@datamoc/mw_games 0.17.0 → 0.18.0

package/dist/version.d.ts

@@ -9,5 +9,5 @@
  * this from `package.json` automatically, chosen because this project's own build already
  * has no step before `tsc`/`vite` that this would need to run ahead of.
  */
-export declare const version = "0.17.0";
+export declare const version = "0.18.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -9,5 +9,5 @@
  * this from `package.json` automatically, chosen because this project's own build already
  * has no step before `tsc`/`vite` that this would need to run ahead of.
  */
-export const version = '0.17.0';
+export const version = '0.18.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@datamoc/mw_games",
-	"version": "0.17.0",
+	"version": "0.18.0",
 	"description": "A local-file game framework: renderer-free game logic, drawn through PixiJS in 2D or Babylon.js in 3D, with mobile and desktop packaging.",
 	"license": "MPL-2.0",
 	"repository": {

package/sbom.cdx.json

@@ -1,7 +1,7 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:13e7db60-e211-50ba-bee8-7124a3e3943a",
+  "serialNumber": "urn:uuid:41a4c04b-a4b7-51d1-8ed7-ef7398a60e44",
   "version": 1,
   "metadata": {
     "tools": {
@@ -10,16 +10,16 @@
           "type": "application",
           "group": "datamoc",
           "name": "tools/sbom.mjs",
-          "version": "0.17.0"
+          "version": "0.18.0"
         }
       ]
     },
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/%40datamoc/mw_games@0.17.0",
+      "bom-ref": "pkg:npm/%40datamoc/mw_games@0.18.0",
       "name": "@datamoc/mw_games",
-      "version": "0.17.0",
-      "purl": "pkg:npm/%40datamoc/mw_games@0.17.0",
+      "version": "0.18.0",
+      "purl": "pkg:npm/%40datamoc/mw_games@0.18.0",
       "description": "A local-file game framework: renderer-free game logic, drawn through PixiJS in 2D or Babylon.js in 3D, with mobile and desktop packaging.",
       "licenses": [
         {
@@ -4453,7 +4453,7 @@
       ]
     },
     {
-      "ref": "pkg:npm/%40datamoc/mw_games@0.17.0",
+      "ref": "pkg:npm/%40datamoc/mw_games@0.18.0",
       "dependsOn": [
         "pkg:npm/%40babylonjs/core@9.26.0",
         "pkg:npm/%40babylonjs/loaders@9.26.0",

package/tools/csp.mjs

@@ -21,7 +21,16 @@ import { createHash } from 'node:crypto';
  *   extra script texts to allow by hash (a single-file loader's unpacked scripts)
  */
 export function contentSecurityPolicy(html, { connect = [], eval: allowEval = true, scripts = [] } = {}) {
-	const inline = [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi)].map((match) => match[1]);
+	//The HTML parser normalises newlines before it hashes an inline script: CRLF and lone CR
+	//become LF. A checkout with core.autocrlf=true (every Windows clone) hands the source page
+	//over with CRLF, so hashing the bytes on disk here would emit a policy Chrome computes
+	//differently from the file it just parsed, and the page refuses its own script while
+	//`file://` on Linux stays quiet. Hash the text the browser will see.
+	const inline = [...html.matchAll(/<script(?![^>]*\bsrc=)[^>]*>([\s\S]*?)<\/script>/gi)].map((match) =>
+		match[1].replace(/\r\n?/g, '\n'),
+	);
+	//`scripts` are texts the standalone page's unpacker sets on a script element at runtime
+	//(`s.text = code`), where no parser runs: those are hashed exactly as they are written.
 	const hashes = [...new Set([...inline, ...scripts].map((text) => `'sha256-${sha256(text)}'`))];
 	const directives = {
 		'default-src': ["'none'"],

package/tools/sbom.mjs

@@ -313,7 +313,9 @@ async function main(argv) {
 
 	if (argv.includes('--check')) {
 		const committed = await readFile(out, 'utf8').catch(() => undefined);
-		if (committed !== json) {
+		//CRLF is a Windows checkout's doing, not a difference in the BOM itself (and a missing
+		//file still reads as out of date: '' never equals the serialized BOM)
+		if ((committed ?? '').replace(/\r\n/g, '\n') !== json.replace(/\r\n/g, '\n')) {
 			console.error(`${name} is out of date with package-lock.json. Run "npm run sbom" and commit the result.`);
 			process.exitCode = 1;
 		} else {