🐛 Fix problem with node splitting in paths (#11553)

* 🐛 Fix problem with node splitting in paths

* 🐛 Fix merge splitting node in paths

.agents/README.md

@@ -34,7 +34,7 @@ JSON, REPL access, and so on.
 |---|---|---|
 | [`make-a-plan`](skills/make-a-plan/SKILL.md) | Researches the task, writes an implementation plan, asks you the open questions in plain language, and saves the plan to `.agents/plans/`. | "make a plan for the token refresh bug" |
 | [`review-plan`](skills/review-plan/SKILL.md) | Evaluates a plan before anyone writes code: completeness, ordering, risks. Approves it or asks for changes. | "review this plan before we start" |
-| [`implement-plan`](skills/implement-plan/SKILL.md) | Shows you the full flow first — the issue and branch it will create (or the branch it continues on), the execution style, and the task checklist — and, after your go-ahead, executes a ready plan. Default: every task, one commit. On request ("step by step"): one task, one commit, your confirmation between tasks. | "implement the plan" · "step by step, one commit per task" |
+| [`implement-plan`](skills/implement-plan/SKILL.md) | Shows you the full flow first — the issue and branch it will create (or the branch it continues on), the execution style, and the task checklist — and, after your go-ahead, executes a ready plan. Default: every task, one commit. On request ("step by step"): one task, one commit, your confirmation between tasks. On request ("direct"): no issue and no branch, commits on the current branch. | "implement the plan" · "step by step, one commit per task" · "direct, no branch" |
 | [`review-code`](skills/review-code/SKILL.md) | Reviews a diff, branch, or PR and returns findings ranked by impact. | "review my changes before I push" |
 | [`create-pr`](skills/create-pr/SKILL.md) | Opens a pull request for the current branch — with checks on base branch, commits, issue, and push state — or updates an existing PR's title and description. | "open a PR for this branch" |
 | [`resolve-git-conflicts`](skills/resolve-git-conflicts/SKILL.md) | Untangles merge or rebase conflicts: explains both sides, proposes a resolution, applies it after you approve. Never runs `git rebase --continue`. | "resolve these conflicts" |
@@ -65,6 +65,7 @@ JSON, REPL access, and so on.
 | [`nrepl-eval`](skills/nrepl-eval/SKILL.md) | Run Clojure or ClojureScript code in the live REPL sessions (backend and frontend). |
 | [`taiga`](skills/taiga/SKILL.md) | Look up Penpot issues, user stories, and tasks in Taiga. |
 | [`testing`](skills/testing/SKILL.md) | The repo's testing rules and TDD workflow, loaded before writing tests. |
+| [`local-ci`](skills/local-ci/SKILL.md) | Run CI-style lint, test, and format checks for the modules you touched with `scripts/ci`, and read the logs when they fail. |
 | [`security-and-hardening`](skills/security-and-hardening/SKILL.md) | Security checks for code that handles user input, auth, or external services. |
 | [`ste`](skills/ste/SKILL.md) | Rewrites prose in Simplified Technical English. Loads only when you name it. |
 | [`refine-prompt`](skills/refine-prompt/SKILL.md) | Rewrites a rough prompt into a clearer one. Never runs the prompt. |

.agents/skills/create-commit/SKILL.md

@@ -20,6 +20,17 @@ Before drafting any commit, read `mem:workflow/creating-commits` end-to-end. It
 is the authoritative source for the commit message format, the emoji menu,
 subject/body limits, and the `AI-assisted-by` trailer. Follow it exactly.
 
+## Iron Rules (non-negotiable)
+
+1. **Wrap every body line at 76 characters or fewer.** Count characters, do
+   not eyeball. Exceptions: `Signed-off-by:` / `AI-assisted-by:` trailers and
+   lines carrying a URL. This is the rule agents skip most often.
+2. **Subject ≤70 chars**, imperative, capitalized, no trailing period.
+3. **Blank line between subject and body.**
+4. **Run `./scripts/check-commit` and require exit code 0.** It mechanically
+   checks rules 1–3. A non-zero exit is a hard blocker: fix the message and
+   re-commit. Never report the commit as done with a failing checker.
+
 ## Workflow
 
 1. **Stage the files** specified by the calling context. Do not ask for
@@ -29,12 +40,18 @@ subject/body limits, and the `AI-assisted-by` trailer. Follow it exactly.
    that does not match the stated intent, **STOP** and tell the user before
    committing.
 3. Draft the message following the format in the memory doc, wrapping the body
-   at 72 characters per line, and run:
+   at 76 characters per line, and run:
    ```bash
    git commit -m "<subject>" -m "<body>"
    ```
    (or `git commit -F -` if the body has unusual characters).
-4. The `AI-assisted-by` trailer value is provided by the calling context — use
+4. **Verify the message with the checker**:
+   ```bash
+   ./scripts/check-commit
+   ```
+   If it fails, amend the message (`git commit --amend`) until it passes. Do
+   not finish with a failing checker.
+5. The `AI-assisted-by` trailer value is provided by the calling context — use
    it verbatim.
 
 ## Constraints
@@ -45,3 +62,4 @@ subject/body limits, and the `AI-assisted-by` trailer. Follow it exactly.
 - Do not amend a commit you did not create in this session, unless explicitly asked.
 - Do not bypass pre-commit hooks (`--no-verify`) unless explicitly asked.
 - Do not add untracked files that were not created in this session.
+- Do not skip the `scripts/check-commit` verification step (Iron Rule 4).

.agents/skills/implement-plan/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: implement-plan
-description: Implementation flow — execute a ready plan from the session context: read the plan, detect the flow, then present the full picture (issue and branch to create or the branch to continue on, execution style, task checklist) and wait for confirmation. Default is every task with one final commit; on request ("step by step"), one task and one commit at a time with a pause after each. Use it when the user asks to implement or execute a plan, in any phrasing.
+description: Implementation flow — execute a ready plan from the session context: read the plan, detect the flow, then present the full picture (issue and branch to create or the branch to continue on, execution style, task checklist) and wait for confirmation. Default is every task with one final commit; on request ("step by step"), one task and one commit at a time with a pause after each; on request ("direct"), no issue and no branch — the commit lands on the current branch. Use it when the user asks to implement or execute a plan, in any phrasing.
 ---
 
 # Implement Plan
@@ -45,9 +45,14 @@ read-only: nothing is created until the user confirms (step 3).
   No issue or branch is created. The branch name provides the issue
   reference when it follows the `issue-NNNN` pattern.
 
-Arguments override detection: `standalone`, `continue`,
-`no issue` / `without issue`, or an explicit base such as
-`from origin/develop`.
+Arguments override detection: `standalone`, `continue`, `direct`
+(`no branch` / `direct commit`), `no issue` / `without issue`, or an
+explicit base such as `from origin/develop`.
+
+**Direct mode** (`direct`, `no branch`, `direct commit`): no issue and
+no branch — the implementation and the commit land on the current branch
+as it is, even when it is a base branch. Best for small or tooling-only
+changes the user wants committed in place.
 
 **Standalone while already on a feature branch:** stop and explain that this
 would stack branches. Ask the user to re-run with an explicit base, for
@@ -59,8 +64,10 @@ Before touching the repository, show the user the full picture:
 
 - **The flow**: whether the GitHub issue and the branch will be created
   (standalone mode — give the planned branch name, `issue-NNNN` or
-  `plan-<slug>`), or whether you continue on the current branch
-  (continue mode — name it).
+  `plan-<slug>`), whether you continue on the current branch
+  (continue mode — name it), or whether everything lands on the current
+  branch as it is (direct mode — name it, and say so when it is a base
+  branch).
 - **The execution style**: batch or step-by-step (see *Execution modes*).
 - A checklist (todolist) of the plan's tasks, in order.
 
@@ -84,6 +91,11 @@ If the arguments say `no issue` / `without issue`, skip the issue and
 create a branch named `plan-<slug>` instead, where `<slug>` is the plan
 title, lowercase and hyphen-separated.
 
+If the arguments say `direct` / `no branch` / `direct commit`, skip the
+issue and the branch: implement and commit on the current branch as it
+is. If it is a base branch, the checklist presentation already said so —
+no further confirmation is needed.
+
 ### Batch mode (default)
 
 Implement every task in one go. Work methodically, keeping changes
@@ -126,7 +138,7 @@ instruction from me overrides them):
 
 Extra context in the user's invocation (the message that triggered this
 skill) plays the role command arguments play elsewhere: `standalone`,
-`continue`, `no issue` / `without issue`, an explicit base such as
-`from origin/develop`, or `step by step` / `one commit per task` for the
-step-by-step execution mode. Modes combine freely, for example
-"standalone step by step".
+`continue`, `direct` (`no branch` / `direct commit`), `no issue` /
+`without issue`, an explicit base such as `from origin/develop`, or
+`step by step` / `one commit per task` for the step-by-step execution
+mode. Modes combine freely, for example "standalone step by step".

.agents/skills/local-ci/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: local-ci
+description: Run local CI-style checks with ./scripts/ci (lint, tests, format) per monorepo module. Use when verifying changes before declaring work done, running lint or tests locally, fixing formatting, or repairing Clojure delimiter errors.
+---
+
+# Local CI
+
+Run the same checks CI runs, locally, for the modules you touched, with
+`scripts/ci`. Each task writes a log file; the final summary says what
+passed and what failed.
+
+Full details: `mem:scripts/ci` (file: `.serena/memories/scripts/ci.md`)
+
+## When to use
+
+- After implementing or fixing code — verify every module you touched
+  before declaring the work done.
+- When the user asks to run CI, lint, tests, or format checks locally.
+- When you changed `common/` — validate its consumers too.
+
+**Skip:** while exploring, planning, or reading code.
+
+## Command reference
+
+Run from the repo root:
+
+```bash
+./scripts/ci [OPTIONS] [MODULES...]
+```
+
+Modules: `frontend` `backend` `common` `render-wasm` `exporter` `mcp`
+`plugins` `library`, or `--all` for every module.
+
+With no task flags it runs three tasks per module, in order: **lint**,
+**test**, **fmt** (format check; `--fix` formats files instead).
+
+| Flag | Effect |
+|------|--------|
+| `--all` | Run every module |
+| `--exclude MOD` | Skip one module (repeatable) |
+| `--lint` / `--no-lint` | Run only lint / drop lint |
+| `--test` / `--no-test` | Run only tests / drop tests |
+| `--fmt` / `--no-fmt` | Run only format check / drop it |
+| `--fix` | Format files instead of checking (other tasks unaffected) |
+| `--paren-repair` | Fix delimiter errors in Clojure/CLJS files |
+| `--fail-fast` | Stop at the first failure |
+| `--quiet` | Suppress failure output |
+| `--dry-run` | Show what would run, execute nothing |
+| `--clean` | Delete the `.ci-logs/` directory |
+
+## Reading failures
+
+Every task writes its full output to `.ci-logs/<module>-<task>.log`. On
+failure the script prints only the last 30 lines. To diagnose a failure,
+**read the log file** — never re-run the command piped through filters
+(repo rule: redirect to a file first, then read it). The exit code is 1
+when any task failed; the summary lists each failed `module:task` and its
+log path.
+
+## Typical workflows
+
+```bash
+# Verify a module you changed: lint + tests + format check
+./scripts/ci frontend
+
+# Fast pass while iterating: lint only
+./scripts/ci --lint frontend
+
+# Lint + format check, skip the long test suite
+./scripts/ci --no-test frontend
+
+# Format the module without running the test suite
+./scripts/ci --fix --no-test frontend
+
+# Broke delimiters in Clojure/CLJS files: repair first, then lint
+./scripts/ci --paren-repair frontend
+./scripts/ci --lint frontend
+
+# Changed common/ — validate its consumers too
+./scripts/ci frontend backend exporter
+
+# Preview what would run, without running it
+./scripts/ci --dry-run --all
+```
+
+## Gotchas
+
+- Run from the repo root.
+- Test tasks are long-running (backend runs `clojure -M:dev:test`); give
+  the bash call a generous timeout (10–20 minutes) instead of letting it
+  time out mid-run.
+- `mcp` has no lint task — it shows as skipped, not failed.
+- `--paren-repair` only fixes delimiters; run lint afterwards to catch
+  what remains. See `mem:scripts/paren-repair`.
+- What to run and how to read test results: `mem:testing`.

.agents/skills/planner/SKILL.md

@@ -1,13 +1,11 @@
 ---
 name: planner
-description: Read-only planning and architecture analysis for Penpot — produce a structured implementation plan with task breakdown, acceptance criteria, sizing, and checkpoints. Always output to the user with the plan's save path (saved or suggested) and the next steps.
+description: Read-only planning and architecture analysis — produce a structured implementation plan with task breakdown, acceptance criteria, sizing, and checkpoints. Always output to the user with the plan, suggested save path and the next steps.
 ---
 
 # Planner
 
-Read-only senior software architect role for Penpot. Produces structured
-implementation plans with task breakdowns that engineers or other agents can
-execute. Never writes or modifies code.
+Produce a plan that another engineer or agent can execute without guessing.
 
 ## When to Use
 
@@ -21,24 +19,7 @@ execute. Never writes or modifies code.
 - A task feels too large or vague to start.
 - Work needs to be parallelized across multiple agents or sessions.
 
-Do **not** use this skill to actually implement anything — it is read-only.
-
-**When NOT to use:** Single-file changes with obvious scope, or when the spec
-already contains well-defined tasks.
-
-## Role
-
-You help users understand the Penpot codebase, design solutions, and produce
-implementation plans that other agents or developers can execute. The plan
-tells them what to build and how to verify it, task by task.
-
-The implementer reads the project's agent docs (`AGENTS.md`, project memories
-such as `mem:critical-info`, `mem:testing`, and each module's core memory)
-before working. Reference those memories instead of re-explaining tooling,
-conventions, or test design — explain in the plan only what they do not cover.
-
-Do **not** suggest commit messages or commit names anywhere in your plans or
-responses — committing is the implementer's responsibility.
+Do not use for a small change with obvious scope or an existing executable plan.
 
 ## CRITICAL: Required Reading Before Planning
 
@@ -55,67 +36,36 @@ Before drafting any plan, work through the project's own guidance:
 
 Skipping this step is the #1 cause of incorrect or incomplete plans.
 
----
+## Constraints
 
-## The Planning Process
+- You are **analysis-only** — never create, edit, or delete source code. The
+  only file you may write is the plan itself, and only when the command or
+  user explicitly instructs you to save it.
+- You do **not** run builds, tests, linters, or any commands that modify state.
+- You do **not** create git commits or interact with version control.
+- You do **not** execute shell commands beyond read-only searches (`rg`, `ls`,
+  `find`, `cat`, `bat`).
+- Your output is a structured plan or analysis, ready for handoff to an
+  engineer agent or developer.
 
-### Phase 1: Architecture Analysis
+## Planning Process
 
-1. Read the spec, requirements, or feature request.
-2. Analyze the codebase architecture and identify affected modules.
-3. Read project conventions (starting with `critical-info` and module core
-   memories) before drafting.
-4. Map dependencies between components (see the dependency graph in
-   `critical-info`).
-5. Identify risks, edge cases, performance implications, and breaking changes.
+1. Define the problem, desired outcome, constraints, and exclusions.
+2. Trace the current behavior through the affected modules.
+3. Map dependencies and choose an implementation order that builds foundations
+   before their consumers.
+4. Identify open product or architecture decisions. Resolve implementation
+   details from existing conventions when they do not affect public behavior.
+5. Identify edge cases, security and data risks, performance bounds, breaking
+   changes, and external dependencies.
+6. Split the work into small, ordered tasks. Prefer complete testable slices
+   over unrelated layer-wide batches. Apply DRY and KISS to the proposed
+   implementation.
+7. Define exact acceptance criteria and verification for every task.
+8. Add a checkpoint after every two or three tasks in a longer plan.
+9. State which tasks can run in parallel and which must remain sequential.
 
-### Phase 2: Task Breakdown
-
-#### Identify the Dependency Graph
-
-Map what depends on what, following the monorepo's module dependency graph:
-
-```
-common (shared types, schemas — no deps)
-    │
-    ├── backend (depends common)
-    │       ├── RPC handlers
-    │       └── persistence / migrations
-    │
-    ├── frontend (depends common, render-wasm)
-    │       ├── UI components
-    │       └── state / API integration
-    │
-    ├── exporter (depends common)
-    │
-    └── render-wasm (consumed by frontend)
-```
-
-Implementation order follows the dependency graph bottom-up: build shared
-foundations first, then layer consumers on top.
-
-#### Slice Vertically
-
-Instead of building all of common, then all of backend, then all of frontend —
-build one complete feature path at a time:
-
-**Bad (horizontal slicing):**
-```
-Task 1: Build all common types
-Task 2: Build all backend handlers
-Task 3: Build all frontend components
-```
-
-**Good (vertical slicing):**
-```
-Task 1: common data types + schema             ← foundation
-Task 2: backend RPC handler + persistence
-Task 3: frontend UI component + API integration
-```
-
-Each vertical slice delivers working, testable functionality.
-
-#### Write Tasks
+## Task Format
 
 Each task follows this structure:
 
@@ -152,17 +102,16 @@ implementation. Omit when the task is mechanical.
 **Estimated scope:** [XS: 1 file | S: 1-2 files | M: 3-5 files | L: 5+ files]
 ```
 
-Replace "module-specific test command" with the actual commands for the module
-(e.g. `clojure -M:dev:test` for backend/common,
-`npx shadow-cljs compile test && npx karma start` for frontend, or the
-commands noted in the module's core memory).
+Use commands from `mem:testing` and affected module memories. Never substitute
+generic text such as "run the tests" when the project documents an exact
+command.
 
-When possible, design each task with TDD in mind: acceptance criteria double
-as a test list, and the natural first step of the task is writing those tests
-before the implementation. Some tasks resist this (config, migrations, pure
-wiring) — for those, keep the usual verification steps.
+When possible, design each task with TDD in mind: acceptance criteria double as a test
+list, and the natural first step of the task is writing those tests before the
+implementation. Some tasks resist this (config, migrations, pure wiring) — for those, keep
+the usual verification steps.
 
-#### Estimate Scope
+## Task Sizing
 
 | Size | Files | Scope | Example |
 |------|-------|-------|---------|
@@ -172,16 +121,11 @@ wiring) — for those, keep the usual verification steps.
 | **L** | 5-8 | Multi-component feature | Search with filtering and pagination |
 | **XL** | 8+ | **Too large — break it down further** | — |
 
-If a task is XL, it should be broken into smaller tasks. Agents perform best
-on S and M tasks.
+Split a task when it contains independent outcomes, spans unrelated systems, or cannot be
+completed and verified in one focused session (if a task is XL, it should be broken into
+smaller tasks; agents perform best on S and M tasks).
 
-**When to break a task down further:**
-- It would take more than one focused session
-- You cannot describe the acceptance criteria in 3 or fewer bullet points
-- It touches two or more independent subsystems
-- You find yourself writing "and" in the task title (a sign it is two tasks)
-
-#### Order and Checkpoints
+## Task order and checkpoints
 
 Arrange tasks so that:
 
@@ -197,153 +141,43 @@ Add explicit checkpoints with the relevant module commands:
 - [ ] Relevant tests pass (module-specific command).
 - [ ] The relevant build or compilation passes, if applicable.
 - [ ] The core flow works end-to-end.
-- [ ] Review with human before proceeding.
 ```
 
-## Requirements
-
-- Analyze the codebase architecture and identify affected modules.
-- Read project conventions before drafting (start with `critical-info` and
-  affected module core memories).
-- Break down complex features or bugs into atomic, actionable steps.
-- Propose solutions with clear rationale, trade-offs, and sequencing.
-- Identify risks, edge cases, performance implications, and breaking changes.
-- Apply DRY and KISS principles to the proposed implementation.
-- Define a testing strategy aligned with each affected module's tooling.
-- Every task must have acceptance criteria and verification steps.
-- Checkpoints must exist after every 2-3 tasks.
-
-## Constraints
-
-- You are **analysis-only** — never create, edit, or delete source code. The
-  only file you may write is the plan itself, and only when the command or
-  user explicitly instructs you to save it.
-- You do **not** run builds, tests, linters, or any commands that modify state.
-- You do **not** create git commits or interact with version control.
-- You do **not** execute shell commands beyond read-only searches (`rg`, `ls`,
-  `find`, `cat`, `bat`).
-- Your output is a structured plan or analysis, ready for handoff to an
-  engineer agent or developer.
-
 ## Output Format
 
 The plan is always delivered in the response so the user sees it regardless
-of which agent is running the skill. By default you never write the plan file;
-announce the path instead. Write the file only when the command or user
-explicitly instructs you to save it — and then only that file.
+of which agent is running the skill. File writes follow `Constraints` —
+by default announce the path instead of writing.
 
-Announce the suggested save path:
-
-```
-.agents/plans/YYYY-MM-DD-<plan-one-line-title>.md
-```
-
-Use today's date in the user's local timezone. The `<plan-one-line-title>`
-slug is lowercase, hyphen-separated, and a short summary of the task
-(e.g. `add-batch-get-profiles-for-file-comments`). If the user explicitly
-provides a target file path, announce that path instead of the default.
+Announce the save path `.agents/plans/YYYY-MM-DD-<slug>.md` (today's date,
+lowercase hyphen-separated slug, e.g. `2026-09-10-add-batch-get-profiles`;
+an explicit user path wins).
 
 End the response by suggesting the next steps: `/review-plan` to get a second
 opinion on the plan and `/implement-plan` to execute it.
 
-### Plan Document Template
+### Plan Structure
+
+Use this document shape:
 
 ```markdown
-# Plan: [Feature/Project Name]
+# Plan: Title
 
 ## Context
-[One paragraph: what is the problem or feature request? Why is it needed?]
-
 ## Affected Modules
-[Which modules of the monorepo are involved? Reference module paths and any
-`mem:` memories that were consulted.]
-
 ## Architecture Decisions
-- [Key decision 1 and rationale]
-- [Key decision 2 and rationale]
-
-## Risks & Considerations
-[Edge cases, performance implications, breaking changes, migration concerns,
-security implications.]
-
+## Risks and Considerations
 ## Approach
-[A short strategy summary: 3-5 sentences describing the overall approach and
-the shape of the dependency graph (what depends on what, what gets built
-first). High-level only — the task-by-task detail lives in the Task List.]
-
 ## Task List
-
-Each task uses the full task structure defined in
-[Write Tasks](#write-tasks) — description, rationale, acceptance criteria,
-verification, dependencies, files, estimated scope, and optional code sketch.
-Never reduce a task to a one-line checkbox; the plan must be self-contained
-and executable without other context.
-
-Tasks are a flat, ordered list — a plan is not a roadmap. Do not group tasks
-into phases, milestones, or sprints; ordering and dependencies are already
-captured per task. Insert a checkpoint after every 2-3 tasks.
-
-## Task 1: [Short descriptive title]
-
-**Description:** [What this task accomplishes.]
-
-**Rationale:** [Why this approach over the alternatives.]
-
-**Acceptance criteria:**
-- [ ] [Specific, testable condition]
-
-**Verification:**
-- [ ] Relevant tests pass (module-specific command).
-
-**Dependencies:** None
-
-**Files likely touched:**
-- `path/to/file`
-
-**Estimated scope:** [XS: 1 file | S: 1-2 files | M: 3-5 files | L: 5+ files]
-
-**Code sketch (optional):** [Short contract-level example, only if the shape
-is non-obvious.]
-
-## Task 2: [Short descriptive title]
-
-[Same structure as Task 1.]
-
-## Task 3: [Short descriptive title]
-
-[Same structure as Task 1.]
-
-### Checkpoint: After Tasks 1-3
-- [ ] Relevant tests pass (module-specific command).
-- [ ] The relevant build or compilation passes, if applicable.
-- [ ] The core flow works end-to-end.
-- [ ] Review with human before proceeding.
-
-## Task 4: [Short descriptive title]
-
-[Same structure as Task 1.]
-
-## Task 5: [Short descriptive title]
-
-[Same structure as Task 1.]
-
-## Verification & Testing
-[How to verify each task and the whole plan: the project's real test, lint,
-build, and run commands (extracted during Required Reading), coverage
-expectations, and manual checks. Consult each module's core memory for the
-exact commands.]
-
-## Parallelization Opportunities
-- **Safe to parallelize:** Independent feature slices across separate
-  modules, tests for already-implemented features, documentation
-- **Must be sequential:** Shared common schema changes, database migrations
-- **Needs coordination:** Features that share a contract (define the contract
-  first, then parallelize)
-
+## Verification and Testing
+## Parallelization
 ## Open Questions
-- [Question needing human input]
 ```
 
+Omit empty sections only when they do not apply. Every implementation task
+still requires acceptance criteria, verification, dependencies, likely files,
+and scope.
+
 When the plan is purely analytical (e.g. a code review or feasibility study
 with no implementation), skip the **Approach** and **Task List** sections and
 lead with **Findings** instead, keeping the rest of the structure.
@@ -357,15 +191,6 @@ lead with **Findings** instead, keeping the rest of the structure.
 | "Planning is overhead" | Planning is the task. Implementation without a plan is just typing. |
 | "I can hold it all in my head" | Context windows are finite. Written plans survive session boundaries and compaction. |
 
-## Red Flags
-
-- Delivering prose without a task breakdown
-- Tasks that say "implement the feature" without acceptance criteria
-- No verification steps in the plan
-- All tasks are XL-sized
-- No checkpoints between tasks
-- Dependency order isn't considered
-
 ## Verification Checklist
 
 Before delivering the plan, confirm:

.agents/skills/update-changelog/SKILL.md

@@ -357,6 +357,39 @@ Insert the new version section right after the `# CHANGELOG` header (before
 the previous version entry). Use the `edit` tool with enough context to make
 a unique match.
 
+### 8b. Propose and populate the `:rocket: Epics and highlights` subsection
+
+After inserting the version section, proactively create or populate the
+`### :rocket: Epics and highlights` subsection. This section surfaces the
+most impactful changes for self-hosted users checking for updates.
+
+**When to create:** If the version section does not already have a
+`### :rocket: Epics and highlights` subsection, create one. Place it before
+`### :sparkles:` (matching existing order in CHANGES.md).
+
+**How to identify highlights:** Review the `:sparkles:` entries for the
+version and select 2–5 of the most impactful/user-visible ones. Criteria:
+- New user-visible features (not internal refactors)
+- Significant capability additions
+- Items that create "FOMO" for self-hosted users on older versions
+
+**Use release notes as hints:** Check
+`frontend/src/app/main/ui/releases/v2_<MINOR>.cljs` for the corresponding
+version. The slide titles and feature descriptions there are curated
+marketing content indicating what the team considers highlight-worthy. Match
+those themes to changelog entries. Treat these files as optional hints — they
+may not exist for every version.
+
+**Format requirement:** Every `:rocket:` entry MUST follow the standard
+changelog format with issue/PR references:
+```
+- <description> [#<ISSUE>](https://github.com/penpot/penpot/issues/<ISSUE>) (PR: [#<PR>](https://github.com/penpot/penpot/pull/<PR>))
+```
+An entry without issue AND PR references is a highlight gap (warning, not an anomaly).
+
+**Preserve existing entries:** If the `:rocket:` section already exists from
+a prior run, preserve its entries. Do not remove or rewrite them.
+
 ### 9. Verify
 
 Read the top of `CHANGES.md` and confirm:
@@ -468,9 +501,8 @@ Markdown viewer.
 ## What is an anomaly
 
 **An anomaly is a milestone-mismatch between an issue and its referenced
-PR.** It indicates that the changelog claim "this issue is fixed by this PR,
-all in milestone M" is inconsistent with the actual milestone assignments.
-There are exactly two types:
+PR.** There are two anomaly types, plus two highlight gaps (warnings that
+do not count toward the anomaly total):
 
 1. **Issue is in the milestone, but its referenced PR is in a different
    milestone (or has no milestone).** The changelog claims a fix in this
@@ -486,6 +518,13 @@ There are exactly two types:
    PR that closes an issue with no milestone references an issue from
    another (probably private) project; that is expected and the issue is
    not part of this changelog. Do not report it.
+3. **missing-highlights (gap):** A released X.Y.0 version section has no
+   `### :rocket: Epics and highlights` subsection. Patches (X.Y.Z) never
+   carry highlights, so only minors/majors are checked.
+4. **missing-highlight-reference (gap):** A `:rocket:` entry lacks the
+   required issue AND PR references. Every highlight entry must follow the
+   standard changelog format with `[#ISSUE]` and `(PR: [#PR])` links
+   (multi-PR `(PR: [#A](...), [#B](...))` accepted).
 
 **Anything else is not an anomaly.** Other discrepancies (exclusion
 labels on in-changelog issues, missing valid issues, unmerged PR
@@ -653,6 +692,40 @@ for pr_num in sorted(changelog_prs):
                 'issue_milestone': issue_ms,  # may be None
             })
 
+# --- Type C: released X.Y.0 version sections without :rocket: subsection ---
+# Patches (X.Y.Z with Z != 0) never carry :rocket: by design — only minors/majors (X.Y.0).
+anomalies_c = []  # list of version strings
+rocket_heading_re = re.compile(r'^### :rocket:', re.MULTILINE)
+version_sections = re.split(r'(?=^## \d+\.\d+\.\d+)', content, flags=re.MULTILINE)
+for vs in version_sections:
+    m = re.match(r'^## (\d+\.\d+\.\d+)(.*)', vs)
+    if not m: continue
+    ver, suffix = m.group(1), m.group(2)
+    if 'unreleased' in suffix.lower(): continue
+    if ver.split('.')[2] != '0': continue
+    if not rocket_heading_re.search(vs):
+        anomalies_c.append(ver)
+
+# --- Type D: :rocket: entries without issue AND PR references ---
+# Both are required: `[#ISSUE](.../issues/N)` and `(PR: [#PR](.../pull/M))`.
+# Multi-PR entries `(PR: [#A](...), [#B](...))` are accepted.
+anomalies_d = []  # list of dicts: {version, line}
+issue_ref_re = re.compile(r'\[#\d+\]\(https://github\.com/penpot/penpot/issues/\d+\)')
+pr_ref_re = re.compile(r'\(PR:\s*\[#\d+\]\(https://github\.com/penpot/penpot/pull/\d+\)(\s*,\s*\[#\d+\]\(https://github\.com/penpot/penpot/pull/\d+\))*\)')
+for vs in version_sections:
+    m = re.match(r'^## (\d+\.\d+\.\d+)(.*)', vs)
+    if not m: continue
+    ver = m.group(1)
+    rocket_match = rocket_heading_re.search(vs)
+    if not rocket_match: continue
+    # Extract the :rocket: subsection body (up to next ### or ##)
+    rocket_body = vs[rocket_match.end():]
+    rocket_body = re.split(r'(?m)^#{2,3}\s', rocket_body)[0]
+    for line in rocket_body.splitlines():
+        line = line.strip()
+        if line.startswith('- ') and not (issue_ref_re.search(line) and pr_ref_re.search(line)):
+            anomalies_d.append({'version': ver, 'line': line[:100]})
+
 # --- Write report ---
 def fmt_ms(ms):
     return ms if ms else "_none_"
@@ -664,13 +737,17 @@ with open(OUTPUT, 'w') as f:
 
     n_a = len(anomalies_a)
     n_b = len(anomalies_b)
+    n_c = len(anomalies_c)
+    n_d = len(anomalies_d)
 
     f.write('## Summary\n\n')
     f.write(f'- **Issue in {MILESTONE}, referenced PR in different milestone or no milestone:** {n_a}\n')
     f.write(f'- **PR in {MILESTONE}, closing issue in a different milestone:** {n_b}\n')
-    f.write(f'- **Total anomalies:** {n_a + n_b}\n\n')
+    f.write(f'- **Total anomalies:** {n_a + n_b}\n')
+    f.write(f'- **Released X.Y.0 version missing :rocket: section (gap):** {n_c}\n')
+    f.write(f'- **:rocket: entry without issue AND PR references (gap):** {n_d}\n\n')
 
-    # --- Anomalies section ---
+    # --- Anomalies section (milestone mismatches only) ---
     if n_a or n_b:
         f.write('## Anomalies\n\n')
         f.write('These are milestone mismatches between an issue in the changelog '
@@ -709,9 +786,37 @@ with open(OUTPUT, 'w') as f:
                     badge = '🔴' if e['issue_milestone'] is None else '⚠️'
                     f.write(f'  - {badge} Closing {issue_link(e["issue"])} is in milestone **{ms_label}** (expected: {MILESTONE})\n')
                 f.write('\n')
+
     else:
         f.write('✅ No anomalies found. All (issue, PR) pairs in the changelog have aligned milestone assignments.\n\n')
 
+    # --- Highlight gaps (warnings, not anomalies) ---
+    if n_c or n_d:
+        f.write('## Highlight gaps\n\n')
+        f.write('These are warnings, not anomalies: they do not affect the '
+                'milestone-mismatch total above. They track `:rocket:` coverage '
+                'across all released X.Y.0 versions. Historical entries (e.g. '
+                'Taiga links) predate the current reference convention and are '
+                'expected to appear here.\n\n')
+
+        if n_c:
+            f.write(f'### Released X.Y.0 version missing :rocket: section\n\n')
+            f.write('These released minors/majors have no `### :rocket: Epics and highlights` subsection. '
+                    'Add highlights to help self-hosted users understand what they are missing.\n\n')
+            for ver in anomalies_c:
+                f.write(f'- Version **{ver}**\n')
+            f.write('\n')
+
+        if n_d:
+            f.write(f'### :rocket: entry without issue AND PR references\n\n')
+            f.write('These highlight entries lack the required issue AND PR references. '
+                    'Add `[#ISSUE](...)` and `(PR: [#PR](...))` links.\n\n')
+            for d in anomalies_d:
+                f.write(f'- **{d["version"]}**: `{d["line"]}`\n')
+            f.write('\n')
+    elif not (n_a or n_b):
+        f.write('✅ No highlight gaps found. All released X.Y.0 versions have properly referenced :rocket: entries.\n\n')
+
     # --- Context ---
     f.write('---\n\n')
     f.write('## Context\n\n')
@@ -726,8 +831,7 @@ print(f"Anomaly report written to {OUTPUT}")
 PYEOF
 ```
 
-This generates `CHANGES-ISSUES.md` containing **only the anomalies** —
-milestone mismatches between issues and their referenced PRs:
+This generates `CHANGES-ISSUES.md` containing anomalies and highlight gaps:
 
 1. **Issue in milestone, referenced PR in different milestone or no milestone** —
    the changelog claims a fix here, but the PR is released elsewhere.
@@ -736,6 +840,13 @@ milestone mismatches between issues and their referenced PRs:
    (An issue with *no* milestone belongs to another, probably private,
    project — milestones are only required on the "Main" project — so it is
    neither an anomaly nor a changelog candidate.)
+3. **missing-highlights (gap, warning)** — a released X.Y.0 version section
+   has no `### :rocket: Epics and highlights` subsection. Patches (X.Y.Z)
+   never carry highlights.
+4. **missing-highlight-reference (gap, warning)** — a `:rocket:` entry lacks
+   the required issue AND PR references.
+
+Gaps do not count toward the anomaly total.
 
 **Rule violations are not in the report** — they are workflow errors the
 LLM must fix directly in `CHANGES.md` during step 6a (pre-flight checks).
@@ -809,10 +920,13 @@ self-contained and clickable in any Markdown viewer.
   issue from a different project or context. If the PR title and issue title
   are clearly unrelated, or the PR predates the issue by years, treat it as a
   data glitch and skip it.
-- **Anomaly = milestone mismatch only.** The report contains only milestone
-  mismatches: (1) the issue is in this milestone but the referenced PR is
-  in a different milestone (or unassigned), and (2) the PR is in this
-  milestone but the issue it closes is in a different milestone. An
+- **Anomaly = milestone mismatch only; gaps are warnings.** The report's
+  anomaly total counts only milestone mismatches: (1) the issue is in this
+  milestone but the referenced PR is in a different milestone (or unassigned),
+  and (2) the PR is in this milestone but the issue it closes is in a
+  different milestone. `:rocket:` highlight gaps (missing section on a
+  released X.Y.0, entry without issue AND PR references) are reported in a
+  separate `Highlight gaps` section and never count toward the anomaly total. An
   *unassigned* (milestone-less) issue closed by a milestone PR is **not**
   an anomaly: milestones are required only for the "Main" project, so such
   issues come from another (probably private) project and are not changelog

.github/workflows/build-docker-devenv.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   build-and-push:
     name: Build and push DevEnv Docker image
-    runs-on: penpot-extended-runner
+    runs-on: penpot-standar-runner
 
     steps:
       - name: Set common environment variables

.github/workflows/build-docker.yml

@@ -46,7 +46,7 @@ jobs:
   # ── 1. Resolve the build key and check the whole set at once ───────────
   prepare:
     name: Prepare
-    runs-on: penpot-extended-runner
+    runs-on: penpot-standar-runner
     timeout-minutes: 15
     outputs:
       gh_ref: ${{ steps.vars.outputs.gh_ref }}
@@ -135,7 +135,7 @@ jobs:
   # ── 2. One build per image, in parallel, only when needed ──────────────
   build:
     name: Build ${{ matrix.image }}
-    runs-on: penpot-extended-runner
+    runs-on: penpot-standar-runner
     timeout-minutes: 60
     needs: prepare
     if: needs.prepare.outputs.exists == 'false'
@@ -248,7 +248,7 @@ jobs:
   # the S3 marker guarantees the branch tags were already moved.
   promote:
     name: Promote image set
-    runs-on: penpot-extended-runner
+    runs-on: penpot-standar-runner
     timeout-minutes: 10
     needs: [prepare, build]
 
@@ -302,7 +302,7 @@ jobs:
   # ── 4. Single failure notification for the whole workflow ─────────────
   notify:
     name: Notify failure
-    runs-on: penpot-extended-runner
+    runs-on: penpot-standar-runner
     timeout-minutes: 5
     needs: [prepare, build, promote]
     if: failure()

.github/workflows/build-tag.yml

@@ -46,7 +46,7 @@ jobs:
 
   notify:
     name: Notifications
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs:
       - build-docker
       - build-docker-admin-console

.github/workflows/release.yml

@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   release:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.vars.outputs.gh_ref }}
       release_notes: ${{ steps.extract_release_notes.outputs.release_notes }}

.github/workflows/tests-exporter.yml

@@ -32,7 +32,7 @@ jobs:
   test-exporter:
     if: ${{ !github.event.pull_request.draft }}
     name: "Exporter Tests"
-    runs-on: penpot-runner-02
+    runs-on: penpot-extended-runner
     container:
       image: penpotapp/devenv:latest
       volumes:

.gitignore

@@ -24,7 +24,6 @@ opencode.json
 !AGENTS.md
 !CODE_OF_CONDUCT.md
 !SECURITY.md
-!HIGHLIGHTS.md
 /*.png
 /*.svg
 /*.sql

.opencode/commands/implement-plan.md

@@ -1,5 +1,5 @@
 ---
-description: Execute a ready plan — task checklist, your confirmation, then all tasks with one commit (default) or step by step with a commit and a pause per task; creates issue + branch when on a base branch — loads and follows the implement-plan skill
+description: Execute a ready plan — task checklist, your confirmation, then all tasks with one commit (default) or step by step with a commit and a pause per task; creates issue + branch when on a base branch, or commits on the current branch with "direct" — loads and follows the implement-plan skill
 agent: build
 ---
 

.serena/memories/critical-info.md

@@ -11,9 +11,12 @@ You are working on the GitHub project `penpot/penpot`, a monorepo.
 # Development workflow
 
 - Commit/PR/issue creation is **on explicit request only**. Before any of these actions, read the relevant memory — don't infer format from prior examples:
-  - Before `git commit` → `mem:workflow/creating-commits` (subject format, body, `AI-assisted-by: model-name` trailer)
+  - Before `git commit` → `mem:workflow/creating-commits` (subject/body format, 76-char body wrapping enforced by `scripts/check-commit`, `AI-assisted-by: model-name` trailer)
   - Before `gh issue create` → `mem:workflow/creating-issues` (title derivation, body template, labels, Issue Type)
   - Before `gh pr create` / `gh pr edit` → `mem:workflow/creating-prs` (title format, body structure, "Note:" line)
+- Before a repo-wide pnpm version update → `mem:workflow/updating-pnpm` (workspace
+  layout, `corepack use` sweep order, the stamp-missing-field and
+  ignored-builds gotchas, verification steps)
 - **Never `git push`, force-push, or modify `git origin`** (or any other remote). The user pushes from their own shell; if a push is required, say so and wait. Never amend a commit that the user has already pushed unless explicitly asked.
 - **Never edit `CHANGES.md` by hand.** The changelog is generated from GitHub milestones during the release process; update it only via the `update-changelog` skill flow or on explicit user request.
 - You have access to the GitHub CLI `gh` or corresponding MCP tools.
@@ -71,6 +74,14 @@ module. You can read it from `mem:<MODULE>/core`
 - `scripts/error-reports.mjs` — Query error reports via RPC API with token
   authentication. Supports list/get operations with filtering and pagination.
   See `mem:scripts/error-reports`.
+- `scripts/clean-node-modules` — Remove stale `node_modules` from all pnpm
+  workspaces (root, modules, member packages). Keeps the shared pnpm store
+  at `<repo>/.pnpm-store` unless `--store`; ignores `external/` and
+  `.opencode/`. Usage and reinstall steps: `mem:workflow/updating-pnpm`.
+- `scripts/ci` — CI orchestration script: runs lint, tests, and format
+  checks per module (`frontend backend common render-wasm exporter mcp
+  plugins library`). Logs go to `.ci-logs/`; read the log file on failure.
+  See `mem:scripts/ci`.
 
 # Dependency graph
 

.serena/memories/scripts/ci.md

@@ -0,0 +1,61 @@
+# CI (scripts/ci)
+
+`scripts/ci` runs CI-style checks — lint, tests, format — for one or more
+monorepo modules and prints a per-task summary. It is the local equivalent
+of CI; use it to verify changes before declaring work done.
+
+## When to use
+
+- After implementing or fixing code in a module: run its checks before
+  finishing (AGENTS.md: run the applicable lint and format checks).
+- When `common/` changed: validate its consumers too (frontend, backend,
+  exporter; see the dependency graph in `mem:critical-info`).
+- To fix formatting across a module (`--fix`) or repair delimiters
+  (`--paren-repair`) before linting.
+
+## How to use (CLI)
+
+Run from the repo root:
+
+```bash
+./scripts/ci MODULE...                  # lint + test + fmt per module
+./scripts/ci --all --no-test            # lint + fmt on all modules
+./scripts/ci --lint frontend            # lint only
+./scripts/ci --fix --no-test frontend   # format files, skip tests
+./scripts/ci --paren-repair --all       # fix delimiters in all Clojure modules
+./scripts/ci --dry-run --all            # preview what would run
+```
+
+Modules: `frontend backend common render-wasm exporter mcp plugins library`.
+
+Flags:
+
+- Default tasks: `lint`, `test`, `fmt` (format check; `--fix` formats
+  instead).
+- `--lint` / `--test` / `--fmt` run one task only; `--no-lint` /
+  `--no-test` / `--no-fmt` drop one task from the default set.
+- `--paren-repair` runs only the delimiter repair — it wraps
+  `scripts/paren-repair` over each module's Clojure/CLJS sources; see
+  `mem:scripts/paren-repair`.
+- `--all` selects every module; `--exclude MOD` drops one (repeatable).
+- `--fail-fast` stops at the first failure; `--quiet` suppresses failure
+  output; `--dry-run` prints commands without running; `--clean` removes
+  the log directory.
+
+## Logs and exit codes
+
+- Full output of every task: `.ci-logs/<module>-<task>.log`.
+- On failure the script prints the last 30 lines; the final summary lists
+  every failed `module:task` with its log path.
+- Exit code 0 when all selected tasks passed, 1 otherwise.
+- Diagnose failures by reading the log file — never pipe test output
+  through filters (AGENTS.md hard rule).
+
+## Notes
+
+- `mcp` has no lint task (shows as skipped). `render-wasm` uses `./lint`,
+  `./test`, and `cargo fmt`.
+- Test tasks are long-running (backend: `clojure -M:dev:test`); use a
+  generous timeout when calling it from an agent shell.
+- Skill entry point: `.agents/skills/local-ci/SKILL.md`.
+- Testing principles and output discipline: `mem:testing`.

.serena/memories/workflow/creating-commits.md

@@ -14,12 +14,32 @@ automatically pull the identity from the local git config `user.name` and `user.
 :emoji: Subject line (imperative, capitalized, no period, <=70 chars)
 
 Body explaining what changed and why.
-Wrap lines at 72 characters — git log and tooling
-render long lines poorly. Keep each line concise.
+Wrap lines at 76 characters — git log adds a
+four-space indent, so 76 + 4 fits an 80-column
+terminal. Keep each line concise.
 
 AI-assisted-by: model-name
 ```
 
+## HARD RULES (inexcusable)
+
+These rules are not advisory. Do not commit until every one holds. A commit
+that breaks them is wrong, even if the code is right.
+
+- **Body lines MUST wrap at 76 characters or fewer.** Measure every line; do
+  not eyeball it. This is the rule most often skipped. Rationale: `git log`
+  indents the body four spaces, so 76 + 4 fits an 80-column terminal.
+- **Subject MUST be ≤70 chars**, imperative, capitalized, no trailing period.
+- **MUST be a blank line** between subject and body.
+- **MUST run `scripts/check-commit` and get exit code 0 before finishing.**
+  It mechanically validates the rules above; a failing run is a blocker.
+  - It checks `HEAD` by default: `./scripts/check-commit`
+  - For another commit: `./scripts/check-commit -c <ref>`
+- **NEVER** hand-wave the body as "one long line". If a line exceeds 76,
+  break it at a space.
+- Exceptions inside the body (do not wrap these): `Signed-off-by:`,
+  `Co-authored-by:`, `AI-assisted-by:` trailers, and lines carrying a URL.
+
 **AI-assisted-by trailer rules:**
 - Use only the model name, e.g. `mimo-v2.5`, `deepseek-v4-flash`
 - Do NOT add prefixes like `opencode-go/` — use the bare model name

.serena/memories/workflow/updating-pnpm.md

@@ -0,0 +1,91 @@
+# Updating pnpm Across All Workspaces
+
+Canonical procedure. Run it from the repo root with the log redirected to a
+file (never pipe tool output through filters).
+
+## Layout facts
+
+- The repo has 11 pnpm workspaces, each with its own `pnpm-workspace.yaml`
+  and `pnpm-lock.yaml`: the repo root plus `backend`, `common`, `docs`,
+  `exporter`, `frontend`, `library`, `mcp`, `media-processor`, `plugins`,
+  and `render-wasm`.
+- Every package inside a module workspace (for example all `plugins/apps/*`
+  and `plugins/libs/*` packages) is a plain member of that module's
+  workspace. Members must not carry their own `pnpm-workspace.yaml` or
+  `pnpm-lock.yaml`; their dependencies resolve through the parent
+  workspace's lockfile.
+- One shared pnpm store for the whole repo: `<repo>/.pnpm-store`. Every
+  workspace yaml sets it explicitly: `storeDir: .pnpm-store` at the root,
+  `storeDir: ../.pnpm-store` in each module. pnpm resolves the value
+  against the workspace root, so all workspaces land on the same store.
+  Do not remove these lines: nested workspaces do not inherit settings,
+  and without them each workspace may resolve a different store.
+- The store survives `node_modules` cleans. It is content-addressed and
+  integrity-verified, so it cannot go stale; staleness lives in
+  node_modules. Only `scripts/clean-node-modules --store` removes it.
+- Every `package.json` (about 35 of them) must carry a `packageManager` field
+  with the identical `pnpm@<version>+sha512.<hash>` value. Do not let them drift.
+- CI pins no pnpm version; workflows rely on corepack reading
+  `packageManager`. Fixing the fields fixes CI.
+
+## Procedure
+
+1. Resolve the target tag first and note the version. Example:
+   `npm view pnpm dist-tags --json` for `next-12` (latest 12.x). The tag
+   moves over time; always re-check.
+2. List every directory with a `package.json`, excluding `node_modules`
+   (`fd -H -t f package.json -E node_modules`). This list is the work set;
+   do not maintain a hand-written list.
+3. Run `corepack use pnpm@<tag>` in workspace roots first, then members.
+   `corepack use` stamps `packageManager` in the nearest package.json and
+   runs an install. Member runs repeat the workspace install; after the root
+   run they are quick no-ops.
+4. If a run fails, fix the cause (see gotchas) and re-run that directory.
+
+## Gotchas
+
+- `corepack use` only updates an existing `packageManager` field. If a
+  package.json lacks the field, corepack walks up to the nearest ancestor
+  that has one and stamps that file instead; the member stays unstamped.
+  After the sweep, assert every package.json carries the field. For a
+  missing one, insert the identical `pnpm@<version>+sha512.<hash>` string,
+  then re-run `corepack use pnpm@<tag>` in that directory.
+- A workspace may fail with `ERR_PNPM_IGNORED_BUILDS`, and pnpm then writes
+  a placeholder scaffold into its `pnpm-workspace.yaml`:
+  `allowBuilds: esbuild: set this to true or false`. Current pnpm writes
+  only the `allowBuilds` placeholder; any legacy key still present
+  (`ignoredBuiltDependencies`, `onlyBuiltDependencies`,
+  `neverBuiltDependencies`) is ignored since pnpm 11. Repo convention is
+  `allowBuilds: esbuild: true`. Replace the placeholder and drop the
+  legacy entry, then re-run.
+- `plugins/apps/composable-test-suite` once had its own
+  `pnpm-workspace.yaml` and acted as a nested workspace root. That state is
+  gone on purpose: pnpm picks the nearest `pnpm-workspace.yaml` walking up,
+  so a nested one silently forks install and lockfile behavior. Do not
+  reintroduce it.
+- Expect metadata-only lockfile diffs when only the pnpm version moves:
+  the pnpm self-reference entries, plus a new `packageManagerDependencies`
+  section in lockfiles last written by older pnpm. Large diffs mean
+  re-resolution; inspect them before accepting.
+
+## Verification
+
+- Every `packageManager` field is byte-identical (same version and hash).
+- `pnpm --version` in each workspace prints the target version.
+- `pnpm install --frozen-lockfile` succeeds in each of the 11 workspaces.
+- `git diff` on lockfiles matches the expectations above.
+
+## Cleaning stale node_modules
+
+- `scripts/clean-node-modules` removes every workspace `node_modules`: the
+  repo root, all module workspaces, and all member packages. Use it when
+  installs misbehave after dependency changes: clean, reinstall, done.
+- Flags: `-n/--dry-run` lists without deleting; `--store` also removes the
+  shared pnpm store at `<repo>/.pnpm-store` (the next install re-downloads
+  what it held). `external/` (vendored dependency trees with their own
+  lifecycles) and `.opencode/` are always ignored.
+- The script never touches the pnpm store by default, so the reinstall
+  after cleaning reuses cached packages (zero downloads).
+- After cleaning, run `pnpm install` in each workspace root to restore the
+  development environment; `frontend` postinstall also reinstalls and
+  builds `plugins-runtime`.

AGENTS.md

@@ -14,6 +14,12 @@
 - **Never pipe test output directly to filters** (`| head`, `| tail`, `| grep`, etc.).
   Always redirect to a file first: `command > /tmp/output.txt 2>&1`, then read/grep the file.
   This prevents hiding test failures. See `mem:testing` for details.
+- **`.claude/skills` is a symlink to `.agents/skills`.**
+  Edit skills only in their canonical location (`.agents/skills`); never edit
+  through `.claude/skills`.
+- **Commit message body lines MUST wrap at ≤76 chars** (subject ≤70 chars) and
+  the commit MUST pass `./scripts/check-commit` with exit code 0 before you
+  consider it done. This is mechanically checked — do not eyeball it.
 - **Read the workflow memory BEFORE the corresponding action**:
   - Before `git commit` → `mem:workflow/creating-commits` (commit format, AI-assisted-by trailer)
   - Before `gh issue create` → `mem:workflow/creating-issues` (title derivation, body template, Issue Type)
@@ -145,6 +151,6 @@ precision while maintaining a strong focus on maintainability and performance.
 - `scripts/nrepl-eval.mjs` — Evaluate Clojure code via nREPL (backend + frontend).
 - `scripts/check-commit` — Validate commit messages against Penpot's commit guidelines.
 - `scripts/check-fmt-clj` — Check Clojure formatting without modifying files.
-- `scripts/ci` — CI orchestration script for running lint, tests, and format checks across modules. See `scripts/ci --help`.
+- `scripts/ci` — CI orchestration script for running lint, tests, and format checks across modules. See `mem:scripts/ci`.
 - `scripts/gh.py` — Multi-purpose GitHub CLI helper. Subcommands: `issues` (list issues in a milestone), `prs` (fetch PR details), `advisories` (list/inspect security advisories). See `python3 scripts/gh.py --help`.
 

CHANGES.md

@@ -2,6 +2,12 @@
 
 ## 2.19.0 (Unreleased)
 
+### :rocket: Epics and highlights
+
+- Add configurable keyboard shortcuts [#9924](https://github.com/penpot/penpot/issues/9924) (PR: [#10237](https://github.com/penpot/penpot/pull/10237))
+- Improve path operations and edition in the path editor [#10889](https://github.com/penpot/penpot/issues/10889) (PR: [#10807](https://github.com/penpot/penpot/pull/10807))
+- Add auto-linking of libraries during import based on slugified name [#9263](https://github.com/penpot/penpot/issues/9263) (PR: [#9958](https://github.com/penpot/penpot/pull/9958))
+
 ### :bug: Bugs fixed
 
 - Fix copying text from Penpot to the clipboard not working on MS Windows [#11303](https://github.com/penpot/penpot/issues/11303) (PR: [#11305](https://github.com/penpot/penpot/pull/11305))
@@ -11,6 +17,20 @@
 - Fix overlay shifting left when shown with top-center alignment in viewer prototype (by @filipsajdak) [#9048](https://github.com/penpot/penpot/issues/9048) (PR: [#10454](https://github.com/penpot/penpot/pull/10454))
 - Fix internal error when clicking the Copy button on the Access Token page (by @0xTHAC0) [#8496](https://github.com/penpot/penpot/issues/8496) (PR: [#11156](https://github.com/penpot/penpot/pull/11156))
 - Fix `disable-registration` flag not preventing non-users from creating accounts in the share prototypes page (by @0xTHAC0) [#5164](https://github.com/penpot/penpot/issues/5164) (PR: [#11199](https://github.com/penpot/penpot/pull/11199))
+- Fix "Cannot assign to read only property 'toString'" error during text resize (by @makesomethingshit) [#10168](https://github.com/penpot/penpot/issues/10168) (PR: [#11521](https://github.com/penpot/penpot/pull/11521))
+- Fix plugin postMessage channel broadcasting messages to all plugins without origin validation [#10968](https://github.com/penpot/penpot/issues/10968) (PR: [#10970](https://github.com/penpot/penpot/pull/10970))
+- Fix MCP plugin page navigation while connected crashing the workspace (by @makesomethingshit) [#11001](https://github.com/penpot/penpot/issues/11001) (PR: [#11521](https://github.com/penpot/penpot/pull/11521))
+- Fix shortcut search never matching on key combination, only on action label [#11003](https://github.com/penpot/penpot/issues/11003) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
+- Fix Shift + special character key shortcut capturing the shifted character instead of the physical key [#11004](https://github.com/penpot/penpot/issues/11004) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
+- Fix reassigning the "Paste" shortcut not updating the UI or taking effect in the workspace [#11005](https://github.com/penpot/penpot/issues/11005) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
+- Fix font-size dropdown clipping multi-digit values in Firefox (by @0xTHAC0) [#11008](https://github.com/penpot/penpot/issues/11008) (PR: [#11162](https://github.com/penpot/penpot/pull/11162), [#11500](https://github.com/penpot/penpot/pull/11500))
+- Fix exporting shortcuts producing an invalid "toggle-fullscreen" entry that breaks re-import [#11032](https://github.com/penpot/penpot/issues/11032) (PR: [#11081](https://github.com/penpot/penpot/pull/11081))
+- Fix plugin API missing permission checks in tokens, shapes, variants, flows, layouts, and user identity [#11137](https://github.com/penpot/penpot/issues/11137) (PR: [#11139](https://github.com/penpot/penpot/pull/11139))
+- Fix library summary Redis cache keys omitting the tenant [#11407](https://github.com/penpot/penpot/issues/11407) (PR: [#11408](https://github.com/penpot/penpot/pull/11408))
+- Fix active theme name in the inspect tab displaying an id instead of the name [#11437](https://github.com/penpot/penpot/issues/11437) (PR: [#11439](https://github.com/penpot/penpot/pull/11439))
+- Fix triple-click not selecting the full line in text editor v3 [#11483](https://github.com/penpot/penpot/issues/11483) (PR: [#11493](https://github.com/penpot/penpot/pull/11493))
+- Fix pasted text losing formatting on last lines after resizing and adding new lines from the top [#11501](https://github.com/penpot/penpot/issues/11501) (PR: [#11503](https://github.com/penpot/penpot/pull/11503))
+- Fix variant property dropdown appearing empty and throwing an internal error when the component has no sibling variants [#11524](https://github.com/penpot/penpot/issues/11524) (PR: [#11499](https://github.com/penpot/penpot/pull/11499))
 
 ### :sparkles: New features & Enhancements
 
@@ -19,9 +39,22 @@
 - Improve path operations and edition in the path editor [#10889](https://github.com/penpot/penpot/issues/10889) (PR: [#10807](https://github.com/penpot/penpot/pull/10807))
 - Add configurable keyboard shortcuts [#9924](https://github.com/penpot/penpot/issues/9924) (PR: [#10237](https://github.com/penpot/penpot/pull/10237))
 - Add auto-linking of libraries during import based on slugified name [#9263](https://github.com/penpot/penpot/issues/9263) (PR: [#9958](https://github.com/penpot/penpot/pull/9958))
+- Add support for internal libraries and file sync for Design Tokens [#9334](https://github.com/penpot/penpot/issues/9334)
+- Warn self-hosted users when their Penpot version is outdated and surface what they're missing [#10497](https://github.com/penpot/penpot/issues/10497) (PR: [#11411](https://github.com/penpot/penpot/pull/11411))
+- Add dedicated RPC methods for plugin registry operations with permission validation [#10952](https://github.com/penpot/penpot/issues/10952) (PR: [#10957](https://github.com/penpot/penpot/pull/10957))
+- Document MCP and internal resolver environment variables (by @ShreyashAgare26) [#11318](https://github.com/penpot/penpot/issues/11318) (PR: [#11572](https://github.com/penpot/penpot/pull/11572))
+- Add tokens source indicator to assets tab [#11365](https://github.com/penpot/penpot/issues/11365) (PR: [#11439](https://github.com/penpot/penpot/pull/11439))
+- Export multiple fills to SVG [#11466](https://github.com/penpot/penpot/issues/11466) (PR: [#11467](https://github.com/penpot/penpot/pull/11467))
+- Add Penpot-specific board size presets (file thumbnail, template cover, plugin icon/cover) [#11561](https://github.com/penpot/penpot/issues/11561) (PR: [#11565](https://github.com/penpot/penpot/pull/11565))
 
 ## 2.18.0 (Unreleased)
 
+### :rocket: Epics and highlights
+
+- Group toolbar drawing tools into shape and free-draw flyouts [#9316](https://github.com/penpot/penpot/issues/9316) (PR: [#9480](https://github.com/penpot/penpot/pull/9480), [#10354](https://github.com/penpot/penpot/pull/10354))
+- Add dedicated Line and Arrow drawing tools (by @davidv399) [#9145](https://github.com/penpot/penpot/issues/9145) (PR: [#9146](https://github.com/penpot/penpot/pull/9146))
+- Show and manage comments while designing in the workspace [#10239](https://github.com/penpot/penpot/issues/10239) (PR: [#10275](https://github.com/penpot/penpot/pull/10275))
+
 ### :bug: Bugs fixed
 
 - Fix MCP integration hanging when the Penpot tab is backgrounded or frozen by the browser [#10323](https://github.com/penpot/penpot/issues/10323) (PR: [#10392](https://github.com/penpot/penpot/pull/10392))
@@ -123,6 +156,21 @@
 - Fix incorrect permission handling when managing share links on a file [#11289](https://github.com/penpot/penpot/issues/11289) (PR: [#11290](https://github.com/penpot/penpot/pull/11290))
 - Fix backend session remaining valid after logout when the auth-token cookie is replayed [#11316](https://github.com/penpot/penpot/issues/11316) (PR: [#11317](https://github.com/penpot/penpot/pull/11317))
 - Fix get-team-invitation-token requiring only read permissions [#11358](https://github.com/penpot/penpot/issues/11358) (PR: [#11359](https://github.com/penpot/penpot/pull/11359))
+- Fix missing text in legacy SVG board thumbnails [#10182](https://github.com/penpot/penpot/issues/10182) (PR: [#11552](https://github.com/penpot/penpot/pull/11552))
+- Fix workspace crash when applying transform modifiers in the WASM renderer [#10894](https://github.com/penpot/penpot/issues/10894) (PR: [#10896](https://github.com/penpot/penpot/pull/10896))
+- Limit ZIP entry count and object size on V3 binfile import [#11021](https://github.com/penpot/penpot/issues/11021) (PR: [#11022](https://github.com/penpot/penpot/pull/11022))
+- Block plugin UI iframe URLs targeting the Penpot domain [#11271](https://github.com/penpot/penpot/issues/11271) (PR: [#11273](https://github.com/penpot/penpot/pull/11273))
+- Restrict the MCP REPL code execution endpoint to development environments [#11283](https://github.com/penpot/penpot/issues/11283) (PR: [#11282](https://github.com/penpot/penpot/pull/11282))
+- Filter share-link tokens from the get-view-only-bundle response [#11285](https://github.com/penpot/penpot/issues/11285) (PR: [#11286](https://github.com/penpot/penpot/pull/11286))
+- Disable MCP developer tools in multi-user mode [#11291](https://github.com/penpot/penpot/issues/11291) (PR: [#11310](https://github.com/penpot/penpot/pull/11310))
+- Fix Hide comments setting being ignored after opening the Comments section [#11308](https://github.com/penpot/penpot/issues/11308) (PR: [#11492](https://github.com/penpot/penpot/pull/11492))
+- Block NAT64/6to4/Teredo IPv6 transition addresses in the SSRF guard [#11319](https://github.com/penpot/penpot/issues/11319) (PR: [#11320](https://github.com/penpot/penpot/pull/11320))
+- Prevent team admins from removing the team owner [#11367](https://github.com/penpot/penpot/issues/11367) (PR: [#11368](https://github.com/penpot/penpot/pull/11368))
+- Enforce share-link comment permissions and page scope [#11370](https://github.com/penpot/penpot/issues/11370) (PR: [#11371](https://github.com/penpot/penpot/pull/11371))
+- Clean up orphaned teams, projects and files on profile deletion [#11394](https://github.com/penpot/penpot/issues/11394) (PR: [#11395](https://github.com/penpot/penpot/pull/11395))
+- Fix crash when pressing Ctrl+D with no shape selected [#11448](https://github.com/penpot/penpot/issues/11448) (PR: [#11491](https://github.com/penpot/penpot/pull/11491))
+- Fix text layout not updating when auto-width is set by double-clicking the bounding box [#11480](https://github.com/penpot/penpot/issues/11480) (PR: [#11541](https://github.com/penpot/penpot/pull/11541))
+- Fix boolean shapes rendering deformed in the WASM renderer and exports [#11482](https://github.com/penpot/penpot/issues/11482) (PR: [#11551](https://github.com/penpot/penpot/pull/11551))
 
 ### :sparkles: New features & Enhancements
 
@@ -185,6 +233,10 @@
 ### :rocket: Epics and highlights
 
 - Render prototype viewer with WASM (Skia) engine instead of SVG [#10037](https://github.com/penpot/penpot/issues/10037) (PR: [#10038](https://github.com/penpot/penpot/pull/10038))
+- Add layer blur effect for visual depth and styling [#9844](https://github.com/penpot/penpot/issues/9844) (PR: [#10034](https://github.com/penpot/penpot/pull/10034))
+- Render guides in WebGL for consistent viewer performance [#10068](https://github.com/penpot/penpot/issues/10068) (PR: [#10014](https://github.com/penpot/penpot/pull/10014))
+- Add concurrency limiter and status indicators for MCP server communications [#9493](https://github.com/penpot/penpot/issues/9493) (PR: [#9748](https://github.com/penpot/penpot/pull/9748))
+- Add typography token row to multiselected texts for better token visibility [#9336](https://github.com/penpot/penpot/issues/9336) (PR: [#9128](https://github.com/penpot/penpot/pull/9128))
 
 ### :sparkles: New features & Enhancements
 
@@ -360,7 +412,7 @@
 
 ### :rocket: Epics and highlights
 
-- WebGL rendering (beta) user preference [#9683](https://github.com/penpot/penpot/issues/9683) (PR:[9113](https://github.com/penpot/penpot/pull/9113))
+- WebGL rendering (beta) user preference [#9683](https://github.com/penpot/penpot/issues/9683) (PR: [#9113](https://github.com/penpot/penpot/pull/9113))
 - Design Tokens at the design tab: numeric fields with token selection in place [#9358](https://github.com/penpot/penpot/issues/9358)
 
 ### :sparkles: New features & Enhancements
@@ -539,6 +591,10 @@
 
 ## 2.15.0
 
+### :rocket: Epics and highlights
+
+- Add MCP server integration for AI-assisted design workflows [#9174](https://github.com/penpot/penpot/issues/9174) (PR: [#9032](https://github.com/penpot/penpot/pull/9032), [#9321](https://github.com/penpot/penpot/pull/9321))
+
 ### :sparkles: New features & Enhancements
 
 - Add MCP server integration [GH #9174](https://github.com/penpot/penpot/issues/9174)

CONTRIBUTING.md

@@ -188,8 +188,11 @@ Commit messages must follow this format:
 - Add clear and concise description on the body
 - Do not end the subject with a period
 - Keep the subject to **70 characters** or fewer
+- **Wrap body lines at 76 characters or fewer** (trailers and URLs excepted)
 - Separate the subject from the body with a **blank line**
 
+You can check a commit against these rules with `./scripts/check-commit`.
+
 ### Examples
 
 ```

HIGHLIGHTS.md

@@ -1,26 +0,0 @@
-# HIGHLIGHTS
-
-## 2.17.0
-
-- Background blur is here
-- WebGL rendering gets stronger
-- MCP connection status and more
-- Design tokens: more visible, more user-friendly
-
-
-## 2.16.0
-
-- Design tokens in the design panel
-- Major community contributions
-- WebGL rendering (beta)
-
-
-## 2.15.0
-
-- AI connected to real design context
-- Multi-directional workflow
-- Your stack, your model, your decision
-
-
-
-

README.md

@@ -56,6 +56,7 @@ If your organization is scaling and needs extra support, we’re here to help. [
 
 - [Why Penpot](#why-penpot)
 - [Getting Started](#getting-started)
+- [Penpot Enterprise](#penpot-enterprise)
 - [Community](#community)
 - [Contributing](#contributing)
 - [Resources](#resources)
@@ -93,6 +94,12 @@ Penpot is the only design & prototype platform that is deployment agnostic. You
 
 Learn how to install it with Docker, Kubernetes, Elestio or other options on [our website](https://penpot.app/self-host).
 
+<img width="100%" height="1010" alt="2" src="https://github.com/user-attachments/assets/243e796e-a140-481a-b68f-b24be6a70e37" />
+
+## Penpot Enterprise ##
+
+Penpot Enterprise is our paid plan for organizations that need to scale their design work across multiple teams with advanced governance, security, and administration. Manage teams and access from a centralized **Admin Console**, configure advanced permissions, and connect your **identity provider through SSO**. Available for cloud and self-hosted environments, it combines enterprise controls with Penpot’s open-source foundation and open standards.
+
 ## Community ##
 
 We love the Open Source software community. Contributing is our passion and if it’s yours too, participate and [improve](https://community.penpot.app/c/help-us-improve-penpot/7) Penpot. All your designs, code and ideas are welcome!

backend/package.json

@@ -4,7 +4,7 @@
   "license": "MPL-2.0",
   "author": "Kaleidos INC Sucursal en España SL",
   "private": true,
-  "packageManager": "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee",
+  "packageManager": "pnpm@12.3.4+sha512.961aa41fb077da3a04a441d9f8e15ebc0c96da8ef710b2eb67bf9ee7cb0610eabd48f1fd85f51cffe73846785fa0f87c56a3a872a1d893f8446741b5cce45457",
   "repository": {
     "type": "git",
     "url": "https://github.com/penpot/penpot"

backend/pnpm-lock.yaml

@@ -1,3 +1,104 @@
+---
+lockfileVersion: '9.0'
+
+importers:
+
+  .:
+    configDependencies: {}
+    packageManagerDependencies:
+      pnpm:
+        specifier: 12.3.4
+        version: 12.3.4
+
+packages:
+
+  '@pnpm/exe.darwin-arm64@12.3.4':
+    resolution: {integrity: sha512-PAyUol8T1+/+ViOiXAt51ECA+QnfXCqz6foL4bW+LsoX0NcVd5XVEM2mRQu+LV4oc7uRz9zf9U0P+XFfuQeDAw==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@pnpm/exe.darwin-x64@12.3.4':
+    resolution: {integrity: sha512-fxP9JCk0Cdye+ePuj+GJJLMUMTqHGWRdb1dtv4How876uQ2ehxvenpgiYAir/ceO9PsYUZkFTtyZdx+rRu5QOA==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@pnpm/exe.linux-arm64-musl@12.3.4':
+    resolution: {integrity: sha512-FBOt0/7ye6O6q4AllVV5QMviB6qE6fqkeczV/+MDWQsmo+QJrlfsh6X7CpH/tClVpBZEyIbjpUoT8bNhCYBxEg==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-arm64@12.3.4':
+    resolution: {integrity: sha512-t71AVA7LRqiKTyZ5xMYaZc2n5DfdpMbfokZuiIOXHBOM03ECnF0t4iYwaBDqJgVjlKYUOwaF/bRQajGNA4cJ4w==}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.linux-x64-musl@12.3.4':
+    resolution: {integrity: sha512-RPmk7Jb/aYaFvL2iyDN/AtMY+hUEsue732WmXpcuQ9tBpMnGyA5py7Z3+e+qmQaJ0zY/4ni9jJiyPBQHujmv6w==}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
+  '@pnpm/exe.linux-x64@12.3.4':
+    resolution: {integrity: sha512-2ZqOlSPkfwX1h5cR+FPiWf8+F+2hZT/3TvhUK5sigHqwaQCIiq8R7CGxhndKs63JtcLi2a1Qpo+wX/EoyfjyJQ==}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
+  '@pnpm/exe.win32-arm64@12.3.4':
+    resolution: {integrity: sha512-ANyrHqyqco6SXBysUTRF74itDyyraea7IbFsKFdNXTjcFnfycTDx37EwuhdpPYFNSIh2JhUG4fByclsRfiHX7w==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@pnpm/exe.win32-x64@12.3.4':
+    resolution: {integrity: sha512-WH/KqBPY/hq2Tb7SgQltEZytimcjgKRaCRL/aM9CI0c67iKc5TVmHUhIiL3Ux9FB4bWn36i6XewUcScQI+zG8w==}
+    cpu: [x64]
+    os: [win32]
+
+  pnpm@12.3.4:
+    resolution: {integrity: sha512-lhqkH7B32joEpEHZ+OFevAyW2o73ELLrZ7+e58sGEOq9SPH9hfUc/+c4RnhfoPh8VqOocqHYk/hEZ0G1zORUVw==}
+    engines: {node: '>=18.*'}
+    hasBin: true
+
+snapshots:
+
+  '@pnpm/exe.darwin-arm64@12.3.4':
+    optional: true
+
+  '@pnpm/exe.darwin-x64@12.3.4':
+    optional: true
+
+  '@pnpm/exe.linux-arm64-musl@12.3.4':
+    optional: true
+
+  '@pnpm/exe.linux-arm64@12.3.4':
+    optional: true
+
+  '@pnpm/exe.linux-x64-musl@12.3.4':
+    optional: true
+
+  '@pnpm/exe.linux-x64@12.3.4':
+    optional: true
+
+  '@pnpm/exe.win32-arm64@12.3.4':
+    optional: true
+
+  '@pnpm/exe.win32-x64@12.3.4':
+    optional: true
+
+  pnpm@12.3.4:
+    optionalDependencies:
+      '@pnpm/exe.darwin-arm64': 12.3.4
+      '@pnpm/exe.darwin-x64': 12.3.4
+      '@pnpm/exe.linux-arm64': 12.3.4
+      '@pnpm/exe.linux-arm64-musl': 12.3.4
+      '@pnpm/exe.linux-x64': 12.3.4
+      '@pnpm/exe.linux-x64-musl': 12.3.4
+      '@pnpm/exe.win32-arm64': 12.3.4
+      '@pnpm/exe.win32-x64': 12.3.4
+
+---
 lockfileVersion: '9.0'
 
 settings:

backend/pnpm-workspace.yaml

@@ -1,2 +1,4 @@
+storeDir: ../.pnpm-store
+
 minimumReleaseAgeExclude:
   - brace-expansion@5.0.8 || 5.0.9

backend/scripts/_env

@@ -31,7 +31,7 @@ export PENPOT_MEDIA_PROCESSING_SERVICE_URI=http://localhost:6065
 export PENPOT_FLAGS="\
        $PENPOT_FLAGS \
        enable-login-with-password \
-       disable-login-with-ldap \
+       enable-login-with-ldap \
        disable-login-with-oidc \
        disable-login-with-google \
        disable-login-with-github \

backend/src/app/auth/ldap.clj

@@ -10,7 +10,7 @@
    [app.common.logging :as l]
    [app.common.schema :as sm]
    [clj-ldap.client :as ldap]
-   [clojure.string]
+   [cuerdas.core :as str]
    [integrant.core :as ig]))
 
 (defn- prepare-params
@@ -36,11 +36,22 @@
                 :cause cause))))
 
 (defn- replace-several [s & {:as replacements}]
-  (reduce-kv clojure.string/replace s replacements))
+  (reduce-kv str/replace s replacements))
+
+(defn- escape-ldap-filter-value
+  "Escapes special characters in a string for use in LDAP filter values,
+  per RFC 4515 section 3."
+  [s]
+  (-> s
+      (str/replace "\\" "\\5c")
+      (str/replace "*"  "\\2a")
+      (str/replace "("  "\\28")
+      (str/replace ")"  "\\29")
+      (str/replace "\u0000" "\\00")))
 
 (defn- search-user
   [{:keys [::conn base-dn] :as cfg} email]
-  (let [query  (replace-several (:query cfg) ":username" email)
+  (let [query  (replace-several (:query cfg) ":username" (escape-ldap-filter-value email))
         attrs  [(:attrs-username cfg)
                 (:attrs-email cfg)
                 (:attrs-fullname cfg)]
@@ -49,12 +60,19 @@
                  :attributes attrs}]
     (first (ldap/search conn base-dn params))))
 
+(defn- get-attr
+  "Retrieves an attribute from an LDAP entry. Handles multi-valued
+  attributes by returning the first value."
+  [entry attr-key]
+  (let [v (get entry attr-key)]
+    (if (coll? v) (first v) v)))
+
 (defn- retrieve-user
   [{:keys [::conn] :as cfg} {:keys [email password]}]
   (when-let [{:keys [dn] :as user} (search-user cfg email)]
     (when (ldap/bind? conn dn password)
-      {:fullname (get user (-> cfg :attrs-fullname keyword))
-       :email    email
+      {:fullname (get-attr user (-> cfg :attrs-fullname keyword))
+       :email    (get-attr user (-> cfg :attrs-email keyword))
        :backend  "ldap"})))
 
 (def ^:private schema:info-data
@@ -79,7 +97,7 @@
           (l/warn :hint "invalid response from ldap, looks like ldap is not configured correctly" :data user)
           (ex/raise :type :restriction
                     :code :wrong-ldap-response
-                    :explain explain)))
+                    ::sm/explain explain)))
       user)))
 
 (defn- try-connectivity

backend/src/app/config.clj

@@ -58,6 +58,7 @@
    :objects-storage-fs-directory "assets"
 
    :auth-token-cookie-name "auth-token"
+   :auth-token-cookie-max-age-absolute (ct/duration {:days 30})
 
    :assets-path "/internal/assets/"
    :smtp-default-reply-to "Penpot <no-reply@example.com>"
@@ -91,6 +92,7 @@
 
    :quotes-upload-sessions-per-profile 5
    :quotes-upload-chunks-per-session 20
+   :upload-max-chunk-size (* 1024 1024 30) ; 30MiB
 
    ;; SSRF protection
    :ssrf-allowed-hosts #{}
@@ -202,10 +204,12 @@
     [:quotes-team-access-requests-per-requester {:optional true} ::sm/int]
     [:quotes-upload-sessions-per-profile {:optional true} ::sm/int]
     [:quotes-upload-chunks-per-session {:optional true} ::sm/int]
+    [:upload-max-chunk-size {:optional true} ::sm/int]
     [:quotes-media-storage-bytes-per-team {:optional true} ::sm/int]
 
     [:auth-token-cookie-name {:optional true} :string]
     [:auth-token-cookie-max-age {:optional true} ::ct/duration]
+    [:auth-token-cookie-max-age-absolute {:optional true} ::ct/duration]
 
     [:registration-domain-whitelist {:optional true} [::sm/set :string]]
     [:email-verify-threshold {:optional true} ::ct/duration]

backend/src/app/graph/arrow.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.arrow
   "Bulk Ladybug ingest through in-memory Arrow.

backend/src/app/graph/debug.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.debug
   "In-memory Ladybug sessions for the debug graph console."

backend/src/app/graph/ingest.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.ingest
   "Penpot file -> Ladybug graph projection."

backend/src/app/graph/ladybug.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.ladybug
   "Ladybug access layer for graph-backed Penpot.

backend/src/app/graph/meta.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.meta
   "`GraphMeta`: the graph's own account of who built it and from what.

backend/src/app/graph/projection/document.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.projection.document
   "Project a Penpot file-data map into Ladybug nodes and structural edges.

backend/src/app/graph/projection/transforms.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.projection.transforms
   "Derived graph links: edges a reader could compute from the projected

backend/src/app/graph/report.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.report
   (:require

backend/src/app/graph/schema.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.schema
   "Ladybug DDL facade for the graph-backed Penpot vertical slice.

backend/src/app/graph/schema/contract.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.schema.contract
   "Deliberate choices in Penpot's graph schema, recorded as data.

backend/src/app/graph/schema/nodes.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.schema.nodes
   "Single source of truth for graph node tables.

backend/src/app/graph/schema/projection.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.schema.projection
   "Derive Ladybug node column schemas from Penpot Malli sources.

backend/src/app/graph/schema/types.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.schema.types
   "Map Malli schemas to Ladybug column types.

backend/src/app/graph/schema/values.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.schema.values
   "Shape a Penpot value into the plain data its Ladybug column type wants.

backend/src/app/graph/stats.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.stats
   (:require

backend/src/app/graph/sync.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.graph.sync
   "Incremental Ladybug graph updates from Penpot file-change events."

backend/src/app/http/client.clj

@@ -15,6 +15,7 @@
   (:require
    [app.common.schema :as sm]
    [app.util.ssrf :as ssrf]
+   [app.worker :as-alias wrk]
    [cuerdas.core :as str]
    [integrant.core :as ig]
    [java-http-clj.core :as http])
@@ -23,6 +24,8 @@
    java.net.URI))
 
 (def default-max-redirects 5)
+(def default-connect-timeout 30000)
+(def default-request-timeout 30000)
 
 (defn client?
   [o]
@@ -33,15 +36,17 @@
   :pred client?})
 
 (defmethod ig/init-key ::client
-  [_ _]
-  (http/build-client {:connect-timeout 30000
+  [_ {:keys [::wrk/executor]}]
+  (http/build-client {:connect-timeout default-connect-timeout
+                      :executor executor
                       :follow-redirects :never}))
 
 (defn send!
   ([client req] (send! client req {}))
   ([client req {:keys [response-type] :or {response-type :string}}]
    (assert (client? client) "expected valid http client")
-   (http/send req {:client client :as response-type})))
+   (http/send (merge {:timeout default-request-timeout} req)
+              {:client client :as response-type})))
 
 (defn- resolve-client
   [params]

backend/src/app/http/errors.clj

@@ -60,7 +60,13 @@
 
 (defmethod handle-error :restriction
   [err request _]
-  (let [{:keys [code] :as data} (ex-data err)]
+  (let [data    (ex-data err)
+        code    (get data :code)
+        explain (ex/explain data)
+        data    (-> data
+                    (dissoc ::sm/explain)
+                    (cond-> explain (assoc :explain explain)))]
+
     (if (= code :method-not-allowed)
       {::yres/status 405
        ::yres/body data}

backend/src/app/http/session.clj

@@ -36,6 +36,9 @@
 ;; Default age for automatic session renewal
 (def default-renewal-max-age (ct/duration {:hours 6}))
 
+;; Default absolute maximum session duration
+(def default-cookie-max-age-absolute (ct/duration {:days 30}))
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; PROTOCOLS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -169,15 +172,19 @@
 
 (defn- assign-token
   [cfg session]
-  (let [claims {:iss "authentication"
-                :aud "penpot"
-                :sid (:id session)
-                :iat (:modified-at session)
-                :uid (:profile-id session)
-                :sso-provider-id (:sso-provider-id session)
-                :sso-session-id (:sso-session-id session)}
-        header {:kid 1 :ver 1}
-        token  (tokens/generate cfg claims header)]
+  (let [absolute-max-age (cf/get :auth-token-cookie-max-age-absolute default-cookie-max-age-absolute)
+        claims            {:iss "authentication"
+                           :aud "penpot"
+                           :sid (:id session)
+                           :iat (:modified-at session)
+                           :uid (:profile-id session)
+                           :sso-provider-id (:sso-provider-id session)
+                           :sso-session-id (:sso-session-id session)}
+        claims            (if (:created-at session)
+                            (assoc claims :exp (ct/plus (:created-at session) absolute-max-age))
+                            claims)
+        header            {:kid 1 :ver 1}
+        token             (tokens/generate cfg claims header)]
     (assoc session :token token)))
 
 (defn create-fn
@@ -353,15 +360,23 @@
        or (updated_at is null and
            created_at < ?::timestamptz)")
 
+(def ^:private
+  sql:delete-expired-v2
+  "DELETE FROM http_session_v2
+    WHERE created_at < ?::timestamptz")
+
 (defn- collect-expired-tasks
   [{:keys [::db/conn ::tasks/max-age]}]
   (let [threshold (ct/minus (ct/now) max-age)
-        result    (-> (db/exec-one! conn [sql:delete-expired threshold threshold])
-                      (db/get-update-count))]
+        result-legacy (-> (db/exec-one! conn [sql:delete-expired threshold threshold])
+                          (db/get-update-count))
+        result-v2     (-> (db/exec-one! conn [sql:delete-expired-v2 threshold])
+                          (db/get-update-count))]
     (l/dbg :task "gc"
            :hint "clean http sessions"
-           :deleted result)
-    result))
+           :deleted-legacy result-legacy
+           :deleted-v2 result-v2)
+    (+ result-legacy result-v2)))
 
 (defmethod ig/init-key ::tasks/gc
   [_ {:keys [::tasks/max-age] :as cfg}]

backend/src/app/main.clj

@@ -205,7 +205,7 @@
     ::sto/storage (ig/ref ::sto/storage)}
 
    ::http.client/client
-   {}
+   {::wrk/executor (ig/ref ::wrk/executor)}
 
    ::session/manager
    {::db/pool (ig/ref ::db/pool)}

backend/src/app/media/remote.clj

@@ -75,10 +75,10 @@
                            {:method method
                             :uri uri
                             :body body
-                            :headers headers}
+                            :headers headers
+                            :timeout timeout}
                            {:response-type :input-stream
-                            :skip-ssrf-check? true
-                            :timeout timeout})
+                            :skip-ssrf-check? true})
             status (:status resp)]
         (when (not (<= 200 status 299))
           (let [body (:body resp)]

backend/src/app/rpc/commands/comments.clj

@@ -390,18 +390,26 @@
 
 (def ^:private sql:file-comment-users
   "WITH available_profiles AS (
-     SELECT DISTINCT owner_id AS id
-       FROM comment
-      WHERE thread_id IN (SELECT id FROM comment_thread WHERE file_id=?)
+     SELECT DISTINCT c.owner_id AS id
+     FROM comment c
+     JOIN comment_thread ct
+       ON ct.id = c.thread_id
+    WHERE ct.file_id = ?::uuid
+  ),
+  profile_ids AS (
+    SELECT id FROM available_profiles
+    UNION
+    SELECT ?::uuid
   )
   SELECT p.id,
          p.email,
          p.fullname AS name,
-         p.fullname AS fullname,
+         p.fullname,
          p.photo_id,
          p.is_active
-    FROM profile AS p
-   WHERE p.id IN (SELECT id FROM available_profiles) OR p.id=?")
+    FROM profile p
+    JOIN profile_ids AS x
+      ON x.id = p.id;")
 
 (defn get-file-comments-users
   [conn file-id profile-id]

backend/src/app/rpc/commands/media.clj

@@ -339,6 +339,9 @@
 
 ;; --- Chunked Upload: Upload a single chunk
 
+(declare ^:private get-upload-chunk)
+(declare ^:private check-upload-chunk-slot)
+
 (def ^:private schema:upload-chunk
   [:map {:title "upload-chunk"}
    [:session-id ::sm/uuid]
@@ -354,9 +357,31 @@
   {::doc/added "2.17"
    ::sm/params schema:upload-chunk
    ::sm/result schema:upload-chunk-result}
-  [{:keys [::db/pool] :as cfg}
-   {:keys [::rpc/profile-id session-id index content] :as _params}]
-  (let [session (db/get pool :upload-session {:id session-id :profile-id profile-id})]
+  [cfg {:keys [::rpc/profile-id session-id index content]}]
+  (let [session (db/tx-run! cfg check-upload-chunk-slot session-id profile-id index content)]
+    (l/trc :hint "upload-chunk"
+           :session-id session-id
+           :chunk (str index "/" (:total-chunks session))
+           :size (:size content)
+           :path (:path content))
+
+    (let [storage (sto/resolve cfg)
+          data    (sto/content (:path content))]
+      (sto/put-object! storage
+                       {::sto/content      data
+                        ::sto/deduplicate? false
+                        ::sto/touch        true
+                        :content-type      (:mtype content)
+                        :bucket            sto/tempfile-bucket
+                        :upload-id         (str session-id)
+                        :chunk-index       index}))
+
+    {:session-id session-id
+     :index      index}))
+
+(defn- check-upload-chunk-slot
+  [{:keys [::db/conn]} session-id profile-id index content]
+  (let [session (db/get conn :upload-session {:id session-id :profile-id profile-id} {::db/for-update true})]
     (when (or (neg? index) (>= index (:total-chunks session)))
       (ex/raise :type :validation
                 :code :invalid-chunk-index
@@ -365,26 +390,23 @@
                 :total-chunks (:total-chunks session)
                 :index index))
 
+    (when (> (:size content) (cf/get :upload-max-chunk-size))
+      (ex/raise :type :validation
+                :code :chunk-too-large
+                :hint "chunk size exceeds the maximum allowed"
+                :session-id session-id
+                :index index
+                :size (:size content)
+                :max-size (cf/get :upload-max-chunk-size)))
 
-    (l/trc :hint "upload-chunk"
-           :session-id session-id
-           :chunk (str index "/" (:total-chunks session))
-           :size (:size content)
-           :path (:path content)))
+    (when (get-upload-chunk conn session-id index)
+      (ex/raise :type :validation
+                :code :duplicate-chunk-index
+                :hint "chunk index already uploaded for this session"
+                :session-id session-id
+                :index index))
 
-  (let [storage (sto/resolve cfg)
-        data    (sto/content (:path content))]
-    (sto/put-object! storage
-                     {::sto/content      data
-                      ::sto/deduplicate? false
-                      ::sto/touched-at   (ct/in-future {:hours 1})
-                      :content-type      (:mtype content)
-                      :bucket            sto/tempfile-bucket
-                      :upload-id         (str session-id)
-                      :chunk-index       index}))
-
-  {:session-id session-id
-   :index      index})
+    session))
 
 ;; --- Chunked Upload: shared helpers
 
@@ -400,6 +422,18 @@
   [conn session-id]
   (db/exec! conn [sql:get-upload-chunks (str session-id)]))
 
+(def ^:private sql:get-upload-chunk
+  "SELECT id
+     FROM storage_object
+    WHERE (metadata->>'~:upload-id') = ?::text
+      AND (metadata->>'~:chunk-index')::integer = ?
+      AND deleted_at IS NULL
+    LIMIT 1")
+
+(defn- get-upload-chunk
+  [conn session-id index]
+  (db/exec-one! conn [sql:get-upload-chunk (str session-id) index]))
+
 (defn- concat-chunks
   "Reads all chunk storage objects in order and writes them to a single
   temporary file on the local filesystem. Returns a path to that file."
@@ -418,18 +452,21 @@
   conforming to `media.v/schema:upload` with `:filename`, `:path` and
   `:size`.
 
-  Raises a :validation/:missing-chunks error when the number of stored
-  chunks does not match `:total-chunks` recorded in the session row.
+  Raises a :validation/:missing-chunks error when the stored chunk
+  indices do not form exactly the `0..total-chunks` range recorded in
+  the session row (wrong count, gaps or duplicates).
   Raises :not-found when the session does not belong to `profile-id`.
   Deletes the session row from `upload_session` on success."
   [{:keys [::db/conn] :as cfg} profile-id session-id]
   (let [session (db/get conn :upload-session {:id session-id :profile-id profile-id})
-        chunks  (get-upload-chunks conn session-id)]
+        chunks  (get-upload-chunks conn session-id)
+        indices (sort (map :chunk-index chunks))]
 
-    (when (not= (count chunks) (:total-chunks session))
+    (when (or (not= (count chunks) (:total-chunks session))
+              (not= indices (range (:total-chunks session))))
       (ex/raise :type :validation
                 :code :missing-chunks
-                :hint "number of stored chunks does not match expected total"
+                :hint "stored chunks do not match expected total"
                 :session-id session-id
                 :expected   (:total-chunks session)
                 :found      (count chunks)))

backend/src/app/rpc/commands/plugins.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.rpc.commands.plugins
   (:require

backend/src/app/rpc/management/nitrate.clj

@@ -41,6 +41,7 @@
    [app.rpc.notifications :as notifications]
    [app.storage :as sto]
    [app.util.services :as sv]
+   [app.util.ssrf :as ssrf]
    [app.worker :as wrk]
    [cuerdas.core :as str]))
 
@@ -960,13 +961,18 @@ RETURNING id, deleted_at;")
 (sv/defmethod ::check-organization-sso
   "Validate an organization SSO configuration by generating a login redirect URL.
   Nitrate calls this while configuring SSO to verify client credentials and OIDC
-  discovery before saving the settings."
+  discovery before saving the settings. The issuer URL is nitrate-supplied
+  (customer-configured), so it is checked against the SSRF blocklist before
+  any outbound request is attempted."
   {::doc/added "2.18"
    ::sm/params cto/schema:nitrate-sso
    ::sm/result schema:check-organization-sso-result
    ::rpc/auth false}
   [cfg params]
-  {:valid (oidc/is-organization-sso-config-valid? cfg params)})
+  (let [issuer (oidc/organization-sso-discovery-uri params)]
+    {:valid (boolean (and issuer
+                          (ssrf/safe-url? issuer)
+                          (oidc/is-organization-sso-config-valid? cfg params)))}))
 
 ;; ---- API: notify-organization-sso-change
 (sv/defmethod ::notify-organization-sso-change

backend/src/app/storage/pending_gc.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.storage.pending-gc
   "A maintenance task that reclaims storage objects created in 'pending'

backend/src/app/tasks/demo_purge.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.tasks.demo-purge
   "Task handler for delayed demo profile deletion. Submitted at demo

backend/src/app/tasks/telemetry.clj

@@ -17,7 +17,6 @@
    [app.http.client :as http]
    [app.main :as-alias main]
    [app.setup :as-alias setup]
-   [app.util.blob :as blob]
    [app.util.json :as json]
    [integrant.core :as ig]
    [promesa.exec :as px]))
@@ -248,20 +247,16 @@
     :props      (or (some-> props db/decode-transit-pgobject) {})
     :context    (or (some-> context db/decode-transit-pgobject) {})}))
 
-(defn- encode-batch
-  "Encode a sequence of event maps into a fressian+zstd base64 string
-  suitable for JSON transport."
-  ^String [events]
-  (blob/encode-str events {:version 4}))
-
 (defn send-event-batch
   "Send a single batch of events to the telemetry endpoint. Returns
-  true on success."
+  true on success. The events are sent as a plain vector of event
+  maps; the JSON encoder handles UUID and temporal types natively and
+  the receiver coerces them back to proper types."
   [{:keys [::setup/props] :as cfg} batch]
   (let [payload {:type :telemetry-events
                  :version (:full cf/version)
                  :instance-id (:instance-id props)
-                 :events (encode-batch batch)}
+                 :events (vec batch)}
         request {:method  :post
                  :uri     (cf/get :telemetry-uri)
                  :headers {"content-type" "application/json"}

backend/test/backend_tests/auth_ldap_test.clj

@@ -0,0 +1,76 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
+
+(ns backend-tests.auth-ldap-test
+  (:require
+   [app.auth.ldap :as ldap-auth]
+   [clj-ldap.client :as ldap]
+   [clojure.test :as t]))
+
+;; --- search-user: filter must be escaped (RED: currently not escaped)
+
+(t/deftest search-user-escapes-email-in-filter
+  (t/testing "wildcard * is escaped before building LDAP filter"
+    (let [captured-query (atom nil)
+          fake-search    (fn [_conn _base-dn params]
+                           (reset! captured-query (:filter params))
+                           [])]
+      (with-redefs [ldap/search fake-search]
+        (#'ldap-auth/search-user {:query "(mail=:username)" :sizelimit 1
+                                  :attrs-username "uid" :attrs-email "mail"
+                                  :attrs-fullname "cn"}
+                                 "fry*@planetexpress.com"))
+      ;; After fix: * should be escaped as \2a
+      (t/is (= "(mail=fry\\2a@planetexpress.com)" @captured-query)
+            "filter must have * escaped per RFC 4515"))))
+
+;; --- retrieve-user: email must come from directory, not client (RED)
+
+(t/deftest retrieve-user-uses-directory-email
+  (t/testing "returned email is from LDAP directory, not client input"
+    (let [fake-search (fn [_conn _base-dn _params]
+                        [{:dn "cn=fry,ou=people,dc=planetexpress,dc=com"
+                          :mail "fry@planetexpress.com"
+                          :cn "Philip J. Fry"
+                          :uid "fry"}])
+          fake-bind?  (fn [_conn _dn _password] true)]
+      (with-redefs [ldap/search fake-search
+                    ldap/bind?  fake-bind?]
+        (let [cfg     {:query "(mail=:username)" :sizelimit 1
+                       :attrs-username "uid" :attrs-email "mail"
+                       :attrs-fullname "cn"}
+              result  (#'ldap-auth/retrieve-user cfg {:email "fry*@planetexpress.com" :password "fry"})]
+          ;; After fix: email should be from directory (fry@planetexpress.com)
+          ;; BUG: email is client input (fry*@planetexpress.com)
+          (t/is (= "fry@planetexpress.com" (:email result))
+                "email must come from LDAP directory attribute, not client input"))))))
+
+;; --- authenticate: full flow with directory email (RED)
+
+(t/deftest authenticate-returns-directory-email
+  (t/testing "authenticate returns directory email for profile"
+    (let [fake-search (fn [_conn _base-dn _params]
+                        [{:dn "cn=amy,ou=people,dc=planetexpress,dc=com"
+                          :mail "amy@planetexpress.com"
+                          :cn "Amy Wong"
+                          :uid "amy"}])
+          fake-bind?  (fn [_conn _dn _password] true)]
+      (with-redefs [ldap/search fake-search
+                    ldap/bind?  fake-bind?
+                    ldap/connect (fn [_cfg] (reify java.lang.AutoCloseable (close [_] nil)))]
+        (let [cfg    {:query "(mail=:username)" :sizelimit 1
+                      :attrs-username "uid" :attrs-email "mail"
+                      :attrs-fullname "cn"
+                      :bind-dn "cn=admin,dc=planetexpress,dc=com"
+                      :bind-password "GoodNewsEveryone"
+                      :host "localhost" :port 10389
+                      :ssl false :tls false
+                      :base-dn "ou=people,dc=planetexpress,dc=com"}
+              result (ldap-auth/authenticate cfg {:email "*@planetexpress.com" :password "amy"})]
+          ;; After fix: email should be amy@planetexpress.com (directory)
+          ;; BUG: email is *@planetexpress.com (client)
+          (t/is (= "amy@planetexpress.com" (:email result))
+                "authenticate must return directory email, not client-supplied wildcard"))))))

backend/test/backend_tests/demo_test.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns backend-tests.demo-test
   (:require

backend/test/backend_tests/graph_binder_gate_test.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns backend-tests.graph-binder-gate-test
   "Binder gate for the incremental-sync statement templates.

backend/test/backend_tests/graph_sync_parity_test.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns backend-tests.graph-sync-parity-test
   "Cold projection and incremental sync are two implementations of one mapping,

backend/test/backend_tests/http_client_test.clj

@@ -0,0 +1,30 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
+
+(ns backend-tests.http-client-test
+  (:require
+   [app.http.client :as http]
+   [clojure.test :as t]
+   [java-http-clj.core :as jhttp]
+   [mockery.core :refer [with-mocks]]))
+
+(t/deftest send-injects-default-timeout-when-absent
+  (with-mocks [mock {:target 'java-http-clj.core/send
+                     :return {:status 200 :body ""}}]
+    (let [client (jhttp/build-client {})]
+      (http/send! client {:method :get :uri "https://example.com/"})
+      (let [[req _opts] (:call-args @mock)]
+        (t/is (= http/default-request-timeout (:timeout req)))))))
+
+(t/deftest send-preserves-caller-supplied-timeout
+  (with-mocks [mock {:target 'java-http-clj.core/send
+                     :return {:status 200 :body ""}}]
+    (let [client (jhttp/build-client {})]
+      (http/send! client {:method :get
+                          :uri "https://example.com/"
+                          :timeout 5000})
+      (let [[req _opts] (:call-args @mock)]
+        (t/is (= 5000 (:timeout req)))))))

backend/test/backend_tests/http_middleware_test.clj

@@ -277,6 +277,70 @@
     (t/is (= (:id session) (:sid claims)))
     (t/is (= (:id profile) (:uid claims)))))
 
+(t/deftest session-token-contains-exp-claim
+  (let [cfg     th/*system*
+        manager (session/inmemory-manager)
+        profile (th/create-profile* 1)
+        session (->> (session/create-session manager {:profile-id (:id profile)
+                                                      :user-agent "user agent"})
+                     (#'session/assign-token cfg))
+        claims  (tokens/decode cfg (:token session))
+        exp     (:exp claims)]
+    (t/is (some? exp) "session token should contain :exp claim")
+    (t/is (ct/inst? exp) "exp should be an instant")))
+
+(t/deftest session-token-exp-based-on-created-at
+  (let [cfg              th/*system*
+        manager          (session/inmemory-manager)
+        profile          (th/create-profile* 1)
+        session          (->> (session/create-session manager {:profile-id (:id profile)
+                                                               :user-agent "user agent"})
+                              (#'session/assign-token cfg))
+        claims           (tokens/decode cfg (:token session))
+        expected-exp     (ct/plus (:created-at session) (ct/duration {:days 30}))]
+    (t/is (some? (:exp claims)) "session token should contain :exp claim")
+    (t/is (= (inst-ms (:exp claims))
+             (inst-ms expected-exp))
+          "exp should equal created-at + 30 days")))
+
+(t/deftest session-token-past-exp-is-rejected
+  (let [cfg     th/*system*
+        manager (session/inmemory-manager)
+        profile (th/create-profile* 1)
+        session (->> (session/create-session manager {:profile-id (:id profile)
+                                                      :user-agent "user agent"})
+                     (#'session/assign-token cfg))
+        claims  (tokens/decode cfg (:token session))
+        ;; Manually create a token with exp in the past
+        past-claims (assoc claims :exp (ct/minus (ct/now) (ct/duration {:days 1})))
+        header     {:kid 1 :ver 1}
+        past-token (tokens/generate cfg past-claims header)]
+    (t/is (nil? (session/decode-token cfg past-token))
+          "token with exp in the past should be rejected")))
+
+(t/deftest session-renewal-preserves-original-exp
+  (let [cfg      th/*system*
+        manager  (session/inmemory-manager)
+        profile  (th/create-profile* 1)
+        handler  (-> (fn [req] req)
+                     (#'session/wrap-authz  {::session/manager manager})
+                     (#'mw/wrap-auth {:bearer (partial session/decode-token cfg)
+                                      :cookie (partial session/decode-token cfg)}))
+        session  (->> (session/create-session manager {:profile-id (:id profile)
+                                                       :user-agent "user agent"})
+                      (#'session/assign-token cfg))
+        original-exp (:exp (tokens/decode cfg (:token session)))
+        ;; Force renewal by setting modified-at to 7 hours ago
+        old-session  (assoc session :modified-at (ct/minus (ct/now) (ct/duration {:hours 7})))
+        response    (handler (make-dummy-request {:cookies {"auth-token" (:token old-session)}}))
+        {:keys [token claims]} (get response ::http/auth-data)
+        new-exp     (:exp claims)]
+    (t/is (some? original-exp) "original token should have :exp")
+    (t/is (some? new-exp) "renewed token should have :exp")
+    (t/is (= (inst-ms original-exp)
+             (inst-ms new-exp))
+          "renewed token should preserve original :exp, not extend it")))
+
 (t/deftest parse-request-illegal-argument-exception
   ;; clojure.data.json raises IllegalArgumentException (case
   ;; fall-through) on several kinds of malformed input. The

backend/test/backend_tests/media_remote_test.clj

@@ -8,6 +8,7 @@
   (:require
    [app.common.exceptions :as ex]
    [app.config :as cf]
+   [app.http.client :as http]
    [app.media.remote :as media.remote]
    [app.setup :as-alias setup]
    [app.util.json :as json]
@@ -500,6 +501,22 @@
                      :headers {}})]
           (t/is (= 200 (:status resp))))))))
 
+(t/deftest service-request-puts-configured-timeout-in-request
+  (t/testing "service-request puts media-processing-service-timeout on the http request"
+    (let [captured (atom nil)]
+      (with-redefs [cf/get (th/config-get-mock config-mock)
+                    http/req (fn [_client request _opts]
+                               (reset! captured request)
+                               {:status 200
+                                :body (json-stream {:width 100 :height 100})})]
+        (media.remote/service-request
+         (mk-system)
+         {:method :post
+          :uri "http://localhost:6065/api/image/info"
+          :body nil
+          :headers {}})
+        (t/is (= 5000 (:timeout @captured)))))))
+
 ;; ---------------------------------------------------------------------------
 ;; Shared key
 ;; ---------------------------------------------------------------------------

backend/test/backend_tests/passwords_test.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns backend-tests.passwords-test
   (:require

backend/test/backend_tests/rpc_demo_test.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns backend-tests.rpc-demo-test
   (:require

backend/test/backend_tests/rpc_management_nitrate_test.clj

@@ -17,6 +17,7 @@
    [app.msgbus :as mbus]
    [app.nitrate :as nitrate]
    [app.rpc :as-alias rpc]
+   [app.util.ssrf :as ssrf]
    [app.worker :as wrk]
    [backend-tests.helpers :as th]
    [clojure.set :as set]
@@ -1806,13 +1807,14 @@
 
 (t/deftest check-organization-sso-returns-valid-true
   (let [organization-id (uuid/random)
-        out    (with-redefs [oidc/is-organization-sso-config-valid? (constantly true)]
-                 (th/management-command!
-                  {::th/type :check-organization-sso
-                   :organization-id organization-id
-                   :client-id "test-client"
-                   :client-secret "test-secret"
-                   :issuer "https://idp.example.com"}))]
+        out             (with-redefs [ssrf/safe-url? (constantly true)
+                                      oidc/is-organization-sso-config-valid? (constantly true)]
+                          (th/management-command!
+                           {::th/type :check-organization-sso
+                            :organization-id organization-id
+                            :client-id "test-client"
+                            :client-secret "test-secret"
+                            :issuer "https://idp.example.com"}))]
     (t/is (th/success? out))
     (t/is (true? (-> out :result :valid)))))
 
@@ -1827,19 +1829,36 @@
 
 (t/deftest check-organization-sso-passes-issuer-to-validation
   (let [organization-id (uuid/random)
-        out    (with-redefs [oidc/is-organization-sso-config-valid?
-                             (fn [_cfg sso]
-                               (and (= "test-client" (:client-id sso))
-                                    (= "https://idp.example.com/" (:issuer sso))))]
-                 (th/management-command!
-                  {::th/type :check-organization-sso
-                   :organization-id organization-id
-                   :client-id "test-client"
-                   :client-secret "test-secret"
-                   :issuer "https://idp.example.com/"}))]
+        out             (with-redefs [ssrf/safe-url? (constantly true)
+                                      oidc/is-organization-sso-config-valid?
+                                      (fn [_cfg sso]
+                                        (and (= "test-client" (:client-id sso))
+                                             (= "https://idp.example.com/" (:issuer sso))))]
+                          (th/management-command!
+                           {::th/type :check-organization-sso
+                            :organization-id organization-id
+                            :client-id "test-client"
+                            :client-secret "test-secret"
+                            :issuer "https://idp.example.com/"}))]
     (t/is (th/success? out))
     (t/is (true? (-> out :result :valid)))))
 
+(t/deftest check-organization-sso-returns-valid-false-on-ssrf-blocked-issuer
+  (t/testing "an SSRF-blocked issuer must not reach the OIDC validation flow"
+    (let [called? (atom false)
+          out     (with-redefs [oidc/is-organization-sso-config-valid?
+                                (fn [_cfg _sso] (reset! called? true) true)]
+                    (th/management-command!
+                     {::th/type :check-organization-sso
+                      :organization-id (uuid/random)
+                      :client-id "test-client"
+                      :client-secret "test-secret"
+                      :issuer "http://127.0.0.1/idp"}))]
+      (t/is (th/success? out))
+      (t/is (false? (-> out :result :valid)))
+      (t/is (false? @called?)
+            "OIDC validation should not run when the issuer is SSRF-blocked"))))
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; PUSH AUDIT EVENTS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

backend/test/backend_tests/rpc_media_test.clj

@@ -681,6 +681,131 @@
       (t/is (= :validation (-> out :error ex-data :type)))
       (t/is (= :missing-chunks (-> out :error ex-data :code))))))
 
+(t/deftest chunked-upload-assemble-rejects-duplicate-indices
+  ;; assemble-chunks must validate the index SET, not just the count: a
+  ;; session declaring 2 chunks but storing [0,0] must fail instead of
+  ;; assembling a corrupt file. Chunks are written at the storage level
+  ;; because upload-chunk itself now rejects the second index.
+  (let [prof        (th/create-profile* 1)
+        _           (th/create-project* 1 {:profile-id (:id prof)
+                                           :team-id (:default-team-id prof)})
+        file        (th/create-file* 1 {:profile-id (:id prof)
+                                        :project-id (:default-project-id prof)
+                                        :is-shared false})
+        session-id  (create-session! prof 2)
+        storage     (:app.storage/storage th/*system*)
+        source-path (th/tempfile "backend_tests/test_files/sample.jpg")
+        chunks      (split-file-into-chunks source-path 312043)
+        put-chunk!  (fn [idx]
+                      (let [mfile (make-chunk-mfile (first chunks) "image/jpeg")]
+                        (sto/put-object! storage
+                                         {::sto/content      (sto/content (:path mfile))
+                                          ::sto/deduplicate? false
+                                          ::sto/touch        true
+                                          :content-type      "image/jpeg"
+                                          :bucket            sto/tempfile-bucket
+                                          :upload-id         (str session-id)
+                                          :chunk-index       idx})))]
+    (put-chunk! 0)
+    (put-chunk! 0)
+
+    (let [out (th/command! {::th/type        :assemble-file-media-object
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :file-id         (:id file)
+                            :is-local        true
+                            :name            "dupe-indices"
+                            :mtype           "image/jpeg"})]
+      (t/is (some? (:error out)))
+      (t/is (= :validation (-> out :error ex-data :type)))
+      (t/is (= :missing-chunks (-> out :error ex-data :code))))))
+
+(t/deftest chunked-upload-duplicate-then-assemble
+  ;; A rejected duplicate must leave the first chunk intact: upload 0,
+  ;; re-upload 0 (rejected), then assemble succeeds with the original size.
+  (let [prof        (th/create-profile* 1)
+        _           (th/create-project* 1 {:profile-id (:id prof)
+                                           :team-id (:default-team-id prof)})
+        file        (th/create-file* 1 {:profile-id (:id prof)
+                                        :project-id (:default-project-id prof)
+                                        :is-shared false})
+        session-id  (create-session! prof 1)
+        source-path (th/tempfile "backend_tests/test_files/sample.jpg")
+        chunks      (split-file-into-chunks source-path 312043)
+        mtype       "image/jpeg"
+        size        (alength (first chunks))]
+
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           0
+                            :content         (make-chunk-mfile (first chunks) mtype)})]
+      (t/is (nil? (:error out))))
+
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           0
+                            :content         (make-chunk-mfile (first chunks) mtype)})]
+      (t/is (some? (:error out)))
+      (t/is (= :duplicate-chunk-index (-> out :error ex-data :code))))
+
+    (let [out (th/command! {::th/type        :assemble-file-media-object
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :file-id         (:id file)
+                            :is-local        true
+                            :name            "after-dupe"
+                            :mtype           mtype})]
+      (t/is (nil? (:error out)))
+      (let [storage (:app.storage/storage th/*system*)
+            mobj    (sto/get-object storage (:media-id (:result out)))]
+        (t/is (= size (:size mobj)))))))
+
+(t/deftest chunked-upload-rejected-duplicate-keeps-session-usable
+  ;; Rejecting a duplicate must not poison the session: the remaining
+  ;; distinct indices still accumulate and assemble normally.
+  (let [prof        (th/create-profile* 1)
+        _           (th/create-project* 1 {:profile-id (:id prof)
+                                           :team-id (:default-team-id prof)})
+        file        (th/create-file* 1 {:profile-id (:id prof)
+                                        :project-id (:default-project-id prof)
+                                        :is-shared false})
+        session-id  (create-session! prof 2)
+        source-path (th/tempfile "backend_tests/test_files/sample.jpg")
+        chunks      (split-file-into-chunks source-path 110000)
+        mtype       "image/jpeg"]
+
+    (t/is (= 3 (count chunks)))
+
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           0
+                            :content         (make-chunk-mfile (nth chunks 0) mtype)})]
+      (t/is (nil? (:error out))))
+
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           0
+                            :content         (make-chunk-mfile (nth chunks 0) mtype)})]
+      (t/is (some? (:error out)))
+      (t/is (= :duplicate-chunk-index (-> out :error ex-data :code))))
+
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           1
+                            :content         (make-chunk-mfile (nth chunks 1) mtype)})]
+      (t/is (nil? (:error out))))
+
+    ;; The live store holds exactly the two distinct indices: the
+    ;; rejected duplicate stored nothing.
+    (let [rows (th/db-exec! ["SELECT (metadata->>'~:chunk-index')::integer AS idx FROM storage_object WHERE (metadata->>'~:upload-id') = ?::text AND deleted_at IS NULL ORDER BY idx"
+                             (str session-id)])]
+      (t/is (= [0 1] (mapv :idx rows))))))
+
 (t/deftest chunked-upload-session-not-found
   (let [prof       (th/create-profile* 1)
         _          (th/create-project* 1 {:profile-id (:id prof)
@@ -767,6 +892,77 @@
       (t/is (= :validation (-> out :error ex-data :type)))
       (t/is (= :invalid-chunk-index (-> out :error ex-data :code))))))
 
+(t/deftest chunked-upload-duplicate-index-rejected
+  ;; Uploading the same chunk index twice into one session must fail:
+  ;; the second call raises :validation / :duplicate-chunk-index and
+  ;; stores nothing, so one session+index keeps at most one object.
+  (let [prof        (th/create-profile* 1)
+        session-id  (create-session! prof 1)
+        source-path (th/tempfile "backend_tests/test_files/sample.jpg")
+        chunks      (split-file-into-chunks source-path 312043)
+        mtype       "image/jpeg"
+        mfile1      (make-chunk-mfile (first chunks) mtype)
+        mfile2      (make-chunk-mfile (first chunks) mtype)]
+
+    ;; First upload succeeds
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           0
+                            :content         mfile1})]
+      (t/is (nil? (:error out))))
+
+    ;; Second upload of the same index must be rejected
+    (let [out (th/command! {::th/type        :upload-chunk
+                            ::rpc/profile-id (:id prof)
+                            :session-id      session-id
+                            :index           0
+                            :content         mfile2})]
+      (t/is (some? (:error out)))
+      (t/is (= :validation (-> out :error ex-data :type)))
+      (t/is (= :duplicate-chunk-index (-> out :error ex-data :code))))
+
+    ;; Exactly one live object stored for that session/index
+    (let [rows (th/db-exec! ["SELECT id FROM storage_object WHERE (metadata->>'~:upload-id') = ?::text AND (metadata->>'~:chunk-index') = '0' AND deleted_at IS NULL"
+                             (str session-id)])]
+      (t/is (= 1 (count rows))))))
+
+(t/deftest chunked-upload-chunk-too-large
+  ;; Chunks larger than the configured cap must be rejected with
+  ;; :validation / :chunk-too-large before anything is stored, while a
+  ;; chunk exactly at the cap still uploads fine.
+  (with-mocks [mock {:target 'app.config/get
+                     :return (th/config-get-mock
+                              {:upload-max-chunk-size 1024})}]
+    (let [prof        (th/create-profile* 1)
+          session-id  (create-session! prof 1)
+          source-path (th/tempfile "backend_tests/test_files/sample.jpg")
+          chunks      (split-file-into-chunks source-path 312043)
+          mtype       "image/jpeg"]
+
+      ;; 312043 bytes exceeds the mocked 1024-byte cap: rejected
+      (let [out (th/command! {::th/type        :upload-chunk
+                              ::rpc/profile-id (:id prof)
+                              :session-id      session-id
+                              :index           0
+                              :content         (make-chunk-mfile (first chunks) mtype)})]
+        (t/is (some? (:error out)))
+        (t/is (= :validation (-> out :error ex-data :type)))
+        (t/is (= :chunk-too-large (-> out :error ex-data :code))))
+
+      ;; Nothing stored for the rejected chunk
+      (let [rows (th/db-exec! ["SELECT id FROM storage_object WHERE (metadata->>'~:upload-id') = ?::text AND deleted_at IS NULL"
+                               (str session-id)])]
+        (t/is (= 0 (count rows))))
+
+      ;; A chunk exactly at the cap still uploads fine
+      (let [out (th/command! {::th/type        :upload-chunk
+                              ::rpc/profile-id (:id prof)
+                              :session-id      session-id
+                              :index           0
+                              :content         (make-chunk-mfile (byte-array 1024 (byte 1)) mtype)})]
+        (t/is (nil? (:error out)))))))
+
 (t/deftest chunked-upload-sessions-per-profile-quota
   ;; With the session limit set to 2, creating a third session for the
   ;; same profile must fail with :restriction / :max-quote-reached.

backend/test/backend_tests/rpc_plugins_test.clj

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns backend-tests.rpc-plugins-test
   (:require

backend/test/backend_tests/tasks_telemetry_test.clj

@@ -12,7 +12,6 @@
    [app.db :as db]
    [app.loggers.audit :as audit]
    [app.tasks.telemetry :as telemetry]
-   [app.util.blob :as blob]
    [app.util.json :as json]
    [backend-tests.helpers :as th]
    [clojure.test :as t]
@@ -59,11 +58,6 @@
       :cnt
       long))
 
-(defn- decode-event-batch
-  "Decode the base64+fressian+zstd event-batch sent to the mock."
-  [b64-str]
-  (blob/decode-str b64-str))
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; STATS / REPORT STRUCTURE TESTS (existing behaviour, extended)
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -245,21 +239,19 @@
             (t/is (not (contains? ev :ip-addr)))))))))
 
 (t/deftest test-batch-encoding-is-decodable
-  ;; Verify that encode-batch produces a blob that round-trips back
-  ;; through blob/decode to the original data.
+  ;; Events are sent as a plain vector of raw event maps (no blob
+  ;; encoding): every batch must JSON round-trip unchanged, because
+  ;; the receiver coerces types from the plain JSON representation.
   (let [events [{:name "navigate" :type "action" :source "telemetry"
                  :tracked-at (ct/now)}
                 {:name "create-file" :type "action" :source "telemetry"
                  :tracked-at (ct/now)}]
-        ;; Call the private fn through the ns-mapped var
-        encode  (ns-resolve 'app.tasks.telemetry 'encode-batch)
-        encoded (encode events)
-        decoded (decode-event-batch encoded)]
-    (t/is (string? encoded))
-    (t/is (seq decoded))
-    (t/is (= (count events) (count decoded)))
-    (t/is (= "navigate" (:name (first decoded))))
-    (t/is (= "create-file" (:name (second decoded))))))
+        encoded (json/encode-str {:events (vec events)})
+        decoded (json/decode encoded)]
+    (t/is (vector? (:events decoded)))
+    (t/is (= (count events) (count (:events decoded))))
+    (t/is (= "navigate" (:name (first (:events decoded)))))
+    (t/is (= "create-file" (:name (second (:events decoded)))))))
 
 (t/deftest test-multiple-batches-when-many-events
   ;; Lower batch-size to 1 so that 3 events produce 3 separate
@@ -787,9 +779,13 @@
             (t/is (= "telemetry-events" (name (:type body))))
             (t/is (string? (:version body)))
             (t/is (some? (:instance-id body)))
-            ;; :events is a base64-encoded blob
-            (t/is (string? (:events body)))
-            (t/is (pos? (count (:events body))))))))))
+            ;; :events is a plain vector of raw event maps
+            (t/is (vector? (:events body)))
+            (t/is (pos? (count (:events body))))
+            (doseq [ev (:events body)]
+              (t/is (string? (:name ev)))
+              (t/is (string? (:source ev)))
+              (t/is (string? (:tracked-at ev))))))))))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; TASK BRANCH COVERAGE

backend/test/e2e/ldap-injection.test.mjs

@@ -0,0 +1,106 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { rpcPost, extractCookie } from "./helpers/client.mjs";
+
+async function loginWithLdap(email, password) {
+  const res = await rpcPost("login-with-ldap", { email, password });
+  if (res.status !== 200 || res.body.type) {
+    throw new Error(
+      `LDAP login failed: ${JSON.stringify(res.body)}`
+    );
+  }
+  const cookie = extractCookie(res.setCookie);
+  return { profile: res.body, cookie };
+}
+
+describe("LDAP injection — T5-N1-03", () => {
+
+  it("normal LDAP login works with valid credentials", async () => {
+    const { profile, cookie } = await loginWithLdap(
+      "fry@planetexpress.com",
+      "fry"
+    );
+    assert.equal(profile.email, "fry@planetexpress.com");
+    assert.ok(profile.id, "profile should have id");
+    assert.ok(cookie, "cookie should be set");
+  });
+
+  it("wildcard injection: *@planetexpress.com must not return client literal as email", async () => {
+    // ATTACK SCENARIO (from Criptored audit):
+    // 1. Attacker (amy) sends email="*@planetexpress.com" with her own password
+    // 2. LDAP filter becomes (mail=*@planetexpress.com) — * is a wildcard
+    // 3. With sizelimit=1, LDAP returns amy's entry (first match)
+    // 4. Bind succeeds: amy's DN + amy's password = valid
+    //
+    // EXPECTED BEHAVIOR AFTER FIX (two valid outcomes):
+    // A) If * is escaped: LDAP finds no match → wrong-credentials (injection blocked)
+    // B) If * matches: profile email must be "amy@planetexpress.com" (directory), not "*@planetexpress.com" (client)
+    //
+    // Either outcome is correct — the vulnerability is fixed.
+    try {
+      const { profile } = await loginWithLdap("*@planetexpress.com", "amy");
+      // Outcome B: login succeeded, verify email is from directory
+      assert.equal(
+        profile.email,
+        "amy@planetexpress.com",
+        "email must come from LDAP directory, not client input"
+      );
+    } catch (e) {
+      // Outcome A: injection blocked — * is escaped, no LDAP match
+      assert.ok(
+        e.message.includes("wrong-credentials"),
+        "wildcard should be rejected or return directory email"
+      );
+    }
+  });
+
+  it("identity swap: alternate email must return primary directory email", async () => {
+    // Professor has two emails in LDAP: professor@ and hubert@.
+    // Login with hubert@ — the profile email should be the one
+    // the LDAP directory returns as attrs-email, not what the client typed.
+    //
+    // EXPECTED BEHAVIOR AFTER FIX:
+    // Profile email should be "professor@planetexpress.com" (primary directory email),
+    // NOT "hubert@planetexpress.com" (client literal).
+    //
+    // CURRENT BUG: email is "hubert@planetexpress.com" (client literal) — test FAILS
+    const { profile, cookie } = await loginWithLdap(
+      "hubert@planetexpress.com",
+      "professor"
+    );
+    assert.ok(profile.id, "profile should have id");
+    assert.ok(cookie, "cookie should be set");
+    // This assertion FAILS with current code (RED) — proves the vulnerability
+    assert.equal(
+      profile.email,
+      "professor@planetexpress.com",
+      "email must come from LDAP directory, not client input"
+    );
+  });
+
+  it("wrong password fails", async () => {
+    try {
+      await loginWithLdap("fry@planetexpress.com", "wrong-password");
+      assert.fail("should have thrown");
+    } catch (e) {
+      assert.ok(
+        e.message.includes("LDAP login failed") ||
+        e.message.includes("wrong-credentials"),
+        "should fail with wrong credentials"
+      );
+    }
+  });
+
+  it("non-existent user fails", async () => {
+    try {
+      await loginWithLdap("nobody@planetexpress.com", "password");
+      assert.fail("should have thrown");
+    } catch (e) {
+      assert.ok(
+        e.message.includes("LDAP login failed") ||
+        e.message.includes("wrong-credentials"),
+        "should fail for non-existent user"
+      );
+    }
+  });
+});

common/package.json

@@ -4,7 +4,7 @@
   "license": "MPL-2.0",
   "author": "Kaleidos INC Sucursal en España SL",
   "private": true,
-  "packageManager": "pnpm@12.0.0+sha512.9e2e3dc3911995868dc94b8175c217c27e95408fa03b4a22749778f2b34f773b77cdd3b39ede8171b22fcd53be6a35342e9fac9948a68ef58df6488ce89a7e67",
+  "packageManager": "pnpm@12.3.4+sha512.961aa41fb077da3a04a441d9f8e15ebc0c96da8ef710b2eb67bf9ee7cb0610eabd48f1fd85f51cffe73846785fa0f87c56a3a872a1d893f8446741b5cce45457",
   "type": "module",
   "repository": {
     "type": "git",

common/pnpm-lock.yaml

@@ -7,96 +7,96 @@ importers:
     configDependencies: {}
     packageManagerDependencies:
       pnpm:
-        specifier: 12.0.0
-        version: 12.0.0
+        specifier: 12.3.4
+        version: 12.3.4
 
 packages:
 
-  '@pnpm/exe.darwin-arm64@12.0.0':
-    resolution: {integrity: sha512-sqeoPfVMIfQhbwzDrKraXY2ynyuWClFqzvfImzAS/yczEru1m5SGvQ9kgFPDvQzJZ9AetedgJeDZC6qYvH8/tQ==}
+  '@pnpm/exe.darwin-arm64@12.3.4':
+    resolution: {integrity: sha512-PAyUol8T1+/+ViOiXAt51ECA+QnfXCqz6foL4bW+LsoX0NcVd5XVEM2mRQu+LV4oc7uRz9zf9U0P+XFfuQeDAw==}
     cpu: [arm64]
     os: [darwin]
 
-  '@pnpm/exe.darwin-x64@12.0.0':
-    resolution: {integrity: sha512-Quc3J6c9cGTy+LDgz1cLVgCNOU9IERuyAlDoEj0DCilKqvo50Jx1GV8k74iwn4J9fFSKkm8JrwNvtTDj3uWnUA==}
+  '@pnpm/exe.darwin-x64@12.3.4':
+    resolution: {integrity: sha512-fxP9JCk0Cdye+ePuj+GJJLMUMTqHGWRdb1dtv4How876uQ2ehxvenpgiYAir/ceO9PsYUZkFTtyZdx+rRu5QOA==}
     cpu: [x64]
     os: [darwin]
 
-  '@pnpm/exe.linux-arm64-musl@12.0.0':
-    resolution: {integrity: sha512-EVWd3OTmgsMFhXx69b5JxIzoabG9Ma7m4OeTaf0ZKBzMnfYi8u21NDQo92ToMrdYL5dYDDCHsyYIjXzk+d0HhA==}
+  '@pnpm/exe.linux-arm64-musl@12.3.4':
+    resolution: {integrity: sha512-FBOt0/7ye6O6q4AllVV5QMviB6qE6fqkeczV/+MDWQsmo+QJrlfsh6X7CpH/tClVpBZEyIbjpUoT8bNhCYBxEg==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@pnpm/exe.linux-arm64@12.0.0':
-    resolution: {integrity: sha512-cXHHW8M4rAPsYNkKZO9WVcpLLK55i9EaIsZPfIqUuY2eopd5LqnFyBge54HCh1GC0yCX8ySn0hYIi+4OyAEoDg==}
+  '@pnpm/exe.linux-arm64@12.3.4':
+    resolution: {integrity: sha512-t71AVA7LRqiKTyZ5xMYaZc2n5DfdpMbfokZuiIOXHBOM03ECnF0t4iYwaBDqJgVjlKYUOwaF/bRQajGNA4cJ4w==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@pnpm/exe.linux-x64-musl@12.0.0':
-    resolution: {integrity: sha512-UcXwMdFjly0mpddkGigHKTxe27IMv2fUK4IWW/MHmJ3yMguxXmkwNlEI4aE+G1HO2TLo20uNEUWD4ymLe/DaCQ==}
+  '@pnpm/exe.linux-x64-musl@12.3.4':
+    resolution: {integrity: sha512-RPmk7Jb/aYaFvL2iyDN/AtMY+hUEsue732WmXpcuQ9tBpMnGyA5py7Z3+e+qmQaJ0zY/4ni9jJiyPBQHujmv6w==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@pnpm/exe.linux-x64@12.0.0':
-    resolution: {integrity: sha512-6Rsl+zEWMOmus7v7/9J3OE8EMvHyNAfxYmDfmhQG4J0985OuT3G3Ho9NSGHjkBn4aU4bgklWifRhe1HX8dUSyw==}
+  '@pnpm/exe.linux-x64@12.3.4':
+    resolution: {integrity: sha512-2ZqOlSPkfwX1h5cR+FPiWf8+F+2hZT/3TvhUK5sigHqwaQCIiq8R7CGxhndKs63JtcLi2a1Qpo+wX/EoyfjyJQ==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@pnpm/exe.win32-arm64@12.0.0':
-    resolution: {integrity: sha512-O5F76A4oVFrpDGdFxEszRIThOSBfjHdH5c006gR+7UTCfiXrukr1XfqPungUI1DXcSR5gb9jBsPQqQZOAoOOxw==}
+  '@pnpm/exe.win32-arm64@12.3.4':
+    resolution: {integrity: sha512-ANyrHqyqco6SXBysUTRF74itDyyraea7IbFsKFdNXTjcFnfycTDx37EwuhdpPYFNSIh2JhUG4fByclsRfiHX7w==}
     cpu: [arm64]
     os: [win32]
 
-  '@pnpm/exe.win32-x64@12.0.0':
-    resolution: {integrity: sha512-5dKFajIEWJ1ai+KHXFJvskY6vchbunmLwSUV2ywbLymcmJjfY5XJVpgzPCyIoVCMVG0zHorr66+hM8h8b3aRfQ==}
+  '@pnpm/exe.win32-x64@12.3.4':
+    resolution: {integrity: sha512-WH/KqBPY/hq2Tb7SgQltEZytimcjgKRaCRL/aM9CI0c67iKc5TVmHUhIiL3Ux9FB4bWn36i6XewUcScQI+zG8w==}
     cpu: [x64]
     os: [win32]
 
-  pnpm@12.0.0:
-    resolution: {integrity: sha512-ni49w5EZlYaNyUuBdcIXwn6VQI+gO0oidJd48rNPdzt3zdOznt6BcbIvzVO+ajU0Lp+smUimjvWN9kiM6Jp+Zw==}
+  pnpm@12.3.4:
+    resolution: {integrity: sha512-lhqkH7B32joEpEHZ+OFevAyW2o73ELLrZ7+e58sGEOq9SPH9hfUc/+c4RnhfoPh8VqOocqHYk/hEZ0G1zORUVw==}
     engines: {node: '>=18.*'}
     hasBin: true
 
 snapshots:
 
-  '@pnpm/exe.darwin-arm64@12.0.0':
+  '@pnpm/exe.darwin-arm64@12.3.4':
     optional: true
 
-  '@pnpm/exe.darwin-x64@12.0.0':
+  '@pnpm/exe.darwin-x64@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-arm64-musl@12.0.0':
+  '@pnpm/exe.linux-arm64-musl@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-arm64@12.0.0':
+  '@pnpm/exe.linux-arm64@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-x64-musl@12.0.0':
+  '@pnpm/exe.linux-x64-musl@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-x64@12.0.0':
+  '@pnpm/exe.linux-x64@12.3.4':
     optional: true
 
-  '@pnpm/exe.win32-arm64@12.0.0':
+  '@pnpm/exe.win32-arm64@12.3.4':
     optional: true
 
-  '@pnpm/exe.win32-x64@12.0.0':
+  '@pnpm/exe.win32-x64@12.3.4':
     optional: true
 
-  pnpm@12.0.0:
+  pnpm@12.3.4:
     optionalDependencies:
-      '@pnpm/exe.darwin-arm64': 12.0.0
-      '@pnpm/exe.darwin-x64': 12.0.0
-      '@pnpm/exe.linux-arm64': 12.0.0
-      '@pnpm/exe.linux-arm64-musl': 12.0.0
-      '@pnpm/exe.linux-x64': 12.0.0
-      '@pnpm/exe.linux-x64-musl': 12.0.0
-      '@pnpm/exe.win32-arm64': 12.0.0
-      '@pnpm/exe.win32-x64': 12.0.0
+      '@pnpm/exe.darwin-arm64': 12.3.4
+      '@pnpm/exe.darwin-x64': 12.3.4
+      '@pnpm/exe.linux-arm64': 12.3.4
+      '@pnpm/exe.linux-arm64-musl': 12.3.4
+      '@pnpm/exe.linux-x64': 12.3.4
+      '@pnpm/exe.linux-x64-musl': 12.3.4
+      '@pnpm/exe.win32-arm64': 12.3.4
+      '@pnpm/exe.win32-x64': 12.3.4
 
 ---
 lockfileVersion: '9.0'

common/pnpm-workspace.yaml

@@ -1 +1,3 @@
+storeDir: ../.pnpm-store
+
 minimumReleaseAge: 0

common/src/app/common/types/color.cljc

@@ -72,6 +72,13 @@
   [:map {:title "PlainColorAttrs"}
    [:color schema:hex-color]])
 
+(def schema:image-transform
+  [:map {:title "ImageTransform" :closed true}
+   [:x {:optional true} ::sm/safe-number]
+   [:y {:optional true} ::sm/safe-number]
+   [:width {:optional true} ::sm/safe-number]
+   [:height {:optional true} ::sm/safe-number]])
+
 (def schema:image
   [:map {:title "ImageColor" :closed true}
    [:width [::sm/int {:min 0 :gen/gen sg/int}]]
@@ -79,7 +86,8 @@
    [:mtype {:gen/gen (sg/elements cm/image-types)} ::sm/text]
    [:id ::sm/uuid]
    [:name {:optional true} ::sm/text]
-   [:keep-aspect-ratio {:optional true} :boolean]])
+   [:keep-aspect-ratio {:optional true} :boolean]
+   [:transform {:optional true} schema:image-transform]])
 
 (def image-attrs
   "A set of attrs that corresponds to image data type"

common/src/app/common/types/fills/impl.cljc

@@ -119,12 +119,15 @@
 
 (defn write-image-fill
   [offset buffer opacity image]
-  (let [image-id     (get image :id)
-        image-width  (get image :width)
-        image-height (get image :height)
-        alpha      (mth/floor (* opacity 0xff))
-        keep-aspect-ratio  (if (get image :keep-aspect-ratio false) 0x01 0x00)
-        flags        (bit-or keep-aspect-ratio 0x00)]
+  (let [image-id          (get image :id)
+        image-width       (get image :width)
+        image-height      (get image :height)
+        alpha             (mth/floor (* opacity 0xff))
+        keep-aspect-ratio (if (get image :keep-aspect-ratio false) 0x01 0x00)
+        transform         (get image :transform)
+        has-transform?    (some? transform)
+        transform-flag    (if has-transform? 0x02 0x00)
+        flags             (bit-or keep-aspect-ratio transform-flag)]
     (buf/write-byte  buffer (+ offset  0) 0x03)
     (buf/write-uuid  buffer (+ offset  4) image-id)
     (buf/write-byte  buffer (+ offset 20) alpha)
@@ -132,6 +135,17 @@
     (buf/write-short buffer (+ offset 22) 0) ;; 2-byte padding (reserved for future use)
     (buf/write-int   buffer (+ offset 24) image-width)
     (buf/write-int   buffer (+ offset 28) image-height)
+    (if has-transform?
+      (do
+        (buf/write-float buffer (+ offset 32) (double (get transform :x 0.0)))
+        (buf/write-float buffer (+ offset 36) (double (get transform :y 0.0)))
+        (buf/write-float buffer (+ offset 40) (double (get transform :width 1.0)))
+        (buf/write-float buffer (+ offset 44) (double (get transform :height 1.0))))
+      (do
+        (buf/write-float buffer (+ offset 32) 0.0)
+        (buf/write-float buffer (+ offset 36) 0.0)
+        (buf/write-float buffer (+ offset 40) 1.0)
+        (buf/write-float buffer (+ offset 44) 1.0)))
     (+ offset FILL-U8-SIZE)))
 
 (defn- write-metadata
@@ -208,28 +222,36 @@
                                            :type type}})
 
                   3 ;; image fill
-                  (let [id      (buf/read-uuid  dbuffer (+ doffset 4))
-                        alpha   (buf/read-unsigned-byte dbuffer (+ doffset 20))
-                        opacity (mth/precision (/ alpha 0xff) 2)
-                        flags   (buf/read-unsigned-byte dbuffer (+ doffset 21))
-                        ratio   (boolean (bit-and flags 0x01))
-                        width   (buf/read-int   dbuffer (+ doffset 24))
-                        height  (buf/read-int   dbuffer (+ doffset 28))
-                        mtype   (buf/read-short mbuffer (+ moffset 2))
-                        mtype   (case mtype
-                                  0x01 "image/jpeg"
-                                  0x02 "image/png"
-                                  0x03 "image/gif"
-                                  0x04 "image/webp"
-                                  0x05 "image/svg+xml")]
+                  (let [id        (buf/read-uuid  dbuffer (+ doffset 4))
+                        alpha     (buf/read-unsigned-byte dbuffer (+ doffset 20))
+                        opacity   (mth/precision (/ alpha 0xff) 2)
+                        flags     (buf/read-unsigned-byte dbuffer (+ doffset 21))
+                        ratio     (not (zero? (bit-and flags 0x01)))
+                        has-tf    (not (zero? (bit-and flags 0x02)))
+                        width     (buf/read-int   dbuffer (+ doffset 24))
+                        height    (buf/read-int   dbuffer (+ doffset 28))
+                        transform (when has-tf
+                                    {:x      (buf/read-float dbuffer (+ doffset 32))
+                                     :y      (buf/read-float dbuffer (+ doffset 36))
+                                     :width  (buf/read-float dbuffer (+ doffset 40))
+                                     :height (buf/read-float dbuffer (+ doffset 44))})
+                        mtype     (buf/read-short mbuffer (+ moffset 2))
+                        mtype     (case mtype
+                                    0x01 "image/jpeg"
+                                    0x02 "image/png"
+                                    0x03 "image/gif"
+                                    0x04 "image/webp"
+                                    0x05 "image/svg+xml")]
                     {:fill-opacity opacity
-                     :fill-image {:id id
-                                  :width width
-                                  :height height
-                                  :mtype mtype
-                                  :keep-aspect-ratio ratio
-                                  ;; FIXME: we are not encodign the name, looks useless
-                                  :name "sample"}}))]
+                     :fill-image   (cond-> {:id                id
+                                            :width             width
+                                            :height            height
+                                            :mtype             mtype
+                                            :keep-aspect-ratio ratio
+                                            ;; FIXME: we are not encodign the name, looks useless
+                                            :name              "sample"}
+                                     (some? transform)
+                                     (assoc :transform transform))}))]
 
     (if refs?
       (let [ref-file (buf/read-uuid mbuffer (+ moffset 4))

common/src/app/common/types/path.cljc

@@ -460,6 +460,19 @@
   (let [content (impl/path-data content)]
     (segment/merge-nodes content points)))
 
+(defn merge-coincident-nodes
+  "Collapses the nodes sharing a position into one node.
+
+  Without `points` every position held by more than one command is merged."
+  ([content]
+   (let [content (impl/path-data content)]
+     (-> (segment/merge-coincident-nodes content)
+         (impl/from-plain))))
+  ([content points]
+   (let [content (impl/path-data content)]
+     (-> (segment/merge-coincident-nodes content points)
+         (impl/from-plain)))))
+
 (defn join-nodes
   "Creates new segments between points that weren't previously connected."
   [content points]

common/src/app/common/types/path/fit.cljc

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.common.types.path.fit
   "Curve fitting helpers."

common/src/app/common/types/path/segment.cljc

@@ -940,18 +940,21 @@
                              (not= :close-path (:command c))))]
     (loop [i      0
            k      0
+           start  nil
            result (transient [])]
       (if (>= i n)
         (persistent! result)
         (let [cmd   (nth content i)
               nxt   (nth content (inc i) nil)
+              move? (= :move-to (:command cmd))
+              start (if move? (helpers/segment->point cmd) start)
               at-p? (and (not= :close-path (:command cmd))
                          (gpt/close? point (helpers/segment->point cmd)))]
           (cond
             ;; Offset a subpath start.
-            (and at-p? (= :move-to (:command cmd)))
+            (and at-p? move?)
             (let [off (gpt/point (* k ox) (* k oy))]
-              (recur (inc i) (inc k)
+              (recur (inc i) (inc k) start
                      (conj! result (-> cmd
                                        (update-in [:params :x] + (:x off))
                                        (update-in [:params :y] + (:y off))))))
@@ -972,7 +975,7 @@
                          (= :curve-to (:command nxt))
                          (-> (update-in [:params :c1x] + (:x off2))
                              (update-in [:params :c1y] + (:y off2))))]
-              (recur (+ i 2) (inc k2)
+              (recur (+ i 2) (inc k2) start
                      (-> result (conj! cmd') (conj! mv) (conj! nxt'))))
 
             ;; Open and offset a closed seam.
@@ -985,12 +988,20 @@
                          (-> (update-in [:params :c2x] + (:x off))
                              (update-in [:params :c2y] + (:y off))))]
               ;; Drop the close command so the seam stays open.
-              (recur (+ i 2) (inc k) (conj! result cmd')))
+              (recur (+ i 2) (inc k) start (conj! result cmd')))
+
+            ;; Open the seam of a subpath that closes back onto the node.
+            (and (= :close-path (:command cmd))
+                 (some? start)
+                 (gpt/close? point start))
+            (let [off (gpt/point (* k ox) (* k oy))]
+              (recur (inc i) (inc k) start
+                     (conj! result (helpers/make-line-to (gpt/add point off)))))
 
             ;; Offset the end of an open subpath.
             (and at-p? (seg? cmd) (not= :close-path (:command nxt)))
             (let [off (gpt/point (* k ox) (* k oy))]
-              (recur (inc i) (inc k)
+              (recur (inc i) (inc k) start
                      (conj! result (cond-> (-> cmd
                                                (update-in [:params :x] + (:x off))
                                                (update-in [:params :y] + (:y off)))
@@ -999,7 +1010,7 @@
                                          (update-in [:params :c2y] + (:y off)))))))
 
             :else
-            (recur (inc i) k (conj! result cmd))))))))
+            (recur (inc i) k start (conj! result cmd))))))))
 
 (defn separate-nodes
   "Removes segments between points or splits one node into offset open ends."
@@ -1072,7 +1083,7 @@
 
             result (cond-> result
                      (and (nil? set-a) (nil? set-b))
-                     (conj #{point-a point-b})
+                     (conj (hash-set point-a point-b))
 
                      (and (some? set-a) (nil? set-b))
                      (add-to-set set-a point-b)
@@ -1108,6 +1119,144 @@
     (->> content
          (mapv replace-command))))
 
+(defn- remove-empty-segments
+  "Drops segments with no length whose ends are accepted by `at-point?`."
+  [content at-point?]
+  (loop [result    (transient [])
+         prev      nil
+         segments? false
+         pending   (seq content)]
+    (if-let [{:keys [command] :as segment} (first pending)]
+      (let [close?  (= :close-path command)
+            move?   (= :move-to command)
+            point   (when-not close? (helpers/segment->point segment))
+            ;; A close command on a subpath without segments draws nothing.
+            empty?  (if close?
+                      (not segments?)
+                      (and (not move?)
+                           (some? prev)
+                           (gpt/close? prev point)
+                           (at-point? point)))]
+        (if empty?
+          (recur result prev segments? (next pending))
+          (recur (conj! result segment)
+                 (if close? nil point)
+                 (not (or move? close?))
+                 (next pending))))
+      (persistent! result))))
+
+(defn- point-key
+  "Rounded coordinates of a point, usable as a map key."
+  [point]
+  [(mth/round (:x point) 0.1) (mth/round (:y point) 0.1)])
+
+(defn- curve-key
+  "Key for the curve a segment draws, equal in either direction."
+  [from segment to]
+  (let [c1  (or (get-handler segment :c1) from)
+        c2  (or (get-handler segment :c2) to)
+        fwd [(point-key from) (point-key c1) (point-key c2) (point-key to)]
+        bwd [(point-key to) (point-key c2) (point-key c1) (point-key from)]]
+    (if (neg? (compare fwd bwd)) fwd bwd)))
+
+(defn- node-point-groups
+  "Node positions of the content grouped by their rounded coordinates."
+  [content]
+  (group-by point-key
+            (into []
+                  (comp (remove #(= :close-path (:command %)))
+                        (map helpers/segment->point))
+                  content)))
+
+(defn- coincident-points
+  "Positions of the content that more than one command holds."
+  [content]
+  (into #{}
+        (comp (filter (fn [[_ points]] (> (count points) 1)))
+              (map (fn [[_ points]] (first points))))
+        (node-point-groups content)))
+
+(defn- repeated-nodes
+  "Rounded positions accepted by `at-point?` that more than one command holds."
+  [content at-point?]
+  (into #{}
+        (comp (filter (fn [[_ points]]
+                        (and (> (count points) 1)
+                             (at-point? (first points)))))
+              (map key))
+        (node-point-groups content)))
+
+(defn- resume-segment
+  "Commands that reopen the subpath at `from` and draw `segment` from there."
+  [from segment start]
+  (if (= :close-path (:command segment))
+    (when-not (subpath/pt= from start)
+      [(helpers/make-move-to from) (helpers/make-line-to start)])
+    [(helpers/make-move-to from) segment]))
+
+(defn- remove-retraced-segments
+  "Drops the segments that draw a curve already drawn through a node.
+
+  A node held by several commands is a junction, but two segments meeting
+  there and drawing the same curve are one line traced twice."
+  [content at-point?]
+  (let [repeated  (repeated-nodes content at-point?)
+        retraced? (fn [from to]
+                    (or (contains? repeated (point-key from))
+                        (contains? repeated (point-key to))))]
+    (if (empty? repeated)
+      content
+      (loop [result  (transient [])
+             pending (seq content)
+             drawn   #{}
+             from    nil
+             start   nil
+             lifted? false]
+        (if-let [{:keys [command] :as segment} (first pending)]
+          (if (= :move-to command)
+            (let [point (helpers/segment->point segment)]
+              (recur (conj! result segment) (next pending) drawn point point false))
+            (let [to  (if (= :close-path command)
+                        start
+                        (helpers/segment->point segment))
+                  key (curve-key from segment to)]
+              (if (and (contains? drawn key)
+                       (retraced? from to))
+                (recur result (next pending) drawn to start true)
+                (recur (reduce conj! result (if lifted?
+                                              (resume-segment from segment start)
+                                              [segment]))
+                       (next pending) (conj drawn key) to start false))))
+          (persistent! result))))))
+
+(defn merge-coincident-nodes
+  "Collapses the commands sharing a position at `points` into a single node.
+
+  Drops the empty segments and the ones retracing another through such a
+  point, and stitches the subpath ends meeting there, closing the resulting
+  loops. A point where more than two distinct segments meet is left alone: the
+  format needs one command per segment there. Without `points` every position
+  held by more than one command is merged."
+  ([content]
+   (merge-coincident-nodes content (coincident-points content)))
+  ([content points]
+   (let [at-point? (fn [point] (some #(gpt/close? point %) points))
+
+         stitch    (fn [content]
+                     (-> content
+                         (subpath/close-subpaths at-point?)
+                         ;; A subpath whose ends meet carries an explicit close command.
+                         (subpath/close-loops)))
+
+         content   (-> (vec content)
+                       (remove-empty-segments at-point?)
+                       (stitch))
+
+         retraced  (remove-retraced-segments content at-point?)]
+     (if (= retraced content)
+       content
+       (stitch retraced)))))
+
 (defn merge-nodes
   "Joins and merges `points` into one point."
   [content points]
@@ -1116,10 +1265,12 @@
     (if (seq segments)
       (let [point->merge-point (-> segments
                                    (group-segments)
-                                   (calculate-merge-points points))]
+                                   (calculate-merge-points points))
+            merge-points       (set (vals point->merge-point))]
         (-> content
             (separate-nodes points)
-            (replace-points point->merge-point)))
+            (replace-points point->merge-point)
+            (merge-coincident-nodes merge-points)))
       content)))
 
 (defn transform-content

common/src/app/common/types/path/selection.cljc

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.common.types.path.selection
   "Transforms selected path nodes and handlers."

common/src/app/common/types/path/subpath.cljc

@@ -99,25 +99,30 @@
 
 (defn- merge-paths
   "Tries to merge into candidate the subpaths. Will return the candidate with the subpaths merged
-  and removed from subpaths the subpaths merged"
-  [candidate subpaths]
-  (let [merge-with-candidate
+  and removed from subpaths the subpaths merged. Only meeting points accepted
+  by `meet?` are joined"
+  [candidate subpaths meet?]
+  (let [joins?
+        (fn [point other]
+          (and (pt= point other) (meet? point)))
+
+        merge-with-candidate
         (fn [[candidate result] current]
           (cond
             (pt= (:to current) (:from current))
             ;; Subpath is already a closed path
             [candidate (conj result current)]
 
-            (pt= (:to candidate) (:from current))
+            (joins? (:to candidate) (:from current))
             [(subpaths-join candidate current) result]
 
-            (pt= (:from candidate) (:to current))
+            (joins? (:from candidate) (:to current))
             [(subpaths-join current candidate) result]
 
-            (pt= (:to candidate) (:to current))
+            (joins? (:to candidate) (:to current))
             [(subpaths-join candidate (reverse-subpath current)) result]
 
-            (pt= (:from candidate) (:from current))
+            (joins? (:from candidate) (:from current))
             [(subpaths-join (reverse-subpath current) candidate) result]
 
             :else
@@ -163,35 +168,37 @@
     (into [] xf-mapcat-data merged)))
 
 (defn close-subpaths
-  "Searches a path for possible subpaths that can create closed loops and merge them"
-  [content]
-  (let [subpaths (get-subpaths content)
-        closed-subpaths
-        (loop [result []
-               current (first subpaths)
-               subpaths (rest subpaths)]
+  "Searches a path for possible subpaths that can create closed loops and merge them.
+  When `meet?` is given only subpaths that touch at an accepted point are merged"
+  ([content]
+   (close-subpaths content (constantly true)))
+  ([content meet?]
+   (let [subpaths (get-subpaths content)
+         closed-subpaths
+         (loop [result []
+                current (first subpaths)
+                subpaths (rest subpaths)]
 
-          (if (some? current)
-            (let [[new-current new-subpaths]
-                  (if (is-closed? current)
-                    [current subpaths]
-                    (merge-paths current subpaths))]
+           (if (some? current)
+             (let [[new-current new-subpaths]
+                   (if (is-closed? current)
+                     [current subpaths]
+                     (merge-paths current subpaths meet?))]
 
-              (if (= current new-current)
-                ;; If equal we haven't found any matching subpaths we advance
-                (recur (conj result new-current)
-                       (first new-subpaths)
-                       (rest new-subpaths))
+               (if (= current new-current)
+                 ;; If equal we haven't found any matching subpaths we advance
+                 (recur (conj result new-current)
+                        (first new-subpaths)
+                        (rest new-subpaths))
 
-                ;; If different we need to pass again the merge to check for additional
-                ;; subpaths to join
-                (recur result
-                       new-current
-                       new-subpaths)))
-            result))]
+                 ;; If different we need to pass again the merge to check for additional
+                 ;; subpaths to join
+                 (recur result
+                        new-current
+                        new-subpaths)))
+             result))]
 
-
-    (into [] xf-mapcat-data closed-subpaths)))
+     (into [] xf-mapcat-data closed-subpaths))))
 
 (defn- close-loop
   "Adds an explicit close command when a subpath's endpoints meet."

common/src/app/common/types/shape_tree.cljc

@@ -272,6 +272,20 @@
               -1))))
       items))))
 
+(defn- clipped-by-ancestor?
+  "Checks whether position falls outside the visible (clipped) bounds of
+  some ancestor frame with clip content enabled. Used so that a nested
+  frame that extends beyond a clipping ancestor's own bounds is never
+  considered hit/reachable in the invisible, clipped-away region."
+  [objects shape position]
+  (->> (cfh/get-parent-ids objects (dm/get-prop shape :id))
+       (keep (d/getf objects))
+       (some (fn [ancestor]
+               (and (not= (dm/get-prop ancestor :id) uuid/zero)
+                    ^boolean (cfh/frame-shape? ancestor)
+                    (not (:show-content ancestor))
+                    (not ^boolean (gsh/has-point? ancestor position)))))))
+
 (defn get-frame-by-position
   ([objects position]
    (get-frame-by-position objects position nil))
@@ -287,6 +301,7 @@
          validator (or (get options :validator) #(-> true))]
      (or (d/seek #(and ^boolean (some? position)
                        ^boolean (gsh/has-point? % position)
+                       ^boolean (not (clipped-by-ancestor? objects % position))
                        ^boolean (validator %))
                  frames)
          (get objects uuid/zero)))))
@@ -302,7 +317,8 @@
   ([objects position options]
    (->> (get-frames objects options)
         (filter #(and ^boolean (some? position)
-                      ^boolean (gsh/has-point? % position)))
+                      ^boolean (gsh/has-point? % position)
+                      ^boolean (not (clipped-by-ancestor? objects % position))))
         (sort-z-index-objects objects))))
 
 (defn top-nested-frame

common/src/app/common/types/tokens_status.cljc

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns app.common.types.tokens-status
   (:require

common/test/common_tests/files_migrations_0026_test.cljc

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns common-tests.files-migrations-0026-test
   (:require

common/test/common_tests/geom_image_bounds_resize_test.cljc

@@ -0,0 +1,275 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
+
+(ns common-tests.geom-image-bounds-resize-test
+  (:require
+   #?(:clj [clojure.test :refer [deftest is testing]]
+      :cljs [cljs.test :refer-macros [deftest is testing]])
+   [app.common.math :as mth]
+   [app.common.schema :as sm]
+   [app.common.types.color :as clr]
+   [app.common.types.fills :as fills]
+   [app.common.types.fills.impl :as fills.impl]
+   [app.common.uuid :as uuid]))
+
+(deftest test-image-transform-schema
+  (testing "validates image with transform"
+    (let [img {:id (uuid/custom 1)
+               :width 400
+               :height 300
+               :mtype "image/png"
+               :keep-aspect-ratio true
+               :transform {:x 0.1 :y -0.2 :width 1.5 :height 2.0}}]
+      (is (sm/validate clr/schema:image img))))
+
+  (testing "validates image without transform"
+    (let [img {:id (uuid/custom 1)
+               :width 400
+               :height 300
+               :mtype "image/png"
+               :keep-aspect-ratio true}]
+      (is (sm/validate clr/schema:image img))))
+
+  (testing "validates fill with image transform"
+    (let [fill {:fill-opacity 0.8
+                :fill-image {:id (uuid/custom 1)
+                             :width 400
+                             :height 300
+                             :mtype "image/png"
+                             :keep-aspect-ratio true
+                             :transform {:x -0.5 :y -0.5 :width 2.0 :height 2.0}}}]
+      (is (sm/validate fills/schema:fill fill)))))
+
+(deftest test-image-fill-buffer-roundtrip
+  (testing "roundtrip image fill without transform"
+    (let [fill-vec [{:fill-opacity 0.9
+                     :fill-image {:id (uuid/custom 1)
+                                  :width 800
+                                  :height 600
+                                  :mtype "image/jpeg"
+                                  :keep-aspect-ratio true
+                                  :name "sample"}}]
+          coerced (fills/from-plain fill-vec)
+          plain (into [] coerced)]
+      (is (= 1 (count plain)))
+      (is (= 0.9 (:fill-opacity (first plain))))
+      (is (= 800 (-> plain first :fill-image :width)))
+      (is (= 600 (-> plain first :fill-image :height)))
+      (is (true? (-> plain first :fill-image :keep-aspect-ratio)))
+      (is (nil? (-> plain first :fill-image :transform)))))
+
+  (testing "roundtrip image fill with transform"
+    (let [fill-vec [{:fill-opacity 0.75
+                     :fill-image {:id (uuid/custom 2)
+                                  :width 1920
+                                  :height 1080
+                                  :mtype "image/webp"
+                                  :keep-aspect-ratio false
+                                  :name "sample"
+                                  :transform {:x 0.25 :y -0.15 :width 1.5 :height 2.0}}}]
+          coerced (fills/from-plain fill-vec)
+          plain (into [] coerced)
+          tf (-> plain first :fill-image :transform)]
+      (is (= 1 (count plain)))
+      (is (= 0.75 (:fill-opacity (first plain))))
+      (is (= 1920 (-> plain first :fill-image :width)))
+      (is (= 1080 (-> plain first :fill-image :height)))
+      (is (false? (-> plain first :fill-image :keep-aspect-ratio)))
+      (is (some? tf))
+      (is (mth/close? 0.25 (double (:x tf))))
+      (is (mth/close? -0.15 (double (:y tf))))
+      (is (mth/close? 1.5 (double (:width tf))))
+      (is (mth/close? 2.0 (double (:height tf)))))))
+
+(defn compute-bounds-resize-transform
+  "Mathematical model for independent image bounds resizing"
+  [{:keys [width height handler center? sx sy transform]}]
+  (let [w-new (* width sx)
+        h-new (* height sy)
+        [dx dy] (if ^boolean center?
+                  [(/ (* width (- 1.0 sx)) 2.0)
+                   (/ (* height (- 1.0 sy)) 2.0)]
+                  [(case handler
+                     (:left :bottom-left :top-left) (* width (- 1.0 sx))
+                     0.0)
+                   (case handler
+                     (:top :top-left :top-right) (* height (- 1.0 sy))
+                     0.0)])
+        nx0 (get transform :x 0.0)
+        ny0 (get transform :y 0.0)
+        nw0 (get transform :width 1.0)
+        nh0 (get transform :height 1.0)
+        nx' (/ (- (* nx0 width) dx) w-new)
+        ny' (/ (- (* ny0 height) dy) h-new)
+        nw' (/ nw0 sx)
+        nh' (/ nh0 sy)]
+    {:transform {:x nx' :y ny' :width nw' :height nh'}
+     :rendered-pixel-rect {:x (* nx' w-new)
+                           :y (* ny' h-new)
+                           :width (* nw' w-new)
+                           :height (* nh' h-new)}}))
+
+(deftest test-handle-anchoring-mathematics
+  (testing "Right handle crop (shrinking width to 50%)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :right :center? false :sx 0.5 :sy 1.0})]
+      (is (mth/close? 0.0 (-> res :transform :x)))
+      (is (mth/close? 0.0 (-> res :transform :y)))
+      (is (mth/close? 2.0 (-> res :transform :width)))
+      (is (mth/close? 1.0 (-> res :transform :height)))
+      ;; Rendered pixel content remains 200x100 starting at (0, 0)
+      (is (mth/close? 0.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? 0.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Left handle crop (shrinking width to 50% from left)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :left :center? false :sx 0.5 :sy 1.0})]
+      (is (mth/close? -1.0 (-> res :transform :x)))
+      (is (mth/close? 0.0 (-> res :transform :y)))
+      (is (mth/close? 2.0 (-> res :transform :width)))
+      (is (mth/close? 1.0 (-> res :transform :height)))
+      ;; Rendered pixel content has left at -100, width 200 -> right edge at +100 (matches right edge of 100px container!)
+      (is (mth/close? -100.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width)))))
+
+  (testing "Top handle crop (shrinking height to 50% from top)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :top :center? false :sx 1.0 :sy 0.5})]
+      (is (mth/close? 0.0 (-> res :transform :x)))
+      (is (mth/close? -1.0 (-> res :transform :y)))
+      (is (mth/close? 1.0 (-> res :transform :width)))
+      (is (mth/close? 2.0 (-> res :transform :height)))
+      ;; Rendered pixel content has top at -50, height 100 -> bottom edge at +50 (matches bottom edge of 50px container!)
+      (is (mth/close? -50.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Top-Left handle crop (shrinking both dimensions to 50%)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :top-left :center? false :sx 0.5 :sy 0.5})]
+      (is (mth/close? -1.0 (-> res :transform :x)))
+      (is (mth/close? -1.0 (-> res :transform :y)))
+      (is (mth/close? 2.0 (-> res :transform :width)))
+      (is (mth/close? 2.0 (-> res :transform :height)))
+      (is (mth/close? -100.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? -50.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Center resize (Alt modifier)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :right :center? true :sx 0.5 :sy 0.5})]
+      (is (mth/close? -0.5 (-> res :transform :x)))
+      (is (mth/close? -0.5 (-> res :transform :y)))
+      (is (mth/close? 2.0 (-> res :transform :width)))
+      (is (mth/close? 2.0 (-> res :transform :height)))
+      (is (mth/close? -50.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? -25.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Bottom handle crop (shrinking height to 50% from bottom)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :bottom :center? false :sx 1.0 :sy 0.5})]
+      (is (mth/close? 0.0 (-> res :transform :x)))
+      (is (mth/close? 0.0 (-> res :transform :y)))
+      (is (mth/close? 1.0 (-> res :transform :width)))
+      (is (mth/close? 2.0 (-> res :transform :height)))
+      (is (mth/close? 0.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Top-Right handle crop (shrinking both dimensions to 50%)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :top-right :center? false :sx 0.5 :sy 0.5})]
+      (is (mth/close? 0.0 (-> res :transform :x)))
+      (is (mth/close? -1.0 (-> res :transform :y)))
+      (is (mth/close? 2.0 (-> res :transform :width)))
+      (is (mth/close? 2.0 (-> res :transform :height)))
+      (is (mth/close? 0.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? -50.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Bottom-Left handle crop (shrinking both dimensions to 50%)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :bottom-left :center? false :sx 0.5 :sy 0.5})]
+      (is (mth/close? -1.0 (-> res :transform :x)))
+      (is (mth/close? 0.0 (-> res :transform :y)))
+      (is (mth/close? 2.0 (-> res :transform :width)))
+      (is (mth/close? 2.0 (-> res :transform :height)))
+      (is (mth/close? -100.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? 0.0 (-> res :rendered-pixel-rect :y)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width)))
+      (is (mth/close? 100.0 (-> res :rendered-pixel-rect :height)))))
+
+  (testing "Expanding bounds beyond original size (empty space exposure)"
+    (let [res (compute-bounds-resize-transform
+               {:width 200 :height 100 :handler :right :center? false :sx 2.0 :sy 1.0})]
+      (is (mth/close? 0.0 (-> res :transform :x)))
+      (is (mth/close? 0.0 (-> res :transform :y)))
+      (is (mth/close? 0.5 (-> res :transform :width)))
+      (is (mth/close? 1.0 (-> res :transform :height)))
+      ;; Rendered pixel content is 200px wide in a 400px container -> exposes 200px empty space
+      (is (mth/close? 0.0 (-> res :rendered-pixel-rect :x)))
+      (is (mth/close? 200.0 (-> res :rendered-pixel-rect :width))))))
+
+(deftest test-sequential-resize-operations
+  (testing "Sequential crops: crop right then crop left"
+    ;; Initial shape: 200x100, transform: {:x 0 :y 0 :width 1 :height 1}
+    ;; Step 1: Crop right handle from 200 to 150 (sx = 0.75)
+    (let [step1 (compute-bounds-resize-transform
+                 {:width 200 :height 100 :handler :right :center? false :sx 0.75 :sy 1.0})
+          tf1 (:transform step1)]
+      (is (mth/close? 0.0 (:x tf1)))
+      (is (mth/close? (/ 1.0 0.75) (:width tf1)))
+      ;; Step 2: Now shape is 150x100 with tf1. Crop left handle from 150 to 100 (sx = 100/150 = 2/3)
+      (let [step2 (compute-bounds-resize-transform
+                   {:width 150 :height 100 :handler :left :center? false :sx (/ 2.0 3.0) :sy 1.0 :transform tf1})
+            tf2 (:transform step2)]
+        ;; The final 100x100 container has bitmap with width 200px
+        (is (mth/close? 200.0 (-> step2 :rendered-pixel-rect :width)))
+        ;; The bitmap left edge is at -50px in the 100px container, so right edge is at -50 + 200 = 150px
+        (is (mth/close? -50.0 (-> step2 :rendered-pixel-rect :x))))))
+
+  (testing "Bounds resize followed by standard proportional scaling"
+    ;; Step 1: Bounds resize crops width from 200 to 100
+    (let [step1 (compute-bounds-resize-transform
+                 {:width 200 :height 100 :handler :right :center? false :sx 0.5 :sy 1.0})
+          tf1 (:transform step1)]
+      (is (mth/close? 2.0 (:width tf1)))
+      (is (mth/close? 1.0 (:height tf1)))
+
+      ;; Step 2: Standard proportional scale of the 100x100 cropped shape to 200x200 (scale 2x)
+      ;; During standard scale, normalized transform tf1 is kept constant!
+      (let [scaled-w (* 100.0 2.0)
+            scaled-h (* 100.0 2.0)
+            rendered-w (* (:width tf1) scaled-w)
+            rendered-h (* (:height tf1) scaled-h)]
+        ;; The underlying bitmap scaled from 200x100 to 400x200, matching the 2x scale of the cropped frame!
+        (is (mth/close? 400.0 rendered-w))
+        (is (mth/close? 200.0 rendered-h))))))
+
+(deftest test-proportion-lock-invariance
+  (testing "Shape proportion-lock attribute remains unchanged"
+    (let [shape {:id (uuid/custom 10)
+                 :type :rect
+                 :width 200
+                 :height 100
+                 :proportion-lock true
+                 :fills [{:fill-image {:id (uuid/custom 1)
+                                       :width 800
+                                       :height 600
+                                       :keep-aspect-ratio true}}]}
+          ;; Simulate bounds resize interaction
+          has-img? (boolean (or (some :fill-image (:fills shape)) (:fill-image shape)))
+          mod-pressed? true
+          bounds-resize? (and has-img? mod-pressed?)
+          lock-during-drag (if bounds-resize? false (:proportion-lock shape))]
+      ;; During drag, lock is bypassed (unless Shift is pressed)
+      (is (false? lock-during-drag))
+      ;; Shape's persistent setting is completely preserved
+      (is (true? (:proportion-lock shape))))))

common/test/common_tests/runner.cljc

@@ -29,6 +29,7 @@
    [common-tests.geom-flex-layout-test]
    [common-tests.geom-grid-layout-test]
    [common-tests.geom-grid-test]
+   [common-tests.geom-image-bounds-resize-test]
    [common-tests.geom-line-test]
    [common-tests.geom-modif-tree-test]
    [common-tests.geom-modifiers-test]
@@ -108,6 +109,7 @@
    'common-tests.geom-flex-layout-test
    'common-tests.geom-grid-layout-test
    'common-tests.geom-grid-test
+   'common-tests.geom-image-bounds-resize-test
    'common-tests.geom-line-test
    'common-tests.geom-modif-tree-test
    'common-tests.geom-modifiers-test

common/test/common_tests/types/path_data_test.cljc

@@ -1373,6 +1373,20 @@
     (t/is (= {:c2x 4.0 :c2y 4.0}
              (select-keys (:params (peek result)) [:c2x :c2y])))))
 
+(t/deftest segment-separate-single-node-closed-subpath-start
+  ;; The seam of a closed subpath opens even when it is the subpath start.
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}
+                  {:command :close-path :params {}}])
+        result  (vec (path/separate-nodes content #{(gpt/point 0.0 0.0)}))]
+    ;; the close command becomes the second, offset, open end
+    (t/is (= [:move-to :line-to :line-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 0.0} {:x 10.0 :y 0.0}
+              {:x 10.0 :y 10.0} {:x 8.0 :y 8.0}]
+             (mapv #(select-keys (:params %) [:x :y]) result)))))
+
 (t/deftest segment-separate-single-node-endpoint-noop
   ;; an endpoint node has no following segment, so nothing is split
   (let [content (path/content
@@ -2092,7 +2106,7 @@
       (t/is (some? result)))))
 
 (t/deftest path-merge-disconnected-nodes
-  ;; Merging separate subpaths joins them at the shared midpoint.
+  ;; Merging separate subpaths stitches them into one at the shared midpoint.
   (let [content (path/content
                  [{:command :move-to :params {:x 0.0 :y 0.0}}
                   {:command :line-to :params {:x 10.0 :y 0.0}}
@@ -2100,10 +2114,184 @@
                   {:command :line-to :params {:x 10.0 :y 10.0}}])
         pts     #{(gpt/point 10.0 0.0) (gpt/point 0.0 10.0)}
         result  (vec (path/merge-nodes content pts))]
-    (t/is (= [{:x 0.0 :y 0.0} {:x 5.0 :y 5.0}
-              {:x 5.0 :y 5.0} {:x 10.0 :y 10.0}]
+    (t/is (= [:move-to :line-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 0.0} {:x 5.0 :y 5.0} {:x 10.0 :y 10.0}]
              (mapv :params result)))))
 
+(t/deftest path-merge-nodes-leaves-a-single-node
+  ;; The merged node exists once, so separating it yields a fresh split.
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}
+                  {:command :move-to :params {:x 20.0 :y 0.0}}
+                  {:command :line-to :params {:x 12.0 :y 12.0}}])
+        merged  (path/merge-nodes content #{(gpt/point 10.0 10.0)
+                                            (gpt/point 12.0 12.0)})
+        node    (gpt/point 11.0 11.0)]
+    (t/is (= 1 (count (path/point-indices merged node))))
+    ;; separating splits the node in two ends, none of them the merged nodes
+    (let [result (vec (path/separate-nodes merged #{node} (gpt/point 8.0 8.0)))]
+      (t/is (= [{:x 0.0 :y 0.0} {:x 11.0 :y 11.0}
+                {:x 19.0 :y 19.0} {:x 20.0 :y 0.0}]
+               (mapv #(select-keys (:params %) [:x :y]) result))))))
+
+(t/deftest path-merge-nodes-on-empty-segment
+  ;; Merging across an empty segment returns a content instead of throwing
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 20.0 :y 0.0}}])]
+    (t/is (some? (path/merge-nodes content #{(gpt/point 0.0 0.0)
+                                             (gpt/point 20.0 0.0)})))))
+
+(t/deftest path-merge-coincident-nodes-stitches-dragged-ends
+  ;; Two open ends left at the same position become one node
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}
+                  {:command :move-to :params {:x 20.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}])
+        result  (vec (path/merge-coincident-nodes content #{(gpt/point 10.0 10.0)}))]
+    (t/is (= [:move-to :line-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 0.0} {:x 10.0 :y 10.0} {:x 20.0 :y 0.0}]
+             (mapv :params result)))))
+
+(t/deftest path-merge-coincident-nodes-drops-empty-segment
+  ;; A node dragged onto its neighbour leaves no segment behind
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 20.0 :y 0.0}}])
+        result  (vec (path/merge-coincident-nodes content #{(gpt/point 0.0 0.0)}))]
+    (t/is (= [:move-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 0.0} {:x 20.0 :y 0.0}] (mapv :params result)))))
+
+(t/deftest path-merge-coincident-nodes-closes-the-loop
+  ;; Dragging both ends of a subpath together closes it
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 0.0}}
+                  {:command :line-to :params {:x 0.0 :y 0.0}}])
+        result  (vec (path/merge-coincident-nodes content #{(gpt/point 0.0 0.0)}))]
+    (t/is (= [:move-to :line-to :close-path] (mapv :command result)))))
+
+(t/deftest path-merge-coincident-nodes-only-at-given-points
+  ;; Subpaths touching somewhere else are left alone
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}
+                  {:command :move-to :params {:x 20.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}])
+        result  (path/merge-coincident-nodes content #{(gpt/point 20.0 0.0)})]
+    (t/is (= (vec content) (vec result)))))
+
+(t/deftest path-merge-coincident-nodes-keeps-closed-subpaths
+  ;; Closed subpaths keep their close command, wherever the merge happens
+  (let [rect  (path/content
+               [{:command :move-to :params {:x 0.0 :y 0.0}}
+                {:command :line-to :params {:x 10.0 :y 0.0}}
+                {:command :line-to :params {:x 10.0 :y 10.0}}
+                {:command :line-to :params {:x 0.0 :y 10.0}}
+                {:command :close-path :params {}}])
+        curve (path/content
+               [{:command :move-to :params {:x 0.0 :y 0.0}}
+                {:command :curve-to :params {:c1x 2.0 :c1y 2.0 :c2x 8.0 :c2y 8.0
+                                             :x 10.0 :y 10.0}}
+                {:command :curve-to :params {:c1x 8.0 :c1y -8.0 :c2x 2.0 :c2y -2.0
+                                             :x 0.0 :y 0.0}}
+                {:command :close-path :params {}}])]
+    (t/is (= (vec rect) (vec (path/merge-coincident-nodes rect #{(gpt/point 10.0 0.0)}))))
+    (t/is (= (vec rect) (vec (path/merge-coincident-nodes rect #{(gpt/point 0.0 0.0)}))))
+    (t/is (= (vec curve) (vec (path/merge-coincident-nodes curve #{(gpt/point 0.0 0.0)}))))))
+
+(t/deftest path-merge-coincident-nodes-keeps-junctions
+  ;; Four distinct segments meeting at a point need one command each
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 5.0 :y 5.0}}
+                  {:command :line-to :params {:x 10.0 :y 0.0}}
+                  {:command :move-to :params {:x 0.0 :y 10.0}}
+                  {:command :line-to :params {:x 5.0 :y 5.0}}
+                  {:command :line-to :params {:x 10.0 :y 10.0}}])
+        result  (path/merge-coincident-nodes content #{(gpt/point 5.0 5.0)})]
+    (t/is (= (vec content) (vec result)))))
+
+(t/deftest path-merge-coincident-nodes-drops-a-retraced-segment
+  ;; The rest of the loop draws the same two lines backwards; dropping them
+  ;; leaves a single node where they meet.
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 5.0}}
+                  {:command :line-to :params {:x 20.0 :y 10.0}}
+                  {:command :curve-to :params {:c1x 20.0 :c1y 10.0
+                                               :c2x 10.0 :c2y 5.0
+                                               :x 10.0 :y 5.0}}
+                  {:command :close-path :params {}}])
+        result  (vec (path/merge-coincident-nodes content #{(gpt/point 10.0 5.0)}))]
+    (t/is (= [:move-to :line-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 0.0} {:x 10.0 :y 5.0} {:x 20.0 :y 10.0}]
+             (mapv :params result)))
+    (t/is (= 1 (count (path/point-indices result (gpt/point 10.0 5.0)))))))
+
+(t/deftest path-merge-coincident-nodes-stitches-a-retraced-junction
+  ;; The same two lines, drawn out and back from the subpath start
+  (let [content (path/content
+                 [{:command :move-to :params {:x 5.0 :y 5.0}}
+                  {:command :line-to :params {:x 10.0 :y 0.0}}
+                  {:command :line-to :params {:x 5.0 :y 5.0}}
+                  {:command :line-to :params {:x 0.0 :y 10.0}}
+                  {:command :close-path :params {}}])
+        result  (vec (path/merge-coincident-nodes content #{(gpt/point 5.0 5.0)}))]
+    (t/is (= [:move-to :line-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 10.0} {:x 5.0 :y 5.0} {:x 10.0 :y 0.0}]
+             (mapv :params result)))))
+
+(t/deftest path-merge-coincident-nodes-collapses-every-repeated-node
+  ;; Without points every position held by more than one command is merged
+  (let [content (path/content
+                 [{:command :move-to :params {:x 119.0 :y 231.0}}
+                  {:command :line-to :params {:x 447.0 :y 253.0}}
+                  {:command :curve-to :params {:c1x 447.0 :c1y 253.0
+                                               :c2x 774.0 :c2y 384.0
+                                               :x 774.0 :y 384.0}}
+                  {:command :curve-to :params {:c1x 774.0 :c1y 384.0
+                                               :c2x 447.0 :c2y 253.0
+                                               :x 447.0 :y 253.0}}
+                  {:command :close-path :params {}}])
+        result  (vec (path/merge-coincident-nodes content))]
+    (t/is (= [:move-to :line-to :curve-to] (mapv :command result)))
+    (t/is (= 1 (count (path/point-indices result (gpt/point 447.0 253.0)))))))
+
+(t/deftest path-merge-coincident-nodes-keeps-distinct-curves
+  ;; Two different curves between the same two points are not a retrace
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :curve-to :params {:c1x 2.0 :c1y 2.0 :c2x 8.0 :c2y 8.0
+                                               :x 10.0 :y 10.0}}
+                  {:command :curve-to :params {:c1x 8.0 :c1y -8.0 :c2x 2.0 :c2y -2.0
+                                               :x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 0.0 :y 20.0}}])
+        result  (path/merge-coincident-nodes content #{(gpt/point 0.0 0.0)})]
+    (t/is (= (vec content) (vec result)))))
+
+(t/deftest path-separate-nodes-after-merge-yields-one-end-per-line
+  ;; A node with two visible lines separates into two ends.
+  (let [content (path/content
+                 [{:command :move-to :params {:x 0.0 :y 0.0}}
+                  {:command :line-to :params {:x 10.0 :y 5.0}}
+                  {:command :line-to :params {:x 20.0 :y 10.0}}
+                  {:command :curve-to :params {:c1x 20.0 :c1y 10.0
+                                               :c2x 10.0 :c2y 5.0
+                                               :x 10.0 :y 5.0}}
+                  {:command :close-path :params {}}])
+        node    (gpt/point 10.0 5.0)
+        merged  (path/merge-coincident-nodes content #{node})
+        result  (vec (path/separate-nodes merged #{node} (gpt/point 4.0 4.0)))]
+    (t/is (= [:move-to :line-to :move-to :line-to] (mapv :command result)))
+    (t/is (= [{:x 0.0 :y 0.0} {:x 10.0 :y 5.0}
+              {:x 14.0 :y 9.0} {:x 20.0 :y 10.0}]
+             (mapv #(select-keys (:params %) [:x :y]) result)))))
+
 (t/deftest path-duplicate-node-content
   ;; Duplicating a node copies its incident segments as subpaths.
   (let [content (path/content

common/test/common_tests/types/tokens_status_test.cljc

@@ -2,7 +2,7 @@
 ;; License, v. 2.0. If a copy of the MPL was not distributed with this
 ;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
 ;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
+;; Copyright (c) KALEIDOS SUBSIDIARY SL
 
 (ns common-tests.types.tokens-status-test
   (:require

common/test/common_tests/types_shape_tree_test.cljc

@@ -0,0 +1,58 @@
+;; This Source Code Form is subject to the terms of the Mozilla Public
+;; License, v. 2.0. If a copy of the MPL was not distributed with this
+;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;;
+;; Copyright (c) KALEIDOS INC Sucursal en España SL
+
+(ns common-tests.types-shape-tree-test
+  (:require
+   [app.common.geom.point :as gpt]
+   [app.common.types.shape-tree :as ctt]
+   [app.common.uuid :as uuid]
+   [clojure.test :as t]))
+
+(defn- make-frame
+  [id parent-id shapes x y width height show-content]
+  {:id id
+   :type :frame
+   :parent-id parent-id
+   :frame-id parent-id
+   :shapes (vec shapes)
+   :x x
+   :y y
+   :width width
+   :height height
+   :rotation nil
+   :hidden false
+   :blocked false
+   :show-content show-content})
+
+(t/deftest top-nested-frame-clip-content-test
+  (t/testing "board A (clip) contains a wider board B; point inside both resolves to B"
+    (let [a-id     (uuid/next)
+          b-id     (uuid/next)
+          objects  {a-id (make-frame a-id uuid/zero [b-id] 0 0 200 200 false)
+                    b-id (make-frame b-id a-id [] 50 50 300 300 false)}
+          position (gpt/point 150 150)
+          result   (ctt/top-nested-frame objects position)]
+      (t/is (= b-id result))))
+
+  (t/testing "point inside B but outside A's clipped bounds is not reachable at all"
+    (let [a-id     (uuid/next)
+          b-id     (uuid/next)
+          objects  {a-id (make-frame a-id uuid/zero [b-id] 0 0 200 200 false)
+                    b-id (make-frame b-id a-id [] 50 50 300 300 false)}
+          position (gpt/point 300 300)
+          result   (ctt/top-nested-frame objects position)]
+      ;; Outside A (the clip ancestor) and B's visible/clipped region there is
+      ;; not visible either, so no frame should be resolved at that point.
+      (t/is (= uuid/zero result))))
+
+  (t/testing "with show-content true on A, the same point can resolve into B"
+    (let [a-id     (uuid/next)
+          b-id     (uuid/next)
+          objects  {a-id (make-frame a-id uuid/zero [b-id] 0 0 200 200 true)
+                    b-id (make-frame b-id a-id [] 50 50 300 300 false)}
+          position (gpt/point 300 300)
+          result   (ctt/top-nested-frame objects position)]
+      (t/is (= b-id result)))))

docs/package.json

@@ -39,5 +39,5 @@
     "markdown-it-anchor": "^9.2.1",
     "markdown-it-plantuml": "^1.4.1"
   },
-  "packageManager": "pnpm@12.0.0+sha512.9e2e3dc3911995868dc94b8175c217c27e95408fa03b4a22749778f2b34f773b77cdd3b39ede8171b22fcd53be6a35342e9fac9948a68ef58df6488ce89a7e67"
+  "packageManager": "pnpm@12.3.4+sha512.961aa41fb077da3a04a441d9f8e15ebc0c96da8ef710b2eb67bf9ee7cb0610eabd48f1fd85f51cffe73846785fa0f87c56a3a872a1d893f8446741b5cce45457"
 }

docs/pnpm-lock.yaml

@@ -7,96 +7,96 @@ importers:
     configDependencies: {}
     packageManagerDependencies:
       pnpm:
-        specifier: 12.0.0
-        version: 12.0.0
+        specifier: 12.3.4
+        version: 12.3.4
 
 packages:
 
-  '@pnpm/exe.darwin-arm64@12.0.0':
-    resolution: {integrity: sha512-sqeoPfVMIfQhbwzDrKraXY2ynyuWClFqzvfImzAS/yczEru1m5SGvQ9kgFPDvQzJZ9AetedgJeDZC6qYvH8/tQ==}
+  '@pnpm/exe.darwin-arm64@12.3.4':
+    resolution: {integrity: sha512-PAyUol8T1+/+ViOiXAt51ECA+QnfXCqz6foL4bW+LsoX0NcVd5XVEM2mRQu+LV4oc7uRz9zf9U0P+XFfuQeDAw==}
     cpu: [arm64]
     os: [darwin]
 
-  '@pnpm/exe.darwin-x64@12.0.0':
-    resolution: {integrity: sha512-Quc3J6c9cGTy+LDgz1cLVgCNOU9IERuyAlDoEj0DCilKqvo50Jx1GV8k74iwn4J9fFSKkm8JrwNvtTDj3uWnUA==}
+  '@pnpm/exe.darwin-x64@12.3.4':
+    resolution: {integrity: sha512-fxP9JCk0Cdye+ePuj+GJJLMUMTqHGWRdb1dtv4How876uQ2ehxvenpgiYAir/ceO9PsYUZkFTtyZdx+rRu5QOA==}
     cpu: [x64]
     os: [darwin]
 
-  '@pnpm/exe.linux-arm64-musl@12.0.0':
-    resolution: {integrity: sha512-EVWd3OTmgsMFhXx69b5JxIzoabG9Ma7m4OeTaf0ZKBzMnfYi8u21NDQo92ToMrdYL5dYDDCHsyYIjXzk+d0HhA==}
+  '@pnpm/exe.linux-arm64-musl@12.3.4':
+    resolution: {integrity: sha512-FBOt0/7ye6O6q4AllVV5QMviB6qE6fqkeczV/+MDWQsmo+QJrlfsh6X7CpH/tClVpBZEyIbjpUoT8bNhCYBxEg==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@pnpm/exe.linux-arm64@12.0.0':
-    resolution: {integrity: sha512-cXHHW8M4rAPsYNkKZO9WVcpLLK55i9EaIsZPfIqUuY2eopd5LqnFyBge54HCh1GC0yCX8ySn0hYIi+4OyAEoDg==}
+  '@pnpm/exe.linux-arm64@12.3.4':
+    resolution: {integrity: sha512-t71AVA7LRqiKTyZ5xMYaZc2n5DfdpMbfokZuiIOXHBOM03ECnF0t4iYwaBDqJgVjlKYUOwaF/bRQajGNA4cJ4w==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@pnpm/exe.linux-x64-musl@12.0.0':
-    resolution: {integrity: sha512-UcXwMdFjly0mpddkGigHKTxe27IMv2fUK4IWW/MHmJ3yMguxXmkwNlEI4aE+G1HO2TLo20uNEUWD4ymLe/DaCQ==}
+  '@pnpm/exe.linux-x64-musl@12.3.4':
+    resolution: {integrity: sha512-RPmk7Jb/aYaFvL2iyDN/AtMY+hUEsue732WmXpcuQ9tBpMnGyA5py7Z3+e+qmQaJ0zY/4ni9jJiyPBQHujmv6w==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@pnpm/exe.linux-x64@12.0.0':
-    resolution: {integrity: sha512-6Rsl+zEWMOmus7v7/9J3OE8EMvHyNAfxYmDfmhQG4J0985OuT3G3Ho9NSGHjkBn4aU4bgklWifRhe1HX8dUSyw==}
+  '@pnpm/exe.linux-x64@12.3.4':
+    resolution: {integrity: sha512-2ZqOlSPkfwX1h5cR+FPiWf8+F+2hZT/3TvhUK5sigHqwaQCIiq8R7CGxhndKs63JtcLi2a1Qpo+wX/EoyfjyJQ==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@pnpm/exe.win32-arm64@12.0.0':
-    resolution: {integrity: sha512-O5F76A4oVFrpDGdFxEszRIThOSBfjHdH5c006gR+7UTCfiXrukr1XfqPungUI1DXcSR5gb9jBsPQqQZOAoOOxw==}
+  '@pnpm/exe.win32-arm64@12.3.4':
+    resolution: {integrity: sha512-ANyrHqyqco6SXBysUTRF74itDyyraea7IbFsKFdNXTjcFnfycTDx37EwuhdpPYFNSIh2JhUG4fByclsRfiHX7w==}
     cpu: [arm64]
     os: [win32]
 
-  '@pnpm/exe.win32-x64@12.0.0':
-    resolution: {integrity: sha512-5dKFajIEWJ1ai+KHXFJvskY6vchbunmLwSUV2ywbLymcmJjfY5XJVpgzPCyIoVCMVG0zHorr66+hM8h8b3aRfQ==}
+  '@pnpm/exe.win32-x64@12.3.4':
+    resolution: {integrity: sha512-WH/KqBPY/hq2Tb7SgQltEZytimcjgKRaCRL/aM9CI0c67iKc5TVmHUhIiL3Ux9FB4bWn36i6XewUcScQI+zG8w==}
     cpu: [x64]
     os: [win32]
 
-  pnpm@12.0.0:
-    resolution: {integrity: sha512-ni49w5EZlYaNyUuBdcIXwn6VQI+gO0oidJd48rNPdzt3zdOznt6BcbIvzVO+ajU0Lp+smUimjvWN9kiM6Jp+Zw==}
+  pnpm@12.3.4:
+    resolution: {integrity: sha512-lhqkH7B32joEpEHZ+OFevAyW2o73ELLrZ7+e58sGEOq9SPH9hfUc/+c4RnhfoPh8VqOocqHYk/hEZ0G1zORUVw==}
     engines: {node: '>=18.*'}
     hasBin: true
 
 snapshots:
 
-  '@pnpm/exe.darwin-arm64@12.0.0':
+  '@pnpm/exe.darwin-arm64@12.3.4':
     optional: true
 
-  '@pnpm/exe.darwin-x64@12.0.0':
+  '@pnpm/exe.darwin-x64@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-arm64-musl@12.0.0':
+  '@pnpm/exe.linux-arm64-musl@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-arm64@12.0.0':
+  '@pnpm/exe.linux-arm64@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-x64-musl@12.0.0':
+  '@pnpm/exe.linux-x64-musl@12.3.4':
     optional: true
 
-  '@pnpm/exe.linux-x64@12.0.0':
+  '@pnpm/exe.linux-x64@12.3.4':
     optional: true
 
-  '@pnpm/exe.win32-arm64@12.0.0':
+  '@pnpm/exe.win32-arm64@12.3.4':
     optional: true
 
-  '@pnpm/exe.win32-x64@12.0.0':
+  '@pnpm/exe.win32-x64@12.3.4':
     optional: true
 
-  pnpm@12.0.0:
+  pnpm@12.3.4:
     optionalDependencies:
-      '@pnpm/exe.darwin-arm64': 12.0.0
-      '@pnpm/exe.darwin-x64': 12.0.0
-      '@pnpm/exe.linux-arm64': 12.0.0
-      '@pnpm/exe.linux-arm64-musl': 12.0.0
-      '@pnpm/exe.linux-x64': 12.0.0
-      '@pnpm/exe.linux-x64-musl': 12.0.0
-      '@pnpm/exe.win32-arm64': 12.0.0
-      '@pnpm/exe.win32-x64': 12.0.0
+      '@pnpm/exe.darwin-arm64': 12.3.4
+      '@pnpm/exe.darwin-x64': 12.3.4
+      '@pnpm/exe.linux-arm64': 12.3.4
+      '@pnpm/exe.linux-arm64-musl': 12.3.4
+      '@pnpm/exe.linux-x64': 12.3.4
+      '@pnpm/exe.linux-x64-musl': 12.3.4
+      '@pnpm/exe.win32-arm64': 12.3.4
+      '@pnpm/exe.win32-x64': 12.3.4
 
 ---
 lockfileVersion: '9.0'

docs/pnpm-workspace.yaml

@@ -1,3 +1,5 @@
+storeDir: ../.pnpm-store
+
 minimumReleaseAgeExclude:
   - undici@7.28.0 || 7.29.0
   - js-yaml@3.15.0 || 4.3.0

docs/user-guide/account-teams/comments.njk

@@ -1,6 +1,6 @@
 ---
 title: Comments
-order: 4
+order: 6
 desc: Learn how to import and export files in Penpot, the free, open-source design tool. Discover file formats, backups, sharing, and library management.
 ---
 

docs/user-guide/account-teams/enterprise-plan.njk

@@ -0,0 +1,35 @@
+---
+title: Enterprise plan
+order: 2
+desc: Learn how the Enterprise plan works in Penpot. Discover its features and how to use it within your organization.
+---
+
+<h1 id="enterprise">Enterprise plan</h1>
+<p class="main-paragraph">Penpot Enterprise gives organizations the tools to govern how design work happens across their teams: from creating a structured org and managing members, to applying fine-grained permissions and configuration through the Admin Console.</p>
+
+<h3 id="what-is-penpot-enterprise">What is Penpot Enterprise?
+</h3>
+<p>Penpot Enterprise is the plan that unlocks organizational governance features. While Penpot remains free and unlimited as an open-source platform, Enterprise adds a layer of control on top: the ability to create Organizations, manage teams under it, and apply configuration settings that define what members can and cannot do.</p>
+<p>The organization owner is the user who creates the organization. They have exclusive access to the Admin Console and are responsible for configuring Modules.</p>
+<p>The key concepts you'll work with:</p>
+<ul>
+  <li><strong><a href="/user-guide/account-teams/organizations/">Organization</a>:</strong> the top-level structure that groups one or more Teams under a shared governance layer.</li>
+  <li><strong><a href="/user-guide/account-teams/organizations/#the-admin-console">Admin Console</a>:</strong> the back-office interface where the org owner manages settings, teams and members.</li>
+  <li><strong><a href="/user-guide/account-teams/organizations/#modules-and-controls">Modules</a>:</strong> the paid, configurable capabilities applied to an organization. Each Module consists of individual Controls (specific settings or restrictions).</li>
+</ul>
+
+<h3 id="subscribing-to-enterprise">Subscribing to Enterprise
+  <a class="direct-link" href="#subscribing-to-enterprise">#</a>
+</h3>
+<p>To create an organization, you first need to upgrade to the <a href="https://penpot.app/pricing" target="_blank">Enterprise plan</a>. Click "Create Organization" to begin. Once the subscription process is complete, you'll be redirected to the Admin Console to finish creating your organization.</p>
+
+<h3 id="frequently-asked-questions"> Frequently asked questions
+  <a class="direct-link" href="#frequently-asked-questions">#</a>
+</h3>
+
+  <h4>Can I have multiple organizations?</h4>
+  <p>Yes. You can create more than one organization under a single Enterprise subscription and manage them from the Admin Console.</p>
+
+  <h4>What happens if I cancel my Enterprise subscription?</h4>
+  <p>Your organizations are deleted but not their teams. Governance settings no longer apply to any of them.</p>
+

docs/user-guide/account-teams/index.njk

@@ -13,7 +13,19 @@ desc: Begin with the Penpot user guide! Get quickstarts, shortcuts, and tutorial
       <p>Access your account settings and manage personal access tokens</p>
     </a>
   </li>
-    <li>
+  <li>
+    <a href="/user-guide/account-teams/enterprise-plan/">
+      <h2>Enterprise plan →</h2>
+      <p>Learn how the Enterprise plan works and what it includes</p>
+    </a>
+  </li>
+  <li>
+    <a href="/user-guide/account-teams/organizations/">
+      <h2>Organizations →</h2>
+      <p>Create and manage organizations, the Admin Console, and SSO</p>
+    </a>
+  </li>
+  <li>
     <a href="/user-guide/account-teams/teams">
       <h2>Teams →</h2>
       <p>Create and manage your teams</p>