@triforge/shader-core 0.1.1 → 0.2.0

package/dist/bundle.js

@@ -247,6 +247,24 @@ var InputNode = class extends ShaderNode {
   }
 };
 
+// src/core/glslIdentifier.ts
+var GLSL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isValidGlslIdentifier(name) {
+  if (typeof name !== "string") return false;
+  if (!GLSL_IDENTIFIER.test(name)) return false;
+  if (name.startsWith("gl_")) return false;
+  if (name.includes("__")) return false;
+  return true;
+}
+function assertGlslIdentifier(name, context) {
+  if (!isValidGlslIdentifier(name)) {
+    throw new Error(
+      `[st-shader-core] ${context}: "${String(name)}" is not a valid GLSL identifier. Only letters, digits and single underscores are allowed (must start with a letter or underscore, may not start with "gl_" or contain "__"). This guards against GLSL injection.`
+    );
+  }
+  return name;
+}
+
 // src/core/CompileContext.ts
 var CompileContext = class _CompileContext {
   constructor() {
@@ -290,7 +308,14 @@ var CompileContext = class _CompileContext {
    */
   resolveInput(socket) {
     if (socket.connection) {
-      return this.outputVar(socket.connection.node, socket.connection.name);
+      const varName = this.outputVar(socket.connection.node, socket.connection.name);
+      if (socket.type === "vector" && socket.connection.type !== "vector") {
+        return `(${varName}).xy`;
+      }
+      if (socket.type === "color" && socket.connection.type === "vector") {
+        return `vec3(${varName}, 0.0)`;
+      }
+      return varName;
     }
     if (socket.uniformName !== null) {
       if (!(socket.uniformName in this._uniforms)) {
@@ -337,6 +362,8 @@ var CompileContext = class _CompileContext {
       const call = node.compileCall(this).trim();
       if (call) this.calls.push(call);
       for (const inj of node.vertexInjections()) {
+        assertGlslIdentifier(inj.attrName, `${node.nodeType} vertex attribute name`);
+        assertGlslIdentifier(inj.varyingName, `${node.nodeType} varying name`);
         if (!this._vertexInjections.has(inj.varyingName)) {
           this._vertexInjections.set(inj.varyingName, { attrName: inj.attrName, attrType: inj.attrType });
         }
@@ -401,6 +428,8 @@ var CompileContext = class _CompileContext {
   typesCompatible(from, to) {
     if (from === to) return true;
     if ((from === "shader" || from === "color") && (to === "shader" || to === "color")) return true;
+    if ((from === "color" || from === "shader") && to === "vector") return true;
+    if (from === "vector" && to === "color") return true;
     return false;
   }
   // ── GLSL builders ─────────────────────────────────────────────────
@@ -784,6 +813,7 @@ var Attribute = class extends InputNode {
     super("Attribute");
     /** 0 = vec3, 1 = float. Stored as number for keyframe/GSAP compat. */
     this.parameters = { attributeType: 0 };
+    assertGlslIdentifier(attributeName, "Attribute name");
     this._safeAttrName = attributeName.replace(/[^a-zA-Z0-9_]/g, "_");
     this.attributeName = attributeName;
     this.parameters.attributeType = attributeType === "float" ? 1 : 0;
@@ -1997,6 +2027,7 @@ var ImageTexture = class extends ProcessNode {
         fix: 'new ImageTexture({ uniformName: "uMyTexture" })\n  After compile(): mat.material.uniforms.uMyTexture = { value: texture }'
       });
     }
+    assertGlslIdentifier(inputs.uniformName, "ImageTexture uniformName");
     this.uniformName = inputs.uniformName;
     this._inputs = this.createInputs(inputs, { vector: ["vector", null] });
     this._outputs = this.createOutputs({ Color: "color", Alpha: "float" });
@@ -2011,7 +2042,7 @@ var ImageTexture = class extends ProcessNode {
     return `uniform sampler2D ${this.uniformName};`;
   }
   compileCall(ctx) {
-    const uv = this._inputs.vector.isConnected() ? ctx.outputVar(this._inputs.vector.connection.node, this._inputs.vector.connection.name) : "vUv";
+    const uv = this._inputs.vector.isConnected() ? ctx.resolveInput(this._inputs.vector) : "vUv";
     const cv = ctx.outputVar(this, "Color");
     const av = ctx.outputVar(this, "Alpha");
     return [
@@ -2043,6 +2074,7 @@ var EnvironmentTexture = class extends ProcessNode {
         fix: 'new EnvironmentTexture({ uniformName: "uEnv" })\n  After compile(): mat.material.uniforms.uEnv = { value: cubeTexture }'
       });
     }
+    assertGlslIdentifier(inputs.uniformName, "EnvironmentTexture uniformName");
     this._uniformName = inputs.uniformName;
     this._inputs = this.createInputs(inputs, {
       vector: ["color", null],
@@ -2621,7 +2653,7 @@ vec3 _st_wavelength(float w) {
 };
 
 // src/nodes/process/NormalMap.ts
-var NormalMap = class extends ProcessNode {
+var NormalMap = class _NormalMap extends ProcessNode {
   get nodeType() {
     return "NormalMap";
   }
@@ -2634,19 +2666,35 @@ var NormalMap = class extends ProcessNode {
       category: "Vector",
       color: "#4a3a8a",
       cost: "medium",
-      costNote: "Samples input Fac four times for gradient computation."
+      costNote: "Builds a derivative-based TBN frame per fragment."
     };
   }
   static {
     this.glslFunction = `
-vec3 _st_normalMap(float fac, float strength) {
-  return vec3(0.0, 1.0, 0.0);
+vec3 _st_normalMap(vec3 sampledColor, float strength, vec3 N, vec3 P, vec2 uv) {
+  vec3 n = sampledColor * 2.0 - 1.0;
+  n.xy *= strength;
+
+  // Derivative-based cotangent frame (Sch\xFCler) \u2014 no vertex tangent attribute needed.
+  vec3 dp1  = dFdx(P);
+  vec3 dp2  = dFdy(P);
+  vec2 duv1 = dFdx(uv);
+  vec2 duv2 = dFdy(uv);
+
+  vec3 dp2perp = cross(dp2, N);
+  vec3 dp1perp = cross(N, dp1);
+  vec3 T = dp2perp * duv1.x + dp1perp * duv2.x;
+  vec3 B = dp2perp * duv1.y + dp1perp * duv2.y;
+
+  float invmax = inversesqrt(max(dot(T, T), dot(B, B)));
+  mat3 TBN = mat3(T * invmax, B * invmax, N);
+  return normalize(TBN * n);
 }`;
   }
   constructor(inputs = {}) {
     super("NormalMap");
     this._inputs = this.createInputs(inputs, {
-      fac: ["float", 0.5],
+      color: ["color", [0.5, 0.5, 1]],
       strength: ["float", inputs.strength ?? 1]
     });
     this._outputs = this.createOutputs({ Normal: "color" });
@@ -2658,17 +2706,13 @@ vec3 _st_normalMap(float fac, float strength) {
     return this._outputs;
   }
   compileDefs() {
-    return "";
+    return _NormalMap.glslFunction;
   }
   compileCall(ctx) {
-    const facVar = this._inputs.fac.isConnected() ? ctx.outputVar(this._inputs.fac.connection.node, this._inputs.fac.connection.name) : ctx.resolveInput(this._inputs.fac);
+    const color = ctx.resolveInput(this._inputs.color);
     const strength = ctx.resolveInput(this._inputs.strength);
     const normalVar = ctx.outputVar(this, "Normal");
-    return [
-      `float _nm_nx_${this.id} = dFdx(${facVar});`,
-      `float _nm_ny_${this.id} = dFdy(${facVar});`,
-      `vec3  ${normalVar} = normalize(vec3(-_nm_nx_${this.id} * ${strength}, 1.0, -_nm_ny_${this.id} * ${strength}));`
-    ].join("\n  ");
+    return `vec3 ${normalVar} = _st_normalMap(${color}, ${strength}, normalize(vNormal), vPosition, vUv);`;
   }
 };
 
@@ -2770,10 +2814,12 @@ vec3 _st_rotateZ(vec3 v, float a) {
   constructor(inputs = {}) {
     super("Mapping");
     this.mode = inputs.mode ?? "TEXTURE";
-    this.loc = inputs.location ?? [0, 0, 0];
-    this.rot = inputs.rotation ?? [0, 0, 0];
-    this.scl = inputs.scale ?? [1, 1, 1];
-    this._inputs = this.createInputs(inputs, { vector: ["color", null] });
+    this._inputs = this.createInputs(inputs, {
+      vector: ["color", null],
+      location: ["color", inputs.location ?? [0, 0, 0]],
+      rotation: ["color", inputs.rotation ?? [0, 0, 0]],
+      scale: ["color", inputs.scale ?? [1, 1, 1]]
+    });
     this._outputs = this.createOutputs({ Vector: "color" });
   }
   getInputSockets() {
@@ -2787,18 +2833,19 @@ vec3 _st_rotateZ(vec3 v, float a) {
   }
   compileCall(ctx) {
     const v = ctx.resolveInput(this._inputs.vector);
+    const loc = ctx.resolveInput(this._inputs.location);
+    const rot = ctx.resolveInput(this._inputs.rotation);
+    const scl = ctx.resolveInput(this._inputs.scale);
     const out = ctx.outputVar(this, "Vector");
-    const toRad = (d) => (d * Math.PI / 180).toFixed(6);
-    const [lx, ly, lz] = this.loc;
-    const [rx, ry, rz] = this.rot.map(Number);
-    const [sx, sy, sz] = this.scl;
+    const toRad = (Math.PI / 180).toFixed(6);
     return [
       `vec3 _mp_v_${this.id} = ${v};`,
-      `_mp_v_${this.id} = _mp_v_${this.id} - vec3(${lx.toFixed(4)}, ${ly.toFixed(4)}, ${lz.toFixed(4)});`,
-      `_mp_v_${this.id} = _st_rotateX(_mp_v_${this.id}, ${toRad(rx)});`,
-      `_mp_v_${this.id} = _st_rotateY(_mp_v_${this.id}, ${toRad(ry)});`,
-      `_mp_v_${this.id} = _st_rotateZ(_mp_v_${this.id}, ${toRad(rz)});`,
-      `_mp_v_${this.id} = _mp_v_${this.id} * vec3(${sx.toFixed(4)}, ${sy.toFixed(4)}, ${sz.toFixed(4)});`,
+      `vec3 _mp_r_${this.id} = ${rot} * ${toRad};`,
+      `_mp_v_${this.id} = _mp_v_${this.id} - ${loc};`,
+      `_mp_v_${this.id} = _st_rotateX(_mp_v_${this.id}, _mp_r_${this.id}.x);`,
+      `_mp_v_${this.id} = _st_rotateY(_mp_v_${this.id}, _mp_r_${this.id}.y);`,
+      `_mp_v_${this.id} = _st_rotateZ(_mp_v_${this.id}, _mp_r_${this.id}.z);`,
+      `_mp_v_${this.id} = _mp_v_${this.id} * ${scl};`,
       `vec3 ${out} = _mp_v_${this.id};`
     ].join("\n  ");
   }
@@ -4836,6 +4883,7 @@ var ShaderScript = class extends ProcessNode {
     const defs = {};
     const supplied = {};
     for (const [name, spec] of Object.entries(config.inputs ?? {})) {
+      assertGlslIdentifier(name, "ShaderScript input name");
       if (Array.isArray(spec)) {
         const [type, defaultVal] = spec;
         defs[name] = [type, defaultVal];
@@ -4845,6 +4893,9 @@ var ShaderScript = class extends ProcessNode {
         supplied[name] = sock;
       }
     }
+    for (const name of Object.keys(this._outputDecl)) {
+      assertGlslIdentifier(name, "ShaderScript output name");
+    }
     this._inputs = this.createInputs(supplied, defs);
     this._outputs = this.createOutputs(this._outputDecl);
   }
@@ -5574,5 +5625,7 @@ export {
   WaveTexture,
   Wavelength,
   WhiteNoise,
-  Wireframe
+  Wireframe,
+  assertGlslIdentifier,
+  isValidGlslIdentifier
 };

package/dist/core/CompileContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CompileContext.d.ts","sourceRoot":"","sources":["../../src/core/CompileContext.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAI,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAQ,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAClD,KAAK,EAAW,UAAU,EAAE,CAAA;CAC7B;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAqD;IACpE,OAAO,CAAC,QAAQ,CAAoD;IACpE,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,IAAI,CAAiD;IAC7D,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,SAAS,CAAuD;IACxE,0FAA0F;IAC1F,OAAO,CAAC,iBAAiB,CAAiE;IAI1F,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB;IAcjD;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAKvD;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM;IAuBlD,OAAO,CAAC,KAAK;IA8Bb,OAAO,CAAC,IAAI;IAoBZ,OAAO,CAAC,QAAQ;IA0BhB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,YAAY;IAsCpB,OAAO,CAAC,eAAe;IASvB,OAAO,CAAC,iBAAiB;IAuBzB,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,mBAAmB;IA2B3B,OAAO,CAAC,SAAS;IAqBjB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAS3D,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAQrC,OAAO,CAAC,SAAS;CAGlB"}
+{"version":3,"file":"CompileContext.d.ts","sourceRoot":"","sources":["../../src/core/CompileContext.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAI,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,QAAQ,EAAQ,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAClD,KAAK,EAAW,UAAU,EAAE,CAAA;CAC7B;AAED;;;;;;;;;GASG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,OAAO,CAAqD;IACpE,OAAO,CAAC,QAAQ,CAAoD;IACpE,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,IAAI,CAAiD;IAC7D,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,SAAS,CAA4C;IAC7D,OAAO,CAAC,SAAS,CAAuD;IACxE,0FAA0F;IAC1F,OAAO,CAAC,iBAAiB,CAAiE;IAI1F,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,gBAAgB;IAcjD;;;OAGG;IACH,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM;IAKvD;;;;;OAKG;IACH,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,MAAM;IAgClD,OAAO,CAAC,KAAK;IA8Bb,OAAO,CAAC,IAAI;IAyBZ,OAAO,CAAC,QAAQ;IA0BhB,OAAO,CAAC,QAAQ;IAKhB,OAAO,CAAC,YAAY;IAsCpB,OAAO,CAAC,eAAe;IAcvB,OAAO,CAAC,iBAAiB;IAuBzB,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,mBAAmB;IA2B3B,OAAO,CAAC,SAAS;IAqBjB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;IAS3D,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM;IAQrC,OAAO,CAAC,SAAS;CAGlB"}

package/dist/core/CompileContext.js

@@ -1,5 +1,6 @@
 import { ShaderNodeError } from './ShaderNodeError.js';
 import { ShaderConfig } from './ShaderConfig.js';
+import { assertGlslIdentifier } from './glslIdentifier.js';
 /**
  * Walks the node graph from an OutputNode, validates all connections,
  * deduplicates GLSL function definitions, scopes variable names to node IDs,
@@ -52,7 +53,16 @@ export class CompileContext {
      */
     resolveInput(socket) {
         if (socket.connection) {
-            return this.outputVar(socket.connection.node, socket.connection.name);
+            const varName = this.outputVar(socket.connection.node, socket.connection.name);
+            // vec3 (color/shader) → vec2 (vector) implicit conversion, e.g. Mapping.Vector → ImageTexture.vector
+            if (socket.type === 'vector' && socket.connection.type !== 'vector') {
+                return `(${varName}).xy`;
+            }
+            // vec2 (vector) → vec3 (color) implicit conversion, e.g. TextureCoordinate.UV → Mapping.vector
+            if (socket.type === 'color' && socket.connection.type === 'vector') {
+                return `vec3(${varName}, 0.0)`;
+            }
+            return varName;
         }
         if (socket.uniformName !== null) {
             if (!(socket.uniformName in this._uniforms)) {
@@ -103,8 +113,13 @@ export class CompileContext {
             const call = node.compileCall(this).trim();
             if (call)
                 this.calls.push(call);
-            // Collect vertex attribute injections from this node
+            // Collect vertex attribute injections from this node. Both the attribute
+            // name and the varying name are emitted verbatim into GLSL source, so
+            // both must be validated here — this is the single chokepoint covering
+            // every current and future vertexInjections() implementor.
             for (const inj of node.vertexInjections()) {
+                assertGlslIdentifier(inj.attrName, `${node.nodeType} vertex attribute name`);
+                assertGlslIdentifier(inj.varyingName, `${node.nodeType} varying name`);
                 if (!this._vertexInjections.has(inj.varyingName)) {
                     this._vertexInjections.set(inj.varyingName, { attrName: inj.attrName, attrType: inj.attrType });
                 }
@@ -186,6 +201,13 @@ export class CompileContext {
         // shader and color are both vec3 — compatible
         if ((from === 'shader' || from === 'color') && (to === 'shader' || to === 'color'))
             return true;
+        // vec3 (color/shader) implicitly narrows to vec2 (vector) via .xy, mirroring Blender's
+        // Mapping (vector output) → Image Texture Vector panning graph
+        if ((from === 'color' || from === 'shader') && to === 'vector')
+            return true;
+        // vec2 (vector) implicitly widens to vec3 (color), e.g. Texture Coordinate UV → Mapping.vector
+        if (from === 'vector' && to === 'color')
+            return true;
         return false;
     }
     // ── GLSL builders ─────────────────────────────────────────────────
@@ -196,18 +218,18 @@ export class CompileContext {
         const customAssigns = [...this._vertexInjections.entries()]
             .map(([vName, { attrName }]) => `  ${vName} = ${attrName};`)
             .join('\n');
-        return `
-varying vec2 vUv;
-varying vec3 vNormal;
-varying vec3 vPosition;
-${customAttrs}
-
-void main() {
-  vUv       = uv;
-  vNormal   = normalize(mat3(transpose(inverse(modelMatrix))) * normal);
-  vPosition = (modelMatrix * vec4(position, 1.0)).xyz;
-${customAssigns}
-  gl_Position = projectionMatrix * modelViewMatrix * vec4(position, 1.0);
+        return `
+varying vec2 vUv;
+varying vec3 vNormal;
+varying vec3 vPosition;
+${customAttrs}
+
+void main() {
+  vUv       = uv;
+  vNormal   = normalize(mat3(transpose(inverse(modelMatrix))) * normal);
+  vPosition = (modelMatrix * vec4(position, 1.0)).xyz;
+${customAssigns}
+  gl_Position = projectionMatrix * modelViewMatrix * vec4(position, 1.0);
 }`.trim();
     }
     buildUniformDeclarations() {
@@ -222,20 +244,20 @@ ${customAssigns}
             .join('\n');
         const defsBlock = this.defs.join('\n\n');
         const callsBlock = this.calls.map(c => `  ${c}`).join('\n');
-        return `
-precision mediump float;
-
-varying vec2 vUv;
-varying vec3 vNormal;
-varying vec3 vPosition;
-${customVaryings}
-
-${uniformsBlock}
-
-${defsBlock}
-
-void main() {
-${callsBlock}
+        return `
+precision mediump float;
+
+varying vec2 vUv;
+varying vec3 vNormal;
+varying vec3 vPosition;
+${customVaryings}
+
+${uniformsBlock}
+
+${defsBlock}
+
+void main() {
+${callsBlock}
 }`.trim();
     }
     // ── Literal conversion ────────────────────────────────────────────

package/dist/core/glslIdentifier.d.ts

@@ -0,0 +1,17 @@
+/**
+ * GLSL identifier validation — the single security boundary for any string
+ * that a node injects verbatim into generated GLSL source (attribute names,
+ * uniform names, etc). The root ecosystem rule is "NEVER interpolate
+ * user-supplied strings directly into GLSL"; where a name genuinely must
+ * appear in the source (e.g. a geometry attribute name the shader reads), it
+ * MUST first pass this validator, which throws on anything that isn't a plain
+ * GLSL identifier. A name that fails this check could never reference a usable
+ * GLSL attribute/uniform anyway, so nothing legitimate is rejected.
+ */
+export declare function isValidGlslIdentifier(name: string): boolean;
+/**
+ * Returns `name` if it is a safe GLSL identifier, otherwise throws. Use at the
+ * point a name is about to be emitted into shader source.
+ */
+export declare function assertGlslIdentifier(name: string, context: string): string;
+//# sourceMappingURL=glslIdentifier.d.ts.map

package/dist/core/glslIdentifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"glslIdentifier.d.ts","sourceRoot":"","sources":["../../src/core/glslIdentifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM3D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAS1E"}

package/dist/core/glslIdentifier.js

@@ -0,0 +1,37 @@
+/**
+ * GLSL identifier validation — the single security boundary for any string
+ * that a node injects verbatim into generated GLSL source (attribute names,
+ * uniform names, etc). The root ecosystem rule is "NEVER interpolate
+ * user-supplied strings directly into GLSL"; where a name genuinely must
+ * appear in the source (e.g. a geometry attribute name the shader reads), it
+ * MUST first pass this validator, which throws on anything that isn't a plain
+ * GLSL identifier. A name that fails this check could never reference a usable
+ * GLSL attribute/uniform anyway, so nothing legitimate is rejected.
+ */
+// GLSL ES identifiers: letter/underscore start, then letters/digits/underscore.
+const GLSL_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+// Reserved: names beginning with `gl_` are reserved by the GLSL spec, and the
+// double-underscore prefix/anywhere is reserved for implementation use.
+export function isValidGlslIdentifier(name) {
+    if (typeof name !== 'string')
+        return false;
+    if (!GLSL_IDENTIFIER.test(name))
+        return false;
+    if (name.startsWith('gl_'))
+        return false;
+    if (name.includes('__'))
+        return false;
+    return true;
+}
+/**
+ * Returns `name` if it is a safe GLSL identifier, otherwise throws. Use at the
+ * point a name is about to be emitted into shader source.
+ */
+export function assertGlslIdentifier(name, context) {
+    if (!isValidGlslIdentifier(name)) {
+        throw new Error(`[st-shader-core] ${context}: "${String(name)}" is not a valid GLSL identifier. ` +
+            `Only letters, digits and single underscores are allowed (must start with a letter or underscore, ` +
+            `may not start with "gl_" or contain "__"). This guards against GLSL injection.`);
+    }
+    return name;
+}

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export { InputSocket } from './core/InputSocket.js';
 export { OutputSocket } from './core/OutputSocket.js';
 export { SOCKET_GLSL_TYPE } from './core/SocketType.js';
 export type { SocketType } from './core/SocketType.js';
+export { isValidGlslIdentifier, assertGlslIdentifier } from './core/glslIdentifier.js';
 export { CompileContext } from './core/CompileContext.js';
 export type { CompiledMaterial } from './core/CompileContext.js';
 export { TextureCoordinate } from './nodes/input/TextureCoordinate.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAS,wBAAwB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAQ,sBAAsB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAS,qBAAqB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAQ,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAO,uBAAuB,CAAA;AAGpD,OAAO,EAAE,WAAW,EAAE,MAAW,uBAAuB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAU,wBAAwB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,MAAO,sBAAsB,CAAA;AAGvD,OAAO,EAAE,cAAc,EAAE,MAAa,0BAA0B,CAAA;AAChE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,MAAkB,wBAAwB,CAAA;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAoB,sBAAsB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAe,2BAA2B,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAY,8BAA8B,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAa,6BAA6B,CAAA;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAkB,wBAAwB,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAgB,0BAA0B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAS,iCAAiC,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAc,4BAA4B,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAc,4BAA4B,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAa,6BAA6B,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAS,iCAAiC,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAe,2BAA2B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAW,+BAA+B,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAc,4BAA4B,CAAA;AAG9D,OAAO,EAAE,cAAc,EAAE,MAAa,kCAAkC,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAe,gCAAgC,CAAA;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAC5E,YAAY,EAAE,kBAAkB,EAAE,MAAQ,gCAAgC,CAAA;AAG1E,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAY,mCAAmC,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAe,gCAAgC,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAW,oCAAoC,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAY,mCAAmC,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,eAAe,EAAE,MAAW,oCAAoC,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,MAAgB,+BAA+B,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAO,uCAAuC,CAAA;AAG3E,OAAO,EAAE,SAAS,EAAE,MAAgB,8BAA8B,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAmB,2BAA2B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAO,uCAAuC,CAAA;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAW,mCAAmC,CAAA;AACvE,OAAO,EAAE,OAAO,EAAE,MAAkB,4BAA4B,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,MAAgB,8BAA8B,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,MAAoB,0BAA0B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAc,gCAAgC,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAgB,8BAA8B,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAe,+BAA+B,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAa,8BAA8B,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAkB,yBAAyB,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAe,4BAA4B,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAY,+BAA+B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAW,gCAAgC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAY,+BAA+B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAW,gCAAgC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAY,+BAA+B,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAgB,2BAA2B,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAU,iCAAiC,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAO,oCAAoC,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAU,iCAAiC,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAa,mCAAmC,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAmB,6BAA6B,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAU,qCAAqC,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAa,kCAAkC,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAU,qCAAqC,CAAA;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAoB,4BAA4B,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAgB,gCAAgC,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAiB,+BAA+B,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAa,mCAAmC,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAO,yCAAyC,CAAA;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAmB,6BAA6B,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAe,iCAAiC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAY,oCAAoC,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAa,mCAAmC,CAAA;AAGzE,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAmB,0BAA0B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAgB,6BAA6B,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAc,+BAA+B,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAa,gCAAgC,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAY,iCAAiC,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAW,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAe,8BAA8B,CAAA;AAGjE,OAAO,EAAE,YAAY,EAAE,MAAW,iCAAiC,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAG5G,OAAO,EAAE,YAAY,EAAE,MAAc,+BAA+B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAQ,uCAAuC,CAAA;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAc,gCAAgC,CAAA;AAGrE,OAAO,EAAE,gBAAgB,EAAE,MAAO,oCAAoC,CAAA;AACtE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAChF,OAAO,EAAE,SAAS,EAAE,MAAc,6BAA6B,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAGlE,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,0BAA0B,EAAE,MAAO,yCAAyC,CAAA;AAC1F,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAC7F,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC9F,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAC7F,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAC7F,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,wBAAwB,EAAE,MAAQ,uCAAuC,CAAA;AACvF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAS,2BAA2B,CAAA;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAS,uCAAuC,CAAA;AACxF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,aAAa,EAAE,MAAoB,4BAA4B,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,MAAsB,0BAA0B,CAAA;AAC3E,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,UAAU,EAAE,MAAuB,yBAAyB,CAAA;AAC1E,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAO,4BAA4B,CAAA;AAC7E,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACrF,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,YAAY,EAAE,MAAqB,2BAA2B,CAAA;AAC5E,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAC3F,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC1H,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,cAAc,EAAE,MAAmB,6BAA6B,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAW,qCAAqC,CAAA;AACtF,YAAY,EAAE,mBAAmB,EAAE,MAAc,kCAAkC,CAAA;AACnF,YAAY,EAAE,sBAAsB,EAAE,MAAW,qCAAqC,CAAA;AACtF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,aAAa,EAAE,MAAoB,4BAA4B,CAAA;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,0BAA0B,EAAE,MAAO,yCAAyC,CAAA;AAC1F,YAAY,EAAE,cAAc,EAAE,MAAmB,6BAA6B,CAAA;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,qBAAqB,EAAE,MAAY,oCAAoC,CAAA;AACrF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAa,yBAAyB,CAAA;AAC1E,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAW,0BAA0B,CAAA;AAC3E,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/E,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAC3F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAC9F,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAS,wBAAwB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAGxD,OAAO,EAAE,UAAU,EAAE,MAAQ,sBAAsB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAS,qBAAqB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAQ,sBAAsB,CAAA;AACnD,OAAO,EAAE,WAAW,EAAE,MAAO,uBAAuB,CAAA;AAGpD,OAAO,EAAE,WAAW,EAAE,MAAW,uBAAuB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,MAAU,wBAAwB,CAAA;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,MAAO,sBAAsB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAGtF,OAAO,EAAE,cAAc,EAAE,MAAa,0BAA0B,CAAA;AAChE,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAGhE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAA;AACtE,OAAO,EAAE,KAAK,EAAE,MAAkB,wBAAwB,CAAA;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAoB,sBAAsB,CAAA;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAe,2BAA2B,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAY,8BAA8B,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAa,6BAA6B,CAAA;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAkB,wBAAwB,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAgB,0BAA0B,CAAA;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAS,iCAAiC,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAc,4BAA4B,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,MAAc,4BAA4B,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAa,6BAA6B,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAS,iCAAiC,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAe,2BAA2B,CAAA;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAW,+BAA+B,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAc,4BAA4B,CAAA;AAG9D,OAAO,EAAE,cAAc,EAAE,MAAa,kCAAkC,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAe,gCAAgC,CAAA;AACtE,YAAY,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAC5E,YAAY,EAAE,kBAAkB,EAAE,MAAQ,gCAAgC,CAAA;AAG1E,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAA;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAY,mCAAmC,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAe,gCAAgC,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,MAAW,oCAAoC,CAAA;AACzE,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAY,mCAAmC,CAAA;AACxE,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,eAAe,EAAE,MAAW,oCAAoC,CAAA;AACzE,OAAO,EAAE,UAAU,EAAE,MAAgB,+BAA+B,CAAA;AACpE,OAAO,EAAE,YAAY,EAAE,MAAc,iCAAiC,CAAA;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAO,uCAAuC,CAAA;AAG3E,OAAO,EAAE,SAAS,EAAE,MAAgB,8BAA8B,CAAA;AAClE,OAAO,EAAE,MAAM,EAAE,MAAmB,2BAA2B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAO,uCAAuC,CAAA;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAW,mCAAmC,CAAA;AACvE,OAAO,EAAE,OAAO,EAAE,MAAkB,4BAA4B,CAAA;AAChE,OAAO,EAAE,SAAS,EAAE,MAAgB,8BAA8B,CAAA;AAClE,OAAO,EAAE,KAAK,EAAE,MAAoB,0BAA0B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAc,gCAAgC,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAgB,8BAA8B,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAe,+BAA+B,CAAA;AAGnE,OAAO,EAAE,SAAS,EAAE,MAAa,8BAA8B,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAkB,yBAAyB,CAAA;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAe,4BAA4B,CAAA;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAY,+BAA+B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAW,gCAAgC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAY,+BAA+B,CAAA;AAChE,OAAO,EAAE,WAAW,EAAE,MAAW,gCAAgC,CAAA;AACjE,OAAO,EAAE,UAAU,EAAE,MAAY,+BAA+B,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAgB,2BAA2B,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAU,iCAAiC,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,MAAO,oCAAoC,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,MAAU,iCAAiC,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAa,mCAAmC,CAAA;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAmB,6BAA6B,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAU,qCAAqC,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAa,kCAAkC,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAU,qCAAqC,CAAA;AAC1E,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,OAAO,EAAE,MAAoB,4BAA4B,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAgB,gCAAgC,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,MAAiB,+BAA+B,CAAA;AACrE,OAAO,EAAE,cAAc,EAAE,MAAa,mCAAmC,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,SAAS,EAAE,MAAkB,8BAA8B,CAAA;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAO,yCAAyC,CAAA;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAmB,6BAA6B,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAe,iCAAiC,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,MAAY,oCAAoC,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAa,mCAAmC,CAAA;AAGzE,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAmB,0BAA0B,CAAA;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAgB,6BAA6B,CAAA;AAChE,OAAO,EAAE,UAAU,EAAE,MAAc,+BAA+B,CAAA;AAClE,OAAO,EAAE,WAAW,EAAE,MAAa,gCAAgC,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAY,iCAAiC,CAAA;AACpE,OAAO,EAAE,aAAa,EAAE,MAAW,kCAAkC,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,MAAe,8BAA8B,CAAA;AAGjE,OAAO,EAAE,YAAY,EAAE,MAAW,iCAAiC,CAAA;AACnE,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAG5G,OAAO,EAAE,YAAY,EAAE,MAAc,+BAA+B,CAAA;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAQ,uCAAuC,CAAA;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,uCAAuC,CAAA;AACrF,OAAO,EAAE,YAAY,EAAE,MAAc,gCAAgC,CAAA;AAGrE,OAAO,EAAE,gBAAgB,EAAE,MAAO,oCAAoC,CAAA;AACtE,YAAY,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAChF,OAAO,EAAE,SAAS,EAAE,MAAc,6BAA6B,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAGlE,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,0BAA0B,EAAE,MAAO,yCAAyC,CAAA;AAC1F,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAC7F,YAAY,EAAE,iBAAiB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAA;AAC9F,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAC7F,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAA;AAC7F,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,wBAAwB,EAAE,MAAQ,uCAAuC,CAAA;AACvF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAS,2BAA2B,CAAA;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAS,uCAAuC,CAAA;AACxF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,aAAa,EAAE,MAAoB,4BAA4B,CAAA;AAC7E,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,MAAsB,0BAA0B,CAAA;AAC3E,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,UAAU,EAAE,MAAuB,yBAAyB,CAAA;AAC1E,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAO,4BAA4B,CAAA;AAC7E,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACrF,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,YAAY,EAAE,MAAqB,2BAA2B,CAAA;AAC5E,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAC3F,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAC1H,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,cAAc,EAAE,MAAmB,6BAA6B,CAAA;AAC9E,YAAY,EAAE,sBAAsB,EAAE,MAAW,qCAAqC,CAAA;AACtF,YAAY,EAAE,mBAAmB,EAAE,MAAc,kCAAkC,CAAA;AACnF,YAAY,EAAE,sBAAsB,EAAE,MAAW,qCAAqC,CAAA;AACtF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,aAAa,EAAE,MAAoB,4BAA4B,CAAA;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA;AAC/E,YAAY,EAAE,0BAA0B,EAAE,MAAO,yCAAyC,CAAA;AAC1F,YAAY,EAAE,cAAc,EAAE,MAAmB,6BAA6B,CAAA;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAe,iCAAiC,CAAA;AAClF,YAAY,EAAE,qBAAqB,EAAE,MAAY,oCAAoC,CAAA;AACrF,YAAY,EAAE,oBAAoB,EAAE,MAAa,mCAAmC,CAAA;AACpF,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAa,yBAAyB,CAAA;AAC1E,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAW,0BAA0B,CAAA;AAC3E,YAAY,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAC/E,YAAY,EAAE,gBAAgB,EAAE,MAAiB,+BAA+B,CAAA;AAChF,YAAY,EAAE,iBAAiB,EAAE,MAAgB,gCAAgC,CAAA;AACjF,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAC3F,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AAC9F,YAAY,EAAE,eAAe,EAAE,MAAkB,8BAA8B,CAAA"}

package/dist/index.js

@@ -10,6 +10,7 @@ export { ProcessNode } from './core/ProcessNode.js';
 export { InputSocket } from './core/InputSocket.js';
 export { OutputSocket } from './core/OutputSocket.js';
 export { SOCKET_GLSL_TYPE } from './core/SocketType.js';
+export { isValidGlslIdentifier, assertGlslIdentifier } from './core/glslIdentifier.js';
 // ── Compiler ──────────────────────────────────────────────────────────────────
 export { CompileContext } from './core/CompileContext.js';
 // ── Input nodes ───────────────────────────────────────────────────────────────

package/dist/nodes/input/Attribute.d.ts

@@ -29,7 +29,7 @@ export declare class Attribute extends InputNode {
     /** Sanitized attribute name — only alphanumeric + underscore, used in GLSL. */
     private readonly _safeAttrName;
     constructor(attributeName: string, attributeType?: 'float' | 'vec3');
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     vertexInjections(): {
         attrName: string;
         attrType: "float";

package/dist/nodes/input/Attribute.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Attribute.d.ts","sourceRoot":"","sources":["../../../src/nodes/input/Attribute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAElE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,IAAI,QAAQ,WAAyB;IAErC,IAAI,QAAQ,IAAI,YAAY,CAE3B;IAED,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B,sEAAsE;IAC7D,UAAU,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAuB;IAErE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmE;IAE5F,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;gBAE1B,aAAa,EAAE,MAAM,EAAE,aAAa,GAAE,OAAO,GAAG,MAAe;IAW3E,gBAAgB;IAEhB,gBAAgB;;;;;;;;;IAUhB,WAAW,IAAI,MAAM;IAErB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM;CAkBzC"}
+{"version":3,"file":"Attribute.d.ts","sourceRoot":"","sources":["../../../src/nodes/input/Attribute.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAGlE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,SAAU,SAAQ,SAAS;IACtC,IAAI,QAAQ,WAAyB;IAErC,IAAI,QAAQ,IAAI,YAAY,CAE3B;IAED,kEAAkE;IAClE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAE9B,sEAAsE;IAC7D,UAAU,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAuB;IAErE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmE;IAE5F,+EAA+E;IAC/E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAQ;gBAE1B,aAAa,EAAE,MAAM,EAAE,aAAa,GAAE,OAAO,GAAG,MAAe;IAiB3E,gBAAgB;IAEhB,gBAAgB;;;;;;;;;IAUhB,WAAW,IAAI,MAAM;IAErB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM;CAkBzC"}

package/dist/nodes/input/Attribute.js

@@ -1,4 +1,5 @@
 import { InputNode } from '../../core/InputNode.js';
+import { assertGlslIdentifier } from '../../core/glslIdentifier.js';
 /**
  * Attribute — Blender "Attribute" input node equivalent.
  * Reads a named custom float or vector attribute from the geometry's BufferAttributes.
@@ -23,7 +24,13 @@ export class Attribute extends InputNode {
         super('Attribute');
         /** 0 = vec3, 1 = float. Stored as number for keyframe/GSAP compat. */
         this.parameters = { attributeType: 0 };
-        // SECURITY: sanitize the attribute name for safe use in GLSL identifiers
+        // SECURITY: the attribute name is emitted verbatim into the vertex shader
+        // (`attribute <type> <attributeName>;` and `<varying> = <attributeName>;`),
+        // so it must be a valid GLSL identifier — reject anything else here for a
+        // clear early error. CompileContext re-validates at emit time as the
+        // authoritative boundary. The varying name uses a sanitized copy so it is
+        // always safe regardless.
+        assertGlslIdentifier(attributeName, 'Attribute name');
         this._safeAttrName = attributeName.replace(/[^a-zA-Z0-9_]/g, '_');
         this.attributeName = attributeName;
         this.parameters.attributeType = attributeType === 'float' ? 1 : 0;

package/dist/nodes/input/CameraData.d.ts

@@ -15,7 +15,7 @@ export declare class CameraData extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     compileCall(ctx: CompileContext): string;
 }
 //# sourceMappingURL=CameraData.d.ts.map

package/dist/nodes/input/ColorAttribute.d.ts

@@ -16,7 +16,7 @@ export declare class ColorAttribute extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     vertexInjections(): {
         attrName: string;
         attrType: "vec3";

package/dist/nodes/input/Geometry.d.ts

@@ -17,7 +17,7 @@ export declare class Geometry extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     compileCall(ctx: CompileContext): string;
 }
 //# sourceMappingURL=Geometry.d.ts.map

package/dist/nodes/input/HairInfo.d.ts

@@ -23,7 +23,7 @@ export declare class HairInfo extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     vertexInjections(): ({
         attrName: string;
         attrType: "vec3";

package/dist/nodes/input/LayerWeight.d.ts

@@ -20,7 +20,7 @@ export declare class LayerWeight extends InputNode {
     constructor(inputs?: {
         blend?: number;
     } | number);
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     compileCall(ctx: CompileContext): string;
 }
 //# sourceMappingURL=LayerWeight.d.ts.map

package/dist/nodes/input/LightPath.d.ts

@@ -46,7 +46,7 @@ export declare class LightPath extends InputNode {
         readonly transmissionDepth: "u_st_lp_transmissionDepth";
     };
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     /**
      * Register all LightPath uniforms with their rasterizer defaults.
      * CompileContext picks these up and includes them in the compiled

package/dist/nodes/input/ObjectInfo.d.ts

@@ -16,7 +16,7 @@ export declare class ObjectInfo extends InputNode {
     private readonly _outputs;
     private readonly _seed;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     compileCall(ctx: CompileContext): string;
 }
 //# sourceMappingURL=ObjectInfo.d.ts.map

package/dist/nodes/input/OceanAttribute.d.ts

@@ -21,7 +21,7 @@ export declare class OceanAttribute extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     vertexInjections(): {
         attrName: string;
         attrType: "float";

package/dist/nodes/input/ParticleInfo.d.ts

@@ -20,7 +20,7 @@ export declare class ParticleInfo extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     vertexInjections(): {
         attrName: string;
         attrType: "float";

package/dist/nodes/input/RGB.d.ts

@@ -13,7 +13,7 @@ export declare class RGB extends InputNode {
     private readonly hex;
     private readonly _outputs;
     constructor(color?: string);
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     compileCall(ctx: CompileContext): string;
 }
 //# sourceMappingURL=RGB.d.ts.map

package/dist/nodes/input/ScreenCamera.d.ts

@@ -25,7 +25,7 @@ export declare class ScreenCamera extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     /**
      * Declare the camera uniforms that ScreenOutput will inject.
      * They are vec2/vec3/float types that live outside the standard

package/dist/nodes/input/Tangent.d.ts

@@ -15,7 +15,7 @@ export declare class Tangent extends InputNode {
     get metadata(): NodeMetadata;
     private readonly _outputs;
     constructor();
-    getOutputSockets(): Record<string, import("../../core/OutputSocket.js").OutputSocket>;
+    getOutputSockets(): Record<string, import("../../index.js").OutputSocket>;
     compileCall(ctx: CompileContext): string;
 }
 //# sourceMappingURL=Tangent.d.ts.map