@1agh/maude 0.51.1 → 0.52.1

package/apps/studio/exporters/video.ts

@@ -41,8 +41,17 @@ const CONTENT_TYPE: Record<string, string> = {
   gif: 'image/gif',
 };
 
-/** Hard cap so a runaway/huge comp can't spawn an unbounded screenshot loop. */
-const MAX_FRAMES = 900; // 30 s @ 30 fps
+/** Default frame ceiling — 2 min @ 30 fps. Raisable per-export via
+ *  `options.maxFrames` (an editor invites longer cuts than the original 30 s
+ *  cap; the flatmap RCA's real 90 s reel already violated it). A request that
+ *  exceeds the resolved ceiling is REFUSED with remediation, never silently
+ *  truncated. */
+const DEFAULT_MAX_FRAMES = 3600;
+/** Absolute backstop for `options.maxFrames` itself (10 min @ 30 fps). */
+const MAX_FRAMES_CEILING = 18000;
+/** Above this, the frame-step fallback path gets slow (~2.5 s/frame) and 1080p
+ *  captures have died from memory pressure — warn loudly, recommend ≤720p. */
+const HEAVY_FRAMES_WARNING = 900; // 30 s @ 30 fps
 
 async function runVideo(
   format: VideoFormat,
@@ -112,8 +121,19 @@ async function runVideo(
   const fps = clampInt(options.fps, 1, 60);
   if (fps) args.push('--fps', String(fps));
 
-  const frames = resolveFrames(options, fps);
+  const maxFrames = resolveMaxFrames(options);
+  const frames = resolveFrames(options, fps, maxFrames);
   if (frames) args.push('--frames', String(frames));
+  // The shim clamps its comp-meta fallback to this same ceiling (and reports
+  // loudly when it has to), so raising the cap here raises it end-to-end.
+  args.push('--max-frames', String(maxFrames));
+  if ((frames ?? 0) > HEAVY_FRAMES_WARNING) {
+    console.error(
+      `⚠ long export: ${frames} frames. If the fast renderer falls back to ` +
+        `frame-step capture this runs ~2.5 s/frame; scale ≤2× (≈720–1080p) is ` +
+        'recommended for memory headroom.'
+    );
+  }
 
   if (format === 'gif') {
     const colors = clampInt(options.gifColors, 2, 256);
@@ -175,16 +195,35 @@ function clampInt(raw: unknown, lo: number, hi: number): number | undefined {
   return Math.max(lo, Math.min(hi, n));
 }
 
-/** Resolve the frame count from options (frames | durationMs×fps), capped. */
-function resolveFrames(options: ExportOptions, fps: number | undefined): number | undefined {
-  const explicit = clampInt(options.frames, 1, MAX_FRAMES);
-  if (explicit) return explicit;
+/** The frame ceiling for this export: `options.maxFrames` (clamped to the
+ *  absolute backstop) or the raised default. */
+function resolveMaxFrames(options: ExportOptions): number {
+  return clampInt(options.maxFrames, 1, MAX_FRAMES_CEILING) ?? DEFAULT_MAX_FRAMES;
+}
+
+/** Resolve the frame count from options (frames | durationMs×fps). A request
+ *  over the ceiling is REFUSED with remediation — never silently truncated. */
+function resolveFrames(
+  options: ExportOptions,
+  fps: number | undefined,
+  maxFrames: number
+): number | undefined {
+  const explicit = clampInt(options.frames, 1, MAX_FRAMES_CEILING);
   const durationMs = Number(options.durationMs);
-  if (Number.isFinite(durationMs) && durationMs > 0 && fps) {
-    return Math.min(MAX_FRAMES, Math.max(1, Math.round((durationMs / 1000) * fps)));
+  const fromDuration =
+    Number.isFinite(durationMs) && durationMs > 0 && fps
+      ? Math.max(1, Math.round((durationMs / 1000) * fps))
+      : undefined;
+  const requested = explicit ?? fromDuration;
+  if (requested != null && requested > maxFrames) {
+    throw new Error(
+      `export of ${requested} frames exceeds the ${maxFrames}-frame cap — ` +
+        'pass options.maxFrames to raise it (long exports can take minutes and real memory)'
+    );
   }
+  if (requested != null) return requested;
   // No hint → the shim falls back to the in-page comp meta (durationInFrames),
-  // still clamped there. Pass the ceiling so an unbounded comp can't run away.
+  // clamped to the --max-frames ceiling we pass it (loudly, never silently).
   return undefined;
 }
 

package/apps/studio/http.ts

@@ -24,6 +24,7 @@ import { ImportBrandError, importBrand } from './bin/_import-brand.mjs';
 import { buildCanvasModule } from './canvas-build.ts';
 import { canvasLibPath } from './canvas-lib-resolver.ts';
 import { TranspileError } from './canvas-pipeline.ts';
+import { createCloudEndpoints } from './cloud/endpoints.ts';
 import type { AiActivity } from './collab/ai-activity.ts';
 import type { Context } from './context.ts';
 import { reloadConfig } from './context.ts';
@@ -78,7 +79,6 @@ import {
 } from './generation/whisper-models.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
-import { createCloudEndpoints } from './cloud/endpoints.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
 import type { Inspect } from './inspect.ts';
 import { canvasSlug, writeLocator } from './locator.ts';
@@ -87,6 +87,7 @@ import { createPhotoStore, PHOTO_EDIT_MAX_BYTES } from './photo-store.ts';
 import { probeReadiness } from './readiness.ts';
 import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
 import { linkHub } from './sync/hub-link.ts';
+import { isHubReadOnly } from './sync/hubs-config.ts';
 import { signInToWorkspace, workspaceDisclosure } from './sync/workspace-signin.ts';
 import { readUiPrefs, type UiPrefs, writeUiPrefs } from './ui-prefs.ts';
 import { loadWhatsNew, resolveMaudeVersion } from './whats-new.ts';
@@ -1163,7 +1164,17 @@ export function createHttp(
       }
     },
 
-    '/_config': () => Response.json({ ...ctx.cfg, canvasOrigin: ctx.canvasOrigin }),
+    // `readOnly` is COMPUTED, not stored in cfg: it comes from the role the
+    // workspace vouched for at sign-in (Cloud Phase 25 C2), so the client
+    // knows before it draws anything. It decides what the UI OFFERS and is
+    // never what stops a write — the cell enforces that (Phase 25 C1),
+    // whatever a patched client believes.
+    '/_config': () =>
+      Response.json({
+        ...ctx.cfg,
+        canvasOrigin: ctx.canvasOrigin,
+        readOnly: ctx.cfg.linkedHub ? isHubReadOnly(ctx.cfg.linkedHub.url) : false,
+      }),
 
     // What's New feed (DDR-A) — read-only product-update list surfaced in the
     // Maude UI chrome. Main-origin only by omission from the canvas-origin
@@ -1241,7 +1252,10 @@ export function createHttp(
         const m = /^data:image\/(png|jpeg);base64,([A-Za-z0-9+/=]+)$/.exec(shot);
         if (!m || m[2].length > 7_000_000) continue; // ~5 MB decoded cap
         n += 1;
-        await Bun.write(join(dir, `screenshot-${n}.${m[1] === 'png' ? 'png' : 'jpg'}`), Buffer.from(m[2], 'base64'));
+        await Bun.write(
+          join(dir, `screenshot-${n}.${m[1] === 'png' ? 'png' : 'jpg'}`),
+          Buffer.from(m[2], 'base64')
+        );
       }
       return Response.json(
         { dir: relative(ctx.paths.repoRoot, dir), screenshots: n },
@@ -1810,6 +1824,12 @@ export function createHttp(
     // DELETE /_api/github/identity here; see DDR-114.)
     '/_api/cloud/status': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      // isLoopbackHost is a DNS-rebind guard, not a CSRF guard: a cross-site
+      // page can issue a no-cors GET at 127.0.0.1:<port>. These two GETs read
+      // the cloud credential's identity and (for projects) make a Bearer call
+      // whose 401 DELETES the stored credential — a confused deputy worth
+      // closing (validate 2026-07-30, defender F6).
+      if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required', { status: 403 });
       return gitJson(cloudApi.status());
@@ -1841,6 +1861,7 @@ export function createHttp(
     },
     '/_api/cloud/projects': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required', { status: 403 });
       return gitJson(await cloudApi.projects());
@@ -1863,8 +1884,13 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required', { status: 403 });
-      const body = (await req.json().catch(() => ({}))) as { code?: string };
-      return gitJson(await cloudApi.attachCode(String(body.code ?? '')));
+      const body = (await req.json().catch(() => ({}))) as { code?: string; project?: string };
+      return gitJson(
+        await cloudApi.attachCode(
+          String(body.code ?? ''),
+          typeof body.project === 'string' ? body.project : undefined
+        )
+      );
     },
 
     '/_api/github/identity': async (req: Request) => {
@@ -2186,6 +2212,53 @@ export function createHttp(
       );
     },
 
+    '/_api/clip-edit': async (req: Request) => {
+      // feature-enhanced-video-editing (Phase 2) — parametric clip verbs, one
+      // dispatch route: POST { canvas, artboardId?, stableId, contentHash?,
+      // verb: speed|trim-in|audio|detach-audio|framing|grade|transition, …verb
+      // params }. Same MAIN-ORIGIN-ONLY trust boundary as the other source
+      // writes (absent from CANVAS_SAFE_API + startCanvasServer routes,
+      // DDR-054) — this is also the agent door for /design:edit's timeline
+      // vocabulary.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        artboardId?: unknown;
+        stableId?: unknown;
+        contentHash?: unknown;
+        verb?: unknown;
+        rate?: unknown;
+        deltaFrames?: unknown;
+        muted?: unknown;
+        volume?: unknown;
+        framing?: unknown;
+        grade?: unknown;
+        presentation?: unknown;
+        durationInFrames?: unknown;
+        atFrame?: unknown;
+        src?: unknown;
+        mediaKind?: unknown;
+        text?: unknown;
+        toIndex?: unknown;
+      }>(req, 16 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.clipEditOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq, ...result.extra },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/remove-sequence': async (req: Request) => {
       // DDR-150 P3 — remove a clip. POST { canvas, stableId, artboardId?,
       // contentHash? } → removeClip (fingerprint + semantic gate; refuses the
@@ -2234,7 +2307,10 @@ export function createHttp(
         durationInFrames?: unknown;
         mediaTag?: unknown;
         src?: unknown;
-      }>(req, 8 * 1024);
+        lane?: unknown;
+        index?: unknown;
+        placeholder?: unknown;
+      }>(req, 16 * 1024);
       if (!body) return new Response('body required', { status: 400 });
       const result = await api.insertSequenceOp(body);
       if (!result.ok) {
@@ -2269,6 +2345,7 @@ export function createHttp(
         refStableId?: unknown;
         refContentHash?: unknown;
         position?: unknown;
+        mode?: unknown;
       }>(req, 8 * 1024);
       if (!body) return new Response('body required', { status: 400 });
       const result = await api.reorderSequenceOp(body);
@@ -3750,6 +3827,36 @@ export function createHttp(
       );
     },
 
+    '/_api/timeline-media': async (req: Request) => {
+      // Task 7 (enhanced-video-editing) — filmstrip/waveform cache. Runtime
+      // state under `_canvas-state/timeline-media/` (DDR-115). MAIN-ORIGIN only
+      // (shell UI cache — not in CANVAS_SAFE_API / startCanvasServer routes).
+      // DNS-rebinding guard on BOTH methods (security review 2026-07-30): under
+      // rebinding sameOriginWrite passes (page origin == req origin == attacker
+      // host), so a remote page could otherwise READ the cache (filmstrip JPEG
+      // dataURLs of local footage → disclosure) or WRITE arbitrary JSON later
+      // rendered as <img src> in the trusted shell. The loopback-host check is
+      // the same backstop every sibling privileged route carries.
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const url = new URL(req.url);
+      const key = url.searchParams.get('key') ?? '';
+      if (req.method === 'GET') {
+        const data = await api.timelineMediaLoad(key);
+        if (!data) return Response.json({ ok: false }, { status: 404 });
+        return Response.json({ ok: true, data }, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method === 'PUT' || req.method === 'POST') {
+        if (!sameOriginWrite(req))
+          return new Response('cross-origin write rejected', { status: 403 });
+        const body = await readJson<Record<string, unknown>>(req, 8 * 1024 * 1024);
+        if (!body) return new Response('body required', { status: 400 });
+        const ok = await api.timelineMediaSave(key, body);
+        return Response.json({ ok }, { status: ok ? 200 : 400 });
+      }
+      return new Response('Method not allowed', { status: 405 });
+    },
+
     '/_canvas-state': async (req: Request) => {
       const url = new URL(req.url);
       if (req.method === 'GET') {

package/apps/studio/ripple.ts

@@ -0,0 +1,335 @@
+// ripple.ts — pure ripple engine (feature-enhanced-video-editing, Phase 0).
+//
+// When a clip's length changes (trim, speed, split, insert, remove), everything
+// AFTER the edit point must shift so the cut stays gapless — the "magnetic"
+// contract. Series clips (`TransitionSeries.Sequence` / `Series.Sequence`)
+// need no `from` shift (Remotion computes their offsets), but the comp TOTAL
+// still moves; standalone `<Sequence from={…}>` clips shift their `from`.
+//
+// The engine is PURE (source in → source out) and deliberately conservative:
+//   • literal ints rewrite in place (`from={90}` → `from={102}`);
+//   • additive const-arithmetic rewrites by merging the trailing integer term
+//     (`from={A + B - 20}` +12 → `from={A + B - 8}`) or appending one
+//     (`from={A}` +12 → `from={A + 12}`) — the symbolic form survives;
+//   • an expression it can't RESOLVE (function call, ternary, unknown ident)
+//     is refused loudly with a structured RippleError naming the clip — the UI
+//     renders that as guidance, never a silent mis-shift.
+//
+// Double-shift guard: the comp TOTAL is bumped FIRST (const-preferring, so a
+// shared `const TOTAL = A + B` updates every user consistently). Each
+// downstream `from` expression is then evaluated under the ORIGINAL and the
+// POST-TOTAL const environments — an expression that already moved by the
+// delta (e.g. `from={TOTAL - 60}` on an end card) is SKIPPED, one that didn't
+// move gets the textual shift, and one that moved by anything else (partial
+// coupling) is refused rather than guessed at.
+
+import MagicString from 'magic-string';
+import { parseSync } from 'oxc-parser';
+
+import { assertCompSemantics, CanvasEditError, enumerateClips } from './canvas-edit.ts';
+
+/** Structured refusal — a subclass so the api layer's `instanceof
+ *  CanvasEditError → 422` mapping (and its error message plumbing) applies. */
+export class RippleError extends CanvasEditError {
+  /** The unrewritable expression, when that's what was refused. */
+  readonly expr: string | null;
+  constructor(message: string, info: { canvas: string; id: string; expr?: string | null }) {
+    super(message, info);
+    this.name = 'RippleError';
+    this.expr = info.expr ?? null;
+  }
+}
+
+export interface RippleResult {
+  source: string;
+  /** stableIds of clips whose `from` was textually shifted. */
+  shifted: string[];
+  /** True when the comp duration (attr or its const) was rewritten. */
+  totalEdited: boolean;
+}
+
+export interface RippleOptions {
+  /** Shift downstream standalone `from` attrs (default true). */
+  shiftFroms?: boolean;
+  /** Bump the comp's durationInFrames / its const (default true). */
+  bumpTotal?: boolean;
+}
+
+// ---------------------------------------------------------------------------
+// Const resolution (mirrors timeline-parse.js — literal pass, then up to 3
+// expression passes so `const TOTAL = A + B - XF` resolves).
+
+const IDENT_RE = /^[A-Za-z_$][\w$]*$/;
+const SAFE_EXPR_RE = /^[A-Za-z0-9_$+\-*/()\s.]+$/;
+
+export function collectConsts(source: string): Record<string, number> {
+  const consts: Record<string, number> = {};
+  for (const m of source.matchAll(/\bconst\s+([A-Za-z_$][\w$]*)\s*=\s*(-?\d+)\s*;/g)) {
+    consts[m[1] as string] = Number(m[2]);
+  }
+  for (let pass = 0; pass < 3; pass += 1) {
+    for (const m of source.matchAll(/\bconst\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+);/g)) {
+      const name = m[1] as string;
+      if (Object.hasOwn(consts, name)) continue;
+      const v = resolveNum(m[2] as string, consts);
+      if (v != null) consts[name] = v;
+    }
+  }
+  return consts;
+}
+
+/** Resolve an expression to an integer: a literal, a known const, or simple
+ *  arithmetic of them. `null` when not resolvable. */
+export function resolveNum(raw: string, consts: Record<string, number>): number | null {
+  const t = String(raw ?? '').trim();
+  if (!t) return null;
+  if (/^-?\d+$/.test(t)) return Number(t);
+  if (IDENT_RE.test(t)) return Object.hasOwn(consts, t) ? (consts[t] as number) : null;
+  if (!SAFE_EXPR_RE.test(t)) return null;
+  const substituted = t.replace(/[A-Za-z_$][\w$]*/g, (id) =>
+    Object.hasOwn(consts, id) ? String(consts[id]) : id
+  );
+  if (!/^[-+*/()\d\s.]+$/.test(substituted) || !/\d/.test(substituted)) return null;
+  try {
+    // eslint-disable-next-line no-new-func
+    const v = Function(`"use strict";return (${substituted});`)() as unknown;
+    return typeof v === 'number' && Number.isFinite(v) ? Math.round(v) : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Shift an additive-friendly expression by `delta`, preserving its symbolic
+ * form: a literal rewrites in place; a trailing integer term merges
+ * (`A + B - 20` +12 → `A + B - 8`); anything else valid gets ` + delta`
+ * appended. Returns null for an expression outside the safe charset — the
+ * caller refuses those (resolvability is checked separately).
+ */
+export function shiftExpression(expr: string, delta: number): string | null {
+  const t = String(expr ?? '').trim();
+  if (!t || !SAFE_EXPR_RE.test(t)) return null;
+  if (delta === 0) return t;
+  if (/^-?\d+$/.test(t)) return String(Number(t) + delta);
+  const trailing = t.match(/^(.*?)([+-])\s*(\d+)\s*$/);
+  if (trailing) {
+    const base = (trailing[1] as string).trim();
+    // Only merge when the trailing int is a TERM of a top-level sum — a base
+    // ending in an operator or '(' means the int is an operand of * / ( … ),
+    // where merging would change the math. Fall through to append instead.
+    if (base && !/[+\-*/(]$/.test(base)) {
+      const cur = (trailing[2] === '-' ? -1 : 1) * Number(trailing[3]);
+      const next = cur + delta;
+      if (next === 0) return base;
+      return `${base} ${next < 0 ? '-' : '+'} ${Math.abs(next)}`;
+    }
+  }
+  return delta < 0 ? `${t} - ${-delta}` : `${t} + ${delta}`;
+}
+
+// ---------------------------------------------------------------------------
+// Attr helpers — regex over ONE opening tag's text (the retimeAttr house style).
+
+export interface AttrSpan {
+  /** Absolute span of the inner expression (between the braces). */
+  start: number;
+  end: number;
+  inner: string;
+}
+
+/** Locate `name={…}` inside the opening tag that starts at `tagStart`. */
+export function attrExprSpan(source: string, tagStart: number, name: string): AttrSpan | null {
+  const gt = source.indexOf('>', tagStart);
+  const tag = source.slice(tagStart, gt < 0 ? source.length : gt + 1);
+  const m = tag.match(new RegExp(`\\b${name}=\\{\\s*([^}]*?)\\s*\\}`));
+  if (!m || m.index == null) return null;
+  const braceRel = m[0].indexOf('{');
+  const innerRel = m[0].indexOf(m[1] as string, braceRel);
+  // Empty inner (`from={}` is invalid JSX anyway) — treat as absent.
+  if ((m[1] as string) === '') return null;
+  const start = tagStart + m.index + innerRel;
+  return { start, end: start + (m[1] as string).length, inner: m[1] as string };
+}
+
+// ---------------------------------------------------------------------------
+// TOTAL rewrite (const-preferring, mirrors retimeAttr's preference order).
+
+function findVideoCompTagStart(source: string, compName: string): number | null {
+  const re = /<VideoComp\b[^>]*>/g;
+  let m: RegExpExecArray | null = re.exec(source);
+  while (m) {
+    if (new RegExp(`component=\\{\\s*${compName}\\s*\\}`).test(m[0])) return m.index;
+    m = re.exec(source);
+  }
+  return null;
+}
+
+/** Plan the TOTAL bump on a scratch copy; returns the edited source or null
+ *  when there is nothing to bump (no comp usage / no durationInFrames attr). */
+function bumpTotal(
+  canvasAbsPath: string,
+  source: string,
+  compName: string,
+  delta: number
+): string | null {
+  const tagStart = findVideoCompTagStart(source, compName);
+  if (tagStart == null) return null;
+  const attr = attrExprSpan(source, tagStart, 'durationInFrames');
+  if (!attr) return null;
+  const s = new MagicString(source);
+  const inner = attr.inner.trim();
+  if (IDENT_RE.test(inner)) {
+    // durationInFrames={TOTAL} — rewrite the const so every other user of it
+    // (end-card `from={TOTAL - 60}`, interpolate windows) follows consistently.
+    const cm = source.match(new RegExp(`\\bconst\\s+${inner}\\s*=\\s*([^;\\n]+);`));
+    if (!cm || cm.index == null) {
+      throw new RippleError(
+        `comp duration is {${inner}} but no \`const ${inner} = …\` was found to rewrite`,
+        { canvas: canvasAbsPath, id: compName, expr: inner }
+      );
+    }
+    const init = (cm[1] as string).trim();
+    const initStart = cm.index + (cm[0] as string).indexOf(cm[1] as string);
+    const consts = collectConsts(source);
+    if (resolveNum(init, consts) == null) {
+      throw new RippleError(
+        `cannot ripple the comp duration: \`const ${inner} = ${init}\` is not simple arithmetic — adjust it by hand`,
+        { canvas: canvasAbsPath, id: compName, expr: init }
+      );
+    }
+    const next = shiftExpression(init, delta);
+    if (next == null) {
+      throw new RippleError(`cannot ripple the comp duration expression \`${init}\``, {
+        canvas: canvasAbsPath,
+        id: compName,
+        expr: init,
+      });
+    }
+    s.overwrite(initStart, initStart + (cm[1] as string).length, next);
+    return s.toString();
+  }
+  const consts = collectConsts(source);
+  if (resolveNum(inner, consts) == null) {
+    throw new RippleError(
+      `cannot ripple the comp duration: \`durationInFrames={${inner}}\` is not simple arithmetic`,
+      { canvas: canvasAbsPath, id: compName, expr: inner }
+    );
+  }
+  const next = shiftExpression(inner, delta);
+  if (next == null) {
+    throw new RippleError(`cannot ripple the comp duration expression \`${inner}\``, {
+      canvas: canvasAbsPath,
+      id: compName,
+      expr: inner,
+    });
+  }
+  s.overwrite(attr.start, attr.end, next);
+  return s.toString();
+}
+
+// ---------------------------------------------------------------------------
+// The engine.
+
+/**
+ * Ripple everything after `afterStableId` by `deltaFrames` (positive = the
+ * clip grew / one was inserted; negative = it shrank / was removed). Pure —
+ * returns the new source; the caller owns disk writes and locking. Throws
+ * `RippleError` (a `CanvasEditError`) with a user-renderable message when an
+ * expression can't be rewritten safely.
+ */
+export function applyRippleAfterClip(
+  canvasAbsPath: string,
+  source: string,
+  artboardId: string | undefined,
+  afterStableId: string,
+  deltaFrames: number,
+  options: RippleOptions = {}
+): RippleResult {
+  const shiftFroms = options.shiftFroms !== false;
+  const doTotal = options.bumpTotal !== false;
+  const delta = Math.round(deltaFrames);
+  if (delta === 0) return { source, shifted: [], totalEdited: false };
+
+  const before = enumerateClips(canvasAbsPath, source, artboardId);
+  const targetIdx = before.clips.findIndex((c) => c.stableId === afterStableId);
+  if (targetIdx < 0) {
+    throw new CanvasEditError(`clip "${afterStableId}" not found`, {
+      canvas: canvasAbsPath,
+      id: afterStableId,
+    });
+  }
+  const compName = before.compName;
+
+  const consts0 = collectConsts(source);
+
+  // Stage 1 — TOTAL (const-preferring, so shared users follow consistently).
+  let mid = source;
+  let totalEdited = false;
+  if (doTotal && compName) {
+    const bumped = bumpTotal(canvasAbsPath, mid, compName, delta);
+    if (bumped != null) {
+      mid = bumped;
+      totalEdited = true;
+    }
+  }
+  const consts1 = collectConsts(mid);
+
+  // Stage 2 — downstream standalone `from` shifts (fresh spans post-Stage-1).
+  const shifted: string[] = [];
+  if (shiftFroms) {
+    const after = enumerateClips(canvasAbsPath, mid, artboardId);
+    const idx = after.clips.findIndex((c) => c.stableId === afterStableId);
+    const downstream = after.clips.slice(idx + 1).filter((c) => c.kind === 'sequence');
+    const s = new MagicString(mid);
+    let touched = false;
+    for (const clip of downstream) {
+      if (clip.tag !== 'Sequence') continue; // series clips position themselves
+      const attr = attrExprSpan(mid, clip.start, 'from');
+      if (!attr) continue; // cursor-implicit — follows the flow by construction
+      const v0 = resolveNum(attr.inner, consts0);
+      const v1 = resolveNum(attr.inner, consts1);
+      if (v0 == null || v1 == null) {
+        throw new RippleError(
+          `cannot ripple "${clip.stableId}": \`from={${attr.inner.trim()}}\` is not simple arithmetic — move it by hand, then retry`,
+          { canvas: canvasAbsPath, id: clip.stableId, expr: attr.inner.trim() }
+        );
+      }
+      if (v1 - v0 === delta) continue; // already follows the bumped const
+      if (v1 !== v0) {
+        throw new RippleError(
+          `cannot ripple "${clip.stableId}": \`from={${attr.inner.trim()}}\` is partially coupled to the comp duration — adjust it by hand`,
+          { canvas: canvasAbsPath, id: clip.stableId, expr: attr.inner.trim() }
+        );
+      }
+      if (v0 + delta < 0) {
+        throw new RippleError(
+          `cannot ripple "${clip.stableId}": it would start at frame ${v0 + delta} (before 0)`,
+          { canvas: canvasAbsPath, id: clip.stableId }
+        );
+      }
+      const next = shiftExpression(attr.inner, delta);
+      if (next == null) {
+        throw new RippleError(
+          `cannot ripple "${clip.stableId}": \`from={${attr.inner.trim()}}\` can't be rewritten`,
+          { canvas: canvasAbsPath, id: clip.stableId, expr: attr.inner.trim() }
+        );
+      }
+      s.overwrite(attr.start, attr.end, next);
+      shifted.push(clip.stableId);
+      touched = true;
+    }
+    if (touched) mid = s.toString();
+  }
+
+  if (mid === source) return { source, shifted, totalEdited };
+
+  const parsed = parseSync(canvasAbsPath, mid, { sourceType: 'module' });
+  if (parsed.errors && parsed.errors.length > 0) {
+    throw new CanvasEditError(
+      `ripple produced invalid source: ${parsed.errors[0]?.message ?? 'parse error'}`,
+      { canvas: canvasAbsPath, id: afterStableId }
+    );
+  }
+  assertCompSemantics(canvasAbsPath, mid);
+  return { source: mid, shifted, totalEdited };
+}

package/apps/studio/sync/hub-link.ts

@@ -108,8 +108,8 @@ async function probeHealth(url: string): Promise<{ ok: boolean; version?: string
   }
 }
 
-/** Upsert the token under `normUrl` + record per-machine trust; mode 0600. */
-export function saveHubCredential(normUrl: string, token: string): void {
+/** Upsert the token (+ the vouched role) under `normUrl` + record per-machine trust; mode 0600. */
+export function saveHubCredential(normUrl: string, token: string, role?: string): void {
   const path = hubsConfigPath();
   const dir = dirname(path);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
@@ -123,7 +123,7 @@ export function saveHubCredential(normUrl: string, token: string): void {
       /* malformed → start fresh rather than throw */
     }
   }
-  cfg.hubs[normUrl] = { token, linkedAt: Date.now() };
+  cfg.hubs[normUrl] = { token, linkedAt: Date.now(), ...(role ? { role } : {}) };
   if (!Array.isArray(cfg.trusted)) cfg.trusted = [];
   if (!cfg.trusted.includes(normUrl)) cfg.trusted.push(normUrl);
   writeFileSync(path, `${JSON.stringify(cfg, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });