@1agh/maude 1.0.6 → 1.0.8

package/apps/studio/test/export-format-scope-coherence.test.ts

@@ -0,0 +1,89 @@
+// export-format-scope-coherence.test.ts — DDR-231 Phase 2 T4.
+//
+// REPRODUCED DEFECT (local, 2026-08-23, workspace-shaped studio + a real
+// maude-render service): a cloud PDF or HTML export failed with
+//
+//   render service refused the job: invalid render job
+//
+// `POST /_api/export-jobs {format:'pdf', scope:'project-raw'}` is accepted by
+// the route (it validates `isFormat` and `isScope` INDEPENDENTLY, never the
+// pair), `resolveScope` correctly returns a `file-tree` target for that scope,
+// and the render service's `validBody` correctly refuses a file-tree target —
+// it names repo paths that process holds no checkout for and must never read.
+// Every layer did what it was specified to do; the PAIR was never legal, and
+// no layer said so.
+//
+// The scope table lived in `client/app.jsx` and `export-dialog.tsx` and in
+// neither server. It now lives in `exporters/format-scopes.ts`; these tests
+// pin the table, the refusal, and — the part that actually closes the bug —
+// that the two client copies have not drifted from it.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import {
+  defaultScopeForFormat,
+  isScopeValidForFormat,
+  scopeRefusalMessage,
+  VALID_SCOPES_BY_FORMAT,
+} from '../exporters/format-scopes.ts';
+import { FORMATS } from '../exporters/index.ts';
+import { DEV_SERVER_ROOT } from '../paths.ts';
+
+describe('format × scope coherence', () => {
+  test('every known format has a scope list', () => {
+    for (const f of FORMATS) {
+      expect(VALID_SCOPES_BY_FORMAT[f]?.length ?? 0).toBeGreaterThan(0);
+    }
+  });
+
+  test('project-raw is legal for zip ONLY — it resolves to a file-tree target', () => {
+    for (const f of FORMATS) {
+      expect(isScopeValidForFormat(f, 'project-raw')).toBe(f === 'zip');
+    }
+  });
+
+  test('the exact reproduced pairs are refused', () => {
+    // These two are the live failures, verbatim.
+    expect(isScopeValidForFormat('pdf', 'project-raw')).toBe(false);
+    expect(isScopeValidForFormat('html', 'project-raw')).toBe(false);
+    // …while the shapes the dialogs really offer stay legal.
+    expect(isScopeValidForFormat('pdf', 'artboard')).toBe(true);
+    expect(isScopeValidForFormat('html', 'canvas-as-separate')).toBe(true);
+    expect(isScopeValidForFormat('mp4', 'artboard')).toBe(true);
+  });
+
+  test('the refusal names the format, the bad scope and the way out', () => {
+    const msg = scopeRefusalMessage('pdf', 'project-raw');
+    expect(msg).toContain('PDF');
+    expect(msg).toContain('project-raw');
+    expect(msg).toContain('artboard');
+  });
+
+  test('the default scope is the first offered one', () => {
+    expect(defaultScopeForFormat('zip')).toBe('project-raw');
+    expect(defaultScopeForFormat('pptx')).toBe('canvas-as-separate');
+    expect(defaultScopeForFormat('mp4')).toBe('artboard');
+  });
+});
+
+/**
+ * Both dialogs must render pickers from the shared table. A literal map left
+ * behind in either client is how the three copies drifted in the first place —
+ * `export-dialog.tsx`'s copy was missing mp4/webm/gif entirely.
+ */
+describe('no client keeps its own copy of the scope table', () => {
+  const read = (...p: string[]) => readFileSync(join(DEV_SERVER_ROOT, ...p), 'utf8');
+
+  for (const [file, banned] of [
+    ['client/app.jsx', 'EXPORT_VALID_SCOPES = {'],
+    ['export-dialog.tsx', 'VALID_SCOPES_PER_FORMAT: Record'],
+  ] as const) {
+    test(`${file} sources its scopes from exporters/format-scopes.ts`, () => {
+      const src = read(...file.split('/'));
+      expect(src).not.toContain(banned);
+      expect(src).toContain('format-scopes');
+    });
+  }
+});

package/apps/studio/test/exporters/jobs.test.ts

@@ -267,3 +267,76 @@ describe('exporters/jobs — byte retrieval + eviction', () => {
     }
   });
 });
+
+// DDR-232 follow-up — the cloud video export that "didn't answer" after 4½
+// minutes. Bun's `fetch` carries its OWN default ceiling of 300 s, independent
+// of the AbortSignal, and rejects with a bare TimeoutError that renderRemotely's
+// catch reported as a waking service. `timeout: false` lifts it (measured:
+// a 315 s response then arrives; without it the same fetch rejects at 300 s
+// exactly). A behavioural test would take five minutes per run, so this pins
+// the source instead — remove the option and a real video job silently
+// re-inherits the ceiling.
+describe('renderRemotely — no second timeout under the job timeout', () => {
+  test("the render fetch disables Bun's default 300 s fetch ceiling", async () => {
+    const { readFileSync } = await import('node:fs');
+    const { join } = await import('node:path');
+    const src = readFileSync(join(import.meta.dir, '..', '..', 'exporters', 'remote.ts'), 'utf8');
+    const call = src.slice(
+      src.indexOf('${service.url}/render') - 600,
+      src.indexOf('${service.url}/render') + 200
+    );
+    expect(call).toContain('timeout: false');
+  });
+});
+
+// Security review F2 — a viewer flooding the browser-lane ledger must not evict
+// another member's real export bytes. `recordBrowserExport` fabricates a
+// `done` row stamped now (top of the sort); before the fix, `persistAndEvict`
+// ranked ALL finished jobs together, so 20 byteless browser rows pushed a real
+// job past HISTORY_DEPTH and `rm`'d its bytes — an append that was secretly a
+// delete primitive, reachable by the lowest-privilege role.
+describe('exporters/jobs — browser-lane rows never evict real job bytes (F2)', () => {
+  test('a real job stays downloadable after a flood of recordBrowserExport rows', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, { MAUDE_EXPORT_MAX_QUEUED: '30' });
+    try {
+      // A real completed export with bytes on disk.
+      const r0 = await fetch(`http://localhost:${port}/_api/export-jobs`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ format: 'zip', scope: 'project-raw' }),
+      });
+      const { jobId } = (await r0.json()) as { jobId: string };
+      let done = false;
+      const deadline = Date.now() + 4000;
+      while (Date.now() < deadline && !done) {
+        const jobs = await listJobs(port);
+        done = jobs.find((j) => j.id === jobId)?.status === 'done';
+        if (!done) await Bun.sleep(15);
+      }
+      expect(done).toBe(true);
+      expect(
+        (await fetch(`http://localhost:${port}/_api/export-jobs/download?id=${jobId}`)).status
+      ).toBe(200);
+
+      // Flood: 30 browser-lane ledger rows (what a viewer POSTs), well past the
+      // 20-row cap — enough to have evicted the real job under the old logic.
+      for (let i = 0; i < 30; i += 1) {
+        const rr = await fetch(`http://localhost:${port}/_api/export-history`, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json', origin: `http://localhost:${port}` },
+          body: JSON.stringify({ format: 'png', scope: 'artboard', filename: `flood-${i}.png` }),
+        });
+        expect(rr.status).toBe(201);
+      }
+
+      // The real job's bytes must still be there.
+      const dl = await fetch(`http://localhost:${port}/_api/export-jobs/download?id=${jobId}`);
+      expect(dl.status).toBe(200);
+      expect((await dl.arrayBuffer()).byteLength).toBeGreaterThan(0);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/test/exporters/scope.test.ts

@@ -257,3 +257,36 @@ describe('resolveScope — project-raw', () => {
     expect(targets).toEqual([]);
   });
 });
+
+// DDR-232 follow-up — the live dialog's canvas file beats the persisted
+// `_active.json`: a job submitted right after a tab switch used to resolve
+// against the PREVIOUS canvas (with the new canvas's artboardId — a selector
+// that never appears; a 60 s waitFor timeout on the worker).
+describe('canvasFile hint precedence', () => {
+  test('options.canvasFile wins over activeJson.active', async () => {
+    const targets = await resolveScope({
+      scope: 'artboard',
+      activeJson: { active: '.design/ui/stale-previous.tsx', selected: null },
+      designRoot: '/abs/.design',
+      options: { canvasFile: '.design/ui/the-open-one.tsx', artboardId: 'hero' },
+    });
+    expect(targets).toEqual([
+      {
+        kind: 'element',
+        cssPath: '[data-dc-screen="hero"]',
+        canvasSlug: 'ui-the-open-one',
+        file: '.design/ui/the-open-one.tsx',
+        widen: false,
+      },
+    ]);
+  });
+  test('canvasFile alone is enough — a null active no longer empties the job', async () => {
+    const targets = await resolveScope({
+      scope: 'artboard',
+      activeJson: { active: null, selected: null },
+      designRoot: '/abs/.design',
+      options: { canvasFile: '.design/ui/open.tsx', artboardId: 'a1' },
+    });
+    expect(targets.length).toBe(1);
+  });
+});

package/apps/studio/test/pdf-print-boxes.test.ts

@@ -324,3 +324,36 @@ describe('pdf-print-boxes — applyPageFit (non-print artboard scale-to-paper)',
     expect(doc.getPage(0).getSize()).toEqual({ width: 100, height: 100 });
   });
 });
+
+// DDR-232 follow-up — the WORKER-lane print gap. pdf.ts read the artboard's
+// `print` prop from the canvas source ON DISK; the render worker holds no
+// checkout (DDR-230 §1), so every cloud print PDF silently came back with no
+// BleedBox/TrimBox and no marks — the fall-through was "not a print artboard".
+// The cell now resolves every print artboard's prop up front
+// (readAllArtboardPrintProps) and ships it in the job as `options.printProps`.
+describe('readAllArtboardPrintProps — what the cell ships to the worker', () => {
+  const SRC = `import { DesignCanvas, DCSection, DCArtboard } from "@maude/canvas-lib";
+export default function C() {
+  return (
+    <DesignCanvas>
+      <DCSection id="s" title="t">
+        <DCArtboard id="screen" width={400} height={300}><div/></DCArtboard>
+        <DCArtboard id="flyer" kind="print" print={{ paper: "a6", bleedMm: 3 }} width={397} height={559}><div/></DCArtboard>
+        <DCArtboard id="poster" kind="print" print={{ paper: "a3" }} width={1123} height={1587}><div/></DCArtboard>
+      </DCSection>
+    </DesignCanvas>
+  );
+}
+`;
+  test('collects every print artboard by id and skips screen artboards', async () => {
+    const { readAllArtboardPrintProps } = await import('../canvas-edit.ts');
+    const props = readAllArtboardPrintProps('/x/c.tsx', SRC);
+    expect(Object.keys(props).sort()).toEqual(['flyer', 'poster']);
+    expect(props.flyer).toEqual({ paper: 'a6', bleedMm: 3 });
+    expect(props.poster).toEqual({ paper: 'a3' });
+  });
+  test('an unparsable canvas contributes nothing rather than throwing', async () => {
+    const { readAllArtboardPrintProps } = await import('../canvas-edit.ts');
+    expect(readAllArtboardPrintProps('/x/c.tsx', 'export default <<<')).toEqual({});
+  });
+});

package/apps/studio/test/photo-canvas-bundle.test.ts

@@ -59,3 +59,21 @@ describe('lazy-bundle guarantee — <PhotoLayer> keeps pixi out of the eager gra
     expect(js.includes('isDefaultEdit') || js.includes('PhotoLayer')).toBe(true);
   });
 });
+
+describe('lazy-bundle guarantee — the export-capture bridge keeps dom-to-svg out of the eager graph', () => {
+  // DDR-231: every canvas mounts useExportCaptureBridge (via DesignCanvas), so
+  // an EAGER dom-to-svg import would tax every canvas load with the ~110 KB
+  // bundle. Same fragility as pixi: canvas builds run `splitting: false`, and
+  // a refactor that turns the bridge's `await import('dom-to-svg')` static
+  // silently re-breaks this.
+  test('a plain canvas has NO eager `from "dom-to-svg"` import', async () => {
+    const js = await buildCanvas(CANVAS);
+    const eager = [...js.matchAll(/import\s[^;]*?from\s*["']dom-to-svg["']/g)];
+    expect(eager.length).toBe(0);
+  });
+
+  test('dom-to-svg is reachable only via a lazy runtime import("dom-to-svg")', async () => {
+    const js = await buildCanvas(CANVAS);
+    expect(/import\(\s*["']dom-to-svg["']\s*\)/.test(js)).toBe(true);
+  });
+});

package/apps/studio/test/workspace-containment.test.ts

@@ -327,14 +327,22 @@ describe('pruneForWorkspace — how a cell can boot at all', () => {
       '/_api/export-jobs': 'j',
       '/_api/export-jobs/download': 'd',
       '/_api/export-history': 'h',
+      // DDR-231 — the browser lane's assemble half: pure data (client-captured
+      // PNGs) → PptxGenJS in-cell; nothing evaluates, same class as zip.
+      '/_api/export-assemble': 'a',
+      // DDR-231 T7 — warm-up ping: proxies GET /_health to the render service
+      // so the container wakes while the member is still picking options.
+      '/_api/export-warmup': 'w',
       '/_api/export-next-phase-surprise': 'f',
       '/_health': 'ok',
     };
     const { routes, removed } = pruneForWorkspace(table);
     expect(Object.keys(routes).sort()).toEqual([
+      '/_api/export-assemble',
       '/_api/export-history',
       '/_api/export-jobs',
       '/_api/export-jobs/download',
+      '/_api/export-warmup',
       '/_health',
     ]);
     expect(removed).toEqual(['/_api/export', '/_api/export-next-phase-surprise']);

package/apps/studio/whats-new.json

@@ -1,6 +1,24 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "exports-match-what-you-see",
+      "version": "1.0.8",
+      "date": "2026-08-24",
+      "kind": "improvement",
+      "title": "Exports now match what you see",
+      "summary": "Cloud and in-browser exports are now faithful to your canvas across every format — fonts, photo filters and duotones, gradients and full-bleed images all come through, and PNG, SVG, PPTX, PDF and HTML export fully self-contained. Video (MP4, WebM, GIF) now exports reliably from a hosted workspace too.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "instant-exports-in-your-browser",
+      "version": "1.0.7",
+      "date": "2026-08-23",
+      "kind": "feature",
+      "title": "Instant exports, right in your browser",
+      "summary": "In a hosted workspace, PNG and SVG of the artboard you're looking at — and the whole PPTX deck — now export straight from your browser in seconds. No render service, no waiting for a container to wake up. Video and PDF still render on the service, which now warms up the moment you open the export dialog.",
+      "surface": "design-ui"
+    },
     {
       "id": "cloud-exports-actually-arrive",
       "version": "1.0.6",

package/apps/studio/workspace-mode.ts

@@ -98,8 +98,21 @@ export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{
     // The job lane: enqueue / list+stream / history. No evaluation happens
     // in-cell — browser formats dispatch to maude-render (exporters/jobs.ts
     // render lane), zip runs browser-free, and lane `none` refuses with a
-    // remedy. DDR amending DDR-209 A′1 records the contract.
-    except: ['/_api/export-jobs', '/_api/export-jobs/download', '/_api/export-history'],
+    // remedy. DDR-230 (amending DDR-209 A′1) records the contract.
+    // `/_api/export-assemble` (DDR-231): the browser lane's assemble half —
+    // the MEMBER's browser captured the artboard PNGs, the cell composes the
+    // deck with PptxGenJS (pure JS over pure data, the zip containment
+    // class). Nothing evaluates here either.
+    // `/_api/export-warmup` (DDR-231 T7): proxies GET /_health to the render
+    // service so the container wakes while the member picks export options —
+    // no job body, no evaluation, no secret in the response.
+    except: [
+      '/_api/export-jobs',
+      '/_api/export-jobs/download',
+      '/_api/export-history',
+      '/_api/export-assemble',
+      '/_api/export-warmup',
+    ],
   },
   {
     prefix: '/_api/generate',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "1.0.6",
-    "@1agh/maude-darwin-x64": "1.0.6",
-    "@1agh/maude-linux-arm64": "1.0.6",
-    "@1agh/maude-linux-arm64-musl": "1.0.6",
-    "@1agh/maude-linux-x64": "1.0.6",
-    "@1agh/maude-linux-x64-musl": "1.0.6",
-    "@1agh/maude-win32-x64": "1.0.6"
+    "@1agh/maude-darwin-arm64": "1.0.8",
+    "@1agh/maude-darwin-x64": "1.0.8",
+    "@1agh/maude-linux-arm64": "1.0.8",
+    "@1agh/maude-linux-arm64-musl": "1.0.8",
+    "@1agh/maude-linux-x64": "1.0.8",
+    "@1agh/maude-linux-x64-musl": "1.0.8",
+    "@1agh/maude-win32-x64": "1.0.8"
   },
   "files": [
     "cli",

package/plugins/design/templates/_shell.html

@@ -156,7 +156,8 @@
           "@remotion/transitions/wipe": "./_canvas-runtime/@remotion_transitions_wipe.js",
           "@remotion/transitions/flip": "./_canvas-runtime/@remotion_transitions_flip.js",
           "@remotion/transitions/clock-wipe": "./_canvas-runtime/@remotion_transitions_clock-wipe.js",
-          "@remotion/transitions/none": "./_canvas-runtime/@remotion_transitions_none.js"
+          "@remotion/transitions/none": "./_canvas-runtime/@remotion_transitions_none.js",
+          "dom-to-svg": "./_canvas-runtime/dom-to-svg.js"
         }
       }
     </script>