feat(canvas): first-class inlined asset imports in the build recipe (phase 4)

[k11kirky]

Note

Stacked PR chain (Graphite-style) — merge in this order:

• posthog/posthog: #73725 (phase 1) → #73730 (phase 3) → #73731 (phase 4)
• PostHog/code: #3824 (phase 1) → #3825 (phase 2) → #3826 (phase 3) → #3827 (phase 4)
• Cross-repo: each posthog PR should deploy before the same-phase code PR ships (skills/tools/endpoints must exist before clients rely on them).

Problem

Phase 4 ("Package and runtime expansion") of the canvas application build pipeline plan (#3823), the slice implementable ahead of production admission data: canvases couldn't import assets — an svg logo or a json config had no supported path through the build recipe.

Note

Stacked PR — merge order: #3824 (phase 1) → #3825 (phase 2) → #3826 (phase 3) → this PR (phase 4). Base branch is posthog-code/canvas-build-pipeline-phase-3.

Changes

• svg imports compile to data URLs (usable directly as img.src / CSS values); json imports were already literals. Both inline into the bundle, so the artifact stays self-contained — no runtime asset fetches and nothing new for the sandbox CSP to allow.
• A new shared contract fixture ("asset imports") binds the future cloud adapter to inline them identically.

Deliberately not here: binary asset formats (png/woff2), web workers, and WebAssembly need a binary file representation in the source-project schema, and the plan's package-policy expansion is driven by observed admission failures — both belong to the build-service iteration once production data exists.

How did you test this?

• New adapter test: the asset fixture builds ready and the emitted chunk contains the svg data URL and the json value (guards a loader regression silently turning assets into broken text imports).
• All 10 shared contract fixtures pass through the local adapter (14 tests total); shared suite 684 passed; turbo typecheck green for shared + workspace-server.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

---

Created with PostHog Code

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 92e218d.}