feat(creator-motion-storyboard): capsule-to-storyboard controller route

[Fearvox]

Summary

New @syndash/creator-motion-storyboard package — a public-safe capsule-to-motion-storyboard HTTP controller route.

• POST /capsule-to-storyboard — accepts a capsule JSON body, returns a self-contained fixed-canvas HTML motion storyboard
• JSON contract (capsule-v1 schema) with structural validation
• Machine check: scene index consistency, positive durations, duplicate ID detection, element canvas-bounds validation
• Append-only JSONL ledger retention (.ledger/storyboard-transforms.jsonl)
• XSS-safe: all user content HTML-escaped; CSP headers on responses
• 23 tests (contract, transform, validate, ledger) — all passing
• GitHub Actions CI workflow

Design decisions

• Bun native HTTP server — no framework dependency, minimal footprint
• esc() everywhere — every capsule-originated string passes through HTML entity encoding before rendering
• CSP header default-src 'none'; style-src 'unsafe-inline' — defense in depth beyond escaping
• Fire-and-forget ledger — ledger write failures don't block the response
• Scene elements rendered as positioned <div>s — CSS classes (el-text, el-shape, el-placeholder) for theming; no raw generated media

Test plan

• bun test — 23/23 pass
• bun run build — bundles to 9.24 KB
• Smoke test: health endpoint, valid storyboard generation, 422 on bad input

Evidence

$ bun test
23 pass, 0 fail, 52 expect() calls
Ran 23 tests across 4 files.

$ bun run build
Bundled 5 modules in 65ms — server.js 9.24 KB

$ curl -X POST :3099/capsule-to-storyboard -d '{valid capsule}'
200 — returned self-contained HTML storyboard

$ curl -X POST :3099/capsule-to-storyboard -d '{"bad":1}'
422 — {"error":"body does not match capsule contract",...}

Closes DAS-234.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dash-proof	Ready	Preview, Comment	May 2, 2026 4:19am

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[capy-ai]

I cannot approve this PR yet.

Blocking issue: the generated HTML is not actually public-safe. Capsule-originated CSS is interpolated directly into HTML style="..." attributes without escaping or sanitization:

• style entries are rendered as raw ${k}:${v} in renderSceneElements.
• scene.background is rendered raw inside the scene-canvas style attribute.
• validateCapsule only checks the element numeric fields/type and does not validate/sanitize style keys/values or background.

A malicious capsule can break out of the style attribute with a quote-bearing CSS value/background and inject markup. CSP reduces script execution risk, but the PR claims all capsule-originated strings are escaped and the route is public-safe; this is currently false.

Please either:

1. remove arbitrary style/background passthrough from public input, or
2. strictly whitelist CSS properties and validate CSS values against safe patterns, then HTML-escape any final attribute fragments.

Add tests covering hostile style values and background values containing quotes / <img / event-handler payloads.