fix(web): vendor the Macroquad browser loader

The page depended on the externally hosted miniquad bundle, which violates a same-origin `script-src 'self'` policy and makes the game depend on a third party at runtime. Vendor the current official loader alongside the web assets and move the WASM `load` call into a local bootstrap script, preserving plugin registration order without inline JavaScript. Document the CSP requirement for WebAssembly compilation and same-origin connections. The vendored bundle is the current response from the official Macroquad loader URL and was syntax-checked before committing. Test Plan: - `just web-build` -- passed - `node --check web/mq_js_bundle.js web/storage.js web/bootstrap.js` -- passed - `prettier --check web/storage.js web/bootstrap.js` -- passed - Browser smoke test with `script-src 'self' 'wasm-unsafe-eval'` and `connect-src 'self'` -- passed; 640x460 canvas and no CSP/script errors - `git diff --cached --check` -- passed
2026-08-29 17:12:43 +02:00
parent a81741b470
commit acb0c20b59
5 changed files with 18 additions and 7 deletions
@@ -46,10 +46,8 @@
  <body>
    <canvas id="glcanvas" tabindex="1" aria-label="TDK Pinball Machine"></canvas>
    <noscript>This game needs JavaScript enabled.</noscript>
-    <script src="https://not-fl3.github.io/miniquad-samples/mq_js_bundle.js"></script>
+    <script src="./mq_js_bundle.js"></script>
    <script src="./storage.js"></script>
-    <script>
-      load("tdkpin-rs.wasm");
-    </script>
+    <script src="./bootstrap.js"></script>
  </body>
 </html>