Files
GeoLibre/scripts
Qiusheng Wu 84a1dc0b5e chore: pin the web CSP's jsDelivr paths and tighten loose types (#2906)
* chore: pin the web CSP's jsDelivr paths and tighten loose types

Follow-up cleanups from #2869:

- docker/nginx.conf: the app policy lists the same version-pinned
  jsDelivr script-src paths as tauri.conf.json instead of all of /npm/
  and /pyodide/. The JupyterLite policy drops /npm/ and keeps /pyodide/
  (its version comes from the pip-resolved kernel). tauri-csp.test.ts
  parses nginx.conf and checks both.
- CLAUDE.md: tile hosts need no CSP change; script-src is pinned.
- StoryChapterLocation pitch/bearing are optional. Cesium and
  applyStoryViewAndWait fill an absent value from the current camera
  (it was NaN on Cesium), Mapbox leaves the key out, and the story CSV
  writes an empty cell instead of "undefined".
- geojsonToCsv and shapefileFieldWarnings accept null geometries;
  shadow-style addLayer accepts an inline-source layer.
- Drop the test casts those worked around, type the root
  @mapbox/vector-tile copy locally in geojson-vt-tiling.test.ts, and
  lower the test type-check baseline to 0.
- A null registry bundleSha256 is treated as absent without a warning.
- Rename a variable that shadowed main() and skip a repeated existence
  check in upstream-contract.ts.

Part of #2869.

* Address review feedback

- Document that a story location's pitch/bearing are optional only in
  memory: loading a project or a CSV fills an absent value with 0, as
  it always has, so existing files keep playing north-up and flat.
- Assert the CSV round trip fills an empty pitch/bearing cell with 0.

* Address Claude review feedback

- Drop the LayerSpecification import shadow-style.test.ts no longer
  uses after the inline-layer cast was removed.
2026-10-04 09:30:48 -04:00
..