fix: cors issues from preview fixed by changing embedder policies

[wonderwhy-er]

Reason for Change

Issue reported here:
https://thinktank.ottomator.ai/t/cors-proxy-needed/4096/6

leex279 shared an example of OpenStreetMap.
I tested that it works in bolt.new but not in DIY.

Difference Identified

The issue was traced to the Cross-Origin Embedder Policy (COEP):

1. DIY (hosted from local-corp.webcontainer-api.io)

   • Header: cross-origin-embedder-policy: require-corp
   • Impact:
     This policy mandates that all resources loaded by the iframe must explicitly allow cross-origin embedding by setting appropriate headers (e.g., Cross-Origin-Resource-Policy or Access-Control-Allow-Origin).
     If the tile server (a.tile.openstreetmap.org) doesn't fully comply with this policy, the browser blocks the resource.

2. Bolt.New (hosted from local-credentialless.webcontainer-api.io)

   • Header: cross-origin-embedder-policy: credentialless
   • Impact:
     This policy is less restrictive and doesn't require the same level of resource permissions. It works better with services like OpenStreetMap that rely on permissive Access-Control-Allow-Origin: *.

---

Solution

I explored the differences and found two places where this policy could be changed.
After making these changes, it works correctly.

---

Before

---

After