What's new

Official launch — scoped API keys, live status, and a hardened embed

Meshless is officially open. Alongside launch, this release makes API keys carry their own permissions, fails deleted workspaces closed with a recovery window, and makes the embed runtime leaner and safer.

New

• Permission-scoped API keys — each key now carries its own fixed set of permissions, chosen at creation and immutable afterward, instead of inheriting a role. You can only grant permissions you hold yourself, and keys created before this release keep full access.
• Live system status — the dashboard shows real service status from our status provider in place of static figures.
• Grouped timezone picker — workspace settings replaces the free-text timezone field with a region-grouped list, so you pick a valid zone instead of typing an IANA id.

Improved

• API documentation — the reference now lives at meshless.io/docs/api-reference, always in sync with the live API; the older in-dashboard developer page has been retired in its favor.
• Leaner embed on large captures — the viewer preloads frames within a bounded window and evicts with an LRU cache, so multi-thousand-frame products no longer spike memory or crash mobile tabs.
• Embed origin pinning — a new data-parent-origin attribute pins the viewer's outgoing postMessage events to a specific parent origin for stricter isolation.
• Hardened embed generation — generated snippets escape their values and hotspot links are restricted to http(s) targets, closing snippet- and URL-injection edges.

Fixed

• Deleted-workspace access — deleting an organization now revokes its API keys immediately; a stale key can no longer reach data. Workspace data is retained for 30 days for accidental-deletion recovery, then permanently purged.
• Telemetry hygiene — signed upload/download URLs are scrubbed from error and diagnostic reports so short-lived credentials never leak into logs.

Plan quotas, zero-storage, and viewer fixes

A focused follow-up to 1.0.0: stricter plan enforcement, a zero-storage option, and a round of viewer and onboarding fixes.

New

• Per-project quotas — variant and hotspot limits are now enforced per plan. The Studio disables the relevant control with an upgrade prompt at the cap.
• Zero source storage — opt in to "do not store source model" at upload, or remove the source from an existing project. When the source is not stored, re-export and variants are locked (they need the source GLB).
• Guided start — a short welcome on first sign-in, plus a one-click sample model to explore the editor without uploading.

Improved

• Variant re-export — re-encoding a model now regenerates its variants in a single batch, behind a typed confirmation so it can't run by accident.
• Pricing — the pricing page shows the public plans only.
• Rate limits — switched to burst-friendly token-bucket limits and added a re-export guard, so normal use is never throttled while abuse is still capped. Limit responses now return an accurate Retry-After.

Fixed

• Auto-rotate — embeds now honor the auto-rotate setting saved in the Studio instead of overriding it.
• Variant flash — opening an embed on a specific variant no longer shows the base model first.
• Hotspot alignment — hotspots are positioned against the rendered image area, so they land in the same spot in the Studio and in the embed regardless of container shape.

Official Production Release

Meshless is out of beta. This release stabilizes the platform across the API, Studio, and embed runtime for production use.

Production hardening

• Security headers — strict CSP, HSTS, and frame-ancestor policies applied globally.
• CDN-only delivery — encoded frame sets are served exclusively from Cloudflare R2 over the CDN, with enforced cache-control.
• Health checks — /health, /health/live, and /health/ready back uptime monitoring and deployment readiness.

Plan quotas

• Per-plan caps for variants and hotspots are enforced on every write; exceeding a cap returns 402.
• Counters stay in sync with the subscription state, so downgrades take effect on the next write.

Studio safety

• Destructive actions (delete project, variant, or hotspot) require typing the item name to confirm.
• The expected name is shown inline as a copyable monospace chip; Enter submits when it matches.

Fixed — cache invalidation on re-renders

Re-renders weren't visible in live embeds because frame URLs were unchanged and CDN/browser caches kept serving the old images.

• Every successful upload bumps RenderVersion (a Unix timestamp) and appends ?v={renderVersion} to all frame URLs, so caches treat them as new resources.
• This applies to base frames, variant frame sets, and per-frame replacements.
• The embed's ISR cache is invalidated after each re-encode, so live embeds update without waiting for the cache window.

Fixed — dashboard polish

• Smoother high-frequency editing on smaller viewports.
• Consistent modal accessibility (focus trap, aria-modal, Escape-to-dismiss) across confirmation dialogs.

Frames tab redesign, per-frame variant replace, and cache fixes

This release redesigns the Frames tab, enables per-frame replacement for variant frame sets, fixes variant re-render cache invalidation, and improves the dashboard's confirmation dialogs.

Frames tab redesign

The Frames tab has been replaced with a grid layout and now supports all variant frame sets alongside the base model.

• Grid layout — frames render in a repeat(auto-fill, minmax(88px, 1fr)) grid instead of a horizontal film strip. Every frame is visible at once without horizontal scrolling.
• Source selector — a pill bar above the grid lets you switch between the base model and any Ready variant. The active source is highlighted; pending variants are shown at reduced opacity.
• Row selector — multi-row projects show row buttons above the grid. Switching source resets the row selection to prevent out-of-bounds frame requests.
• START badge — the starting frame is marked with a green badge. Only the base model tracks a starting frame.
• Hover actions — hovering a base model frame shows Set as start and Replace. Hovering a variant frame shows Replace only.

Per-frame replace for variants

Individual frames in a variant frame set can now be replaced without re-rendering the entire variant.

Hover any frame while a variant source is selected and click Replace. Upload a replacement image in the same format as the project's export. On confirmation:

• The new frame is uploaded directly to R2.
• RenderVersion is bumped so CDN and browser caches immediately serve the updated frame.
• The embed viewer data cache is invalidated.

New API endpoints:

POST /api/projects/{projectId}/colorways/{colorwayId}/frames/{frameIndex}/generate-replace-url
POST /api/projects/{projectId}/colorways/{colorwayId}/frames/{frameIndex}/confirm-replace

Both follow the same request and response shape as the existing base model frame replace endpoints.

Variant re-render cache busting

Re-rendering a variant previously had no visible effect because the frame URLs were unchanged and CDN/browser caches served the old images.

Variants now carry a RenderVersion field. Every successful complete-upload bumps this value to the current Unix timestamp. The frameUrlTemplate returned by the API appends ?v={renderVersion} to all frame URLs, forcing CDN and browser caches to treat them as new resources.

Preview tab variant switching

The Preview tab now includes a Variants panel above the viewer config. Switching between Base model and any ready variant updates the Player360 embed in real time so you can compare renders without leaving the tab.

Re-export embed cache fix

After re-encoding a project from the Export tab, the embed's Next.js ISR cache was not being invalidated. Embeds served stale frames until the ISR window expired.

revalidateEmbedCache is now called immediately after every successful re-encode so the embed reflects the new frames without delay. The distributed viewer data cache was already evicted on complete-upload; this fix closes the separate ISR layer.

Delete confirmations with type-to-confirm

All destructive actions in the dashboard now use modal dialogs with a type-to-confirm input instead of browser confirm() prompts.

• Project delete, variant delete, and hotspot delete each require typing the item name (or confirm for untitled items) before the delete button activates.
• The name is displayed inline as a monospace chip with a copy icon. Clicking the icon copies the name to the clipboard so it can be pasted directly.
• Pressing Enter submits when the input matches.
• The embed override reset dialog uses a simple Cancel / Confirm flow without a typed input.

Per-project variant and hotspot limits

This release adds per-project usage limits for variants and hotspots, with live Studio indicators, server-side enforcement, and new Studio documentation.

Variant limits per project

The number of alternate rendered frame sets per project is now gated by plan.

The Colorways panel in Studio shows a X / Y count. When the limit is reached, the Create & render button is disabled and an upgrade link appears. Replacing an existing variant is always allowed.

Hotspot limits per project

The number of saved hotspots per project is now gated by plan.

The Hotspots panel in Studio shows a X / Y count. Placing a hotspot when the limit is reached shows an error toast with a link to upgrade.

Server-side enforcement

Both limits are enforced at the API layer:

• POST /api/projects/{id}/colorways returns 402 Payment Required when the variant cap is exceeded.
• POST /api/projects/{id}/hotspots returns 402 Payment Required when the hotspot cap is exceeded.

PlanLimits API changes

The PlanLimits object returned by /api/subscriptions/current and /api/plans now includes two new fields:

New Studio documentation

• Hotspots — full guide covering placement, types, visual styles, appearance settings, dynamic embed hotspots, JavaScript runtime control, and plan limits.
• Variants — full guide covering the base frame set, rendering in Studio, variant states, embed switcher, JavaScript switching, API reference, and plan limits.

Rich hotspots, variants, and embed script improvements

This release expands Meshless from a plain 360° viewer into a richer product storytelling layer.

Rich hotspot system

Hotspots now support four content types and three visual styles, with per-hotspot color, icon, and visibility controls.

Types

Visual styles

Appearance controls

Each hotspot now accepts accentColor, backgroundColor, textColor, icon, openInNewTab, and isVisible fields.

Studio placement

Hotspots can be placed directly on the viewer in Studio. Rotate to the target frame, click the product, and the hotspot is created at the normalized x/y position. An inline editor handles label, frame reassignment, and deletion.

Variants

Additional rendered frame sets can now be attached to a project — one per color option, material, or product state. Each variant shares the camera orbit, frame count, and resolution of the base project.

• Variants are created in Studio by re-rendering the source GLB with new material or background settings.
• Only Ready variants appear in the embed switcher — pending uploads are hidden.
• Variants can be replaced without changing their ID, so live embeds update transparently.

Variant switcher

When more than one ready variant exists, the embed shows a compact switcher. Use setColorway via postMessage to sync the viewer with an existing color swatch UI:

window.postMessage(
  {
    source: 'meshless-viewer-config',
    event: 'setColorway',
    data: { colorwayId: 'walnut-id' },
  },
  '*',
);

Embed script improvements

• New data-autorotate-speed, data-autorotate-direction, data-autorotate-pause-on-hover, and data-autorotate-resume-delay attributes.
• New data-sensitivity, data-vertical-sensitivity, data-invert-x, data-invert-y for drag control.
• New data-momentum and data-momentum-friction for coasting behavior after drag release.
• New data-keyboard for arrow key navigation.
• Added <meshless-viewer> web component — same attributes as the div embed, works in Vue, Svelte, and Angular.

API changes

• Hotspot create/update/delete endpoints now accept all rich fields.
• New GET /api/projects/{id}/colorways and associated CRUD + upload endpoints.
• Public viewer endpoint now returns hotspots and colorways in the response.
• Viewer cache is invalidated after hotspot and colorway mutations so embeds receive fresh data after project edits.

Rich hotspots, variants, and embed improvements

This release expands Meshless from a plain 360° viewer into a richer product storytelling layer.

Rich hotspot system

Hotspots now support four content types and three visual styles, with per-hotspot color, icon, and visibility controls.

Types

Visual styles

Appearance controls

Each hotspot now accepts accentColor, backgroundColor, textColor, icon, openInNewTab, and isVisible fields.

Studio placement

Hotspots can be placed directly on the viewer in Studio. Rotate to the target frame, click the product, and the hotspot is created at the normalized x/y position. An inline editor handles label, frame reassignment, and deletion.

Variants

Additional rendered frame sets can now be attached to a project — one per color option, material, or product state. Each variant shares the camera orbit, frame count, and resolution of the base project.

• Variants are created in Studio by re-rendering the source GLB with new material or background settings.
• Only Ready variants appear in the embed switcher — pending uploads are hidden.
• Variants can be replaced without changing their ID, so live embeds update transparently.

Variant switcher

When more than one ready variant exists, the embed shows a compact switcher. Send a setColorway postMessage to sync the viewer with an existing color swatch UI.

window.postMessage(
  {
    source: 'meshless-viewer-config',
    event: 'setColorway',
    data: { colorwayId: 'walnut-id' },
  },
  '*',
);

Embed script improvements

• New data-autorotate-speed, data-autorotate-direction, data-autorotate-pause-on-hover, and data-autorotate-resume-delay attributes.
• New data-sensitivity, data-vertical-sensitivity, data-invert-x, data-invert-y for drag control.
• New data-momentum and data-momentum-friction for coasting behavior after drag release.
• New data-keyboard for arrow key navigation.
• Added <meshless-viewer> web component — same API as the div embed, works in Vue, Svelte, and Angular.

API changes

• Hotspot create/update/delete endpoints now accept all rich fields.
• New GET /api/projects/{id}/colorways and associated CRUD + upload endpoints.
• Public viewer endpoint now returns hotspots and colorways in the response.
• Viewer cache is invalidated after hotspot and colorway mutations so embeds receive fresh data after project edits.