@1agh/maude 0.59.0 → 0.60.1

package/apps/studio/figma/fig-decode.test.ts

@@ -15,7 +15,7 @@ import { crc32, deflateRawSync, zstdCompressSync } from 'node:zlib';
 import {
   decodeFigArchive,
   FigDecodeError,
-  KNOWN_CONTAINER_VERSIONS,
+  OBSERVED_CONTAINER_VERSIONS,
   readFigContainer,
 } from './fig-decode.ts';
 import { findRootDefinition, parseKiwiSchema } from './fig-kiwi.ts';
@@ -224,10 +224,32 @@ describe('tier 1 — container framing', () => {
     expect(design.schemaSha256.slice(0, 8)).toBe('c22712ff');
   });
 
-  test('an unknown container version REFUSES and names the version', () => {
+  test('an unobserved container version DECODES and is flagged, not refused', () => {
+    // Measured 2026-08-12 on a real third-party export: version 101, LOWER than
+    // the fixtures' 106 despite a later export date, a different schema, and
+    // byte-identical framing that decodes cleanly. The version predicts nothing,
+    // so refusing on it only rejected valid files (DDR-221 D3, amended).
+    const archive = hostileArchive(baseDefs(), baseData());
     const bytes = containerBytes(schemaBytes(baseDefs()), baseData(), 107);
-    expect(() => readFigContainer(bytes)).toThrow(/version 107/);
-    expect(KNOWN_CONTAINER_VERSIONS.has(107)).toBe(false);
+    expect(readFigContainer(bytes).version).toBe(107);
+    expect(OBSERVED_CONTAINER_VERSIONS.has(107)).toBe(false);
+    expect(decodeFigArchive(archive, { fileKey: KEY }).report.containerVersionKnown).toBe(true);
+  });
+
+  test('STRUCTURE is what refuses — the checks that replaced the version gate', () => {
+    // Each of these is a framing violation the version number could never have
+    // caught, and together they are why dropping the allowlist is safe.
+    const defs = baseDefs();
+    expect(() =>
+      readFigContainer(containerBytes(schemaBytes(defs), baseData(), 106, 'notafig'))
+    ).toThrow(/prelude/);
+    // A schema with trailing bytes cannot be a Kiwi schema.
+    const padded = new Uint8Array([...schemaBytes(defs), 0, 0, 0]);
+    expect(() =>
+      decodeFigArchive(zipOf([{ name: 'canvas.fig', data: containerBytes(padded, baseData()) }]), {
+        fileKey: KEY,
+      })
+    ).toThrow(/trailing bytes/);
   });
 
   test('an unrecognised prelude refuses without echoing the bytes as text', () => {
@@ -362,16 +384,18 @@ describe('tier 3 — the fixture vocabulary survives the door', () => {
     expect(JSON.stringify(report)).not.toContain('Maude import fixture');
   });
 
-  test('an unmapped node type degrades and is REPORTED, bounded', async () => {
-    const { report } = decodeFigArchive(await fixture('design.fig'), { fileKey: KEY });
-    // The design fixture carries a SYMBOL, which FigmaNodeType has no member
-    // for. `reportToken` lowercases — the report trades exact casing for the
-    // one-token-no-spaces guarantee, which is the property that matters.
-    expect(report.unmappedTypes.map((u) => u.type)).toContain('symbol');
-    for (const u of report.unmappedTypes) {
-      expect(u.type.length).toBeLessThanOrEqual(24);
-      expect(u.type).not.toContain(' ');
-    }
+  test('the internal vocabulary is mapped to REST, so a clean file reports nothing', async () => {
+    const { document, report } = decodeFigArchive(await fixture('design.fig'), { fileKey: KEY });
+    // SYMBOL/ROUNDED_RECTANGLE/FRAME-with-resizeToFit are Figma INTERNAL names.
+    // They are mapped to the public REST vocabulary (COMPONENT/RECTANGLE/GROUP),
+    // so a legitimate file has no vocabulary gap at all. Measured by the Tier-2
+    // differential; before the mapping this fixture reported `symbol`.
+    expect(report.unmappedTypes).toEqual([]);
+    const types = new Set<string>();
+    walkNodes(document.root, (n) => types.add(n.type));
+    expect(types).toContain('COMPONENT');
+    expect(types).toContain('GROUP');
+    expect(types).not.toContain('UNKNOWN');
   });
 
   test("Figma's internal-only canvas is skipped and counted", async () => {
@@ -645,6 +669,68 @@ describe('silent-wrongness sweep — a hostile file must not produce a plausible
   });
 });
 
+describe('image fills resolve out of the archive (DDR-221 D6)', () => {
+  test("a paint's 20-byte image.hash becomes the hex imageRef that names the archive entry", () => {
+    const defs = baseDefs();
+    defs.push({
+      name: 'ImageRefStruct',
+      kind: 1,
+      fields: [
+        ['hash', -2, true, 0],
+        ['name', -6, false, 0],
+      ],
+    });
+    defs.push({
+      name: 'Paint',
+      kind: 2,
+      fields: [
+        ['type', -6, false, 1],
+        ['visible', -1, false, 2],
+        ['image', 4, false, 3],
+      ],
+    });
+    defs[2].fields.push(['fillPaints', 5, true, 38]);
+
+    const hash = [0x0f, 0x0e, 0x1f, 0xf4, 0xb9, 0xf8, 0xbe, 0x0c];
+    const w = new W();
+    w.varuint(6).varuint(1);
+    w.varuint(1).varuint(0).varuint(0);
+    w.varuint(4).varuint(1);
+    w.varuint(5).str('Document');
+    w.varuint(38).varuint(1); // one Paint
+    w.varuint(1).str('IMAGE');
+    w.varuint(2).byte(1);
+    w.varuint(3); // image: ImageRefStruct (a STRUCT — fields in order, no ids)
+    w.varuint(hash.length);
+    for (const b of hash) w.byte(b);
+    w.str('photo');
+    w.varuint(0); // end Paint
+    w.varuint(0).varuint(0);
+
+    const { document } = decodeFigArchive(hostileArchive(defs, w.out), { fileKey: KEY });
+    const fill = document.root.fills?.[0];
+    // Measured on a real export: this hex IS the `images/<name>` entry, which is
+    // what makes the offline door resolve pictures with no network at all.
+    expect(fill?.imageRef).toBe('0f0e1ff4b9f8be0c78b7e0a28320f60808027d35'.slice(0, 16));
+    expect(fill?.type).toBe('IMAGE');
+  });
+
+  test('an archive entry is fetched by exact name and verified, never by path', async () => {
+    // The lookup key rule (D6): `images/<hex>` is matched literally against the
+    // central directory, and the bytes are CRC-checked on the way out.
+    const png = new TextEncoder().encode('not-really-a-png-but-bytes-are-bytes');
+    const zip = zipOf([
+      { name: 'canvas.fig', data: containerBytes(schemaBytes(baseDefs()), baseData()) },
+      { name: 'images/0f0e1ff4b9f8be0c78b7e0a28320f60808027d35', data: png },
+    ]);
+    const archive = readFigZip(zip);
+    expect(archive.has('images/0f0e1ff4b9f8be0c78b7e0a28320f60808027d35')).toBe(true);
+    expect(archive.get('images/0f0e1ff4b9f8be0c78b7e0a28320f60808027d35')).toEqual(png);
+    // A ref that is not an entry is simply absent — no traversal, no guessing.
+    expect(archive.get('images/../canvas.fig')).toBeUndefined();
+  });
+});
+
 // ── Fuzz corpus — mandatory for a parser fed untrusted bytes ────────────────
 
 describe('fuzz — mutated real archives never crash the process', () => {

package/apps/studio/figma/fig-decode.ts

@@ -27,7 +27,9 @@
 import { createHash } from 'node:crypto';
 import { inflateRawSync, zstdDecompressSync } from 'node:zlib';
 
+import { styleToWeight } from './codegen-fonts.ts';
 import { decodeKiwi, findRootDefinition, type KiwiSchema, parseKiwiSchema } from './fig-kiwi.ts';
+import { pathFromBlob, type VectorPath } from './fig-vector.ts';
 import { FigZipError, readFigZip } from './fig-zip.ts';
 import { reportToken } from './sanitize.ts';
 import {
@@ -46,12 +48,28 @@ const PRELUDES: Record<string, 'design' | 'board'> = {
 };
 
 /**
- * Known container versions. An unknown one REFUSES (DDR-221 D3) — this is the
- * decision most likely to annoy someone the first time Figma ships 107, and the
- * trade is deliberate: the message names the version, the schema-hash alarm is
- * designed to see it coming, and the REST door still works.
+ * Container versions we have actually observed. INFORMATIONAL — not a gate.
+ *
+ * DDR-221 D3 originally REFUSED an unrecognised version, on the assumption that
+ * the number predicts framing compatibility. Measured on a real third-party
+ * export (2026-08-12): it does not. That file is version **101** — LOWER than
+ * the fixtures' 106 despite being exported nine days later — carries a
+ * DIFFERENT schema (`7ae1921b` vs `c22712ff`), and decodes perfectly under the
+ * same code, because the framing is byte-identical and the file brings its own
+ * schema (D1's whole thesis).
+ *
+ * So the version was refusing valid files while predicting nothing. What
+ * actually gates correctness is STRUCTURE, all of it still enforced: the
+ * prelude, exactly two chunks with zero trailing bytes, a raw-deflate schema
+ * that parses and consumes every byte, the zstd magic, STRICT root resolution
+ * (exactly one `Message` of kind MESSAGE with a `nodeChanges: NodeChange[]`),
+ * and a data chunk that decodes with nothing left over. A file passing all of
+ * those is a Figma document whatever integer sits in bytes 8–11.
+ *
+ * The version is reported instead, and an unobserved one is worth noticing —
+ * see `FigDecodeReport.containerVersion` and the schema-hash alarm (D8).
  */
-export const KNOWN_CONTAINER_VERSIONS: ReadonlySet<number> = new Set([106]);
+export const OBSERVED_CONTAINER_VERSIONS: ReadonlySet<number> = new Set([101, 106]);
 
 /** ~1 500x the measured 42 KB. */
 export const MAX_CANVAS_FIG_BYTES = 64 * 1024 * 1024;
@@ -87,7 +105,10 @@ export interface FigContainer {
 }
 
 export interface FigDecodeReport {
+  /** Observed, not validated. See `OBSERVED_CONTAINER_VERSIONS`. */
   containerVersion: number;
+  /** True when this version is one we have seen before — a soft drift signal. */
+  containerVersionKnown: boolean;
   schemaSha256: string;
   /** From `meta.json`. Makes a dated fixture corpus self-labelling. */
   exportedAt?: string;
@@ -99,11 +120,24 @@ export interface FigDecodeReport {
   unmappedTypes: Array<{ type: string; count: number }>;
   /** Nodes dropped because Figma marks them internal (e.g. the hidden canvas). */
   internalNodesSkipped: number;
+  /**
+   * Fields this door CANNOT reproduce from a local file, with how many nodes
+   * each affected. Reported rather than left implicit: the plan's bar is that
+   * known-lossy fields are named, never silently degraded.
+   */
+  lossyFields: Array<{ field: string; count: number; why: string }>;
 }
 
 export interface FigDecodeResult {
   document: NormalizedDocument;
   report: FigDecodeReport;
+  /**
+   * Vector geometry the archive carries, by node id. Kept OUT of the normalized
+   * tree on purpose: REST has no equivalent, so putting it there would make the
+   * Tier-2 differential diverge for a field the REST door cannot produce. The
+   * local importer reads this to build SVGs without asking Figma to render.
+   */
+  vectors: Map<string, VectorPath>;
 }
 
 function u32le(b: Uint8Array, o: number): number {
@@ -150,13 +184,9 @@ export function readFigContainer(bytes: Uint8Array): FigContainer {
     throw new FigDecodeError(`unrecognised Figma container prelude (bytes: ${hex})`);
   }
 
+  // Read, reported, NOT gated — see OBSERVED_CONTAINER_VERSIONS for why the
+  // allowlist was removed. Structure gates; the integer does not.
   const version = u32le(bytes, 8);
-  if (!KNOWN_CONTAINER_VERSIONS.has(version)) {
-    throw new FigDecodeError(
-      `unsupported Figma container version ${version} (known: ${[...KNOWN_CONTAINER_VERSIONS].join(', ')}). ` +
-        'Import this file over the Figma API instead.'
-    );
-  }
 
   const chunks: Uint8Array[] = [];
   let offset = 12;
@@ -295,14 +325,97 @@ function guidOf(v: unknown): string | undefined {
  * schema, so a generic copy would let them choose which REST field each value
  * lands in (`absoluteBoundingBox`, `characters`, `children`).
  */
-function toRestNode(change: Record<string, unknown>, absolute: Matrix): Record<string, unknown> {
+/**
+ * `.fig` carries Figma's INTERNAL node vocabulary; REST reports the public one,
+ * and the translators are written against REST. Measured by the Tier-2
+ * differential on the fixtures — the unit tests could not have found this,
+ * because both sides of an internal-vocabulary mismatch look perfectly valid.
+ *
+ * A GROUP is internally a FRAME with `resizeToFit` (shrink-wrap to children);
+ * that flag is the discriminator, 5/5 on the design fixture and 1/1 on the
+ * board. `ROUNDED_RECTANGLE` collapses to `RECTANGLE` (the radius survives in
+ * `cornerRadius`), and `SYMBOL` is Figma's internal name for a `COMPONENT`.
+ */
+function restType(change: Record<string, unknown>): string | undefined {
+  const type = str(change.type);
+  if (type === 'FRAME' && change.resizeToFit === true) return 'GROUP';
+  if (type === 'ROUNDED_RECTANGLE') return 'RECTANGLE';
+  if (type === 'SYMBOL') return 'COMPONENT';
+  return type;
+}
+
+/**
+ * Pull a FigJam node's text out of its template overrides. Reads only the
+ * hardcoded `nodeGenerationData.overrides[].textData.characters` path (A8/F5) —
+ * the override list is attacker-controlled, so it is walked, never spread — and
+ * takes the first entry that carries characters, which is what REST reports as
+ * the node's own `characters`.
+ */
+/**
+ * `.fig` identifies an image fill by a 20-byte `image.hash`; REST calls the same
+ * thing `imageRef` and states it as hex. Measured on a real export: the hex IS
+ * the archive entry name (`images/<hex>`), which is what makes D6's "images
+ * travel inside the file" resolvable with no network at all.
+ *
+ * Only that one field is added — the paint is otherwise passed through for
+ * `normalizeDocument` to sanitize, exactly like the REST door's paints.
+ */
+function toRestPaint(paint: unknown): unknown {
+  const p = obj(paint);
+  if (!p || p.imageRef !== undefined) return paint;
+  const hash = obj(p.image)?.hash;
+  if (!Array.isArray(hash) || hash.length === 0 || hash.length > 64) return paint;
+  let hex = '';
+  for (const byte of hash) {
+    const n = num(byte);
+    if (n === undefined || n < 0 || n > 255 || !Number.isInteger(n)) return paint;
+    hex += n.toString(16).padStart(2, '0');
+  }
+  return { ...p, imageRef: hex };
+}
+
+function overrides(change: Record<string, unknown>): unknown[] {
+  const list = obj(change.nodeGenerationData)?.overrides;
+  return Array.isArray(list) ? list : [];
+}
+
+/**
+ * First override carrying `key`. The template's own root comes first, so this
+ * resolves to the node's own paint/text rather than a sub-part's.
+ *
+ * The ordering is an OBSERVED property, not a documented one — which is exactly
+ * why the Tier-3 comparison is the guard: if Figma ever reorders these, the
+ * translator diff against REST fails loudly instead of quietly picking the
+ * wrong colour. Only hardcoded keys are read (A8/F5).
+ */
+function fromOverrides(change: Record<string, unknown>, key: string): unknown {
+  for (const entry of overrides(change)) {
+    const value = obj(entry)?.[key];
+    if (value !== undefined) return value;
+  }
+  return undefined;
+}
+
+function overrideText(change: Record<string, unknown>): string | undefined {
+  for (const entry of overrides(change)) {
+    const characters = str(obj(obj(entry)?.textData)?.characters);
+    if (characters !== undefined) return characters;
+  }
+  return undefined;
+}
+
+function toRestNode(
+  change: Record<string, unknown>,
+  absolute: Matrix,
+  lossy: { lineHeights: number }
+): Record<string, unknown> {
   const size = obj(change.size);
   const w = num(size?.x) ?? 0;
   const h = num(size?.y) ?? 0;
 
   const raw: Record<string, unknown> = {
     id: guidOf(change.guid),
-    type: str(change.type),
+    type: restType(change),
     name: str(change.name) ?? '',
     visible: change.visible !== false,
     absoluteBoundingBox: absoluteBox(absolute, w, h),
@@ -316,8 +429,13 @@ function toRestNode(change: Record<string, unknown>, absolute: Matrix): Record<s
   if (cornerRadius !== undefined) raw.cornerRadius = cornerRadius;
   const strokeWeight = num(change.strokeWeight);
   if (strokeWeight !== undefined) raw.strokeWeight = strokeWeight;
-  if (Array.isArray(change.fillPaints)) raw.fills = change.fillPaints;
-  if (Array.isArray(change.strokePaints)) raw.strokes = change.strokePaints;
+  // A FigJam STICKY / SHAPE_WITH_TEXT is a template instance: its own paint is
+  // an override, not a top-level field. Reading only the top level left every
+  // board node on the translator's default colour (found by Tier 3).
+  const fills = change.fillPaints ?? fromOverrides(change, 'fillPaints');
+  if (Array.isArray(fills)) raw.fills = fills.map(toRestPaint);
+  const strokes = change.strokePaints ?? fromOverrides(change, 'strokePaints');
+  if (Array.isArray(strokes)) raw.strokes = strokes;
   if (Array.isArray(change.effects)) raw.effects = change.effects;
 
   // Auto-layout. `.fig` calls it `stack*`; REST calls it `layout*`.
@@ -342,19 +460,39 @@ function toRestNode(change: Record<string, unknown>, absolute: Matrix): Record<s
     if (counter) raw.counterAxisAlignItems = counter;
   }
 
-  // Text.
-  const textData = obj(change.textData);
-  const characters = str(textData?.characters);
+  // Text. Two storage locations, and the second one is not optional:
+  //  - a design-file TEXT node carries `textData.characters` directly;
+  //  - a FigJam STICKY / SHAPE_WITH_TEXT is an instance of an internal
+  //    template, and its text is an OVERRIDE on a sub-node, under
+  //    `nodeGenerationData.overrides[].textData.characters`.
+  // Missing the second path lost the text of every sticky and every shape on
+  // the board while the tree still looked perfect — found by the Tier-2
+  // differential (20 nodes), invisible to every unit test.
+  const characters = str(obj(change.textData)?.characters) ?? overrideText(change);
   if (characters !== undefined) raw.characters = characters;
   const fontSize = num(change.fontSize);
   const fontName = obj(change.fontName);
-  const align = str(change.textAlignHorizontal);
-  if (fontSize !== undefined || fontName || align) {
+  if (fontSize !== undefined || fontName || characters !== undefined) {
+    // `.fig` encodes typography sparsely and semantically; REST reports it
+    // resolved. Three deltas, all found by the Tier-3 translator comparison:
+    //  - weight lives in the font STYLE name ("Bold"), not a number — reuse the
+    //    codegen lane's map rather than keeping a second one;
+    //  - a default alignment is OMITTED, where REST always states it;
+    //  - lineHeight is authored ({value, units}), and REST reports the RESOLVED
+    //    pixel value. A PERCENT line-height cannot be resolved to px without
+    //    font metrics we do not have offline, so it is carried only when the
+    //    file already states pixels. This is the local door's one genuinely
+    //    lossy typography field and it is asserted as lossy in the Tier-3 test.
+    const lineHeight = obj(change.lineHeight);
+    const lineHeightPx = str(lineHeight?.units) === 'PIXELS' ? num(lineHeight?.value) : undefined;
+    if (lineHeight && lineHeightPx === undefined) lossy.lineHeights++;
     raw.style = {
       fontSize,
       fontFamily: str(fontName?.family),
       fontPostScriptName: str(fontName?.postscript),
-      textAlignHorizontal: align,
+      fontWeight: styleToWeight(str(fontName?.style) ?? null) ?? undefined,
+      textAlignHorizontal: str(change.textAlignHorizontal) ?? 'LEFT',
+      ...(lineHeightPx !== undefined ? { lineHeightPx } : {}),
     };
   }
 
@@ -379,11 +517,76 @@ function toRestNode(change: Record<string, unknown>, absolute: Matrix): Record<s
   return raw;
 }
 
+/**
+ * A PERCENT line-height cannot be resolved to pixels without font metrics, and
+ * REST reports the resolved value. Counted per node so the import summary can
+ * say so out loud (the only lossy typography field — Tier 3 asserts it is).
+ */
+const LOSSY_LINE_HEIGHT = {
+  field: 'style.lineHeightPx',
+  why: 'a percent line-height needs font metrics the local file does not carry',
+};
+
+/**
+ * Read one node's own path geometry, if it has any.
+ *
+ * A decode failure DEGRADES to "no vector" rather than refusing the document:
+ * a single unreadable icon should not cost the whole import, and the caller
+ * reports the absence. That is the one place the fail-loud rule bends, and it
+ * bends toward reporting rather than toward guessing at the shape.
+ */
+function vectorOf(change: Record<string, unknown>, blobs: readonly unknown[]): VectorPath | null {
+  const geometry = change.fillGeometry;
+  if (!Array.isArray(geometry) || geometry.length === 0) return null;
+  const first = obj(geometry[0]);
+  const index = num(first?.commandsBlob);
+  if (index === undefined || index < 0 || index >= blobs.length) return null;
+
+  const raw = obj(blobs[index])?.bytes;
+  const bytes =
+    raw instanceof Uint8Array ? raw : Array.isArray(raw) ? Uint8Array.from(raw as number[]) : null;
+  if (!bytes) return null;
+
+  let d: string;
+  try {
+    d = pathFromBlob(bytes);
+  } catch {
+    return null;
+  }
+
+  const paint = (Array.isArray(change.fillPaints) ? change.fillPaints : []).find(
+    (p) => obj(p)?.type === 'SOLID' && obj(p)?.visible !== false
+  );
+  const colour = obj(obj(paint)?.color);
+  const hex =
+    colour === undefined
+      ? null
+      : `#${(['r', 'g', 'b'] as const)
+          .map((k) => {
+            const v = num(colour[k]) ?? 0;
+            return Math.max(0, Math.min(255, Math.round(v * 255)))
+              .toString(16)
+              .padStart(2, '0');
+          })
+          .join('')}`;
+
+  return {
+    d,
+    fill: hex,
+    fillOpacity: num(obj(paint)?.opacity) ?? 1,
+    fillRule: str(first?.windingRule) === 'EVENODD' ? 'evenodd' : 'nonzero',
+    x: 0,
+    y: 0,
+  };
+}
+
 interface RebuildResult {
   root: Record<string, unknown>;
   unmapped: Map<string, number>;
   internalSkipped: number;
   nodeCount: number;
+  lossyLineHeights: number;
+  vectors: Map<string, VectorPath>;
 }
 
 /**
@@ -392,7 +595,7 @@ interface RebuildResult {
  * that the Kiwi decode-depth cap does not bound (A8/F4) — hence the explicit
  * cycle, duplicate, orphan and single-root controls here.
  */
-function rebuildTree(changes: unknown[]): RebuildResult {
+function rebuildTree(changes: unknown[], blobs: readonly unknown[]): RebuildResult {
   if (changes.length > MAX_NODE_COUNT) {
     throw new FigDecodeError(
       `file carries ${changes.length} nodes, over the ${MAX_NODE_COUNT} limit. Import a specific frame instead.`
@@ -454,6 +657,8 @@ function rebuildTree(changes: unknown[]): RebuildResult {
 
   const unmapped = new Map<string, number>();
   const onStack = new Set<string>();
+  const vectors = new Map<string, VectorPath>();
+  const lossy = { lineHeights: 0 };
   let nodeCount = 0;
   let internalSkipped = 0;
 
@@ -473,9 +678,12 @@ function rebuildTree(changes: unknown[]): RebuildResult {
 
     const change = byId.get(id) as Record<string, unknown>;
     const absolute = compose(parentAbsolute, matrixOf(change.transform));
-    const node = toRestNode(change, absolute);
+    const node = toRestNode(change, absolute, lossy);
     nodeCount++;
 
+    const art = vectorOf(change, blobs);
+    if (art) vectors.set(String(node.id), art);
+
     const type = node.type;
     if (typeof type !== 'string' || !KNOWN_NODE_TYPES.has(type)) {
       // Vocabulary gap: degrade and report (D3). The raw string is left in
@@ -514,7 +722,14 @@ function rebuildTree(changes: unknown[]): RebuildResult {
     throw new FigDecodeError('the document root is marked internal-only');
   }
   const root = build(roots[0], IDENTITY, 0);
-  return { root, unmapped, internalSkipped, nodeCount };
+  return {
+    root,
+    unmapped,
+    internalSkipped,
+    nodeCount,
+    lossyLineHeights: lossy.lineHeights,
+    vectors,
+  };
 }
 
 // ── The door ────────────────────────────────────────────────────────────────
@@ -561,7 +776,11 @@ export function decodeFigArchive(archive: Uint8Array, opts: DecodeFigOptions): F
     throw new FigDecodeError('canvas.fig carries no node changes');
   }
 
-  const { root, unmapped, internalSkipped, nodeCount } = rebuildTree(changes);
+  const blobs = Array.isArray(message?.blobs) ? message.blobs : [];
+  const { root, unmapped, internalSkipped, nodeCount, lossyLineHeights, vectors } = rebuildTree(
+    changes,
+    blobs
+  );
 
   const document = normalizeDocument(root, {
     fileKey: opts.fileKey,
@@ -571,8 +790,10 @@ export function decodeFigArchive(archive: Uint8Array, opts: DecodeFigOptions): F
 
   return {
     document,
+    vectors,
     report: {
       containerVersion: container.version,
+      containerVersionKnown: OBSERVED_CONTAINER_VERSIONS.has(container.version),
       schemaSha256: container.schemaSha256,
       exportedAt: readExportedAt(safeEntry(zip, META_ENTRY)),
       nodeCount,
@@ -580,6 +801,7 @@ export function decodeFigArchive(archive: Uint8Array, opts: DecodeFigOptions): F
         .map(([type, count]) => ({ type, count }))
         .sort((a, b) => b.count - a.count),
       internalNodesSkipped: internalSkipped,
+      lossyFields: lossyLineHeights > 0 ? [{ ...LOSSY_LINE_HEIGHT, count: lossyLineHeights }] : [],
     },
   };
 }