@1agh/maude 0.49.1 → 0.50.0

package/apps/studio/http.ts

@@ -77,6 +77,7 @@ import {
 } from './generation/whisper-models.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
+import { createCloudEndpoints } from './cloud/endpoints.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
 import type { Inspect } from './inspect.ts';
 import { canvasSlug, writeLocator } from './locator.ts';
@@ -837,6 +838,11 @@ export function createHttp(
   // and every route is token-bearing (server-held keychain token via the loopback
   // bridge), so all four also carry a loopback-Host check.
   const githubApi = createGitHubEndpoints(ctx);
+  // Cloud Phase 23 C3 — `/_api/cloud/*`. Same dual-allowlist rule as the
+  // GitHub routes: MAIN-ORIGIN ONLY (absent from CANVAS_SAFE_API +
+  // startCanvasServer) and loopback-Host gated — every route either bears or
+  // stores the cloud credential.
+  const cloudApi = createCloudEndpoints(ctx);
   const gitJson = (r: { status: number; json: unknown }) =>
     Response.json(r.json, { status: r.status, headers: { 'Cache-Control': 'no-store' } });
 
@@ -1515,6 +1521,66 @@ export function createHttp(
       );
     },
 
+    // feature-file-tree-drag-drop-folders (Task 5) — move/rename a canvas.
+    // POST body { file, toDir } -> 200 { fromRel, toRel, fromSlug, toSlug, moved[] }
+    // Same guard stack as /_api/canvas, copied verbatim: MAIN ORIGIN ONLY —
+    // intentionally absent from BOTH startCanvasServer's allowlist and
+    // CANVAS_SAFE_API (DDR-054/DDR-088) — the untrusted canvas iframe origin
+    // must never reach a file-move endpoint. Validation lives in
+    // api.moveCanvas (containment + non-DS-group allowlist + collision +
+    // collab-pin guard).
+    '/_api/fs-move': async (req: Request) => {
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      const body = await readJson<{ file?: unknown; toDir?: unknown }>(req, 4 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.moveCanvas(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        {
+          ok: true,
+          fromRel: result.fromRel,
+          toRel: result.toRel,
+          fromSlug: result.fromSlug,
+          toSlug: result.toSlug,
+          moved: result.moved,
+        },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    // feature-file-tree-drag-drop-folders (Task 5) — create an empty folder.
+    // POST body { parent?, name } -> 201 { dir }. Same guard stack, same
+    // MAIN-ORIGIN-ONLY / dual-allowlist posture as /_api/fs-move above.
+    '/_api/fs-mkdir': async (req: Request) => {
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      const body = await readJson<{ parent?: unknown; name?: unknown }>(req, 4 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.createFolder(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, dir: result.dir },
+        { status: 201, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     // ── Phase 27 (E2) — in-UI git layer. Save version / Publish / Get latest /
     // History / visual diff. All MAIN-ORIGIN ONLY (see gitApi comment above).
     // POST routes add the sameOriginWrite CSRF guard (cross-site forged POST);
@@ -1663,6 +1729,53 @@ export function createHttp(
     // since every one is token-bearing. (Sign-out is the `github_sign_out` Tauri
     // command — the dev-server can't touch the OS keychain — so there is no
     // DELETE /_api/github/identity here; see DDR-114.)
+    '/_api/cloud/status': async (req: Request) => {
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(cloudApi.status());
+    },
+    '/_api/cloud/signin/start': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(await cloudApi.signinStart());
+    },
+    '/_api/cloud/signin/poll': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      const body = (await req.json().catch(() => ({}))) as { deviceCode?: string };
+      return gitJson(await cloudApi.signinPoll(String(body.deviceCode ?? '')));
+    },
+    '/_api/cloud/signout': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(cloudApi.signout());
+    },
+    '/_api/cloud/projects': async (req: Request) => {
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(await cloudApi.projects());
+    },
+    '/_api/cloud/attach': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      const body = (await req.json().catch(() => ({}))) as { project?: string };
+      return gitJson(await cloudApi.attach(String(body.project ?? '')));
+    },
+
     '/_api/github/identity': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       if (!isLoopbackHost(req.headers.get('host')))

package/apps/studio/inspect.ts

@@ -101,6 +101,16 @@ export interface Inspect {
   setActive(file: string): void;
   setOpenTabs(tabs: string[]): void;
   setSelected(sel: SetSelectedInput): void;
+  /**
+   * feature-file-tree-drag-drop-folders (Task 3) — a canvas moved server-side
+   * (`moveCanvas`). Retarget every reference to the OLD designRel-prefixed
+   * file path (`active`, `open_tabs[]`, the active `selected`) to the new
+   * one, and re-key the parked `selections` map entry from the old slug to
+   * the new one. Returns whether anything actually changed (so the caller
+   * can skip an unnecessary `canvas-list-update` detail). Idempotent no-op
+   * when the moved canvas wasn't referenced anywhere in this state.
+   */
+  retarget(fromFile: string, toFile: string): boolean;
   save(): Promise<void>;
   injectInspector(html: string): string;
 }
@@ -313,6 +323,44 @@ export function createInspect(
     ctx.bus.emit('selected', state.selected);
   }
 
+  function retarget(fromFile: string, toFile: string): boolean {
+    const fromSlug = deriveCanvasSlug(fromFile);
+    const toSlug = deriveCanvasSlug(toFile);
+    let changed = false;
+
+    if (state.active === fromFile) {
+      state.active = toFile;
+      changed = true;
+    }
+    if (state.open_tabs.includes(fromFile)) {
+      state.open_tabs = state.open_tabs.map((t) => (t === fromFile ? toFile : t));
+      changed = true;
+    }
+    if (Object.hasOwn(state.selections, fromSlug)) {
+      state.selections[toSlug] = state.selections[fromSlug] as SelectedValue;
+      delete state.selections[fromSlug];
+      changed = true;
+    }
+    if (state.selected != null) {
+      const list = Array.isArray(state.selected) ? state.selected : [state.selected];
+      let selChanged = false;
+      const next = list.map((e) => {
+        if (e.canvas !== fromSlug) return e;
+        selChanged = true;
+        return { ...e, canvas: toSlug, file: e.file === fromFile ? toFile : e.file };
+      });
+      if (selChanged) {
+        state.selected = Array.isArray(state.selected) ? next : (next[0] ?? null);
+        changed = true;
+      }
+    }
+
+    if (!changed) return false;
+    state.last_change = new Date().toISOString();
+    scheduleSave();
+    return true;
+  }
+
   /**
    * Canvas slug for v2 selections. Mirrors `canvasSlug()` from locator.ts but
    * accepts a designRoot-relative `file` path (which is what the iframe reports)
@@ -336,6 +384,7 @@ export function createInspect(
     setActive,
     setOpenTabs,
     setSelected,
+    retarget,
     save,
     injectInspector,
   };

package/apps/studio/server.ts

@@ -62,6 +62,10 @@ ctx.sharedDoc = /^(1|true|on|yes)$/i.test(process.env.MAUDE_SHARED_DOC ?? '');
 // synchronously below; the callback only fires at runtime, by which point the
 // binding is set.
 let collab: ReturnType<typeof createCollab> | null = null;
+// Forward-declared for the same reason — moveCanvas (feature-file-tree-
+// drag-drop-folders, Task 3) retargets `_active.json` through the live
+// Inspect instance, which is constructed after `api`.
+let inspectHandle: ReturnType<typeof createInspect> | null = null;
 
 const api = createApi(ctx, {
   onCommentsChanged: async (file) => {
@@ -82,9 +86,20 @@ const api = createApi(ctx, {
       collab.registry.syncRoomFromAnnotations(api.fileSlug(file), svg);
     }
   },
+  // feature-file-tree-drag-drop-folders (Task 3) — moveCanvas's collab guard
+  // + `_active.json` retarget, bridged the same forward-declared way as the
+  // comments/annotations hooks above.
+  isRoomPinned: (slug) => collab?.registry.isPinned(slug) ?? false,
+  flushAndDropRoom: async (slug) => {
+    if (collab) await collab.registry.forceDrop(slug);
+  },
+  retargetActive: (fromFile, toFile) => {
+    inspectHandle?.retarget(fromFile, toFile);
+  },
 });
 
 const inspect = createInspect(ctx, (file) => api.loadCommentsForFile(file));
+inspectHandle = inspect;
 await inspect.load();
 
 collab = createCollab(ctx, api);

package/apps/studio/test/canvas-artifacts.test.ts

@@ -0,0 +1,125 @@
+// canvas-artifacts.ts — the canonical artifact inventory. Pure, no server boot
+// needed: cover inventory completeness, the divergent `_locator.json` slug
+// shape, and relocatedName()'s path math for both a pure directory move and a
+// combined move+rename.
+
+import { describe, expect, test } from 'bun:test';
+import path from 'node:path';
+
+import { canvasArtifacts, locatorKeyFor, relocatedName } from '../canvas-artifacts.ts';
+import type { Paths } from '../context.ts';
+
+function fakePaths(repoRoot: string): Paths {
+  const designRoot = path.join(repoRoot, '.design');
+  return {
+    repoRoot,
+    designRel: '.design',
+    designRoot,
+    serverInfoFile: path.join(designRoot, '_server.json'),
+    activeFile: path.join(designRoot, '_active.json'),
+    commentsDir: path.join(designRoot, '_comments'),
+    canvasStateDir: path.join(designRoot, '_canvas-state'),
+    historyDir: path.join(designRoot, '_history'),
+    tokensUrlRel: '.design/system/colors_and_type.css',
+    systemDirRel: 'system',
+  };
+}
+
+describe('canvasArtifacts', () => {
+  const paths = fakePaths('/repo');
+
+  test('lists the primary + siblings + every slug-keyed sidecar', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const abs = artifacts.map((a) => a.abs);
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.tsx'));
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.meta.json'));
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.css'));
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.registry.json'));
+    const slug = 'ui-foo';
+    expect(abs).toContain(path.join(paths.historyDir, slug));
+    expect(abs).toContain(path.join(paths.canvasStateDir, `${slug}.json`));
+    expect(abs).toContain(path.join(paths.canvasStateDir, `${slug}.view.json`));
+    expect(abs).toContain(path.join(paths.commentsDir, `${slug}.json`));
+    expect(abs).toContain(path.join(paths.designRoot, '_state', `${slug}.ydoc.bin`));
+    expect(abs).toContain(path.join(paths.designRoot, `${slug}.annotations.svg`));
+    expect(abs).toContain(path.join(paths.designRoot, `${slug}.edl.json`));
+  });
+
+  test('does NOT include _photo/ or _draw/ (asset-keyed / mark-slug-keyed, not canvas-slug-keyed)', () => {
+    const abs = canvasArtifacts({ rel: 'ui/Foo.tsx', paths }).map((a) => a.abs);
+    expect(abs.some((p) => p.includes('_photo'))).toBe(false);
+    expect(abs.some((p) => p.includes('_draw'))).toBe(false);
+  });
+
+  test('marks exactly one primary and the rest sibling/slug-keyed', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const primaries = artifacts.filter((a) => a.kind === 'primary');
+    expect(primaries.length).toBe(1);
+    expect(primaries[0]?.abs).toBe(path.join(paths.designRoot, 'ui', 'Foo.tsx'));
+  });
+
+  test('handles a nested rel (subfolder)', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/sub/Bar.tsx', paths });
+    const primary = artifacts.find((a) => a.kind === 'primary');
+    expect(primary?.abs).toBe(path.join(paths.designRoot, 'ui', 'sub', 'Bar.tsx'));
+    const slug = 'ui-sub-bar';
+    expect(artifacts.some((a) => a.abs === path.join(paths.historyDir, slug))).toBe(true);
+  });
+});
+
+describe('locatorKeyFor — the DIVERGENT slug shape', () => {
+  test('posix, extension-less, NOT lowercased or dash-flattened', () => {
+    expect(locatorKeyFor('ui/Onboarding Brief.tsx')).toBe('ui/Onboarding Brief');
+  });
+
+  test('differs from canvasSlugFromRel for a mixed-case / spaced name', () => {
+    // canvasSlugFromRel('ui/Onboarding Brief.tsx', ...) => 'ui-onboarding_brief'
+    expect(locatorKeyFor('ui/Onboarding Brief.tsx')).not.toBe('ui-onboarding_brief');
+  });
+});
+
+describe('relocatedName', () => {
+  const paths = fakePaths('/repo');
+
+  test('pure directory move (basename unchanged) — siblings track the new dir', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const primary = artifacts.find((a) => a.kind === 'primary');
+    if (!primary) throw new Error('no primary');
+    expect(relocatedName(primary, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.designRoot, 'ui', 'sub', 'Foo.tsx')
+    );
+    const meta = artifacts.find((a) => a.abs.endsWith('Foo.meta.json'));
+    if (!meta) throw new Error('no meta sibling');
+    expect(relocatedName(meta, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.designRoot, 'ui', 'sub', 'Foo.meta.json')
+    );
+  });
+
+  test('slug-keyed sidecars stay in their fixed dir but re-key the filename', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const history = artifacts.find((a) => a.abs === path.join(paths.historyDir, 'ui-foo'));
+    if (!history) throw new Error('no history artifact');
+    expect(relocatedName(history, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.historyDir, 'ui-sub-foo')
+    );
+    const view = artifacts.find((a) => a.abs.endsWith('ui-foo.view.json'));
+    if (!view) throw new Error('no view artifact');
+    expect(relocatedName(view, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.canvasStateDir, 'ui-sub-foo.view.json')
+    );
+  });
+
+  test('a rename (same dir, new basename) re-keys both the sibling and the slug-keyed sidecar', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const primary = artifacts.find((a) => a.kind === 'primary');
+    if (!primary) throw new Error('no primary');
+    expect(relocatedName(primary, 'ui/Foo.tsx', 'ui/Bar.tsx', paths)).toBe(
+      path.join(paths.designRoot, 'ui', 'Bar.tsx')
+    );
+    const comments = artifacts.find((a) => a.abs === path.join(paths.commentsDir, 'ui-foo.json'));
+    if (!comments) throw new Error('no comments artifact');
+    expect(relocatedName(comments, 'ui/Foo.tsx', 'ui/Bar.tsx', paths)).toBe(
+      path.join(paths.commentsDir, 'ui-bar.json')
+    );
+  });
+});

package/apps/studio/test/canvas-create-api.test.ts

@@ -7,7 +7,14 @@
 //       covering happy path, the rejection matrix, group allowlist, duplicate.
 
 import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs';
 import { join } from 'node:path';
 
 import { componentNameFrom, renderBriefBoard, validateCanvasName } from '../canvas-create.ts';
@@ -455,6 +462,36 @@ describe('/_api/canvas — DELETE (soft-delete)', () => {
     }
   });
 
+  // Task 2 bug fix: deleteCanvas now consumes canvas-artifacts.ts's inventory,
+  // which closes two gaps the old hand-rolled sidecar list missed.
+  test('also trashes the .ydoc.bin cache and the footage EDL (bug fix — canvas-artifacts.ts inventory)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Full Sweep');
+      mkdirSync(join(designRoot, '_state'), { recursive: true });
+      const ydocAbs = join(designRoot, '_state', `${created.slug}.ydoc.bin`);
+      writeFileSync(ydocAbs, Buffer.from([1, 2, 3]));
+      const edlAbs = join(designRoot, `${created.slug}.edl.json`);
+      writeFileSync(edlAbs, JSON.stringify({ beats: [] }));
+
+      const r = await del(port, created.file);
+      expect(r.status).toBe(200);
+      const j = (await r.json()) as { ok: boolean; trashed: string[] };
+      expect(j.trashed.some((t) => t.endsWith('.ydoc.bin'))).toBe(true);
+      expect(j.trashed.some((t) => t.endsWith('.edl.json'))).toBe(true);
+      expect(existsSync(ydocAbs)).toBe(false);
+      expect(existsSync(edlAbs)).toBe(false);
+      const trashDirs = readdirSync(join(designRoot, '_trash'));
+      const td = join(designRoot, '_trash', trashDirs[0] as string);
+      expect(existsSync(join(td, `_state__${created.slug}.ydoc.bin`))).toBe(true);
+      expect(existsSync(join(td, `${created.slug}.edl.json`))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
   test('refuses to delete a design-system file (400, untouched)', async () => {
     const { root, designRoot } = makeSandbox();
     const port = nextPort();
@@ -507,3 +544,124 @@ describe('/_api/canvas — DELETE (soft-delete)', () => {
     }
   });
 });
+
+// feature-file-tree-drag-drop-folders (dogfood follow-up) — DELETE now
+// auto-detects a non-.tsx target as a folder delete.
+describe('/_api/canvas — DELETE (folder delete, dogfood follow-up)', () => {
+  async function createBoard(port: number, name: string) {
+    const r = await fetch(`http://localhost:${port}/_api/canvas`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name }),
+    });
+    return (await r.json()) as { file: string; slug: string };
+  }
+  const del = (port: number, file: string) =>
+    fetch(`http://localhost:${port}/_api/canvas?file=${encodeURIComponent(file)}`, {
+      method: 'DELETE',
+    });
+
+  test('deletes a folder: trashes every nested canvas, folder itself is gone', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const created = await createBoard(port, 'Inside');
+      const moved = await fetch(`http://localhost:${port}/_api/fs-move`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ file: created.file, toDir: 'ui/Box' }),
+      });
+      expect(moved.status).toBe(200);
+      expect(existsSync(join(designRoot, 'ui', 'Box', 'Inside.tsx'))).toBe(true);
+
+      const r = await del(port, 'ui/Box');
+      expect(r.status).toBe(200);
+      const j = (await r.json()) as { ok: boolean; trashed: string[] };
+      expect(j.ok).toBe(true);
+      expect(j.trashed.some((t) => t.endsWith('Inside.tsx'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'Box'))).toBe(false);
+      const trashDirs = readdirSync(join(designRoot, '_trash'));
+      expect(trashDirs.length).toBe(1);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('deletes an EMPTY folder (mkdir + delete, no canvases inside)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      await fetch(`http://localhost:${port}/_api/fs-mkdir`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ parent: 'ui', name: 'Empty' }),
+      });
+      expect(existsSync(join(designRoot, 'ui', 'Empty'))).toBe(true);
+      const r = await del(port, 'ui/Empty');
+      expect(r.status).toBe(200);
+      expect(existsSync(join(designRoot, 'ui', 'Empty'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses deleting a canvas GROUP ROOT (400, untouched)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await del(port, 'ui');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(designRoot, 'ui'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses deleting a design-system folder (400, untouched)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'system', 'sub'), { recursive: true });
+      const r = await del(port, 'system/sub');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(designRoot, 'system', 'sub'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a missing folder returns 404', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await del(port, 'ui/Nope');
+      expect(r.status).toBe(404);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  // Security review finding — see the matching tests in canvas-move-api.test.ts
+  // and fs-mkdir-api.test.ts.
+  test('refuses deleting a symlinked "folder" (would rm -rf outside designRoot)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const outside = join(root, 'OUTSIDE');
+    mkdirSync(outside, { recursive: true });
+    writeFileSync(join(outside, 'Secret.txt'), 'do not delete me');
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      symlinkSync(outside, join(designRoot, 'ui', 'evil'));
+      const r = await del(port, 'ui/evil');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(outside, 'Secret.txt'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});