@1agh/maude 0.42.0 → 0.43.0

package/apps/studio/test/element-structural-edit.test.ts

@@ -10,6 +10,7 @@ import {
   applyDeleteElement,
   applyInsertArtboard,
   applyInsertElement,
+  applyInsertElementIntoArtboard,
   applyResizeArtboard,
   CanvasEditError,
 } from '../canvas-edit.ts';
@@ -153,6 +154,51 @@ describe('canvas-edit / applyInsertElement', () => {
   });
 });
 
+describe('canvas-edit / applyInsertElementIntoArtboard (empty-artboard fallback)', () => {
+  const emptyCanvas = [
+    'export default function Demo() {',
+    '  return (',
+    '    <DesignCanvas>',
+    '      <DCArtboard id="home" label="Home" width={1440} height={1024}>',
+    '      </DCArtboard>',
+    '    </DesignCanvas>',
+    '  );',
+    '}',
+  ].join('\n');
+
+  test("inserts a div as the artboard's only child (inside-end)", () => {
+    const out = applyInsertElementIntoArtboard(CANVAS, emptyCanvas, 'home', 'inside-end', 'div');
+    expect(out.source).toMatch(
+      /<DCArtboard id="home"[^>]*>[\s\S]*var\(--bg-2\)[\s\S]*<\/DCArtboard>/
+    );
+    expect(parses(out.source)).toBe(true);
+    expect(out.newId).toMatch(/^[0-9a-f]{8}$/);
+  });
+
+  test('inside-start lands the new element right after the opening tag', () => {
+    const out = applyInsertElementIntoArtboard(CANVAS, emptyCanvas, 'home', 'inside-start', 'text');
+    expect(out.source).toContain('<p style={{ margin: 0 }}>Text</p>');
+    expect(parses(out.source)).toBe(true);
+  });
+
+  test('image insert requires a contained asset src', () => {
+    expect(() =>
+      applyInsertElementIntoArtboard(CANVAS, emptyCanvas, 'home', 'inside-end', 'image')
+    ).toThrow(CanvasEditError);
+    const ok = applyInsertElementIntoArtboard(CANVAS, emptyCanvas, 'home', 'inside-end', 'image', {
+      src: 'assets/ab12cd34.png',
+    });
+    expect(ok.source).toContain('src="assets/ab12cd34.png"');
+    expect(parses(ok.source)).toBe(true);
+  });
+
+  test('unknown artboard id throws', () => {
+    expect(() =>
+      applyInsertElementIntoArtboard(CANVAS, emptyCanvas, 'nope', 'inside-end', 'div')
+    ).toThrow(CanvasEditError);
+  });
+});
+
 describe('canvas-edit / applyResizeArtboard (D4)', () => {
   const canvas = [
     'export default function Demo() {',

package/apps/studio/test/footage-store.test.ts

@@ -0,0 +1,100 @@
+// footage-store — round-trip + rejection coverage (feature-footage-analysis-director).
+// Uses a real temp designRoot on disk (Bun.write/Bun.file). Mirrors the photo
+// store's contract: valid analysis + EDL persist and read back; invalid input
+// returns a discriminated {ok:false,status} (never throws); traversal params in
+// the asset/slug are rejected by construction.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+import type { Context } from '../context.ts';
+import { assetSha8, createFootageStore, edlSlug } from '../footage-store.ts';
+
+let root: string;
+let store: ReturnType<typeof createFootageStore>;
+
+beforeAll(() => {
+  root = mkdtempSync(path.join(tmpdir(), 'footage-store-'));
+  const designRoot = path.join(root, '.design');
+  // Only the fields footage-store touches are needed.
+  store = createFootageStore({ paths: { designRoot } } as unknown as Context);
+});
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+
+describe('assetSha8 / edlSlug extraction', () => {
+  test('accepts the sha8 in every form', () => {
+    for (const p of ['assets/a1b2c3d4.mp4', '/assets/a1b2c3d4.png', 'a1b2c3d4.mov', 'a1b2c3d4'])
+      expect(assetSha8(p)).toBe('a1b2c3d4');
+  });
+  test('rejects traversal / non-hex', () => {
+    for (const p of ['../x', 'assets/../x', 'not-hex!', '', null]) expect(assetSha8(p)).toBeNull();
+  });
+  test('slug accepts kebab, rejects traversal / dots', () => {
+    expect(edlSlug('alligators-reel')).toBe('alligators-reel');
+    for (const s of ['../evil', 'has.dot', 'UPPER', '/abs', '']) expect(edlSlug(s)).toBeNull();
+  });
+});
+
+describe('analysis round-trip', () => {
+  test('saves a valid analysis and reads it back', async () => {
+    const res = await store.saveAnalysis('assets/a1b2c3d4.mp4', {
+      asset: 'assets/a1b2c3d4.mp4',
+      durationSec: 10,
+      shots: [{ start: 0, end: 3, usable: true, quality: 0.8 }],
+    });
+    expect(res.ok).toBe(true);
+    if (res.ok) expect(res.path).toBe('assets/a1b2c3d4.footage.json');
+    const back = await store.getAnalysis('a1b2c3d4');
+    expect(back?.shots?.[0].quality).toBe(0.8);
+    expect(back?.version).toBe(1);
+  });
+
+  test('rejects an invalid analysis with a 400 (never throws)', async () => {
+    const res = await store.saveAnalysis('assets/a1b2c3d4.mp4', { shots: [{ start: 5, end: 5 }] });
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.status).toBe(400);
+  });
+
+  test('rejects a bad asset param with a 400', async () => {
+    const res = await store.saveAnalysis('../evil', {});
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.status).toBe(400);
+  });
+
+  test('getAnalysis returns null for an absent sidecar', async () => {
+    expect(await store.getAnalysis('ffffffff')).toBeNull();
+  });
+});
+
+describe('EDL round-trip', () => {
+  test('saves a valid EDL under <slug>.edl.json and reads it back', async () => {
+    const res = await store.saveEdl('alligators-reel', {
+      title: 'Reel',
+      fps: 30,
+      width: 1920,
+      height: 1080,
+      beats: [{ clip: 'assets/a1b2c3d4.mp4', startSec: 0, durationFrames: 60, name: 'intro' }],
+    });
+    expect(res.ok).toBe(true);
+    if (res.ok) expect(res.path).toBe('alligators-reel.edl.json');
+    const back = await store.getEdl('alligators-reel');
+    expect(back?.beats?.[0].name).toBe('intro');
+    expect(back?.version).toBe(1);
+  });
+
+  test('rejects an EDL with an unbundled transition', async () => {
+    const res = await store.saveEdl('bad-reel', {
+      beats: [
+        {
+          clip: 'assets/a1b2c3d4.mp4',
+          startSec: 0,
+          durationFrames: 30,
+          transition: { presentation: 'zoom', frames: 5 },
+        },
+      ],
+    });
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.status).toBe(400);
+  });
+});

package/apps/studio/test/git-branches.test.ts

@@ -14,6 +14,8 @@ import {
   gitFetchRemote,
   gitFoldDraft,
   gitListBranches,
+  gitPull,
+  gitPush,
   remoteAheadBehind,
 } from '../git/service.ts';
 
@@ -111,6 +113,30 @@ test('fold: merges the draft into the Shared version locally; a tokenless publis
   expect((await gitListBranches(dir)).some((b) => b.name === 'nav')).toBe(true);
 });
 
+test('fold: a GitHub remote takes the PR path — pushes the draft, never locally merges main (DDR-162)', async () => {
+  // isGitHubRemote(github.com) → PR flow: publish the DRAFT branch (fails here — no
+  // real access) and NEVER merge/modify the local Shared version. `false` as the ssh
+  // command fails the transport instantly, so there's no network to github.com.
+  const prevSsh = process.env.GIT_SSH_COMMAND;
+  process.env.GIT_SSH_COMMAND = 'false';
+  const shared = (await gitListBranches(dir)).find((b) => b.current)?.name as string;
+  sh(['remote', 'add', 'origin', 'git@github.com:fake-org/fake-repo.git']);
+  await gitCreateBranch(dir, 'nav'); // now on 'nav'
+  writeFileSync(join(dir, 'b.txt'), 'draft work\n');
+  sh(['add', '.']);
+  sh(['commit', '-q', '-m', 'draft work']);
+  const r = await gitFoldDraft(dir, 'nav', undefined, {});
+  process.env.GIT_SSH_COMMAND = prevSsh ?? '';
+  // The draft push failed (fake repo) → not ok, and NOT the iso transport error…
+  expect(r.ok).toBe(false);
+  expect(r.error || '').not.toMatch(/unrecognized transport/i);
+  // …but crucially the Shared version was NEVER locally merged/modified…
+  sh(['checkout', shared]);
+  expect(existsSync(join(dir, 'b.txt'))).toBe(false);
+  // …and the draft still exists (nothing destroyed on a failed publish).
+  expect((await gitListBranches(dir)).some((b) => b.name === 'nav')).toBe(true);
+});
+
 // ── remote drafts (phase: surface remote branches) ───────────────────────────
 
 /** Stand up a bare "remote" with main + a teammate draft, clone it locally (system
@@ -197,6 +223,77 @@ test('an ssh remote routes to system git, never the iso transport error', async
   expect(r.error || '').not.toMatch(/unrecognized transport/i); // didn't fall into iso
 });
 
+// ── publish / get-latest over ssh (DDR-131/DDR-133 parity — the gap that shipped) ──
+// gitFetchRemote was hardened for ssh; gitPush/gitPull historically routed on the
+// USE_SYSTEM_GIT env flag only (default off) and fell into iso → "unrecognized
+// transport protocol: ssh". These prove the write paths now take the same gate.
+
+test('gitPush: an ssh remote routes to system git, never the iso transport error', async () => {
+  process.env.GIT_SSH_COMMAND =
+    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
+  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
+  const r = await gitPush(dir, undefined, {});
+  process.env.GIT_SSH_COMMAND = '';
+  expect(r.ok).toBe(false);
+  expect(r.authRequired).toBeFalsy(); // an ssh failure is not a GitHub sign-in prompt
+  expect(r.error || '').not.toMatch(/unrecognized transport/i); // didn't fall into iso
+});
+
+test('gitPull: an ssh remote routes to system git, never the iso transport error', async () => {
+  process.env.GIT_SSH_COMMAND =
+    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
+  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
+  const r = await gitPull(dir, undefined, {});
+  process.env.GIT_SSH_COMMAND = '';
+  expect(r.ok).toBe(false);
+  expect(r.authRequired).toBeFalsy();
+  expect(r.error || '').not.toMatch(/unrecognized transport/i);
+});
+
+test('SECURITY: gitPush refuses an unsafe (ext::) remote — no spawn, no RCE', async () => {
+  // A poisoned .git/config remote — must be refused BEFORE any git spawn (the payload
+  // never runs); classifyRemoteUrl reads the url via iso getConfig, not the git binary.
+  const sentinel = join(dir, 'PWNED_PUSH');
+  sh(['remote', 'add', 'origin', `ext::sh -c "touch ${sentinel}"`]);
+  const r = await gitPush(dir, 'tok_should_not_be_used', {});
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/github\.com/i); // "can only sync github.com…"
+  expect(existsSync(sentinel)).toBe(false); // payload NEVER executed
+});
+
+test('SECURITY: gitPush does not send the GitHub token to a non-GitHub HTTPS host', async () => {
+  sh(['remote', 'add', 'origin', 'https://evil.example.com/repo.git']);
+  const r = await gitPush(dir, 'tok_secret', {});
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/github\.com/i); // refused by policy, token never attached
+});
+
+test('SECURITY: a backslash-@ host-confusion remote is refused, PAT never attached (F1)', async () => {
+  // `https://github.com\@evil` — new URL() parses host=github.com (backslash → '/'),
+  // but git/curl dials `evil` (backslash = path/userinfo char). The token-host allowlist
+  // must reject the parser differential and NOT lend the PAT — on every token path:
+  // explicit fetch, the unattended ahead/behind probe (the zero-click trigger), and push.
+  sh(['remote', 'add', 'origin', 'https://github.com\\@evil.example/x.git']);
+  const f = await gitFetchRemote(dir, 'tok_secret');
+  expect(f.ok).toBe(false);
+  expect(f.error).toMatch(/github\.com/i); // refused by policy — token never attached
+  const ab = await remoteAheadBehind(dir, 'tok_secret');
+  expect(ab).toEqual({ ahead: 0, behind: 0 }); // the unattended probe refuses too (0/0, no fetch)
+  const p = await gitPush(dir, 'tok_secret', {});
+  expect(p.ok).toBe(false);
+  expect(p.error).toMatch(/github\.com/i);
+});
+
+test('SECURITY: the unattended probe refuses a repo with a url.insteadOf rewrite (verify re-review)', async () => {
+  // A clean github `origin.url` (passes isTrustedTokenHost) + a poisoned
+  // `url.<attacker>.insteadOf` that redirects github.com → attacker (only the system
+  // engine honors it). git would dial the attacker; the zero-click probe must refuse.
+  sh(['remote', 'add', 'origin', 'https://github.com/owner/repo.git']);
+  sh(['config', '--local', 'url.https://attacker.example/.insteadOf', 'https://github.com/']);
+  const ab = await remoteAheadBehind(dir, 'tok_secret');
+  expect(ab).toEqual({ ahead: 0, behind: 0 });
+});
+
 // ── transport-injection hardening (adversarial review of 75a2f0d) ────────────
 
 test('SECURITY: refuses to fetch an `ext::` (command-executing) remote — no spawn, no RCE', async () => {

package/apps/studio/test/github-api.test.ts

@@ -18,6 +18,7 @@ import git from 'isomorphic-git';
 import type { Context } from '../context.ts';
 import { createGitHubEndpoints, __testing as epTesting } from '../github/endpoints.ts';
 import {
+  createPullRequest,
   createRepo,
   GitHubApiError,
   getIdentity,
@@ -98,6 +99,59 @@ describe('GitHub REST request construction', () => {
     expect((err as GitHubApiError).message).toMatch(/already have a project with that name/i);
   });
 
+  test('createPullRequest POSTs title/head/base/body and shapes the result', async () => {
+    const calls = stubFetch(() =>
+      json({ number: 12, html_url: 'https://github.com/octocat/acme/pull/12' }, 201)
+    );
+    const pr = await createPullRequest('t', 'octocat', 'acme', {
+      head: 'nav-redesign',
+      base: 'main',
+      title: 'Add draft',
+      body: 'hi',
+    });
+    expect(pr).toEqual({ number: 12, html_url: 'https://github.com/octocat/acme/pull/12' });
+    expect(calls[0].url).toBe('https://api.github.com/repos/octocat/acme/pulls');
+    expect(calls[0].init?.method).toBe('POST');
+    expect(JSON.parse(calls[0].init?.body as string)).toEqual({
+      title: 'Add draft',
+      head: 'nav-redesign',
+      base: 'main',
+      body: 'hi',
+    });
+  });
+
+  test('createPullRequest recovers the existing PR link on a 422 (already exists)', async () => {
+    const calls = stubFetch((_url, init) =>
+      init?.method === 'POST'
+        ? json({ message: 'A pull request already exists for octocat:nav.' }, 422)
+        : json([{ number: 7, html_url: 'https://github.com/octocat/acme/pull/7' }])
+    );
+    const pr = await createPullRequest('t', 'octocat', 'acme', {
+      head: 'nav',
+      base: 'main',
+      title: 'x',
+    });
+    expect(pr).toEqual({ number: 7, html_url: 'https://github.com/octocat/acme/pull/7' });
+    // the recovery GET filters by head=owner:branch + base + state=open
+    expect(calls[1].url).toContain('head=octocat%3Anav');
+    expect(calls[1].url).toContain('base=main');
+    expect(calls[1].url).toContain('state=open');
+  });
+
+  test('createPullRequest maps a 422 with no existing PR to a "nothing new" message', async () => {
+    stubFetch((_url, init) =>
+      init?.method === 'POST' ? json({ message: 'No commits between main and nav' }, 422) : json([])
+    );
+    const err = await createPullRequest('t', 'octocat', 'acme', {
+      head: 'nav',
+      base: 'main',
+      title: 'x',
+    }).catch((e) => e);
+    expect(err).toBeInstanceOf(GitHubApiError);
+    expect((err as GitHubApiError).status).toBe(422);
+    expect((err as GitHubApiError).message).toMatch(/nothing new to add/i);
+  });
+
   test('inviteCollaborator PUTs permission=push, 201 = invited', async () => {
     const calls = stubFetch(() => json({ id: 1 }, 201));
     const r = await inviteCollaborator('t', 'octocat', 'acme', 'anna');
@@ -242,7 +296,8 @@ describe('token bridge fetch', () => {
     const calls = stubFetch(() => new Response('gho_secret\n', { status: 200 }));
     expect(tokenBridgeAvailable()).toBe(true);
     expect(await getGithubToken()).toBe('gho_secret');
-    expect((calls[0].init?.headers as Record<string, string>)['X-Maude-Token-Key']).toBe('k123');
+    const headers = calls[0].init?.headers as Record<string, string>;
+    expect(headers['X-Maude-Token-Key']).toBe('k123');
   });
 
   test('returns null on 404 (not signed in) and 403 (bad key)', async () => {

package/apps/studio/test/input-router.test.ts

@@ -348,6 +348,39 @@ describe('input-router / isEditableTarget', () => {
     const el = { tagName: 'DIV', isContentEditable: true } as HTMLElement;
     expect(isEditableTarget(el)).toBe(true);
   });
+
+  // Dogfood fix — the reported bug: typing "R" while editing in-canvas
+  // element text (canvas-shell.tsx's contenteditable="plaintext-only") fired
+  // the Rectangle tool shortcut. `.isContentEditable` SHOULD reflect
+  // "plaintext-only" per spec, but engine/version inconsistencies mean it
+  // can't be the only check — these lock in the raw-attribute fallback that
+  // now makes isEditableTarget resilient regardless.
+  test('contenteditable="plaintext-only" (isContentEditable false or unreliable) → true', () => {
+    const el = {
+      tagName: 'DIV',
+      isContentEditable: false,
+      getAttribute: (name: string) => (name === 'contenteditable' ? 'plaintext-only' : null),
+    } as unknown as HTMLElement;
+    expect(isEditableTarget(el)).toBe(true);
+  });
+
+  test('bare contenteditable="" attribute → true', () => {
+    const el = {
+      tagName: 'DIV',
+      isContentEditable: false,
+      getAttribute: (name: string) => (name === 'contenteditable' ? '' : null),
+    } as unknown as HTMLElement;
+    expect(isEditableTarget(el)).toBe(true);
+  });
+
+  test('plain div WITH a getAttribute method (real-element shape) still → false', () => {
+    const el = {
+      tagName: 'DIV',
+      isContentEditable: false,
+      getAttribute: () => null,
+    } as unknown as HTMLElement;
+    expect(isEditableTarget(el)).toBe(false);
+  });
 });
 
 // T25 — Drag-vs-click threshold. Centralized here so every drag-class gesture

package/apps/studio/test/inspect-script-syntax.test.ts

@@ -0,0 +1,53 @@
+// inspect-script-syntax.test.ts — regression guard for a real bug hit while
+// adding the photo-editor's background-removal busy shimmer: INSPECTOR_SCRIPT
+// (inspect.ts) is itself a giant template literal, so a stray backtick in an
+// inline comment silently truncates/reopens it — tsc DOES catch backtick
+// imbalance (it breaks the outer .ts file's own syntax), but nothing catches
+// any OTHER malformed-JS mistake inside the injected string (e.g. a stray
+// unescaped quote, mismatched braces in the CSS array). This test extracts the
+// actual injected <script> body and syntax-checks it directly.
+
+import { describe, expect, test } from 'bun:test';
+import { join } from 'node:path';
+
+import { type Context, createBus } from '../context.ts';
+import { createInspect } from '../inspect.ts';
+import { makeSandbox } from './_helpers.ts';
+
+function mkCtx(root: string, designRoot: string): Context {
+  return {
+    cfg: {} as Context['cfg'],
+    projectLabel: 'test',
+    bus: createBus(),
+    paths: {
+      repoRoot: root,
+      designRel: '.design',
+      designRoot,
+      serverInfoFile: join(designRoot, '_server.json'),
+      activeFile: join(designRoot, '_active.json'),
+      commentsDir: join(designRoot, '_comments'),
+      canvasStateDir: join(designRoot, '_canvas-state'),
+      historyDir: join(designRoot, '_history'),
+      tokensUrlRel: '',
+      systemDirRel: 'system',
+    },
+  };
+}
+
+describe('injectInspector — injected <script> is syntactically valid JS', () => {
+  test('the extracted script body compiles with no SyntaxError', () => {
+    const { root, designRoot } = makeSandbox();
+    const inspect = createInspect(mkCtx(root, designRoot), async () => []);
+    const out = inspect.injectInspector('<html><body></body></html>');
+
+    const scripts = [...out.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+    expect(scripts.length).toBeGreaterThan(0);
+
+    for (const body of scripts) {
+      // `new Function` only PARSES the body (no window/document access at
+      // construction time) — throws SyntaxError on malformed JS, exactly the
+      // class of bug a stray backtick / unbalanced brace produces.
+      expect(() => new Function(body)).not.toThrow();
+    }
+  });
+});

package/apps/studio/test/photo-canvas-bundle.test.ts

@@ -0,0 +1,61 @@
+// photo-canvas-bundle.test.ts — the automated guard for the lazy-bundle
+// acceptance criterion + BUILDER's flagged top risk (feature-photo-editor).
+//
+// A canvas that uses <PhotoLayer> with a NEUTRAL edit must pay ZERO pixi.js cost:
+// the ~500 KB pixi runtime must stay behind a LAZY runtime `import("pixi.js")`,
+// never an eager top-level `import ... from "pixi.js"`. Canvas builds run with
+// `splitting: false`, so this is fragile — a future refactor that turns the
+// compositor's pixi import back into a static import (or statically imports
+// pipeline.ts from canvas-lib) would silently re-break it. This test bundles a
+// real canvas via the actual dev-server pipeline and inspects the output.
+
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { buildCanvasModule } from '../canvas-build.ts';
+
+const CANVAS = `
+import { DesignCanvas, DCArtboard, PhotoLayer } from '@maude/canvas-lib';
+export default function C() {
+  return (
+    <DesignCanvas>
+      <DCArtboard id="a" width={200} height={200}>
+        <PhotoLayer source="assets/aaaa1111.png" edit={{}} width={120} height={120} alt="photo" />
+      </DCArtboard>
+    </DesignCanvas>
+  );
+}
+`;
+
+async function buildCanvas(source: string): Promise<string> {
+  const dir = mkdtempSync(join(tmpdir(), 'maude-photo-bundle-'));
+  const abs = join(dir, 'probe.tsx');
+  writeFileSync(abs, source);
+  try {
+    const { js } = await buildCanvasModule(abs, source, {});
+    return js;
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+describe('lazy-bundle guarantee — <PhotoLayer> keeps pixi out of the eager graph', () => {
+  test('an unedited PhotoLayer canvas has NO eager `from "pixi.js"` import', async () => {
+    const js = await buildCanvas(CANVAS);
+    const eager = [...js.matchAll(/import\s[^;]*?from\s*["']pixi\.js["']/g)];
+    expect(eager.length).toBe(0);
+  });
+
+  test('pixi is reachable only via a lazy runtime import("pixi.js")', async () => {
+    const js = await buildCanvas(CANVAS);
+    expect(/import\(\s*["']pixi\.js["']\s*\)/.test(js)).toBe(true);
+  });
+
+  test('the canvas still bundles PhotoLayer itself (sanity — the import resolved)', async () => {
+    const js = await buildCanvas(CANVAS);
+    // isDefaultEdit is the schema helper <PhotoLayer> calls on the render path.
+    expect(js.includes('isDefaultEdit') || js.includes('PhotoLayer')).toBe(true);
+  });
+});