[TheGreatAxios]

Closes CL-11930 (Slice 1 of 5 for CL-11929).

Summary

• Add @corbits/pdf (packages/pdf), a zero-dependency pure-TypeScript PDF 1.4 writer with deterministic output, RFC 1950/1951 Deflate/Zlib streams, Type1 fonts, vector paths, linear gradients, and PNG/JPEG image XObjects.
• Extend @corbits/slidedeck with checkDeck(deck) (WCAG AA contrast thresholds, overflow estimation, empty placeholder/region checks, and image validation), writeDeckPdf(deck), and createDeckTools(env) (write_deck and check_deck).
• Add unit tests for @corbits/pdf and @corbits/slidedeck deck checking and PDF rendering.

[linear-code]

CL-11930

[corbits-triage]

Triage requests changes:

• Conventions: added code matches a code pattern

[TheGreatAxios]

The checks cover empty regions, overflow, images, and contrast. A failed check can still be filed as a good deck.

1. write_deck in apps/hub/src/artifacts/deck-tools.ts writes .builder/deck.json, the pptx, and the pdf when checkDeck returns issues. isError is set only when the schema or an image throws, so a contrast or overflow failure comes back as a successful tool call with passed: false. check_deck itself does refuse. The test named like "return isError: true on validation or check failures" never calls write_deck with a check-only failure.

2. Free-slide contrast in packages/slidedeck/src/check.ts keeps the best foreground/background pair. White text on a white shape over a black slide passes, because the slide background is still a candidate and the max ratio is 21:1. A gradient with one passing stop does the same. The check needs the paint that covers the text, not the best ratio among every candidate.

[TheGreatAxios]

Decks are not durable. write_deck writes .builder/deck.json, .builder/deck.pptx, and .builder/deck.pdf on the sidecar workspace. Nothing copies those bytes into an artifact. If the sidecar is gone before a later step files them, the deck is gone. Git is not a store for decks. .builder is excluded from the app repo.

The portal should read the durable copy, not the live sidecar. For a deck that is: an artifact version, fetched with getArtifactVersion, the same as documents and a filed app. The sidecar is only the workspace the tool is writing in.

Do that when a deck has passed check_deck, not on every write_deck. This PR can still write a failed check to those three files and report success. Saving that to Postgres would keep the bad deck. File the artifact only after the check passes, and do not write the workspace files when the check fails.

Until that exists, coming back after the sidecar dies means there is no deck to load. There is no git ref and no artifact row.

[corbits-triage]

Triage requests changes:

• CI green: required checks are failing
  • test

[corbits-triage]

Triage requests changes:

• Merge conflicts: merge conflicts with base

[corbits-triage]

Triage: Pass

No changes needed from you. A maintainer will review this pull request.

Notes:

• changes sensitive paths: locks: bun.lock

Triage will approve, request review.

Nothing triage asked to change still fails, so this request no longer stands.

Nothing triage asked to change still fails, so this request no longer stands.