标签：#tooling

Why this matters I’ve worked on a few frontend projects where code reviews turned into style debates—tabs vs spaces, semicolons, quote styles… you name it. It slows everything down and adds zero value. At some point, I realized this shouldn’t even be a discussion. So now, whenever I start a project, I set up Prettier + ESLint + Husky on day one. No debates. No manual fixes. No messy PRs. This post is exactly how I do it. 🧰 What each tool actually does Prettier → formats your code automatically ESLint → catches bad patterns & enforces rules Husky → runs checks before commits (so no one skips them) Together → clean, consistent code without thinking ⚙️ Step 1 — Install dependencies npm install -D prettier eslint husky lint-staged 🎯 Step 2 — Setup Prettier Create: prettier.config.js module . exports = { semi : true , singleQuote : true , trailingComma : ' all ' , tabWidth : 2 , }; Create: .prettierignore node_modules dist build 🔍 Step 3 — Setup ESLint Initialize: npx eslint --init Then tweak your config: .eslintrc.js module . exports = { extends : [ ' eslint:recommended ' , ' plugin:react/recommended ' , ' prettier ' ], rules : { ' no-unused-vars ' : ' warn ' , ' react/react-in-jsx-scope ' : ' off ' , }, }; 👉 Important: "prettier" disables ESLint rules that conflict with Prettier. 🔗 Step 4 — Connect ESLint + Prettier Install: npm install -D eslint-config-prettier That’s it. Now ESLint won’t fight Prettier. 🐶 Step 5 — Setup Husky Initialize Husky: npx husky init Add pre-commit hook: npx husky add .husky/pre-commit "npx lint-staged" 🚀 Step 6 — Setup lint-staged Add to package.json : "lint-staged" : { "*.{js,jsx,ts,tsx}" : [ "eslint --fix" , "prettier --write" ] } 💡 What happens now? Every time you commit: ESLint checks your code Prettier formats it Only clean code gets committed No more: “fix formatting” PR comments broken lint rules in main branch inconsistent code styles 🧠 Real impact (from experience) After adding this to a team project: PR noise dropped a lot reviews

Every developer I know has the same reflex now. Hit an unfamiliar concept, paste it into ChatGPT, read the explanation, move on. I did this for months. It felt efficient. Then I noticed a pattern: I was reading a lot of clear explanations and retaining almost none of them. I could follow along perfectly in the moment and then draw a blank a week later when I actually needed the knowledge. The problem was not ChatGPT. The problem was using a general-purpose conversational tool for a job it was never designed to do. Here is what I switched to, and why it works better. The three failure modes of using a chatbot to learn Passive consumption feels like learning. Reading a good explanation triggers the feeling of understanding without the work that creates actual memory. You nod along, it makes sense, and nothing sticks. This is the biggest trap. There is no retrieval practice. The research on this is well established: you remember things by pulling them out of memory, not by putting them in repeatedly. A chatbot will explain the same concept ten different ways, but it will never make you answer a question you cannot immediately answer. That struggle is the mechanism. Confident hallucination is dangerous when you are the beginner. If you already know a topic, you can spot when an AI is subtly wrong. If you are learning it for the first time, you cannot, and you may internalize something incorrect with full confidence. For technical material, this is a real cost. What actually works better Tools that quiz you. Anything built around retrieval practice and spaced repetition beats passive reading by a wide margin. If a tool generates questions from your material and makes you answer them over spaced intervals, it is working with how memory actually forms rather than against it. Tools that read YOUR source material. This one is huge for technical learning. Instead of asking a model to answer from its general training data (which may be outdated or wrong for your specific libra

The issue was not the tools. It was opening five of them before deciding what the log file was for. The log file was already on the screen. A remote Windows workstation had failed a desktop build, and the relevant file was sitting in a local app directory, something like: C:\Users\<user>\AppData\Local\<app>\logs\build.log The remote session was working. The error was visible. The next step seemed small: get the log back to the local laptop, open it in a familiar editor, compare it with the issue notes, and pull out the part that mattered. That should have been a 30-second task. Instead, it turned into five context switches. The first context was the remote session The remote desktop session made sense. The build failed on that machine, the app was installed there, and the log path was easier to find visually than by guessing from memory. So far, nothing was wrong. The file was selected. The timestamp matched the failed run. The log looked useful. It probably had the stack trace, the missing dependency path, or the configuration mismatch that explained the build failure. Then came the small but surprisingly annoying question: How should this file leave the remote machine? That is where the workflow started to wobble. The second context was chat The first instinct in many teams is chat. Drop the file into a message to yourself, a teammate, or the debugging thread. It is fast, already open, and keeps the file near the conversation. For some files, that is the right move. A screenshot, a short error snippet, or a quick “does this look familiar?” artifact belongs naturally in the discussion. But a full log file is not always a chat artifact. If it goes into chat, will anyone know later whether it was the first failing run or the second? Will it be obvious which remote machine produced it? Will the file still be easy to find after the thread moves on? Chat was not wrong. It was just not clearly the right home for this specific file. So the workflow moved on. The third con

I just submitted another Chrome extension to the Chrome Web Store. I have submitted multiple extensions overtime. Mostly for my own tooling and community share or just because idea was fun. The first time took 3 attempts. The second time I got rejected in 12 hours for something completely avoidable. Here's every gotcha I hit — so you don't have to. 1. Manifest description has a 132-character hard limit Not documented prominently anywhere. You'll get a cryptic upload error: "The description field in manifest is too long." Your package.json description or wxt.config.ts description gets baked into manifest.json — check it BEFORE you zip. Fix : Count characters. 132 max. Put the detailed description in the CWS form, not the manifest. 2. Don't put a "Keywords:" line in your description I literally had: Keywords: pinterest seo, pin score, pin quality, pinterest optimizer... Rejected within 12 hours for "Keyword Spam." CWS explicitly bans keyword lists in descriptions — even if they're relevant. Your keywords should be woven naturally into prose. Fix : Write human sentences that include your keywords. "Score your Pinterest pin quality before publishing" contains 3 keywords naturally. 3. upload-artifact@v4 silently skips hidden directories If your build tool outputs to .output/ (like WXT does), GitHub Actions' upload-artifact won't find it. The glob path: .output/*.zip returns nothing because .output starts with a dot. Fix : Add include-hidden-files: true to your upload-artifact step. - uses : actions/upload-artifact@v4 with : path : .output/*.zip include-hidden-files : true 4. optional_permissions need justification too I added sidePanel as an optional permission (reserved for a future feature). CWS asked me to justify it. Optional doesn't mean invisible to reviewers. Fix : Add a justification for EVERY permission — required AND optional. Explain what it'll do and why it's optional. 5. "Support URL" is not your email address The form has separate fields: Support email : yo

How you split your code into repositories seems like a plumbing decision, but it quietly shapes how your team collaborates, ships, and reasons about the system. A monorepo keeps everything in one repository; a polyrepo gives each service or app its own. Neither is universally right, and the loudest opinions online usually ignore your actual stage and team size. Here's how to think about it clearly. What a monorepo buys you A monorepo puts your web app, mobile app, backend, and shared libraries under one roof. The advantages are real, especially for smaller teams: Atomic changes. Update a shared type and every consumer in the same pull request. No cross-repo coordination dance. One source of truth for tooling. A single lint, format, and CI config instead of drift across a dozen repos. Effortless code sharing. Shared TypeScript packages are just imports, not published versions you have to bump and reinstall everywhere. Easy refactoring. You can find and fix every caller of a function because it's all in front of you. Tools like Turborepo and Nx make this practical by caching builds and only running work for the parts that actually changed. What a monorepo costs The trade-offs show up as you grow. Build and CI times can balloon without smart caching. Access control is coarser — it's harder to give a contractor one service without the whole codebase. And a naive setup rebuilds and tests everything on every change, which gets slow fast. Good tooling mitigates all of this, but you have to invest in it deliberately. What a polyrepo buys you Separate repositories give each service hard boundaries . A team owns its repo end to end, deploys on its own schedule, and can't accidentally reach into another team's internals. Access control is naturally granular, CI for each repo is small and fast, and the blast radius of a bad change is contained. The cost is coordination. A change that spans services becomes multiple pull requests across multiple repos that must land in the right

According to the PLG AI SaaS Benchmarks 2026 report , SaaS companies lose an average of 5–7% of revenue every month to churn , a rate that quietly compounds into nearly half of annual revenue erosion if left unchecked. Most teams don’t realize churn is already happening long before the cancellation click. It starts as subtle behavioral drift, lower engagement, feature abandonment, and delayed logins and only shows up in dashboards when it’s too late to act. That’s where AI changes the equation. Instead of reacting to churn, modern SaaS teams now try to intercept it through real-time behavioral detection, automated interventions, and continuous experimentation inside the product. Here are the best AI tools for SaaS customer retention (also called churn prevention tools) in 2026, compared by category, pricing, and key limitation. Why Traditional Churn Prevention Fails Most churn prevention strategies fail for three predictable reasons. First, they rely on lagging indicators. By the time dashboards show declining engagement, the user has already mentally churned. The decision didn’t happen when they clicked cancel; it happened days or weeks earlier during silent disengagement. Second, interventions are batch-based. Many lifecycle tools still operate on schedules like “send email after 7 days of inactivity.” But churn signals don’t wait for weekly jobs. The best intervention window is the moment behavior changes. Third, messaging is too generic. A user abandoning reporting features needs a completely different response than one abandoning collaboration workflows. Yet most tools treat both cases the same. The result is simple: teams react too late, too slowly, and too generically. Churn Signal Framework (What Predicts Churn) Churn doesn’t appear randomly; it follows patterns that can be detected in product data before cancellation ever happens. Churn Signal What It Looks Like Intervention Window Best Response Login drop Daily user becomes inactive within 7–14 days 1–7 da

React Doctor es un linter de cero instalación que escanea un codebase de React buscando problemas de correctitud, seguridad, accesibilidad, rendimiento y mantenibilidad, luego los rankea y te entrega una lista de arreglos con forma de agente. Este post es un reporte de campo: lo corrí sobre una SPA real de React 18 + Vite + TypeScript (~50 rutas, TanStack Query, react-hook-form) y separé lo que de verdad me atrapó. El resultado honesto: 1,249 hallazgos, cinco que valía la pena arreglar, incluyendo dos bugs de seguridad reales. Los otros 1,244 fueron una mezcla de ruido, decisiones de criterio, y falsos positivos. TL;DR Categoría Reportados Vale la pena actuar Por qué la brecha Seguridad 18 warnings 2 13 eran sinks saneados en el servidor (falsos positivos); 1 mina de código muerto + 1 XSS real fueron el oro Bugs 24 errores, 487 warnings 2 1 fuga de timer, 1 key/spread; ~27 exhaustive-deps piden criterio humano Accesibilidad 434 warnings, 1 error 1 el 1 error ( aria-selected faltante) era real; los 434 son ruido de <Label> / <button type> Rendimiento 110 warnings 0 nada caliente; candidatos pero sin impacto medido Mantenibilidad 176 warnings 0 opiniones de estilo tipo "componente grande" Total 1,249 5 señal-a-ruido ≈ 1 en 250 El puntaje que imprimió: 39 / 100 . Dos cosas que ese encuadre esconde: los cinco que sacó a la superficie eran de alto valor (una fuga de token en localStorage y un sink de XSS almacenado), y el conteo no es determinista : una segunda corrida del mismo commit reportó 1,254, no 1,249. El veredicto en una línea: excelente generador de hipótesis, pésima compuerta. Úsalo para encontrar candidatos, verifica cada uno contra el código, y nunca conectes el conteo al CI. Qué es React Doctor Un solo binario que corres por npx / pnpm dlx , sin agregar dependencia a tu proyecto, sin archivo de configuración obligatorio. Parsea tu src/ , hace match contra un conjunto de reglas (sus familias: Seguridad, Bugs, Accesibilidad, Rendimiento, Mantenibilidad), e im

Software spends a surprising amount of its life just moving structured data around: an API returns JSON, a config file is written in YAML or TOML, a report is exported as CSV, a spreadsheet wants tabular rows. These formats are not interchangeable — each was designed for a particular job, and using the wrong one creates friction. Knowing the strengths of each makes you faster and saves you from a category of frustrating bugs. JSON: the lingua franca of APIs JSON (JavaScript Object Notation) is the default for data exchange between systems, especially web APIs. It represents nested objects and arrays cleanly, every programming language can parse it, and its rules are strict enough to be unambiguous. That strictness is also its main friction for humans: no comments are allowed, every string needs double quotes, and a single trailing comma makes the whole document invalid. JSON is excellent for machine-to-machine communication and data storage; it is merely tolerable for files humans have to edit by hand. YAML: configuration humans edit YAML was designed to be readable and writable by people. It uses indentation instead of braces, supports comments, and drops most of the punctuation that makes JSON noisy. This makes it popular for configuration in tools like CI pipelines and container orchestration. Its strength is also its danger: because structure is defined by indentation, a single misplaced space can silently change the meaning of your file or break it entirely. YAML also has surprising type-coercion quirks (the classic example: the word "no" being read as the boolean false ). Use YAML for human-edited configuration, but validate it. TOML: configuration that stays unambiguous TOML (Tom's Obvious Minimal Language) aims for YAML's readability without YAML's ambiguity. It uses explicit, INI-like sections and clear key-value pairs, supports comments, and has unambiguous typing. It is less prone to the silent indentation mistakes that plague YAML, which is why a number

I have been turning old code projects into sellable source-code products. The hard part is not changing the cover image. It is not renaming the ZIP. It is deciding whether the project deserves to be sold at all. A lot of old apps are useful to the person who built them. Far fewer are useful to a stranger who has never seen the repo, never heard the backstory, and only wants to know one thing: Will this save me time, or will it become another folder I regret buying? Here is the checklist I now use before treating a source-code project as a starter kit. 1. The buyer must understand the workflow "Full-stack dashboard" is not enough. A buyer should immediately understand the workflow the project helps with. For example: a review and scoring portal; a maintenance and work-order dashboard; an email-template governance tool; a runnable technical code lab. The more generic the product sounds, the harder it is to buy. I now try to answer this in one sentence: This kit helps [specific buyer] start from a working foundation for [specific workflow]. If I cannot fill that sentence honestly, the project is not ready. 2. A stranger must be able to run it "It runs on my machine" is not a product standard. A buyer needs a path from download to working state. That usually means: setup instructions; environment notes; seeded demo data; demo accounts or fixtures; expected local startup behavior; known limitations; a simple smoke-test checklist. The goal is not perfection. The goal is that a competent developer should not have to reverse-engineer the project before deciding whether it is useful. 3. The product needs proof, not adjectives Marketing adjectives are cheap: production-ready; powerful; scalable; enterprise-grade; battle-tested. Most of those words create more risk than trust if they are not backed by evidence. Better proof looks boring: screenshots; a short demo video; a verified release ZIP; install notes; architecture notes; included / not-included boundaries; a changelog;

Introduction Most projects start with a single repository. Imagine you're building an e-commerce platform: a Next.js storefront for customers, a React Native mobile app, and a NestJS backend API. Splitting these into three repositories feels like the obvious, clean solution. ecommerce-web ecommerce-mobile ecommerce-api For the first few months, this works fine. Then the project grows, and the cracks start to show: You copy utility functions between repositories instead of importing them. You duplicate TypeScript interfaces across the frontend, mobile app, and API. Your frontend and backend drift apart because each repo defines its own version of the same models. Updating one shared component means editing it in three different places. Eventually, maintaining the project becomes harder than building new features. If that sounds familiar, you're not alone — it's exactly the problem monorepos were designed to solve. In this article, we'll cover: What a monorepo actually is, and how it differs from a multi-repo (polyrepo) setup Why engineering teams choose it How Turborepo makes monorepos fast instead of slow A practical, production-ready structure for a Next.js + React Native + NestJS monorepo Common mistakes and best practices Whether you work with React, Next.js, React Native, or NestJS, these concepts will help you build projects that scale without becoming a maintenance burden. The Problem With Multiple Repositories A typical multi-repo setup looks like this: web-app/ mobile-app/ backend-api/ shared-components/ Each repository has its own package.json , dependencies, CI/CD pipeline, Git history, and versioning strategy. It looks clean at first — but as the project grows, several problems appear. 1. Code duplication You write a helper function once: export function formatPrice ( price : number ) { return `$ ${ price . toFixed ( 2 )} ` ; } Both the web app and the mobile app need it, so instead of importing it, someone copies it. Now there are two versions. When one

We did what most engineering teams do. Bought an OpenAI API key. Shared it on Slack. Told everyone to start using AI in their workflow. It felt like the right move. Productivity went up. Developers were happy. Managers were impressed. Then the invoice arrived. Nobody could explain it. We could not tell which team spent what, which model was being used, or whether anyone had accidentally sent customer data to an external provider. We had full AI adoption and zero visibility. That is when we realized we had confused access with governance. The problem is not the AI. It is the missing layer between your team and the API. Most teams operate with raw provider keys floating around in .env files, Slack messages, and IDE configs. When someone leaves, you hope they did not take the key with them. When a pipeline misbehaves overnight, you find out from the billing alert, not from your own monitoring. We started asking ourselves some uncomfortable questions: Who on the team is using GPT-4o versus a cheaper model? Is anyone sending PII to an external provider without knowing it? What happens if our OpenAI key gets exposed in a public repo? Can we switch to Anthropic without rewriting half our tooling? None of these are exotic concerns. They are the natural consequences of scaling AI access without an infrastructure layer to govern it. What actually helped We needed something that sat between our developers and every AI provider, handling authentication, enforcing limits, logging every request, and letting us swap providers without touching application code. Think of it the way an API gateway manages microservices. Same idea, but for LLM traffic. Developers point their tools like Cursor, Continue.dev,...at a single endpoint. Two environment variables. Nothing else changes. Behind the scenes, every request is logged, every token counted, every provider key protected. Governance without friction. That is the only kind developers will actually tolerate. If your team is using AI wit

You know what you want from a JSON document. You just don't want to memorize whether it's $[?(@.age > 18)] or $..users[?(@.active)] . Plain English in. JSONPath out. JSONPath Assistant on FormatList lets you paste JSON, describe what you need in natural language, and get a validated JSONPath expression plus the actual results — all in your browser. No account, no API key, no data sent to a server. How it works Paste your JSON — an API response, config file, or test fixture. Describe what you need — e.g. "get all user names" or "find products with tag tech". Generate — the assistant reads your JSON structure and maps your query to JSONPath. Validate & copy — the expression runs against your data immediately. Copy the path or the matched values in one click. If the first attempt returns no matches, the tool retries with a simpler variation automatically. Example queries You type Generated JSONPath Get all user names $.users[*].name Find users older than 18 $.users[?(@.age > 18)] Get names of active users $.users[?(@.active == true)].name Find products with tag tech $.products[?(@.tags.indexOf('tech') >= 0)] Get all order prices $.orders[*].price Get the first user's email $.users[0].email Get all pod names {.items[*].metadata.name} Get all pod IP addresses {.items[*].status.podIP} The tool ships with one-click examples for each of these — load one, hit Generate, and see how it works before trying your own JSON. What kinds of queries it understands Property access — "get all names", "list order prices" Numeric filters — "older than 18", "price under $10", "greater than 100" Boolean filters — "active users", "enabled devices" Tag / category searches — "with tag tech", "beauty category" Multi-condition — "both tech and mobile tags" Quantifiers — "the first user", "the last item" Kubernetes — "get all pod names", "pod IP addresses" It analyzes field names in your JSON — so users , products , orders , or whatever keys you actually have — and builds paths that match your sc

Deep into a coding session, you realize you want beta testers to try some new functionality first....

Every npm project is one malicious package away from a supply-chain breach. NPM Safety Guard catches threats that npm audit completely misses — from DPRK backdoors and typosquatted packages, to exposed API keys and AI credential theft hidden inside your node_modules. This video walks through all 23 detection layers, one by one, showing exactly what each layer catches and how it protects your project in real time. 🛡️ Intro NPM Safety Guard is the most comprehensive npm security scanner for developers. It ships as a VS Code extension (also works in Cursor and Windsurf) and a JetBrains plugin (WebStorm, IntelliJ IDEA, and all IntelliJ-based IDEs). It runs silently in the background and alerts you to supply-chain threats, malware, CVEs, and credential leaks — before they can cause damage. Layer 1 — Known Malicious Packages Checks every package in your package.json against a bundled database of documented supply-chain attacks, including DPRK/Lazarus Group backdoors, the infamous event-stream compromise, and dozens of other confirmed malicious packages. The database is also synced against a live remote feed so newly discovered threats are caught even before you update the extension. Layer 2 — CVE Vulnerabilities Queries the Google OSV.dev API for known CVEs across all your direct dependencies. No API key needed — it is completely free. Results are cached for 24 hours to minimize network calls. CVSS scores are mapped to severity levels (Critical, High, Medium, Low) so you always know exactly how serious each vulnerability is and which version fixes it. Layer 3 — Install Script Hooks Flags packages that declare preinstall, postinstall, install, or prepare npm scripts. These hooks run automatically during npm install — before any of your own code executes — making them the number one real-world vector for supply-chain malware delivery. Legitimate packages that genuinely need install scripts (like node-gyp and imagemin) are automatically whitelisted. Layer 4 — Deep Tarball AS

According to ChartMogul's 2026 analysis of 200 B2B software products, the median free-to-paid...

Originally published on danholloran.me The original Grimicorn was an exercise in restraint: muted pastels on a blue-gray base, tuned so nothing on screen ever burns your eyes. Grimicorn Neon is the opposite impulse. Same grim-reaper-meets-unicorn idea, except this one is plugged into the mains — saturated, glowing accents on a near-black base, dark-only, loud on purpose. What makes the pair interesting from an engineering angle is how little had to change to get there. Neon is not a new theme so much as the same theme with the volume knob turned all the way up. That only works because of a decision made back in the calm version: colors are defined by role, not by appearance. Eight roles, eight louder hexes Both themes share the exact same role map. Blue is keywords, links, and the primary accent. Green is strings, success, and the cursor. Yellow is types, decorators, and warnings. The accent hierarchy is still blue → purple → teal, and the semantic anchors still hold: green means good, the error color means wrong. What changes is only the values bound to those roles. Calm Grimicorn's blue is a soft #83AFE5 ; Neon's is an electric #2323FF . Calm green is a sage #A9CE93 ; Neon green is an acid #A3E635 . The error role even swaps identity, from a gentle salmon to a hot #FF2D9B pink. Lay the two palettes side by side and the structure is identical — only the saturation and brightness move: // same eight roles, two personalities const calm = { blue : " #83AFE5 " , green : " #A9CE93 " , error : " #DD9787 " , base : " #253039 " , }; const neon = { blue : " #2323FF " , green : " #A3E635 " , error : " #FF2D9B " , base : " #0A0A0B " , }; Because every one of the fourteen tool ports — VS Code, Ghostty, Obsidian, Claude Code, JetBrains, tmux, and the rest — is generated from a single palette.md , producing the neon set was mostly a matter of feeding the build a different eight values. The emitters that translate roles into VS Code scopes or ANSI slots never knew the difference.

Video demo link : https://youtu.be/vSjeTkrou1s?si=qTcrWyz0HSWDiWSF If you run Claude Code, Codex, or other AI agents, you know the pain: the terminal floods with generated output while you're still typing — and your keystrokes lag, characters "drag." TawTerminal fixes that. Your keystrokes go straight to the screen on a separate path from shell output, so typing stays instant even while an AI agent streams thousands of lines. What you get: ⚡ Zero input lag — GPU-accelerated (WebGL) rendering at 60fps, multi-process so heavy output never blocks your typing 📁 Workspace folders — pin folders in the sidebar, spawn a shell rooted in any directory in one click, with live git branch + status 🤖 One-click AI agents — launch Claude Code, Codex, PI, or tawx directly from the sidebar, sessions auto-restored 🪟 Split panes & tabs — Cmd+D to split, Cmd+T for tabs 🖼️ Paste images — drag-drop or Cmd+V images straight into the terminal 🎨 4 beautiful themes — Tokyo Night, Catppuccin Mocha, Dracula, Rosé Pine 📊 Live AI usage footer — see today's Claude Code / Codex token + cost estimate 🍎 Native macOS feel — clean hidden title bar, clickable URLs, custom fonts Requirements: macOS, Apple Silicon (M1 or newer). Signed & notarized by Apple — installs clean, no security warnings.

I’ve always been fascinated by PDFs. They look simple on the surface. Just a document you can open anywhere but underneath they’re a full layout engine, object graph, drawing model, and archival format all at once. I enjoy that mix of precision and complexity and that is exactly what led me to build PDF::Make (and yes I had some help from Claude LLM). I wanted a fully featured toolkit that could both generate PDFs and let me inspect/edit them programmatically. At the low level, PDF::Make exposes the raw building blocks of the format: PDF objects, pages, the drawing canvas, a parser/reader, and import/merge primitives. This is the layer you reach for when you need fine grained control or want to work with the structure of a document directly. For everyday document creation, PDF::Make::Builder sits on top of that foundation and provides a higher level API. It handles the boilerplate of page setup, fonts, text flow, and layout so you can produce a polished PDF in just a few lines of Perl. The same toolkit is also designed for post-processing. You can open an existing PDF, extract structured text along with its coordinates, and then draw annotations or overlays back onto the page, making it straightforward to build review, QA, or markup workflows on top of documents you didn’t originally generate. This post shows a practical two-step flow: Create a PDF Re-open it, extract text coordinates, and draw border highlights around matched words 1) Create a PDF with PDF::Make::Builder Script: #!/usr/bin/perl use strict ; use warnings ; use PDF::Make:: Builder ; my $pdf = PDF::Make:: Builder -> new ( file_name => ' source_demo.pdf ', configure => { text => { font => { family => ' Helvetica ', size => 12 , colour => ' #222222 ' }, }, }, ); $pdf -> add_page ( page_size => ' Letter ') -> add_h1 ( text => ' PDF::Make blog demo ') -> add_text ( text => ' PDF::Make builds and edits PDF files directly from Perl. ') -> add_text ( text => ' In the next step we extract text coordinates and

I spent last month migrating 23 client sites from JPEG/PNG to WebP and AVIF. Here's what I wish someone told me before I started. AVIF vs WebP: the real numbers AVIF is about 30% smaller than WebP at the same quality level. But Safari support is still patchy — if your traffic is 40%+ iOS, you need <picture> tags with WebP fallback. No way around it. The biggest win wasn't the format The single biggest reduction came from capping max image width at 1200px and setting quality to 80. One site went from 9.4MB to 318KB per page — a 97% reduction — just from those two settings plus lazy loading. The format switch was the cherry on top, not the cake. Tools I used daily SmartImgKit — quick batch conversions in the browser. No uploads, no signup, drag and drop. Handles the 80% case where you don't need a CLI pipeline. Supports JPG, PNG, WebP, AVIF, GIF, BMP, TIFF. ImageMagick — server-side batch jobs for when you need automation. Squoosh — one-off fine-tuning with visual comparison. Sharp (Node.js) — build pipeline integration. The HEIC surprise Every iPhone user's photos are HEIC. Most web tools crash on them. You need a converter that handles them before the pipeline — SmartImgKit's HEIC converter works locally in-browser, no uploads. The 80/20 rule Format + max width + lazy loading = 80% of the gain. Everything else is diminishing returns. Don't over-engineer it.

A few weeks back I shared some early Zen code examples. Since then, a lot has changed. We're now at v1.1.1 and the language actually has real tooling. What's new: Full CLI with package management zen publish - publish packages directly from CLI zen install - install packages from the registry zen list - browse all published packages with pagination Language improvements Struct support with literals and returns Regex with POSIX ERE ( matchRegex ) File I/O with binary support FFI bindings to C functions 162 stdlib functions across math, strings, fs, os, http, crypto, path utilities Package Registry (v1.0.0) JWT-based authentication GitHub-hosted packages Support for both runnable apps and libraries Semantic versioning The reactive variables concept from the first post is still there (that was my favorite feature), and now you can actually write real programs and share them with the community. Full docs: https://jishith-dev.github.io/zen-doc/site/ Install: curl -fsSL https://raw.githubusercontent.com/jishith-dev/Zen/main/install.sh | bash Next up: HTTP server APIs, better imports, and whatever the community asks for. Open to feedback and collaborators 💻 ✨ zen #programming #compiler #llvm #packagemanager #opensource #programminglanguage