FE-1500: add editor presentation profiles

[kube]

Summary

Before this PR, every Petrinaut host got the full authoring editor. A read-only page could stop edits through the document handle, but subnet add, rename, and delete affordances, type-dimension mutation controls, and source-code fields still rendered. Scenario and playback controls lived inside the editor's bottom panel and bottom bar, so no other surface could compose them.

Petrinaut takes a presentationProfile prop, editor or review, that gates authoring-only controls. Scenario and playback controls become shared components that surfaces outside the full editor can compose. The default editor profile keeps every capability on, so existing hosts render as before.

Links

• Ticket FE-1500

Changes

Presentation profiles

• PetrinautPresentationProvider maps a profile to capability booleans

  showMutationActions, showSourceCode, showCustomVisualizers, showViewportSettings, showMinimap, compactControls.
  review turns off mutation actions and keeps the rest on.

• Editor UI gates on those capabilities

  Subnet add, rename, and delete affordances, type-dimension mutation controls, source-code fields in property inspectors, the custom place visualizer, viewport settings, and the minimap.

• Example pages render with the review profile

Shared components

• SelectedItemProperties extracted from the properties panel
• SimulationScenarioControls and simulation-parameter-bounds extracted as a scenario picker with typed parameter controls

  Modelled on the picker and parameter list in Simulation Settings.
  The full panel keeps its own layout, which main has since rebuilt around the ad-hoc scenario form, so the shared component serves compact hosts.

• Compact variant of the bottom-bar SimulationControls and PlaybackSettingsMenu

  allowedSpeeds restricts the speed menu to an allow-list.

• createDeferredSubView loads optional property sub-views behind a bundle boundary

  Transition firing time, transition results, and the place visualizer load on demand while the panel keeps a synchronous descriptor.

Test coverage

• simulation-parameter-bounds.test.ts:

  Clamping a value into declared bounds.

• Existing @hashintel/petrinaut unit suite

How to test

Editor unchanged

• Open Petrinaut preview on Vercel

  Expect property panels, scenario controls in Simulation Settings, playback bar, viewport controls

Review presentation

• Open /examples/gases-1-pn

  Expect no subnet add, rename or delete affordances, no type-dimension mutation controls

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hash	Ready	Preview	Sep 4, 2026 9:29am UTC
petrinaut	Ready	Preview	Sep 4, 2026 9:29am UTC
petrinaut-docs	Ready	Preview	Sep 4, 2026 9:29am UTC

1 Skipped Deployment

Project	Deployment	Actions	Updated
hashdotdesign-tokens	Ignored	Preview	Sep 4, 2026 9:29am UTC

[semgrep-code-hashintel]

Semgrep found 4 detect-replaceall-sanitization findings:

• apps/petrinaut-website/api/oembed.ts
  • L86-91 - Triage
  • L86-90 - Triage
  • L86-88 - Triage
  • L86-87 - Triage

Detected a call to replaceAll() in an attempt to HTML escape the string value .replaceAll("&", "&amp;") .replaceAll('"', "&quot;") .replaceAll("'", "&#39;") .replaceAll("<", "&lt;"). Manually sanitizing input through a manually built list can be circumvented in many situations, and it's better to use a well known sanitization library such as sanitize-html or DOMPurify.

[semgrep-code-hashintel]

Semgrep found 1 regex_dos finding:

• apps/petrinaut-website/src/main/app/brunch-demo/brunch-endpoint.ts
  • L8-18 - Triage

Ensure that the regex used to compare with user supplied input is safe from regular expression denial of service.