@1agh/maude 0.41.0 → 0.43.0

package/apps/studio/http.ts

@@ -10,20 +10,23 @@ import { dirname, join, posix, relative, resolve, sep } from 'node:path';
 
 import { probeAcpAvailability } from './acp/probe.ts';
 import { deleteChat, listChats, readChatMessages } from './acp/transcript.ts';
-import { type Api, ASSET_MAX_VIDEO_BYTES } from './api.ts';
+import { type Api, ASSET_MAX_BYTES, ASSET_MAX_VIDEO_BYTES } from './api.ts';
 import { buildCanvasModule } from './canvas-build.ts';
 import { canvasLibPath } from './canvas-lib-resolver.ts';
 import { TranspileError } from './canvas-pipeline.ts';
 import type { AiActivity } from './collab/ai-activity.ts';
 import type { Context } from './context.ts';
-import { isFormat, isScope, runExport } from './exporters/index.ts';
+import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
+import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
 import type { ActiveJsonShape } from './exporters/scope.ts';
+import { createFootageStore, FOOTAGE_MAX_BYTES } from './footage-store.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
 import type { Inspect } from './inspect.ts';
 import { canvasSlug, writeLocator } from './locator.ts';
-import { DEV_SERVER_ROOT } from './paths.ts';
+import { DEV_SERVER_ROOT, STICKERS_DIR } from './paths.ts';
+import { createPhotoStore, PHOTO_EDIT_MAX_BYTES } from './photo-store.ts';
 import { probeReadiness } from './readiness.ts';
 import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
 import { linkHub } from './sync/hub-link.ts';
@@ -594,7 +597,13 @@ export interface Http {
   isCanvasSafeRoute(pathname: string): boolean;
 }
 
-export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActivity): Http {
+export function createHttp(
+  ctx: Context,
+  api: Api,
+  inspect: Inspect,
+  ai: AiActivity,
+  exportJobs: ExportJobQueue
+): Http {
   // Cache invalidation — when canvas-lib changes, every cached canvas bundle
   // is stale because canvas-lib is inlined into each one via the resolver
   // plugin. Drop the whole cache so the next request rebuilds with the fresh
@@ -714,6 +723,12 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
   // `routes` map (the dual-allowlist rule), so the untrusted canvas iframe origin
   // can never reach status/commit/publish/get-latest. http.ts owns the gating;
   // git/endpoints.ts owns the orchestration.
+  const photoStore = createPhotoStore(ctx);
+  // feature-footage-analysis-director — footage-analysis + EDL sidecars.
+  // MAIN-ORIGIN ONLY (privileged): the `/_api/footage` route is intentionally
+  // absent from CANVAS_SAFE_API + startCanvasServer's `routes` map, so the
+  // untrusted canvas iframe origin can never read/write the director's analysis.
+  const footageStore = createFootageStore(ctx);
   const gitApi = createGitEndpoints(ctx);
   // Phase 28 (E3) — `/_api/github/*`. Same dual-allowlist rule: main-origin only,
   // and every route is token-bearing (server-held keychain token via the loopback
@@ -722,6 +737,38 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
   const gitJson = (r: { status: number; json: unknown }) =>
     Response.json(r.json, { status: r.status, headers: { 'Cache-Control': 'no-store' } });
 
+  // Shared by /_api/export and /_api/export-jobs — build the exportJobs.enqueue()
+  // args from a validated request body. `inspect.state` is the live `_active.json`;
+  // readers narrow to the resolver's subset locally so the export pipeline doesn't
+  // pin the wider ActiveState interface.
+  function buildExportArgs(
+    req: Request,
+    body: { format: Format; scope: Scope; options?: Record<string, unknown> }
+  ) {
+    const activeJson = inspect.state as unknown as ActiveJsonShape;
+    return {
+      format: body.format,
+      scope: body.scope,
+      options: body.options ?? {},
+      resolve: { activeJson, designRoot: ctx.paths.designRoot, repoRoot: ctx.paths.repoRoot },
+      ctx: {
+        designRoot: ctx.paths.designRoot,
+        repoRoot: ctx.paths.repoRoot,
+        // Adapters reach back into the server via this origin only when they
+        // need Playwright rendering (PNG / PDF / SVG / HTML). The host that
+        // received this request is, by definition, the one serving the canvas.
+        serverOrigin: new URL(req.url).origin,
+        // Mirror `client/app.jsx:85` — the per-DS tokensCssRel wins over the
+        // legacy top-level default (which still points at the pre-multi-DS
+        // layout `system/colors_and_type.css`). Without the per-DS path, the
+        // standalone `_canvas-shell.html` 404s on the tokens link and the
+        // rendered DOM uses `var(--bg-0)` unresolved → screenshots come out
+        // blank. See canvasShellUrl().
+        tokensCssRel: ctx.cfg.designSystems?.[0]?.tokensCssRel ?? ctx.cfg.tokensCssRel,
+      },
+    };
+  }
+
   const routes = {
     '/_health': () =>
       Response.json({
@@ -797,8 +844,8 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
     // expands to so Claude can Read it. MAIN-ORIGIN ONLY: sameOriginWrite CSRF gate
     // on POST + deliberately absent from CANVAS_SAFE_API + startCanvasServer routes,
     // so the untrusted canvas iframe is 403'd. The disk caps live in
-    // api.saveChatAttachment (magic-byte sniff / 10 MB / content-addressed name /
-    // session write budget).
+    // api.saveChatAttachment (magic-byte sniff / ASSET_MAX_BYTES / content-
+    // addressed name / session write budget).
     //
     // GET ?name=<sha8>.<ext> serves the pasted image back to the chat feed
     // (thumbnail + lightbox). The name is regex-allowlisted in
@@ -825,9 +872,12 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const declared = Number(req.headers.get('content-length') || '0');
-      if (Number.isFinite(declared) && declared > 10 * 1024 * 1024) {
+      if (Number.isFinite(declared) && declared > ASSET_MAX_BYTES) {
         return Response.json(
-          { ok: false, error: 'attachment exceeds the 10 MB cap' },
+          {
+            ok: false,
+            error: `attachment exceeds the ${Math.round(ASSET_MAX_BYTES / (1024 * 1024))} MB cap`,
+          },
           { status: 413, headers: { 'Cache-Control': 'no-store' } }
         );
       }
@@ -930,6 +980,87 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       return new Response('Method not allowed', { status: 405 });
     },
 
+    '/_api/photo-edit': async (req: Request) => {
+      // feature-photo-editor (Stage C, Task 8) — non-destructive PhotoEdit sidecar.
+      //   GET ?asset=<sha8 | assets/<sha8>.<ext>>  → stored PhotoEdit or {}
+      //   PUT/POST ?asset=<...> body { …PhotoEdit } → validated + persisted
+      // CANVAS-SAFE (listed in BOTH CANVAS_SAFE_API below AND startCanvasServer's
+      // `routes` map — Bun matches `routes` before `fetch`, so a one-list entry
+      // 404s from the canvas iframe, the DDR-088 rollout bug). Reached from the
+      // canvas origin by <PhotoLayer> (GET) and the headless bg-remove harness
+      // (PUT), so NO sameOriginWrite (it would block the legit canvas origin);
+      // the photo-store cap stack (sha8 validate + containment + validatePhotoEdit
+      // + size cap) is the load-bearing mitigation. loopback-Host gates DNS-
+      // rebinding on every method.
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const asset = new URL(req.url).searchParams.get('asset');
+      if (req.method === 'GET') {
+        const edit = await photoStore.getPhotoEdit(asset);
+        return Response.json(edit ?? {}, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method === 'PUT' || req.method === 'POST') {
+        const body = await readJson<unknown>(req, PHOTO_EDIT_MAX_BYTES + 1024);
+        if (body == null) return new Response('body required', { status: 400 });
+        const result = await photoStore.savePhotoEdit(asset, body);
+        if (!result.ok) {
+          return Response.json(
+            { ok: false, error: result.error },
+            { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+          );
+        }
+        return Response.json(
+          { ok: true, path: result.path, edit: result.edit },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return new Response('Method not allowed', { status: 405 });
+    },
+
+    '/_api/footage': async (req: Request) => {
+      // feature-footage-analysis-director (Task 2) — FootageAnalysis + EDL sidecars.
+      //   GET  ?asset=<sha8|assets/…>          → stored FootageAnalysis or {}
+      //   GET  ?slug=<cut-slug>                → stored Edl or {}
+      //   PUT/POST ?asset=<…> body {FootageAnalysis} → validated + persisted
+      //   PUT/POST ?slug=<…>  body {Edl}             → validated + persisted
+      // MAIN-ORIGIN ONLY (privileged — NOT in CANVAS_SAFE_API / startCanvasServer
+      // routes): written by the footage-analyst / footage-director agents over
+      // loopback, never the untrusted canvas iframe. A GET from the canvas origin
+      // 403s at the gate (canvas-origin-gate.test.ts). loopback-Host gates
+      // DNS-rebinding on every method; the footage-store cap stack (sha8/slug
+      // validate + containment + validate{FootageAnalysis,Edl} + size cap) is the
+      // load-bearing mitigation for the caller-derived write path.
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const params = new URL(req.url).searchParams;
+      const asset = params.get('asset');
+      const slug = params.get('slug');
+      if (!asset && !slug) return new Response('asset or slug required', { status: 400 });
+      const isEdl = !asset && !!slug;
+
+      if (req.method === 'GET') {
+        const data = isEdl
+          ? await footageStore.getEdl(slug)
+          : await footageStore.getAnalysis(asset);
+        return Response.json(data ?? {}, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method === 'PUT' || req.method === 'POST') {
+        const body = await readJson<unknown>(req, FOOTAGE_MAX_BYTES + 1024);
+        if (body == null) return new Response('body required', { status: 400 });
+        const result = isEdl
+          ? await footageStore.saveEdl(slug, body)
+          : await footageStore.saveAnalysis(asset, body);
+        if (!result.ok) {
+          return Response.json(
+            { ok: false, error: result.error },
+            { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+          );
+        }
+        return Response.json({ ok: true, ...result }, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      return new Response('Method not allowed', { status: 405 });
+    },
+
     '/_api/canvas-source': async (req: Request) => {
       // DDR-148 — read-only raw .tsx source for the Timeline panel's sequence/
       // keyframe parser. GET ?file=<canvas rel or slug> → { source }.
@@ -1436,10 +1567,13 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
-      const body = await readJson<{ canvas?: unknown; id?: unknown; text?: unknown }>(
-        req,
-        16 * 1024
-      );
+      const body = await readJson<{
+        canvas?: unknown;
+        id?: unknown;
+        text?: unknown;
+        occurrence?: unknown;
+        before?: unknown;
+      }>(req, 16 * 1024);
       if (!body) return new Response('body required', { status: 400 });
       const result = await api.editText(body);
       if (!result.ok) {
@@ -1813,9 +1947,11 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
     },
 
     '/_api/insert-element': async (req: Request) => {
-      // Stage I — insert a synthesized div/text/image relative to `refId`. POST
-      // { canvas, refId, position, kind, src?, refIndex? } → api.insertElementOp.
-      // Returns the new element's post-transpile id so the shell can select it.
+      // Stage I — insert a synthesized div/text/image relative to `refId`, OR —
+      // empty-artboard fallback — as a direct child of `artboardId` (exactly one
+      // of the two). POST { canvas, refId|artboardId, position, kind, src?,
+      // refIndex? } → api.insertElementOp. Returns the new element's
+      // post-transpile id so the shell can select it.
       // Whole-file undo seq. MAIN-ORIGIN ONLY (absent from both allowlists);
       // sameOriginWrite + loopback-Host gated. An `image` src is contained to
       // assets/ in the engine (no remote hotlink / ../ / scheme).
@@ -1827,6 +1963,7 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       const body = await readJson<{
         canvas?: unknown;
         refId?: unknown;
+        artboardId?: unknown;
         position?: unknown;
         kind?: unknown;
         src?: unknown;
@@ -1922,6 +2059,24 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       );
     },
 
+    '/_api/stickers': async (req: Request) => {
+      // Phase 4 (feature-whiteboard-annotation-improvements) — the bundled
+      // sticker catalogue for the StickerPicker. GET → { packs:[{slug, name,
+      // author, attributionUrl, license, stickers:[{file,keywords,url}]}] }.
+      // MAIN-ORIGIN ONLY: the picker is a shell dialog, same posture as
+      // /_api/assets above — absent from CANVAS_SAFE_API + startCanvasServer
+      // routes (dual-allowlist, DDR-054). Loopback-Host gated (DNS-rebinding);
+      // read-only, so no sameOriginWrite (GET).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const r = await api.listStickers();
+      return Response.json(
+        { ok: true, packs: r.packs },
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/edit-scope': async (req: Request) => {
       // Stage H (feature-element-editing-robustness) — the INV-3 predictability
       // verdict. GET ?canvas&id&rendered → { ok, scope:'local'|'shared',
@@ -2041,17 +2196,28 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
 
     '/_api/export-history': async (req: Request) => {
       // Phase 6.5 T10 — read-only recent-exports feed for the dialog's
-      // Recent tab. Writes happen as a side-effect of `/_api/export`.
+      // Recent tab. Writes happen as a side-effect of job completion
+      // (exporters/jobs.ts persistAndEvict) rather than this handler.
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      const history = await api.loadExportHistory();
+      const history = exportJobs.loadHistory();
       return Response.json({ history }, { headers: { 'Cache-Control': 'no-store' } });
     },
 
     '/_api/export': async (req: Request) => {
-      // Phase 6.5 — single dispatch endpoint for the export pipeline.
-      // POST body { format, scope, options? } → binary stream with
-      // Content-Disposition + Content-Type set by the adapter.
+      // feature-background-export-notification-center — thin wrapper over the
+      // job queue: enqueue() then await the SAME job's result. Byte-for-byte
+      // identical external contract to the old synchronous handler, so
+      // `/design:export` (CLI) and any other blocking caller need zero changes.
+      // sameOriginWrite CSRF + loopback-Host (DNS-rebinding) gated, matching
+      // the write-route convention elsewhere in this file (e.g.
+      // /_api/delete-element) — closed as part of the /flow:done security
+      // fan-out (defender finding: this POST now has a disk-write + queue-
+      // growth consequence a bare cross-origin form-POST could trigger).
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const body = await readJson<{
         format?: unknown;
         scope?: unknown;
@@ -2060,63 +2226,108 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
       if (!body) return new Response('body required', { status: 400 });
       if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
       if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
-      // `inspect.state` is the live `_active.json` — readers narrow to the
-      // resolver's subset locally so the export pipeline doesn't pin the
-      // wider ActiveState interface.
-      const activeJson = inspect.state as unknown as ActiveJsonShape;
+      const format = body.format;
+      const scope = body.scope;
       try {
-        const result = await runExport({
-          format: body.format,
-          scope: body.scope,
-          options: body.options ?? {},
-          resolve: { activeJson, designRoot: ctx.paths.designRoot, repoRoot: ctx.paths.repoRoot },
-          ctx: {
-            designRoot: ctx.paths.designRoot,
-            repoRoot: ctx.paths.repoRoot,
-            // Adapters reach back into the server via this origin only when
-            // they need Playwright rendering (PNG / PDF / SVG / HTML). The
-            // host that received this request is, by definition, the one
-            // serving the canvas.
-            serverOrigin: new URL(req.url).origin,
-            // Mirror `client/app.jsx:85` — the per-DS tokensCssRel wins over
-            // the legacy top-level default (which still points at the pre-
-            // multi-DS layout `system/colors_and_type.css`). Without the
-            // per-DS path, the standalone `_canvas-shell.html` 404s on the
-            // tokens link and the rendered DOM uses `var(--bg-0)` unresolved
-            // → screenshots come out blank. See canvasShellUrl().
-            tokensCssRel: ctx.cfg.designSystems?.[0]?.tokensCssRel ?? ctx.cfg.tokensCssRel,
-          },
-        });
-        // Fire-and-forget history append — failure here doesn't block the
-        // download. Synchronous await keeps the order: history reflects the
-        // export the moment the client sees a 200.
-        try {
-          await api.appendExportHistory({
-            format: body.format,
-            scope: body.scope,
-            options: body.options ?? {},
-            filename: result.filename,
-            at: new Date().toISOString(),
-          });
-        } catch {
-          /* ignore — history is best-effort */
-        }
+        const { result } = exportJobs.enqueue(
+          buildExportArgs(req, { format, scope, options: body.options })
+        );
+        const finished = await result;
         // Bun.serve accepts Uint8Array directly; the cast satisfies the
         // SharedArrayBuffer-strict BodyInit narrowing on @types/bun.
-        return new Response(result.body as unknown as BodyInit, {
+        return new Response(finished.body as unknown as BodyInit, {
           status: 200,
           headers: {
-            'Content-Type': result.contentType,
-            'Content-Disposition': `attachment; filename="${result.filename}"`,
+            'Content-Type': finished.contentType,
+            'Content-Disposition': `attachment; filename="${finished.filename}"`,
             'Cache-Control': 'no-store',
           },
         });
       } catch (err) {
+        if (err instanceof ExportQueueFullError) {
+          return new Response(err.message, { status: 429 });
+        }
         const msg = err instanceof Error ? err.message : String(err);
         return new Response(`export failed: ${msg}`, { status: 500 });
       }
     },
 
+    '/_api/export-jobs': async (req: Request) => {
+      // feature-background-export-notification-center — the non-blocking
+      // sibling of /_api/export: same body, returns 202 { jobId } immediately
+      // without awaiting the render. MAIN-ORIGIN ONLY (absent from
+      // CANVAS_SAFE_API + startCanvasServer routes, same trust boundary as
+      // /_api/export today — DDR-060). loopback-Host gated on every method;
+      // the mutating POST is additionally sameOriginWrite CSRF gated (same
+      // /flow:done security fan-out fix as /_api/export above).
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method === 'GET') {
+        return Response.json(
+          { jobs: exportJobs.list() },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      const body = await readJson<{
+        format?: unknown;
+        scope?: unknown;
+        options?: Record<string, unknown>;
+      }>(req, 64 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
+      if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      try {
+        const { id, result } = exportJobs.enqueue(
+          buildExportArgs(req, { format: body.format, scope: body.scope, options: body.options })
+        );
+        // This route deliberately doesn't await the render — the job's own
+        // status (surfaced via GET /_api/export-jobs + the export:job WS
+        // push) is the completion signal. A render failure still needs a
+        // handler here or it's an unhandled rejection on every failed/timed-
+        // out background job (security fan-out finding, /flow:done) — the
+        // failure is already recorded on the job record, so this is a no-op.
+        result.catch(() => {});
+        return Response.json(
+          { jobId: id },
+          { status: 202, headers: { 'Cache-Control': 'no-store' } }
+        );
+      } catch (err) {
+        if (err instanceof ExportQueueFullError) {
+          return new Response(err.message, { status: 429 });
+        }
+        throw err;
+      }
+    },
+
+    '/_api/export-jobs/download': async (req: Request) => {
+      // MAIN-ORIGIN ONLY, same boundary as /_api/export-jobs above.
+      // loopback-Host gated (read-only — no sameOriginWrite needed — but an
+      // unguessable job-scoped UUID plus this guard closes the DNS-rebinding
+      // angle the /flow:done security fan-out checked for).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const id = new URL(req.url).searchParams.get('id');
+      if (!id) return new Response('id query param required', { status: 400 });
+      const dl = await exportJobs.getBytes(id);
+      if (!dl.ok) {
+        return new Response(dl.reason === 'not-done' ? 'job not finished' : 'Not found', {
+          status: dl.reason === 'not-done' ? 409 : 404,
+        });
+      }
+      return new Response(dl.bytes as unknown as BodyInit, {
+        status: 200,
+        headers: {
+          'Content-Type': dl.contentType,
+          'Content-Disposition': `attachment; filename="${dl.filename}"`,
+          'Cache-Control': 'no-store',
+        },
+      });
+    },
+
     '/_canvas-state': async (req: Request) => {
       const url = new URL(req.url);
       if (req.method === 'GET') {
@@ -2272,6 +2483,48 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
         }
       }
 
+      // Phase 4 (feature-whiteboard-annotation-improvements) — bundled sticker
+      // PNGs, served from MAUDE's OWN STICKERS_DIR (paths.ts, DDR-045), never
+      // the served project's designRoot (unlike /assets/ above). MAIN-ORIGIN
+      // ONLY: absent from CANVAS_SAFE_API + startCanvasServer's own routes
+      // object (server.ts) — a canvas-origin request 404s via isCanvasSafeRoute
+      // before ever reaching here (dual-allowlist, DDR-054/DDR-088).
+      if (pathname.startsWith('/_stickers/')) {
+        const rest = pathname.slice('/_stickers/'.length);
+        let decoded = '';
+        try {
+          decoded = decodeURIComponent(rest);
+        } catch {
+          return new Response('Bad request', { status: 400 });
+        }
+        const parts = decoded.split('/');
+        const [pack, name] = parts;
+        if (
+          parts.length === 2 &&
+          pack &&
+          name &&
+          /^[a-z0-9-]+$/.test(pack) &&
+          !name.includes('..') &&
+          !name.includes('/') &&
+          !name.includes('\\') &&
+          ext(name) === '.png'
+        ) {
+          const abs = join(STICKERS_DIR, pack, name);
+          const f = Bun.file(abs);
+          if (await f.exists()) {
+            return new Response(f, {
+              headers: {
+                'Content-Type': 'image/png',
+                'Cache-Control': 'public, max-age=31536000, immutable', // bundled with this maude version, never changes at this URL
+                'X-Content-Type-Options': 'nosniff',
+              },
+            });
+          }
+          return new Response('Not found', { status: 404 });
+        }
+        return new Response('Not found', { status: 404 });
+      }
+
       // Fall-through: serve user repo files (designRoot + everything under repoRoot).
       const fp = safePathUnderRoot(req.url, ctx.paths.repoRoot);
       if (!fp) return new Response('Forbidden', { status: 403 });
@@ -2363,7 +2616,8 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
     '/_api/git-user', // presence display name
     '/_api/canvas-meta', // layout/viewport sidecar (GET + PATCH)
     '/_api/annotations', // annotation SVG (GET + PUT) — drives the collab bridge
-    '/_api/asset', // Phase 23 — capped binary image upload (sniff+10MB+sha8 name+no-SVG)
+    '/_api/asset', // Phase 23 — capped binary image upload (sniff+category cap+sha8 name+no-SVG)
+    '/_api/photo-edit', // feature-photo-editor — PhotoEdit sidecar GET/PUT (cap-stack gated). MIRROR in server.ts routes.
     '/_api/git-committers', // @mention autocomplete
     '/_api/ai', // AI-activity banner
     '/_comments', // per-file comment list (renders pins)

package/apps/studio/input-router.tsx

@@ -330,6 +330,16 @@ export function isEditableTarget(t: EventTarget | null): boolean {
   const tag = el.tagName;
   if (tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT') return true;
   if (el.isContentEditable) return true;
+  // Dogfood fix — `.isContentEditable` is a computed/inherited property whose
+  // handling of the `contenteditable="plaintext-only"` token (the value the
+  // element-text-edit system uses, canvas-shell.tsx) has had cross-engine/
+  // version inconsistencies. Check the raw attribute too so a tool-letter
+  // shortcut (R, T, N, …) can never fire while that editor has focus,
+  // regardless of whether isContentEditable correctly reflects it in a given
+  // runtime — this was the reported bug (typing "R" while editing in-canvas
+  // text switched to the Rectangle tool).
+  const raw = el.getAttribute?.('contenteditable');
+  if (raw === 'true' || raw === 'plaintext-only' || raw === '') return true;
   return false;
 }
 

package/apps/studio/inspect.ts

@@ -47,6 +47,19 @@ export interface SelectedElement {
    * degrade to canvas-wide — never trust the positional id when stale.
    */
   stale?: boolean;
+  /**
+   * feature-photo-editor (Task 14) — which photo-editing context this
+   * selection is (an artboard `<img>` vs. an annotation `ImageStroke`), and
+   * the resolved `assets/<sha8>.<ext>` source. Client-derived (dom-selection.ts
+   * re-reads the live DOM, including a `data-photo-asset` tag stamped after an
+   * edit bakes) — round-tripped here (not dropped like the OTHER client-only
+   * fields such as `authored`/`computed`/`attrs`) because, unlike those, there
+   * is no cheap way to re-derive it from a plain server-side restore: losing it
+   * silently drops the Inspector's Photo tab on every canvas switch / reconnect
+   * until a fresh click re-selects the element.
+   */
+  photoKind?: 'artboard-img' | 'annotation-image';
+  photoAsset?: string;
 }
 
 /**
@@ -240,6 +253,19 @@ export function createInspect(
       v,
       canvas_mtime: mtimeFor(file),
       ...(id ? { id, canvas: deriveCanvasSlug(file) } : {}),
+      ...(() => {
+        if (sel.photoKind !== 'artboard-img' && sel.photoKind !== 'annotation-image') return {};
+        // `photoAsset` traces back to client-derived DOM state (a
+        // `data-photo-asset` attribute inside the untrusted canvas iframe,
+        // DDR-054) — unlike the sibling `text` field it had no shape/length
+        // constraint before persisting to `_active.json` and broadcasting to
+        // every connected WS peer (security review finding). It's always a
+        // fixed-shape `assets/<sha8>.<ext>` reference, so an unshaped value
+        // is dropped outright rather than merely truncated.
+        const asset = String(sel.photoAsset || '');
+        if (!/^assets\/[0-9a-f]{8}\.[a-z0-9]+$/i.test(asset)) return {};
+        return { photoKind: sel.photoKind, photoAsset: asset };
+      })(),
     };
   }
 
@@ -366,6 +392,26 @@ const INSPECTOR_SCRIPT = `
     '@keyframes dc-activity-glow { 0%, 100% { opacity: 0.4; } 50% { opacity: 0.85; } }',
     '@keyframes dc-activity-wave { from { transform: translateY(-100%); } to { transform: translateY(100%); } }',
     '@media (prefers-reduced-motion: reduce) { html .dc-activity-rim { transition: none; } html .dc-activity-rim::after { animation: none; opacity: 0.55; } html .dc-activity-scan { display: none; } }',
+    /* feature-photo-editor — background-removal busy reveal. A data-photo-busy
+       attribute toggle on the real img/image element (set by canvas-lib.tsx's
+       PhotoPreviewBridge on a photo-busy postMessage from the shell), styled
+       here at the same single injection point as the .dc-activity-* agent-edit
+       chrome above — same "something is actively happening" rim + pulse
+       language. Deliberately NOT a floating tracked overlay: that's the exact
+       architecture DDR-161's addendum removed from the live-edit preview
+       (z-index/resize/hit-testing bugs) — an attribute on the element itself
+       moves for free with pan/zoom/resize, no separate rect sync needed.
+       Deliberately opacity-only (not a moving mask-position sweep, tried
+       first): the ML pass runs single-threaded WASM on the main thread
+       (confirmed live — env.wasm.numThreads falls back without
+       crossOriginIsolated), which blocks per-frame style/paint work for the
+       ENTIRE inference; a mask-position animation froze mid-sweep for that
+       whole window. opacity is one of the few properties browsers composite
+       off the main thread unconditionally, so the pulse keeps animating
+       exactly when the page is busiest — the one moment it needs to. */
+    'html [data-photo-busy] { outline: 2px solid var(--mdcc-activity, hsl(210 90% 58%)); outline-offset: 2px; animation: dc-photo-busy-pulse 1100ms ease-in-out infinite; will-change: opacity; }',
+    '@keyframes dc-photo-busy-pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.5; } }',
+    '@media (prefers-reduced-motion: reduce) { html [data-photo-busy] { animation: none; opacity: 0.75; } }',
     /* Phase 13.1 / DDR-077 — "holding last good render" toast, shown when an
        agent edit produced a broken intermediate (build/render error) and the
        canvas is held instead of flashing white. Amber = warn, distinct from the
@@ -482,7 +528,13 @@ const INSPECTOR_SCRIPT = `
       return;
     }
     if (e.shiftKey) {
-      var id = k === 'i' ? 'inspector' : k === 'm' ? 'comments' : k === 'e' ? 'export' : k === 'h' ? 'handoff' : null;
+      // ⌘⇧T (timeline) + ⌘⇧G (changes) were missing here, so with focus inside
+      // the canvas iframe they never reached the shell — opening the Timeline
+      // (and its Space/arrow transport, which needs the dock focused) silently
+      // stopped working after a canvas interaction moved focus into the iframe.
+      // ⌘⇧T is also the browser "reopen closed tab" chord, so the preventDefault
+      // below is doubly load-bearing.
+      var id = k === 'i' ? 'inspector' : k === 'm' ? 'comments' : k === 'e' ? 'export' : k === 'h' ? 'handoff' : k === 't' ? 'timeline' : k === 'g' ? 'changes' : null;
       if (id) {
         e.preventDefault();
         try { window.parent.postMessage({ dgn: 'shell-shortcut', id: id }, '*'); } catch (err) {}

package/apps/studio/paths.ts

@@ -48,6 +48,16 @@ export const CLIENT_DIR: string = join(DEV_SERVER_ROOT, 'client');
 /** `<DEV_SERVER_ROOT>/dist/runtime/` — pre-built /_canvas-runtime/*.js bundles. */
 export const RUNTIME_BUNDLES_DIR: string = join(DIST_DIR, 'runtime');
 
+/**
+ * `<DEV_SERVER_ROOT>/stickers/` — bundled whiteboard sticker packs
+ * (feature-whiteboard-annotation-improvements, Phase 4). Ships with the
+ * `@1agh/maude` tarball (a subdir of `apps/studio`, already covered by the
+ * existing `files` entry — no separate packaging step). Resolved from
+ * DEV_SERVER_ROOT per DDR-045 — this is MAUDE's own bundled asset store, never
+ * the served project's.
+ */
+export const STICKERS_DIR: string = join(DEV_SERVER_ROOT, 'stickers');
+
 /**
  * Absolute path to a bundled plugin's loadable tree (`commands/`, `agents/`,
  * `skills/`, `hooks/`, `.claude-plugin/plugin.json`), or `null` when this layout