feat(lint): font loading + invalid capture path composition rules

[ukimsanov]

What

Two new composition lint rules catching real failure modes from the website-to-video eval. Total lint suite goes from 148 to 151 tests; all 151 pass.

3 of 5 in the pipeline-quality stack. Stacked on #988.

Why

Both rules were chosen because the failure modes recurred across multiple eval rounds:

• Google Fonts CDN — Sub-agents reflexively wrote <link href="https://fonts.googleapis.com/css2?..."> in compositions. Works locally; fails in sandboxed/offline renders, adds latency, and isn't deterministic.
• Missing @font-face — CSS used a font-family with no declaration and no entry in the auto-bundled set. Text silently fell back to system-ui. Visual fidelity loss across multiple v2 videos (Mercury fonts, GeistMono, "Inter Variable").
• ../capture/ paths — Sub-compositions live in compositions/ but are served with the project root as their base URL. <img src="../capture/logo.svg"> works on disk but 404s in Studio and renders. Four of six framer sub-agents got this wrong; mercury had four of five.

How

packages/core/src/lint/rules/fonts.ts (new)

• google_fonts_import — warning. Detects <link> to fonts.googleapis.com and @import url(...fonts.googleapis.com...). Fix hint points to root-relative capture/assets/fonts/...woff2 with a local @font-face declaration.
• font_family_without_font_face — warning. Checks every used family against @font-face declarations + the auto-bundled font set. Fix hint also points to root-relative capture/assets/fonts/.

packages/core/src/lint/rules/composition.ts

• invalid_capture_path — error. Counts ../capture/ matches across the entire file (HTML + CSS + inline scripts) and reports the total. Registry source files and installed blocks are exempted via the existing isRegistrySourceFile / isRegistryInstalledFile guards.

Tests

• fonts.test.ts (new) — 11 tests covering Google Fonts in <link> and @import, undeclared families, auto-bundled families staying clean.
• composition.test.ts — three new cases for invalid_capture_path: <img> triggers, multi-occurrence url()s counted, root-relative capture/ clean.

Wiring — hyperframeLinter.ts runs the new fonts rules alongside the existing rule set.

Test plan

• Unit tests added/updated — 151/151 passing (was 148).
• Manual testing performed — typecheck clean; lint on a sub-composition with ../capture/ paths produces the expected error.
• Documentation updated (if applicable) — fix hints in the rules themselves point at the correct root-relative paths; skill prose in PR feat(studio): consolidate into single OSS-ready NLE editor #4 of the stack updates step-5-build.md with the rule-aware guidance.

[ukimsanov]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(skill): hyperframes core — remove prescriptive tables, bundle text-effects #991
• feat(skill): website-to-hyperframes — concept-first authoring + per-beat read protocol #990
• feat(lint): font loading + invalid capture path composition rules #989 👈 (View in Graphite)
• feat(capture): pipeline improvements — contact sheets, design styles, snapshot #988
• feat(capture): identify hashed fonts via OpenType name table #987
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[miguel-heygen]

Clean lint rules. google_fonts_import catches both and @import. font_family_without_font_face correctly skips generics, producer-bundled fonts, and font-family inside @font-face blocks. invalid_capture_path scoped correctly — only flags ../capture/ traversal. Tests comprehensive (12 cases).

[jrusso1020]

Approve at 06e71a39. Magi covered the test count (148 → 151) + producer-bundled-font / generic-family skip lists. Additive:

• invalid_capture_path rule scope — counts ../capture/ matches across HTML + CSS + inline scripts and reports total. Registry source files + installed blocks exempted via existing isRegistrySourceFile / isRegistryInstalledFile guards. Worth confirming: are there legitimate top-level project files (e.g., a tools/ script) that reference ../capture/ for off-line preview reasons? If yes, they'd hit this rule. Counter-evidence: this is a lint rule (not a build error), so it surfaces as feedback rather than gating, mitigating false-positive damage.

• google_fonts_import rule fix-hint — points to capture/assets/fonts/...woff2 (root-relative). One thing to verify against hf#988's capture pipeline: does capture/assets/fonts/ actually land at the root-relative path the fix hint claims, OR is it under capture/extracted/fonts/? Cross-PR consistency between the rule's fix-hint and the capture pipeline's actual output directory will save users an "I followed the hint and it 404'd" moment.

• font_family_without_font_face rule — auto-bundled font set check is solid. The fallback-to-system-ui silent failure was a real eval-blocker; this catches it at lint time. ✓

• Test coverage — 11 new tests for fonts + 3 for the capture-path rule. Both rules have explicit positive AND negative cases (e.g., auto-bundled families stay clean) — that's the right shape for a lint rule.

Stack base correctly set to feat/capture-pipeline-improvements.

— Rames Jusso