@1agh/maude 1.0.6 → 1.0.8

package/apps/studio/exporters/scope.ts

@@ -73,6 +73,15 @@ export interface ExportScopeHints {
   selection?: { selector?: string; file?: string } | null;
   /** `data-dc-screen` id of the artboard to export for `scope=artboard`. */
   artboardId?: string | null;
+  /**
+   * The canvas FILE the dialog was exporting, captured at submit time. Wins
+   * over `activeJson.active`: the persisted `_active.json` is written
+   * asynchronously after a tab switch, so a job submitted right after opening
+   * another canvas rendered the PREVIOUS one — with the live `artboardId` of
+   * the new one, i.e. a selector that never appears (a 60 s waitFor timeout on
+   * the worker). The live dialog knows which file it is looking at; trust it.
+   */
+  canvasFile?: string | null;
 }
 
 export interface ResolveScopeArgs {
@@ -108,7 +117,9 @@ function readHints(options: Record<string, unknown> | undefined): ExportScopeHin
       : null;
   const artboardId =
     typeof options.artboardId === 'string' && options.artboardId ? options.artboardId : null;
-  return { selection, artboardId };
+  const canvasFile =
+    typeof options.canvasFile === 'string' && options.canvasFile ? options.canvasFile : null;
+  return { selection, artboardId, canvasFile };
 }
 
 const RAW_EXCLUDES = new Set([
@@ -207,11 +218,11 @@ export async function resolveScope(args: ResolveScopeArgs): Promise<Target[]> {
     return [{ kind: 'file-tree', paths }];
   }
 
-  const activeFile = activeJson.active;
+  const hints = readHints(args.options);
+  const activeFile = hints.canvasFile ?? activeJson.active;
   if (!activeFile) return [];
   const slug = slugify(activeFile, designRel);
   const sel = firstSelection(activeJson.selected);
-  const hints = readHints(args.options);
 
   if (scope === 'selection') {
     // Prefer the live submit-time snapshot over the persisted `_active.json`

package/apps/studio/exporters/svg.ts

@@ -12,7 +12,7 @@ import path from 'node:path';
 
 import JSZip from 'jszip';
 
-import { getBrowserBundle } from './_browser-bundles.ts';
+import { getBrowserBundle, getCaptureCoreBundle } from './_browser-bundles.ts';
 import { exportShimPath, runShim } from './_runtime.ts';
 import {
   canvasShellUrl,
@@ -32,6 +32,7 @@ async function captureSvg(
   outDir: string,
   timeoutSec: number,
   bundlePath: string,
+  corePath: string,
   hooks?: ExportHooks
 ): Promise<string[]> {
   const args = [
@@ -42,6 +43,8 @@ async function captureSvg(
     target.cssPath,
     '--bundle-path',
     bundlePath,
+    '--core-path',
+    corePath,
     '--timeout',
     String(timeoutSec),
   ];
@@ -82,13 +85,24 @@ export async function run(
     throw new Error('svg adapter requires element targets (got file-tree)');
   }
   const timeoutSec = (options.timeoutSec as number | undefined) ?? 12;
-  const bundlePath = await getBrowserBundle('dom-to-svg', 'domToSvg');
+  const [bundlePath, corePath] = await Promise.all([
+    getBrowserBundle('dom-to-svg', 'domToSvg'),
+    getCaptureCoreBundle(),
+  ]);
   const tmp = mkdtempSync(path.join(tmpdir(), 'maude-svg-'));
 
   try {
     const written: string[] = [];
     for (let i = 0; i < elementTargets.length; i += 1) {
-      const paths = await captureSvg(elementTargets[i], ctx, tmp, timeoutSec, bundlePath, hooks);
+      const paths = await captureSvg(
+        elementTargets[i],
+        ctx,
+        tmp,
+        timeoutSec,
+        bundlePath,
+        corePath,
+        hooks
+      );
       written.push(...paths);
       hooks?.onProgress?.({ current: i + 1, total: elementTargets.length });
     }

package/apps/studio/exporters/video.ts

@@ -15,7 +15,7 @@
 // Scope is always `artboard`. No native binaries; the capture Chromium is the
 // same one every other exporter already uses (DDR-041).
 
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
@@ -30,7 +30,45 @@ import {
   type ExportResult,
 } from './index.ts';
 import type { Target } from './scope.ts';
-import { audioRefusalMessage, scanUnsupportedMedia } from './unsupported-media.ts';
+import {
+  audioRefusalMessage,
+  scanUnsupportedMedia,
+  type UnsupportedFinding,
+} from './unsupported-media.ts';
+
+/** Resolve a client-influenced canvas `file` to an absolute path inside the
+ * design root, following symlinks — .tsx/.html only. Mirrors jobs.ts's guard
+ * (security review F2). Returns null on any failure. */
+function safeCanvasAbs(repoRoot: string, designRoot: string, file: string): string | null {
+  if (!/\.(tsx|html)$/i.test(file)) return null;
+  try {
+    const designReal = realpathSync(path.resolve(designRoot));
+    // `file` is repo-relative (carries the `.design/` prefix) — resolve against
+    // repoRoot, require the realpath under designRoot.
+    const abs = realpathSync(path.resolve(repoRoot, file));
+    return abs === designReal || abs.startsWith(designReal + path.sep) ? abs : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `options.unsupportedMedia` — the cell's pre-resolved `scanUnsupportedMedia`
+ * findings for a remote job, or null when absent (local lane: scan the disk).
+ * Shape-checked: it crosses the cell→worker HTTP boundary.
+ */
+function shippedUnsupportedMedia(options: ExportOptions): UnsupportedFinding[] | null {
+  const raw = (options as { unsupportedMedia?: unknown }).unsupportedMedia;
+  if (!Array.isArray(raw)) return null;
+  return raw.filter(
+    (f): f is UnsupportedFinding =>
+      !!f &&
+      typeof f === 'object' &&
+      ((f as UnsupportedFinding).element === 'Audio' ||
+        (f as UnsupportedFinding).element === 'OffthreadVideo') &&
+      typeof (f as UnsupportedFinding).sourceFile === 'string'
+  );
+}
 
 // DDR-045: resolve via DEV_SERVER_ROOT, never `import.meta.dir`. See _runtime.ts.
 const VIDEO_PLAYWRIGHT = exportShimPath('_video-playwright.mjs');
@@ -75,8 +113,21 @@ async function runVideo(
   // via a muted file is pure waste. GIF is silent by format, so it is exempt.
   let preStamped: ExportDegradation | undefined;
   if (format !== 'gif' && options.allowUnsupportedMedia !== true) {
-    const canvasAbs = path.resolve(ctx.repoRoot, el.file);
-    for (const finding of scanUnsupportedMedia(canvasAbs)) {
+    // The scan reads the canvas SOURCE, which only the process holding the
+    // checkout has. On the render worker (DDR-230: no tenant files) the read
+    // fails quietly — an empty finding list — and the export went on to do
+    // EXACTLY what this guard exists to prevent: renderMediaOnWeb rejected
+    // <Audio>, the frame-step fallback ran ~40× slower and shipped a muted
+    // file. So the cell resolves the findings up front and ships them in the
+    // job (`options.unsupportedMedia`, exporters/jobs.ts), same as printProps.
+    // `el.file` is client-influenced (canvasFile / selection.file). On the
+    // local/in-cell lane we scan it off disk — bound to the DESIGN root,
+    // realpath-checked (a `startsWith` prefix alone is escaped by an
+    // in-checkout symlink), .tsx/.html only (defender W1 / attacker F2).
+    const canvasAbs = safeCanvasAbs(ctx.repoRoot, ctx.designRoot, el.file);
+    const findings =
+      shippedUnsupportedMedia(options) ?? (canvasAbs ? scanUnsupportedMedia(canvasAbs) : []);
+    for (const finding of findings) {
       if (finding.element === 'Audio' && options.audio !== false) {
         // Refuse. A vanished music bed is worse than an export that did not run.
         throw new Error(audioRefusalMessage(finding, el.file));
@@ -97,10 +148,26 @@ async function runVideo(
   // silent format), so it never needs the render-lib bundle; mp4/webm build it
   // alongside the frame-step encode-lib (the shim decides per-target at runtime
   // whether the artboard has a registered comp to hand the renderer).
-  const [lib, renderLib] = await Promise.all([
-    getEncodeLibBundle(),
-    format === 'gif' ? Promise.resolve(null) : getWebRendererBundle(),
-  ]);
+  // These Bun.build calls happen BEFORE the render shim spawns. On the headless
+  // render worker a mp4 job hung here in total silence (no shim ever launched,
+  // so the shim's own hard-kill never fired) — bound it so a stuck bundle build
+  // FAILS with a named reason instead of eating the whole render budget.
+  console.error(`[video] building bundles (format=${format})…`);
+  const bundleStart = Date.now();
+  const withTimeout = (p: Promise<unknown>, label: string, ms: number) =>
+    Promise.race([
+      p,
+      new Promise((_, reject) =>
+        setTimeout(() => reject(new Error(`${label} did not finish within ${ms}ms`)), ms)
+      ),
+    ]);
+  const [lib, renderLib] = (await Promise.all([
+    withTimeout(getEncodeLibBundle(), 'encode-lib bundle', 90_000),
+    format === 'gif'
+      ? Promise.resolve(null)
+      : withTimeout(getWebRendererBundle(), 'web-renderer bundle', 90_000),
+  ])) as [string, string | null];
+  console.error(`[video] bundles ready in ${Date.now() - bundleStart}ms`);
   const tmp = mkdtempSync(path.join(tmpdir(), 'maude-video-'));
   const outPath = path.join(tmp, `export.${format}`);
 

package/apps/studio/http.ts

@@ -6,7 +6,7 @@
 
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync, unlinkSync, watch } from 'node:fs';
-import { dirname, join, posix, relative, resolve, sep } from 'node:path';
+import { basename, dirname, join, posix, relative, resolve, sep } from 'node:path';
 // Ownership mutations live with the CLI on purpose — see /_api/sync/ownership.
 import { adoptToHub, detachToRepo, ownershipState } from '../../cli/lib/design-ownership.mjs';
 import {
@@ -39,6 +39,7 @@ import type { Context } from './context.ts';
 import { reloadConfig } from './context.ts';
 import { buildDebugBundle } from './debug-bundle.ts';
 import { probeSetupReadiness } from './design-setup-readiness.ts';
+import { isScopeValidForFormat, scopeRefusalMessage } from './exporters/format-scopes.ts';
 import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
 import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
 import type { ActiveJsonShape } from './exporters/scope.ts';
@@ -399,6 +400,19 @@ export const READ_ONLY_ALLOWED_WRITES = new Set([
   '/_api/export', // "look, comment and download" — the cell allows /api/export too
   '/_api/export-jobs',
   '/_api/export-jobs/download',
+  // DDR-231 Phase 2 T6 — the browser lane's ledger row. A viewer may already
+  // EXPORT (the two entries above), so recording that they did is the same
+  // class of write: it touches no project state, only the recent-exports list.
+  // Refusing it here while allowing the export produced exactly the reported
+  // symptom for viewers — a file downloads and nothing anywhere says so.
+  '/_api/export-history',
+  // …and the deck's composition half. The member's own browser captured the
+  // PNGs; this route only packs bytes they already hold into a .pptx and hands
+  // it back — it writes no project state. Missing from this list, a VIEWER's
+  // PPTX export captured every artboard and then died on a 403 with the dialog
+  // still saying "Capturing 10/10" (found by the T7 export E2E, which runs
+  // unauthenticated and therefore as a viewer).
+  '/_api/export-assemble',
   '/_api/report', // bug reports are about Maude, not the project
   '/_api/report-fallback',
   // Cloud Phase 27 — COMMENT IS THE ONE WRITE A VIEWER HOLDS. The role matrix
@@ -4292,12 +4306,49 @@ export function createHttp(
     },
 
     '/_api/export-history': async (req: Request) => {
-      // Phase 6.5 T10 — read-only recent-exports feed for the dialog's
-      // Recent tab. Writes happen as a side-effect of job completion
-      // (exporters/jobs.ts persistAndEvict) rather than this handler.
-      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      const history = exportJobs.loadHistory();
-      return Response.json({ history }, { headers: { 'Cache-Control': 'no-store' } });
+      // Phase 6.5 T10 — recent-exports feed for the dialog's Recent tab. For a
+      // JOB, the write happens as a side-effect of completion (exporters/
+      // jobs.ts persistAndEvict), not here.
+      //
+      // DDR-231 Phase 2 T6 — the browser lane has no job: the member's own
+      // browser captures the artboard and saves the file, and this process
+      // never sees the bytes. Phase 1 therefore left those exports INVISIBLE —
+      // "v exports dialog nic nevidim" — so the POST exists to record one in
+      // the same ledger. It stores a name and a timestamp, never a payload.
+      if (req.method === 'GET') {
+        const history = exportJobs.loadHistory();
+        return Response.json({ history }, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      // Same gates as every other write here: CSRF + DNS-rebinding. This route
+      // is MAIN-ORIGIN only (absent from CANVAS_SAFE_API + the canvas server's
+      // routes map) — the canvas iframe reaches it through the shell bridge.
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      const body = await readJson<{ format?: unknown; scope?: unknown; filename?: unknown }>(
+        req,
+        4 * 1024
+      );
+      if (!body) return new Response('body required', { status: 400 });
+      if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
+      if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      // The name is chosen in the browser, where tenant TSX shares the window
+      // (DDR-231 F1) — reduce it to a bare, charset-limited basename before it
+      // reaches the ledger that agents and future sessions read back.
+      const raw = typeof body.filename === 'string' ? body.filename : '';
+      const filename = basename(raw)
+        .replace(/[^A-Za-z0-9._-]/g, '')
+        .slice(0, 255);
+      if (!filename || /^\.+$/.test(filename))
+        return new Response('filename required', { status: 400 });
+      const entry = exportJobs.recordBrowserExport({
+        format: body.format,
+        scope: body.scope,
+        filename,
+      });
+      return Response.json(entry, { status: 201, headers: { 'Cache-Control': 'no-store' } });
     },
 
     '/_api/export': async (req: Request) => {
@@ -4323,6 +4374,14 @@ export function createHttp(
       if (!body) return new Response('body required', { status: 400 });
       if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
       if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      // DDR-231 Phase 2 T4 — the PAIR, not just each half. `pdf` + `project-raw`
+      // is two individually-valid values that resolve to a `file-tree` target,
+      // which the render service refuses as `invalid render job` — a refusal
+      // that named neither the field nor the remedy. Reproduced locally against
+      // a real maude-render; see test/export-format-scope-coherence.test.ts.
+      if (!isScopeValidForFormat(body.format, body.scope)) {
+        return new Response(scopeRefusalMessage(body.format, body.scope), { status: 400 });
+      }
       const format = body.format;
       const scope = body.scope;
       try {
@@ -4376,6 +4435,14 @@ export function createHttp(
       if (!body) return new Response('body required', { status: 400 });
       if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
       if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      // DDR-231 Phase 2 T4 — the PAIR, not just each half. `pdf` + `project-raw`
+      // is two individually-valid values that resolve to a `file-tree` target,
+      // which the render service refuses as `invalid render job` — a refusal
+      // that named neither the field nor the remedy. Reproduced locally against
+      // a real maude-render; see test/export-format-scope-coherence.test.ts.
+      if (!isScopeValidForFormat(body.format, body.scope)) {
+        return new Response(scopeRefusalMessage(body.format, body.scope), { status: 400 });
+      }
       try {
         const { id, result } = exportJobs.enqueue(
           buildExportArgs(req, { format: body.format, scope: body.scope, options: body.options })
@@ -4425,6 +4492,107 @@ export function createHttp(
       });
     },
 
+    '/_api/export-warmup': async (req: Request) => {
+      // DDR-231 T7 — wake the render service while the member is still picking
+      // export options: the dialog fires this on open (remote lane only), so
+      // by the time a video/PDF job lands the multi-GB Chromium container is
+      // already booting instead of starting cold. Proxies GET /_health — no
+      // job body, no secret in the response, nothing evaluates.
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      // Side-effecting GET (it triggers an outbound fetch that wakes/bills a
+      // container) → gate it like every other side-effecting GET, so a
+      // cross-site page a member visits can't fire it as a keep-warm
+      // amplification (DDR-231 security L2).
+      if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
+      const serviceUrl = process.env.MAUDE_RENDER_URL;
+      if (!serviceUrl) return Response.json({ ok: false, lane: resolveRenderLane() });
+      try {
+        const r = await fetch(`${serviceUrl.replace(/\/+$/, '')}/_health`, {
+          signal: AbortSignal.timeout(8_000),
+        });
+        const body = (await r.json().catch(() => null)) as { ok?: boolean } | null;
+        return Response.json(
+          { ok: Boolean(body?.ok), lane: 'remote' },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      } catch {
+        // A timeout here usually MEANS the container is waking — that is the
+        // point of the ping; report it calmly.
+        return Response.json(
+          { ok: false, waking: true, lane: 'remote' },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+    },
+
+    '/_api/export-assemble': async (req: Request) => {
+      // DDR-231 (hybrid export lanes) — the browser lane's ASSEMBLE half. The
+      // member's browser captured the artboard PNGs (canvas-lib's
+      // export-capture bridge — the only place the pixels exist in a
+      // workspace); this composes them into a .pptx deck with PptxGenJS —
+      // pure JS over pure data, the same containment class as zip: no tenant
+      // TSX evaluates here and no browser enters the image. MAIN-ORIGIN ONLY
+      // (absent from CANVAS_SAFE_API + the canvas-origin routes map) and
+      // CSRF-gated like its jobs siblings.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      // Byte cap BEFORE parsing: 50 artboards at 3× are tens of MB; 96 MB sits
+      // under Bun's global maxRequestBodySize (~108 MB) so formData() can't be
+      // pushed past it, and still fits a large deck (PptxGenJS base64-encodes
+      // every image → memory ~3× input). REQUIRE an honest content-length: a
+      // chunked / absent-length body would otherwise skip this fast-reject and
+      // buffer up to Bun's ceiling before the loop below could stop it
+      // (adversarial pass). formData() itself is still Bun-capped as a backstop.
+      const MAX_ASSEMBLE_BYTES = 96 * 1024 * 1024;
+      const declared = Number(req.headers.get('content-length'));
+      if (!Number.isFinite(declared) || declared <= 0)
+        return new Response('content-length required', { status: 411 });
+      if (declared > MAX_ASSEMBLE_BYTES)
+        return new Response('assembly payload too large', { status: 413 });
+      const form = await req.formData().catch(() => null);
+      if (!form) return new Response('multipart form body required', { status: 400 });
+      if (form.get('format') !== 'pptx')
+        return new Response('unsupported assemble format', { status: 400 });
+      const scale = Math.max(1, Math.min(8, Number(form.get('scale')) || 1));
+      const images: Uint8Array[] = [];
+      let total = 0;
+      for (const [key, value] of form.entries()) {
+        if (key !== 'image') continue;
+        // Bun's FormData typings collapse the entry value; runtime-check the
+        // Blob shape instead of trusting the declared union.
+        const file = value as unknown;
+        if (!(file instanceof Blob)) continue;
+        const bytes = new Uint8Array(await file.arrayBuffer());
+        total += bytes.byteLength;
+        if (images.length >= 100 || total > MAX_ASSEMBLE_BYTES)
+          return new Response('assembly payload too large', { status: 413 });
+        images.push(bytes);
+      }
+      if (!images.length) return new Response('no images to assemble', { status: 400 });
+      try {
+        const { assemblePngDeck } = await import('./exporters/pptx.ts');
+        const body = await assemblePngDeck(images, scale);
+        const name = String(form.get('name') || 'export').replace(/[^A-Za-z0-9._-]/g, '_');
+        return new Response(body as unknown as BodyInit, {
+          status: 200,
+          headers: {
+            'Content-Type':
+              'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+            'Content-Disposition': `attachment; filename="${name}.pptx"`,
+            'Cache-Control': 'no-store',
+          },
+        });
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return new Response(`deck assembly failed: ${msg}`, { status: 422 });
+      }
+    },
+
     // feature-ai-media-generation (DDR-16x) — the background AI-media generation
     // job queue. The privileged sibling of /_api/export-jobs: MAIN-ORIGIN ONLY
     // (absent from CANVAS_SAFE_API + startCanvasServer's routes — the untrusted

package/apps/studio/runtime-bundle.ts

@@ -123,6 +123,12 @@ export const RUNTIME_PACKAGES = [
   '@remotion/transitions/flip',
   '@remotion/transitions/clock-wipe',
   '@remotion/transitions/none',
+  // DDR-231 (hybrid export lanes) — the workspace `browser` lane captures
+  // artboards in the MEMBER's browser. canvas-lib's export-capture listener
+  // reaches dom-to-svg through a LAZY runtime `import('dom-to-svg')` (the
+  // pixi.js pattern), so a canvas that never exports pays zero bundle cost —
+  // regression-pinned alongside pixi in test/photo-canvas-bundle.test.ts.
+  'dom-to-svg',
 ] as const;
 
 export type RuntimePackage = (typeof RUNTIME_PACKAGES)[number];

package/apps/studio/test/canvas-hide-chrome.test.ts

@@ -13,6 +13,7 @@ import { describe, expect, test } from 'bun:test';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { CAPTURE_HIDDEN_SELECTORS } from '../exporters/capture-chrome.ts';
 import { DEV_SERVER_ROOT } from '../paths.ts';
 
 const SHELL_HTML_PATH = join(
@@ -56,3 +57,32 @@ describe('_shell.html #canvas-hide-chrome covers every overlay mount class', ()
     });
   }
 });
+
+// DDR-231 Phase 2 T2 — the SECOND consumer. The browser lane captures the live
+// canvas (it never navigates to `?hide-chrome=1`), so it applies the same
+// suppression from `exporters/capture-chrome.ts`. Two copies of a selector list
+// drift; this is the tripwire that makes them fail loudly instead. Same shape
+// as the `isMaudeRuntimeState` / `isRuntimeStateRel` agreement pin.
+describe('capture-chrome.ts agrees with the _shell.html block', () => {
+  const shellHtml = readFileSync(SHELL_HTML_PATH, 'utf8');
+  const block =
+    shellHtml.match(/<style id="canvas-hide-chrome"[^>]*>([\s\S]*?)<\/style>/)?.[1] ?? '';
+
+  /** Selectors declared in the shell's style block, comments stripped. */
+  const shellSelectors = block
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\{[\s\S]*$/, '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  test('every shell selector is in CAPTURE_HIDDEN_SELECTORS', () => {
+    const ours = new Set(CAPTURE_HIDDEN_SELECTORS);
+    expect(shellSelectors.filter((s) => !ours.has(s))).toEqual([]);
+  });
+
+  test('every CAPTURE_HIDDEN_SELECTORS entry is in the shell block', () => {
+    const theirs = new Set(shellSelectors);
+    expect(CAPTURE_HIDDEN_SELECTORS.filter((s) => !theirs.has(s))).toEqual([]);
+  });
+});

package/apps/studio/test/capture-core.test.ts

@@ -0,0 +1,32 @@
+// capture-core.test.ts — pure-logic guards of the shared capture spine
+// (DDR-231). The DOM-dependent half (svgForElement, rasterizeSvg) is exercised
+// end-to-end by the fidelity gate (plan T6) — no DOM emulation here.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  assertRasterSizeOk,
+  MAX_OUTPUT_BYTES,
+  MAX_OUTPUT_SIDE_PX,
+} from '../exporters/capture-core.ts';
+
+describe('assertRasterSizeOk — the raster render guard', () => {
+  test('a 1440×900 artboard at 2× passes', () => {
+    expect(() => assertRasterSizeOk(1440, 900, 2)).not.toThrow();
+  });
+
+  test('a 600dpi A0 poster still fits (the guard ceiling rationale)', () => {
+    // 9933×14043 px ≈ 558MB RGBA — deliberately inside the ~600MB ceiling.
+    expect(() => assertRasterSizeOk(9933 / 6.25, 14043 / 6.25, 6.25)).not.toThrow();
+  });
+
+  test('exceeding the side ceiling throws with an actionable max-DPI hint', () => {
+    expect(() => assertRasterSizeOk(MAX_OUTPUT_SIDE_PX, 900, 2)).toThrow(/max supported DPI/);
+  });
+
+  test('exceeding the byte ceiling throws even when both sides fit', () => {
+    // 15000×15000 × 4B = 900MB > ceiling while each side < 16000.
+    expect(15000 * 15000 * 4).toBeGreaterThan(MAX_OUTPUT_BYTES);
+    expect(() => assertRasterSizeOk(15000, 15000, 1)).toThrow(/render guard/);
+  });
+});

package/apps/studio/test/export-assemble.test.ts

@@ -0,0 +1,53 @@
+// export-assemble.test.ts — DDR-231: the in-cell half of the pptx browser
+// lane. assemblePngDeck composes client-captured PNG bytes into a deck with
+// PptxGenJS — pure JS over pure data (the zip containment class), so it must
+// work with no browser, no filesystem inputs, no tenant checkout.
+
+import { describe, expect, test } from 'bun:test';
+
+import { assemblePngDeck } from '../exporters/pptx.ts';
+
+// 1×1 transparent PNG.
+const PNG_1PX = Uint8Array.from(
+  atob(
+    'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg=='
+  ),
+  (c) => c.charCodeAt(0)
+);
+
+describe('assemblePngDeck — bytes in, deck out', () => {
+  test('two PNGs become a two-slide .pptx (zip container with per-slide parts)', async () => {
+    const body = await assemblePngDeck([PNG_1PX, PNG_1PX], 3);
+    // .pptx IS a zip — PK\x03\x04 magic.
+    expect(body[0]).toBe(0x50);
+    expect(body[1]).toBe(0x4b);
+    const JSZip = (await import('jszip')).default;
+    const zip = await JSZip.loadAsync(body);
+    expect(zip.file('ppt/slides/slide1.xml')).toBeTruthy();
+    expect(zip.file('ppt/slides/slide2.xml')).toBeTruthy();
+    expect(zip.file('ppt/slides/slide3.xml')).toBeFalsy();
+  });
+
+  test('non-PNG bytes are refused, not composed into a corrupt deck', async () => {
+    await expect(assemblePngDeck([new TextEncoder().encode('<svg/>')], 3)).rejects.toThrow(
+      /not a PNG/
+    );
+  });
+
+  test('a \\x89PNG prefix on non-PNG bytes is caught by the full 8-byte signature (L3)', async () => {
+    // First 4 bytes match the old check, bytes 4-7 do not.
+    const fake = new Uint8Array(24);
+    fake.set([0x89, 0x50, 0x4e, 0x47, 0x00, 0x00, 0x00, 0x00], 0);
+    await expect(assemblePngDeck([fake], 3)).rejects.toThrow(/not a PNG/);
+  });
+
+  test('an implausible IHDR dimension is refused, not fed to the geometry math (F3)', async () => {
+    // Valid 8-byte sig + IHDR claiming 0x7fffffff × 0x7fffffff.
+    const bomb = new Uint8Array(24);
+    bomb.set([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a], 0);
+    const dv = new DataView(bomb.buffer);
+    dv.setUint32(16, 0x7fffffff);
+    dv.setUint32(20, 0x7fffffff);
+    await expect(assemblePngDeck([bomb], 3)).rejects.toThrow(/implausible PNG dimensions/);
+  });
+});