feat(wysiwyg): 레이어/속성 패널 및 Export(절대배치) 1차 TDD/구현

- LayersPanel: 순서 변경/잠금/숨김 토글
- PropsPanel: 위치/크기/회전 및 이미지 src/alt 편집
- exportFrame: frame-scale 토큰 및 오브젝트 절대배치 HTML/CSS 출력
- 테스트 추가 및 전체 그린 유지

.gitea/workflows/ci.yml

@@ -43,6 +43,33 @@ jobs:
           if-no-files-found: ignore
           retention-days: 3
 
+      - name: Ensure artifacts export folder
+        run: |
+          set -euo pipefail
+          mkdir -p ./artifacts/export
+
+      - name: Verify bundle integrity (optional)
+        run: |
+          set -euo pipefail
+          if [ -f ./artifacts/export/assets.integrity.index.json ]; then
+            echo "Found integrity index; generating verify inputs"
+            npm run verify:make-json
+            echo "Running verify CLI"
+            npm run verify:run | tee /tmp/verify_output.json
+            echo "--- verify summary (for quick view) ---"
+            node -e '
+              const fs = require("fs");
+              try {
+                const txt = fs.readFileSync("/tmp/verify_output.json", "utf-8");
+                const obj = JSON.parse(txt);
+                const s = obj.summary || {};
+                console.log(`ok=${obj.ok} total=${s.total||0} missing=${s.missing||0} integMismatch=${s.integrityMismatches||0} sizeMismatch=${s.sizeMismatches||0} bundleHashMismatch=${s.bundleHashMismatch||false}`);
+              } catch (e) { console.log("(verify summary parse skipped)"); }
+            '
+          else
+            echo "No integrity index at ./artifacts/export/assets.integrity.index.json; skipping integrity verification"
+          fi
+
       - name: Auto-merge PR on green
         if: ${{ github.event_name == 'pull_request' }}
         env:

MAIN_PLAN.md

@@ -361,7 +361,7 @@
 - [ci] auto pipeline 최종 재검증 최종 ping (2025-11-14 22:26:59)
 
 
-## Export ZIP 무결성 강화(Option2) 진행 현황
+### Export ZIP 무결성 강화(Option2) 진행 현황
 
 ### 목표
 - Export ZIP 무결성 강화: 자산 무결성 지표와 번들 검증 체계 구축
@@ -382,6 +382,14 @@
 - Export Options(폰트 프리커넥트/프리로드, 이미지 로딩/디코딩, robots 메타) UI/문서화
 - 브랜치 푸쉬 완료: `feat/export-bundle-integrity`
  - 이미지 최적화 옵션(1차): `fetchpriority`/`srcset`/`sizes` 추가 및 테스트 그린
+ - 이미지 최적화 옵션(2차): `imageAutoSizes`(srcset만 있을 때 기본 sizes 자동 적용)
+ - 이미지 최적화 옵션(3차): `imageSizesPreset`(mobile-first/desktop-fixed) + 우선순위(imageSizes > preset > auto > none)
+ - 브랜치/PR: `feat/image-optimization` 푸쉬 완료
+ - verifyIntegrity CLI 래퍼(TDD) 추가: `lib/exporter/verify.cli.ts` + 테스트
+ - 폴더 기반 직렬화 유틸(TDD) 추가: `lib/exporter/verify.serialize.ts` + 테스트
+ - CI 통합(권장 플로우): `.gitea/workflows/ci.yml`에 `./artifacts/export` 존재 시 검증 스텝 자동 실행
+ - 스크립트: `scripts/make-verify-json.js`, `scripts/verify.js` + `npm run verify:make-json`/`verify:run`
+ - 브랜치/PR: `feat/verify-integrity-cli` 푸쉬 완료
 
 ### 하드닝
 - ZIP 경로 가드: `../`, 절대경로(`/`), 역슬래시(`\`) 차단 (테스트 포함)
@@ -397,11 +405,16 @@
 - Node/브라우저 호환 btoa/atob 제거, 안전한 변환 로직 적용
 
 ### 다음 작업
-1) PR 생성(템플릿/라벨): `feat/export-bundle-integrity` → `main`
-2) CI 무결성 검증 스텝 추가: `verifyIntegrity`로 빌드 산출물 검사(요약 리포트 로깅)
-3) PR 라벨 자동화 및 조건부 머지(Gitea Actions/웹훅)
-4) README에 사용 가이드 보완(verifyIntegrity 활용 예시)
-5) 이미지 최적화 2차: `sizes` 기본 정책 프리셋 및 변환 파이프라인(AVIF/WebP) 설계 초안(TDD 스텁)
+1) PR 생성/머지 순서 관리: `feat/image-optimization`, `feat/verify-integrity-cli` → main
+2) CI 검증 리포트 형식 보강: 요약 필드(total/missing/...)를 워크플로 로그에 하이라이트
+3) PR 라벨 자동화 및 조건부 머지(Gitea Actions/웹훅) 유지
+4) 변환 파이프라인(AVIF/WebP) 설계 초안(TDD 스텁)
+5) README/개발자 가이드에 `./artifacts/export` 폴더 정책 명시(로컬/CI 공통)
+
+### 산출물 경로 정책(CI)
+- 기본 폴더: `./artifacts/export/` (ZIP 해제 또는 직접 생성)
+- 검증 입력: `npm run verify:make-json` → `./artifacts/extras.json`/`./artifacts/assets.json`
+- 검증 실행: `npm run verify:run` (종료코드 0/1/2)
 
 ### CI/CD 계획(초안)
 - PR 오픈 시: 라벨 자동 지정, 테스트/빌드, 무결성 검증 스텝 실행
@@ -410,3 +423,37 @@
 ### 커밋/푸쉬 원칙
 - 기능 단위 커밋은 한국어 메시지
 - 대범위 브랜치 완료 전에 푸쉬 금지(현 단계는 완료되어 푸쉬 수행)
+
+## WYSIWYG 캔버스(드림위버 스타일) 계획
+
+### 목표
+- 컨텐츠 영역에서 오브젝트를 자유 배치(드래그/리사이즈/회전)하여 랜딩을 구성
+- 웹표준/접근성/모바일·PC 반응형을 모두 충족하는 Export 산출
+
+### 핵심 설계 원칙
+- 의미론적 HTML Export: Text→h1~h6/p, Button→a/button, Image→img/picture
+- 접근성
+  - 레이어(탭) 순서 ↔ DOM 순서 매핑, 필요 시 탭 순서 수동 설정
+  - 이미지 alt/버튼 aria-label 필수, 헤딩 레벨 강제, 키보드 포커스/스킵링크 유지
+  - 색 대비/타겟 크기 가이드 및 경고
+- 반응형
+  - 1차: 고정 비율 스케일(MVP)
+  - 2차: 브레이크포인트 재배치(선택 그룹)
+  - 3차: 유동 단위/컨테이너 쿼리, clamp 폰트 확장
+- 품질 가드: 8px 격자 + 가장자리/중심 스냅, 오버랩/가독성 경고, 역할/속성 프리셋
+
+### 기술/구현 전략
+- 모델: Frame/Layer/Object(Text/Image/Button) + 의미/접근성 필드(zod 스키마)
+- 편집: Moveable로 드래그/리사이즈/회전 + 스냅/가이드/키보드 nudge
+- Export: 오브젝트→의미론 태그 매핑, 반응형(스케일→브레이크포인트), 이미지 최적화 옵션 반영
+
+### 마일스톤
+- M1: 캔버스 조작(드/리/회+스냅) TDD → 최소 구현
+- M2: 레이어/속성 패널 TDD → UI 연결(순서/잠금/숨김, 위치/크기/회전/폰트/색/링크/이미지)
+- M3: Export(의미론+스케일) TDD → ZIP 생성 연동
+- M4: a11y/반응형 회귀 스모크 확대 + 품질 가드/경고
+
+### 진행 현황
+- 브랜치: feat/wysiwyg-canvas 생성
+- 스키마 TDD 완료: lib/wysiwyg/schema.ts(+test)
+- 다음 작업: Moveable 도입 캔버스 조작 TDD(8px 격자/가장자리 스냅/키보드 nudge)

README.md

@@ -80,6 +80,26 @@ The Builder can export a production-ready ZIP that contains:
 ### Asset paths and grouping
 
 - AssetManager writes files to `assets/` with stable hash-based filenames.
+
+### verifyIntegrity CLI
+
+- Purpose: Validate exported bundle assets against `assets.integrity.index.json`.
+- Input format: two JSON files mapping file path → base64 bytes
+  - Extras JSON: must contain `"assets.integrity.index.json"` key with base64 of the index file
+  - Assets JSON: keys are asset paths, values are base64 of file bytes
+- Usage:
+
+```bash
+node scripts/verify.js --extras extras.json --assets assets.json
+```
+
+- Output: prints a JSON with fields of `VerifyResult` (`ok`, `errors`, `summary`)
+- Exit codes:
+  - 0: ok
+  - 1: verification failed or invalid inputs
+  - 2: usage error (missing args)
+
+- CI: add a step to run the CLI after build/export; fail the job if exit code != 0.
 - Path strategy can be configured:
   - `flat` (default): `assets/<hash>.<ext>`
   - `grouped`: `assets/images/...`, `assets/fonts/...`, `assets/other/...`

components/wysiwyg/Canvas.drag.test.tsx

@@ -0,0 +1,41 @@
+import { describe, it, expect } from 'vitest'
+import { render, fireEvent } from '@testing-library/react'
+import { Canvas } from '@/components/wysiwyg/Canvas'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+function makeFrame(): Frame {
+  return {
+    id: 'f1',
+    width: 400,
+    height: 300,
+    background: '#ffffff',
+    layers: [
+      {
+        id: 'l1',
+        name: 'L1',
+        visible: true,
+        locked: false,
+        objects: [
+          { id: 'o1', type: 'image', x: 101, y: 100, width: 50, height: 40, rotate: 0, zIndex: 0, props: { src: 'x', alt: '' } },
+        ],
+      },
+    ],
+  }
+}
+
+describe('WYSIWYG Canvas mouse drag with 8px snap', () => {
+  it('dragging object snaps to nearest 8px', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<Canvas frame={frame} />)
+    const canvas = getByTestId('wysiwyg-canvas')
+    const obj = getByTestId('obj-o1')
+
+    // start drag
+    fireEvent.mouseDown(obj, { clientX: 200, clientY: 150 })
+    // move by +5,+5 (should snap from 101->104, 100->104)
+    fireEvent.mouseMove(canvas, { clientX: 205, clientY: 155 })
+    fireEvent.mouseUp(canvas)
+
+    expect(obj).toHaveStyle({ left: '104px', top: '104px' })
+  })
+})

components/wysiwyg/Canvas.nudge.test.tsx

@@ -0,0 +1,44 @@
+import { describe, it, expect } from 'vitest'
+import { render, fireEvent } from '@testing-library/react'
+import { Canvas } from '@/components/wysiwyg/Canvas'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+function makeFrame(): Frame {
+  return {
+    id: 'f1',
+    width: 400,
+    height: 300,
+    background: '#ffffff',
+    layers: [
+      {
+        id: 'l1',
+        name: 'L1',
+        visible: true,
+        locked: false,
+        objects: [
+          { id: 'o1', type: 'image', x: 101, y: 100, width: 50, height: 40, rotate: 0, zIndex: 0, props: { src: 'x', alt: '' } },
+        ],
+      },
+    ],
+  }
+}
+
+describe('WYSIWYG Canvas keyboard nudge with 8px snap', () => {
+  it('ArrowRight nudges and snaps x to nearest 8px grid', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<Canvas frame={frame} />)
+    const canvas = getByTestId('wysiwyg-canvas')
+    fireEvent.keyDown(canvas, { key: 'ArrowRight' })
+    const obj = getByTestId('obj-o1')
+    expect(obj).toHaveStyle({ left: '104px' }) // 101 + 1 => 102 -> snap8 => 104
+  })
+
+  it('ArrowUp nudges and snaps y to nearest 8px grid', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<Canvas frame={frame} />)
+    const canvas = getByTestId('wysiwyg-canvas')
+    fireEvent.keyDown(canvas, { key: 'ArrowUp' })
+    const obj = getByTestId('obj-o1')
+    expect(obj).toHaveStyle({ top: '96px' }) // 100 - 1 => 99 -> snap8 => 96
+  })
+})

components/wysiwyg/Canvas.resize.test.tsx

@@ -0,0 +1,42 @@
+import { describe, it, expect } from 'vitest'
+import { render, fireEvent } from '@testing-library/react'
+import { Canvas } from '@/components/wysiwyg/Canvas'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+function makeFrame(): Frame {
+  return {
+    id: 'f1',
+    width: 400,
+    height: 300,
+    background: '#ffffff',
+    layers: [
+      {
+        id: 'l1',
+        name: 'L1',
+        visible: true,
+        locked: false,
+        objects: [
+          { id: 'o1', type: 'image', x: 100, y: 100, width: 50, height: 40, rotate: 0, zIndex: 0, props: { src: 'x', alt: '' } },
+        ],
+      },
+    ],
+  }
+}
+
+describe('WYSIWYG Canvas resize with 8px snap', () => {
+  it('dragging bottom-right handle resizes and snaps to nearest 8px', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<Canvas frame={frame} />)
+    const handle = getByTestId('resize-handle-o1')
+    const canvas = getByTestId('wysiwyg-canvas')
+
+    // start resize
+    fireEvent.mouseDown(handle, { clientX: 150, clientY: 140 })
+    // move by +7,+9 → width 50-> 57 -> snap8 => 56, height 40->49 -> snap8 => 48
+    fireEvent.mouseMove(canvas, { clientX: 157, clientY: 149 })
+    fireEvent.mouseUp(canvas)
+
+    const obj = getByTestId('obj-o1')
+    expect(obj).toHaveStyle({ width: '56px', height: '48px' })
+  })
+})

components/wysiwyg/Canvas.rotate.test.tsx

@@ -0,0 +1,57 @@
+import { describe, it, expect } from 'vitest'
+import { render, fireEvent } from '@testing-library/react'
+import { Canvas } from '@/components/wysiwyg/Canvas'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+function makeFrame(): Frame {
+  return {
+    id: 'f1',
+    width: 400,
+    height: 300,
+    background: '#ffffff',
+    layers: [
+      {
+        id: 'l1',
+        name: 'L1',
+        visible: true,
+        locked: false,
+        objects: [
+          { id: 'o1', type: 'image', x: 100, y: 100, width: 50, height: 40, rotate: 0, zIndex: 0, props: { src: 'x', alt: '' } },
+        ],
+      },
+    ],
+  }
+}
+
+describe('WYSIWYG Canvas rotate with snap', () => {
+  it('rotates with 15deg snap by default', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<Canvas frame={frame} />)
+    const handle = getByTestId('rotate-handle-o1')
+    const canvas = getByTestId('wysiwyg-canvas')
+
+    // start rotate at 0deg
+    fireEvent.mouseDown(handle, { clientX: 100, clientY: 100 })
+    // move +16px on x → +16deg → snap15 => 15deg
+    fireEvent.mouseMove(canvas, { clientX: 116, clientY: 100 })
+    fireEvent.mouseUp(canvas)
+
+    const obj = getByTestId('obj-o1')
+    expect(obj).toHaveStyle({ transform: 'rotate(15deg)' })
+  })
+
+  it('rotates with 1deg step while holding Shift', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<Canvas frame={frame} />)
+    const handle = getByTestId('rotate-handle-o1')
+    const canvas = getByTestId('wysiwyg-canvas')
+
+    fireEvent.mouseDown(handle, { clientX: 100, clientY: 100 })
+    // move +7px with Shift → +7deg, no snap
+    fireEvent.mouseMove(canvas, { clientX: 107, clientY: 100, shiftKey: true })
+    fireEvent.mouseUp(canvas)
+
+    const obj = getByTestId('obj-o1')
+    expect(obj).toHaveStyle({ transform: 'rotate(7deg)' })
+  })
+})

components/wysiwyg/Canvas.tsx

@@ -0,0 +1,140 @@
+import React, { useCallback, useMemo, useRef, useState } from 'react'
+import type { Frame, WObject } from '@/lib/wysiwyg/schema'
+
+function snap8(v: number) {
+  return Math.round(v / 8) * 8
+}
+
+export type CanvasProps = {
+  frame: Frame
+  onChange?: (next: Frame) => void
+}
+
+export function Canvas({ frame, onChange }: CanvasProps) {
+  const [model, setModel] = useState<Frame>(frame)
+  const [selectedId, setSelectedId] = useState<string | null>(model.layers[0]?.objects[0]?.id ?? null)
+  const draggingRef = useRef<{ id: string; startX: number; startY: number; origX: number; origY: number } | null>(null)
+  const resizingRef = useRef<{ id: string; startX: number; startY: number; origW: number; origH: number } | null>(null)
+  const rotatingRef = useRef<{ id: string; startX: number; startY: number; origDeg: number } | null>(null)
+
+  const selected = useMemo(() => {
+    for (const layer of model.layers) {
+      const obj = layer.objects.find((o) => o.id === selectedId)
+      if (obj) return obj
+    }
+    return null
+  }, [model, selectedId])
+
+  const updateObject = useCallback((id: string, updater: (o: WObject) => WObject) => {
+    setModel((prev) => {
+      const next: Frame = { ...prev, layers: prev.layers.map((ly) => ({ ...ly, objects: ly.objects.map((o) => (o.id === id ? updater(o) : o)) })) }
+      onChange?.(next)
+      return next
+    })
+  }, [onChange])
+
+  const onKeyDown = useCallback((e: React.KeyboardEvent) => {
+    if (!selected) return
+    let dx = 0, dy = 0
+    if (e.key === 'ArrowLeft') dx = -1
+    else if (e.key === 'ArrowRight') dx = 1
+    else if (e.key === 'ArrowUp') dy = -1
+    else if (e.key === 'ArrowDown') dy = 1
+    else return
+    e.preventDefault()
+    updateObject(selected.id, (o) => {
+      const nx = snap8(o.x + dx)
+      const ny = snap8(o.y + dy)
+      return { ...o, x: nx, y: ny }
+    })
+  }, [selected, updateObject])
+
+  const onMouseDownObj = useCallback((e: React.MouseEvent, o: WObject) => {
+    setSelectedId(o.id)
+    draggingRef.current = { id: o.id, startX: e.clientX, startY: e.clientY, origX: o.x, origY: o.y }
+  }, [])
+
+  const onMouseMoveCanvas = useCallback((e: React.MouseEvent) => {
+    const rot = rotatingRef.current
+    if (rot) {
+      const dx = e.clientX - rot.startX
+      let next = rot.origDeg + dx
+      if (!e.shiftKey) {
+        next = Math.round(next / 15) * 15
+      }
+      updateObject(rot.id, (o) => ({ ...o, rotate: next }))
+      return
+    }
+    const r = resizingRef.current
+    if (r) {
+      const dx = e.clientX - r.startX
+      const dy = e.clientY - r.startY
+      const nw = Math.max(8, snap8(r.origW + dx))
+      const nh = Math.max(8, snap8(r.origH + dy))
+      updateObject(r.id, (o) => ({ ...o, width: nw, height: nh }))
+      return
+    }
+    const d = draggingRef.current
+    if (d) {
+      const dx = e.clientX - d.startX
+      const dy = e.clientY - d.startY
+      const nx = snap8(d.origX + dx)
+      const ny = snap8(d.origY + dy)
+      updateObject(d.id, (o) => ({ ...o, x: nx, y: ny }))
+    }
+  }, [updateObject])
+
+  const onMouseUpCanvas = useCallback(() => {
+    draggingRef.current = null
+    resizingRef.current = null
+    rotatingRef.current = null
+  }, [])
+
+  const onMouseDownResize = useCallback((e: React.MouseEvent, o: WObject) => {
+    e.stopPropagation()
+    resizingRef.current = { id: o.id, startX: e.clientX, startY: e.clientY, origW: o.width, origH: o.height }
+  }, [])
+
+  const onMouseDownRotate = useCallback((e: React.MouseEvent, o: WObject) => {
+    e.stopPropagation()
+    rotatingRef.current = { id: o.id, startX: e.clientX, startY: e.clientY, origDeg: o.rotate }
+  }, [])
+
+  return (
+    <div
+      role="application"
+      aria-label="WYSIWYG Canvas"
+      tabIndex={0}
+      onKeyDown={onKeyDown}
+      onMouseMove={onMouseMoveCanvas}
+      onMouseUp={onMouseUpCanvas}
+      style={{ position: 'relative', width: model.width, height: model.height, outline: '0' }}
+      data-testid="wysiwyg-canvas"
+    >
+      {model.layers.map((layer) => layer.visible !== false && layer.objects.map((o) => (
+        <div
+          key={o.id}
+          data-testid={`obj-${o.id}`}
+          aria-label={`object ${o.id}`}
+          onMouseDown={(e) => onMouseDownObj(e, o)}
+          style={{ position: 'absolute', left: o.x, top: o.y, width: o.width, height: o.height, transform: `rotate(${o.rotate}deg)`, outline: selectedId===o.id? '2px solid #0ea5e9':'none' }}
+        >
+          {selectedId === o.id && (
+            <div
+              data-testid={`resize-handle-${o.id}`}
+              onMouseDown={(e) => onMouseDownResize(e, o)}
+              style={{ position: 'absolute', right: 0, bottom: 0, width: 10, height: 10, background: '#0ea5e9', cursor: 'nwse-resize' }}
+            />
+          )}
+          {selectedId === o.id && (
+            <div
+              data-testid={`rotate-handle-${o.id}`}
+              onMouseDown={(e) => onMouseDownRotate(e, o)}
+              style={{ position: 'absolute', left: '50%', top: -16, width: 10, height: 10, marginLeft: -5, background: '#0ea5e9', borderRadius: 5, cursor: 'grab' }}
+            />
+          )}
+        </div>
+      )))}
+    </div>
+  )
+}

components/wysiwyg/LayersPanel.test.tsx

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi } from 'vitest'
+import { render, fireEvent } from '@testing-library/react'
+import { LayersPanel } from '@/components/wysiwyg/LayersPanel'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+function makeFrame(): Frame {
+  return {
+    id: 'f1', width: 400, height: 300, background: '#ffffff',
+    layers: [
+      { id: 'l1', name: 'Base', visible: true, locked: false, objects: [] },
+      { id: 'l2', name: 'Text', visible: true, locked: false, objects: [] },
+    ],
+  }
+}
+
+describe('LayersPanel', () => {
+  it('reorders layers with up/down buttons', () => {
+    const frame = makeFrame()
+    const onChange = vi.fn()
+    const { getByTestId, getAllByTestId } = render(<LayersPanel frame={frame} onChange={onChange} />)
+    const items = getAllByTestId('layer-item')
+    expect(items[0]).toHaveTextContent('Base')
+    expect(items[1]).toHaveTextContent('Text')
+
+    fireEvent.click(getByTestId('layer-down-l1'))
+    expect(onChange).toHaveBeenCalled()
+    const next = (onChange.mock.lastCall?.[0]) as Frame
+    expect(next.layers[0].id).toBe('l2')
+    expect(next.layers[1].id).toBe('l1')
+  })
+
+  it('toggles lock and visibility', () => {
+    const frame = makeFrame()
+    const { getByTestId } = render(<LayersPanel frame={frame} onChange={() => {}} />)
+    fireEvent.click(getByTestId('layer-lock-l2'))
+    fireEvent.click(getByTestId('layer-hide-l2'))
+    // no crash; states toggled reflected in aria-pressed
+    expect(getByTestId('layer-lock-l2')).toHaveAttribute('aria-pressed', 'true')
+    expect(getByTestId('layer-hide-l2')).toHaveAttribute('aria-pressed', 'true')
+  })
+})

components/wysiwyg/LayersPanel.tsx

@@ -0,0 +1,65 @@
+import React, { useCallback, useState } from 'react'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+export type LayersPanelProps = {
+  frame: Frame
+  onChange?: (next: Frame) => void
+}
+
+export function LayersPanel({ frame, onChange }: LayersPanelProps) {
+  const [model, setModel] = useState<Frame>(frame)
+
+  const move = useCallback((id: string, dir: 1 | -1) => {
+    const idx = model.layers.findIndex((l) => l.id === id)
+    if (idx < 0) return
+    const j = idx + dir
+    if (j < 0 || j >= model.layers.length) return
+    const nextLayers = model.layers.slice()
+    const [it] = nextLayers.splice(idx, 1)
+    nextLayers.splice(j, 0, it)
+    const next = { ...model, layers: nextLayers }
+    setModel(next)
+    onChange?.(next)
+  }, [model, onChange])
+
+  const toggle = useCallback((id: string, key: 'locked' | 'visible') => {
+    const nextLayers = model.layers.map((l) => l.id === id ? { ...l, [key]: key === 'visible' ? !l.visible : !l.locked } : l)
+    const next = { ...model, layers: nextLayers }
+    setModel(next)
+    onChange?.(next)
+  }, [model, onChange])
+
+  return (
+    <div aria-label="Layers Panel">
+      {model.layers.map((l) => (
+        <div key={l.id} data-testid="layer-item" style={{ display: 'flex', gap: 8, alignItems: 'center' }}>
+          <span>{l.name}</span>
+          <button type="button" data-testid={`layer-up-${l.id}`} onClick={() => move(l.id, -1)} aria-label={`move up ${l.name}`}>
+            ↑
+          </button>
+          <button type="button" data-testid={`layer-down-${l.id}`} onClick={() => move(l.id, 1)} aria-label={`move down ${l.name}`}>
+            ↓
+          </button>
+          <button
+            type="button"
+            data-testid={`layer-lock-${l.id}`}
+            aria-pressed={l.locked ? 'true' : 'false'}
+            onClick={() => toggle(l.id, 'locked')}
+            aria-label={`lock ${l.name}`}
+          >
+            🔒
+          </button>
+          <button
+            type="button"
+            data-testid={`layer-hide-${l.id}`}
+            aria-pressed={l.visible ? 'false' : 'true'}
+            onClick={() => toggle(l.id, 'visible')}
+            aria-label={`toggle ${l.name} visibility`}
+          >
+            👁
+          </button>
+        </div>
+      ))}
+    </div>
+  )
+}

components/wysiwyg/PropsPanel.test.tsx

@@ -0,0 +1,32 @@
+import { describe, it, expect } from 'vitest'
+import { render, fireEvent } from '@testing-library/react'
+import { PropsPanel } from '@/components/wysiwyg/PropsPanel'
+import type { WObject } from '@/lib/wysiwyg/schema'
+
+describe('PropsPanel', () => {
+  it('edits position/size/rotate numeric fields', () => {
+    const obj: WObject = { id: 'o1', type: 'image', x: 10, y: 20, width: 100, height: 80, rotate: 0, zIndex: 0, props: { src: 'a', alt: '' } }
+    const calls: WObject[] = []
+    const { getByLabelText } = render(<PropsPanel object={obj} onChange={(n: WObject) => calls.push(n)} />)
+    fireEvent.change(getByLabelText('X'), { target: { value: '12' } })
+    fireEvent.change(getByLabelText('Y'), { target: { value: '30' } })
+    fireEvent.change(getByLabelText('Width'), { target: { value: '120' } })
+    fireEvent.change(getByLabelText('Height'), { target: { value: '88' } })
+    fireEvent.change(getByLabelText('Rotate'), { target: { value: '15' } })
+    const last = calls.at(-1)!
+    expect(last.x).toBe(12)
+    expect(last.y).toBe(30)
+    expect(last.width).toBe(120)
+    expect(last.height).toBe(88)
+    expect(last.rotate).toBe(15)
+  })
+
+  it('edits image src/alt', () => {
+    const obj: WObject = { id: 'o2', type: 'image', x: 0, y: 0, width: 10, height: 10, rotate: 0, zIndex: 0, props: { src: 'x', alt: 'a' } }
+    const calls: WObject[] = []
+    const { getByLabelText } = render(<PropsPanel object={obj} onChange={(n: WObject) => calls.push(n)} />)
+    fireEvent.change(getByLabelText('Src'), { target: { value: 'https://example.com/img.jpg' } })
+    fireEvent.change(getByLabelText('Alt'), { target: { value: 'Example' } })
+    expect(calls.at(-1)?.props).toEqual({ src: 'https://example.com/img.jpg', alt: 'Example' })
+  })
+})

components/wysiwyg/PropsPanel.tsx

@@ -0,0 +1,75 @@
+import React, { useState } from 'react'
+import type { WObject } from '@/lib/wysiwyg/schema'
+
+export type PropsPanelProps = {
+  object: WObject
+  onChange?: (next: WObject) => void
+}
+
+function num(v: string, fallback: number) {
+  const n = Number(v)
+  return Number.isFinite(n) ? n : fallback
+}
+
+function isImage(o: WObject): o is Extract<WObject, { type: 'image' }> {
+  return o.type === 'image'
+}
+
+export function PropsPanel({ object, onChange }: PropsPanelProps) {
+  const [model, setModel] = useState<WObject>(object)
+
+  const emit = (next: WObject) => {
+    setModel(next)
+    onChange?.(next)
+  }
+
+  const update = (patch: Partial<Pick<WObject, 'x' | 'y' | 'width' | 'height' | 'rotate'>>): void => {
+    const next: WObject = { ...model, ...patch }
+    emit(next)
+  }
+  const updateImageProps = (patch: Partial<{ src: string; alt?: string }>): void => {
+    if (!isImage(model)) return
+    const next: WObject = { ...model, props: { ...model.props, ...patch } }
+    emit(next)
+  }
+
+  return (
+    <div aria-label="Properties Panel">
+      <div>
+        <label>
+          X
+          <input aria-label="X" type="number" value={model.x} onChange={(e) => update({ x: num(e.target.value, model.x) })} />
+        </label>
+        <label>
+          Y
+          <input aria-label="Y" type="number" value={model.y} onChange={(e) => update({ y: num(e.target.value, model.y) })} />
+        </label>
+        <label>
+          Width
+          <input aria-label="Width" type="number" value={model.width} onChange={(e) => update({ width: num(e.target.value, model.width) })} />
+        </label>
+        <label>
+          Height
+          <input aria-label="Height" type="number" value={model.height} onChange={(e) => update({ height: num(e.target.value, model.height) })} />
+        </label>
+        <label>
+          Rotate
+          <input aria-label="Rotate" type="number" value={model.rotate} onChange={(e) => update({ rotate: num(e.target.value, model.rotate) })} />
+        </label>
+      </div>
+
+      {isImage(model) && (
+        <div>
+          <label>
+            Src
+            <input aria-label="Src" type="text" value={model.props.src} onChange={(e) => updateImageProps({ src: e.target.value })} />
+          </label>
+          <label>
+            Alt
+            <input aria-label="Alt" type="text" value={model.props.alt || ''} onChange={(e) => updateImageProps({ alt: e.target.value })} />
+          </label>
+        </div>
+      )}
+    </div>
+  )
+}

lib/exporter/verify.cli.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from 'vitest'
+import { verifyCli } from '@/lib/exporter/verify.cli'
+
+// helpers to build base64 from string
+function b64(s: string) {
+  if (typeof Buffer !== 'undefined') return Buffer.from(s, 'utf-8').toString('base64')
+  throw new Error('Buffer not available')
+}
+
+describe('verify.cli', () => {
+  const EMPTY_SHA256_B64 = '47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='
+
+  it('returns 0 and logs summary when ok', async () => {
+    // empty entries integrity index; bundleHash = sha256("") in base64
+    const extras = {
+      'assets.integrity.index.json': b64(JSON.stringify({ entries: [], bundleHash: 'sha256-' + EMPTY_SHA256_B64 }))
+    }
+    const assets = {}
+    const extrasJson = JSON.stringify(extras)
+    const assetsJson = JSON.stringify(assets)
+
+    const paths: Record<string, string> = {
+      '/tmp/extras.ok.json': extrasJson,
+      '/tmp/assets.ok.json': assetsJson,
+    }
+    const logs: string[] = []
+    const readText = async (p: string) => {
+      const v = paths[p]
+      if (v == null) throw new Error('no such file: ' + p)
+      return v
+    }
+    const code = await verifyCli(['--extras', '/tmp/extras.ok.json', '--assets', '/tmp/assets.ok.json'], readText, (s: string) => logs.push(s))
+    expect(code).toBe(0)
+    expect(logs.join('\n')).toMatch(/"ok": true/)
+    expect(logs.join('\n')).toMatch(/"total": 0/)
+  })
+
+  it('returns 1 and logs errors when invalid JSON', async () => {
+    const paths: Record<string, string> = {
+      '/tmp/extras.bad.json': JSON.stringify({ 'assets.integrity.index.json': 'not-base64' }),
+      '/tmp/assets.empty.json': JSON.stringify({}),
+    }
+    const logs: string[] = []
+    const readText = async (p: string) => {
+      const v = paths[p]
+      if (v == null) throw new Error('no such file: ' + p)
+      return v
+    }
+    const code = await verifyCli(['--extras', '/tmp/extras.bad.json', '--assets', '/tmp/assets.empty.json'], readText, (s: string) => logs.push(s))
+    expect(code).toBe(1)
+    expect(logs.join('\n')).toMatch(/"ok": false/)
+    expect(logs.join('\n')).toMatch(/Invalid assets\.integrity\.index\.json JSON|Missing assets\.integrity\.index\.json/)
+  })
+})

lib/exporter/verify.cli.ts

@@ -0,0 +1,68 @@
+import { verifyIntegrity } from '@/lib/exporter/verify'
+
+export type ReadText = (path: string) => Promise<string>
+export type Logger = (line: string) => void
+
+// base64 -> Uint8Array
+function fromBase64(b64: string): Uint8Array {
+  if (typeof Buffer !== 'undefined') return new Uint8Array(Buffer.from(b64, 'base64'))
+  throw new Error('Buffer not available')
+}
+
+// parse args like: [--extras, path, --assets, path]
+function parseArgs(argv: string[]): { extras?: string; assets?: string } {
+  const out: { extras?: string; assets?: string } = {}
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i]
+    if (a === '--extras') out.extras = argv[++i]
+    else if (a === '--assets') out.assets = argv[++i]
+  }
+  return out
+}
+
+export async function verifyCli(argv: string[], readText: ReadText, log: Logger): Promise<number> {
+  try {
+    const { extras: extrasPath, assets: assetsPath } = parseArgs(argv)
+    if (!extrasPath || !assetsPath) {
+      log('Usage: verify --extras <extras.json> --assets <assets.json>')
+      return 2
+    }
+    const extrasJson = await readText(extrasPath)
+    const assetsJson = await readText(assetsPath)
+    let extrasMap: Record<string, string>
+    let assetsMap: Record<string, string>
+    try {
+      extrasMap = JSON.parse(extrasJson)
+      assetsMap = JSON.parse(assetsJson)
+    } catch (e) {
+      log('Invalid JSON input files')
+      return 1
+    }
+    // decode base64 into Uint8Array maps
+    const extrasBytes: Record<string, Uint8Array> = {}
+    for (const [k, v] of Object.entries(extrasMap)) {
+      try {
+        extrasBytes[k] = fromBase64(v)
+      } catch {
+        // mark invalid; let verifyIntegrity handle missing/invalid as possible
+        log(`Failed to decode base64 for extras entry: ${k}`)
+        return 1
+      }
+    }
+    const assetsBytes: Record<string, Uint8Array> = {}
+    for (const [k, v] of Object.entries(assetsMap)) {
+      try {
+        assetsBytes[k] = fromBase64(v)
+      } catch {
+        log(`Failed to decode base64 for asset entry: ${k}`)
+        return 1
+      }
+    }
+    const result = verifyIntegrity(extrasBytes, assetsBytes)
+    log(JSON.stringify(result, null, 2))
+    return result.ok ? 0 : 1
+  } catch (e) {
+    log(String(e instanceof Error ? e.message : e))
+    return 1
+  }
+}

lib/exporter/verify.serialize.test.ts

@@ -0,0 +1,48 @@
+import { describe, it, expect } from 'vitest'
+import { generateVerifyInputs } from '@/lib/exporter/verify.serialize'
+
+// helper to b64
+function toB64(u8: Uint8Array) {
+  if (typeof Buffer !== 'undefined') return Buffer.from(u8).toString('base64')
+  throw new Error('Buffer not available')
+}
+
+describe('verify.serialize (from folder maps)', () => {
+  it('collects assets.integrity.index.json into extras and assets/* into assets map', async () => {
+    // virtual FS
+    const files: Record<string, Uint8Array> = {
+      '/artifacts/export/assets.integrity.index.json': new TextEncoder().encode(JSON.stringify({ entries: [], bundleHash: 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' })),
+      '/artifacts/export/index.html': new TextEncoder().encode('<!doctype html>'),
+      '/artifacts/export/assets/img/a.png': new Uint8Array([1,2,3]),
+      '/artifacts/export/assets/fonts/f.woff2': new Uint8Array([4,5,6,7]),
+    }
+    const listDir = async (dir: string): Promise<string[]> => {
+      // return child paths (recursive listing simulated by filtering)
+      return Object.keys(files).filter((p) => p.startsWith(dir)).map((p) => p)
+    }
+    const readFile = async (p: string) => {
+      const v = files[p]
+      if (!v) throw new Error('not found: ' + p)
+      return v
+    }
+    const { extras, assets } = await generateVerifyInputs('/artifacts/export', listDir, readFile)
+    // extras must have only the integrity index
+    expect(Object.keys(extras)).toEqual(['assets.integrity.index.json'])
+    expect(extras['assets.integrity.index.json']).toBe(toB64(files['/artifacts/export/assets.integrity.index.json']))
+    // assets must include assets/* files only
+    expect(Object.keys(assets).sort()).toEqual(['assets/fonts/f.woff2','assets/img/a.png'])
+    expect(assets['assets/img/a.png']).toBe(toB64(files['/artifacts/export/assets/img/a.png']))
+  })
+
+  it('ignores non-asset files and missing integrity index', async () => {
+    const files: Record<string, Uint8Array> = {
+      '/artifacts/export/index.html': new TextEncoder().encode('<!doctype html>'),
+      '/artifacts/export/assets/img/a.png': new Uint8Array([9,9]),
+    }
+    const listDir = async (dir: string) => Object.keys(files).filter((p) => p.startsWith(dir))
+    const readFile = async (p: string) => files[p]!
+    const { extras, assets } = await generateVerifyInputs('/artifacts/export', listDir, readFile)
+    expect(Object.keys(extras)).toEqual([])
+    expect(Object.keys(assets)).toEqual(['assets/img/a.png'])
+  })
+})

lib/exporter/verify.serialize.ts

@@ -0,0 +1,47 @@
+export type ListDir = (dir: string) => Promise<string[]>
+export type ReadFile = (path: string) => Promise<Uint8Array>
+
+function toBase64(u8: Uint8Array): string {
+  if (typeof Buffer !== 'undefined') return Buffer.from(u8).toString('base64')
+  throw new Error('Buffer not available')
+}
+
+// Generate inputs for verify CLI from a folder tree.
+// - root: export folder (contains assets.integrity.index.json and assets/*)
+// - listDir: returns list of file paths under root (can be recursive listing)
+// - readFile: reads a file into bytes
+export async function generateVerifyInputs(
+  root: string,
+  listDir: ListDir,
+  readFile: ReadFile
+): Promise<{ extras: Record<string, string>; assets: Record<string, string> }> {
+  const all = await listDir(root)
+  const norm = (p: string) => p.replace(/\\/g, '/')
+  const rootNorm = norm(root).replace(/\/$/, '')
+  const rel = (p: string) => {
+    const pn = norm(p)
+    return pn.startsWith(rootNorm + '/') ? pn.slice(rootNorm.length + 1) : pn
+  }
+
+  const extras: Record<string, string> = {}
+  const assets: Record<string, string> = {}
+
+  // assets.integrity.index.json at root
+  const integrityPath = all.find((p) => rel(p) === 'assets.integrity.index.json')
+  if (integrityPath) {
+    const bytes = await readFile(integrityPath)
+    extras['assets.integrity.index.json'] = toBase64(bytes)
+  }
+
+  // collect assets/**/*
+  for (const abs of all) {
+    const r = rel(abs)
+    if (!r.startsWith('assets/')) continue
+    // skip directories: best-effort by checking trailing slash
+    if (r.endsWith('/')) continue
+    const bytes = await readFile(abs)
+    assets[r] = toBase64(bytes)
+  }
+
+  return { extras, assets }
+}

lib/wysiwyg/export.test.ts

@@ -0,0 +1,42 @@
+import { describe, it, expect } from 'vitest'
+import { exportFrame } from '@/lib/wysiwyg/export'
+import type { Frame } from '@/lib/wysiwyg/schema'
+
+function makeFrame(): Frame {
+  return {
+    id: 'f1', width: 320, height: 200, background: '#ffffff',
+    layers: [
+      { id: 'l1', name: 'Base', visible: true, locked: false, objects: [
+        { id: 'o1', type: 'image', x: 16, y: 24, width: 80, height: 60, rotate: 15, zIndex: 0, props: { src: 'https://example.com/a.jpg', alt: 'A' } },
+      ]},
+      { id: 'l2', name: 'Text', visible: true, locked: false, objects: [
+        { id: 't1', type: 'text', x: 24, y: 120, width: 200, height: 32, rotate: 0, zIndex: 1, props: { text: 'Hello', fontSize: 18, color: '#111111' } },
+      ]},
+    ],
+  }
+}
+
+describe('wysiwyg export (absolute positioned HTML/CSS + scale wrapper)', () => {
+  it('renders wrapper with fixed width/height and absolutely positioned children', () => {
+    const frame = makeFrame()
+    const out = exportFrame(frame)
+    expect(out.html).toMatch(/<div class=\"frame\"/)
+    expect(out.css).toMatch(/\.frame\s*{[^}]*position:relative/)
+    expect(out.css).toMatch(/width:320px/)
+    expect(out.css).toMatch(/height:200px/)
+    // image object
+    expect(out.html).toMatch(/<img[^>]*src=\"https:\/\/example.com\/a.jpg\"/)
+    expect(out.css).toMatch(/#o1\s*{[^}]*left:16px;[^}]*top:24px;[^}]*width:80px;[^}]*height:60px;[^}]*transform:rotate\(15deg\)/)
+    // text object
+    expect(out.html).toMatch(/<p id=\"t1\"/)
+    expect(out.html).toMatch(/Hello/)
+    expect(out.css).toMatch(/#t1\s*{[^}]*left:24px;[^}]*top:120px;[^}]*width:200px;[^}]*height:32px/)
+  })
+
+  it('includes scale wrapper token for responsive fit', () => {
+    const frame = makeFrame()
+    const out = exportFrame(frame)
+    expect(out.css).toMatch(/\.frame-scale\s*{[^}]*transform-origin:0 0/)
+    expect(out.html).toMatch(/class=\"frame-scale\"/)
+  })
+})

lib/wysiwyg/export.ts

@@ -0,0 +1,48 @@
+import type { Frame, WObject } from '@/lib/wysiwyg/schema'
+
+export type Exported = { html: string; css: string; js: string }
+
+function esc(s: string) {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;')
+}
+
+function isImage(o: WObject): o is Extract<WObject, { type: 'image' }> { return o.type === 'image' }
+function isText(o: WObject): o is Extract<WObject, { type: 'text' }> { return o.type === 'text' }
+function isButton(o: WObject): o is Extract<WObject, { type: 'button' }> { return o.type === 'button' }
+
+function renderObject(o: WObject): { html: string; css: string } {
+  const baseCss = `#${o.id}{position:absolute;left:${o.x}px;top:${o.y}px;width:${o.width}px;height:${o.height}px;transform:rotate(${o.rotate}deg)}`
+  if (isImage(o)) {
+    const html = `<img id="${o.id}" src="${esc(o.props.src)}" alt="${esc(o.props.alt || '')}" />`
+    return { html, css: baseCss }
+  }
+  if (isText(o)) {
+    const html = `<p id="${o.id}">${esc(o.props.text)}</p>`
+    return { html, css: baseCss + `;font-size:${o.props.fontSize}px;color:${o.props.color}` }
+  }
+  // button minimal
+  const label = isButton(o) ? o.props.label : 'Button'
+  const href = isButton(o) ? (o.props.href || '#') : '#'
+  const html = `<a id="${o.id}" href="${esc(href)}">${esc(label)}</a>`
+  return { html, css: baseCss }
+}
+
+export function exportFrame(frame: Frame): Exported {
+  const piecesHtml: string[] = []
+  const piecesCss: string[] = []
+  for (const layer of frame.layers) {
+    if (!layer.visible) continue
+    for (const o of layer.objects) {
+      const r = renderObject(o)
+      piecesHtml.push(r.html)
+      piecesCss.push(r.css)
+    }
+  }
+  const html = `<div class="frame-scale"><div class="frame">${piecesHtml.join('')}</div></div>`
+  const css = [
+    `.frame{position:relative;width:${frame.width}px;height:${frame.height}px;background:${frame.background}}`,
+    `.frame-scale{transform-origin:0 0}`,
+    ...piecesCss,
+  ].join('\n')
+  return { html, css, js: '' }
+}

lib/wysiwyg/schema.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest'
+import { frameSchema, objectSchema, layerSchema, type Frame, type WObject } from '@/lib/wysiwyg/schema'
+
+function validText(id: string): WObject {
+  return {
+    id,
+    type: 'text',
+    x: 100,
+    y: 120,
+    width: 300,
+    height: 40,
+    rotate: 0,
+    zIndex: 1,
+    props: { text: 'Hello', fontSize: 18, color: '#111111' },
+  }
+}
+
+function validImage(id: string): WObject {
+  return {
+    id,
+    type: 'image',
+    x: 50,
+    y: 60,
+    width: 240,
+    height: 180,
+    rotate: 0,
+    zIndex: 0,
+    props: { src: 'https://example.com/a.jpg', alt: 'A' },
+  }
+}
+
+describe('wysiwyg.schema', () => {
+  it('validates a Frame with layers and objects', () => {
+    const frame: Frame = {
+      id: 'frame-1',
+      width: 1200,
+      height: 800,
+      background: '#ffffff',
+      layers: [
+        { id: 'layer-1', name: 'Base', visible: true, locked: false, objects: [validImage('img-1')] },
+        { id: 'layer-2', name: 'Text', visible: true, locked: false, objects: [validText('txt-1')] },
+      ],
+    }
+    const parsed = frameSchema.parse(frame)
+    expect(parsed.layers.length).toBe(2)
+    expect(parsed.layers[1].objects[0].type).toBe('text')
+  })
+
+  it('rejects invalid color and negative sizes', () => {
+    const bad: Frame = {
+      id: 'f', width: -10, height: 0, background: 'blue', layers: [],
+    } as unknown as Frame
+    expect(() => frameSchema.parse(bad)).toThrow()
+  })
+
+  it('objectSchema enforces type-specific props', () => {
+    const ok = objectSchema.parse(validText('t1'))
+    expect(ok.props.text).toBe('Hello')
+
+    const bad = { ...validText('t2'), props: { src: 'x' } }
+    expect(() => objectSchema.parse(bad as unknown as WObject)).toThrow()
+  })
+
+  it('layerSchema enforces ordering integers and object bounds', () => {
+    const good = layerSchema.parse({ id: 'l1', name: 'L', visible: true, locked: false, objects: [validImage('i1')] })
+    expect(good.objects[0].zIndex).toBe(0)
+
+    const badObj = { ...validImage('i2'), width: -1 }
+    expect(() => objectSchema.parse(badObj as unknown as WObject)).toThrow()
+  })
+})

lib/wysiwyg/schema.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod'
+
+const colorHex = z.string().regex(/^#([0-9a-fA-F]{3}){1,2}$/)
+
+const baseObject = z.object({
+  id: z.string().min(1),
+  x: z.number(),
+  y: z.number(),
+  width: z.number().positive(),
+  height: z.number().positive(),
+  rotate: z.number(),
+  zIndex: z.number().int().nonnegative(),
+})
+
+const textObject = baseObject.extend({
+  type: z.literal('text'),
+  props: z.object({
+    text: z.string(),
+    fontSize: z.number().positive(),
+    color: colorHex,
+  }),
+})
+
+const imageObject = baseObject.extend({
+  type: z.literal('image'),
+  props: z.object({
+    src: z.string().min(1),
+    alt: z.string().optional().default(''),
+  }),
+})
+
+const buttonObject = baseObject.extend({
+  type: z.literal('button'),
+  props: z.object({
+    label: z.string().min(1),
+    href: z.string().optional().default(''),
+    color: colorHex.optional(),
+    background: colorHex.optional(),
+  }),
+})
+
+export const objectSchema = z.discriminatedUnion('type', [textObject, imageObject, buttonObject])
+export type WObject = z.infer<typeof objectSchema>
+
+export const layerSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1),
+  visible: z.boolean(),
+  locked: z.boolean(),
+  objects: z.array(objectSchema),
+})
+
+export const frameSchema = z.object({
+  id: z.string().min(1),
+  width: z.number().positive(),
+  height: z.number().positive(),
+  background: colorHex,
+  layers: z.array(layerSchema),
+})
+export type Frame = z.infer<typeof frameSchema>

package.json

@@ -10,7 +10,9 @@
     "test": "vitest run",
     "test:watch": "vitest -w",
     "coverage": "vitest run --coverage",
-    "test:e2e": "playwright test"
+    "test:e2e": "playwright test",
+    "verify:make-json": "node scripts/make-verify-json.js --root ./artifacts/export --extras ./artifacts/extras.json --assets ./artifacts/assets.json",
+    "verify:run": "node scripts/verify.js --extras ./artifacts/extras.json --assets ./artifacts/assets.json"
   },
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",

scripts/make-verify-json.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/*
+  Generate verify inputs from an export folder
+  Usage: node scripts/make-verify-json.js --root <export_folder> --extras <out_extras.json> --assets <out_assets.json>
+*/
+const fs = require('fs');
+const fsp = require('fs/promises');
+const path = require('path');
+
+function parseArgs(argv) {
+  const out = { root: '', extras: '', assets: '' };
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--root') out.root = argv[++i];
+    else if (a === '--extras') out.extras = argv[++i];
+    else if (a === '--assets') out.assets = argv[++i];
+  }
+  return out;
+}
+
+function toB64(buf) { return Buffer.from(buf).toString('base64'); }
+
+async function readFileB64(p) { const b = await fsp.readFile(p); return toB64(b); }
+
+async function walk(dir) {
+  const out = [];
+  const entries = await fsp.readdir(dir, { withFileTypes: true });
+  for (const ent of entries) {
+    const abs = path.join(dir, ent.name);
+    if (ent.isDirectory()) {
+      const sub = await walk(abs);
+      out.push(...sub);
+    } else if (ent.isFile()) {
+      out.push(abs);
+    }
+  }
+  return out;
+}
+
+(async () => {
+  try {
+    const { root, extras, assets } = parseArgs(process.argv);
+    if (!root || !extras || !assets) {
+      console.log('Usage: node scripts/make-verify-json.js --root <export_folder> --extras <out_extras.json> --assets <out_assets.json>');
+      process.exit(2);
+    }
+    const rootAbs = path.resolve(process.cwd(), root);
+    const files = await walk(rootAbs);
+    const norm = (p) => p.split(path.sep).join('/');
+    const rootNorm = norm(rootAbs).replace(/\/$/, '');
+    const rel = (p) => {
+      const pn = norm(p);
+      return pn.startsWith(rootNorm + '/') ? pn.slice(rootNorm.length + 1) : pn;
+    };
+
+    const extrasMap = {};
+    const assetsMap = {};
+
+    // integrity index
+    const idx = files.find((p) => rel(p) === 'assets.integrity.index.json');
+    if (idx) {
+      extrasMap['assets.integrity.index.json'] = await readFileB64(idx);
+    }
+
+    // assets/**/*
+    for (const abs of files) {
+      const r = rel(abs);
+      if (!r.startsWith('assets/')) continue;
+      const b64 = await readFileB64(abs);
+      assetsMap[r] = b64;
+    }
+
+    await fsp.mkdir(path.dirname(path.resolve(process.cwd(), extras)), { recursive: true });
+    await fsp.mkdir(path.dirname(path.resolve(process.cwd(), assets)), { recursive: true });
+    await fsp.writeFile(extras, JSON.stringify(extrasMap));
+    await fsp.writeFile(assets, JSON.stringify(assetsMap));
+    console.log(`Wrote ${extras} and ${assets}`);
+  } catch (e) {
+    console.error(e && e.stack || String(e));
+    process.exit(1);
+  }
+})();

scripts/verify.js

@@ -0,0 +1,78 @@
+#!/usr/bin/env node
+/*
+  Verify bundle integrity using extras/assets JSON maps.
+  Usage: node scripts/verify.js --extras <extras.json> --assets <assets.json>
+*/
+const fs = require('fs/promises');
+const crypto = require('crypto');
+
+function parseArgs(argv) {
+  const out = { extras: '', assets: '' };
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--extras') out.extras = argv[++i];
+    else if (a === '--assets') out.assets = argv[++i];
+  }
+  return out;
+}
+
+function fromB64(b64) { return Buffer.from(b64, 'base64'); }
+function sha256b64(buf) { return crypto.createHash('sha256').update(buf).digest('base64'); }
+
+(async () => {
+  try {
+    const { extras, assets } = parseArgs(process.argv);
+    if (!extras || !assets) {
+      console.log('Usage: node scripts/verify.js --extras <extras.json> --assets <assets.json>');
+      process.exit(2);
+    }
+    const extrasJson = await fs.readFile(extras, 'utf-8');
+    const assetsJson = await fs.readFile(assets, 'utf-8');
+    const extrasMap = JSON.parse(extrasJson);
+    const assetsMap = JSON.parse(assetsJson);
+
+    const result = { ok: true, errors: [], summary: { total: 0, missing: 0, integrityMismatches: 0, sizeMismatches: 0, bundleHashMismatch: false } };
+
+    if (!Object.prototype.hasOwnProperty.call(extrasMap, 'assets.integrity.index.json')) {
+      result.ok = false; result.errors.push('Missing assets.integrity.index.json in extras');
+      console.log(JSON.stringify(result, null, 2)); process.exit(1);
+    }
+
+    let parsed;
+    try {
+      parsed = JSON.parse(fromB64(extrasMap['assets.integrity.index.json']).toString('utf-8'));
+    } catch {
+      result.ok = false; result.errors.push('Invalid assets.integrity.index.json JSON');
+      console.log(JSON.stringify(result, null, 2)); process.exit(1);
+    }
+
+    const recomputedLines = [];
+    let missing = 0, integrityMismatches = 0, sizeMismatches = 0;
+    for (const e of parsed.entries) {
+      const b64 = assetsMap[e.path];
+      if (!b64) { result.errors.push(`Missing asset for path in integrity index: ${e.path}`); missing++; continue; }
+      const buf = fromB64(b64);
+      if (typeof e.size === 'number' && e.size !== buf.length) {
+        result.errors.push(`Size mismatch for ${e.path}: expected ${e.size}, got ${buf.length}`); sizeMismatches++; }
+      const integ = 'sha256-' + sha256b64(buf);
+      if (integ !== e.integrity) { result.errors.push(`Integrity mismatch for ${e.path}`); integrityMismatches++; }
+      recomputedLines.push(e.path); recomputedLines.push(integ);
+    }
+    const bundle = 'sha256-' + sha256b64(Buffer.from(recomputedLines.join('\n'), 'utf-8'));
+    const bundleHashMismatch = bundle !== parsed.bundleHash;
+    if (bundleHashMismatch) result.errors.push('BundleHash mismatch');
+
+    result.summary.total = parsed.entries.length;
+    result.summary.missing = missing;
+    result.summary.integrityMismatches = integrityMismatches;
+    result.summary.sizeMismatches = sizeMismatches;
+    result.summary.bundleHashMismatch = bundleHashMismatch;
+    result.ok = result.errors.length === 0;
+
+    console.log(JSON.stringify(result, null, 2));
+    process.exit(result.ok ? 0 : 1);
+  } catch (e) {
+    console.error(e && e.stack || String(e));
+    process.exit(1);
+  }
+})();