@needle-tools/engine 5.1.1 → 5.1.2

package/plugins/vite/license.js

@@ -49,12 +49,12 @@ export function needleLicense(command, config, userSettings) {
                 let modified = false;
 
                 // Replace license type
-                const index = src.indexOf("__cOctKuk");
+                const index = src.indexOf("__UoF");
                 if (index >= 0) {
                     const end = src.indexOf(";", index);
                     if (end >= 0) {
                         const line = src.substring(index, end);
-                        const replaced = "__cOctKuk = \"" + licenseResult.type + "\"";
+                        const replaced = "__UoF = \"" + licenseResult.type + "\"";
                         src = src.replace(line, replaced);
                         modified = true;
                     }
@@ -62,12 +62,12 @@ export function needleLicense(command, config, userSettings) {
 
                 // Replace license JWT (same pattern)
                 if (licenseResult.jwt) {
-                    const jwtIndex = src.indexOf("$nKsEYz");
+                    const jwtIndex = src.indexOf("_nMW");
                     if (jwtIndex >= 0) {
                         const jwtEnd = src.indexOf(";", jwtIndex);
                         if (jwtEnd >= 0) {
                             const jwtLine = src.substring(jwtIndex, jwtEnd);
-                            const jwtReplaced = "$nKsEYz = \"" + licenseResult.jwt + "\"";
+                            const jwtReplaced = "_nMW = \"" + licenseResult.jwt + "\"";
                             src = src.replace(jwtLine, jwtReplaced);
                             modified = true;
                         }

package/src/engine/api.ts

@@ -230,7 +230,7 @@ export * from "./engine_input.js";
 export { InstancingUtil } from "./engine_instancing.js";
 
 /** License checking utilities */
-export { $Mhcqc, $uRk, __dSkNu } from "./engine_license.js";
+export { Jkdun, _$apSvAt, _hyjgv } from "./engine_license.js";
 
 
 // ============================================================================

package/src/engine/engine_init.ts

@@ -8,7 +8,7 @@ import { initBuiltinTypes } from "./codegen/register_types.js";
 import { initSpatialConsole } from "./debug/debug_spatial_console.js";
 import { initAddressableSerializers } from "./engine_addressables.js";
 import { ensureAudioContextIsResumed } from "./engine_audio.js";
-import { _KGv } from "./engine_license.js";
+import { __NjkWq } from "./engine_license.js";
 import { initNeedleLoader } from "./engine_loaders.js";
 import { initPhysics } from "./engine_physics_rapier.js";
 import { initBuiltinSerializers } from "./engine_serialization_builtin_serializer.js";
@@ -59,7 +59,7 @@ export function initEngine() {
     initPhysics();
     initXR();
     initSpatialConsole();
-    _KGv();
+    __NjkWq();
 
     // Must be last. customElements.define() upgrades existing <needle-engine>
     // elements synchronously, which can trigger context.create() and dispatch

package/src/engine/engine_license.ts

@@ -5,23 +5,23 @@ import { isLocalNetwork } from "./engine_networking_utils.js";
 import { Context } from "./engine_setup.js";
 import { SSR } from "./engine_ssr.js";
 import type { IContext } from "./engine_types.js";
-import { getParam } from "./engine_utils.js";
+import { DeviceUtilities, getParam } from "./engine_utils.js";
 
 const debug = getParam("__debuglic__");
 
-const _gsLyleQ: ((result: boolean) => void)[] = [];
+const _MYuNVg: ((result: boolean) => void)[] = [];
 
 // DO NOT EDIT MANUALLY
-let __cOctKuk: string = "";
+let __UoF: string = "";
 // eslint-disable-next-line prefer-const
-let $nKsEYz: string = "";
+let _nMW: string = "";
 
 if (debug) {
-    console.log("License Type: " + __cOctKuk);
-    if ($nKsEYz) {
-        console.log("License JWT: " + $nKsEYz);
+    console.log("License Type: " + __UoF);
+    if (_nMW) {
+        console.log("License JWT: " + _nMW);
         try {
-            const payload = JSON.parse(atob($nKsEYz.split(".")[1].replace(/-/g, '+').replace(/_/g, '/')));
+            const payload = JSON.parse(atob(_nMW.split(".")[1].replace(/-/g, '+').replace(/_/g, '/')));
             console.log("License JWT payload:", payload);
         }
         catch { console.log("License JWT payload: (failed to decode)"); }
@@ -32,8 +32,8 @@ if (debug) {
 }
 
 /** @internal */
-export function __dSkNu() {
-    switch (__cOctKuk) {
+export function _hyjgv() {
+    switch (__UoF) {
         case "pro":
         case "enterprise":
             return true;
@@ -42,8 +42,8 @@ export function __dSkNu() {
 }
 
 /** @internal */
-export function $uRk() {
-    switch (__cOctKuk) {
+export function _$apSvAt() {
+    switch (__UoF) {
         case "indie":
             return true;
     }
@@ -51,8 +51,8 @@ export function $uRk() {
 }
 
 /** @internal */
-export function _ndIg() {
-    switch (__cOctKuk) {
+export function _KXivjkV() {
+    switch (__UoF) {
         case "edu":
             return true;
     }
@@ -60,20 +60,20 @@ export function _ndIg() {
 }
 
 /** @internal */
-export function $Mhcqc() {
-    return __dSkNu() || $uRk() || _ndIg();
+export function Jkdun() {
+    return _hyjgv() || _$apSvAt() || _KXivjkV();
 }
 
 
 /** @internal */
-export function _ynyIW(cb: (result: boolean) => void) {
-    if (__dSkNu() || $uRk() || _ndIg())
+export function qWc(cb: (result: boolean) => void) {
+    if (_hyjgv() || _$apSvAt() || _KXivjkV())
         return cb(true);
-    _gsLyleQ.push(cb);
+    _MYuNVg.push(cb);
 }
 
-function $hVWu(result: boolean) {
-    for (const cb of _gsLyleQ) {
+function _$OGB(result: boolean) {
+    for (const cb of _MYuNVg) {
         try {
             cb(result);
         }
@@ -88,7 +88,7 @@ function $hVWu(result: boolean) {
 
 // ECDSA P-256 public key for verifying license JWTs (verification-only, safe to ship)
 /* eslint-disable no-secrets/no-secrets -- public key, not a secret */
-const $OabY = {
+const $WYAmrK = {
     kty: "EC",
     crv: "P-256",
     x: "A34nyKMjhQYVgzeE4tyLUYdx34TAKogDa7v7PRaO9Lg",
@@ -112,7 +112,7 @@ function base64urlDecode(str: string): Uint8Array {
  * Verify a JWT license token and return the `type` claim if valid.
  * Returns null if the JWT is missing, malformed, or has an invalid signature.
  */
-async function $OBR(jwt: string): Promise<string | null> {
+async function _fAd(jwt: string): Promise<string | null> {
     if (!jwt) return null;
     try {
         const parts = jwt.split(".");
@@ -122,7 +122,7 @@ async function $OBR(jwt: string): Promise<string | null> {
 
         const key = await crypto.subtle.importKey(
             "jwk",
-            $OabY,
+            $WYAmrK,
             { name: "ECDSA", namedCurve: "P-256" },
             false,
             ["verify"]
@@ -182,24 +182,24 @@ async function $OBR(jwt: string): Promise<string | null> {
 }
 
 /** Verify the injected JWT and update the license type if valid.
- * The engine ONLY trusts the JWT — the plain __cOctKuk string is ignored. */
+ * The engine ONLY trusts the JWT — the plain __UoF string is ignored. */
 let _jwtVerificationPromise: Promise<void> | undefined = undefined;
-async function _$DyIqexB(): Promise<void> {
-    // NOTE: do NOT add an `if (!$nKsEYz) return` guard here.
+async function _mGi(): Promise<void> {
+    // NOTE: do NOT add an `if (!_nMW) return` guard here.
     // esbuild (Vite dependency pre-bundling) would see the variable as constant ""
     // and tree-shake the entire JWT verification code path.
-    const jwt = $nKsEYz;
+    const jwt = _nMW;
     // Clear after reading — this reassignment also prevents esbuild from
     // constant-folding the variable (it now has multiple assignment sites).
-    $nKsEYz = "";
-    const verifiedType = await $OBR(jwt);
+    _nMW = "";
+    const verifiedType = await _fAd(jwt);
     if (verifiedType) {
-        __cOctKuk = verifiedType;
+        __UoF = verifiedType;
         if (debug) console.log("License type set from verified JWT: " + verifiedType);
-        $hVWu($Mhcqc());
+        _$OGB(Jkdun());
     }
     else {
-        __cOctKuk = "basic";
+        __UoF = "basic";
         if (debug && jwt) console.warn("JWT verification failed — license reset to basic");
     }
 }
@@ -269,12 +269,13 @@ export namespace Telemetry {
         if (!domElement) domElement = document.querySelector<HTMLElement>("needle-engine");
         if (!domElement && !context) return false;
 
+        // The no-telemetry attribute opts out of all telemetry for every license tier.
+        // NOTE: this does NOT affect license enforcement — the /check call, the "forbidden"
+        // overlay and the watermark/logo run on separate, ungated code paths.
         const attribute = domElement?.getAttribute("no-telemetry");
         if (attribute === "" || attribute === "true" || attribute === "1") {
-            if (__cOctKuk === "pro" || __cOctKuk === "enterprise") {
-                if (debug) console.debug("Telemetry is disabled via no-telemetry attribute");
-                return false;
-            }
+            if (debug) console.debug("Telemetry is disabled via no-telemetry attribute");
+            return false;
         }
         return true;
     }
@@ -350,6 +351,190 @@ export namespace Telemetry {
         return doFetch(body);
     }
 
+    /**
+     * Reports a scene load result (success/failure + timings) and, on success, a set of
+     * non-identifying device capability buckets. Fired once per load.
+     * No fingerprinting data (e.g. the unmasked GPU renderer/vendor string) is collected.
+     */
+    export function reportLoad(context: IContext | null | undefined, info: {
+        success: boolean;
+        /** number of glTF/glb files loaded */
+        files: number;
+        /** true if this load replaced an already-loaded scene (e.g. a src swap) rather than a cold start */
+        is_reload: boolean;
+        /** duration of context.create() in ms */
+        load_ms: number;
+        /** time from load start to first rendered frame in ms (success path only) */
+        first_frame_ms?: number;
+        /** time from navigation start to first rendered frame in ms (success path only) */
+        since_navigation_ms?: number;
+        /** failure category when success is false */
+        error?: string;
+    }) {
+        if (!isAllowed(context)) return;
+        const props: Record<string, any> = {
+            action: "load",
+            success: info.success,
+            files: info.files,
+            is_reload: info.is_reload,
+            load_ms: Math.round(info.load_ms),
+        };
+        if (info.error) props.error = info.error;
+        if (info.first_frame_ms !== undefined) props.first_frame_ms = Math.round(info.first_frame_ms);
+        if (info.since_navigation_ms !== undefined) props.since_navigation_ms = Math.round(info.since_navigation_ms);
+        if (info.success) collectCapabilities(context, props);
+        sendEvent(context, "engine", props);
+    }
+
+    /**
+     * Writes non-identifying device capability buckets (graphics API, limits, compressed-texture
+     * support, coarse hardware hints) into the given props object. Deliberately omits the unmasked
+     * GPU renderer/vendor strings so this cannot be used to fingerprint a device.
+     */
+    function collectCapabilities(context: IContext | null | undefined, props: Record<string, any>) {
+        const renderer = context?.renderer;
+        if (!renderer) return;
+        try {
+            if ((renderer as { isWebGPURenderer?: boolean }).isWebGPURenderer === true) {
+                props.api = "webgpu";
+            }
+            else {
+                const gl = renderer.getContext();
+                if (gl) {
+                    const isWebGL2 = typeof WebGL2RenderingContext !== "undefined" && gl instanceof WebGL2RenderingContext;
+                    props.api = isWebGL2 ? "webgl2" : "webgl";
+                    props.max_texture_size = gl.getParameter(gl.MAX_TEXTURE_SIZE);
+                    if (isWebGL2) props.max_samples = gl.getParameter((gl as WebGL2RenderingContext).MAX_SAMPLES);
+                    const formats: string[] = [];
+                    if (gl.getExtension("WEBGL_compressed_texture_astc")) formats.push("astc");
+                    if (gl.getExtension("WEBGL_compressed_texture_etc")) formats.push("etc");
+                    if (gl.getExtension("WEBGL_compressed_texture_s3tc")) formats.push("s3tc");
+                    if (gl.getExtension("WEBGL_compressed_texture_pvrtc")) formats.push("pvrtc");
+                    if (formats.length) props.compression = formats.join(",");
+                }
+            }
+            props.dpr = renderer.getPixelRatio();
+            props.is_mobile = DeviceUtilities.isMobileDevice();
+            if (typeof navigator !== "undefined") {
+                if (navigator.hardwareConcurrency) props.cores = navigator.hardwareConcurrency;
+                const deviceMemory = (navigator as { deviceMemory?: number }).deviceMemory;
+                if (typeof deviceMemory === "number") props.device_memory = deviceMemory;
+            }
+        }
+        catch (err) {
+            // Capability probing must never break a load — telemetry is strictly best-effort.
+            if (debug) console.warn("Telemetry: capability probe failed", err);
+        }
+    }
+
+    const _contextLossMonitored = new WeakSet<HTMLCanvasElement>();
+    /**
+     * Attaches WebGL context-loss / -restored listeners to the renderer canvas (once per canvas)
+     * and reports them. Context loss is a real-world GPU crash signal the engine had no visibility
+     * into before.
+     */
+    export function attachContextLossMonitor(context: IContext | null | undefined) {
+        const canvas = context?.renderer?.domElement;
+        if (!canvas) return;
+        if (_contextLossMonitored.has(canvas)) return;
+        _contextLossMonitored.add(canvas);
+        let lostAt = 0;
+        canvas.addEventListener("webglcontextlost", () => {
+            lostAt = performance.now();
+            sendEvent(context, "engine", {
+                action: "context_lost",
+                since_navigation_ms: Math.round(performance.now()),
+                during_xr: context?.isInXR === true,
+            });
+        });
+        canvas.addEventListener("webglcontextrestored", () => {
+            sendEvent(context, "engine", {
+                action: "context_restored",
+                downtime_ms: lostAt ? Math.round(performance.now() - lostAt) : undefined,
+            });
+        });
+    }
+
+    const _perfMonitored = new WeakSet<object>();
+    /**
+     * Accumulates a lightweight runtime performance summary (FPS, frame time, peak draw calls /
+     * triangles) and reports it once per foreground segment when the page becomes hidden.
+     *
+     * The per-frame work is intentionally allocation-free: it only reads scalars the engine and
+     * three.js already compute every frame (`time.deltaTimeUnscaled`, `renderer.info.render`) and
+     * folds them into running accumulators. No GL state is queried in the loop — querying GL state
+     * per frame would force a synchronous GPU-CPU stall.
+     *
+     * Skipped entirely when telemetry is opted out, so opted-out sessions pay zero overhead.
+     */
+    export function attachPerformanceMonitor(context: IContext | null | undefined) {
+        if (!context) return;
+        // requires a browser page lifecycle (visibilitychange) to know when to flush
+        if (typeof document === "undefined") return;
+        if (_perfMonitored.has(context)) return;
+        // respect the opt-out at attach time → no per-frame work at all for opted-out sessions
+        if (!isAllowed(context)) return;
+        _perfMonitored.add(context);
+
+        let frames = 0;
+        let sumMs = 0;
+        let maxDt = 0; // worst (longest) frame in seconds → drives min_fps / max_frame_ms
+        let peakCalls = 0;
+        let peakTriangles = 0;
+
+        // Hot path: runs every rendered frame. Scalar-only — no allocations, no GL queries.
+        // deltaTimeUnscaled is already clamped to <=100ms upstream, so a backgrounded tab can't
+        // inflate the worst-frame figure.
+        const sample = () => {
+            const dt = context.time.deltaTimeUnscaled;
+            if (dt <= 0) return;
+            frames++;
+            sumMs += dt * 1000;
+            if (dt > maxDt) maxDt = dt;
+            const render = context.renderer?.info?.render;
+            if (render) {
+                if (render.calls > peakCalls) peakCalls = render.calls;
+                if (render.triangles > peakTriangles) peakTriangles = render.triangles;
+            }
+        };
+        context.post_render_callbacks.push(sample);
+
+        const reset = () => { frames = 0; sumMs = 0; maxDt = 0; peakCalls = 0; peakTriangles = 0; };
+        const flush = () => {
+            if (frames <= 0) return;
+            sendEvent(context, "engine", {
+                action: "performance",
+                frames,
+                duration_ms: Math.round(sumMs),
+                avg_fps: Math.round((1000 * frames) / sumMs),
+                min_fps: maxDt > 0 ? Math.round(1 / maxDt) : 0,
+                avg_frame_ms: Math.round((sumMs / frames) * 10) / 10,
+                max_frame_ms: Math.round(maxDt * 1000 * 10) / 10,
+                peak_draw_calls: peakCalls,
+                peak_triangles: peakTriangles,
+            });
+            reset();
+        };
+
+        // visibilitychange→hidden is the last reliably-fired lifecycle event on mobile; pagehide is
+        // a desktop backup. Flushing per hidden transition keeps payloads tiny and survives bfcache.
+        const onVisibility = () => { if (document.visibilityState === "hidden") flush(); };
+        document.addEventListener("visibilitychange", onVisibility);
+        window.addEventListener("pagehide", flush);
+
+        // Clean up listeners + the per-frame callback when this context is destroyed (avoids leaks).
+        const unregisterDestroyed = ContextRegistry.registerCallback(ContextEvent.ContextDestroyed, evt => {
+            if (evt.context !== context) return;
+            flush();
+            document.removeEventListener("visibilitychange", onVisibility);
+            window.removeEventListener("pagehide", flush);
+            const idx = context.post_render_callbacks.indexOf(sample);
+            if (idx >= 0) context.post_render_callbacks.splice(idx, 1);
+            _perfMonitored.delete(context);
+            unregisterDestroyed();
+        });
+    }
+
     function doFetch(body: Record<string, any>) {
         try {
             const url = "https://needle.tools/api/v1/rum/t";
@@ -378,32 +563,37 @@ export namespace Telemetry {
 }
 
 
-export function _KGv() {
+export function __NjkWq() {
 
-    if(__cOctKuk === "") __cOctKuk = "basic";
+    if(__UoF === "") __UoF = "basic";
 
     // Start JWT verification — must be here (not top-level) to avoid tree-shaking
-    _jwtVerificationPromise = _$DyIqexB();
+    _jwtVerificationPromise = _mGi();
 
     Telemetry.init();
     ContextRegistry.registerCallback(ContextEvent.ContextRegistered, evt => {
-        zOvk(evt.context);
-        $QEbT(evt.context);
-        setTimeout(() => __YfC(evt.context), 2000);
+        __BvDhlt(evt.context);
+        __CYPgY(evt.context);
+        setTimeout(() => _$xMafOx(evt.context), 2000);
+    });
+    // ContextCreated fires after the renderer exists, so the canvas is available for context-loss monitoring
+    ContextRegistry.registerCallback(ContextEvent.ContextCreated, evt => {
+        Telemetry.attachContextLossMonitor(evt.context);
+        Telemetry.attachPerformanceMonitor(evt.context);
     });
 }
 
-export let __gpBcwS: Promise<void> | undefined = undefined;
+export let xWfUNf: Promise<void> | undefined = undefined;
 let applicationIsForbidden = false;
 let applicationForbiddenText = "";
-async function $nsBUUjAp() {
+async function jfCsRiC() {
     // Only perform the runtime license check once
-    if (__gpBcwS) return __gpBcwS;
+    if (xWfUNf) return xWfUNf;
     // Wait for JWT verification to complete first (if running)
     if (_jwtVerificationPromise) {
         await _jwtVerificationPromise;
     }
-    if (__cOctKuk === "basic") {
+    if (__UoF === "basic") {
         try {
             const licenseUrl = "https://needle.tools/api/v1/needle-engine/check?location=" + encodeURIComponent(window.location.href) + "&version=" + VERSION + "&generator=" + encodeURIComponent(GENERATOR);
             const res = await fetch(licenseUrl, {
@@ -415,29 +605,29 @@ async function $nsBUUjAp() {
             if (res?.status === 200) {
                 applicationIsForbidden = false;
                 if (debug) console.log("License check succeeded");
-                __cOctKuk = "pro";
-                $hVWu(true);
+                __UoF = "pro";
+                _$OGB(true);
             }
             else if (res?.status === 403) {
-                $hVWu(false);
+                _$OGB(false);
                 applicationIsForbidden = true;
                 applicationForbiddenText = await res.text();
             }
             else {
-                $hVWu(false);
+                _$OGB(false);
                 if (debug) console.log("License check failed with status " + res?.status);
             }
         }
         catch (err) {
-            $hVWu(false);
+            _$OGB(false);
             if (debug) console.error("License check failed", err);
         }
     }
-    else if (debug) console.log("Runtime license check is skipped because license is already applied as \"" + __cOctKuk + "\"");
+    else if (debug) console.log("Runtime license check is skipped because license is already applied as \"" + __UoF + "\"");
 }
-__gpBcwS = $nsBUUjAp();
+xWfUNf = jfCsRiC();
 
-async function $QEbT(ctx: IContext) {
+async function __CYPgY(ctx: IContext) {
     function createForbiddenElement() {
         const div = document.createElement("div");
         div.className = "needle-forbidden";
@@ -502,40 +692,40 @@ async function $QEbT(ctx: IContext) {
     }, 500)
 }
 
-async function zOvk(ctx: IContext) {
+async function __BvDhlt(ctx: IContext) {
     try {
-        if (!__dSkNu() && !$uRk()) {
-            return _kSwtWJd(ctx);
+        if (!_hyjgv() && !_$apSvAt()) {
+            return _HlRd(ctx);
         }
     }
     catch (err) {
         if (debug) console.log("License check failed", err)
-        return _kSwtWJd(ctx)
+        return _HlRd(ctx)
     }
-    if (debug) _kSwtWJd(ctx)
+    if (debug) _HlRd(ctx)
 }
 
 
 
-async function _kSwtWJd(ctx: IContext) {
+async function _HlRd(ctx: IContext) {
 
     // if the engine loads faster than the license check, we need to capture the ready event here
     let isReady = false;
     ctx.domElement.addEventListener("ready", () => isReady = true);
 
-    await __gpBcwS?.catch(() => { });
+    await xWfUNf?.catch(() => { });
 
 
-    if (__dSkNu() || $uRk()) return;
-    if ($Mhcqc() === false) _$xDkZm();
+    if (_hyjgv() || _$apSvAt()) return;
+    if (Jkdun() === false) IUY();
 
     // check if the engine is already ready (meaning has finished loading)
     if (isReady) {
-        $Vzv(ctx);
+        bdcF(ctx);
     }
     else {
         ctx.domElement.addEventListener("ready", () => {
-            $Vzv(ctx);
+            bdcF(ctx);
         });
     }
 }
@@ -543,7 +733,7 @@ async function _kSwtWJd(ctx: IContext) {
 // const licenseElementIdentifier = "needle-license-element";
 // const licenseDuration = 10000;
 // const licenseDelay = 1200;
-function $Vzv(ctx: IContext) {
+function bdcF(ctx: IContext) {
 
     const style = `
         position: relative;
@@ -556,7 +746,7 @@ function $Vzv(ctx: IContext) {
         padding: 10px;
         padding-left: 30px;
     `;
-    if (__cOctKuk === "edu") {
+    if (__UoF === "edu") {
         if (navigator.webdriver) {
             console.log("This project is supported by Needle for Education – https://needle.tools");
         }
@@ -613,7 +803,7 @@ function $Vzv(ctx: IContext) {
         }
     }, 1000);
 
-    if (_ndIg()) {
+    if (_KXivjkV()) {
         const removeDelay = 20_000;
         setTimeout(() => {
             clearInterval(interval);
@@ -622,7 +812,7 @@ function $Vzv(ctx: IContext) {
             const intervalInMinutes = 5;
             setTimeout(() => {
                 if (ctx.domElement.parentNode)
-                    $Vzv(ctx);
+                    bdcF(ctx);
             }, 1000 * 60 * intervalInMinutes)
         }, removeDelay);
     }
@@ -633,7 +823,7 @@ function $Vzv(ctx: IContext) {
 const base64Logo = "data:image/webp;base64,UklGRrABAABXRUJQVlA4WAoAAAAQAAAAHwAAHwAAQUxQSKEAAAARN6CmbSM4WR7vdARON11EBDq3fLiNbVtVzpMCPlKAEzsx0Y/x+Ovuv4dn0EFE/ydAvz6YggXzgh5sVgXM/zOC/4sii7qgGvB5N7hmuQYwkvazWAu1JPW41FXSHq6pnaQWvqYH18Fc0j1hO/BFTtIeSBlJi5w6qIIO7IOrwhFsB2Yxukif0FTRLpXswHR8MxbslKe9VZsn/Ub5C7YFOpqSTABWUDgg6AAAAFAGAJ0BKiAAIAA+7VyoTqmkpCI3+qgBMB2JbACdMt69DwMIQBLhkTO6XwY00UEDK6cNIDnuNibPf0EgAP7Y1myuiQHLDsF/0h5unrGh6WAbv7aegg2ZMd3uRKfT/3SJztcaujYfTvMXspfCTmYcoO6a+vhC3ss4M8uM58t4siiu59I4aOl59e9Sr6xoxYlHf2v+NnBNpJYeJf8jABQAId/PXuBkLEFkiCucgSGEcfhvajql/j3reCGl0M5/9gQWy7ayNPs+wlvIxFnNfSlfuND4CZOCyxOHhRqOmHN4ULHo3tCSrUNvgAA=";
 
 let lastLogTime = 0;
-async function _$xDkZm(_logo?: string) {
+async function IUY(_logo?: string) {
     const now = Date.now();
     if (now - lastLogTime < 2000) return;
     lastLogTime = now;
@@ -666,7 +856,7 @@ async function _$xDkZm(_logo?: string) {
 }
 
 
-async function __YfC(context: IContext) {
+async function _$xMafOx(context: IContext) {
     // We can't send beacons from cross-origin isolated pages
     if (window.crossOriginIsolated) return;
 
@@ -681,7 +871,7 @@ async function __YfC(context: IContext) {
 
             // current url without query parameters
             const currentUrl = window.location.href.split("?")[0];
-            const license = __cOctKuk;
+            const license = __UoF;
 
             const beaconData = {
                 license,

package/src/engine/engine_networking.ts

@@ -357,6 +357,11 @@ export class OwnershipModel {
      */
     public freeOwnership(): OwnershipModel {
         // TODO: abort "requestOwnershipIfNotOwned"
+        // Only the current owner may release ownership. Otherwise a non-owner (e.g. a remote client whose
+        // copy of the object gets deactivated) would tell the server to drop the *real* owner's claim,
+        // silently breaking sync for everyone.
+        if (!this._hasOwnership) return this;
+        this._hasOwnership = false;
         this.connection.send(OwnershipEvent.RemoveOwnership, { guid: this.guid });
         if (this._isWaitingForOwnershipResponseCallback) {
             this.connection.stopListen(OwnershipEvent.ResponseHasOwner, this._isWaitingForOwnershipResponseCallback);

package/src/engine/engine_networking_blob.ts

@@ -1,7 +1,7 @@
 import { FileLoader } from "three";
 
 import { showBalloonWarning } from "./debug/index.js";
-import { $Mhcqc } from "./engine_license.js";
+import { Jkdun } from "./engine_license.js";
 import { delay } from "./engine_utils.js";
 import { md5AsBytes, md5Hex, sha256Base64 } from "./engine_utils_hash.js";
 
@@ -45,7 +45,7 @@ export namespace BlobStorage {
      */
     export function canUpload(info: { filesize: number }) {
         const sizeInMB = info.filesize / 1024 / 1024;
-        if ($Mhcqc()) {
+        if (Jkdun()) {
             return sizeInMB < maxSizeInMB;
         }
         return sizeInMB < maxFreeSizeInMB;
@@ -100,7 +100,7 @@ export namespace BlobStorage {
             console.warn(`Your file is too large for uploading (${filesizeInMB.toFixed(1)}MB). Max allowed size is ${maxSizeInMB}MB`);
             return null;
         }
-        else if (!$Mhcqc() && filesizeInMB > maxFreeSizeInMB) {
+        else if (!Jkdun() && filesizeInMB > maxFreeSizeInMB) {
             if (opts?.silent !== true) showBalloonWarning(`File is too large for uploading. Please get a <a href=\"https://needle.tools/pricing\" target=\"_blank\">commercial license</a> to upload files larger than 5MB`);
             console.warn(`Your file is too large for uploading (${filesizeInMB.toFixed(1)}MB). Max size is 5MB for non-commercial users. Please get a commercial license at https://needle.tools/pricing for larger files (up to 50MB)`);
             return null;