Release notes for the Bitruvius SDK, newest first. Every @bitruvius/* package moves
in lockstep, so one version heading covers the whole bundle.
Fix two defects that broke the SDK for anyone installing it from npm. Both are specific to the package delivery; loading the SDK from the CDN was unaffected.
@bitruvius/i3s never built its decode workers. The package's build script listed only its
entry module, so dist/ shipped i3s-mesh-decode-worker.d.ts and i3s-point-decode-worker.d.ts
with no matching .js. Both are resolved by the bundler through
new Worker(new URL('./i3s-mesh-decode-worker.js', import.meta.url)), which Vite follows at build
time, so a consumer's production build failed outright:
Could not resolve entry module "node_modules/@bitruvius/i3s/dist/i3s-mesh-decode-worker.js"
Both workers are now built, flat in dist/ where the spawn site resolves them, matching how every
other worker-bearing package in the SDK is packaged.
prepareMapLibre could accept a 404 page as maplibre's worker. maplibre-gl v6 loads its worker
as a separate module, and prepareMapLibre probes a short list of locations to find it. The probe
only checked that the response was 200, and the most common way to deploy a built application is
a static host that answers every unmatched path with index.html and a 200: Netlify, Vercel,
S3 with an error document, vite preview. On those hosts the probe accepted the application's own
HTML page as the worker module. maplibre then handed that URL to new Worker(...), the worker died
parsing HTML, and the map never finished loading its style.
The failure only ever appeared in a deployed build, never on a dev server where the probed paths are real, and it presented as a map stuck at its loading state with nothing in the console. The probe now requires a JavaScript response, rejecting anything served as HTML by content type and falling back to sniffing the response body for hosts that send no content type at all. When no worker can be found, maplibre's own resolution is left in place, which is correct for CDN and native-ESM loading.
Two release gates were added so neither class of defect can ship again. check-pack now derives
the set of files a package must contain by reading its built output, failing the release if any
new URL(..., import.meta.url) reference resolves to a file the tarball does not carry. The
previous list was maintained by hand, and that list is what drifted. The CDN build applies the same
rule to its own worker chunks, requiring one for every spawn site in a published package.
[LICENSE](./LICENSE) rendered as
/package/@bitruvius/LICENSE. Every publishable package carried at least one. The licence is
now linked at its public, immutable URL, sibling packages link to npmjs.com, and files that
exist only inside the tarball are named as plain text.
First public release.
Esri I3S KTX2 textures. Services publishing ktx2 in their textureSetDefinitions
decoded to an untextured tile with nothing logged — the format was named throughout
the types and the scene-layer parser, but the decoder had no branch for it. The
transcoder is injected, so the package takes no dependency on the Basis wasm and the
wasm is fetched only when a node actually carries a KTX2 texture.
Installable from npm. The published bundle imported two private: true workspace
packages through a lazy import(), on the assumption that dynamic imports stay out of
consumer bundles. Bundlers resolve them at build time, so npm i followed by a Vite or
webpack build failed on an unresolvable specifier. The same resolution inlined both
reference decoders into the public CDN bundle — about 82% of its bytes.
Security. Twelve findings from a pre-launch sweep, each fixed test-first:
tileset.json: an
unbounded corner grid from a malformed region, and a complete N-ary walk from
uncapped implicit-tiling levels. Both synchronous, so nothing could interrupt them.innerHTML sink unescaped.Docs. Every documented symbol now carries its own description; the reference no longer publishes internal machinery, states defaults that contradict the code, or links into a private repository. A version switcher and a changelog ship with it.
Licensing. Apache-2.0 and MIT texts for the vendored decoders now ship, as does attribution for an inlined dependency, and the terms no longer purport to restrict rights those licences grant.
@bitruvius/bvc@0.3.0
@bitruvius/draco@0.3.0
@bitruvius/foundation@0.3.0
@bitruvius/geo-core@0.3.0
@bitruvius/geoid@0.3.0
@bitruvius/gltf@0.3.0
@bitruvius/i3s@0.3.0
@bitruvius/ktx2@0.3.0
@bitruvius/mesh@0.3.0
@bitruvius/point-symbols@0.3.0
@bitruvius/ptcloud@0.3.0
@bitruvius/render-runtime@0.3.0
@bitruvius/splats@0.3.0
@bitruvius/tiles3d@0.3.0
@bitruvius/tiles3d-mesh@0.3.0
@bitruvius/tiles3d-points@0.3.0
@bitruvius/turbo-lepcc@0.3.0
@bitruvius/turbo-lerc@0.3.0
@bitruvius/turbo-spz@0.3.0