21 Commits

Author SHA1 Message Date
Andrey Antukh
4c7863d6c8
📚 Add .penpot format docs and inspector tool (#10674)
* 📚 Add comprehensive documentation for .penpot file format (v3)

Create user-facing documentation for the .penpot binfile format to help
developers and power users understand and inspect the ZIP+JSON structure.

- Add technical specification with complete schema reference for all JSON
  files (manifest, file metadata, pages, shapes, library assets, storage
  objects, plugin data)
- Add user-friendly overview explaining the format structure, inspection
  methods, and version history
- Update export-import-files.njk to clarify current format is not deprecated
  and note that v2 was never released
- Add cross-links between documentation pages
- Include source code references to authoritative malli schemas

AI-assisted-by: qwen3.7-plus

* 📎 Add playwright dependency to the root package.json

* 📚 Add browser based .penpot file inspector to docs

Add a client-side, no-build inspector for .penpot (v3) files. The tool
runs entirely in the browser: JSZip is loaded lazily from a CDN, the
file is never uploaded. It provides a collapsible file tree, syntax-
highlighted JSON viewer with search, image previews, a summary panel
with file/shape/storage counts, shape summary cards with color swatches,
and clickable UUID cross-references with backlinks.

The inspector is added at
docs/technical-guide/developer/data-model/penpot-file-inspector.njk
and linked from the format spec and the user-facing format page.

AI-assisted-by: minimax-m3

* 📚 Use full page width and 2-column layout for inspector

The inspector previously sat inside the docs site's 42rem content
column, which forced a stacked layout and wasted the wide viewport.

- Hide the docs page-navigation sidebar on this page via :has()
- Use a 2-column CSS grid: file tree (280px, sticky) on the left,
  content (flex: 1) on the right
- Restore the directory tree as a permanent left-rail navigation
  (it was removed when the picker was first introduced, then added
  back as a collapsible panel; a sticky rail is a better fit now
  that horizontal space is plentiful)
- Remove the tree toggle button — the tree is always visible
- Collapses to 1 column on viewports below 900px

AI-assisted-by: minimax-m3

* 💄 Indent nested JSON values in inspector

The JSON tree view in the inspector was rendering all properties at
the same indent level, making it hard to see which values were
nested inside objects or arrays. Root-level properties and deeply
nested ones looked identical.

Add padding-left and a subtle vertical guide line to .jchildren so
each nesting level is visually distinct. Bump the toggle column to
1.2em and add a touch of vertical padding to .jrow for breathing
room.

AI-assisted-by: minimax-m3
2026-07-20 14:45:59 +02:00
Andrey Antukh
e2b52d88fc ⬆️ Update dependencies 2026-06-30 16:15:30 +02:00
Andrey Antukh
960b90253f ⬆️ Update root deps 2026-06-22 09:04:13 +02:00
Andrey Antukh
3419f7e60a ⬆️ Update root repo deps 2026-06-10 11:25:59 +02:00
Andrey Antukh
c5bd583b1f 📎 Update root deps 2026-06-08 09:39:59 +02:00
Andrey Antukh
f457c68355 📎 Backport devenv improvements 2026-06-05 11:44:20 +02:00
Andrey Antukh
d66e8702e7 📎 Update root repo deps 2026-06-01 09:27:58 +02:00
Andrey Antukh
e43703c368 📎 Update root dependencies 2026-05-27 10:57:06 +02:00
Andrey Antukh
1161a163a7 ⬆️ Update root repo opencode dependency 2026-05-18 19:59:12 +02:00
Andrey Antukh
9b336e9a3d Add nrepl-eval script and skill 2026-05-10 10:49:53 +02:00
Andrey Antukh
279231240d
🐛 Harden outbound HTTP requests against SSRF and restrict assets handlers (#9390)
* ⬆️ Update root deps

* 🐛 Harden outbound HTTP requests against SSRF and restrict unauthenticated asset access

- Add app.util.ssrf URL/host validator that resolves hostnames and blocks
  loopback, link-local, site-local, cloud metadata, and operator-supplied CIDRs
- Add app.media.sanitize image EOF truncator that strips trailing data after
  PNG IEND, JPEG EOI, GIF trailer, and WebP RIFF markers
- Disable HTTP client auto-redirect; add req-with-redirects! helper that
  revalidates every redirect hop against the SSRF blocklist
- Wire SSRF validation and EOF sanitization into media/download-image
- Validate webhook URLs and OIDC profile picture URLs against SSRF
- Restrict /assets/by-id to require authentication for non-public buckets
  (profile) while keeping public access for file-media-object,
  file-object-thumbnail, team-font-variant, and file-data-fragment
- Add config knobs: ssrf-protection-enabled, ssrf-allowed-hosts,
  ssrf-extra-blocked-cidrs

Signed-off-by: Andrey Antukh <niwi@niwi.nz>

---------

Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-05-08 09:18:22 +02:00
Andrey Antukh
a58dbec8f2 ⬆️ Update root repo deps 2026-04-27 20:35:46 +02:00
Andrey Antukh
2d5e50f352 ⬆️ Update root repo deps 2026-04-24 08:17:32 +02:00
Andrey Antukh
eeeb698d91 ⬆️ Bump opencode-ai dev dependency 1.4.3 -> 1.14.19
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
2026-04-20 20:13:15 +02:00
Andrey Antukh
0fc2050526 ⬆️ Update deps on root package.json 2026-04-13 15:00:47 +02:00
Andrey Antukh
dfa45ec8d8 ⬆️ Update deps on root package.json 2026-04-09 09:10:44 +02:00
Andrey Antukh
9a0ae32488 ⬆️ Update opencode dependency on repo root 2026-04-07 16:33:40 +02:00
Andrey Antukh
e7e98255d9 Add scroll and zoom raf throttling (#8812)
* ⬆️ Update opencode and copilot deps

* 🐛 Decouple workspace-content from workspace-local to reduce scroll re-renders

Move workspace-local subscription from workspace-content* (parent) into
viewport* and viewport-classic* (children). workspace-content* now only
subscribes to the new workspace-vport derived atom, which changes only on
window resize — not on every scroll event. This prevents the sidebar,
palette and other workspace-content children from re-rendering on scroll.

* 🐛 Throttle wheel events to one state update per animation frame

Accumulate wheel event deltas in a mutable ref and flush them via
requestAnimationFrame, so that multiple wheel events between frames
produce a single state mutation instead of one per event. This prevents
the cascade of synchronous React re-renders (via useSyncExternalStore)
that can exceed the maximum update depth on rapid scrolling.

Both panning (scroll) and zoom (ctrl/mod+wheel) are throttled. Scroll
deltas are summed additively; zoom scales are compounded multiplicatively
with the latest cursor point used as the zoom center.

* ♻️ Extract schedule-zoom! and schedule-scroll! from on-mouse-wheel

* ♻️ Avoid zoom dep on on-mouse-wheel by using a ref
2026-03-30 12:06:56 +02:00
Penpot Dev
2ba3605f11 ⬆️ Update root repo deps 2026-03-26 13:09:31 +01:00
Andrey Antukh
8729fed724 📎 Add opencode and copilot deps on root package.json 2026-03-24 12:52:56 +01:00
Andrey Antukh
32cf95265a 📚 Add GitHub Copilot instructions (#8548) 2026-03-10 13:12:15 +01:00