chore: re-sync vendored configurator core from SLASHED main (PR-SYNC)

[jackgranatowski]

Summary

Wave 1 of SLASHED-Plugins' technical-debt audit remediation — the vendored-source catch-up job that PR-C1's --check mode (#136) has been reporting as drift for this entire remediation effort, now unblocked since SLASHED's own audit PRs merged to main via #474.

admin-app/src/ and framework-css/core/ were still vendored at a pre-audit snapshot — predating all of SL-001 through SL-034 (de-obfuscated codec.ts, typed ApiIndex/TokenRegistry, the lucide-svelte→@lucide/svelte migration, rAF-coalesced PreviewPanel.svelte drag updates, the 'error' save state, shape-guarded localStorage reads, etc.).

Ran npm run sync against the current SLASHED checkout (verified byte-identical to origin/main for configurator/src and badges/ beforehand), then rebuilt assets/admin-app/ per this repo's committed-build-output convention. plugin-main.ts/AppOverlay.svelte (.syncignore-protected, plugin-specific) already matched the new API from the Wave 0 hotfix — no changes needed there.

Verification

• sync-core.mjs --check: reported the expected 17 stale files beforehand, reports zero drift afterward.
• npm run check (svelte-check): no new errors (the one remaining error, plugin-main.ts's .ts import extension, is pre-existing and unrelated to this sync).
• npm run build: succeeds, 216 modules.
• npm test: 95/95 passing.
• npm run lint: clean.
• Spot-checked the diff against known SL-fixes (e.g., codec.ts's 304-line de-obfuscation, App.svelte's lucide-svelte→@lucide/svelte + fa→generateCSS + any→ApiIndex typing) — all match expectations, no corruption.

Type

• chore

Checklist

• Conventional Commit messages
• npm test passes
• npm run lint passes
• npm run verify passes
• Generated artifacts not hand-edited (this PR's diff is the generated/vendored artifact, produced entirely by npm run sync)
• CHANGELOG.md updated — internal vendoring catch-up, no plugin-facing behavior change
• Built SPA assets committed (assets/admin-app/app.js/app.css rebuilt from the newly-synced source)

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c4103d62-8657-428f-8e52-ecc79f074e80

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/plugins-pr-sync-catchup

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Re-sync vendored SLASHED configurator core and rebuild admin SPA assets

✨ Enhancement 🕐 40+ Minutes

AI Description

• Re-vendor SLASHED configurator sources to eliminate sync drift against upstream main.
• Adopt upstream audit fixes: typed JSON shapes, safer persistence, and updated share/codec APIs.
• Improve preview performance and UX with rAF-coalesced iframe updates and save error state.

Diagram

graph TD
  A["Admin SPA"] --> B["App.svelte"] --> C["persistence.ts"] --> D["codec.ts"]
  C --> S[("LocalStorage/Hash")]
  B --> P["PreviewPanel.svelte"] --> R["previewResolver"] --> I["Preview iframe"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Git subtree/submodule for SLASHED sources

• ➕ Makes upstream tracking explicit and reduces ad-hoc sync drift
• ➕ Preserves upstream history for easier blame/patching
• ➖ Adds workflow/CI complexity for contributors
• ➖ Submodule UX is often painful for consumers and release packaging

2. Publish/configure SLASHED configurator as an NPM dependency

• ➕ Removes large vendored diffs and simplifies upgrades
• ➕ Enables semver-pinned updates and integrity via lockfile
• ➖ May not fit this repo’s “committed build output” convention
• ➖ Harder to patch locally for plugin-specific needs without forking

3. Stop committing built SPA assets; build on release/CI only

• ➕ Avoids large generated diffs and merge conflicts
• ➕ Review focuses on source changes only
• ➖ Conflicts with current distribution expectations for this plugin
• ➖ Requires release pipeline changes and artifact hosting strategy

Recommendation: Given the repo’s established vendoring + committed-build-output convention, the current sync approach is appropriate and keeps consumers deterministic. If drift continues to be a recurring cost, a git subtree (not submodule) is the most pragmatic next step: it keeps vendored code in-tree while making upstream updates more structured.

Files changed (20) +408 / -264

Enhancement (4) +163 / -58

App.svelteAdopt upstream codec API, typed ApiIndex, and save error state +8/-8

Adopt upstream codec API, typed ApiIndex, and save error state

• Migrates lucide imports to '@lucide/svelte', switches CSS export to 'generateCSS()', and replaces 'any' JSON casting with 'ApiIndex'. Extends save state to include ''error'' and preserves correct transitions after failed saves.

SLASHED-for-WP/admin-app/src/App.svelte

PreviewPanel.svelteCoalesce preview iframe DOM writes with rAF and update codec usage +84/-46

Coalesce preview iframe DOM writes with rAF and update codec usage

• Migrates lucide imports and replaces CSS generation with 'generateCSS()'. Introduces requestAnimationFrame coalescing for iframe style/attribute writes to reduce per-input churn, skips split-mode scheduling when disabled, and avoids unnecessary/double preview version bumps.

SLASHED-for-WP/admin-app/src/components/shell/PreviewPanel.svelte

StudioHeader.svelteAdd save failure UI state +9/-4

Add save failure UI state

• Extends accepted 'saveState' to include ''error'' and renders a dedicated error styling/icon (AlertTriangle) with a retry-focused tooltip.

SLASHED-for-WP/admin-app/src/components/shell/StudioHeader.svelte

types.tsAdd typed shapes for generated indices and codec options +62/-0

Add typed shapes for generated indices and codec options

• Introduces interfaces for 'ApiIndex', 'ClassIndex', and 'TokenRegistry' JSON outputs plus 'DecodeOptions'/'ShareOptions', replacing multiple 'any' casts across the app.

SLASHED-for-WP/admin-app/src/types.ts

Bug fix (1) +9 / -5

persistence.tsHarden override loading and align with new codec exports +9/-5

Harden override loading and align with new codec exports

• Switches to the renamed codec helpers and generates live preview CSS via 'generateCSS()'. Adds shape-guarded localStorage parsing via 'isStringRecord()' and updates hash-share parsing to the new share reader.

SLASHED-for-WP/admin-app/src/lib/persistence.ts

Refactor (8) +165 / -166

DomainPanel.svelteMigrate lucide imports to @lucide/svelte +1/-1

Migrate lucide imports to @lucide/svelte

• Updates icon imports to match the upstream package rename.

SLASHED-for-WP/admin-app/src/components/DomainPanel.svelte

CheatsheetPanel.svelteTighten types for generated class/token indices +5/-4

Tighten types for generated class/token indices

• Migrates lucide imports and replaces 'any' usage with 'SlashedClass' typing for safer filtering and derived lists.

SLASHED-for-WP/admin-app/src/components/panels/CheatsheetPanel.svelte

ExportPanel.svelteUse renamed codec helpers for CSS and share URLs +4/-4

Use renamed codec helpers for CSS and share URLs

• Migrates lucide imports and updates export/share logic to call 'generateCSS()' and 'buildShareUrl()' instead of legacy aliases.

SLASHED-for-WP/admin-app/src/components/panels/ExportPanel.svelte

HomePanel.svelteMigrate lucide imports to @lucide/svelte +1/-1

Migrate lucide imports to @lucide/svelte

• Updates icon imports to the upstream '@lucide/svelte' package.

SLASHED-for-WP/admin-app/src/components/panels/HomePanel.svelte

ThemesPanel.svelteMigrate lucide imports to @lucide/svelte +1/-1

Migrate lucide imports to @lucide/svelte

• Updates icon imports to the upstream '@lucide/svelte' package.

SLASHED-for-WP/admin-app/src/components/panels/ThemesPanel.svelte

SidebarNav.svelteMigrate lucide imports to @lucide/svelte +1/-1

Migrate lucide imports to @lucide/svelte

• Updates icon imports to the upstream '@lucide/svelte' package.

SLASHED-for-WP/admin-app/src/components/shell/SidebarNav.svelte

codec.tsDe-obfuscate and type codec/share/CSS generation APIs +151/-153

De-obfuscate and type codec/share/CSS generation APIs

• Replaces minified symbol names with readable functions/constants, adds explicit CODEC/SHARE constants, and introduces typed options for decode/share paths. Renames exported helpers (encode/decode/generateCSS/parseCSS/share URL builders) and preserves safety checks and limits with clearer intent.

SLASHED-for-WP/admin-app/src/lib/codec.ts

savedThemes.tsExport isStringRecord for reuse +1/-1

Export isStringRecord for reuse

• Exports the record-shape guard so other modules (persistence) can validate localStorage payloads safely.

SLASHED-for-WP/admin-app/src/lib/savedThemes.ts

Documentation (4) +46 / -10

layout.cssClarify container-query breakpoint constraints and section headings +16/-3

Clarify container-query breakpoint constraints and section headings

• Adds upstream documentation noting '@container' conditions cannot use 'var()' breakpoints and introduces clearer section comments. Removes a redundant inline note now covered by the header comment.

SLASHED-for-WP/admin-app/framework-css/core/layout.css

themes.cssDocument section-level theming formula duplication +6/-1

Document section-level theming formula duplication

• Adds upstream notes explaining why the clamp() derivation logic is duplicated outside 'light-dark()' for section-level theming.

SLASHED-for-WP/admin-app/framework-css/core/themes.css

tokens.cssImprove theming flag documentation and formula cross-reference +16/-6

Improve theming flag documentation and formula cross-reference

• Clarifies the contract of '--sf-is-dark' as internal-only and distinguishes it from public '--sf-is-*' flags. Adds a cross-reference noting the same color derivation formula is duplicated in themes.css.

SLASHED-for-WP/admin-app/framework-css/core/tokens.css

previewResolver.svelte.tsDocument module-scoped preview version design +8/-0

Document module-scoped preview version design

• Adds upstream rationale for keeping 'previewVersion' module-level and wrapped in an object for Svelte rune reactivity.

SLASHED-for-WP/admin-app/src/lib/previewResolver.svelte.ts

Other (3) +25 / -25

.vendored-manifest.jsonBump vendored sync timestamp +1/-1

Bump vendored sync timestamp

• Updates the recorded 'syncedAt' timestamp to reflect the new upstream resync snapshot.

SLASHED-for-WP/admin-app/.vendored-manifest.json

app.cssRebuild compiled admin CSS bundle +1/-1

Rebuild compiled admin CSS bundle

• Updates the committed build artifact to match the newly-synced upstream sources and styling changes.

SLASHED-for-WP/assets/admin-app/app.css

app.jsRebuild compiled admin JS bundle +23/-23

Rebuild compiled admin JS bundle

• Updates the committed build artifact to match the newly-synced upstream sources (module graph/output changed, but functional source diffs are in 'admin-app/src').

SLASHED-for-WP/assets/admin-app/app.js

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (1) 📜 Skill insights (0)

Context used

✅ Compliance rules (platform): 1 rule

1. Extra rAF scheduling ✗ Dismissed 🐞 Bug ➹ Performance

Description

PreviewPanel now schedules requestAnimationFrame on every reactive rerun even when the iframe(s) are
not ready (loadCount is 0 or iframe refs are null), because the readiness guard is inside the rAF
callback. This adds avoidable scheduling/cancel overhead during initial load and mode toggles (even
though the callback returns immediately).

Code

SLASHED-for-WP/admin-app/src/components/shell/PreviewPanel.svelte[R496-506]

  $effect(() => {
    const _ov = overrides;
    const _theme = previewTheme;
    const _count = loadCount;
    const _lock = lumlockerPreview.value;

-    const iframe = iframeEl;
-    if (_count === 0 || !iframe) return;
-    const doc = iframe.contentDocument;
-    if (!doc) return;
+    const rafId = requestAnimationFrame(() => {
+      const iframe = iframeEl;
+      if (_count === 0 || !iframe) return;
+      const doc = iframe.contentDocument;
+      if (!doc) return;

Relevance

⭐⭐ Medium

No prior accepted/rejected reviews about rAF readiness-guard placement in PreviewPanel; unclear if
team will change.

PR-#122
PR-#125

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The effect queues rAF before any readiness check, and the file’s own comment notes this effect
reruns on every override tick; therefore, during periods where the iframe isn’t loaded yet, each
rerun still schedules a frame that can only no-op in the callback.

SLASHED-for-WP/admin-app/src/components/shell/PreviewPanel.svelte[484-506]
SLASHED-for-WP/admin-app/src/components/shell/PreviewPanel.svelte[502-506]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`PreviewPanel.svelte` schedules `requestAnimationFrame` unconditionally in its `$effect` blocks, then immediately returns in the callback if the iframe/load counters aren’t ready. This still queues (and often cancels) frames on every reactive rerun, creating unnecessary overhead.

## Issue Context
The intent of the change (rAF-coalescing DOM writes) is good, but we can avoid scheduling at all when there is nothing to apply.

## Fix Focus Areas
- SLASHED-for-WP/admin-app/src/components/shell/PreviewPanel.svelte[496-546]

## How to fix
- In the single-iframe effect, add an early return *before* calling `requestAnimationFrame` when `loadCount === 0` or `iframeEl` is null.
 - Example shape:
   - `const iframe = iframeEl; if (_count === 0 || !iframe) return;`
   - then schedule rAF and inside only check `contentDocument`.
- In the split-iframe effect, similarly avoid scheduling when neither pane can possibly apply (e.g., both load counts are 0 or both iframe refs are null).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Modified admin-app/src/App.svelte 📘 Rule violation § Compliance

Description

SLASHED-for-WP/admin-app/src/App.svelte is listed as a vendored file in
SLASHED-for-WP/admin-app/.vendored-manifest.json, but it is modified in this PR. This violates the
rule that files listed in the vendored manifest must not be added/edited/deleted in this
repository’s PRs.

Code

SLASHED-for-WP/admin-app/src/App.svelte[R3-4]

+  import { SlidersHorizontal, Eye, RotateCcw } from '@lucide/svelte';
+  import type { PreviewTemplate, SlashedToken, ApiIndex } from './types';

Relevance

⭐ Low

Vendored files (incl. App.svelte) are routinely modified in sync PRs; policy not enforced during
re-syncs.

PR-#122
PR-#124
PR-#127

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The vendored manifest lists src/App.svelte as a vendored file, and the PR modifies
SLASHED-for-WP/admin-app/src/App.svelte (e.g., changing imports at the top of the file), which the
rule forbids for any file path present in the manifest.

Rule 1514148: Do not modify vendored files listed in .vendored-manifest.json
SLASHED-for-WP/admin-app/.vendored-manifest.json[14-17]
SLASHED-for-WP/admin-app/src/App.svelte[1-10]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
Files tracked as vendored in `SLASHED-for-WP/admin-app/.vendored-manifest.json` were modified in this PR, which is disallowed by the compliance checklist.

## Issue Context
The vendored manifest explicitly marks `src/App.svelte` (and other paths) as vendored from the upstream framework repo and not editable directly in this repository.

## Fix Focus Areas
- SLASHED-for-WP/admin-app/src/App.svelte[3-4]
- SLASHED-for-WP/admin-app/.vendored-manifest.json[14-17]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---