fix(core,sdk): code-review findings — 5 correctness bugs + 2 cleanup

- gsapParserAcorn: top-level variable targets now resolved via program-scope
  null-key fallback in lookupBindingFromAncestors (const el = querySelector...)
- gsapParserAcorn: fromTo guard requires args.length >= 3, preventing undefined
  args[2]/args[3] access when fewer args supplied
- gsapWriterAcorn: remove fuzzing fallback in removeAnimationFromScript that
  silently deleted the wrong animation (from→to ID conversion)
- gsapWriterAcorn: valueToCode guards NaN → "0" to avoid broken tween props;
  safeKey regex aligned to ASCII-only (matching gsapSerialize)
- mutate: handleSetGsapTween now includes stagger in extras (was in addGsapTween
  but missing from setGsapTween)
- apply-patches: script case now mirrors stylesheet — op=remove calls
  setGsapScript("") instead of silently ignoring the patch

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: vanceingalls

packages/core/src/parsers/gsapParserAcorn.ts

@@ -153,7 +153,9 @@ function lookupBindingFromAncestors(
     const selector = bindings.get(scopeNode)?.get(name);
     if (selector !== undefined) return selector;
   }
-  return null;
+  // Program-scope bindings are stored under null (enclosingScopeNodeFromAncestors
+  // returns null when no function wrapper exists — the common case in HF scripts).
+  return bindings.get(null)?.get(name) ?? null;
 }
 
 function isFunctionNode(node: any): boolean {
@@ -470,31 +472,31 @@ function findAllTweenCalls(
       ) {
         const method = callee.property.name;
         const args = node.arguments;
-        if (args.length >= 2) {
-          const selectorValue =
-            resolveTargetSelector(args[0], nodeAncestors, scope, targetBindings) ??
-            "__unresolved__";
-
-          if (method === "fromTo") {
-            results.push({
-              node,
-              ancestors: nodeAncestors,
-              method: "fromTo",
-              selector: selectorValue,
-              fromArg: args[1],
-              varsArg: args[2],
-              positionArg: args[3],
-            });
-          } else {
-            results.push({
-              node,
-              ancestors: nodeAncestors,
-              method: method as GsapMethod,
-              selector: selectorValue,
-              varsArg: args[1],
-              positionArg: args[2],
-            });
-          }
+        const selectorValue =
+          args.length >= 1
+            ? (resolveTargetSelector(args[0], nodeAncestors, scope, targetBindings) ??
+              "__unresolved__")
+            : "__unresolved__";
+
+        if (method === "fromTo" && args.length >= 3) {
+          results.push({
+            node,
+            ancestors: nodeAncestors,
+            method: "fromTo",
+            selector: selectorValue,
+            fromArg: args[1],
+            varsArg: args[2],
+            positionArg: args[3],
+          });
+        } else if (method !== "fromTo" && args.length >= 2) {
+          results.push({
+            node,
+            ancestors: nodeAncestors,
+            method: method as GsapMethod,
+            selector: selectorValue,
+            varsArg: args[1],
+            positionArg: args[2],
+          });
         }
       }
     }

packages/core/src/parsers/gsapWriterAcorn.ts

@@ -20,12 +20,13 @@ import * as acornWalk from "acorn-walk";
 function valueToCode(value: unknown): string {
   if (typeof value === "string" && value.startsWith("__raw:")) return value.slice(6);
   if (typeof value === "string") return JSON.stringify(value);
-  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (typeof value === "number") return Number.isNaN(value) ? "0" : String(value);
+  if (typeof value === "boolean") return String(value);
   return JSON.stringify(value);
 }
 
 function safeKey(key: string): string {
-  return /^[A-Za-z_$][\w$]*$/.test(key) ? key : JSON.stringify(key);
+  return /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
 }
 
 // fallow-ignore-next-line complexity
@@ -241,11 +242,7 @@ export function addAnimationToScript(
 export function removeAnimationFromScript(script: string, animationId: string): string {
   const parsed = parseGsapScriptAcornForWrite(script);
   if (!parsed) return script;
-  let target = parsed.located.find((l) => l.id === animationId);
-  if (!target) {
-    const convertedId = animationId.replace(/-from-|-fromTo-/, "-to-");
-    target = parsed.located.find((l) => l.id === convertedId);
-  }
+  const target = parsed.located.find((l) => l.id === animationId);
   if (!target) return script;
 
   const ms = new MagicString(script);

packages/sdk/src/engine/apply-patches.ts

@@ -207,7 +207,9 @@ function applyOne(parsed: ParsedDocument, patch: JsonPatchOp, p: ParsedPath): vo
     }
 
     case "script": {
-      if (patch.op !== "remove") {
+      if (patch.op === "remove") {
+        setGsapScript(parsed.document, "");
+      } else {
         setGsapScript(parsed.document, String(patch.value ?? ""));
       }
       break;

packages/sdk/src/engine/mutate.ts

@@ -546,6 +546,7 @@ function handleSetGsapTween(
   const extras: Record<string, unknown> = {};
   if (properties.repeat !== undefined) extras.repeat = properties.repeat;
   if (properties.yoyo !== undefined) extras.yoyo = properties.yoyo;
+  if (properties.stagger !== undefined) extras.stagger = properties.stagger;
   if (Object.keys(extras).length > 0) updates.extras = extras;
 
   const newScript = updateAnimationInScript(script, animationId, updates);