@dcl-regenesislabs/bevy-explorer-web 0.1.0-30919084774.commit-e4fb497 → 0.1.0-30923897152.commit-813e18e
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/{Showcase-c98NYstO.js → Showcase-BjOKt2Yi.js} +1 -1
- package/assets/{design-H00ZXCGo.js → design-CX_vgJF2.js} +1 -1
- package/assets/{index-C0aNBww_.css → index-BFekMXxq.css} +1 -1
- package/assets/{index-D1Ns6Ojf.js → index-CB-x_RE0.js} +3 -3
- package/assets/{menus-FQ5bowl0.js → menus-0N3O_Edo.js} +1 -1
- package/assets/{vendor-1M5K-HyI.css → vendor-9j1sRauX.css} +1 -1
- package/assets/{vendor-9zEBwSKp.js → vendor-DidEmaV1.js} +1 -1
- package/bridge-scene/static/BevyExplorerUI/about +1 -1
- package/bridge-scene/static/{bafkreiarx6gwfip7unm5ejm6de66gt6hv2icjiefgojoxwi6gwfzacdwoa → bafkreihhiilft5bqrq62st3u7ks5oalmqe43kqhtnm6swu7eqrom7gffaa} +1 -1
- package/engine/engine.js +10 -1
- package/engine/pkg/sandbox_worker.bundle.js +6281 -0
- package/engine/pkg/webgpu_build_bg.wasm +0 -0
- package/engine/sandbox_worker.js +29 -4
- package/index.html +17 -17
- package/package.json +3 -3
|
Binary file
|
package/engine/sandbox_worker.js
CHANGED
|
@@ -3,6 +3,10 @@
|
|
|
3
3
|
// Import the wasm-bindgen generated JS glue code.
|
|
4
4
|
import init, * as wasm_bindgen_exports from "./pkg/webgpu_build.js";
|
|
5
5
|
|
|
6
|
+
// The capability the trusted super-user scene is given below. Captured before the scrub so the
|
|
7
|
+
// constructor survives while the global does not.
|
|
8
|
+
const RealBroadcastChannel = self.BroadcastChannel;
|
|
9
|
+
|
|
6
10
|
// self.WebSocket = {}
|
|
7
11
|
|
|
8
12
|
console.log("[Sandbox Worker] Starting");
|
|
@@ -71,10 +75,31 @@ var jsProxy = undefined;
|
|
|
71
75
|
var jsPreamble = undefined;
|
|
72
76
|
function createJsContext(wasmApi, context) {
|
|
73
77
|
const isSuper = wasmApi.is_super(context);
|
|
74
|
-
|
|
78
|
+
|
|
79
|
+
// The allowlist below cannot withhold a capability: jsProxy is only consulted for
|
|
80
|
+
// `globalThis.X` property lookups, so a bare identifier in scene code resolves straight
|
|
81
|
+
// through to the real worker global. Withholding therefore has to be a deletion from that
|
|
82
|
+
// global. `Worker` goes with it — a nested worker is a fresh realm whose global has
|
|
83
|
+
// BroadcastChannel back, which would undo the deletion in one line. (SharedWorker isn't
|
|
84
|
+
// exposed to dedicated workers in Chromium, but delete it too for other engines.)
|
|
85
|
+
//
|
|
86
|
+
// Runs before preloadModules and before any scene code, so nothing untrusted has observed
|
|
87
|
+
// the pre-scrub global. Deleting for super-user scenes as well keeps one code path: the
|
|
88
|
+
// trusted scene gets the captured constructor back through jsContext, below.
|
|
89
|
+
delete self.BroadcastChannel;
|
|
90
|
+
delete self.Worker;
|
|
91
|
+
delete self.SharedWorker;
|
|
92
|
+
|
|
93
|
+
// BroadcastChannel is a same-origin, serverless side channel — handed ONLY to the trusted
|
|
75
94
|
// super-user (--ui) scene, so an embedded host page can drive it; ordinary scenes never see it
|
|
76
95
|
// (it would otherwise let an untrusted scene coordinate with the page / other scenes off-network).
|
|
77
|
-
|
|
96
|
+
if (isSuper) {
|
|
97
|
+
Object.defineProperty(jsContext, "BroadcastChannel", {
|
|
98
|
+
configurable: false,
|
|
99
|
+
value: RealBroadcastChannel,
|
|
100
|
+
});
|
|
101
|
+
}
|
|
102
|
+
|
|
78
103
|
const sceneLabel = context.get_scene_title();
|
|
79
104
|
const sceneStartTime = performance.now();
|
|
80
105
|
function scenePrefix() {
|
|
@@ -179,7 +204,7 @@ function createJsContext(wasmApi, context) {
|
|
|
179
204
|
if (propKey === "global") return jsProxy;
|
|
180
205
|
if (propKey === "undefined") return undefined;
|
|
181
206
|
if (jsContext[propKey] !== undefined) return jsContext[propKey];
|
|
182
|
-
if (
|
|
207
|
+
if (allowListES2020.includes(propKey)) {
|
|
183
208
|
return globalThis[propKey];
|
|
184
209
|
}
|
|
185
210
|
return undefined;
|
|
@@ -187,7 +212,7 @@ function createJsContext(wasmApi, context) {
|
|
|
187
212
|
});
|
|
188
213
|
|
|
189
214
|
const contextKeys = Object.getOwnPropertyNames(jsContext);
|
|
190
|
-
const allGlobals = [...new Set([...
|
|
215
|
+
const allGlobals = [...new Set([...allowListES2020, ...contextKeys])];
|
|
191
216
|
jsPreamble = allGlobals
|
|
192
217
|
.map((key) => `const ${key} = globalThis.${key};`)
|
|
193
218
|
.join("\n");
|
package/index.html
CHANGED
|
@@ -10,12 +10,12 @@
|
|
|
10
10
|
/>
|
|
11
11
|
<meta name="theme-color" content="#2c1442" />
|
|
12
12
|
<!-- Favicons (same art as the engine page's set). Vite rebases these for the CDN base. -->
|
|
13
|
-
<link rel="icon" type="image/png" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
14
|
-
<link rel="icon" type="image/svg+xml" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
15
|
-
<link rel="shortcut icon" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
16
|
-
<link rel="apple-touch-icon" sizes="180x180" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
13
|
+
<link rel="icon" type="image/png" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/favicon/favicon-96x96.png" sizes="96x96" />
|
|
14
|
+
<link rel="icon" type="image/svg+xml" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/favicon/favicon.svg" />
|
|
15
|
+
<link rel="shortcut icon" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/favicon/favicon.ico" />
|
|
16
|
+
<link rel="apple-touch-icon" sizes="180x180" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/favicon/apple-touch-icon.png" />
|
|
17
17
|
<meta name="apple-mobile-web-app-title" content="Decentraland Web" />
|
|
18
|
-
<link rel="manifest" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
18
|
+
<link rel="manifest" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/favicon/site.webmanifest" />
|
|
19
19
|
<!-- Social cards -->
|
|
20
20
|
<meta property="og:title" content="Decentraland" />
|
|
21
21
|
<meta property="og:description" content="Explore a social virtual world from your browser." />
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
<meta name="twitter:card" content="summary" />
|
|
24
24
|
<!-- The loading overlay's full-screen backdrop (1.7MB). Prefetch it during the login screen
|
|
25
25
|
(low priority, won't fight first paint) so it's cached before we enter and freeze. -->
|
|
26
|
-
<link rel="prefetch" as="image" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
26
|
+
<link rel="prefetch" as="image" href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/login/gradient-background.webp" />
|
|
27
27
|
<style>
|
|
28
28
|
/* Instant branded first paint. The JS bundle + React mount take a moment (longer over a slow
|
|
29
29
|
tunnel/network) and #root is empty until then — without this the page flashes white. This
|
|
@@ -71,16 +71,16 @@
|
|
|
71
71
|
}
|
|
72
72
|
}
|
|
73
73
|
</style>
|
|
74
|
-
<script type="module" crossorigin src="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
75
|
-
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
76
|
-
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
77
|
-
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
78
|
-
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
79
|
-
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
80
|
-
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
81
|
-
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
82
|
-
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
83
|
-
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
74
|
+
<script type="module" crossorigin src="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/index-CB-x_RE0.js"></script>
|
|
75
|
+
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/rolldown-runtime-D9-fqq9M.js">
|
|
76
|
+
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/design-CX_vgJF2.js">
|
|
77
|
+
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/vendor-DidEmaV1.js">
|
|
78
|
+
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/menus-0N3O_Edo.js">
|
|
79
|
+
<link rel="modulepreload" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/emoji-DrfHOLaz.js">
|
|
80
|
+
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/design-BdxsbUvY.css">
|
|
81
|
+
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/vendor-9j1sRauX.css">
|
|
82
|
+
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/menus-BDWqQaLj.css">
|
|
83
|
+
<link rel="stylesheet" crossorigin href="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/index-BFekMXxq.css">
|
|
84
84
|
</head>
|
|
85
85
|
<body>
|
|
86
86
|
<!-- React HUD mounts here; the engine runs in a same-origin iframe rendered
|
|
@@ -88,7 +88,7 @@
|
|
|
88
88
|
pre-React branded splash; createRoot() clears it on mount. -->
|
|
89
89
|
<div id="root">
|
|
90
90
|
<div id="boot-splash">
|
|
91
|
-
<img src="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
91
|
+
<img src="https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e/assets/logo.png" alt="" />
|
|
92
92
|
<h1>Decentraland</h1>
|
|
93
93
|
</div>
|
|
94
94
|
</div>
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dcl-regenesislabs/bevy-explorer-web",
|
|
3
|
-
"version": "0.1.0-
|
|
3
|
+
"version": "0.1.0-30923897152.commit-813e18e",
|
|
4
4
|
"scripts": {
|
|
5
5
|
"postinstall": "node ./scripts/prebuild.js"
|
|
6
6
|
},
|
|
@@ -8,6 +8,6 @@
|
|
|
8
8
|
"type": "git",
|
|
9
9
|
"url": "git+https://github.com/decentraland/bevy-explorer.git"
|
|
10
10
|
},
|
|
11
|
-
"homepage": "https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-
|
|
12
|
-
"commit": "
|
|
11
|
+
"homepage": "https://cdn.decentraland.org/@dcl-regenesislabs/bevy-explorer-web/0.1.0-30923897152.commit-813e18e",
|
|
12
|
+
"commit": "813e18ea20f3af41946536a9b52696e58d840f50"
|
|
13
13
|
}
|