@1agh/maude 0.43.0 → 0.45.0

package/apps/studio/test/csrf-write-guard.test.ts

@@ -18,7 +18,7 @@ import { describe, expect, test } from 'bun:test';
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
 
-import { sameOriginWrite } from '../http.ts';
+import { sameOriginRead, sameOriginWrite } from '../http.ts';
 
 const SELF = 'http://localhost:4399';
 const post = (origin?: string): Request =>
@@ -53,6 +53,28 @@ describe('CSRF Origin guard — sameOriginWrite (DDR-105)', () => {
   });
 });
 
+describe('CSRF read guard — sameOriginRead (Task 2.5 F1, Fetch-Metadata)', () => {
+  const get = (secFetchSite?: string): Request =>
+    new Request(`${SELF}/_api/generate/audio-search?q=x`, {
+      method: 'GET',
+      headers: { ...(secFetchSite ? { 'sec-fetch-site': secFetchSite } : {}) },
+    });
+
+  test('rejects a cross-site browser GET (key-bearing fan-out must not be CSRF-triggerable)', () => {
+    expect(sameOriginRead(get('cross-site'))).toBe(false);
+    expect(sameOriginRead(get('same-site'))).toBe(false);
+  });
+
+  test('allows a same-origin browser GET', () => {
+    expect(sameOriginRead(get('same-origin'))).toBe(true);
+    expect(sameOriginRead(get('none'))).toBe(true); // direct navigation
+  });
+
+  test('allows a non-browser client (CLI / curl — no Sec-Fetch-Site header)', () => {
+    expect(sameOriginRead(get())).toBe(true);
+  });
+});
+
 // phase-30 / DDR-120: the ai-activity bridge now projects `/_api/ai/*` POSTs
 // onto room awareness, which crosses the hub to every connected peer. So a
 // forged cross-origin POST to /start /heartbeat /end is no longer a harmless

package/apps/studio/test/design-setup-readiness.test.ts

@@ -0,0 +1,155 @@
+// Design-setup readiness probe (DDR-166 plan, Phase 2 / T6). A pure function
+// over a Context-shaped fixture — no server boot needed, `probeSetupReadiness`
+// only touches `ctx.cfg` + `ctx.paths` (both destructured, so a minimal fake
+// satisfies the type).
+
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { Context, DevServerConfig } from '../context.ts';
+import { probeSetupReadiness } from '../design-setup-readiness.ts';
+
+function fixtureCtx(opts: {
+  hasConfig?: boolean;
+  designSystems?: DevServerConfig['designSystems'];
+  canvasGroups?: DevServerConfig['canvasGroups'];
+  seedCanvas?: boolean;
+  seedTokens?: string[]; // ds names to write a real colors_and_type.css for
+  seedLogo?: string[]; // ds names to write a preview/logo.svg for
+}): Context {
+  const root = mkdtempSync(join(tmpdir(), 'maude-setup-readiness-'));
+  const designRoot = join(root, '.design');
+  mkdirSync(designRoot, { recursive: true });
+
+  const designSystems = opts.designSystems ?? [];
+  const canvasGroups = opts.canvasGroups ?? [
+    { label: 'Design system', path: 'system' },
+    { label: 'UI kit', path: 'ui' },
+  ];
+
+  for (const ds of designSystems) {
+    mkdirSync(join(designRoot, ds.path), { recursive: true });
+    if (opts.seedTokens?.includes(ds.name)) {
+      writeFileSync(join(designRoot, ds.path, 'colors_and_type.css'), ':root{}');
+    }
+    if (opts.seedLogo?.includes(ds.name)) {
+      mkdirSync(join(designRoot, ds.path, 'preview'), { recursive: true });
+      writeFileSync(join(designRoot, ds.path, 'preview', 'logo.svg'), '<svg/>');
+    }
+  }
+  if (opts.seedCanvas) {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(
+      join(designRoot, 'ui', 'Welcome.tsx'),
+      'export default function W(){return <main/>}\n'
+    );
+  }
+
+  const cfg: DevServerConfig = {
+    name: 'test',
+    projectLabel: null,
+    designRoot: '.design',
+    canvasGroups,
+    designSystems,
+    rootClass: 'app',
+    themeDefault: 'dark',
+    tokensCssRel: 'system/colors_and_type.css',
+    teamAccentDefault: null,
+    handoffTargets: [],
+    newCanvasDir: 'ui',
+    newComponentDir: 'ui/components',
+    _source: opts.hasConfig === false ? 'defaults' : '.design/config.json',
+  };
+
+  return {
+    cfg,
+    projectLabel: 'test',
+    paths: {
+      repoRoot: root,
+      designRel: '.design',
+      designRoot,
+      serverInfoFile: join(designRoot, '_server.json'),
+      activeFile: join(designRoot, '_active.json'),
+      commentsDir: join(designRoot, '_comments'),
+      canvasStateDir: join(designRoot, '_canvas-state'),
+      historyDir: join(designRoot, '_history'),
+      tokensUrlRel: 'system/colors_and_type.css',
+      systemDirRel: 'system',
+    },
+    bus: { on: () => () => {}, emit: () => {} },
+  } as Context;
+}
+
+describe('probeSetupReadiness', () => {
+  test('bare write_minimal_design scaffold: config missing, everything else missing too', async () => {
+    const report = await probeSetupReadiness(fixtureCtx({ hasConfig: false }));
+    expect(report.ready).toBe(false);
+    const byId = Object.fromEntries(report.items.map((i) => [i.id, i.status]));
+    expect(byId).toEqual({
+      project: 'missing',
+      'design-system': 'missing',
+      'first-canvas': 'missing',
+      'brand-assets': 'missing',
+    });
+  });
+
+  test('real config, no DS, no canvas: project present, rest missing', async () => {
+    const report = await probeSetupReadiness(fixtureCtx({ hasConfig: true }));
+    const byId = Object.fromEntries(report.items.map((i) => [i.id, i.status]));
+    expect(byId.project).toBe('present');
+    expect(byId['design-system']).toBe('missing');
+    expect(byId['first-canvas']).toBe('missing');
+    expect(byId['brand-assets']).toBe('missing');
+    expect(report.ready).toBe(false);
+  });
+
+  test('DS declared but tokens file absent: still missing (declared != on-disk)', async () => {
+    const report = await probeSetupReadiness(
+      fixtureCtx({
+        hasConfig: true,
+        designSystems: [
+          { name: 'acme', path: 'system/acme', tokensCssRel: 'system/acme/colors_and_type.css' },
+        ],
+      })
+    );
+    const item = report.items.find((i) => i.id === 'design-system')!;
+    expect(item.status).toBe('missing');
+    expect(item.detail).toContain('Declared in config');
+  });
+
+  test('all four present → ready: true', async () => {
+    const report = await probeSetupReadiness(
+      fixtureCtx({
+        hasConfig: true,
+        designSystems: [
+          { name: 'acme', path: 'system/acme', tokensCssRel: 'system/acme/colors_and_type.css' },
+        ],
+        seedTokens: ['acme'],
+        seedLogo: ['acme'],
+        seedCanvas: true,
+      })
+    );
+    expect(report.items.every((i) => i.status === 'present')).toBe(true);
+    expect(report.ready).toBe(true);
+  });
+
+  test('a "system" canvas group never counts as the first user canvas', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'maude-setup-readiness-'));
+    const designRoot = join(root, '.design');
+    const canvasGroups = [{ label: 'Design system', path: 'system' }];
+    mkdirSync(join(designRoot, 'system'), { recursive: true });
+    writeFileSync(
+      join(designRoot, 'system', 'specimen.tsx'),
+      'export default function S(){return <main/>}\n'
+    );
+    const ctx = fixtureCtx({ hasConfig: true, canvasGroups });
+    // Overwrite paths.designRoot/repoRoot to point at this second fixture dir
+    // (fixtureCtx already made its own scratch dir we don't need here).
+    ctx.paths.repoRoot = root;
+    ctx.paths.designRoot = designRoot;
+    const report = await probeSetupReadiness(ctx);
+    expect(report.items.find((i) => i.id === 'first-canvas')!.status).toBe('missing');
+  });
+});

package/apps/studio/test/element-structural-edit.test.ts

@@ -12,6 +12,8 @@ import {
   applyInsertElement,
   applyInsertElementIntoArtboard,
   applyResizeArtboard,
+  applySetArtboardHug,
+  applySetArtboardStyle,
   CanvasEditError,
 } from '../canvas-edit.ts';
 import { transpileCanvasSource } from '../canvas-pipeline.ts';
@@ -231,6 +233,112 @@ describe('canvas-edit / applyResizeArtboard (D4)', () => {
   });
 });
 
+describe('canvas-edit / applySetArtboardHug (Hug ⇄ Fixed toggle)', () => {
+  const canvas = [
+    'export default function Demo() {',
+    '  return (',
+    '    <DesignCanvas>',
+    '      <DCArtboard id="home" label="Home" width={1440} height={1024}>',
+    '        <div>content</div>',
+    '      </DCArtboard>',
+    '    </DesignCanvas>',
+    '  );',
+    '}',
+  ].join('\n');
+
+  test('fixed=true adds the bare boolean prop, no string/expr value', () => {
+    const out = applySetArtboardHug(CANVAS, canvas, 'home', true);
+    expect(out.source).toMatch(/<DCArtboard\b[^>]*\bfixed\b(?!=)[^>]*>/);
+    expect(out.source).not.toContain('fixed={true}');
+    expect(out.source).not.toContain('fixed="true"');
+    expect(parses(out.source)).toBe(true);
+  });
+
+  test('fixed=true with freezeHeight also pins height (numeric prop)', () => {
+    const out = applySetArtboardHug(CANVAS, canvas, 'home', true, 777);
+    expect(out.source).toContain('fixed');
+    expect(out.source).toContain('height={777}');
+    expect(parses(out.source)).toBe(true);
+  });
+
+  test('fixed=true is idempotent — no duplicate attr on a board already pinned', () => {
+    const once = applySetArtboardHug(CANVAS, canvas, 'home', true);
+    const twice = applySetArtboardHug(CANVAS, once.source, 'home', true);
+    expect(twice.source.match(/\bfixed\b/g)?.length).toBe(1);
+  });
+
+  test('fixed=false removes the prop, height untouched', () => {
+    const pinned = applySetArtboardHug(CANVAS, canvas, 'home', true, 777);
+    const out = applySetArtboardHug(CANVAS, pinned.source, 'home', false);
+    expect(out.source).not.toContain('fixed');
+    expect(out.source).toContain('height={777}'); // stays as the hug floor
+    expect(parses(out.source)).toBe(true);
+  });
+
+  test('fixed=false on an already-hug board is a no-op', () => {
+    const out = applySetArtboardHug(CANVAS, canvas, 'home', false);
+    expect(out.source).toBe(canvas);
+  });
+
+  test('unknown artboard id throws', () => {
+    expect(() => applySetArtboardHug(CANVAS, canvas, 'nope', true)).toThrow(CanvasEditError);
+  });
+});
+
+describe('canvas-edit / applySetArtboardStyle (background/padding/layout/gap)', () => {
+  const canvas = [
+    'export default function Demo() {',
+    '  return (',
+    '    <DesignCanvas>',
+    '      <DCArtboard id="home" label="Home" width={1440} height={1024}>',
+    '        <div>content</div>',
+    '      </DCArtboard>',
+    '    </DesignCanvas>',
+    '  );',
+    '}',
+  ].join('\n');
+
+  test('writes background/layout as string literals, padding/gap as numeric', () => {
+    const out = applySetArtboardStyle(CANVAS, canvas, 'home', {
+      background: 'var(--bg-1)',
+      layout: 'flex-col',
+      padding: 16,
+      gap: 8,
+    });
+    expect(out.source).toContain('background="var(--bg-1)"');
+    expect(out.source).toContain('layout="flex-col"');
+    expect(out.source).toContain('padding={16}');
+    expect(out.source).toContain('gap={8}');
+    expect(parses(out.source)).toBe(true);
+  });
+
+  test('padding/gap of 0 is written verbatim, not clamped to 1', () => {
+    const out = applySetArtboardStyle(CANVAS, canvas, 'home', { padding: 0, gap: 0 });
+    expect(out.source).toContain('padding={0}');
+    expect(out.source).toContain('gap={0}');
+  });
+
+  test('null resets a previously-set prop (removes the attribute)', () => {
+    const styled = applySetArtboardStyle(CANVAS, canvas, 'home', { background: 'red' });
+    const out = applySetArtboardStyle(CANVAS, styled.source, 'home', { background: null });
+    expect(out.source).not.toContain('background=');
+    expect(parses(out.source)).toBe(true);
+  });
+
+  test('an absent key leaves that prop untouched', () => {
+    const styled = applySetArtboardStyle(CANVAS, canvas, 'home', { background: 'red', padding: 4 });
+    const out = applySetArtboardStyle(CANVAS, styled.source, 'home', { padding: 8 });
+    expect(out.source).toContain('background="red"'); // untouched
+    expect(out.source).toContain('padding={8}');
+  });
+
+  test('unknown artboard id throws', () => {
+    expect(() => applySetArtboardStyle(CANVAS, canvas, 'nope', { padding: 4 })).toThrow(
+      CanvasEditError
+    );
+  });
+});
+
 describe('canvas-edit / applyInsertArtboard (I4)', () => {
   const canvas = [
     'export default function Demo() {',

package/apps/studio/test/fixtures/fake-claude-auth.mjs

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+// Test fixture standing in for the `claude` CLI — implements only the one
+// subcommand probeAcpAvailabilityAuthed()/getClaudeAuthStatus() shell out to.
+// FAKE_CLAUDE_LOGGED_IN=1 controls the reported sign-in state.
+const [, , cmd, sub] = process.argv;
+if (cmd === 'auth' && sub === 'status') {
+  const loggedIn = process.env.FAKE_CLAUDE_LOGGED_IN === '1';
+  process.stdout.write(
+    JSON.stringify({ loggedIn, apiProvider: loggedIn ? 'firstParty' : undefined })
+  );
+  process.exit(0);
+}
+process.exit(1);

package/apps/studio/test/generate-route.test.ts

@@ -0,0 +1,106 @@
+// generate-route.test.ts — the privileged /_api/generate* routes on the MAIN
+// origin. Boots a real server (no CANVAS_ORIGIN_SPLIT; loopback host). Proves:
+// validation rejects bad bodies; a key POST reports {configured} and GET never
+// echoes the value; the provider catalogue serializes with a presence flag; and
+// a generate POST enqueues a job (202 {jobId}) that fails cleanly with no key
+// configured (no real Google call). Points MAUDE_GEN_KEYS_PATH at the sandbox
+// so the user's real key store is never touched.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+let keysDir: string;
+beforeEach(() => {
+  keysDir = mkdtempSync(join(tmpdir(), 'maude-genroute-'));
+});
+afterEach(() => rmSync(keysDir, { recursive: true, force: true }));
+
+describe('/_api/generate* main-origin routes', () => {
+  test('providers catalogue, key custody (no echo), validation, and enqueue', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_GEN_KEYS_PATH: join(keysDir, 'keys.json'),
+    });
+    const base = `http://localhost:${port}`;
+    try {
+      // Provider catalogue — gemini present, not yet configured.
+      const provRes = await fetch(`${base}/_api/generate/providers`);
+      expect(provRes.status).toBe(200);
+      const provJson = (await provRes.json()) as {
+        providers: Array<{ id: string; configured: boolean }>;
+      };
+      const gemini = provJson.providers.find((p) => p.id === 'gemini');
+      expect(gemini).toBeTruthy();
+      expect(gemini?.configured).toBe(false);
+
+      // Set a key → {configured:true}; the value is NEVER echoed back.
+      const setRes = await fetch(`${base}/_api/generate/keys`, {
+        method: 'POST',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ provider: 'gemini', key: 'AIza-super-secret' }),
+      });
+      expect(setRes.status).toBe(200);
+      const setJson = (await setRes.json()) as Record<string, unknown>;
+      expect(setJson.configured).toBe(true);
+      expect(JSON.stringify(setJson)).not.toContain('super-secret');
+
+      // GET key status → presence only, no value.
+      const statusRes = await fetch(`${base}/_api/generate/keys`);
+      const statusJson = (await statusRes.json()) as { configured: string[] };
+      expect(statusJson.configured).toContain('gemini');
+      expect(JSON.stringify(statusJson)).not.toContain('super-secret');
+
+      // Validation — a malformed generate body 400s before any provider call.
+      const badRes = await fetch(`${base}/_api/generate-jobs`, {
+        method: 'POST',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ modality: 'hologram', provider: '../etc' }),
+      });
+      expect(badRes.status).toBe(400);
+
+      // Unknown provider 400s.
+      const unkRes = await fetch(`${base}/_api/generate-jobs`, {
+        method: 'POST',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ modality: 'image', provider: 'nope', prompt: 'x' }),
+      });
+      expect(unkRes.status).toBe(400);
+
+      // A well-formed request enqueues → 202 { jobId }. (The run will hit the
+      // real Gemini endpoint with a bogus key and fail in the background — we
+      // only assert the queue accepted it and surfaces the job.)
+      const okRes = await fetch(`${base}/_api/generate-jobs`, {
+        method: 'POST',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ modality: 'image', provider: 'gemini', prompt: 'a red circle' }),
+      });
+      expect(okRes.status).toBe(202);
+      const okJson = (await okRes.json()) as { jobId: string };
+      expect(okJson.jobId).toMatch(/^gen_/);
+
+      // The job shows up in the list.
+      const listRes = await fetch(`${base}/_api/generate-jobs`);
+      const listJson = (await listRes.json()) as { jobs: Array<{ id: string }> };
+      expect(listJson.jobs.some((j) => j.id === okJson.jobId)).toBe(true);
+
+      // Remove the key.
+      const delRes = await fetch(`${base}/_api/generate/keys`, {
+        method: 'DELETE',
+        headers: { 'content-type': 'text/plain' },
+        body: JSON.stringify({ provider: 'gemini' }),
+      });
+      expect(delRes.status).toBe(200);
+      const afterDel = (await (await fetch(`${base}/_api/generate/keys`)).json()) as {
+        configured: string[];
+      };
+      expect(afterDel.configured).not.toContain('gemini');
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/test/import-asset-browser.test.ts

@@ -0,0 +1,64 @@
+// Browser-driven pieces of local-file/SVG/PDF ingestion (DDR-167) — the SVG
+// execution canary. Spawns real agent-browser sessions, so this is slower
+// than import-asset.test.ts and is skipped (not failed) when agent-browser
+// can't be resolved, mirroring how the rest of this codebase treats
+// browser-dependent verification as a real-environment concern rather than a
+// hard CI requirement (e.g. ensure-browser.test.ts's resolution-only tests).
+//
+// DDR-167 requires the SVG canary fixtures be a PERMANENT regression test,
+// not a one-time pre-ship check — this file is that test. The PDF rasterize
+// adversarial fixtures (OpenAction/JS canary, SubmitForm/URI/Launch) are NOT
+// here: live spike-verification found the planned rasterization mechanism
+// (headless-Chromium navigating a file://*.pdf URL) does not render PDF
+// content under agent-browser automation (confirmed blank output on both
+// chrome-headless-shell and full Chrome) — see DDR-167's addendum. PDF
+// rasterization throws "not yet available" rather than shipping broken
+// output; there is nothing to fixture-test until a follow-up mechanism lands.
+
+import { describe, expect, test } from 'bun:test';
+import { execFileSync } from 'node:child_process';
+
+import { rasterizePdfPage, runSvgExecutionCanary } from '../bin/_import-asset.mjs';
+
+function agentBrowserAvailable(): boolean {
+  try {
+    execFileSync(process.env.MAUDE_AGENT_BROWSER_BIN || 'agent-browser', ['--version'], {
+      stdio: 'ignore',
+      timeout: 5000,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const HAS_AGENT_BROWSER = agentBrowserAvailable();
+const d = HAS_AGENT_BROWSER ? describe : describe.skip;
+
+d('SVG execution canary (Decision 1, step 6) — permanent regression fixtures', () => {
+  test('accepts a clean, allowlist-sanitized SVG (no false positive)', async () => {
+    const clean =
+      '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M16 5l2.8 8.2L27 16l-8.2 2.8L16 27l-2.8-8.2L5 16l8.2-2.8z" fill="#4f46e5"/></svg>';
+    await expect(runSvgExecutionCanary(clean)).resolves.toBe(clean);
+  }, 30_000);
+
+  test('trips on a raw <script>-bearing SVG (defense-in-depth if the allowlist sanitizer were ever bypassed)', async () => {
+    const malicious =
+      '<svg xmlns="http://www.w3.org/2000/svg"><script>window.__MAUDE_IMPORT_CANARY__=true;</script></svg>';
+    await expect(runSvgExecutionCanary(malicious)).rejects.toThrow(/canary tripped/);
+  }, 30_000);
+
+  test('the sandboxed-render helper does not block the file:// navigation it needs (regression: a bare "*" network route also blocks local file loads)', async () => {
+    // A file:// SVG with no scripting at all must still load and be
+    // observable — this specifically guards against re-introducing the
+    // wildcard-route regression found during implementation.
+    const trivial = '<svg xmlns="http://www.w3.org/2000/svg"><rect width="1" height="1"/></svg>';
+    await expect(runSvgExecutionCanary(trivial)).resolves.toBeTruthy();
+  }, 30_000);
+});
+
+d('PDF rasterization — explicitly NOT shipped (DDR-167 addendum)', () => {
+  test('rasterizePdfPage throws "not yet available" rather than producing output', async () => {
+    await expect(rasterizePdfPage('/nonexistent.pdf', 1)).rejects.toThrow(/not yet available/);
+  });
+});

package/apps/studio/test/import-asset-route.test.ts

@@ -0,0 +1,71 @@
+// POST /_api/import-asset — DDR-167 (Phase 3 / T10). Full HTTP round-trip
+// against a real booted server (privilege/CSRF boundary is covered generically
+// by canvas-origin-gate.test.ts — this file exercises the route's own
+// success/error shapes).
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const MALICIOUS_SVG =
+  '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script>' +
+  '<rect onclick="alert(2)" fill="#4f46e5" width="10" height="10"/></svg>';
+
+describe('POST /_api/import-asset', () => {
+  test('imports and sanitizes an SVG, rejects a PDF kind as not-yet-available, rejects GET', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const base = `http://localhost:${port}`;
+
+      const post = await fetch(`${base}/_api/import-asset`, {
+        method: 'POST',
+        headers: { 'X-Import-Kind': 'svg', Origin: base },
+        body: MALICIOUS_SVG,
+      });
+      expect(post.status).toBe(201);
+      const body = (await post.json()) as { ok: boolean; path: string };
+      expect(body.ok).toBe(true);
+      expect(body.path).toMatch(/^assets\/[a-z0-9]{8}\.svg$/);
+      const written = readFileSync(`${designRoot}/${body.path}`, 'utf8');
+      expect(written).not.toContain('script');
+      expect(written).not.toContain('onclick');
+
+      const pdfAttempt = await fetch(`${base}/_api/import-asset`, {
+        method: 'POST',
+        headers: { 'X-Import-Kind': 'pdf', Origin: base },
+        body: '%PDF-1.4 fixture',
+      });
+      expect(pdfAttempt.status).toBe(501);
+      const pdfBody = (await pdfAttempt.json()) as { ok: boolean; error: string };
+      expect(pdfBody.ok).toBe(false);
+      expect(pdfBody.error).toContain('not yet available');
+
+      const getAttempt = await fetch(`${base}/_api/import-asset`, { method: 'GET' });
+      expect(getAttempt.status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('a malformed SVG is rejected with a clean 400, not a 500 crash', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const base = `http://localhost:${port}`;
+      const res = await fetch(`${base}/_api/import-asset`, {
+        method: 'POST',
+        headers: { 'X-Import-Kind': 'svg', Origin: base },
+        body: '<svg><rect',
+      });
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { ok: boolean };
+      expect(body.ok).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+});