Feature/2026 04 11 (#2)

* feat: add font sources and update CSP for improved styling and security

* feat: implement map resizing functionality in MapCanvas and update MapPanel to handle map options

* refactor: improve readability of map resizing calculations in MapCanvas

* feat: enhance map resizing interaction with hover effects and improved delta calculation

* refactor: simplify background property formatting for resize grips in MapCanvas

* refactor: enhance pixel manipulation functions for better blending and clearing in image editor

* feat: enhance object properties handling and improve pencil tool functionality in image editor

* refactor: streamline import statements and improve formatting in ObjectPropertiesDialog

* feat: implement delete functionality for selected tiles, objects, and layers in MapPanel

* refactor: improve code readability by formatting conditional statements and expressions in MapPanel

* feat: add brush and blur size options to ToolSidebar and EditorToolbar

Co-authored-by: Copilot <copilot@github.com>

* feat: implement canvas resizing functionality and enhance image editor history management

* feat: Implement text object functionality and editor

- Refactored ObjectsPanel to use ObjectPropertiesDialogManager for managing object properties.
- Added support for text objects in the project, including rendering, editing, and properties management.
- Introduced TextObjectEditorOverlay for editing text objects directly on the canvas.
- Created utility functions for handling text object properties and rendering.
- Enhanced drawMapObjects to include text object rendering.
- Added local font loading capabilities and presets for text objects.
- Updated project normalization to include text object properties.
- Introduced hooks for managing text object editing state.
- Expanded type definitions to accommodate new text object features.

Co-authored-by: Copilot <copilot@github.com>

* refactor: improve code formatting and readability across multiple files

* feat: add context menu functionality for map canvas with object editing options

Co-authored-by: Copilot <copilot@github.com>

* feat: enhance project import/export functionality with support for image layers and layer groups

* refactor: improve code formatting for better readability in remapping functions

* feat: Refactor map geometry handling and improve scene interaction

- Introduced new map geometry utilities in `map-geometry.ts` for handling different map types (orthogonal, hexagonal).
- Updated `use-scene-interaction.ts` to utilize new geometry functions for cell interactions and drawing previews.
- Enhanced `MapPanel` to support new map types and geometry settings during map creation.
- Modified fill region logic in `terrain.ts` to leverage new map geometry functions for adjacent cell calculations.
- Updated project normalization to include new map geometry properties.
- Added types for new map geometry in `map-geometry.ts` and updated related interfaces across the codebase.
- Improved context menu interactions in `use-map-canvas-context-menu.ts` to use new cell retrieval methods.

Co-authored-by: Copilot <copilot@github.com>

* refactor: improve code formatting and readability across multiple components

---------

Co-authored-by: Copilot <copilot@github.com>

Author: wernerbihl

AGENTS.md

@@ -3,3 +3,5 @@
 - Always run "bun run lint" after making changes and correct all the errors you see, even if it was not a direct issue caused by current code changes
 - Always comply with ARIA accessibility standards and make sure all inputs have an id and name field. If you are working on a file which doesn't comply with ARIA standards, add the necessary ARIA fields as part of user request, even if the changes does not fall within scope
 - Do not inline typescript types and interfaces - move them to /src/types/
+- When working on a file, and it is more than 1000 lines of code then refactor it into smaller, easier to test and maintain files. There are no exceptions to this. Always do this even if it is outside the scope of what was asked
+- Always run `bun run build` after making code changes to verify that the build succeeds

SECURITY.md

@@ -0,0 +1,5 @@
+## Reporting a Vulnerability
+
+Please contact admin@2dtiler.com with information about the security vulnerability.
+
+We highly appreciate any vulnerability feedback!

TODO.txt

@@ -1,18 +1,8 @@
-Check why sentry is not working in prod
+Refactor files longer than 1000 lines of code
 
-Image/sprite Editor:
-  Opacity not real opacity
-  Allow palette importing from Lospec: https://api.2dtiler.com/lospec_palettes
-    - https://lospec.com/palette-list/load?colorNumberFilterType=any&page=0&tag=&sortingType=newest
-
-- Object properties are not saving
-- Delete button should delete the selected thing
-- Enable map export to serialize image layers  
-- Add Text to Object Layer 
-- Add map should allow options for Orientation: Orthogonal (Default), Isometric, Isometric (Staggered), Hexagonal (Staggered)
+Add Isometric map type
 
 Import Options
-===================================
 Export Options
 
 AI Asset Generation:
@@ -28,6 +18,7 @@ Update README.md
 Ad Marketplace for selling/buying tilesets etc.
 
 Exploration:
+  Universal lpc spritesheet generator
   Ogmo Editor
   LDTK
   Pixelorama
@@ -37,7 +28,6 @@ Exploration:
   Libresprite
   Autotile
   SpriteFusion
-  Universal lpc spritesheet generator
   Tilekit
   Tilesetter
   Tileforge
@@ -47,12 +37,15 @@ Exploration:
   Makko.ai
   Keep Notes
 
+Text Layer custom fonts not working
+
+Allow palette importing from Lospec: https://api.2dtiler.com/lospec_palettes
+  - https://lospec.com/palette-list/load?colorNumberFilterType=any&page=0&tag=&sortingType=newest
+
 Manage Tilesets
 Manage Maps
 Royalty free packs
 Add unit tests and add to CI/CD
-Write documentation for website. Use /nothing-design
-High touch animations
 Add tutorial video
 Add roadmap voting on home page
 Windows/Mac/Linux Apps

bun.lock

@@ -7,11 +7,6 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="theme-color" content="#000000" />
     <meta name="description" content="A 2D tile map editor" />
-    <link rel="preconnect" href="https://fonts.googleapis.com" />
-    <link
-      rel="stylesheet"
-      href="https://fonts.googleapis.com/css2?family=Doto:wght@400..700&family=Space+Grotesk:wght@300..700&family=Space+Mono:wght@400;700&display=swap"
-    />
     <!-- Security: CSP enforced via HTTP headers (_headers for production,
          server.headers in vite.config.ts for local dev). -->
     <title>2D Tiler</title>

index.html

@@ -11,6 +11,9 @@
     "deploy": "bun run build && wrangler pages deploy dist --project-name 2dtiler-app"
   },
   "dependencies": {
+    "@fontsource/doto": "^5.2.10",
+    "@fontsource/space-grotesk": "^5.2.10",
+    "@fontsource/space-mono": "^5.2.9",
     "@msgpack/msgpack": "^3.1.3",
     "@sentry/react": "^10.47.0",
     "class-variance-authority": "^0.7.1",

package.json

@@ -21,14 +21,13 @@
   # default-src: fall-back for anything not listed explicitly
   # script-src:  self + Cloudflare Insights beacon
   # style-src:   unsafe-inline required for Radix UI / Tailwind inline styles
-  #              plus Google Fonts stylesheet loading
   # img-src:     data: / blob: for canvas exports; https: for remote images
-  # font-src:    self + Google Fonts font files
+  # font-src:    self-hosted app fonts + data: URIs
   # connect-src: Sentry ingest + Cloudflare Insights RUM endpoint + app APIs
   # worker-src:  blob: for Vite-generated web workers
   # object-src:  none (no Flash / plugins)
   # base-uri:    self (prevent base-tag injection)
   # form-action: self (no external form submissions)
   # frame-ancestors: none (blocks clickjacking; supersedes X-Frame-Options)
   # upgrade-insecure-requests: force HTTP→HTTPS for sub-resources
-  Content-Security-Policy: default-src 'self'; script-src 'self' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https:; font-src 'self' data: https://fonts.gstatic.com; connect-src 'self' https://o4510891797250048.ingest.us.sentry.io https://*.sentry.io https://cloudflareinsights.com https://api.openai.com https://api.together.xyz https://api.x.ai; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
+  Content-Security-Policy: default-src 'self'; script-src 'self' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://o4510891797250048.ingest.us.sentry.io https://*.sentry.io https://cloudflareinsights.com https://api.openai.com https://api.together.xyz https://api.x.ai; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests