chore: integrate dev into main

.github/workflows/ci.yml

@@ -0,0 +1,76 @@
+name: CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "main"
+
+# A newer push to the same long-lived ref cancels the in-flight run.
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.base_ref == 'main' && github.head_ref == 'dev')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm lint
+
+  test:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.base_ref == 'main' && github.head_ref == 'dev')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm typecheck
+      - run: pnpm test
+
+  coverage:
+    # Coverage is collected at the dev-to-main integration boundary or on demand.
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.base_ref == 'main' && github.head_ref == 'dev')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm test:coverage
+      - uses: actions/upload-artifact@v7
+        with:
+          name: unit-coverage-${{ github.sha }}
+          path: coverage/
+          if-no-files-found: error
+          retention-days: 30
+
+  e2e-full:
+    # Browser regression belongs only at the long-lived integration boundary.
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.base_ref == 'main' && github.head_ref == 'dev')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: sudo grep -rlZ 'packages.microsoft.com' /etc/apt/sources.list.d/ | sudo xargs -0 -r rm -f
+      - run: pnpm exec playwright install --with-deps chromium firefox webkit
+      - run: xvfb-run -a pnpm test:e2e

.github/workflows/package-matrix.yml

@@ -0,0 +1,76 @@
+name: Package Matrix
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "main"
+    paths:
+      - ".github/workflows/package-matrix.yml"
+      - "apps/web/**"
+      - "packages/cli/**"
+      - "packages/core/**"
+      - "scripts/build-cli-package.mjs"
+      - "scripts/package-archive.*"
+      - "e2e/packaged-cli.test.ts"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
+      - "store-specs.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: package-matrix-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  packaged-cli:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.base_ref == 'main' && github.head_ref == 'dev')
+    name: ${{ matrix.os }} / Node ${{ matrix.node }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            node: "22"
+            extended: false
+          - os: macos-latest
+            node: "22"
+            extended: false
+          - os: windows-latest
+            node: "22"
+            extended: false
+          - os: ubuntu-latest
+            node: "24"
+            extended: true
+
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: ${{ matrix.node }}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+
+      - name: Remove broken Microsoft apt source
+        if: runner.os == 'Linux'
+        shell: bash
+        run: sudo grep -rlZ 'packages.microsoft.com' /etc/apt/sources.list.d/ | sudo xargs -0 -r rm -f
+      - name: Install Chromium on Linux
+        if: runner.os == 'Linux'
+        run: pnpm exec playwright install --with-deps chromium chromium-headless-shell
+      - name: Install Chromium on macOS or Windows
+        if: runner.os != 'Linux'
+        run: pnpm exec playwright install chromium chromium-headless-shell
+
+      - name: Verify newer-LTS workspace compatibility
+        if: matrix.extended
+        run: pnpm typecheck && pnpm test
+
+      - name: Verify packed install and exact export
+        run: pnpm test:e2e:package

.github/workflows/release-candidate.yml

@@ -0,0 +1,46 @@
+name: Release candidate
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "main"
+    paths:
+      - ".github/workflows/release-candidate.yml"
+      - "docs/releasing.md"
+      - "scripts/build-cli-package.mjs"
+      - "scripts/check-community.mjs"
+      - "scripts/check-release-candidate.mjs"
+      - "scripts/check-spdx.mjs"
+      - "scripts/check-spdx.test.ts"
+      - "scripts/release-audit.mjs"
+      - "scripts/release-audit.test.ts"
+      - "package.json"
+      - "pnpm-lock.yaml"
+      - "apps/web/package.json"
+      - "packages/core/package.json"
+      - "packages/cli/package.json"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-candidate-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  release-candidate:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.base_ref == 'main' && github.head_ref == 'dev')
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v5
+        with:
+          node-version: "22"
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm check:community
+      - run: pnpm check:spdx
+      - run: pnpm check:release-candidate

.gitignore

@@ -0,0 +1,72 @@
+# OS
+.DS_Store
+Thumbs.db
+
+# Dependencies
+node_modules/
+.pnpm-store/
+
+# Build output / monorepo
+dist/
+build/
+out/
+.turbo/
+*.tsbuildinfo
+
+# Next.js (apps/web)
+.next/
+next-env.d.ts
+.vercel/
+
+# Env & secrets
+.env
+.env.*
+!.env.example
+
+# Logs
+*.log
+npm-debug.log*
+pnpm-debug.log*
+
+# Testing (Vitest / Playwright)
+coverage/
+.vitest/
+playwright-report/
+test-results/
+blob-report/
+.playwright/
+
+# Generated screenshot bundles (CLI export output). The unanchored pattern also matches
+# source directories of the same name, so re-include those explicitly.
+export/
+!packages/core/src/export/
+!apps/web/app/api/export/
+
+# Lint / tool caches
+.eslintcache
+.cache/
+packages/cli/package/
+
+# Agent planning artifacts (local, not the curated docs/ contract)
+docs/superpowers/
+docs/archive/superpowers/
+.superpowers/
+.worktrees/
+/.codex/config.toml
+/.screenshot-studio/
+/apps/web/.screenshot-studio/
+
+# E2E scratch (parity harness temp renders)
+e2e/.tmp/
+fixtures/slice-2-screenshot/_missing.json
+
+# Certs / keys
+*.pem
+
+# Editor
+.vscode/*
+!.vscode/extensions.json
+.idea/
+*.swp
+
+fixtures/slice-3-device-frame/_missing.json

AGENTS.md

@@ -0,0 +1,54 @@
+# AGENTS.md — Screenshot Studio
+
+Before any task, read and apply the repository-wide workflow rules in
+[`RULES.md`](RULES.md).
+
+## Core contracts
+
+- `app-store-screenshots.json` is the single persisted project document. The enforced strict schema
+  in `packages/core/src/model/schema.ts` is the source of truth; inspect it before changing project
+  fields or fixtures.
+- Render/export parity is the primary invariant. The editor and CLI must use the same shared core and
+  browser renderer; never introduce a second pixel-rendering path.
+- Store dimensions come from `store-specs.json`, not duplicated constants.
+- Schema widening requires explicit task authorization and coordinated schema, architecture,
+  renderer, fixture, and parity updates. Do not invent project fields from prose or future ideas.
+- Publication is separate from implementation. Follow `docs/releasing.md`; builds and green checks do
+  not authorize tags, registry publication, GitHub releases, or announcements.
+
+## Task-based reading
+
+Read only the smallest relevant set:
+
+| Task | Read first |
+|---|---|
+| Schema, renderer, export, or CLI behavior | `docs/architecture.md` and the relevant source/tests |
+| Editor/UI behavior | `docs/editor.md` |
+| Test selection or CI behavior | `docs/testing.md` |
+| Project source, active session, catalog, or request fencing | `docs/architecture.md` and the relevant web source/tests |
+| Project locking or concurrent writes | `docs/project-mutation-locking.md` |
+| Asset/output publication safety | `docs/safe-file-publication.md` |
+| Package or release work | `docs/releasing.md` |
+| User-facing setup or documentation | `README.md` |
+| Generated screenshot project | that project's `AGENTS.md` |
+
+## Context discipline
+
+- Read only task-relevant files and narrow ranges. Never recursively scan or print `.superpowers/`,
+  `.worktrees/`, `node_modules/`, build output, lockfiles, logs, traces, or session transcripts.
+- Keep command output bounded and summarize results. Prefer tracked files, exact paths, and targeted
+  `rg`; do not dump repository-wide file lists or passing-test logs into context.
+- Do not use sub-agents, Browser, Computer Use, live preview, or browser developer mode unless the
+  user explicitly requests them or the changed behavior cannot be verified without that surface.
+- Run exact tests first. Never run the full local E2E suite; use one browser file only when required
+  by the changed UI/render contract. `docs/testing.md` owns the exact matrix.
+
+## GitHub authentication boundary
+
+- Repository setup, development, builds, and tests must not require GitHub credentials.
+- Never read, copy, print, modify, or request credential files, access tokens, or private keys.
+- Treat sandbox or container `gh` failures as credentials unavailable in that environment, not proof
+  that the contributor is logged out. Prefer an authorized GitHub connector, then a trusted host
+  credential broker or a narrowly scoped elevated command.
+- If authenticated access remains unavailable, report the blocker and provide the relevant GitHub
+  URL for manual completion.

CLAUDE.md

@@ -0,0 +1,4 @@
+# CLAUDE.md
+
+@AGENTS.md
+@RULES.md

CONTRIBUTING.md

@@ -0,0 +1,42 @@
+# Contributing to Screenshot Studio
+
+Thanks for helping improve Screenshot Studio. Small, focused changes are easiest to review and the
+render/export parity contract takes priority over convenience in any one shell.
+
+## Set up the repository
+
+Requirements are Node.js 22.13+, Corepack, and the Playwright Chromium builds used by export tests.
+
+```bash
+git clone https://github.com/VitaliiDeveloper/Screenshot-Studio.git
+cd Screenshot-Studio
+corepack enable
+pnpm install
+pnpm exec playwright install chromium chromium-headless-shell
+pnpm dev
+```
+
+Before changing the project, read `AGENTS.md`, `RULES.md`, and only the architecture or tracked
+contract section relevant to your change. Keep project JSON inside the enforced schema and keep UI
+and CLI pixels on the shared browser renderer.
+
+## Make a change
+
+1. Open an issue for behavior that changes the schema, renderer, export, or documented product contract.
+2. Keep the patch to one concern and add the smallest practical regression test.
+3. Add `SPDX-License-Identifier: Apache-2.0` to new authored `.ts`, `.tsx`, and `.mjs` source files.
+   Do not add text headers to JSON, media, vendored/generated files, lockfiles, or third-party fonts.
+4. Start with the narrow package test that covers the changed behavior. Add or run an exact E2E
+   file only when that behavior requires a real browser, render host, or packed consumer. Do not run
+   the full browser suite locally; CI owns `pnpm test:e2e` for the integration PR from `dev` into
+   `main`. The leaf-group ownership and cost matrix lives in `docs/testing.md`.
+5. Update public documentation when the user-visible behavior or install path changes.
+
+Commit subjects use `feat:`, `fix:`, `docs:`, `test:`, `refactor:`, `build:`, `chore:`, `style:`, or
+`perf:` followed by a concise imperative description. Do not add agent attribution trailers.
+
+## License
+
+The project is licensed under Apache-2.0. Unless you explicitly state otherwise, a contribution
+intentionally submitted for inclusion is provided under that same license, as described in
+`LICENSE`. Preserve applicable notices and keep third-party license texts with their assets.

NOTICE

@@ -0,0 +1,5 @@
+Screenshot Studio
+Copyright 2026 Vitalii Lavreniuk and Screenshot Studio contributors
+
+This product is licensed under the Apache License, Version 2.0
+(see the LICENSE file in the repository root).