Skip to content

Remove inline JavaScript. - #2013

Open
player-03 wants to merge 69 commits into
openfl:8.4.0-devfrom
player-03:unsafe-inline
Open

Remove inline JavaScript.#2013
player-03 wants to merge 69 commits into
openfl:8.4.0-devfrom
player-03:unsafe-inline

Conversation

@player-03

Copy link
Copy Markdown
Contributor

Running an inline script requires a website to have one of three things:

  1. No script-src directive in its content security policy (insecure).
  2. script-src 'unsafe-inline' (insecure).
  3. A nonce or hash for each inline script (secure but high-effort).

https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP#inline_javascript

If we move the inline scripts into output.js, then websites can use a secure CSP without having to update it every time they want to publish a new Lime app.

Users can still call lime.embed() manually if they want, in which case this will refrain from calling it again. This also means it's compatible with OpenFL's index.html template, so we can safely release this before updating that.

@player-03 player-03 mentioned this pull request Mar 3, 2026
dimensionscape and others added 24 commits May 14, 2026 15:14
Originally, this check happened _in addition to_ copying the asset to `targetPath`. I incorrectly made it run instead, which would mean the asset never got copied.

The copy seems to be mostly redundant, but having a valid `sourcePath` means `getAssetData()` and `getPackedAssetData()` can return more information.
Now copying directly into the application directory rather than _obj/assets_. Everything else here is the same.
This adds a native Vulkan context, wires it through the SDL backend, and exposes the bootstrap pieces needed to create an instance and surface from Lime.
This makes Vulkan selectable from project.xml and adds a small smoke test in CI so the new backend stays covered.
Guard the Vulkan helper imports so the doc builds can compile these types on flash and html5 as well as native targets.
Add the first logical device, queue, command pool, command buffer, fence, and semaphore wrappers for Lime's Vulkan API. Back them with native CFFI calls and exercise the path in the Vulkan smoke test.

Keep the deeper Vulkan primitives behind lime-vulkan so regular Lime apps do not resolve Vulkan-only bindings during startup.
Match the HashLink declarations for Vulkan device enumeration and renderer overlays to the signatures exported by the native hdll.
Introduce comprehensive Vulkan bindings and runtime helpers across Haxe and native code. Updated docs/ImportAll.hx to expose many new lime.graphics.vulkan types. Added numerous Haxe VK* classes and shader SPIR-V assets for the vulkan-smoke test. Major changes in project/src/ExternalInterface.cpp: include <algorithm>, robust device extension enumeration and VK_KHR_portability_subset handling, helpers for choosing present modes, creating/destroying managed swapchains, querying swapchain images and surface formats, finding memory types, and conversion helpers between native Vulkan structs and Haxe/HL values. Also cleaned up existing garbage collectors and added utility functions for array conversions. Tests updated to include Vulkan smoke test assets and project configuration.
Add multiple Vulkan helpers and extended pipeline/command support.

- Implement lime_vk_download_memory (and HL variant) to map and copy device memory to host Bytes.
- Add lime_vk_reset_descriptor_pool (and HL variant) to reset descriptor pools.
- Extend pipeline cache creation to accept initial data and add lime_vk_get_pipeline_cache_data to retrieve cache blobs (with HL variants).
- Expand graphics pipeline state parsing to include stencil ops and per-attachment color write mask.
- Add new command helpers: cmd bind descriptor set (extended), copy buffer<->image region variants, clear depth/stencil image, push constants, and enhanced blit image parameter handling.
- Register new native primes and update NativeCFFI.hx to expose the added functions.
- Minor fix: include VK_IMAGE_USAGE_TRANSFER_SRC_BIT when supported.

These changes are intended to expose more/additional Vulkan functionality to the higher-level API and allow using pipeline caches, fine-grained copy/blit/clear operations, push constants, and descriptor pool management.
Change the Vulkan render-pass/native bindings to accept a packed integer state array instead of many individual parameters. C/C++ and HL CFFI signatures updated to parse the state vector (including a new depthInitialLayout entry) and set attachment initial layouts accordingly.

Also, I simplified VkImageBlit handling to require the full packed layout (21 ints) and removed the old fallback parsing. Removed the legacy lime_vk_cmd_copy_buffer_to_image bindings/definitions (use the region variant instead).

Updated NativeCFFI prime/load signatures and VKDevice to build and pass the packed state array.
Add multisampling and color-resolve support across the Vulkan backend and tests. Expose framebuffer sample count limits from the native ExternalInterface, parse and store them on VKPhysicalDevice, and add helper methods (getMaxUsableSampleCount, supportsSampleCount). Extend render-pass creation to accept resolve attachment parameters and construct a resolve attachment/subpass pResolveAttachments when needed, and propagate resolveFormat into VKRenderPass. Add multisample state fields to VKGraphicsPipelineInfo and wire rasterizationSamples, sample shading, sample mask, and alpha-to-coverage/one into pipeline creation. Update the example test (vulkan-smoke) to request MSAA, create transient MSAA color attachments, include them in framebuffers, and handle resource creation/disposal. Also increase packed data size checks where appropriate.
Add Vulkan support to C++ Windows and Linux builds and CI. CI: install libvulkan-dev and adjust workflow steps to build the default Vulkan-enabled Lime (remove explicit -D lime-vulkan flags). Build/config: add lime-vulkan defines in include.xml and set LIME_VULKAN for windows/linux in project/Build.xml (respecting no-vulkan/apple/winrt exclusions). Tests: remove the explicit lime-vulkan haxedef from tests/vulkan-smoke/project.xml. README: document that native Vulkan is included in standard Windows and Linux C++ Lime builds and note Apple still requires explicit Vulkan builds/MoltenVK.
Introduce managed Vulkan mapped memory support and several Vulkan convenience helpers. Tracks mapped memory in a ManagedVulkanMappedMemory map, prevents double-mapping, automatically unmaps on vkFreeMemory, and exposes map/unmap/write/flush/invalidate operations. Add UpdateManagedVulkanDescriptorSets to batch-update descriptor sets, plus command helpers (dynamic descriptor set bind, draw indirect, draw indexed indirect, clear attachments). Export new device limit fields (maxPushConstantsSize, minStorageBufferOffsetAlignment, minUniformBufferOffsetAlignment, nonCoherentAtomSize) and update Haxe NativeCFFI bindings/primes for new functions.
Add managedVulkanDeviceProcCache to store PFN_vkVoidFunction lookups per VkDevice and a ClearManagedVulkanDeviceProcCache helper.
…_GameControllerDB/

Seems to have been a while. Last commit for mappings in Lime that I found was: 314e020
Standardize the window attribute name to renderer. ProjectXMLParser now recognizes "renderer" and sets the window renderType. README and tests/vulkan-smoke/project.xml updated to use <window renderer="vulkan" />.
player-03 and others added 30 commits June 2, 2026 13:00
This follows the direction discussed in openfl#1802 without changing existing input callback signatures or adding a second set of precise events.

Store the current dispatch timestamp on lime.app.Event, add an internal timestamped dispatch path for backends, and forward native and HTML5 key/gamepad timestamps through the existing event objects so callers can read values like window.onKeyDown.timestamp inside the current callback.

Add unit coverage for dispatch-time fallback, explicit timestamp injection, and nested dispatch restoration.

Closes openfl#1802.
Use a neutral fallback timestamp under lime_doc_gen instead of calling System.getTimer() outside of a live runtime context.

This keeps the docs compile path working for the input timestamp change added in 42785a2.
Latest version of pixman has fixed support for compiling the neon
assembly files with clang.

Older android ndks required disabling the integrated assembler to build
them but that workaround is no longer required. This also avoids the bug
where older ndks didn't pass -march automatically to external
assemblers. See:
android/ndk#906 (comment)
GCC does not have syntax unified set explicitly, so pixman has to be
able to set it.
Some older clang ndk's integrated assemblers have issues still with the
arm64 assembly files. We can just continue disabling the integrated
assembler there.

The assembly is fine with the integrated assembler on versions r20 and
above.
Introduce Lime-level AudioInput and AudioInputDevice classes so frameworks can poll raw PCM capture data without changing existing event contracts.

The native backend uses the existing OpenAL capture bindings to expose support checks, default device lookup, start/stop, sample availability, and Bytes reads. HTML5 and Flash compile as unsupported stubs for now, and the docs import list includes the new media types.
In a perspective projection matrix, the bottom-right element must be 0 to ensure correct perspective division.
Expose alcIsExtensionPresent
Recover native OpenAL playback when the active output device is disconnected.

Some OpenAL implementations expose ALC_EXT_disconnect without newer device
event or reopen extensions. In that case, active sources could stop producing
audio after a headset or output device was unplugged, and they would not recover
when another output became available.

Track the current OpenAL context generation, poll ALC_CONNECTED as a low-cost
compatibility fallback, and recreate the OpenAL context when the active device is
lost. Active native AudioSource instances snapshot their playback state before
recovery and restore their source handles, buffers, gain, pitch, position, time,
loop count, and playing state afterward.

Also remember the startup default output device and reopen it when it becomes
the default again, so playback can move back from a fallback output to the
original headset/device.

If we migrate to a a higher version of OpenAL, we can make polling a pure fallback for MojoAL.
Add handling for inline looping audio streams by tracking per-buffer and per-stream loop counts.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

10 participants