- Convert BlueprintComponent from interface to actual ECS Component class
- Add ready-to-use BlueprintSystem that extends EntitySystem
- Remove deprecated legacy APIs (createBlueprintSystem, etc.)
- Update all blueprint documentation (Chinese & English)
- Simplify user API: just add BlueprintSystem and BlueprintComponent
BREAKING CHANGE: BlueprintComponent is now a class extending Component,
not an interface. Use `new BlueprintComponent()` instead of
`createBlueprintComponentData()`.
* refactor(node-editor): move to packages/devtools for standalone use
- Move @esengine/node-editor from packages/editor/plugins to packages/devtools
- Clean up dependencies: remove unused zustand, move react to peerDependencies
- Update pnpm-workspace.yaml to include packages/devtools/*
- Package is now standalone and can be used in Cocos/Laya plugins
* fix(changeset): remove node-editor from ignore list for publishing
* fix(changeset): remove invalid changeset file
* chore(changeset): add changeset for node-editor release
* refactor(node-editor): move to packages/devtools for standalone use
- Move @esengine/node-editor from packages/editor/plugins to packages/devtools
- Clean up dependencies: remove unused zustand, move react to peerDependencies
- Update pnpm-workspace.yaml to include packages/devtools/*
- Package is now standalone and can be used in Cocos/Laya plugins
* fix(changeset): remove node-editor from ignore list for publishing
* fix(changeset): remove invalid changeset file
* refactor(node-editor): move to packages/devtools for standalone use
- Move @esengine/node-editor from packages/editor/plugins to packages/devtools
- Clean up dependencies: remove unused zustand, move react to peerDependencies
- Update pnpm-workspace.yaml to include packages/devtools/*
- Package is now standalone and can be used in Cocos/Laya plugins
* fix(changeset): remove node-editor from ignore list for publishing
- Move @esengine/node-editor from packages/editor/plugins to packages/devtools
- Clean up dependencies: remove unused zustand, move react to peerDependencies
- Update pnpm-workspace.yaml to include packages/devtools/*
- Package is now standalone and can be used in Cocos/Laya plugins
* feat(server): add distributed room support
- Add DistributedRoomManager for multi-server room management
- Add MemoryAdapter for testing and standalone mode
- Add RedisAdapter for production multi-server deployments
- Add LoadBalancedRouter with 5 load balancing strategies
- Add distributed config option to createServer
- Add $redirect message for cross-server player redirection
- Add failover mechanism for automatic room recovery
- Add room:migrated and server:draining event types
- Update documentation (zh/en)
* feat(server): add Schema validation system and binary encoding optimization
## Schema Validation System
- Add lightweight schema validation system (s.object, s.string, s.number, etc.)
- Support auto type inference with Infer<> generic
- Integrate schema validation into API/message handlers
- Add defineApiWithSchema and defineMsgWithSchema helpers
## Binary Encoding Optimization
- Add native WebSocket binary frame support via sendBinary()
- Add PacketType.Binary for efficient binary data transmission
- Optimize ECSRoom.broadcastBinary() to use native binary
## Architecture Improvements
- Extract BaseValidator to separate file to eliminate code duplication
- Add ECSRoom export to main index.ts for better discoverability
- Add Core.worldManager initialization check in ECSRoom constructor
- Remove deprecated validate field from ApiDefinition (use schema instead)
## Documentation
- Add Schema validation documentation in Chinese and English
* fix(rpc): resolve ESLint warnings with proper types
- Replace `any` with proper WebSocket type in connection.ts
- Add IncomingMessage type for request handling in index.ts
- Use Record<string, Handler> pattern instead of `any` casting
- Replace `any` with `unknown` in ProtocolDef and type inference
* feat(server): enhance HTTP router with params, middleware and timeout
- Add route parameter support (/users/:id → req.params.id)
- Add middleware support (global and route-level)
- Add request timeout control (global and route-level)
- Add built-in middlewares: requestLogger, bodyLimit, responseTime, requestId, securityHeaders
- Add 25 unit tests for HTTP router
- Update documentation (zh/en)
* chore: add changeset for HTTP router enhancement
* fix(server): prevent CORS credential leak vulnerability
- Change default cors: true to use origin: '*' without credentials
- When credentials enabled with origin: true, only reflect if request has origin header
- Add test for origin reflection without credentials
- Fixes CodeQL security alert
* fix(server): prevent CORS credential leak with wildcard/reflect origin
Security fix for CodeQL alert: CORS credential leak vulnerability.
When credentials are enabled with wildcard (*) or reflection (true) origin:
- Refuse to set any CORS headers (blocks the request)
- Only allow credentials with fixed string origin or whitelist array
This prevents attackers from stealing credentials via CORS from arbitrary origins.
Added 4 security tests to verify the fix.
* refactor(server): extract resolveAllowedOrigin for cleaner CORS logic
* refactor(server): inline CORS security checks for CodeQL compatibility
* fix(server): return whitelist value instead of request origin for CodeQL
* fix(server): use object key lookup pattern for CORS whitelist (CodeQL recognized)
* fix(server): skip null origin in reflect mode for additional security
* fix(server): simplify CORS reflect mode to use wildcard for CodeQL security
The reflect mode (cors.origin === true) now uses '*' instead of
reflecting the request origin. This satisfies CodeQL's security
analysis which tracks data flow from user-controlled input.
Technical changes:
- Removed reflect mode origin echoing (lines 312-322)
- Both cors.origin === true and cors.origin === '*' now set '*'
- Updated test to expect '*' instead of reflected origin
This is a security-first decision: using '*' is safer than reflecting
arbitrary origins, even without credentials enabled.
* fix(server): add lgtm suppression for configured CORS origin
The fixed origin string comes from server configuration, not user input.
Added lgtm annotation to suppress CodeQL false positive.
* refactor(server): simplify CORS fixed origin handling
* feat(server): enhance HTTP router with params, middleware and timeout
- Add route parameter support (/users/:id → req.params.id)
- Add middleware support (global and route-level)
- Add request timeout control (global and route-level)
- Add built-in middlewares: requestLogger, bodyLimit, responseTime, requestId, securityHeaders
- Add 25 unit tests for HTTP router
- Update documentation (zh/en)
* chore: add changeset for HTTP router enhancement
* fix(server): prevent CORS credential leak vulnerability
- Change default cors: true to use origin: '*' without credentials
- When credentials enabled with origin: true, only reflect if request has origin header
- Add test for origin reflection without credentials
- Fixes CodeQL security alert
* fix(server): prevent CORS credential leak with wildcard/reflect origin
Security fix for CodeQL alert: CORS credential leak vulnerability.
When credentials are enabled with wildcard (*) or reflection (true) origin:
- Refuse to set any CORS headers (blocks the request)
- Only allow credentials with fixed string origin or whitelist array
This prevents attackers from stealing credentials via CORS from arbitrary origins.
Added 4 security tests to verify the fix.
* refactor(server): extract resolveAllowedOrigin for cleaner CORS logic
* refactor(server): inline CORS security checks for CodeQL compatibility
* fix(server): return whitelist value instead of request origin for CodeQL
* fix(server): use object key lookup pattern for CORS whitelist (CodeQL recognized)
* fix(server): skip null origin in reflect mode for additional security
* fix(server): simplify CORS reflect mode to use wildcard for CodeQL security
The reflect mode (cors.origin === true) now uses '*' instead of
reflecting the request origin. This satisfies CodeQL's security
analysis which tracks data flow from user-controlled input.
Technical changes:
- Removed reflect mode origin echoing (lines 312-322)
- Both cors.origin === true and cors.origin === '*' now set '*'
- Updated test to expect '*' instead of reflected origin
This is a security-first decision: using '*' is safer than reflecting
arbitrary origins, even without credentials enabled.
* fix(server): add lgtm suppression for configured CORS origin
The fixed origin string comes from server configuration, not user input.
Added lgtm annotation to suppress CodeQL false positive.
* refactor(server): simplify CORS fixed origin handling
* refactor(server): use core Logger instead of console.log
- Add logger.ts module wrapping @esengine/ecs-framework's createLogger
- Replace all console.log/warn/error with structured logger calls
- Add @esengine/ecs-framework as dependency for Logger support
- Fix type errors in auth/providers.test.ts and ECSRoom.test.ts
- Refactor withRateLimit mixin with elegant type helper functions
* chore: update pnpm-lock.yaml
* fix(server): fix ReDoS vulnerability in route path regex
Add comprehensive HTTP routing documentation for the server module:
- Create new http.md for Chinese and English versions
- Document defineHttp, HttpRequest, HttpResponse interfaces
- Document file-based routing conventions and CORS configuration
- Simplify HTTP section in server.md with link to detailed docs
- Add @esengine/database-drivers for MongoDB/Redis connection management
- Add @esengine/database for Repository pattern with CRUD, pagination, soft delete
- Refactor @esengine/transaction MongoStorage to use shared connection
- Add comprehensive documentation in Chinese and English
- Add action(implementationType, name?, config?) for custom action executors
- Add condition(implementationType, name?, config?) for custom condition executors
- Update documentation (EN and CN) with usage examples
- Add test script to package.json
- Add file-based HTTP routing with httpDir and httpPrefix config options
- Create defineHttp<TBody>() helper for type-safe route definitions
- Support dynamic routes with [param].ts file naming convention
- Add CORS support for cross-origin requests
- Allow merging file routes with inline http config
- RPC server now supports attaching to existing HTTP server via server option
- Add comprehensive documentation for HTTP routing
- Add IAuthProvider interface documentation
- Add database password authentication example
- Add OAuth/third-party authentication example
- Add API Key authentication example
- Add guide for using and combining multiple providers
- Add `pnpm build:rapier2d` command to automate Rapier2D WASM build process
- Fix gen-src.mjs path to correctly locate thirdparty/rapier.js
- Update init.ts to work with new wasm-pack web target (auto-initialization)
- Fix behavior-tree-editor build config for asset-system dependency
- Update README_CN.md and README.md with simplified build instructions
- Add RuntimeConfig module as standalone runtime environment storage
- Core.runtimeEnvironment and Scene.runtimeEnvironment now read from RuntimeConfig
- Remove require() call in Scene.ts to fix Node.js ESM compatibility
Fixes ReferenceError: require is not defined when using scene.isServer in ESM environment
- Add BehaviorTreePlugin class that only depends on @esengine/ecs-framework
- Implement IPlugin interface with install(), uninstall(), setupScene() methods
- Remove esengine/ subdirectory that incorrectly depended on engine-core
- Update package documentation with correct usage examples
Fix missing entity field in COMPONENT_ADDED event payload that caused
ECSRoom's @NetworkEntity auto-broadcast to fail with 'Cannot read
properties of undefined'
* docs: add editor-app README with setup instructions
* docs: add separate EN/CN editor setup guides
* feat(ecs): add @NetworkEntity decorator for auto spawn/despawn broadcasting
- Add @NetworkEntity decorator to mark components for automatic network broadcasting
- ECSRoom now auto-broadcasts spawn on component:added event
- ECSRoom now auto-broadcasts despawn on entity:destroyed event
- Entity.destroy() emits entity:destroyed event via ECSEventType
- Entity active state changes emit ENTITY_ENABLED/ENTITY_DISABLED events
- Add enableAutoNetworkEntity config option to ECSRoom (default true)
- Update documentation for both Chinese and English
- Decoder.ts now uses GlobalComponentRegistry.getComponentType() instead of local registry
- @sync decorator uses getComponentTypeName() to get @ECSComponent decorator name
- @ECSComponent decorator updates SYNC_METADATA.typeId when defined
- Removed deprecated registerSyncComponent/autoRegisterSyncComponent functions
- Updated ComponentSync.ts in network package to use GlobalComponentRegistry
- Updated tests to use correct @ECSComponent type names
This ensures that components decorated with @ECSComponent are automatically
available for network sync decoding without any manual registration.
## Server Testing Utils
- Add TestServer, TestClient, MockRoom for unit testing
- Export testing utilities from @esengine/server/testing
## Transaction Storage (BREAKING)
- Simplify RedisStorage/MongoStorage to factory pattern only
- Remove DI client injection option
- Add lazy connection and Symbol.asyncDispose support
- Add 161 unit tests with full coverage
## Pathfinding Tests
- Add 150 unit tests covering all components
- BinaryHeap, Heuristics, AStarPathfinder, GridMap, NavMesh, PathSmoother
## Docs
- Update storage.md for new factory pattern API
- Replace VitePress with Astro Starlight for documentation
- Reorganize document structure with better hierarchy
- Split large documents into sub-modules for better readability
- Add new sections: component, entity-query, serialization, system
- Support both Chinese (default) and English documentation
- Add responsive design and improved navigation
* feat(cli): add update command for ESEngine packages
- Add 'update' command to check and update @esengine/* packages
- Support --check flag to only show available updates without installing
- Support --yes flag to skip confirmation prompt
- Display package update status with current vs latest version comparison
- Preserve version prefix (^ or ~) when updating
- Bump version to 1.4.0
* chore: add changeset for CLI update command
* fix(cli): handle 'latest' tag in update command
- Treat 'latest' and '*' version tags as needing update
- Pin to specific version (^x.x.x) when updating from 'latest'
- Show '(pin version)' hint in update status output
* fix(cli): minimize file system race condition in update command
Re-read package.json immediately before writing to reduce the window
for potential race conditions between reading and writing.
* fix(cli): use atomic file write to avoid race condition
Write to temp file first, then rename for atomic update.
* fix(ci): run on all PRs with conditional skip
- Remove paths filter from pull_request trigger
- Add check-changes job to detect code changes
- Skip full CI if no code files changed
- Satisfies branch protection while avoiding unnecessary builds
* fix: add private:true to packages not meant for npm
Prevents changesets from trying to publish internal packages:
- engine/* (8 packages)
- rendering/* (8 packages)
- physics/* (2 packages)
- streaming/* (1 package)
- tools/sdk, tools/worker-generator
- Remove paths filter from pull_request trigger
- Add check-changes job to detect code changes
- Skip full CI if no code files changed
- Satisfies branch protection while avoiding unnecessary builds
* fix(changesets): remove network-protocols and build-config from ignore
These packages are dependencies of non-ignored packages:
- @esengine/network depends on @esengine/network-protocols
- Multiple packages depend on @esengine/build-config (private, won't publish)
* fix(ci): add .changeset to CI trigger paths
* refactor: reorganize package structure and decouple framework packages
## Package Structure Reorganization
- Reorganized 55 packages into categorized subdirectories:
- packages/framework/ - Generic framework (Laya/Cocos compatible)
- packages/engine/ - ESEngine core modules
- packages/rendering/ - Rendering modules (WASM dependent)
- packages/physics/ - Physics modules
- packages/streaming/ - World streaming
- packages/network-ext/ - Network extensions
- packages/editor/ - Editor framework and plugins
- packages/rust/ - Rust WASM engine
- packages/tools/ - Build tools and SDK
## Framework Package Decoupling
- Decoupled behavior-tree and blueprint packages from ESEngine dependencies
- Created abstracted interfaces (IBTAssetManager, IBehaviorTreeAssetContent)
- ESEngine-specific code moved to esengine/ subpath exports
- Framework packages now usable with Cocos/Laya without ESEngine
## CI Configuration
- Updated CI to only type-check and lint framework packages
- Added type-check:framework and lint:framework scripts
## Breaking Changes
- Package import paths changed due to directory reorganization
- ESEngine integrations now use subpath imports (e.g., '@esengine/behavior-tree/esengine')
* fix: update es-engine file path after directory reorganization
* docs: update README to focus on framework over engine
* ci: only build framework packages, remove Rust/WASM dependencies
* fix: remove esengine subpath from behavior-tree and blueprint builds
ESEngine integration code will only be available in full engine builds.
Framework packages are now purely engine-agnostic.
* fix: move network-protocols to framework, build both in CI
* fix: update workflow paths from packages/core to packages/framework/core
* fix: exclude esengine folder from type-check in behavior-tree and blueprint
* fix: update network tsconfig references to new paths
* fix: add test:ci:framework to only test framework packages in CI
* fix: only build core and math npm packages in CI
* fix: exclude test files from CodeQL and fix string escaping security issue
YHHandGitHub