@1agh/maude 0.58.2 → 0.59.0

package/apps/studio/annotations-bindings.ts

@@ -17,18 +17,69 @@ import {
   rotatePoint,
   type Stroke,
   strokeBBox,
+  strokeHitTest,
   strokeRotation,
 } from './annotations-model.ts';
 
-/** Hosts an arrow endpoint can attach to (shapes + cards, FigJam set). */
+/**
+ * The largest bbox a TEXT stroke may present as a bind target, PER AXIS.
+ *
+ * A `TextStroke` has no stored `w`/`h` — `strokeBBox` SYNTHESIZES one from the
+ * content (`max(8, longest * fontSize * 0.55)` wide). So a long single line can
+ * project a bind strip tens of thousands of px wide, and `bindCandidate` scans
+ * topmost-first with no area preference: one such stroke would silently become a
+ * board-wide magnet that steals every endpoint the user drags. Text bigger than
+ * a plausible label is therefore not offered as a host at all (DDR-216 D9).
+ */
+export const MAX_TEXT_BIND_W = 1200;
+export const MAX_TEXT_BIND_H = 480;
+
+/**
+ * Hosts an arrow endpoint can attach to (shapes + cards, FigJam set).
+ *
+ * **Widened to `text` + `section` (DDR-216 D9).** FigJam binds connectors to
+ * anything, and on the only real board measured 2/2 connectors had at least one
+ * endpoint Maude could not bind — so an imported connector degraded to a frozen
+ * line. It is also a plain native gap: you could not attach an arrow to a text
+ * label or a section, independent of import.
+ *
+ * Three deliberate exclusions, each closing a regression the naive widening
+ * would have introduced:
+ *
+ *  1. **ANCHORED text is still not bindable.** `bindCandidate`/`anchorPoint`/
+ *     `recomputeBoundArrows` call `strokeBBox(s)` WITHOUT the anchors map, and
+ *     for a text stroke with `anchorId` that returns `null`. Admitting it would
+ *     mint a bind that `anchorPoint` can never resolve — and `applyEnd` would
+ *     keep it (it only strips when the host stops being bindable), freezing the
+ *     arrow at stale coordinates forever. That is strictly worse than today's
+ *     honest "strip the bind, freeze the endpoint". Anchored text lives inside a
+ *     host shape which is itself bindable, so nothing is lost: bind to the shape.
+ *  2. **Oversized text is not offered** — see `MAX_TEXT_BIND_W`/`_H`.
+ *  3. **Groups are not bindable by construction** — Maude groups are a flat
+ *     `groupIds[]` tag array, not addressable objects. A group-targeted import
+ *     endpoint falls back to the group's geometric bbox and is reported.
+ */
 export function isBindable(s: Stroke): boolean {
-  return (
+  if (
     s.tool === 'rect' ||
     s.tool === 'ellipse' ||
     s.tool === 'polygon' ||
     s.tool === 'sticky' ||
     s.tool === 'image'
-  );
+  ) {
+    return true;
+  }
+  if (s.tool === 'section') return true;
+  if (s.tool === 'text') {
+    if (s.anchorId) return false; // (1) — no resolvable bbox without the anchors map
+    const bb = strokeBBox(s);
+    // Per-AXIS, not an area product: an area cap is satisfiable by a very wide,
+    // very short strip, which is precisely the board-wide magnet shape. 4 000
+    // chars at the fontSize floor of 8 gives w ≈ 17 600 × h ≈ 9.6 — area 168 960,
+    // comfortably under a 640×480 product (post-implementation review F8).
+    return !!bb && bb.w > 0 && bb.h > 0 && bb.w <= MAX_TEXT_BIND_W && bb.h <= MAX_TEXT_BIND_H; // (2)
+  }
+  return false;
 }
 
 /** Bind proximity threshold in world px at zoom 1 (Excalidraw's 15 px). */
@@ -78,6 +129,20 @@ export function bindCandidate(
     ) {
       continue;
     }
+    // A SECTION is a large container, and the natural gesture is to draw one
+    // AROUND existing notes — which puts it later in the array, i.e. topmost.
+    // Testing its raw bbox would make the whole interior a magnet, so every
+    // arrow drawn between two stickies inside a section would bind to the
+    // section instead. `strokeHitTest` already encodes the right rule (a section
+    // is grabbed by its BORDER or its label chip; the interior stays
+    // click-through), so defer to it rather than inventing a second geometry.
+    //
+    // Deliberately NOT "prefer the smallest containing bbox": containment here
+    // is over a bbox INFLATED by `threshold`, so smallest-area lets an 8×8 dot
+    // 14 px AWAY beat the large rect the pointer is actually inside — and it
+    // inverts the visual invariant, letting a shape hidden behind an opaque one
+    // win a bind the user cannot see happening (DDR-216 D9 fix 4).
+    if (s.tool === 'section' && !strokeHitTest(s, wx, wy, threshold)) continue;
     return {
       hostId: s.id,
       nx: snapMagnet(clamp01((wx - bb.x) / bb.w)),
@@ -155,7 +220,21 @@ export function recomputeBoundArrows(strokes: readonly Stroke[]): Stroke[] {
         }
       }
       const pt = anchorPoint(host, effective.nx, effective.ny);
-      if (!pt) return;
+      if (!pt) {
+        // The host is bindable but its bbox is unresolvable right now (e.g. a
+        // text stroke whose anchors map isn't reachable from here). Returning
+        // silently would KEEP a bind that can never be honoured — the arrow
+        // would freeze at stale coordinates permanently, across save/load,
+        // while still claiming to be attached. Strip it instead: the arrow
+        // survives unbound with its endpoint frozen, which is the same honest
+        // degradation a deleted host already gets. (DDR-216 D9 fix 2 — inert
+        // before the `isBindable` widening, load-bearing after it.)
+        const copy: ArrowStroke = { ...next };
+        delete copy[end === 'start' ? 'startBind' : 'endBind'];
+        next = copy;
+        mutated = true;
+        return;
+      }
       if (end === 'start') {
         if (next.x1 !== pt[0] || next.y1 !== pt[1]) {
           next = { ...next, x1: pt[0], y1: pt[1] };

package/apps/studio/annotations-layer.tsx

@@ -154,7 +154,13 @@ import {
 } from './annotations-snap.ts';
 import { arrowPrimitives, type SvgPrimitive } from './canvas-arrowheads.ts';
 import { IconLineThick, IconLineThin } from './canvas-icons.tsx';
-import { useViewportControllerContext, useWorldRefContext } from './canvas-lib.tsx';
+import {
+  countRender,
+  getLiveViewport,
+  useLiveViewport,
+  useViewportControllerContext,
+  useWorldRefContext,
+} from './canvas-lib.tsx';
 import { buildAnnotationStrokesRecord } from './commands/annotation-strokes-command.ts';
 import { ensureMenuStyles as ensureCtxMenuStyles } from './context-menu.tsx';
 import { crossedDragThreshold, type Tool } from './input-router.tsx';
@@ -948,6 +954,7 @@ function scaleStrokeInGroup(
 // Component
 
 export function AnnotationsLayer() {
+  countRender('annotationRenders');
   ensureAnnotStyles();
   const { tool, setTool, sticky, tools, shapeKind } = useToolMode();
   const theme = useCanvasChromeTheme();
@@ -1011,8 +1018,22 @@ export function AnnotationsLayer() {
   // endpoint free). Tracked here because endStroke (pointerup) carries no
   // modifier state of its own.
   const cmdHeldRef = useRef(false);
-  const vpRef = useRef(vp);
-  vpRef.current = vp;
+  const vpFallbackRef = useRef(vp);
+  vpFallbackRef.current = vp;
+  // Reads the LIVE viewport, not the published one. Publishing is settle-only
+  // (gesture-static React), so mirroring the published value here would freeze
+  // this ref for the whole gesture and every zoom-scaled threshold computed
+  // from it — bind distance, snap tolerance, hit-test slop, sticker placement —
+  // would silently use the pre-gesture zoom. Shaped as a ref so the ~40 existing
+  // `vpRef.current` call sites keep working unchanged.
+  const vpRef = useMemo(
+    () => ({
+      get current() {
+        return getLiveViewport() ?? vpFallbackRef.current;
+      },
+    }),
+    []
+  );
   const visibilityCtx = useAnnotationsVisibility();
   const chrome = useChromeVisibility();
   // Presentation Mode hides annotations without mutating the user's own
@@ -1655,7 +1676,9 @@ export function AnnotationsLayer() {
 
   const screenToWorld = useCallback(
     (cx: number, cy: number): [number, number] => {
-      const v = vp ?? { x: 0, y: 0, zoom: 1 };
+      // Live: this runs at event time (drop/placement), where the published
+      // viewport can be a whole gesture behind.
+      const v = vpRef.current ?? { x: 0, y: 0, zoom: 1 };
       const z = v.zoom || 1;
       return [(cx - v.x) / z, (cy - v.y) / z];
     },
@@ -1826,7 +1849,7 @@ export function AnnotationsLayer() {
 
   const eraseAt = useCallback(
     (wx: number, wy: number) => {
-      const zoom = vp?.zoom || 1;
+      const zoom = vpRef.current?.zoom || 1;
       const tol = 8 / zoom;
       const prev = strokesRef.current;
       for (let i = prev.length - 1; i >= 0; i--) {
@@ -4750,8 +4773,15 @@ function AddTextHint({ strokes, hintId }: { strokes: readonly Stroke[]; hintId:
  * marquee/drag handler yields).
  */
 function ConnectorDots({ stroke }: { stroke: Stroke }) {
-  const controller = useViewportControllerContext();
-  const zoom = controller?.viewport?.zoom || 1;
+  // LIVE zoom, deliberately not the published one. These are the counter-scaled
+  // chrome elements (connector dots, selection bbox, section-label chips): they
+  // must hold a constant SCREEN size while the world scales. Publishing is
+  // settle-only since the gesture-static change, so reading published zoom here
+  // would let this chrome grow and shrink with the world through a pinch and
+  // then jump back at settle — the visible fidelity-pop a previous LOD attempt
+  // was reverted for. These components render only for selected/hovered
+  // strokes, so tracking the gesture frame-by-frame stays cheap.
+  const zoom = useLiveViewport().zoom || 1;
   if (!isBindable(stroke)) return null;
   const center = strokeCenter(stroke);
   if (!center) return null;
@@ -4942,8 +4972,9 @@ function SelectionHalo({
   anchorsById: Map<string, AnchorHost>;
   multi: boolean;
 }) {
-  const controller = useViewportControllerContext();
-  const zoom = controller?.viewport?.zoom || 1;
+  // Counter-scaled chrome — must hold a constant screen size while the world
+  // scales, so it needs the live zoom, not the settle-cadence published one.
+  const zoom = useLiveViewport().zoom || 1;
   const bbox = strokeBBox(stroke, anchorsById);
   if (!bbox) return null;
   // T17 + post-Wave-2 fix — annotation halo idioms:
@@ -4990,8 +5021,9 @@ function AnnotGroupBbox({
   selectedStrokes: readonly Stroke[];
   anchorsById: Map<string, AnchorHost>;
 }) {
-  const controller = useViewportControllerContext();
-  const zoom = controller?.viewport?.zoom || 1;
+  // Counter-scaled chrome — must hold a constant screen size while the world
+  // scales, so it needs the live zoom, not the settle-cadence published one.
+  const zoom = useLiveViewport().zoom || 1;
   if (selectedStrokes.length < 2) return null;
   let xMin = Number.POSITIVE_INFINITY;
   let yMin = Number.POSITIVE_INFINITY;
@@ -5225,8 +5257,9 @@ function SectionLabelChip({
   y: number;
   hitMode: 'visiblePainted' | 'none';
 }) {
-  const controller = useViewportControllerContext();
-  const zoom = controller?.viewport?.zoom || 1;
+  // Counter-scaled chrome — must hold a constant screen size while the world
+  // scales, so it needs the live zoom, not the settle-cadence published one.
+  const zoom = useLiveViewport().zoom || 1;
   const fontSize = SECTION_LABEL_FONT / zoom;
   const chipH = SECTION_LABEL_H / zoom;
   const gap = 4 / zoom;
@@ -5279,8 +5312,9 @@ function SectionTitleEditor({
   onCommit: (text: string, fmt?: EditorFmt) => void;
   onCancel: () => void;
 }) {
-  const controller = useViewportControllerContext();
-  const zoom = controller?.viewport?.zoom || 1;
+  // Counter-scaled chrome — must hold a constant screen size while the world
+  // scales, so it needs the live zoom, not the settle-cadence published one.
+  const zoom = useLiveViewport().zoom || 1;
   const fontSize = SECTION_LABEL_FONT / zoom;
   const chipH = SECTION_LABEL_H / zoom;
   const gap = 4 / zoom;

package/apps/studio/api.ts

@@ -5260,7 +5260,12 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     // `loadCanvasMeta` call the DDR-093 DS-map loop below already makes for
     // non-path-owned (`ui/`) canvases — no extra I/O for the common case.
     const canvasKinds: Record<string, string> = {};
-    const NOTABLE_KINDS = new Set(['reconstructed-experimental']);
+    // DDR-216 D7 adds `imported-figma`. The badge deliberately reads as
+    // THIRD-PARTY CONTENT rather than as provenance-therefore-trustworthy: a
+    // clean "imported from Figma" stamp otherwise makes the most
+    // attacker-influenced artifact in the tree look like real design work, to a
+    // human AND to `design-system-keeper` / the critic panel.
+    const NOTABLE_KINDS = new Set(['reconstructed-experimental', 'imported-figma']);
     const defaultDs = cfg.defaultDesignSystem || cfg.designSystems?.[0]?.name || 'project';
     // A file under `system/<folder>/` belongs to the DS that owns that folder —
     // path-authoritative, because specimens/ui_kits rarely carry a sidecar

package/apps/studio/bin/_fetch-asset.mjs

@@ -39,9 +39,9 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { lookup } from 'node:dns/promises';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync } from 'node:fs';
 import { isIP } from 'node:net';
-import { join, resolve, sep } from 'node:path';
+import { basename, dirname, join, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 // A real browser UA — some CDNs (wikimedia) 403 a bare curl/UA; the memory
@@ -202,7 +202,7 @@ export function classifyAddress(addr) {
  * FetchAssetError (code 3) on anything else — non-https scheme, embedded
  * credentials, missing host.
  */
-export function parseHttpsTarget(rawUrl) {
+export function parseHttpsTarget(rawUrl, opts = {}) {
   let u;
   try {
     u = new URL(rawUrl);
@@ -221,9 +221,71 @@ export function parseHttpsTarget(rawUrl) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new FetchAssetError(3, `bad port ${u.port}`);
   }
+  // DDR-216 D4 — an OPTIONAL host allowlist, at the gate rather than at the
+  // caller. Absent (the default) = today's unrestricted behaviour, so the
+  // existing moodboard/research callers are untouched. The Figma lane always
+  // passes it.
+  //
+  // Matching is exact-or-DOTTED-SUFFIX, never a bare `endsWith`: `endsWith(
+  // 'figma.com')` admits `evil-figma.com`, and `endsWith('.amazonaws.com')`
+  // admits every S3 bucket on earth.
+  //
+  // This is a REACH control (which endpoint), never a CONTENT control — the
+  // Figma render bucket is a SHARED object store any account can write into,
+  // so the byte-level sniff below is what actually protects the tree. And it
+  // NARROWS the IP gate, never replaces it: an allowlisted hostname that
+  // resolves to 127.0.0.1 is still refused by `resolveSafeIp`.
+  if (opts.allowHosts?.length) {
+    const h = host.toLowerCase();
+    const ok = opts.allowHosts.some((suffix) => {
+      const s = String(suffix).toLowerCase().replace(/^\./, '');
+      return h === s || h.endsWith(`.${s}`);
+    });
+    if (!ok) throw new FetchAssetError(3, `host not in this lane's allowlist: ${safeHostLabel(h)}`);
+  }
+  // DDR-216 D4 — the Figma lane pins 443. Named as NEW logic rather than
+  // assumed: this function accepts 1–65535 by default and always has.
+  if (opts.pinPort443 && port !== 443) {
+    throw new FetchAssetError(3, `this lane requires port 443 (got ${port})`);
+  }
   return { host, port };
 }
 
+/**
+ * A hostname reduced to a charset-validated token before it can be printed.
+ *
+ * DDR-216 D10: this verb's output is read BY an agent, so an upstream-controlled
+ * string must never appear verbatim in a message. A DNS label charset is narrow
+ * enough to be safe and specific enough to diagnose.
+ */
+function safeHostLabel(host) {
+  const cleaned = String(host)
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]/g, '');
+  return cleaned.slice(0, 253) || '(unprintable)';
+}
+
+/**
+ * The `--raw-out` accept set: everything `sniffImageExt` accepts, PLUS SVG.
+ *
+ * `sniffImageExt` is deliberately NOT modified — it is the type gate the
+ * moodboard lane depends on, and a standing test asserts it still returns null
+ * for `<svg`/`<?xml`. The SVG probe below reuses the exact leading-token shape
+ * `_import-asset.mjs`'s own `svgPreParseReject` uses, so a payload accepted here
+ * is one that lane will actually attempt to parse (and then sanitize).
+ */
+export function sniffStagedKind(bytes) {
+  const raster = sniffImageExt(bytes);
+  if (raster) return raster;
+  // Text probe on the first bytes only — never decode the whole body to guess.
+  const head = Buffer.from(bytes.subarray(0, 256)).toString('utf8');
+  // Deliberately NARROWER than `svgPreParseReject`'s own leading-token set: a
+  // bare `<!--` prologue is legal SVG but it is also what lets an arbitrary text
+  // payload masquerade as one (review F2), and no Figma export starts with it.
+  // The full DDR-167 lane still validates properly downstream.
+  return /^\s*(<\?xml|<svg)/i.test(head) ? 'svg' : null;
+}
+
 // ── image sniff + naming ─────────────────────────────────────────────────────
 
 /**
@@ -408,10 +470,91 @@ export async function fetchAsset({
   designRootRel = '.design',
   maxBytes = DEFAULT_MAX_BYTES,
   maxTime = DEFAULT_MAX_TIME,
+  allowHosts,
+  pinPort443 = false,
+  rawOut = null,
+  rawRoot = null,
 }) {
-  const { host, port } = parseHttpsTarget(url);
+  const { host, port } = parseHttpsTarget(url, { allowHosts, pinPort443 });
   const pinIp = await resolveSafeIp(host);
 
+  // ── `--raw-out` (DDR-216 D11) ──────────────────────────────────────────────
+  //
+  // Download under the FULL network gate (IP classification, DNS pin, redirect
+  // ban, size/time caps, host allowlist) but write to a CALLER-SUPPLIED path
+  // instead of `assets/`, and do NOT content-address or name the file.
+  //
+  // Why this exists: D11 composes two already-reviewed gates rather than
+  // widening one. A Figma vector export is an SVG, and this helper's raster-only
+  // sniff is load-bearing for its OTHER caller (the DDR-147 moodboard lane,
+  // where URLs are research-harvested and there is no allowlist at all). So the
+  // Figma lane stages the bytes here and hands them to `_import-asset.mjs`'s
+  // DDR-167 SVG lane (allowlist DOM-sanitize → SVGO validity gate) before
+  // anything is named or lands in the versioned tree.
+  //
+  // IT STILL SNIFFS. `--raw-out` must never mean "skip the type gate" — that
+  // would turn the one reviewable downloader into an unsniffed one (HTML, JS,
+  // polyglots, archives) for the next caller who copies it. It sniffs against
+  // an EXTENDED accept set; `sniffImageExt` itself is untouched, which is what
+  // keeps the standing "sniffImageExt still rejects SVG" test literally true.
+  if (rawOut) {
+    // CONTAINMENT (post-implementation review F2). Without this, `--raw-out`
+    // was an arbitrary-file-write primitive on the ONE helper whose whole job
+    // is to be the safe downloader: `resolve()` + `renameSync()` with no root
+    // relationship, no charset assertion, and a type gate a leading `<!--`
+    // satisfies. An agent that can run `maude design fetch-asset` (ACP
+    // default-allows `Bash(maude:*)`) could have written remote bytes over
+    // `CLAUDE.md` — durable prompt injection.
+    //
+    // So the mode now REQUIRES the caller to declare the directory it owns, and
+    // the target must resolve inside it. The Figma lane passes its per-run
+    // staging dir; there is no way to express "anywhere".
+    if (!rawRoot) {
+      throw new FetchAssetError(2, '--raw-out requires --raw-root (the directory the caller owns)');
+    }
+    // BOTH sides get realpath'd, or neither. On macOS `/var` and `/tmp` are
+    // themselves OS-level symlinks (`-> /private/var`, `-> /private/tmp`), so
+    // realpath'ing only the root compares `/private/var/…` against `/var/…` and
+    // rejects EVERY legitimate staging path — which is exactly how this shipped
+    // and why the first real import skipped all 29 of its assets. Same trap
+    // DDR-172 Decision 1 documents for its own symlink check.
+    //
+    // The target does not exist yet, so realpath its PARENT (which does — the
+    // caller made the staging dir) and rebuild the leaf onto it.
+    const rootAbs = realpathSync(resolve(rawRoot));
+    const requested = resolve(rawOut);
+    const parentAbs = realpathSync(dirname(requested));
+    const outAbs = join(parentAbs, basename(requested));
+    if (outAbs !== rootAbs && !outAbs.startsWith(rootAbs + sep)) {
+      throw new FetchAssetError(6, '--raw-out must resolve inside --raw-root');
+    }
+    // Never overwrite: a staged download is always a fresh file, so an existing
+    // target means either a collision or an attempt to clobber something.
+    if (existsSync(outAbs)) {
+      throw new FetchAssetError(6, '--raw-out target already exists');
+    }
+    const tmpRaw = `${outAbs}.part`;
+    try {
+      curlDownload({ url, host, port, pinIp, tmpAbs: tmpRaw, maxBytes, maxTime });
+      let data;
+      try {
+        data = readFileSync(tmpRaw);
+      } catch {
+        throw new FetchAssetError(4, 'download produced no file');
+      }
+      if (data.length === 0) throw new FetchAssetError(4, 'downloaded empty body');
+      if (data.length > maxBytes) throw new FetchAssetError(4, `file exceeds ${maxBytes} bytes`);
+      const kind = sniffStagedKind(data);
+      if (!kind) {
+        throw new FetchAssetError(5, 'not a png/jpg/gif/webp/svg payload (HTML/script rejected)');
+      }
+      renameSync(tmpRaw, outAbs);
+      return { ref: null, path: outAbs, name: null, bytes: data.length, ext: kind };
+    } finally {
+      rmSync(tmpRaw, { force: true });
+    }
+  }
+
   const { assetsDir } = containedAssetPath(root, designRootRel, 'placeholder.png');
   mkdirSync(assetsDir, { recursive: true });
   const tmpAbs = join(
@@ -476,6 +619,21 @@ function parseArgv(argv) {
       case '--max-time':
         out.maxTime = Number(argv[++i]);
         break;
+      // DDR-216 D4/D11 — all three default to today's behaviour, so every
+      // existing caller of this helper is untouched.
+      case '--allow-host':
+        if (!out.allowHosts) out.allowHosts = [];
+        out.allowHosts.push(argv[++i]);
+        break;
+      case '--pin-port-443':
+        out.pinPort443 = true;
+        break;
+      case '--raw-out':
+        out.rawOut = argv[++i];
+        break;
+      case '--raw-root':
+        out.rawRoot = argv[++i];
+        break;
       case '--json':
         out.json = true;
         break;
@@ -540,8 +698,14 @@ async function main() {
       designRootRel: opts.designRoot,
       maxBytes: opts.maxBytes,
       maxTime: opts.maxTime,
+      ...(opts.allowHosts ? { allowHosts: opts.allowHosts } : {}),
+      ...(opts.pinPort443 ? { pinPort443: true } : {}),
+      ...(opts.rawOut ? { rawOut: opts.rawOut } : {}),
+      ...(opts.rawRoot ? { rawRoot: opts.rawRoot } : {}),
     });
-    process.stdout.write(opts.json ? `${JSON.stringify(r)}\n` : `${r.ref}\n`);
+    // `--raw-out` has no canvas ref (it deliberately writes outside `assets/`),
+    // so print the staged path instead of a null.
+    process.stdout.write(opts.json ? `${JSON.stringify(r)}\n` : `${r.ref ?? r.path}\n`);
   } catch (err) {
     process.stderr.write(`fetch-asset: ${err.message}\n`);
     process.exit(err instanceof FetchAssetError ? err.code : 1);

package/apps/studio/bin/_import-asset.mjs

@@ -203,7 +203,25 @@ const ALLOWED_PLAIN_ATTRS = new Set([
   'stop-color',
   'stop-opacity',
   'patternUnits',
+  // Required by spec for pattern CONTENT, and we were stripping it. A
+  // `<pattern>` whose children are authored in the 0..1 unit box — which is what
+  // `<use transform="scale(0.00097 0.00075)">` (1/1028 × 1/1331) means — is read
+  // in user space without it, so its content collapses to about a pixel.
+  //
+  // HONEST SCOPE: this is an allowlist bug, NOT the cause of Figma's raster
+  // fills failing to appear. That was chased here first and the diagnosis was
+  // wrong: Figma's OWN UNTOUCHED export, fetched straight from `/v1/images` and
+  // loaded directly, does not paint its `<pattern>`/`<use>`/`<image
+  // xlink:href="data:…">` chain either. Allowing this attribute fixes nothing
+  // user-visible; it just stops us corrupting a pattern that would otherwise
+  // have worked. Same enum-valued, no-URL, no-script risk class as
+  // `patternUnits` directly above.
+  'patternContentUnits',
   'patternTransform',
+  // Presentational text metrics. Their absence is not fatal the way the pattern
+  // one is, but it silently drifts imported type away from the source.
+  'letter-spacing',
+  'xml:space',
   'version',
 ]);
 
@@ -623,6 +641,78 @@ export async function importSvg(svgText, { root, designRootRel = '.design' }) {
  * only the rasterize step is blocked, so this fails loud there rather than
  * pretending the whole pipeline is unavailable.
  */
+
+/**
+ * The execution canary for MANY sanitized SVGs, in ONE browser session.
+ *
+ * Same coverage as `runSvgExecutionCanary`, same probe, same hard network
+ * denial, same directly-navigated document — the only thing that changes is
+ * that the session is created once instead of once per file.
+ *
+ * Why it exists: measured on a real 6-page product file, a per-file canary cost
+ * ~4.5 s each, so a normal design system's icon set (530 distinct vector
+ * renders after component dedupe) would have taken ~40 minutes and forced the
+ * import to drop most of its artwork against an asset-count cap. The canary is
+ * not what needed relaxing — the session-per-file was.
+ *
+ * Returns the set of indices that TRIPPED, so the caller refuses exactly those
+ * and keeps the rest. A tripped canary is still a hard refusal for that file.
+ */
+export async function runSvgExecutionCanaryBatch(sanitizedSvgs, { timeoutMs = 15_000 } = {}) {
+  const tripped = new Set();
+  if (sanitizedSvgs.length === 0) return tripped;
+  const dir = mkdtempSync(join(tmpdir(), 'maude-import-svg-batch-'));
+  const probePath = join(dir, 'probe.js');
+  try {
+    writeFileSync(probePath, 'window.__MAUDE_IMPORT_CANARY__ = false;\n');
+    const paths = sanitizedSvgs.map((svg, i) => {
+      const p = join(dir, `candidate-${i}.svg`);
+      writeFileSync(p, svg);
+      return p;
+    });
+    await withSandboxedRender(
+      async (session) => {
+        for (let i = 0; i < paths.length; i += 1) {
+          session.open(pathToFileURL(paths[i]).href);
+          // The probe re-runs on EVERY navigation in this session (it is
+          // registered as an init script), so the flag is per-document — a
+          // clean file after a tripped one still reads false.
+          if (session.eval('window.__MAUDE_IMPORT_CANARY__ === true').trim() === 'true') {
+            tripped.add(i);
+          }
+        }
+      },
+      { timeoutMs, initScriptPath: probePath }
+    );
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  return tripped;
+}
+
+/**
+ * Sanitize + canary + write MANY SVGs. The batched counterpart of `importSvg`.
+ * Returns one result per input, or `null` where the file was refused.
+ */
+export async function importSvgBatch(svgTexts, { root, designRootRel = '.design' }) {
+  const sanitized = svgTexts.map((t) => {
+    try {
+      return sanitizeSvgAllowlist(t);
+    } catch {
+      return null;
+    }
+  });
+  const live = [];
+  for (let i = 0; i < sanitized.length; i += 1) if (sanitized[i] !== null) live.push(i);
+
+  const tripped = await runSvgExecutionCanaryBatch(live.map((i) => sanitized[i]));
+  return sanitized.map((svg, i) => {
+    if (svg === null) return null;
+    if (tripped.has(live.indexOf(i))) return null;
+    return writeContainedAsset(root, designRootRel, Buffer.from(svg, 'utf8'), 'svg');
+  });
+}
+
 export async function importPdf(inputPath, { root, designRootRel = '.design' }) {
   const buffer = readPdfCapped(inputPath);
   const pageCount = await getPdfPageCountIsolated(buffer);