@tldraw/editor 5.6.0 → 5.7.0-canary.071f910ee80b

package/src/lib/license/LicenseManager.test.ts

@@ -760,6 +760,37 @@ describe('LicenseManager', () => {
 			}
 		})
 
+		it('Licenses our VS Code extension webview when no key is provided', async () => {
+			const manager = await createManagerOnHost(
+				'vscode-webview://1ipd8pun8ud7nd7hv9d112g7evi7m10vak9vviuvia66ou6aibp3/index.html?id=6ec2dc7a-afe9-45d9-bd71-1749f9568d28&swVersion=4&extensionId=tldraw-org.tldraw-vscode&platform=electron'
+			)
+
+			expect(await manager.getLicenseFromKey('')).toMatchObject({
+				isLicenseParseable: true,
+				isDomainValid: true,
+				isLicensedWithWatermark: true,
+			})
+			expect(manager.state.get()).toBe('licensed-with-watermark')
+			manager.dispose()
+		})
+
+		it('Does not license other VS Code extension webviews', async () => {
+			const urls = [
+				'vscode-webview://abc/index.html?extensionId=evil-org.evil-vscode&x=tldraw-org.tldraw-vscode',
+				'vscode-webview://tldraw-org.tldraw-vscode/index.html?extensionId=evil-org.evil-vscode',
+			]
+
+			for (const url of urls) {
+				const manager = await createManagerOnHost(url)
+
+				expect(await manager.getLicenseFromKey('')).toMatchObject({
+					isLicenseParseable: false,
+					reason: 'no-key-provided',
+				})
+				manager.dispose()
+			}
+		})
+
 		it('Never sends a watermark tracking ping for our own domains', async () => {
 			const manager = await createManagerOnHost('https://makereal.tldraw.com')
 

package/src/lib/license/LicenseManager.ts

@@ -59,6 +59,9 @@ const CANONICAL_TLDRAW_HOSTS = [
 	'tldraw.xyz',
 ]
 
+/** Our VS Code extension, whose webviews are served from `vscode-webview:` with a random hostname. */
+const CANONICAL_VSCODE_EXTENSION_ID = 'tldraw-org.tldraw-vscode'
+
 /** Marks a license as the keyless canonical-host grant, which is never tracked. */
 const CANONICAL_HOST_LICENSE_ID = 'tldraw-canonical-host'
 
@@ -237,8 +240,12 @@ export class LicenseManager {
 		return host === 'localhost' || host === '::1' || /^127(?:\.\d{1,3}){3}$/.test(host)
 	}
 
-	/** Whether the page is served from one of tldraw's own domains, or a subdomain of one. */
+	/** Whether the page is served from one of tldraw's own domains, a subdomain of one, or our VS Code extension. */
 	private isCanonicalTldrawHost() {
+		if (window.location.protocol === 'vscode-webview:') {
+			const extensionId = new URL(window.location.href).searchParams.get('extensionId')
+			return extensionId === CANONICAL_VSCODE_EXTENSION_ID
+		}
 		const hostname = window.location.hostname.toLowerCase()
 		return CANONICAL_TLDRAW_HOSTS.some((host) => hostname === host || hostname.endsWith(`.${host}`))
 	}

package/src/version.ts

@@ -1,9 +1,9 @@
 // This file is automatically generated by internal/scripts/refresh-assets.ts.
 // Do not edit manually. Or do, I'm a comment, not a cop.
 
-export const version = '5.6.0'
+export const version = '5.7.0-canary.071f910ee80b'
 export const publishDates = {
 	major: '2026-05-06T16:28:18.473Z',
-	minor: '2026-10-28T14:20:57.238Z',
-	patch: '2026-10-28T14:20:57.238Z',
+	minor: '2026-11-03T19:11:29.223Z',
+	patch: '2026-11-03T19:11:29.223Z',
 }