Harden the parser; add an error API; add web builds and a sample viewer; bump version to 1.1.0

That was quite a lot I've been dragging my feet on.

Security and memory safety:

* Fix discovered memory-safety bugs: signed-overflow in the warp grid
  expansion, an out-of-bounds read on negative keyframe indices, NULL+0
  pointer arithmetic when the blend-key table is empty, NULL derefs on
  empty art-mesh bindings and missing key_count reads at the blend-window
  boundary, and an index underflow in psm__valid_range.

* Improved fuzzing verification: PSM_DEBUG_MALLOC build mode that uses
  `malloc` for every model field.

Public API:

* Add per-model csmGetLastError / csmGetErrorString; record error codes
  in the MOC3 header's padding, and expose csmGetMocError so applications
  can receive detailed failure status.

* Add csmGetExtendedVersionString() with embedded git hash to query the
  exact library build.

* Misc. correctness fixes: propagate color to opacity-0 meshes and stop the
  v5.3 extended-modes bit masking constant-mode bits.

Style / housekeeping:

* .clang-format for the library (BSD-KNF) and samples/viewer (raylib
  layout), a clang-format pre-commit hook, make format/format-check
  targets, and a CI check.

* Line wrapping, standardizing on `bool` for all booleans, remove VLAs,
  rename many symbols for consistency, and more!

Sample viewer:

* Implement a sample MOC3 viewer (both v5 and v6 ABI support) using Raylib.
  Supports all blend modes from v6.

WASM port:

* Web/WASM drop-in Live2DCubismCore.js for both v5 and v6.

Build:

* Makefile rewrite with per-OS shared rules and a proper platform matrix.
  WASM support also added.

* Bundle now generated from a template (src/bundle.c.in) instead of manually
  by a script.

* CMake build system added for cross-compilation. This should be easier to
  build on plain Windows.

CI:

* Misc improvements: cross-build is skipped on v* tag pushes (the release
  job rebuilds the matrix itself), and the release job verifies the tag
  matches PSM_TRUE_VERSION in the header before building.

Author: Ronsor

.clang-format

@@ -0,0 +1,31 @@
+# Purism Core house style: BSD KNF / OpenBSD style(9)-ish.
+#  - return type on its own line for function definitions
+#  - column-aligned declarations and #define values
+#  - 2-space indent, control-statement braces attached, function braces on own line
+#  - preprocessor directives indented after the '#'
+# Function-like "statement" macros (control-flow bodies) are hand-aligned and
+# fenced with `// clang-format off/on` where this config would reflow them.
+Language:        Cpp
+BasedOnStyle:    LLVM
+IndentWidth:     2
+UseTab:          Never
+ContinuationIndentWidth: 4
+ColumnLimit:     0
+AlignAfterOpenBracket: DontAlign
+BreakBeforeBraces: Linux
+AlwaysBreakAfterReturnType: AllDefinitions
+PointerAlignment: Right
+AllowShortFunctionsOnASingleLine: None
+AllowShortIfStatementsOnASingleLine: WithoutElse
+AllowShortLoopsOnASingleLine: false
+SpaceBeforeParens: ControlStatements
+Cpp11BracedListStyle: false
+IndentCaseLabels: false
+KeepEmptyLinesAtTheStartOfBlocks: false
+SortIncludes:    Never
+AlignEscapedNewlines: DontAlign
+AlignTrailingComments:
+  Kind:          Leave
+IndentPPDirectives: AfterHash
+AlignConsecutiveDeclarations: true
+AlignConsecutiveMacros: true

.githooks/pre-commit

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Pre-commit: reject staged C sources that aren't clang-format-clean.
+#
+# Enable once per clone:   git config core.hooksPath .githooks   (or: make hooks)
+# Override the binary:     CLANG_FORMAT=clang-format-19 git commit ...
+#
+# Each file's nearest .clang-format decides the style; DisableFormat trees
+# (tests, samples, vendored) are no-ops. Checks the working-tree copy of the
+# staged files (the usual, fast approximation) -- if a file has both staged and
+# unstaged edits, format the whole file before committing.
+
+CLANG_FORMAT="${CLANG_FORMAT:-clang-format}"
+
+files=$(git diff --cached --name-only --diff-filter=ACM -- '*.c' '*.h')
+[ -z "$files" ] && exit 0
+
+if ! command -v "$CLANG_FORMAT" >/dev/null 2>&1; then
+	echo "pre-commit: $CLANG_FORMAT not found; skipping format check" >&2
+	exit 0
+fi
+
+if ! "$CLANG_FORMAT" --dry-run --Werror $files; then
+	echo >&2
+	echo "pre-commit: staged C sources need formatting." >&2
+	echo "  fix with:  make format   (then re-stage)" >&2
+	exit 1
+fi
+exit 0

.github/workflows/ci.yml

@@ -8,6 +8,23 @@ on:
     branches: [master]
 
 jobs:
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      # Pinned: clang-format output drifts between major versions, so the gate
+      # must use the same version the tree was formatted with.
+      - name: Install clang-format
+        run: pip install clang-format==19.1.7
+
+      - name: Check formatting
+        run: make format-check
+
   build-and-test:
     runs-on: ubuntu-latest
     steps:
@@ -28,41 +45,97 @@ jobs:
   cross-build:
     runs-on: ubuntu-latest
     needs: build-and-test
+    # The release job rebuilds the whole matrix itself (and it is the only job
+    # that can lipo a universal Viewer.app / dylib), so on a tag push the 7
+    # cross-build targets + their artifact uploads are pure duplication -- skip
+    # them and let release be the single build. (PR and branch pushes keep the
+    # matrix, which uploads per-target artifacts for inspection.)
+    if: github.event_name != 'push' || !startsWith(github.ref, 'refs/tags/v')
     strategy:
       matrix:
         target:
-          - linux-x64
-          - linux-arm64
-          - macos-x64
-          - macos-arm64
-          - win-x64
-          - win-x86
-          - win-arm64
+          - zig-cross-linux-x86_64
+          - zig-cross-linux-arm64
+          - zig-cross-macos-x86_64
+          - zig-cross-macos-arm64
+          - zig-cross-windows-x86_64
+          - zig-cross-windows-x86
+          - zig-cross-windows-arm64
     steps:
       - uses: actions/checkout@v4
 
       - uses: mlugg/setup-zig@v2
         with:
           version: 0.16.0
 
+      # raylib v6.0 release archive for this target (viewer-in-dist is opt-in
+      # via RAYLIB_DIR_<PRESET> env vars; if a target has no archive -- e.g.
+      # zig-cross-windows-arm64 only ships MSVC-built raylib -- the viewer is skipped and
+      # the library still builds). Pinned to v6.0; bump here + in the release
+      # job together when upgrading.
+      - name: Fetch raylib v6.0 for ${{ matrix.target }}
+        shell: bash
+        run: |
+          case "${{ matrix.target }}" in
+            zig-cross-linux-x86_64)    url=raylib-6.0_linux_amd64.tar.gz;     var=RAYLIB_DIR_LINUX_AMD64;   ext=tar.gz ;;
+            zig-cross-linux-arm64)     url=raylib-6.0_linux_arm64.tar.gz;     var=RAYLIB_DIR_LINUX_ARM64;   ext=tar.gz ;;
+            zig-cross-macos-x86_64)    url=raylib-6.0_macos.tar.gz;           var=RAYLIB_DIR_MACOS;         ext=tar.gz ;;
+            zig-cross-macos-arm64)     url=raylib-6.0_macos.tar.gz;           var=RAYLIB_DIR_MACOS;         ext=tar.gz ;;
+            zig-cross-windows-x86_64)  url=raylib-6.0_win64_mingw-w64.zip;    var=RAYLIB_DIR_WINDOWS_AMD64; ext=zip    ;;
+            zig-cross-windows-x86)     url=raylib-6.0_win32_mingw-w64.zip;    var=RAYLIB_DIR_WINDOWS_X86;   ext=zip    ;;
+            zig-cross-windows-arm64)   echo "no raylib archive for windows-arm64"; exit 0 ;;
+          esac
+          mkdir -p build/raylib
+          base="${url%.$ext}"
+          if [ "$ext" = tar.gz ]; then
+            curl -sL "https://github.com/raysan5/raylib/releases/download/6.0/$url" \
+              -o "build/raylib/$url"
+            tar -C build/raylib -xzf "build/raylib/$url"
+          else
+            curl -sL "https://github.com/raysan5/raylib/releases/download/6.0/$url" \
+              -o "build/raylib/$url"
+            ( cd build/raylib && unzip -q "$url" )
+          fi
+          # Expose the extracted tree path to subsequent steps via GITHUB_ENV.
+          echo "$var=$PWD/build/raylib/$base" >> "$GITHUB_ENV"
+
       - name: Cross-build (${{ matrix.target }})
-        run: ./scripts/zig-build.sh ${{ matrix.target }} --both
+        run: ./scripts/build-dist.sh ${{ matrix.target }}
 
       - name: Upload artifacts
         uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.target }}
-          path: build/${{ matrix.target }}/
+          path: dist/sdk/
 
   release:
     if: startsWith(github.ref, 'refs/tags/v')
     runs-on: ubuntu-latest
-    needs: cross-build
+    # Cross-build is skipped on tag pushes, so depend on build-and-test (which
+    # always runs) rather than the matrix; release rebuilds the full matrix
+    # itself anyway.
+    needs: build-and-test
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@v4
 
+      - name: Check tag matches PSM_TRUE_VERSION
+        shell: bash
+        run: |
+          tag="${GITHUB_REF#refs/tags/}"; tag="${tag#v}"
+          ver_hex=$(sed -n 's/^#define PSM_TRUE_VERSION[[:space:]]*\(0x[0-9A-Fa-f]*\).*/\1/p' include/PurismCore.h)
+          [ -n "$ver_hex" ] || { echo "error: PSM_TRUE_VERSION not found in include/PurismCore.h" >&2; exit 1; }
+          v_major=$(( ($ver_hex >> 24) & 0xFF ))
+          v_minor=$(( ($ver_hex >> 16) & 0xFF ))
+          v_patch=$((  $ver_hex        & 0xFFFF ))
+          version="$v_major.$v_minor.$v_patch"
+          if [ "$tag" != "$version" ]; then
+            echo "error: tag v$tag does not match PSM_TRUE_VERSION ($version)" >&2
+            exit 1
+          fi
+          echo "ok: tag v$tag matches PSM_TRUE_VERSION ($version)"
+
       - uses: mlugg/setup-zig@v2
         with:
           version: 0.16.0
@@ -73,6 +146,30 @@ jobs:
             -o /usr/local/bin/lipo
           chmod +x /usr/local/bin/lipo
 
+      # Download every raylib v6.0 archive the dist matrix needs (viewer-in-dist
+      # is opt-in via RAYLIB_DIR_<PRESET>; without these env vars, build-dist.sh
+      # silently skips the viewer and ships the libraries only).
+      - name: Fetch raylib v6.0 (all targets)
+        shell: bash
+        run: |
+          mkdir -p build/raylib
+          fetch() {  # <url> <top-dir-name> <ext> <env-var>
+            url="$1"; top="$2"; ext="$3"; var="$4"
+            curl -sL "https://github.com/raysan5/raylib/releases/download/6.0/$url" \
+              -o "build/raylib/$url"
+            if [ "$ext" = tar.gz ]; then
+              tar -C build/raylib -xzf "build/raylib/$url"
+            else
+              ( cd build/raylib && unzip -q "$url" )
+            fi
+            echo "$var=$PWD/build/raylib/$top" >> "$GITHUB_ENV"
+          }
+          fetch raylib-6.0_linux_amd64.tar.gz    raylib-6.0_linux_amd64     tar.gz RAYLIB_DIR_LINUX_AMD64
+          fetch raylib-6.0_linux_arm64.tar.gz    raylib-6.0_linux_arm64     tar.gz RAYLIB_DIR_LINUX_ARM64
+          fetch raylib-6.0_macos.tar.gz          raylib-6.0_macos           tar.gz RAYLIB_DIR_MACOS
+          fetch raylib-6.0_win64_mingw-w64.zip   raylib-6.0_win64_mingw-w64 zip    RAYLIB_DIR_WINDOWS_AMD64
+          fetch raylib-6.0_win32_mingw-w64.zip   raylib-6.0_win32_mingw-w64 zip    RAYLIB_DIR_WINDOWS_X86
+
       - name: Build distribution
         run: ./scripts/build-dist.sh
 
@@ -92,4 +189,4 @@ jobs:
           files: |
             dist/PurismCore-*.zip
             dist/PurismCoreBundle-*.h
-          generate_release_notes: true
+          generate_release_notes: true

.gitignore

@@ -32,3 +32,4 @@ testdata/*
 # OS
 .DS_Store
 Thumbs.db
+/shot.png