mirror of
https://github.com/runbear-io/beardrive.git
synced 2026-08-25 08:08:08 +02:00
Snow Lee (Sungwon)andGitHub
2875e033be
A ```mermaid fence rendered as a wall of `graph TD` source on both surfaces. It now renders as an SVG in the hub file viewer and on public /s/<token> markdown share pages. Mermaid ships inside the binary (no CDN, so air-gapped self-hosters keep working) and is imported lazily: a document with no fence downloads none of it. A fence that doesn't parse — the common case for hand-written wiki diagrams — keeps today's <pre><code> plus a small note, and one bad fence never stops the good ones beside it. A blocked or offline chunk lands in the same place. The share page is the harder half: it is server-rendered Go HTML with no JavaScript, and its `sandbox allow-scripts` CSP makes the origin opaque, so a module script and every import() it makes arrive with `Origin: null`. The CSP is unchanged and gains no allow-same-origin; instead the real-asset branch of frontend() now sets Access-Control-Allow-Origin, which only ever touches files that are already public and cookie-less. The script tag itself is injected only when the rendered document actually contains a fence. Also fixes an embed bug this change surfaced: `//go:embed static` silently skips names beginning with `_`, and Vite's first shared chunk is `_commonjsHelpers-<hash>.js`. The build passed, the commit looked right, and the served app was blank. It is `all:static` now, with a test that every file on disk is in the binary.