@needle-tools/gltf-build-pipeline 3.0.0-alpha → 3.0.0-alpha.1

package/dist/cli/index.js

@@ -1190,7 +1190,7 @@ function registerExtensions(node) {
 import { createTransform } from "@gltf-transform/functions";
 
 // src/utils/version.gen.ts
-var version = "3.0.0-alpha";
+var version = "3.0.0-alpha.1";
 
 // src/utils/version.ts
 function getVersion(_marklocal = !0) {
@@ -3901,7 +3901,7 @@ function trackPipelineEnd(info) {
 }
 
 // src/auth/verify.ts
-import { jwtVerify, importJWK } from "jose";
+import { jwtVerify, importJWK, decodeProtectedHeader } from "jose";
 
 // src/auth/keys.ts
 var PROD_KEYS = [
@@ -3926,52 +3926,72 @@ var AuthError = class extends Error {
   constructor(message) {
     super(message), this.name = "AuthError";
   }
-};
+}, LOCAL_FETCH_TIMEOUT_MS = 2e3;
+async function tryFetchLocalToken(org) {
+  try {
+    let baseUrl = process.env.NEEDLE_LICENSE_SERVER_URL || "http://localhost:8424/api/license", url = new URL(baseUrl);
+    org && url.searchParams.set("org", org);
+    let res = await fetch(url, {
+      signal: AbortSignal.timeout(LOCAL_FETCH_TIMEOUT_MS)
+    });
+    if (!res.ok) return null;
+    let jwt = (await res.json()).needle_license_jwt;
+    return typeof jwt == "string" && jwt.length > 0 ? jwt : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyWithKey(token, key) {
+  if (!key.alg) throw new AuthError(`trusted key '${key.kid ?? "?"}' is missing 'alg'`);
+  let keyObj = await importJWK(key, key.alg);
+  await jwtVerify(token, keyObj);
+}
 async function verifyAuthToken(token) {
   if (!token)
     throw new AuthError("no token provided");
   if (token.startsWith("nc_"))
     throw new AuthError("NEEDLE_CLOUD_TOKEN is a needle-cloud access token (nc_*), not a JWT.");
   try {
-    await jwtVerify(token, async (header) => {
-      if (!header.kid)
-        throw new AuthError("token header missing 'kid'");
+    let header = decodeProtectedHeader(token);
+    if (header.kid) {
       let match = TRUSTED_KEYS.find((k) => k.kid === header.kid);
       if (!match)
         throw new AuthError(`token signed by unknown key '${header.kid}'`);
-      if (!match.alg)
-        throw new AuthError(`trusted key '${header.kid}' is missing 'alg'`);
-      return importJWK(match, match.alg);
-    }, {
-      // jose checks `exp` automatically when present; requiredClaims forces
-      // the issuer to include it. A token without `exp` would otherwise
-      // verify as never-expiring.
-      requiredClaims: ["exp"]
-    });
+      await verifyWithKey(token, match);
+    } else {
+      let lastError = null;
+      for (let key of TRUSTED_KEYS)
+        try {
+          await verifyWithKey(token, key);
+          return;
+        } catch (err) {
+          lastError = err;
+        }
+      if (lastError instanceof AuthError) throw lastError;
+      let message = lastError instanceof Error ? lastError.message : String(lastError);
+      throw new AuthError(message || "no trusted key could verify this token");
+    }
   } catch (err) {
     if (err instanceof AuthError) throw err;
-    if (err && typeof err == "object" && "code" in err) {
-      let code = err.code;
-      if (code === "ERR_JWT_EXPIRED")
-        throw new AuthError("token expired");
-      if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && "claim" in err && err.claim === "exp")
-        throw new AuthError("token missing 'exp' claim");
-    }
+    if (err && typeof err == "object" && "code" in err && err.code === "ERR_JWT_EXPIRED")
+      throw new AuthError("token expired");
     let message = err instanceof Error ? err.message : String(err);
     throw new AuthError(message);
   }
 }
-async function requireAuth(cliToken) {
+async function requireAuth(cliToken, org) {
   let token = typeof cliToken == "string" && cliToken.length > 0 ? cliToken : process.env.NEEDLE_CLOUD_TOKEN;
-  if (!token)
-    throw new AuthError("pass --auth-token or set NEEDLE_CLOUD_TOKEN");
+  if ((!token || typeof token == "string" && token.length === 0) && (token = await tryFetchLocalToken(org ?? process.env.NEEDLE_CLOUD_ORG)), !token)
+    throw new AuthError(
+      "No valid auth token found. Provide one via --auth-token, NEEDLE_CLOUD_TOKEN env, or log in to the needle-cloud CLI (npx needle-cloud@version-1 start --restart). If you are logged in but still see this error, try updating: npx needle-cloud@version-1 start --restart"
+    );
   await verifyAuthToken(token);
 }
 
 // src/cli/index.ts
-async function gateAuth(authToken, logger) {
+async function gateAuth(authToken, org, logger) {
   try {
-    await requireAuth(authToken);
+    await requireAuth(authToken, typeof org == "string" ? org : void 0);
   } catch (err) {
     let message = err instanceof AuthError || err instanceof Error ? err.message : String(err);
     logger.error(`[Needle Build Pipeline] Auth failed: ${message}`), process.exit(ERROR_CODES.AUTH_FAILED);
@@ -3985,8 +4005,8 @@ Caches are limited to ${cacheSizeLimit} MB disc space by default.
 `).action(async ({ logger }) => {
   logger.info("Clearing caches"), clearCache(logger);
 }).command("stats", "Calculate glTF stats").help(`
-`).argument("<input>", "Path to a glTF, GLB or VRM file OR a directory").argument("<output>", "Output path for the stats", { default: null, validator: program.STRING }).option("--verbose", "Enable verbose output", { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).action(async ({ logger, args, options }) => {
-  await gateAuth(options.authToken, logger), logger.level = options.verbose ? "debug" : "info", await ensureHashReady(), logger.info('Calculating stats for "' + args.input + '"');
+`).argument("<input>", "Path to a glTF, GLB or VRM file OR a directory").argument("<output>", "Output path for the stats", { default: null, validator: program.STRING }).option("--verbose", "Enable verbose output", { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).option("--org <org>", "Organization ID for local license-server fallback (or set NEEDLE_CLOUD_ORG).", { validator: program.STRING }).action(async ({ logger, args, options }) => {
+  await gateAuth(options.authToken, options.org, logger), logger.level = options.verbose ? "debug" : "info", await ensureHashReady(), logger.info('Calculating stats for "' + args.input + '"');
   let input = args.input.toString(), filestats = new Array();
   await foreachGLTF(input, async (file) => {
     let stats = await calculateStats(file, { verbose: !!options.verbose });
@@ -3998,8 +4018,8 @@ Caches are limited to ${cacheSizeLimit} MB disc space by default.
 This will produce multiple versions of the input file, each with a different level of optimization.   
 Each version will be compressed and written to the output directory.
 `).argument("<input>", "The input glTF, GLB or VRM file that should be compressed OR a directory that contains files to be compressed. Multiple files can be separated by commas.", { validator: program.STRING }).argument("<output>", "The output file or directory. It can be an absolute path or a relative path to the input file. If not provided, the input file will be overwritten.", { default: null, validator: program.STRING }).option("--compress", "When enabled files will be compressed", { validator: program.BOOLEAN, default: !0 }).option("--progressive", "When enabled files will processed to be progressively loaded", { validator: program.BOOLEAN, default: !0 }).option("--usecase <usecase>", `The usecase for the compression. This will set the compression settings. Possible options: [${UsecaseOptions.join(", ")}]`, { validator: program.STRING }).option("--config <config>", 'The path to a JSON file containing the compression settings. This can also be a needle.config.json file with a "compression" object or usecase string.', { validator: program.STRING }).option("--cache", `Use "--cache False" to disable caching.
-When caching is enabled then previously processed files will be detected and loaded from disc cache instead of being processed again if settings or the file contents have not changed.`, { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable for more verbose outout with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable for more verbose outout with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).action(async ({ logger, args, options }) => {
-  if (await gateAuth(options.authToken, logger), logger.level = options.debug || options.verbose ? "debug" : "info", options.compress === !1 && options.progressive === !1) {
+When caching is enabled then previously processed files will be detected and loaded from disc cache instead of being processed again if settings or the file contents have not changed.`, { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable for more verbose outout with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable for more verbose outout with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).option("--org <org>", "Organization ID for local license-server fallback (or set NEEDLE_CLOUD_ORG).", { validator: program.STRING }).action(async ({ logger, args, options }) => {
+  if (await gateAuth(options.authToken, options.org, logger), logger.level = options.debug || options.verbose ? "debug" : "info", options.compress === !1 && options.progressive === !1) {
     logger.error(`[Needle Build Pipeline] v${getVersion()} You need to enable at least one of the options: --compress or --progressive`);
     return;
   }
@@ -4116,8 +4136,8 @@ When caching is enabled then previously processed files will be detected and loa
 producing <name>.pmrem.ktx2. This is the same processing the Needle build pipeline
 applies to EXR textures inside GLB/GLTF files, exposed as a standalone command for
 raw .exr / .hdr inputs.
-`).argument("<input>", "Path to a .exr/.hdr file OR a directory containing .exr/.hdr files (recursive)", { validator: program.STRING }).argument("<output>", "Output file (when input is a single .exr/.hdr) or output directory. Defaults to writing next to the input file.", { default: null, validator: program.STRING }).option("--cache", 'Use "--cache False" to disable caching.', { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable verbose output with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable verbose output with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).hide().action(async ({ logger, args, options }) => {
-  await gateAuth(options.authToken, logger), logger.level = options.debug || options.verbose ? "debug" : "info", await ensureHashReady();
+`).argument("<input>", "Path to a .exr/.hdr file OR a directory containing .exr/.hdr files (recursive)", { validator: program.STRING }).argument("<output>", "Output file (when input is a single .exr/.hdr) or output directory. Defaults to writing next to the input file.", { default: null, validator: program.STRING }).option("--cache", 'Use "--cache False" to disable caching.', { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable verbose output with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable verbose output with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).option("--org <org>", "Organization ID for local license-server fallback (or set NEEDLE_CLOUD_ORG).", { validator: program.STRING }).hide().action(async ({ logger, args, options }) => {
+  await gateAuth(options.authToken, options.org, logger), logger.level = options.debug || options.verbose ? "debug" : "info", await ensureHashReady();
   let input = args.input.toString();
   existsSync13(input) || (logger.error(`Input does not exist: ${input}`), process.exit(ERROR_CODES.INVALID_ARGS));
   let inputFiles = [], inputIsDirectory = isDirectory(input);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@needle-tools/gltf-build-pipeline",
-  "version": "3.0.0-alpha",
+  "version": "3.0.0-alpha.1",
   "description": "Pipeline and tools for optimizing gltf files using gltf-transform and compression settings within glTF extensions",
   "type": "module",
   "exports": {