Repository navigation
Harden project validation, browser coverage, and loading performance - #19
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…egexp' Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
2 tasks done
PeterHewat
added a commit
that referenced
this pull request
Oct 3, 2026
…#20) ## What changed Four new developer tools — **JWT** (JSON Web Token Debugger), **Codes** (QR codes and barcodes), **Codec** (UTF-8, Base64, URL and Hex Converter) and **Digests** (SHA Hash and HMAC Calculator) — all listed as stable, plus the shared code and repo changes they led to. - **JWT:** two-way editing (edit the token or its parts), algorithm from the header, jwt.io colours, key checks and encoding conversion, key generation. - **Codes:** steps like qr.io: Type → Content (link, text, email, phone, SMS, WhatsApp, Wi-Fi, vCard, event; Code 128, EAN-13, UPC-A) → Design (colours with opacity and radial/linear gradients, module and corner shapes, preset or uploaded logo, frames with caption) → Download. Integer-only SVG; PNG sizes S/M/L in whole pixels per module; redrawn in place without blinking; the index art is generated from the app's own example (`scripts/codes-art.ts`). - **Codec:** every format stacked and live from whichever field is edited; invisible characters drawn. - **Digests:** SHA-256/384/512 and SHA-1 at once, Hex or Base64, HMAC, files up to 64 MiB, Compare naming the matching digest; laid out like Codec. Codec and Digests open each other on the same input. - **Shared (`@tools/ui`):** colour picker (from the SVG app, now with opacity), `renderPng`, `.ui-switch` with `bindSwitch` in every app, `debounce`, versioned per-tab drafts (JSON moved onto them), `.ui-note` / `.ui-data`, new icons. - **Smaller PNG exports:** written in the app as a palette PNG (1–8 bits) when ≤ 256 colours, else RGB/RGBA. Lossless: a plain code at XL went 325 KB → 13.5 KB; the gradient example about 55–63% smaller. - **Repo:** build/test tools declared once at the root; `bun run links` Markdown link check; `bun audit` in CI; AGENTS.md clean-change and shared-UI rules; `@zxing/library` 0.23.0. ## Why this needs merging soon The deploy of #19 failed and the live site has been on #18 since. The JS budget check counted the external Cloudflare analytics script as a missing local file, and only the deploy build has the analytics token. Fixed in `scripts/bundle-budget.ts` (with a test); the site build now also checks that every page carries the beacon when the token is set. ## For reviewers - No draft migrations: these apps had no users yet, so drafts stay at version 1 and an old JSON draft opens on the sample. - JS budgets raised with the change: Codes 20 KiB, Digests 135 KiB (it now uses the shared editor, like Codec). - Browser tests decode the downloaded QR PNGs with jsQR, falling back to ZXing for dot and circle styles. ## Checks - [x] `bun run verify` passes - [x] Tried it in the browser (all 64 Playwright tests pass in Chromium and Firefox) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Malformed SVG projects could pass file validation and then fail during rendering or export. Validate geometry, collections, transforms, and duplicate identities while preserving valid version-1 documents and existing SVG round-trip behavior.
Separate SVG geometry, styling, and ruler gestures and JSON preferences/header wiring into focused modules. Load the SVG source editor when its panel is shown, reducing initial gzip JavaScript from about 193 KB to 68 KB; retain offline precaching and enforce initial/total bundle budgets from the catalog. Failed source loads wait for an explicit Retry.
Add production Chromium/Firefox smoke tests and CI coverage for editing, drawing, undo/redo, autosave/reload, source editing, responsive headers, keyboard menus, and accessibility. Chromium also checks native touch drawing/pinch and offline service-worker replacement. Fix the stale-parse JSON formatting race and light-theme contrast failures uncovered by those tests.
Checks
bun run verifypasses: lint, typechecks, formatting, 574 unit tests, production builds, and bundle budgets.bun run test:browser: 18 passed; two documented Firefox skips for Chromium-only native-touch and service-worker lifecycle coverage.git diff --check origin/main...HEADpasses.