Hosting and building
Build, verify, publish and host the static app, and where its third-party notices are.
What gets deployed
The published app is a folder of static files: a Blazor WebAssembly PWA with its service worker, fonts and the offline manifest. The host needs ordinary static-file service and users need a supported browser. No .NET runtime, Node service, database, package feed or Beep.Skia checkout is needed in production. Serve it over HTTPS (loopback HTTP works for development); file:// cannot supply the WebAssembly and service-worker contract.
Build and verify
Prerequisites (once per computer): Windows x64, .NET SDK 10.0.401 (pinned by global.json, roll-forward disabled), Node 24.15.0 and the WebAssembly workload.
dotnet workload install wasm-tools --skip-manifest-update
# Everyday inner loop
dotnet build Beep.SimpleDraw.slnx
dotnet test tests/Beep.SimpleDraw.Tests -c Release --filter "FullyQualifiedName~MermaidTests"
node --test tests/documents.test.mjs
# After changing ../Beep.Skia: record the change in the source pin
node scripts/pin-inputs.mjs refresh ../Beep.Skia
# Full verification gate (restore, build, every test, publish, assets, notices), then a local preview
./scripts/build.ps1 -Output artifacts/new-candidate
./scripts/serve-published.ps1 -ReleasePath artifacts/new-candidate -Port 5243- SimpleDraw builds against the sibling
../Beep.Skiacheckout, pinned bydependencies/beep-skia.lock.json(a reviewed base commit plus a patch and added files). Any drift fails the build and lists the changed paths. - Each gate run needs a new output folder;
-BasePath /draw/builds for a sub-path. Deploy the verifiedpublish/wwwrootfolder orsimpledraw-static.zip, never the managed-build intermediates. - The MCP server builds from its own solution:
./scripts/publish-mcp.ps1 -Output artifacts/mcp, then./scripts/package-mcp-plugins.ps1to produce the Claude Code and Codex plugins.
Publish to IIS
dotnet publish src/Beep.SimpleDraw.Web -c Release /p:PublishProfile=subsite10 /p:Password=<password>The subsite10 profile builds with native linking and uploads with Web Deploy to draw.thetechidea.app. It rebuilds and does not run the verification gate, so run the gate first for a verified release, and type the password when you run the command; never store it. web.config serves the app from wwwroot, sends the precompressed Brotli and gzip files with IIS compression off (compressing .wasm per request over HTTP/2 can abort downloads), sets the cache policy and security headers, and redirects HTTP to HTTPS. The host needs the IIS URL Rewrite module and a bound HTTPS certificate.
Static host contract
| Resource | Required handling |
|---|---|
| WebAssembly | Content-Type: application/wasm |
| JavaScript, fonts, manifest | Correct MIME types; a missing asset returns 404, never the app's index page |
| Brotli and gzip variants | Negotiate with Content-Encoding and Vary: Accept-Encoding; identity stays available |
| Fingerprinted files | Long immutable cache (a year) |
| Entry page, service worker, offline manifest | Cache-Control: no-cache, so an old entry never lingers |
| Content Security Policy | The exact policy from that build's asset report (entry hashes change per build) |
| Other headers | X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, Cross-Origin-Opener-Policy: same-origin |
| Navigation paths | Resolve only app paths to the index, inside the declared mount; reject traversal and write methods |
index.html, scripts or compressed files after verification, and do not relax the script policy to hide a deployment error.Promote and update. Keep the previous build and its provenance. Upload a complete new build to a staging location, verify it, and promote the mount at once, so visitors never see a mixture of old and new files. Browser autosave belongs to one origin and base path: moving the domain or the path does not move users' drawings or libraries, so ask users to download native drawings and libraries first. PNG and SVG cannot restore editable objects.
Third-party notices
The app ships a software notices page and the full original license texts, which stay available offline after the offline cache installs: Keyboard shortcuts links to it. It lists the bundled fonts (Kalam, Noto Naskh Arabic, Noto Sans and Noto Sans Mono, under the SIL Open Font License 1.1), SkiaSharp and HarfBuzzSharp (MIT) and every other package, with Download all software notices and Read all software notices. The notice texts keep their original language.