The previous "uniform-scale remap" commit fixed node coordinates to
land in 0-100 × 0-(100*h/w), but the renderer (buildShapeSvgInner
path branch) reads shape.viewBox and computes sx = 100/vb.w,
sy = vbH/vb.h. With shape.viewBox.h hardcoded to 100, sx ≠ sy for
non-square layers and the path got stretched again — strokes
distorted around curves after the path was committed, even though
the in-progress draft (which renders inside the pen overlay, not
the layer SVG) looked fine.
Fix is the matching half: also write shape.viewBox.h = 100*lh/lw
wherever we touch the pen data, so sx == sy and the renderer
applies a uniform scale.
- finishPenPath now sets viewBox.h = vbH from the bbox aspect.
- regenPenLayerD (called on every edit drag + insert/delete/toggle)
recomputes vbH from current layer.w/h before writing the new d
string. This catches the rare case where layer.w/h change between
refit calls without my refit running.
- The "Make editable path" conversion remaps primitiveToPenNodes /
parsePathDToNodes results (which always come in 0-100×0-100) into
the layer's actual aspect space, and writes viewBox.h to match.
Result: converting a rect → editable path on a non-square layer
keeps its proportions, and the resulting pen path edits cleanly
with uniform strokes.
Strokes now stay a constant width all the way around closed
shapes, even after the path is fully committed and re-rendered
through the standard shape-layer pipeline.
Two visual issues on top of the Phase D close-out commit:
1. **Stroke width varied along curves.** The pre-existing pipeline
stored nodes in 0-100 × 0-100 viewBox space and let the SVG
renderer pick `vbH = 100 * layer.h / layer.w` with
`preserveAspectRatio="none"`. For any non-square layer, the
0-100×0-100 node range got stretched non-uniformly into a 100×vbH
viewBox, distorting the path: strokes appeared wider where the
curve traveled more in one axis. Phase D's refit made this much
more likely because dragging anchors out of bounds routinely
produced non-square layers.
Fix in two places:
- finishPenPath: uniform-scale the bbox by `100/bbox.w` so y
range lands at exactly `100 * h/w = vbH`. The viewBox aspect
matches the layer aspect, no stretching.
- refitPenLayerIfNeeded: same uniform-scale invariant. Also
respects the layer's current vbH when deciding whether nodes
are "out of bounds" — was previously hard-coded at 100, which
wrongly fired refit on every drag in already-non-square layers.
2. **Anchor + handle glyphs were too prominent.** On a 1920px-wide
slide preview the old `dotR = 0.013 * unit` rendered ~25px
dots. Reduced to `0.0075 * unit` (~12px) and stroke from
`0.003 * unit` to `0.0018 * unit`. The in-progress draft
renderer matches.
Strokes now stay constant width all the way around a curve, and
the editing UI reads as overlay rather than as part of the artwork.
Finished the deferred Phase D pieces from PEN_TOOL_FEATURE.md.
New affordances on the editable pen layer:
- Click a segment between anchors → inserts a new anchor at the
click point via de Casteljau cubic split. Curve shape is
preserved exactly: a's hOut, b's hIn, and the new mid-anchor's
handles all derive from the split. Lines (no handles either
side) get a plain midpoint anchor with no handles. The new
anchor is selected and immediately drag-able.
- Right-click an anchor → delete it. Suppresses the browser
context menu on the pen overlay always.
- Backspace / Delete with an anchor selected → delete it.
Layer-delete still wins when no anchor is selected. The pen
tool's selected-anchor sentinel `_penSelectedAnchor` is reset
on tool change.
- Alt-click an anchor → toggle between `kind: 'corner'` (handles
move independently) and `kind: 'smooth'` (handles stay mirrored
across the anchor). Promoting to smooth re-derives the missing
handle (or re-mirrors both if independent) so the curve
actually becomes continuous. New nodes from pen click-drag
default to smooth; new nodes from a single click are corners.
- Drag an anchor or handle past the original 0–100 viewBox →
the layer's bounding rect auto-refits. New `refitPenLayerIfNeeded`
computes the bbox over all nodes + handles, translates
layer.x/y by the bbox offset (scaled to current w/h), updates
layer.w/h, then remaps every node into the new 0–100 space.
Path stays visually anchored to the canvas — no more clipping
at the layer edge.
Anchor glyphs now distinguish kind: smooth = circle (existing
look), corner = square. The selected anchor renders with an amber
stroke (#f97316) so the Backspace-to-delete target is unmistakable.
Spec updated to mark Phase D complete and the deferred items
shipped. Rotated paths are still not node-editable in v1 (the
deferral remains).
Removed three superseded spec files now that the work they
described is either shipped (under newer specs) or formally
replaced:
docs/ZAP_GATED_TEMPLATES_FEATURE.md
docs/ZAPS_NWC_FEATURE.md
docs/ZAP_GATED_PREMIUM_FEATURE.md
The history is preserved in git. The current canonical premium
plan is docs/PREMIUM_DESIGNS_FEATURE.md (which absorbed the
zap-gated+NWC infrastructure plus added the soft-gate KDF +
encrypted envelopes + purchase vault).
README's docs paragraph now lists every active spec by status —
shipped / partial / drafted — and adds the transparency-iframe
baseline stub that landed alongside the embed feature.
The embed feature is essentially complete — phases 0-6 are live
on main, Phase 7 hardening shipped alongside Phase 1. Updated
the spec to reflect that:
- Status block flipped from "Nothing in this spec is implemented
yet" to "Shipped (2026-06-01)" with date.
- Every shipped phase gets a ✅ marker on its heading.
- Phase 7 (Hardening + headers) body rewritten to record what
actually shipped (CSP frame-ancestors, SPA rewrites, error
handling, sanitization reuse) plus what's still optional
(?debug=1 surface, hard relay-count cap).
- Phase 8 (Polish) deliberately dropped — the previously-drafted
Credits overlay, postMessage handshake, and explicit
light/dark/auto theming weren't needed for the use cases the
feature is actually solving. Replaced with a clear "dropped"
note listing each item and why.
- Phase 9 (Future) reframed as the natural follow-up arcs if we
revisit (oEmbed endpoint, render-to-image, OG images,
lightweight embed.html bundle).
The Acceptance Criteria for Embed v1 stays valid as-is — every
bullet is true.
Animated pixel-art embeds (frames > 1) now respect three controls
per docs/EXTERNAL_EMBED_FEATURE.md §6.3 / §11.4:
- ?play=1 / ?play=0 — explicit auto-play toggle. If the param
isn't set, autoplay follows the visitor's prefers-reduced-motion
preference: motion-OK users get auto-play, reduced-motion users
get start-paused with a play CTA. ?play=1 forces auto-play even
in reduced-motion mode (the spec's "user opt-in" wording).
- ?fps=N — override frame rate, clamped to 1-60. Falls back to the
payload's stored fps (default 8) when not set.
- A play/pause chip in the embed footer's left side that toggles
on click. Re-renders the artwork with the new autoplay state;
the renderer's RAF self-stops when the canvas leaves the DOM, so
the swap is leak-free.
Renderer changes (renderPixelArtPreviewDOM):
- New opts.autoplay (default true) gates the requestAnimationFrame.
When false, frame 0 is drawn but no animation loop starts.
- New opts.fps (number, optional) overrides pa.fps. Defaults
unchanged for all existing callers (linked-design renderer,
feed cards, modal preview) because they don't pass either opt.
Single-frame pixel art is unaffected — the play/pause chip only
appears for frames.length > 1, and the renderer ignores autoplay
for the still-image path.
Public multi-slide deck embeds get a paginated viewer instead of
the single-thumbnail-with-badge that was hitting before (the
shared renderDeckPreviewDOM compact path).
_paintEmbed now branches on mode === 'deck' && slides > 1 into a
new _paintEmbedDeck that:
- Reads ?slide=N (1-based) from the route params for the initial
index; clamps to [0, slides.length-1].
- Renders the current slide via composeSlideForDeck +
renderDesignPayloadPreview into a .designObjectFitWrap and
fitMiniPreview-scales it.
- Adds prev / counter / next pill chips to the footer left side
(only when slides > 1 and controls=1), and the existing author
chip after them.
- Adds a fullscreen chip ⛶ + the Open-in-Artstr link to the
footer right side.
- Wires keyboard nav on document.keydown:
ArrowRight / PageDown / Space → next
ArrowLeft / PageUp → prev
Home → first; End → last
F → toggle fullscreen
Single handler is swapped via the _paintEmbedDeck._kbd sentinel
so re-renders (e.g., the refresh-error path) don't stack
listeners. Form-element targets (none today, future-proof) are
ignored so the embed doesn't eat typing.
- New _toggleEmbedFullscreen helper calls
documentElement.requestFullscreen() / exitFullscreen with a
graceful catch.
Touch swipe, autoplay (?autoplay / ?loop / ?interval), and
prefers-reduced-motion respect are deferred — they fit naturally
on top of this scaffold whenever we want them.
Both card builders (buildFeedCard + buildResultCard) had a
dedicated "Preview" button on the action row that just called
openDesignPreview(row). The whole card already has a click
handler doing exactly that, so the button was redundant — it
just added visual noise next to the Use/Fork (or premium-unlock)
CTA.
Removed the prevBtn from both builders. Existing card-click
behavior unchanged, so the preview still opens on click; the
action row now has only the reactions + the action button(s)
specific to that card state.
Swapped the embed code generator's live-preview backdrop from
the dev-time bright magenta/yellow checker to the standard
Photoshop-style light-gray/white transparency indicator
(#e5e7eb / #ffffff, 14×14 tiles). Reads as "this is where
transparency shows through" without screaming.
src/transparency-iframe.html is a tiny html+body=transparent
stub we serve at /transparency-iframe.html so dev hosts (and
future debug tools) can include it via iframe to confirm that
cross-origin iframe transparency is working in the target
browser without involving any of the Artstr embed JS.
Validated end-to-end:
- srcdoc iframe → magenta shows through ✓
- cross-origin minimal page → magenta shows through ✓
- cross-origin Artstr embed → magenta shows through the
Computer_Icon's transparent ring ✓
What looked like opaque white on the stress-test host was the
artwork's natural fill + the host's pink/yellow checker reading
as noise rather than see-through. Magenta on a flat backdrop
made the transparency unambiguous.
The generator was emitting /embed/<id> URLs (the canonical clean
path from the spec). Vercel rewrites that to / in production —
but on hosts without SPA rewrites (including local dev with
python http.server, and many static hosts users will paste into
WITHOUT Vercel-style routing), it 404s. The Embed modal's live
preview showed a "404 — File not found" error on localhost.
Switched to the ?embed=<id> query form. Universal: works on any
host that serves the index.html at /, no rewrite dependency.
The published Vercel deploy supports both forms via the existing
rewrites, so the change is backward-compatible for production
consumers.
If anyone wants the clean /embed/<id> form they can hand-edit
the snippet after copying; the embed runtime accepts all three
forms (path, hash, query) on the receive side.
openEmbedCodeDialog set modal.style.display = '' to show the
modal, which falls back to the CSS default `.modal { display:
none }` — so the dialog never appeared. Every other modal in the
app sets `'flex'` explicitly. Matching that pattern.
Also fixes the symptom "Embed button doesn't work / doesn't
copy anything" — the dialog was always present in the DOM but
invisible, so the copy buttons inside it couldn't be reached.
Per docs/EXTERNAL_EMBED_FEATURE.md §13 / §18 Phase 6 — the embed-
code generator now ships alongside Phase 1's viewer so authors
can grab iframe snippets directly from the community preview.
UX:
- New "Embed ↗" button in the preview pane's action row, between
the share-link button and Use/Fork. Hidden for private rows
(embed refuses them anyway); shown for locked-premium rows so
designs can be embedded as watermarked-preview teasers pre-
purchase.
- Click opens #embedCodeModal: a single-screen dialog with
identifier selector, size preset, options checkboxes, live
iframe preview, and the generated iframe HTML in a copy-ready
textarea + Copy URL / Copy iframe code buttons.
Controls:
- Identifier: naddr (latest version, auto-updates) | nevent
(snapshot, frozen to this exact event). naddr is the default
but falls back to nevent when the row has no d-tag.
- Size: responsive 16:9 (recommended) | square 320 / 480 | fixed
640×360 / 800×450 / 960×540 | custom WxH.
- Options: controls / author chip / "Open in Artstr" link /
credits row — each toggled via a query param (controls=0,
attr=0, open=0, credits=1).
The live-preview pane uses a pink/yellow checker background so
transparency in the embedded design shows through visually
(verifies that the iframe is actually transparent before the
user pastes the snippet on their own site).
Copy buttons use navigator.clipboard.writeText with a graceful
fallback toast on permission denial. The URL extracted from the
generated iframe's src=, so URL/iframe stay in sync.
Defensive: also setProperty('background-image', 'none', 'important')
and ('background-color', 'transparent', 'important') on both
documentElement and body. Catches any inherited background-image
that might be painting a pattern instead of a flat color.
Added a console.log('[embed] boot v3', { route }) at the top of
bootEmbedViewer so the user can confirm the new code is reaching
the iframe — if the log doesn't appear in the iframe's dev-tools
console, the browser cache hasn't refreshed yet.
Previous fix set documentElement.style.background = 'transparent'
but didn't beat the global
html, body { background: var(--bg); ... }
rule at the top of the stylesheet. --bg is #e8f4f8 (light cyan,
reads as near-white), so pixel-art transparent pixels were showing
that light cyan through instead of the host page background.
Two fixes layered:
1. CSS rule using :has() so html is targeted only when an
embed-mode body is its descendant:
html:has(body.embed-mode), body.embed-mode {
background: transparent !important;
}
:has() is supported in all current browsers (Chrome 105+,
Safari 15.4+, Firefox 121+). The !important flag beats the
global var(--bg) declaration.
2. Inline override via style.setProperty('background',
'transparent', 'important') on both documentElement and body
at the top of bootEmbedViewer. Inline + !important = highest
specificity possible, so this guarantees transparency even on
browsers/edge cases where :has() doesn't trigger immediately
on dynamic class change.
Net effect: from <html> → <body> → #embedRoot → .embedStage →
.designObjectFitWrap → renderer's pixel-art box → canvas, every
layer is transparent. Host backgrounds (color, image, gradient)
now actually show through transparent pixel-art cells.
Two follow-ups from the size/aspect stress test:
1. Retryable error states (relay query failed, event not found
on any relay) now render a "↻ Refresh" chip below the message.
Click re-runs bootEmbedViewer(route) — same boot path,
re-issues the relay race. Non-retryable errors (private,
premium, malformed identifier, wrong-payload-shape) don't show
the button because retrying wouldn't change the outcome.
_setEmbedStatus now accepts an optional { retry } callback;
only the two relay-failure call sites in bootEmbedViewer pass
it.
2. Pixel art (and any other design with transparent pixels) was
rendering on a white default background because the browser
paints document.documentElement white when nothing overrides
it. body.embed-mode set background:transparent, but the
<html> root was unaffected — leaving a white layer behind the
transparent body.
Fixed by setting document.documentElement.style.background =
'transparent' at the top of bootEmbedViewer. Combined with the
already-transparent body + embedRoot + embedStage chain, the
iframe document is now fully transparent from html down. Host
pages can place the embed over background images / colors and
the unfilled pixel-art cells show the host through.
Host-side defensive: dummy host CSS now explicitly sets
`.frame iframe { background: transparent }`. Modern browsers
default this for transparent-document iframes, but explicit is
safer across browser versions.
The grid swap fixed the squish but introduced the inverse: the
renderer's 720px box stayed at 720px without scaling down to the
iframe viewport. fitMiniPreview was firing, but something in the
grid layout path was preventing the transform: scale() from
shrinking the visible artwork.
Reverted the wrap to the same pattern the existing linked-design
renderer uses for in-app layer previews — flex centering + the
.designObjectFitWrap CSS class, which sets
.designObjectFitWrap > * { flex: 0 0 auto; max-width: none;
max-height: none; transform-origin: center center;
margin: 0 !important; }
flex: 0 0 auto on the direct child explicitly disables both
flex-grow and flex-shrink, so the renderer's fixed 720×720 box
stays at its natural size in layout. fitMiniPreview then reads
naturalW=720, wrapW=iframe-width, and scales uniformly with
correct aspect.
This is the exact pattern that works for linked-design layers in
the editor; the embed inherits the same correctness guarantees.
The embed wrap was using display:flex with align-items+justify-content
to center the rendered design. Flex's default flex-shrink:1 on a
fixed-pixel child (the renderer creates a 720×720 box) shrinks the
box horizontally to fit the wrap width on iframes narrower than
720px.
fitMiniPreview then reads naturalW from the box's inline style
(720) — not the post-flex-shrink computed width — and applies
transform: scale(min(wrapW/720, wrapH/720)). The horizontal axis
ends up scaled twice: once by flex (down to wrap width), then
again by the transform. Result: horizontal squish equal to
(wrapW / 720), visible especially on aspect-ratio:1/1 iframes
hosting square pixel art.
Switched both the public paint wrap and the locked-premium paint
wrap to `display: grid; place-items: center`. Grid centers fixed-
size children without shrinking them, so the box stays 720×720 in
layout. fitMiniPreview's scale calc is then accurate and uniform.
User feedback: the embed frame's white footer band clashes with
host site themes. Refactored so the frame is fully transparent
and every control floats as its own pill chip over the bottom
edge of the stage. Each chip carries a semi-opaque dark
backdrop + blur so it stays readable on any host background
(light, dark, branded).
Style changes:
- .embedFooter is now absolute-positioned, transparent, with
pointer-events: none so the artwork beneath stays interactive
(pixel-art animation, future deck swipe gestures).
- New .embedChip base class for every control:
- rgba(17,24,39,0.7) bg + white text
- 12px backdrop-filter blur for cross-theme legibility
- rounded-pill shape, 1px white-translucent border
- Variants:
- .embedChipUnlock — amber accent for the premium CTA
- .embedChipCounter — slightly lighter, cursor:default
- .embedChipBadge — for the top-right "🔒 PREMIUM" badge
JS changes:
- New _makeAuthorChip(pubkey) helper used by both the public and
premium paint paths.
- _paintEmbed and _paintEmbedLockedPremium drop all inline
color/background overrides — every control gets a chip class
instead.
- The locked-premium prev/next buttons are now plain chips
(were amber-on-amber buttons before, hard to read on dark
artwork). The amber accent only stays on the unlock CTA where
it's a semantic signal.
Status placeholder ("⟳ Loading…", error messages) keeps a soft
white-translucent backdrop so it's visible while there's no
artwork behind it yet.
Smoke-test target: the dummy host page (localhost:8001) now
includes a dark-themed section so chip legibility against dark
backgrounds is verifiable visually.
Per docs/EXTERNAL_EMBED_FEATURE.md §10 / §11.6 / §18 Phase 1+
(promoted from Phase 2 since it's natural to ship alongside the
public render path).
The envelope on a premium event ships an unencrypted `preview`
field:
- watermarked-image: single watermarked JPEG (`preview.dataUrl`).
- watermarked-deck: paginated watermarked slides
(`preview.slides[]`, each { dataUrl, width, height }).
The embed loads the envelope from event.content, branches into a
new `_paintEmbedLockedPremium` paint path, and renders the
preview directly. No relay re-query, no decryption attempt.
UX:
- Stage gets a dark backdrop + the watermarked preview centered.
- A small "🔒 PREMIUM" badge sits top-right of the stage so the
lock is visible without obscuring the artwork.
- Deck previews get prev/next controls in the footer with a
"Slide N of M · K in deck" counter that surfaces the deck's
full slide count (preview ships a capped sample).
- Footer's right side has "🔒 Open in Artstr to unlock ↗" in
amber — the only path to unlock. The iframe never initiates a
zap.
Phase 1's premium-refuse fallback still kicks in for envelopes
that ship without a preview field (legacy / malformed) — same
text-only placeholder as before.
Per docs/EXTERNAL_EMBED_FEATURE.md §18 Phase 1.
- parseEmbedRoute() detects three URL forms so the embed works on
Vercel-rewrite-friendly hosts AND on plain static servers:
/embed/<id> (canonical; needs SPA rewrite)
#/embed/<id> (hash; works on any host)
?embed=<id> (query; works on any host)
- Early-return at the top of init() routes embed mode to
bootEmbedViewer; skips welcome modal, slot/disc/jewel controls,
attachEvents, walletUI, autosave restore, share-route popstate.
Editor JS stays loaded (single bundle), but none of its boot
steps run.
- bootEmbedViewer() decodes the identifier via the existing
decodeNostrId helper (note / nevent / naddr / hex), races the
hint relays then user relays + DEFAULT_NOSTR_RELAYS for the
event, warms linked-design sub-trees in one prefetchBatch
round-trip, then paints via the existing
renderDesignPayloadPreview + fitMiniPreview path.
- Premium events refuse with "🔒 Premium design — open in Artstr
to unlock" placeholder; Phase 2 will render the watermarked
preview JPEG with an inline CTA.
- Private (encrypted) envelopes refuse with a 🔒 placeholder; no
decryption attempted.
- body.embed-mode CSS hides every existing top-level element
(`body.embed-mode > :not(#embedRoot) { display: none !important }`)
and shows a single #embedRoot with a stage + thin footer (author
chip + "Open in Artstr ↗"). attr / open / controls query params
toggle each piece.
- vercel.json gains /embed/:id SPA rewrites and a
Content-Security-Policy: frame-ancestors * header so the route
is iframe-able from any origin. Production behavior; dev (python
http.server) needs no headers — cross-origin framing works by
default.
Manual smoke-test paths:
http://localhost:8000/?embed=<naddr> (query form)
http://localhost:8000/#/embed/<naddr> (hash form)
http://localhost:8001/ (cross-origin
iframe host)
Updated rewrite of the earlier embed plan covering every Artstr
feature shipped since the original sketch:
- Linked sub-design resolution inside embeds (reuses
linkedDesigns.prefetchBatch + resolveLinked + disk cache, full
cycle/depth/byte safety).
- Premium boundary: watermarked preview + "Open in Artstr to
unlock" CTA; no in-iframe zap.
- Private boundary: hard refuse with 🔒 placeholder; no decrypt
attempts.
- Pixel-art animation playback (auto-play, fps override,
prefers-reduced-motion respected).
- Deck slide picker — `?slide=N` deep-links; linked-deck layers
carrying design.slideIndex project to a single-slide payload.
- Credits overlay (opt-in via `?credits=1`), mirroring the
in-app Credits panel.
- PostMessage handshake for parent-page integration (deck
control, fullscreen request, ready/error events).
- Layer-group handling falls out naturally — groups are flat
layers with groupId; the existing renderers already paint them.
- Open Graph metadata on the embed route URL itself.
- Per-event + per-tree byte caps inherited from linked-designs.
- Phase plan + acceptance criteria + risks updated.
No code; this is the planning artifact. Implementation phases
0-9 are scoped inside the doc.
Last Phase 3 polish piece per LINKED_DESIGNS_FEATURE.md §14. The
cold-start path used to fire one parallel queryRelays per linked
layer — a host with 20 distinct linked sources opened 20 sockets
to each relay in the union. Now restoreAutosave issues one
batched relay round-trip via the new linkedDesigns.prefetchBatch.
Mechanics:
1. queryRelays accepts either a single filter object (existing
callers) or an array of filters; arrays spread into the NIP-01
REQ after the sub id (OR semantics). One-line change at the
send site; zero impact on existing call sites.
2. prefetchBatch(specs) skips anything already in the in-memory
cache, inflight map, or disk cache — partial cache hits only
fetch what's missing. Distinct address-coord refs are grouped
by (kind, pubkey) into one filter each (#d set of dTags);
pinned event ids collapse into a single ids-filter. Events
bucket by id (for pinned matches) and by address coord with
latest created_at wins (for ref matches).
3. restoreAutosave's per-spec resolveLinked loop becomes a single
prefetchBatch call. The disk-cache pre-filter inside
prefetchBatch means a reload of a previously-resolved host
pays zero network cost; only newly-linked refs hit the wire.
Per-layer resolveLinked calls in the renderer still work the way
they did — this only changes the bulk warm-up path. Interactive
adds (one new linked layer at a time) keep their single-filter
fast path.
Three bugs in the freshly-shipped extract flow:
1. Group extract baked customArt.background='#ffffff' so the
extracted design lost any transparency the group had. Now
defaults to 'transparent' so the extracted design composites
cleanly into any host. Users can pick a solid fill later via
the customart background control if they want one.
2. Double-clicking a linked layer ran beginDesignObjectEdit
which loads layer.design.payload — but linked layers have no
local payload, just a ref. loadProjectFromText('{}') then
fell back to the default cover/casewrap mode with empty
layers, hence "opens the case wrap editor" and "design is
missing completely."
beginDesignObjectEdit now detects design.kind === 'linked',
pulls the resolved payload from linkedDesigns.peek, and opens
THAT for editing. The edit session is tagged with
{ isLinked, linkedContext } so finishDesignObjectEdit knows
to take the republish path on save instead of mutating
layer.design.payload (which doesn't exist for linked
layers).
3. Guard rails on the linked-edit path:
- Refuse if the resolver hasn't cached the source yet
("Refresh the layer and try again").
- Refuse if the layer is pinned ("Unpin to edit — pinned
versions are frozen").
- Refuse if the source author isn't the current user
("Only the source author can edit; fork or unlink it for
a local copy"). Soft permission — relays decide who can
replace a kind-30078 by pubkey + d-tag, so non-authors
couldn't republish even if we let them try.
On save, _republishLinkedDesignSource:
- Strips linked-design ephemera + builds attribution tags
(same as host publish).
- Publishes a fresh kind-30078 under the same author + d-tag,
which is NIP-33 in-place replace.
- clearCache(key) + seed both resolver caches from the new
signed event so every linked layer on this canvas paints the
updated version on next render.
- Refreshes the layer name from the (possibly edited) payload
title with the 🔗 prefix preserved.
finishDesignObjectEdit is now async; existing call sites are
fire-and-forget which is fine — user feedback flows through
toasts, not the return value.
Extends the per-layer "🔗 Publish + link" pattern to layer groups.
A new 🔗 button sits next to the eye-toggle in each group's
header (layerGroupBlock); clicking it publishes the group as a
single customart-mode design and replaces the group with one
linked layer at the group's bounding box.
Implementation:
- layersBounds() over the group's layers gives the bbox in inches.
- customArt.width/height = bbox in pixels (×96 DPI).
- Each layer is cloned with x/y translated so the group's
top-left becomes (0, 0); target forced to 'canvas'; groupId
stripped. Group can contain mixed layer types (shapes, text,
design objects, images) — customart is the right canvas type
for any of them.
- Strip linked-design ephemera + walk attribution like the
host-publish path so the new event ships proper p / link tags.
- d-tag = "extracted:customart:<slug>:<rand>" to avoid colliding
with the user's regular published designs.
- After publish: remove the original group layers from
state.layers, drop the group entry from state.layerGroups, add
one linked layer at the bbox position with the host's original
target (cover-front / canvas / etc.). The replacement layer's
rotation is 0 — group rotation is intrinsically per-layer.
- linkedDesigns.seed primes both caches from the signed event
so the replacement layer paints instantly.
Confirmation copy warns about publishing under the user's
identity (spec §10.3) and explains the bbox + relative-position
behavior so the conversion isn't surprising.
Mixed-target groups (e.g., one layer on cover-front, one on
cover-back) collapse to a single canvas; this matches user
expectation since "the group" only exists when its members are
selected together as a unit.
User-triggered conversion of an embedded design layer into a fresh
published kind-30078 event under the user's pubkey, replaced by a
linked layer pointing at the new event. Spec §10.3 / §11.4 — when
you decide a sub-design is reusable, one click extracts it without
re-importing by hand.
UI: new "🔗 Publish + link" button in the embedded design-layer
options panel (alongside Edit and Replace from file). Hidden for
linked layers since they're already what extract produces.
Flow:
1. Confirm with copy that warns about publishing under the user's
identity (per spec §10.3 — only do this for designs you made).
2. Clone the layer's payload, override payload.meta.title with the
layer's name, keep host category/language so the new event
discovers into the same bucket.
3. Strip linked-design ephemera + walk the linked tree for
attribution p-tags + link tags, same as the host-publish path.
4. Mint d-tag = "extracted:<mode>:<slug>:<rand>" so it can't
collide with the user's regular published designs.
5. Sign + publish via publishCommunityEvent.
6. Mutate the layer in place: design becomes { kind: 'linked',
ref, mode, pinnedEventId: null, slideIndex: 0 for decks }, name
gets the 🔗 prefix, push history.
7. Seed both resolver caches from the signed event via the new
linkedDesigns.seed(spec, sourceEvent) method — the layer paints
from cache instantly without waiting for relay propagation.
linkedDesigns.seed reuses _entryFromEvent so vault / premium /
private detection runs identically to a fresh fetch. Disk-cache
write happens too so a reload also paints instantly.
Group extraction is a natural follow-up — a group of layers would
publish as a single customart-mode payload sized to the group's
bbox. Not in this commit; ship single-layer first.
Mirror the in-memory resolver cache to localStorage so cold reloads
paint linked sources without a relay round-trip. 24-hour TTL keeps
return visits feeling instant while still propagating source edits
within a day; 4 MB LRU eviction stops a host with many linked
layers from blowing the quota.
Storage shape (artstr.linkedDesignCache.v1):
{ version: 1,
entries: {
[cacheKey]: { sourceEvent, fetchedAt }
}
}
The disk cache stores only the raw sourceEvent — premium / private
detection, vault lookup, and decrypt all re-run on every read via
the extracted _entryFromEvent helper. That means vault state,
sign-in changes, and unlocks since the last fetch are always
respected on disk-cache hits; we never serve stale "locked" state
once the user has unlocked, or stale "unlocked" state once they
clear the vault.
Refresh + Unlink continue to be the user's escape hatch:
clearCache(key) now wipes both the in-memory entry AND the disk
entry, so a manual refresh genuinely re-fetches from relays.
Eviction is LRU by fetchedAt when total content bytes exceed
LINKED_DESIGN_DISK_MAX_BYTES. Quota errors on save drop the whole
cache and continue — better to lose the optimization than to break
publishing for an unrelated localStorage write.
Two fixes for linking to slide decks:
1. Per-event cap was 256 KB — fine for slides/covers but legitimate
multi-slide decks routinely run 300-800 KB. The resolver was
returning null for those events, and the renderer fell through
to the "Linked source not found" placeholder. Raised the cap to
1 MB to match the per-tree cap; the tree cap still bounds the
worst-case host render, and a single oversize event is now
tolerated rather than dropped.
While here, added console.warn diagnostics on the resolver's
null paths (no events, empty content, cap exceeded, JSON parse
fail) so future debugging is one dev-tools tab away.
2. A linked deck normally has 5-50 slides and the user almost
always wants to embed one of them, not the multi-slide
thumbnail. New schema field design.slideIndex picks which
slide to render:
- addLinkedDesignLayerFromRow / replaceLinkedDesignLayerFromRow
default it to 0 when the source is a deck.
- renderResolved checks for a finite slideIndex on a deck
payload and projects to a stand-alone slide payload via
_deckSlideToSlidePayload before painting. The picked slide
renders the same way a normal slide-mode design would.
- The linked-layer options panel now shows a "Slide" dropdown
(id linkedDesignSlideRow) when the resolved source is a
deck. The dropdown lists every slide as "N. <name>" and
mutating it pushes history + re-renders.
- The row hides itself for non-deck sources and for decks
that haven't resolved yet — once the resolver fills the
cache, the next render reveals it.
Public/embedded layers and non-deck linked layers are unaffected.
LINKED_DESIGNS_FEATURE.md §12.1 — private sources carry a NIP-44 /
NIP-04 envelope addressed to specific pubkeys. Phase 1 treated them
as unparseable junk; Phase 2 detects them, attempts decryption, and
either renders the decrypted payload (if the viewer is in the
envelope's recipients list) or paints a 🔒 placeholder otherwise.
Resolver changes (_fetchPayload):
- After the premium branch, detect isEncryptedEnvelope(parsed) and
await decryptProjectEnvelope. On success return the decrypted
payload like a public source; on any failure (not in recipients,
no signing extension, malformed envelope) return { payload: null,
private: { state: 'locked' } } so the renderer can paint the
locked UI without re-fetching.
Renderer changes:
- New renderLockedPrivate helper paints a 🔒 + "Private design" +
"Not shared with this account" on a dark gray background. No
unlock CTA — access to a private design is granted at the
source's publish time by adding the viewer to envelope.recipients,
there's no buyer-side action to take.
- Sync peek hit handles cached.private.state === 'locked'; async
path handles entry.private.state === 'locked'.
Source authors are always in their own envelope.recipients, so the
existing self-decrypt path works for them without special-casing.
LINKED_DESIGNS_FEATURE.md §12.1 — Phase 1 silently dropped
premium / encrypted sources because the resolver's JSON.parse hit
an envelope shape and the renderer treated payload=null as
"source missing." Phase 2 detects premium events, gates rendering
on the buyer's purchase-vault entry, and surfaces an inline unlock
CTA when the viewer hasn't bought yet.
Resolver changes (_fetchPayload):
- Detect premium events via isPremiumEvent() on the source event.
- Look up findUnlockedEntry(ev.id, addressCoord); on hit, return
the cached decrypted payload as if it were public.
- For self-authored sources, run Premium.decryptPayload locally
(soft-gate KDF is deterministic from public material) and
mirror the unlock into the vault via markUnlocked so My Designs
and the feed see it too.
- Otherwise return { payload: null, premium: { state: 'locked',
envelope, addressCoord } } so the renderer can paint the locked
UI without re-fetching.
Renderer changes (renderDesignObjectIntoElement linked branch):
- New renderLockedPremium helper paints the watermarked preview
JPEG (from envelope.preview.dataUrl) at .45 opacity behind a
semi-transparent overlay with 🔒 + "Linked premium design" + an
"⚡ Unlock for X sats" button.
- Button awaits openUnlockConfirm with a synthetic row built from
the source event; after it resolves, checks the vault and if
the entry landed, clears the resolver cache for this layer's
key and re-renders. The resolver re-fetches and the next paint
shows the decrypted preview.
- Sync peek hit handles cached.premium.state === 'locked';
async path handles entry.premium.state === 'locked'.
Locked sources still contribute to attribution (sourceEvent.pubkey
is known regardless of payload visibility), but walkLinkedTree
descends no further into them — encrypted contents are opaque to
us, so nested credits stop at the locked boundary. Acceptable
Phase 2 limitation.
Private (visibility) linked designs are NOT in this commit;
adding on top as P2c if Adam wants.
The hydrator was relying on populateCommunityProfiles, which only
queries state.community.relays. Linked-design contributors are
arbitrary pubkeys whose kind-0 metadata typically lives on the
popular default relays (damus, nos.lol, primal, nostr.band), not
necessarily on the host author's narrow relay list — so the lookup
silently came back empty and the UI fell back to short-pubkey
labels.
Switch to the same _vaultRelayUnion() the linked-design resolver
already uses (user relays ∪ DEFAULT_NOSTR_RELAYS). Pick the latest
kind-0 per pubkey when multiple relays return different versions.
Write into both state.community.profiles and _feedCache.profiles
so all downstream profile-display surfaces (including the existing
"by Author" link in the preview header) benefit from the fetch.
Two fixes to the Credits panel + preview surface:
1. Anchor click routed through openProfilePage(pk) instead of
navigating to /u/<npub> — the latter 404s because the SPA only
handles those routes via JS, there's no static file behind them.
Mirrors the pattern used by the existing author link in the
preview header (preventDefault + openProfilePage).
2. Display name pulled from _feedCache.profiles / state.community
.profiles with shortPubkey() as fallback. For contributors who
aren't in the cache yet, _hydrateCreditProfiles fetches kind-0
metadata via populateCommunityProfiles in the background and
re-renders the list when names arrive. Per-pubkey inflight
tracking dedupes concurrent fetches across re-renders.
Editor panel re-renders the full panel on hydration. Preview
section rebuilds just its <ul> in place, guarded on
section.isConnected so a closed or swapped-out preview doesn't
mutate stale DOM.
Mirror the editor's Credits panel into the community/template
browser preview pane so viewers can see who contributed before
importing or unlocking. Same data, different host:
- Factored collectLinkedCredits + buildCreditsListElement out of
renderCreditsPanel so both surfaces share the implementation.
- The preview pane passes the row's payload + author pubkey;
self-attribution (the design author appearing in their own
credits) is filtered out the same way the editor filters the
current user.
- Section is appended at the bottom of the preview content; it
only renders when the previewed design has at least one linked
contributor.
Works for previews of cover, slide, deck, jewel, disc, pixelart,
and custom-art designs — the section appends after whichever
mode-specific preview renderer ran.
Per LINKED_DESIGNS_FEATURE.md §10.1, surface each distinct
contributor reachable via the host's linked layers as a clickable
@npub entry in a "🔗 Credits" panel in the metadata sidebar.
Walks state.layers + every deck slide's layers, groups distinct
linked refs by pubkey (so 5 copies of the same source count as 1
design from that creator), excludes self, and renders one entry
per contributor sorted by descending design count. Each entry
links to the /u/<npub> profile page in a new tab.
Pubkey is parsed straight from design.ref's address coord, so the
panel populates without waiting for the resolver. Fieldset is
hidden entirely when there are no linked layers — non-collaborative
designs stay clutter-free.
Wired into render() so it stays current as the user adds, removes,
pins, replaces, or unlinks layers.
Per LINKED_DESIGNS_FEATURE.md §10.2, host designs that contain
linked layers now emit:
['p', <pubkey>, <relay-hint>, 'design-contributor'] per distinct
contributor
['link', <kind:pubkey:dTag>, <relay-hint>] per distinct
linked ref
Implementation: a new _buildLinkedAttributionTags helper drives the
existing linkedDesigns.walkLinkedTree to collect contributor pubkeys
+ refs in one pass (cycle- and depth-3-safe via the resolver). The
host author's pubkey is filtered from contributors. Walker errors
degrade to empty tag arrays without failing the publish.
Tags are spliced into the public publish path and the premium
publish path. Private publishes skip attribution entirely — tags are
unencrypted, so emitting them would leak the link graph through what
is meant to be a feed-invisible event.
Encrypted sources resolve to null payloads in Phase 1, so their
authors silently don't get p-tagged — which is the right Phase 1
behavior until Phase 2 brings encrypted-link support.
Unit tests at /tmp/test_attributionTags.js (12 cases) cover dedupe,
self-filtering, malformed-pubkey rejection, empty walks, and walker
failure modes.
restoreAutosave now collects every linked layer (top-level + every
deck slide) and kicks off linkedDesigns.resolveLinked for each.
This pre-warms the cache so the first render's renderResolved fires
from a synchronous peek instead of paying the relay round-trip
serially, and duplicate refs across slides dedupe via the inflight
map.
stripLinkedDesignEphemera removes session-only fields
(lastResolvedAt, lastResolvedSize, transient fallbackPreview) from
linked layers in a published payload. Called once at the top of
publishCurrentTemplateToNostr — before the private/premium/public
branches — so every publish path is covered. fallbackPreview only
survives if design.snapshotPreview === true (a future opt-in surface
for designs that want a still preview to ship alongside the link).
Unit tests at /tmp/test_stripLinkedEphemera.js (16 cases) cover the
mutation, opt-in, deck walking, and null-tolerance paths.
renderResolved had an `if (!el.isConnected) return` guard meant to
catch the async path resuming after the layer was removed. But
renderLayers() creates `el` via document.createElement and only
appends it to the overlay *after* renderDesignObjectIntoElement
runs (line 14442). On the synchronous peek-hit path, that meant
the guard fired on every re-render — wiping the layer every time
the canvas re-rendered after the cache warmed.
Move the guard out of renderResolved (the sync caller doesn't
need it — fitWrap is a descendant of el either way, and the
caller will append el right after this function returns) and
keep it in the async closure (where it's actually needed,
because by the time the await resumes the old el may have been
discarded by a subsequent render).
Adds a dedicated layer-options panel that appears when a linked
design layer is selected, alongside the existing import flow:
- Source title + creator npub + "Last resolved <X> ago"
- 📌 Pin-to-current-version toggle (snapshots current event id)
- Refresh button: clears the layer's cache key + forces re-resolve
- Replace link… opens the community browser in 'link-replace' mode,
swapping the source on selection while keeping position + size
- Unlink to embed snapshots the resolved payload into an embedded
layer (requires a successful prior resolve)
The selection-sync block now hides the embedded-design panel and
shows the linked-design panel when design.kind === 'linked'.
User-facing entry point to create a linked design layer. Both
layer-panel sites (designer-app disc target + template-app per-
target panel) now expose a "🔗 Link from Nostr" button alongside
the existing "Import from Nostr" — embed vs link is a one-click
distinction at import time.
Mechanics:
- openLinkedDesignNostrSearch(targetOverride) mirrors the existing
embed-flow opener but stashes state._designLayerImportMode =
'link' before opening the community modal. The modal is unchanged;
the same row-click handler picks the route.
- addLinkedDesignLayerFromRow(row, target) creates a
kind: 'linked' layer with { ref, mode, pinnedEventId: null }. Ref
is built from the source event's kind + pubkey + d-tag. Refuses to
link sources without a d-tag (legacy non-replaceable events). The
initial layer dimensions mirror the embed path — uses
designObjectAspect on the freshly-clicked payload — so the layer
lands at the source's natural aspect. Layer name prefixed with
'🔗 ' so it's visually distinct in the layer list.
- tryDesignLayerImportRow now dispatches on _designLayerImportMode:
'embed' keeps the existing addDesignLayerFromPayload behaviour;
'link' routes to addLinkedDesignLayerFromRow. Resets the mode
back to 'embed' on completion or cancellation.
- openDesignLayerNostrSearch (the embed entry point) explicitly
sets mode = 'embed' on open so a previously-cancelled link
attempt doesn't pollute the next embed.
- The new addLinkedDesignLayerFromRow warms the resolver cache
with the just-fetched payload so the very first render is sync —
no placeholder flicker for the user who just clicked.
Toast copy is honest about the difference:
- embed: "Design imported as an editable object layer."
- link: "🔗 Linked — renders the latest version of the source on
each refresh."
Layer-options panel (refresh / pin / unlink / replace) for selected
linked layers is the next commit in this phase.
Implements the sync-placeholder + async-upgrade render pattern
from spec §8.1. Linked design layers now resolve their source from
relays on first render, with the safety rails wired in.
Render flow for kind: 'linked' layers:
1. Compute the cache key (address or pinned event id).
2. Walk DOM ancestors (data-linked-key markers) to detect
cycles (key already in chain) and depth-3 overshoots. Both
render an explicit visible placeholder rather than silently
no-op'ing, so the user sees why nothing painted.
3. Tag the host element with data-linked-key so deeper renders
can see this layer in their own ancestor walk.
4. Sync cache peek (linkedDesigns.peek) — if the source is
already in the session cache, render the resolved payload
immediately and skip the placeholder flicker.
5. Otherwise: show a "⟳ Loading linked design…" hint (or the
persisted fallbackPreview JPEG if the user opted in), kick
off the async resolver, and upgrade fitWrap when it returns.
Self-aborts via el.isConnected check if the host re-rendered
while we were fetching.
6. On resolve, cache lastResolvedAt + lastResolvedSize on the
layer for the upcoming layer-options panel.
7. On miss (source not on relays), show "🔗 Linked source not
found — refresh to retry" unless the layer's fallbackPreview
is already drawn.
Embedded path (kind: 'embedded' or legacy layers without kind)
unchanged — sync render from inline payload, same as before.
Two new helpers:
- _collectLinkedAncestorKeys(el): walks DOM upward collecting
data-linked-key values. Lets cycle / depth detection work
without threading a context object through every renderer.
- _sizeFromDesignPayload(payload): pulls a (w, h) hint from any
design payload (customart / deck-first-slide / pixel-art).
Used to set lastResolvedSize for the options panel.
The resolver IIFE gained peek() and keyFor() public helpers so
the renderer can do its sync cache check + key computation
without reaching for the underscore-prefixed internals.
No UI yet for creating linked layers — that's Phase 1c. With this
commit, a manually-crafted linked layer (e.g. via a debug console)
renders correctly. Cycles + depth-4 attempts render visible
"blocked" placeholders.
Adds the linkedDesigns IIFE alongside the existing purchase-vault
helpers. Resolves a layer's { ref, pinnedEventId } to its current
source payload via relay query, with all the safety rails the spec
calls out.
What's in this commit:
- _parseAddressCoord: parses NIP-01 "kind:pubkey:dTag" addresses
with hex-pubkey + numeric-kind validation. Returns null on
malformed input so a tampered host event can't crash the resolver.
- Session cache (Map keyed by address-or-eventId) with 5-minute
TTL per spec §7. Inflight-Promise dedupe so parallel resolves
for the same key share one network round-trip.
- _fetchPayload: queries the wider purchase-vault relay union
(user relays + DEFAULT_NOSTR_RELAYS) so linked sources are
reachable cross-domain. Pinned mode uses ids: [eventId] filter,
latest mode uses kinds + authors + '#d'. Picks the most-recent
event by created_at as a defensive measure for relays that
somehow returned more than one addressable match.
- Per-event content cap (256 KB / LINKED_DESIGN_MAX_EVENT_BYTES) —
oversized source events are rejected before parse.
- walkLinkedTree: recursive walker for the layer graph with
depth-3 cap, cycle-safe via visited Set keyed by cache key,
per-tree byte cap (1 MB / LINKED_DESIGN_MAX_TREE_BYTES) that
short-circuits the walk when exceeded. Decks: walks every
slide's layers too.
- walkContributors: convenience wrapper that returns the distinct
set of source pubkeys reachable through the linked-tree walk.
Backs the attribution `p`-tag emission in Phase 3, exposed now
so a Credits panel can also use it.
- clearCache: manual eviction, used by the per-layer Refresh
button + the upcoming pre-publish strip.
Internals (_parseAddressCoord, _cacheKey) are exposed so the
pure-Node unit tests in Phase 1d can hit them without a browser
environment.
No render-side wiring in this commit — that's Phase 1b. With this
commit only, calling `linkedDesigns.resolveLinked({ref: '30078:...'})
from the browser console resolves the source's payload, which is
the minimum building block for the render-time path.
Second-pass review surfaced eight issues worth pinning down before
we start coding. Each addressed in-place rather than as a TODO so
the implementation has a clear target:
1. §5.1 — Persisted vs in-memory fields. The host's serialized
`content` was implicitly inflating with `fallbackPreview`,
`lastResolvedAt`, `lastResolvedSize` from the initial schema.
Now explicit: only `kind` / `ref` / `mode` / `pinnedEventId` /
`pinnedSnapshot` persist; the rest are runtime-only and stripped
at publish time. A linked layer footprint is ~110 bytes serialized.
2. §6.1 — Pinned + source deletion. New section covering the case
where the source author kind-5-deletes a pinned event. Adds a
`pinnedSnapshot` field that the renderer prefers-live-falls-back-
to-snapshot, plus the existing `fallbackPreview` for visual-only
fallback. Default = pin without snapshot, user opts in for
permanence.
3. §8.1 — Sync vs async render decision. The renderer is synchronous
today; this section explicitly picks "sync placeholder + async
upgrade" over "block render" or "pre-fetch all". DOM tagging +
abort-on-detach behaviour documented so the implementation
doesn't end up re-deciding mid-build.
4. §8.2 — Autosave + cold start. localStorage restore loses in-memory
resolver state, so on `restoreAutosave` we kick off the resolver
for every linked layer in the background.
5. §10.3 — Embedded → linked attribution: corrected an inaccurate
claim. Embedded layers don't carry source-author metadata, so
"Publish + link" credits the CURRENT user, not whoever originally
authored the embedded content. Action copy should warn explicitly.
6. §12.1 — Premium-link access check: clarified that the gate is the
host viewer's purchase-vault entry (not technical decryption
capability, since the soft-gate KDF is deterministic).
7. §13 — Added a per-tree cap (1 MB total resolved payload per host
render) on top of the per-event cap. Depth-3 fan-out could
theoretically multiply fetches; the tree cap stops a coordinated
DOS at the host level.
8. §11.5 — Picking initial layer dimensions for a new linked layer
(sync resolver lookup with a 1.5 s timeout, falls back to 16:9
default). Plus a link-creation modal preview so the user can
confirm what they're linking before commit.
Also tightened the Phase 1 acceptance criteria around serialized
size: explicit budgets for 10-link host events and verification that
in-memory fields are stripped at publish.
Spec for the next big arc: reference-based cross-design imports.
Adds a `kind: 'linked'` flavor of the existing design layer that
stores only a NIP-01 addressable-event coordinate
(30078:<pubkey>:<dTag>) and resolves to the latest source on
render. Sits alongside the existing embedded import path; user
picks at import time.
Key decisions baked in (per scoping conversation):
- Versioning: always-latest by default, with an opt-in "Pin to
this version" toggle exposed per linked layer.
- Nesting: up to 3 levels deep with cycle detection + visible
depth-exceeded placeholders.
- Encrypted: Phase 1 ships public-only; Phase 2 adds premium
(renders if viewer's unlocked) and private (share-list aware).
- Attribution chain is first-class — host publish emits one
['p', '<contributor pubkey>', '<relay-hint>', 'design-contributor']
tag per distinct linked-tree creator, plus an in-app Credits
panel surfacing co-creators. Lets larger collaborative projects
carry honest attribution natively.
Architectural shape:
- Resolver IIFE (linkedDesigns) with session cache, multi-relay
union (mirrors _vaultRelayUnion), and a manual Refresh button
to bypass cache.
- renderDesignObjectIntoElement gets a linked branch that calls
the resolver before the existing render path.
- Layer-options panel exposes pin / refresh / unlink / replace.
- "Publish + link" action converts an embedded layer to a freshly-
published source + linked reference (Phase 3 polish).
- Convert-back-to-embed action snapshots the current resolution.
Phased implementation:
- Phase 1: Public-only linking, schema, resolver, rendering, UI.
- Phase 2: Premium + private link resolution with access control.
- Phase 3: Disk cache, attribution `p`-tag emission, Credits panel,
Publish + link workflow.
Acceptance criterion for Phase 1: a public cover design linked into
a public slide deck renders correctly; editing the source updates
the host's render on next refresh. 10-link host event stays under
typical relay size limits.
Outstanding open questions to revisit during implementation:
- Whether the depth limit should be 3 forever or configurable.
- Whether the 256 KB per-source payload cap is the right number.
- Whether to surface "last resolved" times in the layer name itself
or only on hover.
The list had drifted from reality across the last ~30 commits.
Cleaning up so "what's next?" decisions stand on accurate ground.
Moved out of "Drafted-but-unbuilt" / polish sections and into
"Shipped (recent)":
- Native chart import phases 1–4 (bar + pie + line + polish layer).
The old "Native chart support" follow-up text under PPTX polish
was outdated — chart import is now its own arc with its own
CHART_IMPORT_FEATURE.md spec.
- PPTX Phase 7 per-run rich text spans — listed as a follow-up;
actually shipped in commit b6cf4f3.
- Premium deck publishing + multi-slide preview pager.
- Self-author auto-unlock.
- Pixel-art layer animation when embedded.
- One-click PNG / GIF download on pixel-art preview pages.
- Auto-pick category metadata via defaultCategoryForMode.
- Locked-premium UI gating (Print / Save PDF, Start Presentation,
Import-into-Disc-1/2).
- Vault durability fixes (receipt re-derive, synchronous upsert,
multi-relay union).
Fixed the stale "Branch still needs a merge into `main` once we're
done testing" line under PPTX import polish — the merge happened
ages ago.
Added a new "Chart import polish" section listing the open chart
follow-ups (stacked variants, combo charts, 3D approximations).
Added Linked Designs to "Drafted-but-unbuilt features" so the new
spec at docs/LINKED_DESIGNS_FEATURE.md surfaces for future
"what should we do next" decisions.
Three preview-pane actions consume the design payload, not just
the watermarked-preview envelope, so they shouldn't appear until
the buyer unlocks:
- Print / Save PDF — loadProjectFromText against a locked
envelope just loads the encrypted blob, not the printable
artboard. Hidden until unlock.
- Start Presentation (deck) — startPresenter walks payload.deck
/slides which carry the multi-page slide data; on a locked deck
the envelope only has watermarked slide-preview JPEGs.
- Import into Disc 1 / Import into Disc 2 (disc-design) —
importDiscDesignFromPayload reads payload.discDesign, which
isn't present on a locked envelope.
All three gated with `&& !lockedPremium`. The Use/Fork button
already transforms to "Unlock for N sats" for the same reason,
Save JSON is disabled, and Share / Tip / Block-report-overflow
stay available since they don't need the design data.
Creating a Slide, Slide Deck, Pixel Art, or Custom Art template
already auto-set state.meta.category in applyLayout — but the
auto-fill was inconsistent (slide / deck / pixelart unconditionally
overwrote, customart only filled when empty) AND it didn't apply
when importing / forking a design whose payload arrived without
a category set.
Fix:
- defaultCategoryForMode(mode) — new shared helper that maps the
canvas modes to their canonical mediaCategories entries:
'slide' → 'slide'
'deck' → 'slide-deck'
'pixelart' → 'pixel-art'
'customart'→ 'custom-art'
Physical-media modes (cover / disc / jewel / disc-design) return
'' so the user picks DVD / Blu-ray / PS3 / etc. — there's no one
obvious default.
- syncInputs runs the helper at the top: if state.meta.category is
empty, fill it from the current mode. Idempotent — leaves a
user-picked value alone. Covers BOTH create-new and import /
fork / loadProjectFromText paths via the one entry point all
state changes pass through.
- applyLayout's inline mode → category switch replaced with the
shared helper, also made consistently only-if-empty so a
user-picked category survives a mode switch.
Pixel-art designs already expose their own one-click Download
PNG / GIF button (commit 95a39cc), which produces the right asset
for raster sprites at the right native scale. Print / Save PDF
on top of that is redundant + confusing — a printed PDF of a
32x32 pixel sprite isn't a useful artefact.
Gate the printBtn injection on mode !== 'pixelart'. All other
modes (cover, slide, deck, customart, jewel, disc-design, disc)
keep the button as before.
A multi-frame pixel-art design imported as a layer into another
canvas (a cover, slide, custom-art, etc.) was rendering only its
first frame as a static image. Now it animates at its stored fps
+ loop settings, matching what the standalone preview already
does.
renderPixelArtIntoElement now branches on frames.length > 1:
- Multi-frame: pre-render every frame to a native-size canvas
(cheap reuse of renderPixelGridToCanvas), then a RAF loop
blits the current frame onto a display canvas, advancing by
ts deltas to honour the source fps regardless of monitor
refresh rate.
- The RAF self-stops when the display canvas leaves the DOM
(cv.isConnected === false), so a re-render of the editor /
preview pane doesn't leak loops. Same pattern as the
standalone-design animation.
- Single-frame: unchanged static render.
Applies everywhere pixel-art-as-layer surfaces: the live editor
free-layer overlay, the preview pane in the community browser,
and any host design that picks up the layer.
The community-browser preview page for pixel-art designs now
exposes a "⬇ Download PNG" (single-frame) or "⬇ Download GIF"
(multi-frame, animated) button next to Use/Fork, Share, and
Save JSON. Means viewers can grab the sprite asset without
forking it into the editor first.
Implementation reuses the existing exportPixelArtToPngBlob /
exportPixelArtToGifBlob / pixelExportFilename helpers from the
editor's full export menu, at the default 4× scale (matches
the editor's _pixelExportOpts default). GIF carries the source
design's fps + loop settings.
Gated on mode === 'pixelart' && !lockedPremium — locked premium
pixel-art designs only expose the button after unlock (the design
data isn't available before then). Self-authored designs and any
unlocked / free pixel-art design get the button regardless of
who published it.
Button shows "Preparing…" while encoding (matters for big
multi-frame GIFs where encoding can take a second or two).
Errors land as a toast.
The previous commits added paginated previews for the LOCKED
premium state (creator-side multi-slide watermarked previews,
buyer-side Prev/Next viewer). Adam reasonably asked for the same
flippability after unlocking — there's no good reason a buyer
who's paid (or a creator looking at their own work) should
suddenly lose the ability to flip through slides.
renderDeckPreviewDOM now branches:
- compact OR <= 1 slide: keep the existing single-slide-1 +
"N slides" badge render. This is the path feed cards, profile
grids, and anything else passing { compact: true } take.
- non-compact AND >1 slide (i.e. the community-browser preview
pane): emit a Prev / Next pager that re-renders the chosen
slide via composeSlideForDeck + renderCustomArtPreviewDOM, with
a "Slide N of M" counter between the buttons.
Same UX as the locked-premium pager so the transition pre- vs
post-unlock feels continuous. Applies to every deck — premium
or free, self-authored or someone else's — that lands in the
preview pane.
thePR0M3TH3AN