fix(catalog): run block scripts inline in the docs player, and pages for six shader blocks

[miguel-heygen]

What

Two things the six WebGPU shader blocks in #5138 need on the docs site:

1. A catalog generator fix. The live player on a catalog page stayed black for any block whose local script the generator does not inline by name. processAssets turned such a script into src="data:text/javascript;base64,...", and the docs host's Content Security Policy (script-src 'self' 'unsafe-inline' 'unsafe-eval' https:) refuses data: scripts in the player's frame. processAssets now ships those scripts as inline text, which the policy allows. Three published payloads on main carry the same data: script (liquid-glass-widgets, liquid-glass-notification, hw-write-title); they come out clean on the next catalog publish.
2. The six blocks' catalog pages (Godrays, Liquid Metal, Marble, Mesh Gradient, Nebula, Flowing Gradient): bun run generate:catalog output with the fix, kept to these six blocks. Merge after feat(registry): six WebGPU shader backgrounds from the Shaders library #5138.

With the script inline, the generator also sees navigator.gpu in the payload, so these pages get the WebGPU marker and the recorded-video fallback in browsers without WebGPU.

Verification

• scripts/catalog-payload-assets.test.ts: the test that asserted the data: URI now asserts inline text, including a </script inside the code; it passes three runs and fails with the fix removed. The payload, script-inlining, payload-verification and catalog-detail tests pass.
• Regenerated payloads for the six blocks contain no data: script. Against main, the shared index files only add these six blocks' entries.
• Live: on this PR's docs preview, the player of each of the six pages draws and plays the block in Chrome with WebGPU (grab below).

Limits

• A project script's path used outside its <script src> tag (a preload link, new Worker(...)) stays a local path, which the docs host does not serve. No registry item does this today.
• A local type="module" script is inlined too, so relative imports inside it would resolve against the page; the data URI before this had the same problem. No registry item has one.

Merge order

After #5138, right after it, with the catalog publish PR held in between: this adds the six blocks to registry/registry.json, and a publish between the two would regenerate their payloads with the old generator.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
hyperframes	🟢 Ready	View Preview	Oct 7, 2026, 2:40 AM

💡 Tip: Enable Automations to automatically generate PRs for you.

[github-actions]

Edit accuracy: accurate 2059 (base branch 2059), smooth 1623 of those

The gate passes.
Smoothness is reported in the artifact, not gated. A case fails only if it fails 2 of 3 runs.

Quarantined, measured but not gated (0)

[terencecho]

Reviewed #5139 at a241c9319212275a83456785a12f010daaf858c5 after #5138 (c393d998439563c811c2ccd1fd52b1f16942a7e2) merged. Approve: the six pages' committed payloads match a fresh generation from the combined tree byte-for-byte, and their inline shader source matches #5138. The generator reads project-local files and uses the compiler's HTML-safe inline-script escaping. In a no-WebGPU Chromium run, all six pages selected the recorded-video fallback. The 82 focused tests passed; all non-skipped required checks are green. I did not independently replay WebGPU playback.

Publishing note: the original #5139 catalog CI skipped the six source directories before #5138 merged; the combined-tree generation above covers that gap. The three previously published CSP-blocked payloads require the subsequently refreshed bot/catalog-publish PR to be merged; #5139 alone does not rewrite them. Please do not merge an intermediate publish snapshot from #5138 alone. Nonblocking follow-up: the new script matcher does not recognize valid src = or </script > spelling in a raw standalone composition, though none of the current registry items uses it.

— tai