@1agh/maude 0.40.0 → 0.41.0

package/apps/studio/api.ts

@@ -3,7 +3,7 @@
 
 import crypto from 'node:crypto';
 import type { Dirent } from 'node:fs';
-import { mkdir, readdir, readFile, rename, rm, stat as statp } from 'node:fs/promises';
+import { lstat, mkdir, readdir, readFile, rename, rm, stat as statp } from 'node:fs/promises';
 import path from 'node:path';
 
 import { renderBriefBoard, validateCanvasName } from './canvas-create.ts';
@@ -12,15 +12,24 @@ import {
   assembleCompSource,
   CanvasEditError,
   type ClipInfo,
+  deleteArtboard,
+  deleteElement,
+  duplicateElement,
+  type EditScope,
   editArrayElementString,
   editAttribute,
   enumerateClips,
+  type InsertKind,
+  insertArtboard,
   insertClip,
+  insertElement,
   type MovePosition,
   moveElement,
   removeAttribute,
   removeClip,
   reorderClip,
+  resizeArtboard,
+  resolveEditScope,
   retimeSequence,
   retimeSequenceByClip,
   editText as runEditText,
@@ -254,6 +263,8 @@ export interface Api {
   saveAnnotations(file: string, svg: string): Promise<boolean>;
   // Phase 23 — content-addressed binary image write (drag-drop / paste / picker)
   saveAsset(bytes: Uint8Array): Promise<SaveAssetResult>;
+  /** Stage F1 — list content-addressed image/video assets for the AssetPicker. */
+  listAssets(): Promise<{ ok: true; assets: AssetListing[] }>;
   /** DDR-148 — streaming variant for the HTTP route (100 MB video without a
    *  full in-RAM buffer). Sniffs + caps + content-addresses like saveAsset. */
   saveAssetFromStream(stream: ReadableStream<Uint8Array>): Promise<SaveAssetResult>;
@@ -283,6 +294,8 @@ export interface Api {
     id?: unknown;
     property?: unknown;
     value?: unknown;
+    reset?: unknown;
+    idIndex?: unknown;
   }): Promise<EditOpResult>;
   // Phase 12 (DDR-103) — inline text-content edit (POST /_api/edit-text). Main-origin only.
   editText(input: { canvas?: unknown; id?: unknown; text?: unknown }): Promise<EditOpResult>;
@@ -383,6 +396,63 @@ export interface Api {
       }
     | { ok: false; status: number; error: string }
   >;
+  // Stage I (feature-element-editing-robustness) — general element structural
+  // edits. Each logs a whole-file undo seq (reverted via reorderRevert).
+  /** Delete an element by data-cd-id (reused-component instance via idIndex). */
+  deleteElementOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    idIndex?: unknown;
+  }): Promise<
+    { ok: true; deletedId: string; seq?: number } | { ok: false; status: number; error: string }
+  >;
+  /** Insert a synthesized div/text/image relative to a reference element. */
+  insertElementOp(input: {
+    canvas?: unknown;
+    refId?: unknown;
+    position?: unknown;
+    kind?: unknown;
+    src?: unknown;
+    refIndex?: unknown;
+  }): Promise<
+    { ok: true; newId: string | null; seq?: number } | { ok: false; status: number; error: string }
+  >;
+  /** Insert a new empty artboard from a screen-size preset. */
+  insertArtboardOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    label?: unknown;
+    width?: unknown;
+    height?: unknown;
+  }): Promise<
+    { ok: true; artboardId: string; seq?: number } | { ok: false; status: number; error: string }
+  >;
+  /** Free-hand artboard resize — write width/height numeric props (DDR-027, D4). */
+  resizeArtboardOp(input: {
+    canvas?: unknown;
+    artboardId?: unknown;
+    width?: unknown;
+    height?: unknown;
+  }): Promise<{ ok: true; seq?: number } | { ok: false; status: number; error: string }>;
+  /** Duplicate an element (Cmd+D) — a copy as the next sibling, whole-file undo. */
+  duplicateElementOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    idIndex?: unknown;
+  }): Promise<
+    { ok: true; newId: string | null; seq?: number } | { ok: false; status: number; error: string }
+  >;
+  /** Delete an artboard by its `id` prop (whole-file undo seq). */
+  deleteArtboardOp(input: {
+    canvas?: unknown;
+    artboardId?: unknown;
+  }): Promise<{ ok: true; seq?: number } | { ok: false; status: number; error: string }>;
+  /** Edit-scope verdict (local vs shared component instance) for the INV-3 badge. */
+  editScopeOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    rendered?: unknown;
+  }): Promise<({ ok: true } & EditScope) | { ok: false; status: number; error: string }>;
   // Undo/redo a prior reorder by seq (Cmd+Z from the canvas undo stack). Whole-
   // file content swap from the in-memory revert log — immune to the positional
   // data-cd-id churn a reorder causes (inverse-descriptor undo would go stale).
@@ -497,6 +567,17 @@ export interface SaveAssetResult {
   path?: string;
 }
 
+/** Stage F1 — one media asset in the AssetPicker listing. */
+export interface AssetListing {
+  /** designRoot-relative path (`assets/<sha8>.<ext>`) — what a src/href uses. */
+  path: string;
+  name: string;
+  ext: string;
+  kind: 'image' | 'video';
+  size: number;
+  mtimeMs: number;
+}
+
 /** DDR-148 — media category, decides which per-file cap applies. */
 export type AssetCategory = 'image' | 'video' | 'audio';
 
@@ -630,6 +711,51 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     return seq;
   }
 
+  // ── Structural-write throttle + source-size ceiling (G3 security, DDR-152) ──
+  // The new structural verbs (delete / insert-element / insert-artboard /
+  // resize-artboard) are the first that let an UNTRUSTED active canvas both
+  // *remove* and *grow* its own source: the shell relays a canvas's `dgn:*`
+  // request after gating only on `e.source === activeWin` — there is no user
+  // gesture on the wire, so a hostile on-load script can drive these in a loop.
+  // Two bounds close the disk-fill / silent-shred DoS the adversarial review
+  // flagged (mirrors the ASSET_SESSION_BUDGET the /_api/asset lane already has,
+  // DDR-088 — this is the OTHER untrusted-origin disk-write surface):
+  //   (a) a per-api token bucket caps the sustained rate. A human does a few
+  //       structural edits/sec; a scripted loop can't beat the refill, which
+  //       keeps every whole-file _history snapshot + RAM undo entry rate-bound.
+  //   (b) a growth op is refused once the source already exceeds
+  //       MAX_CANVAS_SOURCE, so inserts can't inflate the .tsx (and the snapshot
+  //       + undo copies it holds) without bound. Deletes/shrinks always pass.
+  // Bucket state is per-createApi (each test/instance starts full); env-tunable.
+  const STRUCTURAL_BURST = (() => {
+    const env = Number(process.env.MAUDE_STRUCTURAL_BURST);
+    return Number.isFinite(env) && env > 0 ? Math.floor(env) : 40;
+  })();
+  const STRUCTURAL_REFILL_PER_SEC = 8;
+  let structuralTokens = STRUCTURAL_BURST;
+  let structuralLastRefill = Date.now();
+  /** Consume one token; false when the caller is over the sustained rate. */
+  function takeStructuralToken(): boolean {
+    const now = Date.now();
+    structuralTokens = Math.min(
+      STRUCTURAL_BURST,
+      structuralTokens + ((now - structuralLastRefill) / 1000) * STRUCTURAL_REFILL_PER_SEC
+    );
+    structuralLastRefill = now;
+    if (structuralTokens < 1) return false;
+    structuralTokens -= 1;
+    return true;
+  }
+  const RATE_LIMITED = {
+    ok: false as const,
+    status: 429,
+    error: 'too many structural edits — slow down',
+  };
+  const MAX_CANVAS_SOURCE = (() => {
+    const env = Number(process.env.MAUDE_MAX_CANVAS_SOURCE);
+    return Number.isFinite(env) && env > 0 ? Math.floor(env) : 512 * 1024;
+  })();
+
   function fileSlug(file: string): string {
     return canvasSlugFromRel(file, paths.designRel);
   }
@@ -1361,6 +1487,44 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     return saveAssetFromStream(new Response(bytes).body as ReadableStream<Uint8Array>);
   }
 
+  // Stage F1 (feature-element-editing-robustness) — list the versioned content-
+  // addressed media under <designRoot>/assets/ for the AssetPicker (Replace
+  // image / insert image). Read-only; returns image + video assets only (never
+  // arbitrary files), newest first, capped. MAIN-ORIGIN ONLY at the route layer.
+  async function listAssets(): Promise<{ ok: true; assets: AssetListing[] }> {
+    const assetsDir = path.join(paths.designRoot, 'assets');
+    const IMG = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif', '.svg']);
+    const VID = new Set(['.mp4', '.webm', '.mov', '.m4v', '.ogg']);
+    let entries: string[] = [];
+    try {
+      entries = await readdir(assetsDir);
+    } catch {
+      return { ok: true, assets: [] }; // no assets dir yet
+    }
+    const out: AssetListing[] = [];
+    for (const name of entries) {
+      const ext = path.extname(name).toLowerCase();
+      const kind = IMG.has(ext) ? 'image' : VID.has(ext) ? 'video' : null;
+      if (!kind) continue;
+      let size = 0;
+      let mtimeMs = 0;
+      try {
+        // lstat (not stat): a symlink planted under assets/ resolves to isFile()
+        // === false here → skipped. Defends the listing against a symlink that
+        // would otherwise be served by the /assets/<file> static route.
+        const st = await lstat(path.join(assetsDir, name));
+        if (!st.isFile()) continue;
+        size = st.size;
+        mtimeMs = st.mtimeMs;
+      } catch {
+        continue;
+      }
+      out.push({ path: `assets/${name}`, name, ext: ext.slice(1), kind, size, mtimeMs });
+    }
+    out.sort((a, b) => b.mtimeMs - a.mtimeMs);
+    return { ok: true, assets: out.slice(0, 500) };
+  }
+
   // Phase 31 follow-up — persist an image pasted straight from the clipboard into
   // the ACP composer (a screenshot has no path yet), so the chip can point Claude
   // at a real file to Read. Sibling of saveAsset, but:
@@ -1808,11 +1972,20 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     property?: unknown;
     value?: unknown;
     reset?: unknown;
+    idIndex?: unknown;
   }): Promise<EditOpResult> {
     const r = resolveCanvasAbs(input.canvas);
     if (!r.ok) return r;
     const id = typeof input.id === 'string' ? input.id.trim() : '';
     if (!CD_ID_RE.test(id)) return { ok: false, status: 400, error: 'invalid data-cd-id' };
+    // Stage H3 — optional DOM-occurrence index. Present only for a whole-instance
+    // move/resize (reposition/resize-request); routes the write to the dragged
+    // component instance's own `<Component/>` usage so it stays LOCAL. Absent for
+    // knob / paste-style edits (those stay global on the shared inner element).
+    const idIndex =
+      typeof input.idIndex === 'number' && Number.isInteger(input.idIndex) && input.idIndex >= 0
+        ? input.idIndex
+        : undefined;
     const property = typeof input.property === 'string' ? input.property.trim() : '';
     // CSS property names are ASCII letters + hyphens only (optionally a leading
     // `-` for vendor prefixes) — reject anything that could smuggle a second key
@@ -1827,7 +2000,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     if (input.reset === true) {
       return suppressedEdit(
         r.abs,
-        () => removeAttribute(r.abs, id, `style.${camel}`),
+        () => removeAttribute(r.abs, id, `style.${camel}`, idIndex),
         'reset failed'
       );
     }
@@ -1840,7 +2013,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     // `#fff`, `8px`, `700`, `1.5` all ride verbatim.
     return suppressedEdit(
       r.abs,
-      () => editAttribute(r.abs, id, `style.${camel}`, JSON.stringify(value)),
+      () => editAttribute(r.abs, id, `style.${camel}`, JSON.stringify(value), idIndex),
       'edit failed'
     );
   }
@@ -2140,6 +2313,326 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     }
   }
 
+  // Stage I (feature-element-editing-robustness) — general element structural
+  // edits (delete / insert / new-artboard) + free-hand artboard resize (D4). All
+  // MAIN-ORIGIN ONLY at the route layer; each logs a whole-file {before, after}
+  // under a seq (logUndo) so Cmd+Z reverts through /_api/reorder-revert (a
+  // structural edit renumbers positional data-cd-ids → an inverse descriptor
+  // goes stale). Same agent-rim suppression + pre-op snapshot as reorder.
+
+  /** Delete the element with `data-cd-id === id` (reused-component instance via idIndex). */
+  async function deleteElementOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    idIndex?: unknown;
+  }): Promise<
+    { ok: true; deletedId: string; seq?: number } | { ok: false; status: number; error: string }
+  > {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    if (!takeStructuralToken()) return RATE_LIMITED;
+    const id = typeof input.id === 'string' ? input.id.trim() : '';
+    if (!CD_ID_RE.test(id)) return { ok: false, status: 400, error: 'invalid data-cd-id' };
+    const idIndex = Number.isInteger(input.idIndex) ? (input.idIndex as number) : undefined;
+    const rel = path.relative(paths.designRoot, r.abs);
+    ctx.bus.emit('activity:suppress', rel);
+    try {
+      const before = await Bun.file(r.abs).text();
+      const res = await deleteElement(r.abs, id, idIndex);
+      const after = await Bun.file(r.abs).text();
+      if (after === before) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: true, deletedId: res.deletedId };
+      }
+      try {
+        await history.writeSnapshot(rel, before, 'pre-delete-element');
+      } catch {
+        /* snapshot best-effort */
+      }
+      return { ok: true, deletedId: res.deletedId, seq: logUndo(r.abs, before, after) };
+    } catch (err) {
+      ctx.bus.emit('activity:unsuppress', rel);
+      return {
+        ok: false,
+        status: err instanceof CanvasEditError ? 422 : 500,
+        error: err instanceof Error ? err.message : 'delete failed',
+      };
+    }
+  }
+
+  /** Insert a synthesized element (div/text/image) relative to `refId`. */
+  async function insertElementOp(input: {
+    canvas?: unknown;
+    refId?: unknown;
+    position?: unknown;
+    kind?: unknown;
+    src?: unknown;
+    refIndex?: unknown;
+  }): Promise<
+    { ok: true; newId: string | null; seq?: number } | { ok: false; status: number; error: string }
+  > {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    if (!takeStructuralToken()) return RATE_LIMITED;
+    const refId = typeof input.refId === 'string' ? input.refId.trim() : '';
+    if (!CD_ID_RE.test(refId)) {
+      return { ok: false, status: 400, error: 'invalid reference data-cd-id' };
+    }
+    const position = input.position;
+    if (typeof position !== 'string' || !MOVE_POSITIONS.has(position)) {
+      return { ok: false, status: 400, error: 'invalid position' };
+    }
+    const kind = input.kind;
+    if (kind !== 'div' && kind !== 'text' && kind !== 'image') {
+      return { ok: false, status: 400, error: 'invalid kind (div|text|image)' };
+    }
+    const src = typeof input.src === 'string' ? input.src : undefined;
+    const refIndex = Number.isInteger(input.refIndex) ? (input.refIndex as number) : undefined;
+    const rel = path.relative(paths.designRoot, r.abs);
+    ctx.bus.emit('activity:suppress', rel);
+    try {
+      const before = await Bun.file(r.abs).text();
+      if (before.length > MAX_CANVAS_SOURCE) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: false, status: 413, error: 'canvas source too large to grow' };
+      }
+      const res = await insertElement(r.abs, refId, position as MovePosition, kind as InsertKind, {
+        src,
+        occurrence: refIndex,
+      });
+      const after = await Bun.file(r.abs).text();
+      if (after === before) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: true, newId: res.newId };
+      }
+      try {
+        await history.writeSnapshot(rel, before, 'pre-insert-element');
+      } catch {
+        /* snapshot best-effort */
+      }
+      return { ok: true, newId: res.newId, seq: logUndo(r.abs, before, after) };
+    } catch (err) {
+      ctx.bus.emit('activity:unsuppress', rel);
+      return {
+        ok: false,
+        status: err instanceof CanvasEditError ? 422 : 500,
+        error: err instanceof Error ? err.message : 'insert failed',
+      };
+    }
+  }
+
+  /** Insert a new empty artboard (id/label/width/height) after the last one. */
+  async function insertArtboardOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    label?: unknown;
+    width?: unknown;
+    height?: unknown;
+  }): Promise<
+    { ok: true; artboardId: string; seq?: number } | { ok: false; status: number; error: string }
+  > {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    if (!takeStructuralToken()) return RATE_LIMITED;
+    const id = typeof input.id === 'string' ? input.id.trim() : '';
+    if (!/^[A-Za-z][\w-]{0,63}$/.test(id)) {
+      return { ok: false, status: 400, error: 'invalid artboard id' };
+    }
+    const label = typeof input.label === 'string' ? input.label.slice(0, 120) : id;
+    const width = Number.isFinite(Number(input.width))
+      ? Math.max(64, Math.min(8192, Math.round(Number(input.width))))
+      : 0;
+    const height = Number.isFinite(Number(input.height))
+      ? Math.max(64, Math.min(8192, Math.round(Number(input.height))))
+      : 0;
+    if (!width || !height) return { ok: false, status: 400, error: 'width and height required' };
+    const rel = path.relative(paths.designRoot, r.abs);
+    ctx.bus.emit('activity:suppress', rel);
+    try {
+      const before = await Bun.file(r.abs).text();
+      if (before.length > MAX_CANVAS_SOURCE) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: false, status: 413, error: 'canvas source too large to grow' };
+      }
+      const res = await insertArtboard(r.abs, { id, label, width, height });
+      const after = await Bun.file(r.abs).text();
+      if (after === before) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: true, artboardId: res.artboardId };
+      }
+      try {
+        await history.writeSnapshot(rel, before, 'pre-insert-artboard');
+      } catch {
+        /* snapshot best-effort */
+      }
+      return { ok: true, artboardId: res.artboardId, seq: logUndo(r.abs, before, after) };
+    } catch (err) {
+      ctx.bus.emit('activity:unsuppress', rel);
+      return {
+        ok: false,
+        status: err instanceof CanvasEditError ? 422 : 500,
+        error: err instanceof Error ? err.message : 'insert-artboard failed',
+      };
+    }
+  }
+
+  /** Free-hand artboard resize (D4) — write width/height NUMERIC props (DDR-027). */
+  async function resizeArtboardOp(input: {
+    canvas?: unknown;
+    artboardId?: unknown;
+    width?: unknown;
+    height?: unknown;
+  }): Promise<{ ok: true; seq?: number } | { ok: false; status: number; error: string }> {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    if (!takeStructuralToken()) return RATE_LIMITED;
+    const artboardId = typeof input.artboardId === 'string' ? input.artboardId.trim() : '';
+    if (!/^[A-Za-z][\w-]{0,63}$/.test(artboardId)) {
+      return { ok: false, status: 400, error: 'invalid artboard id' };
+    }
+    const dim = (v: unknown): number | undefined =>
+      Number.isFinite(Number(v)) ? Math.max(64, Math.min(8192, Math.round(Number(v)))) : undefined;
+    const width = dim(input.width);
+    const height = dim(input.height);
+    if (width == null && height == null) {
+      return { ok: false, status: 400, error: 'width or height required' };
+    }
+    const rel = path.relative(paths.designRoot, r.abs);
+    ctx.bus.emit('activity:suppress', rel);
+    try {
+      const before = await Bun.file(r.abs).text();
+      await resizeArtboard(r.abs, artboardId, width, height);
+      const after = await Bun.file(r.abs).text();
+      if (after === before) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: true };
+      }
+      try {
+        await history.writeSnapshot(rel, before, 'pre-resize-artboard');
+      } catch {
+        /* snapshot best-effort */
+      }
+      return { ok: true, seq: logUndo(r.abs, before, after) };
+    } catch (err) {
+      ctx.bus.emit('activity:unsuppress', rel);
+      return {
+        ok: false,
+        status: err instanceof CanvasEditError ? 422 : 500,
+        error: err instanceof Error ? err.message : 'resize-artboard failed',
+      };
+    }
+  }
+
+  /** Duplicate an element (Cmd+D) — insert a copy as the next sibling. */
+  async function duplicateElementOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    idIndex?: unknown;
+  }): Promise<
+    { ok: true; newId: string | null; seq?: number } | { ok: false; status: number; error: string }
+  > {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    if (!takeStructuralToken()) return RATE_LIMITED;
+    const id = typeof input.id === 'string' ? input.id.trim() : '';
+    if (!CD_ID_RE.test(id)) return { ok: false, status: 400, error: 'invalid data-cd-id' };
+    const idIndex = Number.isInteger(input.idIndex) ? (input.idIndex as number) : undefined;
+    const rel = path.relative(paths.designRoot, r.abs);
+    ctx.bus.emit('activity:suppress', rel);
+    try {
+      const before = await Bun.file(r.abs).text();
+      if (before.length > MAX_CANVAS_SOURCE) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: false, status: 413, error: 'canvas source too large to grow' };
+      }
+      const res = await duplicateElement(r.abs, id, idIndex);
+      const after = await Bun.file(r.abs).text();
+      if (after === before) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: true, newId: res.newId };
+      }
+      try {
+        await history.writeSnapshot(rel, before, 'pre-duplicate-element');
+      } catch {
+        /* snapshot best-effort */
+      }
+      return { ok: true, newId: res.newId, seq: logUndo(r.abs, before, after) };
+    } catch (err) {
+      ctx.bus.emit('activity:unsuppress', rel);
+      return {
+        ok: false,
+        status: err instanceof CanvasEditError ? 422 : 500,
+        error: err instanceof Error ? err.message : 'duplicate failed',
+      };
+    }
+  }
+
+  /** Delete an artboard by its `id` prop (Backspace / context-menu on a frame). */
+  async function deleteArtboardOp(input: {
+    canvas?: unknown;
+    artboardId?: unknown;
+  }): Promise<{ ok: true; seq?: number } | { ok: false; status: number; error: string }> {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    if (!takeStructuralToken()) return RATE_LIMITED;
+    const artboardId = typeof input.artboardId === 'string' ? input.artboardId.trim() : '';
+    if (!/^[A-Za-z][\w-]{0,63}$/.test(artboardId)) {
+      return { ok: false, status: 400, error: 'invalid artboard id' };
+    }
+    const rel = path.relative(paths.designRoot, r.abs);
+    ctx.bus.emit('activity:suppress', rel);
+    try {
+      const before = await Bun.file(r.abs).text();
+      await deleteArtboard(r.abs, artboardId);
+      const after = await Bun.file(r.abs).text();
+      if (after === before) {
+        ctx.bus.emit('activity:unsuppress', rel);
+        return { ok: true };
+      }
+      try {
+        await history.writeSnapshot(rel, before, 'pre-delete-artboard');
+      } catch {
+        /* snapshot best-effort */
+      }
+      return { ok: true, seq: logUndo(r.abs, before, after) };
+    } catch (err) {
+      ctx.bus.emit('activity:unsuppress', rel);
+      return {
+        ok: false,
+        status: err instanceof CanvasEditError ? 422 : 500,
+        error: err instanceof Error ? err.message : 'delete-artboard failed',
+      };
+    }
+  }
+
+  /**
+   * Edit-scope verdict for the INV-3 predictability badge (Stage H). READ-only —
+   * parses the canvas + returns whether an edit to `id` is local or shared. No
+   * write, no undo, no rate-cap (a mere parse the shell runs on selection). The
+   * client supplies `rendered` = the DOM occurrence count of the cd-id so the
+   * `.map()` case is honest.
+   */
+  async function editScopeOp(input: {
+    canvas?: unknown;
+    id?: unknown;
+    rendered?: unknown;
+  }): Promise<({ ok: true } & EditScope) | { ok: false; status: number; error: string }> {
+    const r = resolveCanvasAbs(input.canvas);
+    if (!r.ok) return r;
+    const id = typeof input.id === 'string' ? input.id.trim() : '';
+    if (!CD_ID_RE.test(id)) return { ok: false, status: 400, error: 'invalid data-cd-id' };
+    const rendered = Number.isFinite(Number(input.rendered))
+      ? Math.max(1, Math.round(Number(input.rendered)))
+      : 1;
+    try {
+      const source = await Bun.file(r.abs).text();
+      const scope = resolveEditScope(r.abs, source, id, rendered);
+      return { ok: true, ...scope };
+    } catch (err) {
+      return { ok: false, status: 500, error: err instanceof Error ? err.message : 'scope failed' };
+    }
+  }
+
   async function toggleHideOp(input: {
     canvas?: unknown;
     stableId?: unknown;
@@ -2753,6 +3246,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     loadAnnotations,
     saveAnnotations,
     saveAsset,
+    listAssets,
     saveAssetFromStream,
     saveChatAttachment,
     resolveChatAttachment,
@@ -2769,6 +3263,13 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     compClips,
     reorder,
     retimeSequenceOp,
+    deleteElementOp,
+    insertElementOp,
+    insertArtboardOp,
+    resizeArtboardOp,
+    deleteArtboardOp,
+    duplicateElementOp,
+    editScopeOp,
     reorderRevert,
     buildIndexData,
     buildSystemData,

package/apps/studio/artboard-marquee.tsx

@@ -51,7 +51,7 @@ function shouldIgnoreTarget(t: EventTarget | null): boolean {
   // Skip floating chrome and existing overlays (their click handlers run).
   if (
     el.closest(
-      '.dc-mm, .dc-zoom-tb, .dc-tool-palette, .dc-context-menu, .dc-cv-halo, .dc-cv-group-bbox, .cm-composer, .cm-thread, .cm-mention-popup, .cm-pin, .dc-annot-svg, .dc-annot-ctx, .dc-tp-popover, .dc-annot-resize-handle, .dc-multi-artboard-tb, .dc-elem-ctx-tb, .dc-cv-eq-spacing-layer'
+      '.dc-mm, .dc-zoom-tb, .dc-tool-palette, .dc-context-menu, .dc-cv-halo, .dc-cv-group-bbox, .cm-composer, .cm-thread, .cm-mention-popup, .cm-pin, .dc-annot-svg, .dc-annot-ctx, .dc-tp-popover, .dc-annot-resize-handle, .dc-el-resize-handle, .dc-multi-artboard-tb, .dc-elem-ctx-tb, .dc-cv-eq-spacing-layer'
     )
   ) {
     return true;

package/apps/studio/bin/_canvas-rects-playwright.mjs

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+// _canvas-rects-playwright.mjs — playwright fallback for the geometry
+// manifest (feature-whiteboard-ai-toolkit), used by canvas-rects.sh only when
+// agent-browser isn't on PATH. Mirrors _enumerate-artboards-playwright.mjs's
+// shape: a subprocess (not a direct import) so `bun build --compile` of the
+// dev-server binary doesn't pull in playwright + chromium-bidi deep deps.
+//
+// Navigates the canvas-shell URL, waits for `window.__maudeCanvasRects` to
+// exist (the canvas-lib.tsx module-load side effect), and prints the
+// manifest JSON to stdout.
+//
+// Usage: _canvas-rects-playwright.mjs --url <url> [--timeout <sec>]
+
+import { launchChromium } from './_pw-launch.mjs';
+
+const args = process.argv.slice(2);
+let url;
+let timeoutSec = 8;
+for (let i = 0; i < args.length; i += 1) {
+  if (args[i] === '--url') {
+    i += 1;
+    url = args[i];
+  } else if (args[i] === '--timeout') {
+    i += 1;
+    timeoutSec = Number(args[i]) || timeoutSec;
+  }
+}
+if (!url) {
+  console.error('usage: _canvas-rects-playwright.mjs --url <url> [--timeout <sec>]');
+  process.exit(2);
+}
+
+const timeoutMs = timeoutSec * 1000;
+const browser = await launchChromium();
+try {
+  const ctx = await browser.newContext({ viewport: { width: 1440, height: 900 } });
+  const page = await ctx.newPage();
+  await page.goto(url, { waitUntil: 'networkidle', timeout: timeoutMs });
+  try {
+    await page.waitForFunction("typeof window.__maudeCanvasRects === 'function'", {
+      timeout: timeoutMs,
+    });
+  } catch {
+    // Non-canvas page (no .dc-canvas) or the hook never installed — the hook
+    // itself degrades gracefully (empty manifest), so proceed rather than fail.
+  }
+  const manifest = await page.evaluate(() =>
+    typeof window.__maudeCanvasRects === 'function'
+      ? window.__maudeCanvasRects()
+      : { artboards: [], elements: [], elementsTruncated: false }
+  );
+  console.log(JSON.stringify(manifest));
+} finally {
+  await browser.close();
+}