Changelog

Release notes for the Bitruvius SDK, newest first. Every @bitruvius/* package moves in lockstep, so one version heading covers the whole bundle.

0.3.1

@bitruvius/sdk-maplibre

• Fix README links that 404 on npm. npm resolves relative markdown links against the package namespace rather than the tarball, so [LICENSE](./LICENSE) rendered as /package/@bitruvius/LICENSE. Every publishable package carried at least one. The licence is now linked at its public, immutable URL, sibling packages link to npmjs.com, and files that exist only inside the tarball are named as plain text.
  • @bitruvius/bvc@0.3.1
  • @bitruvius/draco@0.3.1
  • @bitruvius/foundation@0.3.1
  • @bitruvius/geo-core@0.3.1
  • @bitruvius/geoid@0.3.1
  • @bitruvius/gltf@0.3.1
  • @bitruvius/i3s@0.3.1
  • @bitruvius/ktx2@0.3.1
  • @bitruvius/mesh@0.3.1
  • @bitruvius/point-symbols@0.3.1
  • @bitruvius/ptcloud@0.3.1
  • @bitruvius/render-runtime@0.3.1
  • @bitruvius/splats@0.3.1
  • @bitruvius/tiles3d@0.3.1
  • @bitruvius/tiles3d-mesh@0.3.1
  • @bitruvius/tiles3d-points@0.3.1
  • @bitruvius/turbo-lepcc@0.3.1
  • @bitruvius/turbo-lerc@0.3.1
  • @bitruvius/turbo-spz@0.3.1

0.3.0

@bitruvius/sdk-maplibre

• First public release.

  Esri I3S KTX2 textures. Services publishing ktx2 in their textureSetDefinitions decoded to an untextured tile with nothing logged — the format was named throughout the types and the scene-layer parser, but the decoder had no branch for it. The transcoder is injected, so the package takes no dependency on the Basis wasm and the wasm is fetched only when a node actually carries a KTX2 texture.

  Installable from npm. The published bundle imported two private: true workspace packages through a lazy import(), on the assumption that dynamic imports stay out of consumer bundles. Bundlers resolve them at build time, so npm i followed by a Vite or webpack build failed on an unresolvable specifier. The same resolution inlined both reference decoders into the public CDN bundle — about 82% of its bytes.

  Security. Twelve findings from a pre-launch sweep, each fixed test-first:

  • Esri and static tileset credentials were sent to any host that asked. A tileset names the URLs it fetches, so a hostile one harvested the caller's ArcGIS token, ion Bearer or Google API key. Credentials are now scoped to the origin they were minted for.
  • Two parsers could hang the tab at parse time from numbers in a tileset.json: an unbounded corner grid from a malformed region, and a complete N-ary walk from uncapped implicit-tiling levels. Both synchronous, so nothing could interrupt them.
  • Three unbounded allocations in the glTF and 3D Tiles metadata paths.
  • Service-supplied attribution text reached an innerHTML sink unescaped.

  Docs. Every documented symbol now carries its own description; the reference no longer publishes internal machinery, states defaults that contradict the code, or links into a private repository. A version switcher and a changelog ship with it.

  Licensing. Apache-2.0 and MIT texts for the vendored decoders now ship, as does attribution for an inlined dependency, and the terms no longer purport to restrict rights those licences grant.

• @bitruvius/bvc@0.3.0

• @bitruvius/draco@0.3.0

• @bitruvius/foundation@0.3.0

• @bitruvius/geo-core@0.3.0

• @bitruvius/geoid@0.3.0

• @bitruvius/gltf@0.3.0

• @bitruvius/i3s@0.3.0

• @bitruvius/ktx2@0.3.0

• @bitruvius/mesh@0.3.0

• @bitruvius/point-symbols@0.3.0

• @bitruvius/ptcloud@0.3.0

• @bitruvius/render-runtime@0.3.0

• @bitruvius/splats@0.3.0

• @bitruvius/tiles3d@0.3.0

• @bitruvius/tiles3d-mesh@0.3.0

• @bitruvius/tiles3d-points@0.3.0

• @bitruvius/turbo-lepcc@0.3.0

• @bitruvius/turbo-lerc@0.3.0

• @bitruvius/turbo-spz@0.3.0