From 30bbd31bd0a8becb7da99fbc3c6ae8e2594da54d Mon Sep 17 00:00:00 2001 From: garrytan Date: Mon, 26 Oct 2026 09:45:41 +0000 Subject: [PATCH] docs(diagram-render): document the Firebase-literal strip and the new drift checks Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --- lib/diagram-render/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/diagram-render/README.md b/lib/diagram-render/README.md index ef2f3a301..c18397c94 100644 --- a/lib/diagram-render/README.md +++ b/lib/diagram-render/README.md @@ -14,6 +14,8 @@ The built page is **committed** (eng-review D2): rendering works with zero network at install time and render time, and there is no npm supply-chain surface in `./setup`. The drift test (`test/diagram-render-drift.test.ts`) fails CI if `dist/` is edited by hand or falls out of sync with `BUILD_INFO.json`. +It also checks that the bundled DOMPurify is the `package.json` override and that +the bundle carries no Google API key. ## Page API (window functions) @@ -41,6 +43,12 @@ bun run build # 3. commit package.json + bun.lock + dist/ together ``` +`scripts/build.ts` empties the one `VITE_APP_FIREBASE_CONFIG` literal in +`@excalidraw/excalidraw`'s npm bundle (a public Firebase client key the offline page +never uses), because a key-shaped literal fails the pre-gate secret scan. The build +fails if that literal is not matched exactly once or an `AIza…` key survives, so an +excalidraw bump that changes its shape needs the strip rule updated. + Render contract details (securityLevel strict, htmlLabels false, print-css font lock, `` + `