@needle-tools/gltf-build-pipeline 3.0.0-alpha → 3.0.0-alpha.2

package/dist/cli/index.js

@@ -1190,7 +1190,7 @@ function registerExtensions(node) {
 import { createTransform } from "@gltf-transform/functions";
 
 // src/utils/version.gen.ts
-var version = "3.0.0-alpha";
+var version = "3.0.0-alpha.2";
 
 // src/utils/version.ts
 function getVersion(_marklocal = !0) {
@@ -3805,7 +3805,7 @@ function resolveConfig(filename, content, logger) {
 }
 
 // src/cli/index.ts
-import { existsSync as existsSync13, readFileSync as readFileSync10, readdirSync as readdirSync3, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync14, readFileSync as readFileSync11, readdirSync as readdirSync3, statSync as statSync7, writeFileSync as writeFileSync7 } from "fs";
 import path7, { basename as basename4, dirname as dirname8, resolve as resolve3 } from "path";
 
 // src/constants.ts
@@ -3901,7 +3901,7 @@ function trackPipelineEnd(info) {
 }
 
 // src/auth/verify.ts
-import { jwtVerify, importJWK } from "jose";
+import { jwtVerify, importJWK, decodeProtectedHeader } from "jose";
 
 // src/auth/keys.ts
 var PROD_KEYS = [
@@ -3922,56 +3922,92 @@ var PROD_KEYS = [
 var trusted = [...PROD_KEYS], TRUSTED_KEYS = trusted;
 
 // src/auth/verify.ts
+import { readFileSync as readFileSync10, existsSync as existsSync13 } from "fs";
+import { join as join8 } from "path";
+import { homedir } from "os";
 var AuthError = class extends Error {
   constructor(message) {
     super(message), this.name = "AuthError";
   }
-};
+}, LOCAL_FETCH_TIMEOUT_MS = 2e3;
+function getLocalServerToken() {
+  try {
+    let file = join8(homedir(), ".needle", "local-server-token");
+    if (!existsSync13(file)) return null;
+    let data = JSON.parse(readFileSync10(file, "utf-8"));
+    return typeof data.token == "string" ? data.token : null;
+  } catch {
+    return null;
+  }
+}
+async function tryFetchLocalToken(org) {
+  try {
+    let baseUrl = process.env.NEEDLE_LICENSE_SERVER_URL || "http://localhost:8424/api/license", url = new URL(baseUrl);
+    org && url.searchParams.set("org", org);
+    let headers = {}, serverToken = getLocalServerToken();
+    serverToken && (headers.Authorization = `Bearer ${serverToken}`);
+    let res = await fetch(url, {
+      signal: AbortSignal.timeout(LOCAL_FETCH_TIMEOUT_MS),
+      headers
+    });
+    if (!res.ok) return null;
+    let jwt = (await res.json()).needle_license_jwt;
+    return typeof jwt == "string" && jwt.length > 0 ? jwt : null;
+  } catch {
+    return null;
+  }
+}
+async function verifyWithKey(token, key) {
+  if (!key.alg) throw new AuthError(`trusted key '${key.kid ?? "?"}' is missing 'alg'`);
+  let keyObj = await importJWK(key, key.alg);
+  await jwtVerify(token, keyObj);
+}
 async function verifyAuthToken(token) {
   if (!token)
     throw new AuthError("no token provided");
   if (token.startsWith("nc_"))
     throw new AuthError("NEEDLE_CLOUD_TOKEN is a needle-cloud access token (nc_*), not a JWT.");
   try {
-    await jwtVerify(token, async (header) => {
-      if (!header.kid)
-        throw new AuthError("token header missing 'kid'");
+    let header = decodeProtectedHeader(token);
+    if (header.kid) {
       let match = TRUSTED_KEYS.find((k) => k.kid === header.kid);
       if (!match)
         throw new AuthError(`token signed by unknown key '${header.kid}'`);
-      if (!match.alg)
-        throw new AuthError(`trusted key '${header.kid}' is missing 'alg'`);
-      return importJWK(match, match.alg);
-    }, {
-      // jose checks `exp` automatically when present; requiredClaims forces
-      // the issuer to include it. A token without `exp` would otherwise
-      // verify as never-expiring.
-      requiredClaims: ["exp"]
-    });
+      await verifyWithKey(token, match);
+    } else {
+      let lastError = null;
+      for (let key of TRUSTED_KEYS)
+        try {
+          await verifyWithKey(token, key);
+          return;
+        } catch (err) {
+          lastError = err;
+        }
+      if (lastError instanceof AuthError) throw lastError;
+      let message = lastError instanceof Error ? lastError.message : String(lastError);
+      throw new AuthError(message || "no trusted key could verify this token");
+    }
   } catch (err) {
     if (err instanceof AuthError) throw err;
-    if (err && typeof err == "object" && "code" in err) {
-      let code = err.code;
-      if (code === "ERR_JWT_EXPIRED")
-        throw new AuthError("token expired");
-      if (code === "ERR_JWT_CLAIM_VALIDATION_FAILED" && "claim" in err && err.claim === "exp")
-        throw new AuthError("token missing 'exp' claim");
-    }
+    if (err && typeof err == "object" && "code" in err && err.code === "ERR_JWT_EXPIRED")
+      throw new AuthError("token expired");
     let message = err instanceof Error ? err.message : String(err);
     throw new AuthError(message);
   }
 }
-async function requireAuth(cliToken) {
+async function requireAuth(cliToken, org) {
   let token = typeof cliToken == "string" && cliToken.length > 0 ? cliToken : process.env.NEEDLE_CLOUD_TOKEN;
-  if (!token)
-    throw new AuthError("pass --auth-token or set NEEDLE_CLOUD_TOKEN");
+  if ((!token || typeof token == "string" && token.length === 0) && (token = await tryFetchLocalToken(org ?? process.env.NEEDLE_CLOUD_ORG)), !token)
+    throw new AuthError(
+      "No valid auth token found. Provide one via --auth-token, NEEDLE_CLOUD_TOKEN env, or log in to the needle-cloud CLI (npx needle-cloud@version-2 start --restart). If you are logged in but still see this error, try updating: npx needle-cloud@version-2 start --restart"
+    );
   await verifyAuthToken(token);
 }
 
 // src/cli/index.ts
-async function gateAuth(authToken, logger) {
+async function gateAuth(authToken, org, logger) {
   try {
-    await requireAuth(authToken);
+    await requireAuth(authToken, typeof org == "string" ? org : void 0);
   } catch (err) {
     let message = err instanceof AuthError || err instanceof Error ? err.message : String(err);
     logger.error(`[Needle Build Pipeline] Auth failed: ${message}`), process.exit(ERROR_CODES.AUTH_FAILED);
@@ -3985,8 +4021,8 @@ Caches are limited to ${cacheSizeLimit} MB disc space by default.
 `).action(async ({ logger }) => {
   logger.info("Clearing caches"), clearCache(logger);
 }).command("stats", "Calculate glTF stats").help(`
-`).argument("<input>", "Path to a glTF, GLB or VRM file OR a directory").argument("<output>", "Output path for the stats", { default: null, validator: program.STRING }).option("--verbose", "Enable verbose output", { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).action(async ({ logger, args, options }) => {
-  await gateAuth(options.authToken, logger), logger.level = options.verbose ? "debug" : "info", await ensureHashReady(), logger.info('Calculating stats for "' + args.input + '"');
+`).argument("<input>", "Path to a glTF, GLB or VRM file OR a directory").argument("<output>", "Output path for the stats", { default: null, validator: program.STRING }).option("--verbose", "Enable verbose output", { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).option("--org <org>", "Organization ID for local license-server fallback (or set NEEDLE_CLOUD_ORG).", { validator: program.STRING }).action(async ({ logger, args, options }) => {
+  await gateAuth(options.authToken, options.org, logger), logger.level = options.verbose ? "debug" : "info", await ensureHashReady(), logger.info('Calculating stats for "' + args.input + '"');
   let input = args.input.toString(), filestats = new Array();
   await foreachGLTF(input, async (file) => {
     let stats = await calculateStats(file, { verbose: !!options.verbose });
@@ -3998,8 +4034,8 @@ Caches are limited to ${cacheSizeLimit} MB disc space by default.
 This will produce multiple versions of the input file, each with a different level of optimization.   
 Each version will be compressed and written to the output directory.
 `).argument("<input>", "The input glTF, GLB or VRM file that should be compressed OR a directory that contains files to be compressed. Multiple files can be separated by commas.", { validator: program.STRING }).argument("<output>", "The output file or directory. It can be an absolute path or a relative path to the input file. If not provided, the input file will be overwritten.", { default: null, validator: program.STRING }).option("--compress", "When enabled files will be compressed", { validator: program.BOOLEAN, default: !0 }).option("--progressive", "When enabled files will processed to be progressively loaded", { validator: program.BOOLEAN, default: !0 }).option("--usecase <usecase>", `The usecase for the compression. This will set the compression settings. Possible options: [${UsecaseOptions.join(", ")}]`, { validator: program.STRING }).option("--config <config>", 'The path to a JSON file containing the compression settings. This can also be a needle.config.json file with a "compression" object or usecase string.', { validator: program.STRING }).option("--cache", `Use "--cache False" to disable caching.
-When caching is enabled then previously processed files will be detected and loaded from disc cache instead of being processed again if settings or the file contents have not changed.`, { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable for more verbose outout with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable for more verbose outout with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).action(async ({ logger, args, options }) => {
-  if (await gateAuth(options.authToken, logger), logger.level = options.debug || options.verbose ? "debug" : "info", options.compress === !1 && options.progressive === !1) {
+When caching is enabled then previously processed files will be detected and loaded from disc cache instead of being processed again if settings or the file contents have not changed.`, { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable for more verbose outout with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable for more verbose outout with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).option("--org <org>", "Organization ID for local license-server fallback (or set NEEDLE_CLOUD_ORG).", { validator: program.STRING }).action(async ({ logger, args, options }) => {
+  if (await gateAuth(options.authToken, options.org, logger), logger.level = options.debug || options.verbose ? "debug" : "info", options.compress === !1 && options.progressive === !1) {
     logger.error(`[Needle Build Pipeline] v${getVersion()} You need to enable at least one of the options: --compress or --progressive`);
     return;
   }
@@ -4027,7 +4063,7 @@ When caching is enabled then previously processed files will be detected and loa
   }
   let set = /* @__PURE__ */ new Set(), useCache = options.cache !== !1, debug = options.debug === !0, verbose = options.verbose === !0;
   await foreachGLTF(inputPaths, async (file) => {
-    if (existsSync13(file)) {
+    if (existsSync14(file)) {
       if (file != input && options.progressive === !0 && isLOD(file)) {
         logger.debug(`\u2192 Ignore existing LOD file at ${file}`);
         return;
@@ -4043,7 +4079,7 @@ When caching is enabled then previously processed files will be detected and loa
       config
     }, file) : void 0;
     if (jobKey) {
-      let outputDir = output ? existsSync13(output) && isDirectory(output) ? output : dirname8(output) : dirname8(file), restored = tryRestoreJobResult(jobKey, outputDir, logger);
+      let outputDir = output ? existsSync14(output) && isDirectory(output) ? output : dirname8(output) : dirname8(file), restored = tryRestoreJobResult(jobKey, outputDir, logger);
       if (restored) {
         let inputFileSize = statSync7(file).size / 1024 / 1024;
         for (let f of restored)
@@ -4116,10 +4152,10 @@ When caching is enabled then previously processed files will be detected and loa
 producing <name>.pmrem.ktx2. This is the same processing the Needle build pipeline
 applies to EXR textures inside GLB/GLTF files, exposed as a standalone command for
 raw .exr / .hdr inputs.
-`).argument("<input>", "Path to a .exr/.hdr file OR a directory containing .exr/.hdr files (recursive)", { validator: program.STRING }).argument("<output>", "Output file (when input is a single .exr/.hdr) or output directory. Defaults to writing next to the input file.", { default: null, validator: program.STRING }).option("--cache", 'Use "--cache False" to disable caching.', { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable verbose output with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable verbose output with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).hide().action(async ({ logger, args, options }) => {
-  await gateAuth(options.authToken, logger), logger.level = options.debug || options.verbose ? "debug" : "info", await ensureHashReady();
+`).argument("<input>", "Path to a .exr/.hdr file OR a directory containing .exr/.hdr files (recursive)", { validator: program.STRING }).argument("<output>", "Output file (when input is a single .exr/.hdr) or output directory. Defaults to writing next to the input file.", { default: null, validator: program.STRING }).option("--cache", 'Use "--cache False" to disable caching.', { validator: program.BOOLEAN, default: !0 }).option("--debug", 'Enable verbose output with "--debug True"', { validator: program.BOOLEAN, default: !1 }).option("--verbose", 'Enable verbose output with "--verbose True"', { validator: program.BOOLEAN, default: !1 }).option("--auth-token <jwt>", "Required. A JWT minted by needle-cloud (alternatively set NEEDLE_CLOUD_TOKEN). Note: an `nc_*` needle-cloud access token is NOT a JWT and will be rejected.", { validator: program.STRING }).option("--org <org>", "Organization ID for local license-server fallback (or set NEEDLE_CLOUD_ORG).", { validator: program.STRING }).hide().action(async ({ logger, args, options }) => {
+  await gateAuth(options.authToken, options.org, logger), logger.level = options.debug || options.verbose ? "debug" : "info", await ensureHashReady();
   let input = args.input.toString();
-  existsSync13(input) || (logger.error(`Input does not exist: ${input}`), process.exit(ERROR_CODES.INVALID_ARGS));
+  existsSync14(input) || (logger.error(`Input does not exist: ${input}`), process.exit(ERROR_CODES.INVALID_ARGS));
   let inputFiles = [], inputIsDirectory = isDirectory(input);
   if (inputIsDirectory ? collectPmremInputFiles(input, inputFiles) : isPmremInputFile(input) ? inputFiles.push(input) : (logger.error(`Input is not an .exr/.hdr file or directory: ${input}`), process.exit(ERROR_CODES.INVALID_ARGS)), inputFiles.length === 0) {
     logger.warn(`No .exr/.hdr files found in ${input}`);
@@ -4138,7 +4174,7 @@ raw .exr / .hdr inputs.
     for (let inPath of inputFiles) {
       let outPath = resolvePmremOutputPath(inPath, input, inputIsDirectory, outputArg);
       logger.info(`\u2192 pmrem ${inPath} \u2192 ${outPath}`);
-      let srcBytes = readFileSync10(inPath), bytes = new Uint8Array(srcBytes.buffer, srcBytes.byteOffset, srcBytes.byteLength), ktx2Bytes = await (inPath.toLowerCase().endsWith(".hdr") ? convertHdrBytesToPmremKtx2 : convertExrBytesToPmremKtx2)(
+      let srcBytes = readFileSync11(inPath), bytes = new Uint8Array(srcBytes.buffer, srcBytes.byteOffset, srcBytes.byteLength), ktx2Bytes = await (inPath.toLowerCase().endsWith(".hdr") ? convertHdrBytesToPmremKtx2 : convertExrBytesToPmremKtx2)(
         runtime,
         bytes,
         { useCache, logLabel: `pmrem ${basename4(inPath)}` }
@@ -4169,7 +4205,7 @@ function resolvePmremOutputPath(srcPath, input, inputIsDirectory, outputArg) {
     let rel = path7.relative(input, srcPath), relDir = dirname8(rel), outDir = relDir === "." ? outputArg : path7.join(outputArg, relDir);
     return ensureIsDirectory(outDir), path7.join(outDir, outName);
   }
-  return existsSync13(outputArg) && isDirectory(outputArg) ? path7.join(outputArg, outName) : outputArg.toLowerCase().endsWith(".ktx2") ? (ensureIsDirectory(dirname8(outputArg)), outputArg) : (ensureIsDirectory(outputArg), path7.join(outputArg, outName));
+  return existsSync14(outputArg) && isDirectory(outputArg) ? path7.join(outputArg, outName) : outputArg.toLowerCase().endsWith(".ktx2") ? (ensureIsDirectory(dirname8(outputArg)), outputArg) : (ensureIsDirectory(outputArg), path7.join(outputArg, outName));
 }
 program.run().catch((err) => {
   if (!(err.message.includes("Unknown command") && !err.message.includes("Did you mean")))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@needle-tools/gltf-build-pipeline",
-  "version": "3.0.0-alpha",
+  "version": "3.0.0-alpha.2",
   "description": "Pipeline and tools for optimizing gltf files using gltf-transform and compression settings within glTF extensions",
   "type": "module",
   "exports": {