Release v0.86.0 — Editor revamp (2026-10-10)

The visual template editor gets a full design and usability pass, plus fixes for about 120 defects found in an audit of the shell, canvas, properties panel, outline and preview. This release also carries the operator-only self-serve commerce surface (off by default) and npm publishing fixes. No API, template-format, or configuration changes for existing deployments. Upgrading is a straight image swap.

Upgrade

Pull ghcr.io/troycoderboy/pulp-engine:v0.86.0 (and the -worker / -controller images if you run RENDER_MODE=container or socket). No migrations, env-var changes, or template changes are required. The editor is bundled in the API image at /editor/, so it updates with the image.

Editor UI state stored in the browser (sidebar collapse, preview width, theme) carries over. One new per-browser setting, canvas zoom, defaults to Fit.

Editor — what changed

• Design system. An indigo primary colour that matches the Pulp Engine brand, refined neutrals, the Inter typeface (bundled; no external font requests), thin scrollbars and consistent buttons, inputs, menus, dialogs and tooltips. In dark mode the page stays white, like paper; previously sections rendered as dark cards on the white page.
• Header. The template name now shows a plain save state (“Published”, “Unpublished changes”, “Local draft”). It also adds a command-menu launcher (Ctrl/Cmd+K), an issues badge coloured by severity, and an account menu with a labelled Sign out, which is now always available while signed in. The Publish/Update button no longer shows a * marker.
• Canvas. A zoom control (Fit by default, with a 60% minimum, after which the canvas scrolls) means the page is no longer cut off on laptop screens or when the preview is docked. Other canvas changes:
  • {{bindings}} render as pills.
  • Drag and drop shows an exact insertion line.
  • Text uses the renderer’s document font, so line breaks match the preview.
  • Positioned, table-of-contents and template-reference blocks can now be selected, moved and deleted on the canvas.
• Blocks panel. A searchable icon grid. Clicking a block inserts it right after the current selection rather than at the end of the section.
• Inspector. Sticky tabs and a node header showing type, label and a copyable ID. The Document tab opens on page setup.
• New template. The dialog is two-pane, so Create is always visible. The key fills in from the name until you edit it.
• Command menu. Adds icons, shortcuts, insert-block, zoom and theme commands. Previously every item rendered as disabled.
• Preview. HTML renders at true page width, scaled to fit, and keeps its scroll position on refresh. Exports sit under a Download menu.

Editor — fixes

Data loss and correctness

• Dragging a block into a column or sticky header deleted it.
• The column and sticky-header “Add block” controls did nothing.
• Find & Replace could overwrite the wrong block, and it replaced fewer matches than it counted.
• Escape in inline text editing saved the edit instead of cancelling it.
• Some inspector fields lost focus or dropped keystrokes while typing: table columns, data-source headers, schema fields, and JSON and number inputs.
• Each keystroke was a separate undo step. Rapid edits to one field are now a single step, and edits that change nothing no longer mark the template as unsaved.
• The expression builder could save expressions the renderer rejects.

Keyboard and selection

• Ctrl/Cmd+click and Shift+click multi-select never worked.
• Ctrl+Shift+Z (redo) did nothing on Windows.
• Backspace in a properties-panel dropdown deleted the selected block.
• Ctrl+K could not close the command menu.

Sessions, drafts and errors

• Draft recovery at startup ran before sign-in. In multi-tenant mode it could list drafts saved under a different tenant on a shared browser.
• Reloading the editor with no template open showed a “Leave site?” prompt.
• A rendering error in one tab disabled the canvas in every tab until a page reload.
• Save errors disappeared after three seconds.

Preview and outline

• The docked preview never showed render errors.
• Editing while a download or PDF proof was in progress silently cancelled it.
• The outline forgot which branches were collapsed. It also could not be operated from the keyboard, and it hid the children of positioned blocks and sticky headers.

Accessibility and dark mode

• Missing labels added, focus now moves to a neighbouring block after a delete, the outline exposes tree semantics, and controls work from the keyboard.
• Dark-mode colours fixed in schedules, version history, diff and preview.

Commerce surface (operator-only)

Self-serve purchase infrastructure ships in the image but is disabled unless COMMERCE_ENABLED=true (default false). With the flag off, no /commerce/* routes register, no commerce tables are created, and no Paddle, AWS or SMTP calls are made. Enabling it also requires STORAGE_MODE=postgres and the full Paddle, AWS KMS and licence SMTP configuration; otherwise the server refuses to start. Customer deployments need no action. (#110)

Licence verification

The baked Ed25519 public key that verifies PULP_LICENCE_KEY tokens now matches the AWS KMS key that signs commercial licences. The cutover was made while no tokens signed with the previous key were outstanding, so no licence re-issue is required. The verifier still works fully offline. (#110)

Release tooling

npm publishing now requires npm ≥ 11.5.1 for Trusted Publishing, and package repository.url fields point at the renamed GitHub repository (#126, #127). Whether npm accepts OIDC publishing still depends on the trusted-publisher settings on npmjs.com.

Validation

CI-verified: the release.yml check-ci gate requires a green push-CI run on the release commit (ci, test-file-mode, test-sqlserver, test-e2e, test-e2e-auth, Docker build + smoke, Windows installer, evaluation bundle).

Locally verified (Windows 11):

• Editor unit tests: 126 files, 1784 passed, 1 skipped. On v0.85.1 the same suite had 1470 passed and 2 failing.
• tsc --noEmit and eslint src pass for the editor. The editor production build (main app, embed and form bundles) succeeds.
• Playwright end-to-end tests against Chrome: main suite 25/25 and auth suite 7/7.
• scripts/check-version.mjs and scripts/check-encoding.sh pass.

Not verified locally: the full API, SQL Server and HA suites. They run in CI and the HA nightly. This release changes no API code apart from #110, which was CI-verified when it merged.