@lumencast/runtime 0.6.0 → 0.8.0

package/dist/render/mask.js

@@ -0,0 +1,243 @@
+import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { checkHostAllowed } from "@lumencast/protocol";
+import { emitDiagnostic } from "./diagnostics";
+/** Closed `mask.type` allowlist — runtime half of the double-gate (T4).
+ *  Mirrors `@lumencast/compiler` `MASK_TYPES` ; kept local so the runtime
+ *  has no compile-time dependency on the compiler package. */
+const MASK_TYPES = new Set(["alpha", "luminance"]);
+/** Feather pad (px). The group/shape mask wrapper's `overflow:hidden` box is
+ *  grown by this on every side (tree.tsx, `inset:-PAD`) and the coverage is
+ *  shifted back by the same amount (buildMask) so a BLURRED mask rim isn't
+ *  re-cut into a hard square at the box edge. Generous enough for the
+ *  bg-texture ellipse's ~3σ (53.88 CSS sigma) feather. Sharp masks are
+ *  unaffected (their alpha-0 region simply sits inside the grown box). */
+export const MASK_FEATHER_PAD = 180;
+/** Closed `mask.op` allowlist — runtime half of the double-gate (T4). */
+const MASK_OPS = new Set(["intersect", "subtract", "union"]);
+let maskIdSeq = 0;
+function nextMaskId() {
+    maskIdSeq = (maskIdSeq + 1) % 1_000_000;
+    return `lumen-mask-${maskIdSeq.toString(36)}`;
+}
+/** Sanitise a shape `ref` to a safe SVG id token. A legitimate ref is a
+ *  compiler-assigned node id (`[A-Za-z0-9_:-]`). Anything carrying markup
+ *  characters (`<`, `"`, `#`, whitespace, `(`) is rejected — it can only be
+ *  an injection attempt, and there is no legitimate id that needs them. */
+function safeIdRef(ref) {
+    return /^[A-Za-z0-9_:-]+$/.test(ref) ? ref : null;
+}
+function finite(v) {
+    return typeof v === "number" && Number.isFinite(v);
+}
+/**
+ * Validate a loose `mask` value into a strict {@link MaskSpec}, or `null`.
+ * Re-runs the closed-enum gates (T4) and the source-shape discriminant ;
+ * a malformed mask is dropped whole (it cannot be partially honoured).
+ */
+export function parseMaskSpec(value, nodeId) {
+    if (typeof value !== "object" || value === null)
+        return null;
+    const m = value;
+    if (typeof m.type !== "string" || !MASK_TYPES.has(m.type)) {
+        emitDiagnostic(nodeId, "mask.type", "is not alpha|luminance ; mask omitted (ADR 002 §3.2, T4)");
+        return null;
+    }
+    if (typeof m.op !== "string" || !MASK_OPS.has(m.op)) {
+        emitDiagnostic(nodeId, "mask.op", "is not intersect|subtract|union ; mask omitted (ADR 002 §3.2, T4)");
+        return null;
+    }
+    const src = m.source;
+    if (typeof src !== "object" || src === null) {
+        emitDiagnostic(nodeId, "mask.source", "is not a typed shape|image source ; mask omitted (T3)");
+        return null;
+    }
+    const s = src;
+    let source;
+    if (s.kind === "shape" && typeof s.ref === "string") {
+        source = { kind: "shape", ref: s.ref };
+    }
+    else if (s.kind === "image" && typeof s.src === "string") {
+        // Preserve the mask source's box (`srcRect`: offset from THIS node + size)
+        // when present — it places/sizes the CSS mask to the source raster, shared
+        // across siblings of different boxes (the caramel halo + drift fix).
+        const sr = s.srcRect;
+        source =
+            sr && finite(sr.x) && finite(sr.y) && finite(sr.w) && finite(sr.h)
+                ? { kind: "image", src: s.src, srcRect: { x: sr.x, y: sr.y, w: sr.w, h: sr.h } }
+                : { kind: "image", src: s.src };
+    }
+    else if (s.kind === "group" && typeof s.ref === "string") {
+        source = { kind: "group", ref: s.ref };
+    }
+    else {
+        emitDiagnostic(nodeId, "mask.source", "is not a typed shape|image|group source ; mask omitted (T3)");
+        return null;
+    }
+    const spec = { source, type: m.type, op: m.op };
+    const pos = m.position;
+    if (pos && finite(pos.x) && finite(pos.y))
+        spec.position = { x: pos.x, y: pos.y };
+    const size = m.size;
+    if (size && finite(size.w) && finite(size.h))
+        spec.size = { w: size.w, h: size.h };
+    return spec;
+}
+/**
+ * Build a `<mask>` element + the CSS reference from a typed mask spec.
+ * Returns `null` when the mask must be omitted (bad enum, rejected host,
+ * unsafe ref) — the caller renders the subtree unmasked.
+ *
+ * @param mask          the typed spec (already enum-checked by parseMaskSpec,
+ *                      but re-checked here so the builder is safe standalone).
+ * @param allowedHosts  the bundle's `assets.allowedHosts` ; an image source is
+ *                      gated against it (T1/T2) before reaching `<image href>`.
+ * @param nodeId        for diagnostics (never carries a value, R9).
+ * @param resolveShape  resolves a shape `mask.source.ref` to its inlined
+ *                      coverage geometry (#K). Omitted / returns `null` ⇒ the
+ *                      shape source is pending → the whole mask is omitted.
+ */
+export function buildMask(mask, allowedHosts, nodeId, resolveShape, boxSize, feather = false) {
+    // T4 — defence in depth : re-validate the enums even though parseMaskSpec
+    // already did, so `buildMask` is safe to call on any typed input.
+    if (!MASK_TYPES.has(mask.type) || !MASK_OPS.has(mask.op)) {
+        emitDiagnostic(nodeId, "mask", "type/op outside the closed enum ; mask omitted (T4)");
+        return null;
+    }
+    const id = nextMaskId();
+    // The mask content : a single element painted into the mask's luminance
+    // (or alpha) channel. Coordinates come from typed numbers only.
+    const x = mask.position?.x;
+    const y = mask.position?.y;
+    const w = mask.size?.w;
+    const h = mask.size?.h;
+    const geom = {
+        ...(finite(x) ? { x } : {}),
+        ...(finite(y) ? { y } : {}),
+        ...(finite(w) ? { width: w } : {}),
+        ...(finite(h) ? { height: h } : {}),
+    };
+    let content;
+    if (mask.source.kind === "image") {
+        // T1/T2 — gate the URL BEFORE it reaches the `<image href>`. A rejected
+        // host/scheme omits the whole mask with a static-reason diagnostic.
+        const decision = checkHostAllowed(mask.source.src, allowedHosts);
+        if (!decision.allowed) {
+            emitDiagnostic(nodeId, "mask.source.src", `image host/scheme rejected ; mask omitted (T1/T2 — ${decision.reason ?? "denied"})`);
+            return null;
+        }
+        // `href` is a typed attribute on a constructed element — never markup.
+        // For an alpha mask, read the source's own alpha (mask-type:alpha on the
+        // <mask>) ; luminance is the SVG default. The image fills the masked box
+        // when no explicit geometry is given.
+        // External <image> in an SVG <mask> (0×0 SVG) never loads. For `intersect`
+        // apply the raster directly as a CSS mask-image. The masked image content is
+        // drawn with `object-fit: cover` (Figma scaleMode FILL), so the mask raster
+        // — the SAME source image — must `cover` too, else a `Wpx Hpx` (stretch)
+        // mask clips a differently-scaled crop and the caramel ribbon shrinks /
+        // shifts off its wave. `cover` keeps the alpha aligned with the content.
+        if (mask.op === "intersect") {
+            const mode = mask.type === "alpha" ? "alpha" : "luminance";
+            const url = `url("${mask.source.src}")`;
+            // Place + size the mask to the SOURCE raster's box (`srcRect`: offset from
+            // this node's box top-left + size), shared by every masked sibling — NOT
+            // `cover` of each sibling's box (inflates → orange halo) nor centred
+            // (drifts → mask pulled down). The caramel gradient (1146) and 3d-render
+            // (930) thus clip to the SAME wave at the SAME spot.
+            const rect = mask.source
+                .srcRect;
+            const usable = rect && finite(rect.x) && finite(rect.y) && finite(rect.w) && finite(rect.h);
+            const sizeCss = usable ? `${rect.w}px ${rect.h}px` : "cover";
+            const posCss = usable ? `${rect.x}px ${rect.y}px` : "center";
+            return {
+                def: _jsx("defs", {}, id),
+                style: {
+                    maskImage: url,
+                    WebkitMaskImage: url,
+                    maskSize: sizeCss,
+                    WebkitMaskSize: sizeCss,
+                    maskRepeat: "no-repeat",
+                    WebkitMaskRepeat: "no-repeat",
+                    maskPosition: posCss,
+                    WebkitMaskPosition: posCss,
+                    maskMode: mode,
+                },
+                id,
+                feather: false,
+            };
+        }
+        const imgGeom = Object.keys(geom).length > 0
+            ? geom
+            : finite(boxSize?.w) && finite(boxSize?.h)
+                ? { x: 0, y: 0, width: boxSize.w, height: boxSize.h }
+                : { width: "100%", height: "100%" };
+        content = _jsx("image", { href: mask.source.src, preserveAspectRatio: "none", ...imgGeom });
+    }
+    else {
+        // Shape (#K) or group/frame (#O) source — INLINE the referenced node's
+        // resolved coverage geometry into the `<mask>`, built element-by-element
+        // (T3 : zero markup). For a `shape` the resolver returns its own outline ;
+        // for a `group` it returns the composite of the container's visible
+        // children (the resolver routes on the referenced node's kind).
+        //
+        // The ref is first re-sanitised (defence in depth : a live LSDP delta could
+        // smuggle markup chars), then resolved against the Tree's referenceable-node
+        // index. A PENDING ref (id absent) → the mask is omitted, sub-tree rendered
+        // unmasked (A2.1 : omission, not crash). Anti-cycle is enforced by the
+        // resolver inlining ONLY geometry — never any node's own mask.
+        const safeRef = safeIdRef(mask.source.ref);
+        if (safeRef === null) {
+            emitDiagnostic(nodeId, "mask.source.ref", "shape ref is not a safe id token ; mask omitted (T3)");
+            return null;
+        }
+        const resolved = resolveShape?.(safeRef) ?? null;
+        if (resolved === null) {
+            emitDiagnostic(nodeId, "mask.source.ref", "shape ref does not resolve to an indexed shape ; mask omitted (ADR 002 A2.1 #K)");
+            return null;
+        }
+        // Position/size place the inlined geometry numerically when given,
+        // wrapping it in a translated group (typed numbers only, never a string).
+        content =
+            Object.keys(geom).length > 0 ? (_jsx("g", { transform: finite(geom.x) || finite(geom.y)
+                    ? `translate(${finite(geom.x) ? geom.x : 0} ${finite(geom.y) ? geom.y : 0})`
+                    : undefined, children: resolved })) : (resolved);
+    }
+    // Feather pad : the mask wrapper's box is grown by MASK_FEATHER_PAD on every
+    // side (tree.tsx, `inset:-PAD`) so a BLURRED coverage edge isn't re-cut into a
+    // hard square by the wrapper's `overflow:hidden`. The coverage is shifted back
+    // by the SAME amount here (userSpaceOnUse), so the mask stays put while the box
+    // grows. A sharp mask is unaffected (its alpha-0 region just sits inside the
+    // grown box). Applied to the coverage only — never the full-coverage union/
+    // subtract rect, which must keep spanning the whole (grown) box.
+    if (feather) {
+        content = (_jsx("g", { transform: `translate(${MASK_FEATHER_PAD} ${MASK_FEATHER_PAD})`, children: content }, "feather-pad"));
+    }
+    // `union` widens coverage : a base full-coverage white rect is unioned with
+    // the source paint. `subtract` removes the source area from full coverage by
+    // painting the source black over a white base. `intersect` (default) keeps
+    // only the source's own coverage. All three are expressed by which fixed
+    // elements we emit — never by interpolating an author string.
+    let inner;
+    if (mask.op === "intersect") {
+        inner = content;
+    }
+    else if (mask.op === "union") {
+        inner = (_jsxs(_Fragment, { children: [_jsx("rect", { x: 0, y: 0, width: "100%", height: "100%", fill: "white" }), content] }));
+    }
+    else {
+        // subtract : white base, source painted black to carve it out.
+        inner = (_jsxs(_Fragment, { children: [_jsx("rect", { x: 0, y: 0, width: "100%", height: "100%", fill: "white" }), _jsx("g", { style: { filter: "invert(1)" }, children: content })] }));
+    }
+    const def = (_jsx("mask", { id: id, 
+        // `maskContentUnits` (not `maskUnits`) places the coverage in the masked
+        // element's user space. The mask REGION is widened to −50%..150% of the
+        // masked box (objectBoundingBox units) so a FEATHERED coverage (the
+        // bg-texture ellipse blurred 107.76) keeps its soft rim — the default
+        // −10%..120% clipped the blur to a hard SQUARE edge. (The prior
+        // `maskUnits="userSpaceOnUse"` WITHOUT x/y/width/height shrank the region
+        // to the 0×0 defs-svg viewport, hiding every group/shape-masked subtree —
+        // the platform-wide bug ; an explicit region is the robust form.)
+        maskContentUnits: "userSpaceOnUse", x: "-50%", y: "-50%", width: "200%", height: "200%", ...(mask.type === "alpha" && mask.source.kind !== "image" ? { "mask-type": "alpha" } : {}), children: inner }, id));
+    const ref = `url(#${id})`;
+    return { def, style: { mask: ref, WebkitMask: ref }, id, feather };
+}
+//# sourceMappingURL=mask.js.map

package/dist/render/mask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mask.js","sourceRoot":"","sources":["../../src/render/mask.tsx"],"names":[],"mappings":";AA8BA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAS/C;;8DAE8D;AAC9D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;AAEnD;;;;;0EAK0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,yEAAyE;AACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;AAmC7D,IAAI,SAAS,GAAG,CAAC,CAAC;AAClB,SAAS,UAAU;IACjB,SAAS,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC;IACxC,OAAO,cAAc,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAChD,CAAC;AAED;;;2EAG2E;AAC3E,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,MAA0B;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAE3C,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,0DAA0D,CAAC,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACpD,cAAc,CACZ,MAAM,EACN,SAAS,EACT,mEAAmE,CACpE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,cAAc,CAAC,MAAM,EAAE,aAAa,EAAE,uDAAuD,CAAC,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,EAAE,GAAG,CAAC,CAAC,OAA6E,CAAC;QAC3F,MAAM;YACJ,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;gBAChE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChF,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACtC,CAAC;SAAM,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,cAAc,CACZ,MAAM,EACN,aAAa,EACb,6DAA6D,CAC9D,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAwB,EAAE,EAAE,EAAE,CAAC,CAAC,EAAoB,EAAE,CAAC;IAEhG,MAAM,GAAG,GAAG,CAAC,CAAC,QAAoD,CAAC;IACnE,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAElF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAgD,CAAC;IAChE,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;IAEnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CACvB,IAAc,EACd,YAA2C,EAC3C,MAA0B,EAC1B,YAA+B,EAC/B,OAAoC,EACpC,OAAO,GAAG,KAAK;IAEf,0EAA0E;IAC1E,kEAAkE;IAClE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACzD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,qDAAqD,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IAExB,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG;QACX,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;IAEF,IAAI,OAAqB,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QACjC,wEAAwE;QACxE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,cAAc,CACZ,MAAM,EACN,iBAAiB,EACjB,sDAAsD,QAAQ,CAAC,MAAM,IAAI,QAAQ,GAAG,CACrF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,uEAAuE;QACvE,yEAAyE;QACzE,yEAAyE;QACzE,sCAAsC;QACtC,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,yEAAyE;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAC3D,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;YACxC,2EAA2E;YAC3E,yEAAyE;YACzE,qEAAqE;YACrE,yEAAyE;YACzE,qDAAqD;YACrD,MAAM,IAAI,GAAI,IAAI,CAAC,MAAuE;iBACvF,OAAO,CAAC;YACX,MAAM,MAAM,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAK,CAAC,CAAC,MAAM,IAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAK,CAAC,CAAC,MAAM,IAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC/D,OAAO;gBACL,GAAG,EAAE,iBAAW,EAAE,CAAI;gBACtB,KAAK,EAAE;oBACL,SAAS,EAAE,GAAG;oBACd,eAAe,EAAE,GAAG;oBACpB,QAAQ,EAAE,OAAO;oBACjB,cAAc,EAAE,OAAO;oBACvB,UAAU,EAAE,WAAW;oBACvB,gBAAgB,EAAE,WAAW;oBAC7B,YAAY,EAAE,MAAM;oBACpB,kBAAkB,EAAE,MAAM;oBAC1B,QAAQ,EAAE,IAAI;iBACE;gBAClB,EAAE;gBACF,OAAO,EAAE,KAAK;aACf,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;YAC1B,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE;gBACrD,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1C,OAAO,GAAG,gBAAO,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,EAAC,MAAM,KAAK,OAAO,GAAI,CAAC;IACrF,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,oEAAoE;QACpE,gEAAgE;QAChE,EAAE;QACF,4EAA4E;QAC5E,6EAA6E;QAC7E,4EAA4E;QAC5E,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,cAAc,CACZ,MAAM,EACN,iBAAiB,EACjB,sDAAsD,CACvD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QACjD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,cAAc,CACZ,MAAM,EACN,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,mEAAmE;QACnE,0EAA0E;QAC1E,OAAO;YACL,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7B,YACE,SAAS,EACP,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;oBAC9B,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;oBAC5E,CAAC,CAAC,SAAS,YAGd,QAAQ,GACP,CACL,CAAC,CAAC,CAAC,CACF,QAAQ,CACT,CAAC;IACN,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,6EAA6E;IAC7E,4EAA4E;IAC5E,iEAAiE;IACjE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,GAAG,CACR,YAAqB,SAAS,EAAE,aAAa,gBAAgB,IAAI,gBAAgB,GAAG,YACjF,OAAO,IADH,aAAa,CAEhB,CACL,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,KAAmB,CAAC;IACxB,IAAI,IAAI,CAAC,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5B,KAAK,GAAG,OAAO,CAAC;IAClB,CAAC;SAAM,IAAI,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QAC/B,KAAK,GAAG,CACN,8BACE,eAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,GAAG,EAC3D,OAAO,IACP,CACJ,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,KAAK,GAAG,CACN,8BACE,eAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAC,MAAM,EAAC,MAAM,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,GAAG,EAC5D,YAAG,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,YAAG,OAAO,GAAK,IAC/C,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,CACV,eACE,EAAE,EAAE,EAAE;QAEN,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,0EAA0E;QAC1E,0EAA0E;QAC1E,kEAAkE;QAClE,gBAAgB,EAAC,gBAAgB,EACjC,CAAC,EAAC,MAAM,EACR,CAAC,EAAC,MAAM,EACR,KAAK,EAAC,MAAM,EACZ,MAAM,EAAC,MAAM,KAGT,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,YAE1F,KAAK,IAlBD,EAAE,CAmBF,CACR,CAAC;IAEF,MAAM,GAAG,GAAG,QAAQ,EAAE,GAAG,CAAC;IAC1B,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC"}

package/dist/render/primitives/frame.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frame.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/frame.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAM9C;;;;;;;;;;;GAWG;AACH,wBAAgB,KAAK,CAAC,EACpB,QAAQ,EACR,MAAM,EACN,aAAa,EACb,cAAc,EACd,QAAQ,GACT,EAAE,cAAc,2CA2DhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAKxE"}
+{"version":3,"file":"frame.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/frame.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAO9C;;;;;;;;;;;GAWG;AACH,wBAAgB,KAAK,CAAC,EACpB,QAAQ,EACR,MAAM,EACN,aAAa,EACb,cAAc,EACd,QAAQ,GACT,EAAE,cAAc,2CAsGhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAKxE"}

package/dist/render/primitives/frame.js

@@ -1,9 +1,10 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { motion } from "framer-motion";
 import { toFramer, mountPlay, resolveTransition } from "../../animate/transitions";
-import { backgroundsToCss, parseFills } from "../fill";
+import { backgroundsToCss, parseFills, gateImageFills } from "../fill";
 import { parseCssColor, warnRejectedColor } from "../css-color";
 import { emitDiagnostic } from "../diagnostics";
+import { useAllowedHosts } from "../allowed-hosts";
 /** Absolute-positioned container with size + transform + opacity.
  *  Animatable on `transform` and `opacity` only — width/height/position
  *  changes are intentionally *not* animatable to keep the broadcast
@@ -23,7 +24,20 @@ export function Frame({ resolved, nodeId, transitionFor, animateInitial, childre
     const height = sizeProp(resolved.height);
     const opacity = numberOr(resolved.opacity, 1);
     const scale = numberOr(resolved.scale, 1);
-    const rotate = numberOr(resolved.rotate, 0);
+    // Static `rotation` (LSML §5.4) is applied HERE, on the frame's own box, so it
+    // pivots around the frame centre (transform-origin: center). It must NOT go on
+    // the UniversalWrapper for a frame : the wrapper carries no position/size for
+    // a self-positioning frame, so it collapses to a 0-height box and the rotation
+    // pivots around the wrong point (the picto/caramel swung off-place). `rotate`
+    // (animated) still wins when present.
+    const rotate = numberOr(resolved.rotate, numberOr(resolved.rotation, 0));
+    // Mirror (Figma `scaleY(-1)`, from a negative transform determinant). Applied
+    // on the frame box like the rotation so it composes correctly.
+    const flipY = resolved.flipY === true;
+    // Compiler forwards `cornerRadius` → `radius` (compile.ts). A frame can be a
+    // rounded container (Figma pills, the rounded picto square) — apply it as
+    // `border-radius` so the frame isn't rendered square.
+    const radius = numberOr(resolved.radius, 0);
     // 1.0 single-fill prop — used as fallback when 1.1 `backgrounds[]`
     // is empty. RC#11 : the value is untrusted (static prop OR live LSDP
     // delta) and lands in inline CSS — strict-parse, never passthrough.
@@ -32,7 +46,11 @@ export function Frame({ resolved, nodeId, transitionFor, animateInitial, childre
     if (rawBackground !== undefined && legacyBackground === null) {
         warnRejectedColor("frame.background", nodeId);
     }
-    const backgrounds = parseFills(resolved.backgrounds, "frame.backgrounds", nodeId);
+    // LSML 1.2 §3.2 — image-fill `src` is host/scheme-gated (Bastion T1/T2)
+    // BEFORE any URL reaches `background-image`. A rejected image-fill is
+    // dropped (no passthrough) with an R9-clean diagnostic.
+    const allowedHosts = useAllowedHosts();
+    const backgrounds = gateImageFills(parseFills(resolved.backgrounds, "frame.backgrounds", nodeId), allowedHosts, "frame.backgrounds", nodeId);
     const clipsContent = resolveClipsContent(resolved.clipsContent, nodeId);
     // Pick the most expressive declared transition among the animated
     // bindings (transform / opacity). If none, no animation.
@@ -43,12 +61,18 @@ export function Frame({ resolved, nodeId, transitionFor, animateInitial, childre
         top: 0,
         width,
         height,
-        willChange: "transform, opacity",
+        // NB: NO permanent `will-change`. `will-change: opacity` makes the frame an
+        // isolated group (the browser pre-promotes it as if opacity < 1), which
+        // CONTAINS any descendant `mix-blend-mode` to the frame's own backdrop — so
+        // a screen/hard-light layer (Sunshine, Ruby20) silently stops compositing
+        // with the scene below. The hint also belongs only on actively-animating
+        // nodes (bind-animate adds it there) ; a static board doesn't need it.
         // LSML 1.1 §4.3 `clipsContent` (default `true`) — children outside
         // the frame's `size` are clipped. Static layout property : it never
         // animates, so it stays off the 0-layout-event hot path (ADR 001
         // §3.2.5). `false` => omit the declaration (CSS initial = visible).
         ...(clipsContent ? { overflow: "hidden" } : {}),
+        ...(radius > 0 ? { borderRadius: radius } : {}),
     };
     if (backgrounds.length > 0) {
         Object.assign(style, backgroundsToCss(backgrounds, nodeId));
@@ -56,7 +80,20 @@ export function Frame({ resolved, nodeId, transitionFor, animateInitial, childre
     else if (legacyBackground !== undefined && legacyBackground !== null) {
         style.background = legacyBackground;
     }
-    const play = mountPlay({ opacity, x, y, scale, rotate }, animateInitial, nodeId);
+    // Figma DROP_SHADOW / INNER_SHADOW. INNER → CSS `box-shadow: inset` (the
+    // square's orange/red rim, on the rotated rounded frame, rotates with it in
+    // local space — matches Figma). A no-spread DROP → CSS `filter: drop-shadow`,
+    // which casts the shadow from the element's RENDERED CONTENT silhouette, not
+    // its own rectangular box : the 5 drop shadows live on the UN-rotated wrapper
+    // GROUP, so a plain `box-shadow` would project a sharp axis-aligned 464² rect
+    // instead of the rotated (8.63°) rounded (r=111) square held inside. The
+    // colour is strict-parsed (RC#11) ; geometry is numeric.
+    const { filter: shadowFilter, boxShadow } = buildShadows(resolved.shadow, nodeId);
+    if (boxShadow !== undefined)
+        style.boxShadow = boxShadow;
+    if (shadowFilter !== undefined)
+        style.filter = shadowFilter;
+    const play = mountPlay({ opacity, x, y, scale, rotate, ...(flipY ? { scaleY: -1 } : {}) }, animateInitial, nodeId);
     return (_jsx(motion.div, { style: style, initial: play.initial, animate: play.animate, transition: toFramer(tx), children: children }));
 }
 /**
@@ -81,6 +118,55 @@ export function resolveClipsContent(v, nodeId) {
 function numberOr(v, fallback) {
     return typeof v === "number" && Number.isFinite(v) ? v : fallback;
 }
+/** Build validated shadow CSS from the node's `shadow[]` (each entry:
+ *  `{ inset?, color, x, y, blur, spread }`). Every colour goes through the
+ *  strict `parseCssColor` gate (RC#11 : the value is wire-drivable) — a
+ *  rejected colour drops that layer with a diagnostic, never reaches CSS.
+ *  Geometry values are coerced to finite numbers.
+ *
+ *  Splits by kind :
+ *   - INNER (inset) OR any shadow with a non-zero spread → `box-shadow`
+ *     (inset rim / spread halo — both follow the element's own border box,
+ *     which for the rotated rounded square IS the right silhouette).
+ *   - no-spread DROP → `filter: drop-shadow`, cast from the element's rendered
+ *     CONTENT (so a wrapper group's drop shadow tracks its rotated/rounded
+ *     child instead of the wrapper's rectangular box). drop-shadow's blur maps
+ *     to a Gaussian stdDeviation ; box-shadow uses 2×σ, so halve to match.
+ *  Returns `{}` when nothing usable survives. */
+function buildShadows(value, nodeId) {
+    if (!Array.isArray(value) || value.length === 0)
+        return {};
+    const dropParts = [];
+    const boxParts = [];
+    for (const s of value) {
+        if (typeof s !== "object" || s === null)
+            continue;
+        const spec = s;
+        const color = typeof spec.color === "string" ? parseCssColor(spec.color) : null;
+        if (color === null) {
+            warnRejectedColor("frame.shadow.color", nodeId);
+            continue;
+        }
+        const x = numberOr(spec.x, 0);
+        const y = numberOr(spec.y, 0);
+        const blur = numberOr(spec.blur, 0);
+        const spread = numberOr(spec.spread, 0);
+        const inset = spec.inset === true;
+        if (!inset && spread === 0) {
+            dropParts.push(`drop-shadow(${x}px ${y}px ${blur / 2}px ${color})`);
+        }
+        else {
+            const insetKw = inset ? "inset " : "";
+            boxParts.push(`${insetKw}${x}px ${y}px ${blur}px ${spread}px ${color}`);
+        }
+    }
+    const out = {};
+    if (dropParts.length > 0)
+        out.filter = dropParts.join(" ");
+    if (boxParts.length > 0)
+        out.boxShadow = boxParts.join(", ");
+    return out;
+}
 function sizeProp(v) {
     if (typeof v === "number" && Number.isFinite(v))
         return v;

package/dist/render/primitives/frame.js.map

@@ -1 +1 @@
-{"version":3,"file":"frame.js","sourceRoot":"","sources":["../../../src/render/primitives/frame.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,KAAK,CAAC,EACpB,QAAQ,EACR,MAAM,EACN,aAAa,EACb,cAAc,EACd,QAAQ,GACO;IACf,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC1C,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAChG,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC7D,iBAAiB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAClF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAExE,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,EAAE,GAAG,iBAAiB,CAC1B,aAAa,EACb,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EACxC,cAAc,CACf,CAAC;IAEF,MAAM,KAAK,GAAkB;QAC3B,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,CAAC;QACN,KAAK;QACL,MAAM;QACN,UAAU,EAAE,oBAAoB;QAChC,mEAAmE;QACnE,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACvE,KAAK,CAAC,UAAU,GAAG,gBAAgB,CAAC;IACtC,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAEjF,OAAO,CACL,KAAC,MAAM,CAAC,GAAG,IACT,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,YAEvB,QAAQ,GACE,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,MAAe;IAC7D,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,cAAc,CAAC,MAAM,EAAE,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAgB;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"frame.js","sourceRoot":"","sources":["../../../src/render/primitives/frame.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAGvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,KAAK,CAAC,EACpB,QAAQ,EACR,MAAM,EACN,aAAa,EACb,cAAc,EACd,QAAQ,GACO;IACf,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1C,+EAA+E;IAC/E,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E,8EAA8E;IAC9E,sCAAsC;IACtC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,8EAA8E;IAC9E,+DAA+D;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC;IACtC,6EAA6E;IAC7E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE5C,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC1C,MAAM,gBAAgB,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;IAChG,IAAI,aAAa,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC7D,iBAAiB,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,wEAAwE;IACxE,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,CAChC,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,EAAE,MAAM,CAAC,EAC7D,YAAY,EACZ,mBAAmB,EACnB,MAAM,CACP,CAAC;IACF,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAExE,kEAAkE;IAClE,yDAAyD;IACzD,MAAM,EAAE,GAAG,iBAAiB,CAC1B,aAAa,EACb,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,EACxC,cAAc,CACf,CAAC;IAEF,MAAM,KAAK,GAAkB;QAC3B,QAAQ,EAAE,UAAU;QACpB,IAAI,EAAE,CAAC;QACP,GAAG,EAAE,CAAC;QACN,KAAK;QACL,MAAM;QACN,4EAA4E;QAC5E,wEAAwE;QACxE,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACvE,KAAK,CAAC,UAAU,GAAG,gBAAgB,CAAC;IACtC,CAAC;IACD,yEAAyE;IACzE,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,yEAAyE;IACzE,yDAAyD;IACzD,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClF,IAAI,SAAS,KAAK,SAAS;QAAE,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IACzD,IAAI,YAAY,KAAK,SAAS;QAAE,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC;IAE5D,MAAM,IAAI,GAAG,SAAS,CACpB,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAClE,cAAc,EACd,MAAM,CACP,CAAC;IAEF,OAAO,CACL,KAAC,MAAM,CAAC,GAAG,IACT,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,YAEvB,QAAQ,GACE,CACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAU,EAAE,MAAe;IAC7D,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IACrC,cAAc,CAAC,MAAM,EAAE,oBAAoB,EAAE,gCAAgC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAgB;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;;;;iDAciD;AACjD,SAAS,YAAY,CAAC,KAAc,EAAE,MAAe;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAClD,MAAM,IAAI,GAAG,CAOZ,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,iBAAiB,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,MAAM,MAAM,KAAK,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAA4C,EAAE,CAAC;IACxD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/render/primitives/grid.d.ts

@@ -1,4 +1,4 @@
 import type { PrimitiveProps } from "./index";
 /** CSS Grid container with declared rows / cols. */
-export declare function Grid({ resolved, children }: PrimitiveProps): import("react/jsx-runtime").JSX.Element;
+export declare function Grid({ resolved, children, establishesContainingBlock }: PrimitiveProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=grid.d.ts.map

package/dist/render/primitives/grid.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grid.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/grid.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,oDAAoD;AACpD,wBAAgB,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,cAAc,2CAgB1D"}
+{"version":3,"file":"grid.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/grid.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,oDAAoD;AACpD,wBAAgB,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAE,EAAE,cAAc,2CAmBtF"}

package/dist/render/primitives/grid.js

@@ -1,6 +1,6 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 /** CSS Grid container with declared rows / cols. */
-export function Grid({ resolved, children }) {
+export function Grid({ resolved, children, establishesContainingBlock }) {
     const cols = resolved.cols ?? "1fr";
     const rows = resolved.rows ?? "auto";
     const gap = resolved.gap ?? 0;
@@ -9,6 +9,9 @@ export function Grid({ resolved, children }) {
             gridTemplateColumns: cols,
             gridTemplateRows: rows,
             gap,
+            // ADR 002 §3.1 (D1) — establish a containing block for absolutely
+            // placed children ; untouched for pure auto-layout grids (RC#2).
+            ...(establishesContainingBlock ? { position: "relative" } : {}),
         }, children: children }));
 }
 //# sourceMappingURL=grid.js.map

package/dist/render/primitives/grid.js.map

@@ -1 +1 @@
-{"version":3,"file":"grid.js","sourceRoot":"","sources":["../../../src/render/primitives/grid.tsx"],"names":[],"mappings":";AAEA,oDAAoD;AACpD,MAAM,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAkB;IACzD,MAAM,IAAI,GAAI,QAAQ,CAAC,IAAe,IAAI,KAAK,CAAC;IAChD,MAAM,IAAI,GAAI,QAAQ,CAAC,IAAe,IAAI,MAAM,CAAC;IACjD,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAmC,IAAI,CAAC,CAAC;IAC/D,OAAO,CACL,cACE,KAAK,EAAE;YACL,OAAO,EAAE,MAAM;YACf,mBAAmB,EAAE,IAAI;YACzB,gBAAgB,EAAE,IAAI;YACtB,GAAG;SACJ,YAEA,QAAQ,GACL,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"grid.js","sourceRoot":"","sources":["../../../src/render/primitives/grid.tsx"],"names":[],"mappings":";AAEA,oDAAoD;AACpD,MAAM,UAAU,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,0BAA0B,EAAkB;IACrF,MAAM,IAAI,GAAI,QAAQ,CAAC,IAAe,IAAI,KAAK,CAAC;IAChD,MAAM,IAAI,GAAI,QAAQ,CAAC,IAAe,IAAI,MAAM,CAAC;IACjD,MAAM,GAAG,GAAI,QAAQ,CAAC,GAAmC,IAAI,CAAC,CAAC;IAC/D,OAAO,CACL,cACE,KAAK,EAAE;YACL,OAAO,EAAE,MAAM;YACf,mBAAmB,EAAE,IAAI;YACzB,gBAAgB,EAAE,IAAI;YACtB,GAAG;YACH,kEAAkE;YAClE,iEAAiE;YACjE,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,YAEA,QAAQ,GACL,CACP,CAAC;AACJ,CAAC"}

package/dist/render/primitives/image.d.ts

@@ -2,6 +2,13 @@ import type { PrimitiveProps } from "./index";
 /** Image leaf. `src`, `fit` (cover/contain/fill), `position`,
  *  `opacity`. Opacity is animated when a transition is declared. When an
  *  `animate.from` is lowered onto the node, it mounts at that state and
- *  plays to its target on mount (mount-play). */
+ *  plays to its target on mount (mount-play).
+ *
+ *  Security (Bastion T1/T2, ADR 002 #F) : `src` is untrusted (static prop
+ *  OR live LSDP delta) and was placed into the DOM with NO host/scheme
+ *  check until #F (the latent 1.1 hole — `assets.allowedHosts` was declared
+ *  but never enforced). It now passes `gateSrc` BEFORE reaching the `<img>`
+ *  — a rejected host/scheme omits the image entirely (no passthrough), with
+ *  an R9-clean diagnostic. This is the runtime arm of the double-gate. */
 export declare function Image({ resolved, nodeId, transitionFor, animateInitial }: PrimitiveProps): import("react/jsx-runtime").JSX.Element | null;
 //# sourceMappingURL=image.d.ts.map

package/dist/render/primitives/image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/image.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C;;;iDAGiD;AACjD,wBAAgB,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,cAAc,kDAmCxF"}
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/image.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI9C;;;;;;;;;;0EAU0E;AAC1E,wBAAgB,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,EAAE,cAAc,kDAyCxF"}

package/dist/render/primitives/image.js

@@ -1,12 +1,21 @@
 import { jsx as _jsx } from "react/jsx-runtime";
 import { motion } from "framer-motion";
 import { toFramer, mountPlay, resolveTransition } from "../../animate/transitions";
+import { gateSrc, useAllowedHosts } from "../allowed-hosts";
 /** Image leaf. `src`, `fit` (cover/contain/fill), `position`,
  *  `opacity`. Opacity is animated when a transition is declared. When an
  *  `animate.from` is lowered onto the node, it mounts at that state and
- *  plays to its target on mount (mount-play). */
+ *  plays to its target on mount (mount-play).
+ *
+ *  Security (Bastion T1/T2, ADR 002 #F) : `src` is untrusted (static prop
+ *  OR live LSDP delta) and was placed into the DOM with NO host/scheme
+ *  check until #F (the latent 1.1 hole — `assets.allowedHosts` was declared
+ *  but never enforced). It now passes `gateSrc` BEFORE reaching the `<img>`
+ *  — a rejected host/scheme omits the image entirely (no passthrough), with
+ *  an R9-clean diagnostic. This is the runtime arm of the double-gate. */
 export function Image({ resolved, nodeId, transitionFor, animateInitial }) {
-    const src = resolved.src;
+    const allowedHosts = useAllowedHosts();
+    const src = gateSrc(resolved.src, allowedHosts, "image.src", nodeId);
     if (!src)
         return null;
     // LSML §4.5 `alt` is required and was silently unrendered until
@@ -27,7 +36,12 @@ export function Image({ resolved, nodeId, transitionFor, animateInitial }) {
             objectPosition: position,
             width,
             height,
-            willChange: "opacity, transform",
+            // NB: NO `will-change` here. Promoting the <img> to its own GPU layer
+            // hoists it out of the wrapper's paint buffer, so a `mix-blend-mode`
+            // on the wrapper (Sunshine screen, Ruby20 / caramel hard-light) blends
+            // an EMPTY box with the backdrop → the blend silently no-ops and the
+            // image's contribution (the diagonal light streaks, the warm Ruby) is
+            // lost. Static images don't need the compositor hint anyway.
         }, initial: play.initial, animate: play.animate, transition: toFramer(tx), draggable: false }));
 }
 function numberOr(v, fallback) {

package/dist/render/primitives/image.js.map

@@ -1 +1 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/render/primitives/image.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnF;;;iDAGiD;AACjD,MAAM,UAAU,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAkB;IACvF,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAyB,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,gEAAgE;IAChE,sEAAsE;IACtE,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,GAAG,GAAI,QAAQ,CAAC,GAA0B,IAAI,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAI,QAAQ,CAAC,QAA+B,IAAI,QAAQ,CAAC;IACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9C,mFAAmF;IACnF,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C,MAAM,EAAE,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAE5D,OAAO,CACL,KAAC,MAAM,CAAC,GAAG,IACT,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,KAAK,EAAE;YACL,SAAS,EAAE,GAAuC;YAClD,cAAc,EAAE,QAAQ;YACxB,KAAK;YACL,MAAM;YACN,UAAU,EAAE,oBAAoB;SACjC,EACD,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,EACxB,SAAS,EAAE,KAAK,GAChB,CACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAgB;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED;mDACmD;AACnD,SAAS,KAAK,CAAC,CAAU,EAAE,QAAgB;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/render/primitives/image.tsx"],"names":[],"mappings":";AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAE5D;;;;;;;;;;0EAU0E;AAC1E,MAAM,UAAU,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAkB;IACvF,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,gEAAgE;IAChE,sEAAsE;IACtE,MAAM,GAAG,GAAG,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,GAAG,GAAI,QAAQ,CAAC,GAA0B,IAAI,SAAS,CAAC;IAC9D,MAAM,QAAQ,GAAI,QAAQ,CAAC,QAA+B,IAAI,QAAQ,CAAC;IACvE,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAC9C,mFAAmF;IACnF,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE9C,MAAM,EAAE,GAAG,iBAAiB,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAE5D,OAAO,CACL,KAAC,MAAM,CAAC,GAAG,IACT,GAAG,EAAE,GAAG,EACR,GAAG,EAAE,GAAG,EACR,KAAK,EAAE;YACL,SAAS,EAAE,GAAuC;YAClD,cAAc,EAAE,QAAQ;YACxB,KAAK;YACL,MAAM;YACN,sEAAsE;YACtE,qEAAqE;YACrE,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,6DAA6D;SAC9D,EACD,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,OAAO,EAAE,IAAI,CAAC,OAAO,EACrB,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC,EACxB,SAAS,EAAE,KAAK,GAChB,CACH,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,EAAE,QAAgB;IAC5C,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpE,CAAC;AAED;mDACmD;AACnD,SAAS,KAAK,CAAC,CAAU,EAAE,QAAgB;IACzC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACjE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/render/primitives/index.d.ts

@@ -13,6 +13,13 @@ export interface PrimitiveProps {
      *  element mounts in this state and animates to its rendered target on
      *  mount (mount-play). `undefined` → no `initial` (no mount-play). */
     animateInitial?: Record<string, number | string>;
+    /** ADR 002 §3.1 (D1) — set by the Tree when this node has at least one
+     *  absolutely positioned child. A layout container (`stack`/`grid`)
+     *  flips to `position: relative` so its children's `left/top` resolve
+     *  against it. `frame` is already `position: absolute` (a containing
+     *  block) and ignores it ; leaf primitives have no children and ignore
+     *  it too. `false`/absent → no change (pure auto-layout, RC#2). */
+    establishesContainingBlock?: boolean;
     children?: ReactNode;
 }
 export declare const PRIMITIVES: Partial<Record<RenderKind, ComponentType<PrimitiveProps>>>;

package/dist/render/primitives/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAa5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;oEACgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IACvD;;;;0EAIsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,eAAO,MAAM,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CASjF,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAa5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC;oEACgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;IACvD;;;;0EAIsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IACjD;;;;;uEAKmE;IACnE,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,EAAE,SAAS,CAAC;CACtB;AAED,eAAO,MAAM,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC,CASjF,CAAC"}

package/dist/render/primitives/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/render/primitives/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,0DAA0D;AAK1D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAoBtC,MAAM,CAAC,MAAM,UAAU,GAA+D;IACpF,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,QAAQ,EAAE,QAAQ;CACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/render/primitives/index.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,0DAA0D;AAK1D,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AA2BtC,MAAM,CAAC,MAAM,UAAU,GAA+D;IACpF,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,IAAI;IACV,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,KAAK;IACZ,QAAQ,EAAE,QAAQ;CACnB,CAAC"}

package/dist/render/primitives/media.d.ts

@@ -1,6 +1,15 @@
 import type { PrimitiveProps } from "./index";
 /** Embedded video. `src`, `loop`, `mute`, `autoplay`. Audio is muted
  *  by default — broadcast audio is Pulsar-side, not from the browser
- *  source. */
-export declare function Media({ resolved }: PrimitiveProps): import("react/jsx-runtime").JSX.Element | null;
+ *  source.
+ *
+ *  Security (Bastion, ADR 003) : `src` is the media primitive's sole
+ *  network sink (no `poster` / `<source>` / `<track>` are rendered). Like
+ *  every other asset leaf (image / image-fill / mask) it MUST pass
+ *  `gateSrc` BEFORE reaching the `<video>` — otherwise a `kind:"media"`
+ *  node would make the headless Chromium of `zabrender` emit an
+ *  off-allowlist request (an SSRF surface). A rejected host/scheme omits
+ *  the source entirely (no passthrough), with an R9-clean diagnostic
+ *  ({ nodeId, field, reason } — never the URL). */
+export declare function Media({ resolved, nodeId }: PrimitiveProps): import("react/jsx-runtime").JSX.Element | null;
 //# sourceMappingURL=media.d.ts.map

package/dist/render/primitives/media.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/media.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C;;cAEc;AACd,wBAAgB,KAAK,CAAC,EAAE,QAAQ,EAAE,EAAE,cAAc,kDAsBjD"}
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/render/primitives/media.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAG9C;;;;;;;;;;;mDAWmD;AACnD,wBAAgB,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,cAAc,kDAuBzD"}

package/dist/render/primitives/media.js

@@ -1,9 +1,20 @@
 import { jsx as _jsx } from "react/jsx-runtime";
+import { gateSrc, useAllowedHosts } from "../allowed-hosts";
 /** Embedded video. `src`, `loop`, `mute`, `autoplay`. Audio is muted
  *  by default — broadcast audio is Pulsar-side, not from the browser
- *  source. */
-export function Media({ resolved }) {
-    const src = resolved.src;
+ *  source.
+ *
+ *  Security (Bastion, ADR 003) : `src` is the media primitive's sole
+ *  network sink (no `poster` / `<source>` / `<track>` are rendered). Like
+ *  every other asset leaf (image / image-fill / mask) it MUST pass
+ *  `gateSrc` BEFORE reaching the `<video>` — otherwise a `kind:"media"`
+ *  node would make the headless Chromium of `zabrender` emit an
+ *  off-allowlist request (an SSRF surface). A rejected host/scheme omits
+ *  the source entirely (no passthrough), with an R9-clean diagnostic
+ *  ({ nodeId, field, reason } — never the URL). */
+export function Media({ resolved, nodeId }) {
+    const allowedHosts = useAllowedHosts();
+    const src = gateSrc(resolved.src, allowedHosts, "media.src", nodeId);
     if (!src)
         return null;
     const loop = resolved.loop ?? true;