@lumencast/compiler 0.6.0 → 0.8.0

package/src/compile.ts

@@ -26,12 +26,22 @@ import type {
   LSMLAnimateDirective,
   LSMLAnimateState,
   LSMLBundle,
+  LSMLFill,
   LSMLKeyframes,
+  LSMLMask,
   LSMLNode,
   LSMLPath,
   LSMLRepeat,
   LSMLText,
 } from "./lsml-types.js";
+import {
+  parseBlendMode,
+  parseObjectFit,
+  clampGradientTransform,
+  MASK_TYPES,
+  MASK_OPS,
+} from "./lsml-1_2.js";
+import { checkHostAllowed } from "@lumencast/protocol";
 
 /** Structured compile diagnostic (ADR 001 §3.4, issue #34). Per
  *  Bastion R9 it carries node identity + field + static reason and
@@ -53,9 +63,16 @@ export interface CompileOptions {
   /** Optional warn collector — receives the formatted message plus the
    *  structured diagnostic (additive second argument, issue #34). */
   onWarn?: (message: string, diagnostic: CompileDiagnostic) => void;
+  /** INTERNAL (ADR 002 #F, Bastion T1/T2) — the bundle's
+   *  `assets.allowedHosts`, threaded down by `compileBundle` so image-fill
+   *  `src` is host/scheme-gated at lowering (the compiler arm of the
+   *  double-gate ; the runtime re-gates because live LSDP deltas bypass the
+   *  compiler). Not part of the caller-facing contract — `compileBundle`
+   *  always sets it from the bundle. */
+  allowedHosts?: readonly string[];
 }
 
-const SUPPORTED_VERSIONS = new Set(["1.0", "1.1"] as const);
+const SUPPORTED_VERSIONS = new Set(["1.0", "1.1", "1.2"] as const);
 
 // --- hard caps (ADR 001 §5.1 R8 + §6 RC#10, threat model Bastion) ------
 //
@@ -132,8 +149,14 @@ const COMMON_NODE_KEYS: ReadonlySet<string> = new Set([
   "visible",
   "opacity",
   "rotation",
+  "flipY",
+  "blur",
+  "shadow",
   "sizing",
   "position",
+  // 1.2+ (ADR 002 §3.2) — universal blend mode + typed mask on every node.
+  "blendMode",
+  "mask",
 ]);
 
 /** Keys `compileRepeat` consumes. `scope` names the iteration scope the
@@ -151,7 +174,7 @@ const REPEAT_NODE_KEYS: ReadonlySet<string> = new Set([
 const KIND_NODE_KEYS: Readonly<Record<string, ReadonlySet<string>>> = {
   stack: new Set(["direction", "gap", "align", "justify", "padding", "rtl"]),
   grid: new Set(["columns", "rows", "gap", "padding"]),
-  frame: new Set(["size", "position", "background", "backgrounds", "clipsContent"]),
+  frame: new Set(["size", "position", "background", "backgrounds", "clipsContent", "cornerRadius"]),
   text: new Set(["style", "format", "maxLines"]),
   image: new Set(["alt", "size", "fit"]),
   shape: new Set([
@@ -194,6 +217,10 @@ const BUNDLE_KEYS: ReadonlySet<string> = new Set([
   "layout",
   "operator_inputs",
   "external_adapters",
+  // ADR 002 #F — `assets` (incl. `allowedHosts`, Bastion T1/T6) is now
+  // consumed : it drives the image-fill host gate at lowering AND is
+  // forwarded verbatim into the RenderBundle so the runtime can re-gate.
+  "assets",
 ]);
 
 const NOT_LOWERED =
@@ -225,9 +252,17 @@ export function compileBundle(lsml: LSMLBundle, options: CompileOptions = {}): R
     );
   }
   auditBundleKeys(lsml, options);
+  // ADR 002 #F / Bastion T1+T2+T6 — thread `assets.allowedHosts` down so the
+  // compiler arm of the double-gate can host/scheme-check every image-fill
+  // `src` at lowering, and FORWARD `assets` verbatim into the bundle so the
+  // runtime arm has the allowlist to re-gate live LSDP deltas. `emit_lsml.go`
+  // (Orion) likewise preserves `assets.allowedHosts` (T6) — the compiler
+  // never fabricates or strips it.
+  const opts: CompileOptions = { ...options, allowedHosts: lsml.assets?.allowedHosts };
   return {
     scene_version: lsml.scene_version,
-    root: compileNode(lsml.layout, options),
+    root: compileNode(lsml.layout, opts),
+    ...(lsml.assets !== undefined ? { assets: lsml.assets } : {}),
     // LSML 1.1 §17.3 — forward `profiles[]` verbatim so the runtime applies
     // the same gating rule (§17.3.1 hard rejection for unsupported
     // behavioural profiles, §17.5.1 advisory pass-through for authoring
@@ -303,10 +338,14 @@ function compileNode(node: LSMLNode, opts: CompileOptions): RenderNode {
       if (node.background !== undefined) props["background"] = node.background;
       // 1.1 §4.3 + §4.12 — stacked backgrounds (frame.tsx reads
       // `resolved.backgrounds`; array form wins over legacy `background`).
-      if (node.backgrounds !== undefined) props["backgrounds"] = node.backgrounds;
+      if (node.backgrounds !== undefined)
+        props["backgrounds"] = lowerFills(node.backgrounds, node.id, "backgrounds", opts);
       // 1.1 §4.3 — clip children to the frame bounds. The spec default
       // (`true`) is applied runtime-side ; only explicit values forward.
       if (node.clipsContent !== undefined) props["clipsContent"] = node.clipsContent;
+      // Rounded container (pills, picto square). Canonical RenderNode name is
+      // `radius` (frame.tsx reads it as `border-radius`).
+      if (node.cornerRadius !== undefined) props["radius"] = node.cornerRadius;
       break;
 
     case "text":
@@ -345,7 +384,7 @@ function compileNode(node: LSMLNode, opts: CompileOptions): RenderNode {
       }
       if (node.fill !== undefined) props["fill"] = node.fill;
       // 1.1 §4.6 + §4.12 — stacked fills (shape.tsx reads `resolved.fills`).
-      if (node.fills !== undefined) props["fills"] = node.fills;
+      if (node.fills !== undefined) props["fills"] = lowerFills(node.fills, node.id, "fills", opts);
       // Single stroke lowers to the flat props shape.tsx consumes
       // (`stroke` = colour string, `stroke_width` = number). The previous
       // object forward was silently unrenderable.
@@ -399,6 +438,9 @@ function compileNode(node: LSMLNode, opts: CompileOptions): RenderNode {
   if (node.visible !== undefined) props["visible"] = node.visible;
   if (node.opacity !== undefined) props["opacity"] = node.opacity;
   if (node.rotation !== undefined) props["rotation"] = node.rotation;
+  if (node.flipY !== undefined) props["flipY"] = node.flipY;
+  if (node.blur !== undefined) props["blur"] = node.blur;
+  if (node.shadow !== undefined) props["shadow"] = node.shadow;
   if (node.sizing !== undefined) props["sizing"] = node.sizing;
   if (node.position !== undefined && props["x"] === undefined && props["y"] === undefined) {
     // Frame's case above already sets x/y from `position` ; the universal
@@ -410,6 +452,22 @@ function compileNode(node: LSMLNode, opts: CompileOptions): RenderNode {
     for (const [k, v] of Object.entries(node.bindUniversal)) bindings[k] = v;
   }
 
+  // 1.2+ universal effects (ADR 002 §3.2 ; Bastion T4). Closed enums :
+  // a value outside the allowlist is diagnosed and OMITTED, never
+  // forwarded. The runtime re-validates on the live path (#D/#E).
+  if (node.blendMode !== undefined) {
+    const mode = parseBlendMode(node.blendMode);
+    if (mode === null) {
+      warn(opts, node.id, "blendMode", "is not a recognised mix-blend-mode (ADR 002 §3.2)");
+    } else {
+      props["blendMode"] = mode;
+    }
+  }
+  if (node.mask !== undefined) {
+    const mask = lowerMask(node.mask, node.id, opts);
+    if (mask !== null) props["mask"] = mask;
+  }
+
   const children = node.children?.map((c) => compileNode(c, opts));
 
   const out: RenderNode = { kind: node.kind };
@@ -668,6 +726,146 @@ function lowerPaths(
   });
 }
 
+// --- LSML 1.2 fill + mask lowering (ADR 002 §3.2 ; Bastion T4) ----------
+//
+// Closed-enum + bounded-float gate at lowering. A bad enum value or a
+// malformed gradient transform is diagnosed and the offending FIELD is
+// omitted — the rest of the fill is preserved. Host/scheme allowlist of an
+// image-fill `src` (T1/T2) is enforced HERE (#F) against the threaded
+// `opts.allowedHosts` — the compiler arm of the double-gate. A rejected
+// `src` drops the WHOLE image-fill (never a passthrough URL) with an
+// R9-clean diagnostic. The runtime re-gates because live LSDP deltas bypass
+// the compiler entirely.
+
+/** Lower a `fills[]` / `backgrounds[]` array, validating 1.2 image-fill and
+ *  gradient-transform fields. An image-fill whose `src` fails the host /
+ *  scheme allowlist is dropped (T1/T2). Unknown fill kinds and stop arrays
+ *  pass through unchanged (they are gated elsewhere). */
+function lowerFills(
+  fills: LSMLFill[],
+  nodeId: string | undefined,
+  field: string,
+  opts: CompileOptions,
+): LSMLFill[] {
+  return fills.flatMap((fill, i) => {
+    // #L (ADR 002 A2.2) — per-fill `blendMode`, revalidated against the closed
+    // enum (T4 compiler arm ; the runtime re-validates independently). A value
+    // outside `LSMLBlendMode` is diagnosed + omitted, never passthrough. The
+    // helper re-applies the validated mode (or drops it) on whatever the branch
+    // below emits, so the same gate covers every Fill variant.
+    const applyBlend = <T extends LSMLFill>(out: T): T => {
+      if (fill.blendMode === undefined) return out;
+      const mode = parseBlendMode(fill.blendMode);
+      if (mode === null) {
+        warn(
+          opts,
+          nodeId,
+          `${field}[${i}].blendMode`,
+          "is not a recognised mix-blend-mode (ADR 002 §3.2)",
+        );
+        const { blendMode: _drop, ...rest } = out;
+        return rest as T;
+      }
+      return { ...out, blendMode: mode };
+    };
+    if (fill.kind === "image") {
+      // T1/T2 — gate `src` before anything else ; a rejected host/scheme
+      // drops the entire image-fill. R9 : the diagnostic carries the static
+      // reason, never the URL.
+      const decision = checkHostAllowed(fill.src, opts.allowedHosts);
+      if (!decision.allowed) {
+        warn(
+          opts,
+          nodeId,
+          `${field}[${i}].src`,
+          `image-fill src rejected by host/scheme allowlist : ${decision.reason} (ADR 002 §3.2, Bastion T1/T2)`,
+        );
+        return [];
+      }
+      const out = { ...fill };
+      if (fill.objectFit !== undefined) {
+        const fit = parseObjectFit(fill.objectFit);
+        if (fit === null) {
+          warn(
+            opts,
+            nodeId,
+            `${field}[${i}].objectFit`,
+            "is not a recognised object-fit (ADR 002 §3.2)",
+          );
+          delete out.objectFit;
+        } else {
+          out.objectFit = fit;
+        }
+      }
+      if (fill.transform !== undefined) {
+        const t = clampGradientTransform(fill.transform);
+        if (t === null) {
+          warn(opts, nodeId, `${field}[${i}].transform`, "is not 6 finite floats (ADR 002 §3.2)");
+          delete out.transform;
+        } else {
+          out.transform = t;
+        }
+      }
+      return applyBlend(out);
+    }
+    if (fill.kind === "linear-gradient" || fill.kind === "radial-gradient") {
+      if (fill.transform === undefined) return applyBlend(fill);
+      const t = clampGradientTransform(fill.transform);
+      if (t === null) {
+        warn(opts, nodeId, `${field}[${i}].transform`, "is not 6 finite floats (ADR 002 §3.2)");
+        const { transform: _drop, ...rest } = fill;
+        return applyBlend(rest);
+      }
+      return applyBlend({ ...fill, transform: t });
+    }
+    return applyBlend(fill);
+  });
+}
+
+/** Lower a typed `mask` (ADR 002 §3.2). Closed enums on `type` / `op` ; a bad
+ *  enum or a malformed `source` discriminant drops the whole mask (it cannot
+ *  be partially honoured). NEVER forwards a free SVG string — `source` is a
+ *  typed discriminated union by construction (Bastion T3). */
+function lowerMask(
+  mask: LSMLMask,
+  nodeId: string | undefined,
+  opts: CompileOptions,
+): LSMLMask | null {
+  if (typeof mask !== "object" || mask === null) {
+    warn(opts, nodeId, "mask", "is not a mask object (ADR 002 §3.2)");
+    return null;
+  }
+  if (!MASK_TYPES.has(mask.type as string)) {
+    warn(opts, nodeId, "mask.type", "is not alpha|luminance (ADR 002 §3.2)");
+    return null;
+  }
+  if (!MASK_OPS.has(mask.op as string)) {
+    warn(opts, nodeId, "mask.op", "is not intersect|subtract|union (ADR 002 §3.2)");
+    return null;
+  }
+  const src = mask.source;
+  const validSource =
+    typeof src === "object" &&
+    src !== null &&
+    ((src.kind === "shape" && typeof (src as { ref?: unknown }).ref === "string") ||
+      (src.kind === "image" && typeof (src as { src?: unknown }).src === "string") ||
+      // group/frame container source (ADR 002 A4.3) — same closed-enum, same
+      // `ref` shape as `shape` ; the runtime composites its visible children.
+      (src.kind === "group" && typeof (src as { ref?: unknown }).ref === "string"));
+  if (!validSource) {
+    warn(opts, nodeId, "mask.source", "is not a typed shape|image|group source (ADR 002 §3.2)");
+    return null;
+  }
+  // Re-emit only the typed fields, dropping any extraneous keys.
+  return {
+    source: src,
+    type: mask.type,
+    op: mask.op,
+    ...(mask.position !== undefined ? { position: mask.position } : {}),
+    ...(mask.size !== undefined ? { size: mask.size } : {}),
+  };
+}
+
 // --- filter lowering (ADR 001 §5.1 R8 — hard clamps, non-optional) -----
 
 /** Lower an LSML `filter` state (`{ blur?, brightness? }`) to the CSS

package/src/index.ts

@@ -14,6 +14,17 @@ export {
   type CompileDiagnostic,
 } from "./compile.js";
 export { canonicalize, hashBundle, ZERO_HASH } from "./canonicalize.js";
+
+export {
+  BLEND_MODES,
+  OBJECT_FITS,
+  MASK_TYPES,
+  MASK_OPS,
+  MAX_GRADIENT_TRANSFORM_ABS,
+  parseBlendMode,
+  parseObjectFit,
+  clampGradientTransform,
+} from "./lsml-1_2.js";
 export type {
   LSMLBundle,
   LSMLNode,
@@ -22,6 +33,10 @@ export type {
   LSMLAnimateDirective,
   LSMLFill,
   LSMLFillStop,
+  LSMLBlendMode,
+  LSMLObjectFit,
+  LSMLMask,
+  LSMLGradientTransform,
   LSMLStroke,
   LSMLPath,
   LSMLKeyframes,

package/src/lsml-1_2.ts

@@ -0,0 +1,101 @@
+// LSML 1.2 closed-enum parsers + bounded gradient-transform clamp
+// (ADR 002 #C ; Bastion condition T4). Compiler half of the double-gate :
+// the runtime re-validates the same values on the live path (#D/#E/#F wire
+// `mix-blend-mode`/`object-fit`/`mask`/`gradientTransform` at render). This
+// module mirrors the `css-color.ts` / `filter-clamp.ts` contract :
+//
+//   - a value outside the closed enum returns `null` → caller emits a
+//     diagnostic and OMITS the field. NEVER passthrough of the raw value.
+//   - a gradient transform is 6 finite floats, each clamped to a bounded
+//     range. A malformed transform returns `null` → omitted, never a free
+//     string interpolated into SVG.
+//
+// None of these helpers throws, logs, or echoes the offending value — the
+// caller attaches a static reason to a diagnostic (Bastion R9).
+
+import type { LSMLBlendMode, LSMLObjectFit, LSMLGradientTransform } from "./lsml-types.js";
+
+/** Closed `mix-blend-mode` allowlist (ADR 002 §3.2 — Figma minus
+ *  `PASS_THROUGH`). The single source of truth for the compiler. */
+export const BLEND_MODES: ReadonlySet<LSMLBlendMode> = new Set([
+  "normal",
+  "multiply",
+  "screen",
+  "overlay",
+  "darken",
+  "lighten",
+  "color-dodge",
+  "color-burn",
+  "hard-light",
+  "soft-light",
+  "difference",
+  "exclusion",
+  "hue",
+  "saturation",
+  "color",
+  "luminosity",
+]);
+
+/** Closed `object-fit` allowlist (ADR 002 §3.2). */
+export const OBJECT_FITS: ReadonlySet<LSMLObjectFit> = new Set([
+  "cover",
+  "contain",
+  "fill",
+  "none",
+  "scale-down",
+]);
+
+/** Closed `mask.type` allowlist. */
+export const MASK_TYPES: ReadonlySet<string> = new Set(["alpha", "luminance"]);
+
+/** Closed `mask.op` allowlist. */
+export const MASK_OPS: ReadonlySet<string> = new Set(["intersect", "subtract", "union"]);
+
+/**
+ * Validate a `blendMode` against the closed enum. Returns the value when it
+ * is a recognised mode, else `null` (caller omits + diagnoses). Never
+ * passthrough.
+ */
+export function parseBlendMode(value: unknown): LSMLBlendMode | null {
+  return typeof value === "string" && BLEND_MODES.has(value as LSMLBlendMode)
+    ? (value as LSMLBlendMode)
+    : null;
+}
+
+/**
+ * Validate an `objectFit` against the closed enum. Returns the value or
+ * `null` (caller omits + diagnoses). Never passthrough.
+ */
+export function parseObjectFit(value: unknown): LSMLObjectFit | null {
+  return typeof value === "string" && OBJECT_FITS.has(value as LSMLObjectFit)
+    ? (value as LSMLObjectFit)
+    : null;
+}
+
+/** Bound on each affine component (anti-DoS ; a gradient transform is purely
+ *  cosmetic, no legitimate value approaches this). Mirrors the spirit of the
+ *  filter caps : finite and bounded, never a free string. */
+export const MAX_GRADIENT_TRANSFORM_ABS = 1e6;
+
+/**
+ * Validate + clamp a gradient `transform` to 6 finite, bounded floats. The
+ * input must be an array of exactly 6 numbers ; each non-finite or
+ * out-of-range component fails the whole transform (returns `null` → omit,
+ * fall back to `angle_deg`). Components within range are clamped to
+ * `[-MAX_GRADIENT_TRANSFORM_ABS, +MAX_GRADIENT_TRANSFORM_ABS]`. A `-0`
+ * normalises to `0`. NEVER returns a string ; SVG `gradientTransform` is
+ * built numerically by the runtime (#D), never interpolated from author text.
+ */
+export function clampGradientTransform(value: unknown): LSMLGradientTransform | null {
+  if (!Array.isArray(value) || value.length !== 6) return null;
+  const out = new Array<number>(6);
+  for (let i = 0; i < 6; i++) {
+    const c = value[i];
+    if (typeof c !== "number" || !Number.isFinite(c)) return null;
+    let clamped = c;
+    if (clamped > MAX_GRADIENT_TRANSFORM_ABS) clamped = MAX_GRADIENT_TRANSFORM_ABS;
+    else if (clamped < -MAX_GRADIENT_TRANSFORM_ABS) clamped = -MAX_GRADIENT_TRANSFORM_ABS;
+    out[i] = Object.is(clamped, -0) ? 0 : clamped;
+  }
+  return out as LSMLGradientTransform;
+}

package/src/lsml-types.ts

@@ -9,6 +9,69 @@
 //   - Multi-fill `fills[]` on `shape` (§4.6 + §4.12)
 //   - Stacked `backgrounds[]` on `frame` (§4.3)
 //   - Bundle-level `$schema`, `profiles[]` (§17.3)
+//
+// 1.2 additions (additive over 1.1 — a 1.1 bundle stays valid ; ADR 002 §3.2) :
+//   - `blendMode` on every primitive (closed enum → CSS `mix-blend-mode`)
+//   - `mask` on every primitive (typed fields, never a free SVG string)
+//   - first-class image-fill variant on `LSMLFill` (`{ kind: "image"; … }`)
+//     with a closed `objectFit` enum
+//   - gradient `transform` (6 finite, bounded floats — never a free string)
+
+/** 1.2+ — CSS `mix-blend-mode` value, restricted to the closed set faithful
+ *  to Figma minus `PASS_THROUGH` (ADR 002 §3.2 ; Bastion T4). A value outside
+ *  this set is a diagnostic + omission at the compiler, never passthrough. */
+export type LSMLBlendMode =
+  | "normal"
+  | "multiply"
+  | "screen"
+  | "overlay"
+  | "darken"
+  | "lighten"
+  | "color-dodge"
+  | "color-burn"
+  | "hard-light"
+  | "soft-light"
+  | "difference"
+  | "exclusion"
+  | "hue"
+  | "saturation"
+  | "color"
+  | "luminosity"
+  | "plus-lighter";
+
+/** 1.2+ — how an image-fill / image source is fitted into its box
+ *  (closed enum → CSS `object-fit` ; ADR 002 §3.2 ; Bastion T4). */
+export type LSMLObjectFit = "cover" | "contain" | "fill" | "none" | "scale-down";
+
+/** 1.2+ — masking model (LSML §4.x, ADR 002 §3.2). A node carries a typed
+ *  `mask` whose fields are ALL typed — there is deliberately NO free-form SVG
+ *  string anywhere in this shape (Bastion T3 : the runtime builds `<mask>` /
+ *  `<clipPath>` from these fields, never from author markup). */
+export interface LSMLMask {
+  /** What provides the mask coverage. A reference to a sibling shape (by id),
+   *  an image asset URL, or a reference to a sibling GROUP/FRAME container (by
+   *  id) whose visible children's geometry is composited (ADR 002 A4.3). A
+   *  `kind: "image"` source is re-gated by the host/scheme allowlist (T1/T2)
+   *  before it reaches the DOM. */
+  source:
+    | { kind: "shape"; ref: string }
+    | { kind: "image"; src: string }
+    | { kind: "group"; ref: string };
+  /** Whether the mask reads the source's alpha channel or its luminance. */
+  type: "alpha" | "luminance";
+  /** Boolean composition op against the masked content. */
+  op: "intersect" | "subtract" | "union";
+  /** Optional placement of the mask source within the masked box. */
+  position?: { x: number; y: number };
+  /** Optional explicit size of the mask source. */
+  size?: { w: number; h: number };
+}
+
+/** 1.2+ — a gradient `transform` : the 6 floats of an affine 2×3 matrix
+ *  `[a, b, c, d, e, f]` (ADR 002 §3.2 ; Bastion T4). Carried as typed
+ *  numbers, never a free string ; the compiler clamps each component to a
+ *  finite, bounded value before it reaches `gradientTransform` SVG. */
+export type LSMLGradientTransform = [number, number, number, number, number, number];
 
 export type LSMLPrimitiveKind =
   | "stack"
@@ -38,16 +101,46 @@ export interface LSMLFillStop {
 }
 
 /** 1.1+ — Fill union used by `shape.fills[]` and `frame.backgrounds[]`
- *  (LSML §4.12). Discriminated on `kind`. */
+ *  (LSML §4.12). Discriminated on `kind`.
+ *
+ *  1.2+ (#L) — each variant may carry an optional `blendMode` (the closed
+ *  `LSMLBlendMode` enum, no new value introduced) applied as a per-fill-layer
+ *  `mix-blend-mode`, independent of the node-level blend (`LSMLBaseNode.
+ *  blendMode`, #D). Absent = `normal` (rétro-compat : a pre-#L bundle is
+ *  unchanged). Re-validated against the closed enum by both the compiler and
+ *  the runtime (T4 double-gate) ; out-of-enum → omission, never passthrough. */
 export type LSMLFill =
-  | { kind: "solid"; color: string; opacity?: number }
-  | { kind: "linear-gradient"; angle_deg?: number; stops: LSMLFillStop[]; opacity?: number }
+  | { kind: "solid"; color: string; opacity?: number; blendMode?: LSMLBlendMode }
+  | {
+      kind: "linear-gradient";
+      angle_deg?: number;
+      /** 1.2+ — full affine gradient transform (6 floats). When present it
+       *  supersedes `angle_deg` (ADR 002 §3.2). */
+      transform?: LSMLGradientTransform;
+      stops: LSMLFillStop[];
+      opacity?: number;
+      blendMode?: LSMLBlendMode;
+    }
   | {
       kind: "radial-gradient";
       center?: { x: number; y: number };
       radius?: number;
+      /** 1.2+ — full affine gradient transform (6 floats). */
+      transform?: LSMLGradientTransform;
       stops: LSMLFillStop[];
       opacity?: number;
+      blendMode?: LSMLBlendMode;
+    }
+  | {
+      /** 1.2+ — first-class image-fill (ADR 002 §3.2). Unifies the frame
+       *  image-background and unblocks the shape image-fill that 1.1 dropped.
+       *  `src` is host/scheme-allowlist-gated (T1/T2) before the DOM. */
+      kind: "image";
+      src: string;
+      objectFit?: LSMLObjectFit;
+      opacity?: number;
+      transform?: LSMLGradientTransform;
+      blendMode?: LSMLBlendMode;
     };
 
 /** 1.1+ — one stacked stroke layer (LSML §4.6). */
@@ -147,10 +240,32 @@ export interface LSMLBaseNode {
   opacity?: number;
   /** 1.1+ — rotation in degrees (LSML §5.4). Defaults to 0. */
   rotation?: number;
+  /** Mirror the node vertically (`scaleY(-1)`) — from a negative Figma
+   *  transform determinant. Composed with `rotation` at render. */
+  flipY?: boolean;
+  /** Figma LAYER_BLUR radius (px) → CSS `filter: blur()`. */
+  blur?: number;
+  /** Figma DROP_SHADOW / INNER_SHADOW → CSS `box-shadow` / `filter: drop-shadow`.
+   *  Each layer is `{ inset?, color, x, y, blur, spread }` (colour strict-parsed
+   *  runtime-side, RC#11). The picto square's depth halo + orange/red inner rim. */
+  shadow?: Array<{
+    inset?: boolean;
+    color: string;
+    x: number;
+    y: number;
+    blur: number;
+    spread: number;
+  }>;
   /** 1.1+ — per-axis sizing mode (LSML §5.4). */
   sizing?: { x?: "fixed" | "hug" | "fill"; y?: "fixed" | "hug" | "fill" };
   /** 1.1+ — universal position relative to parent (LSML §5.4). */
   position?: { x: number; y: number };
+  /** 1.2+ — CSS `mix-blend-mode` (closed enum ; ADR 002 §3.2). A value
+   *  outside `LSMLBlendMode` is a diagnostic + omission, never passthrough. */
+  blendMode?: LSMLBlendMode;
+  /** 1.2+ — typed mask spec (ADR 002 §3.2). Built into `<mask>`/`<clipPath>`
+   *  by the runtime from typed fields — never from author SVG markup. */
+  mask?: LSMLMask;
   /** Open-ended authoring metadata (LSML §17.4). Runtime ignores. */
   metadata?: Record<string, unknown>;
 }
@@ -186,6 +301,9 @@ export interface LSMLFrame extends LSMLBaseNode {
    *  default is `true` ; the default is runtime-side, the compiler only
    *  forwards an explicit value. */
   clipsContent?: boolean;
+  /** Figma `cornerRadius` (px) → canonical RenderNode `radius` (border-radius).
+   *  The rounded picto square (r=111). */
+  cornerRadius?: number;
 }
 
 export interface LSMLText extends LSMLBaseNode {
@@ -290,7 +408,7 @@ export interface LSMLOperatorInput {
 }
 
 export interface LSMLBundle {
-  lsml: "1.0" | "1.1";
+  lsml: "1.0" | "1.1" | "1.2";
   /** 1.1+ — informational schema URL for editor autocomplete (LSML §18.4). */
   $schema?: string;
   scene_id: string;