@1agh/maude 0.49.2 → 0.50.0

package/apps/studio/test/fs-mkdir-api.test.ts

@@ -0,0 +1,248 @@
+// /_api/fs-mkdir — feature-file-tree-drag-drop-folders (Task 4). Folder-name
+// validation, containment, `.gitkeep`, collision.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { validateFolderName } from '../canvas-create.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+describe('validateFolderName', () => {
+  test('accepts ordinary names (incl. spaces + accents)', () => {
+    for (const n of ['Marketing', 'checkout-flow', 'Krok_1', 'Přihlášení']) {
+      const v = validateFolderName(n);
+      expect(v.ok).toBe(true);
+      expect(v.name).toBe(n);
+    }
+  });
+
+  const REJECT: Array<[string, unknown]> = [
+    ['empty', ''],
+    ['non-string', 123],
+    ['parent traversal', '../evil'],
+    ['forward slash', 'a/b'],
+    ['back slash', 'a\\b'],
+    ['leading dot', '.hidden'],
+    ['JSX break-out chars', 'a<b>'],
+    ['double quote', 'a"b'],
+    ['too long (61)', 'x'.repeat(61)],
+  ];
+  for (const [label, value] of REJECT) {
+    test(`rejects ${label}`, () => {
+      expect(validateFolderName(value).ok).toBe(false);
+    });
+  }
+});
+
+function mkdirReq(port: number, parent: string | undefined, name: string) {
+  return fetch(`http://localhost:${port}/_api/fs-mkdir`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ parent, name }),
+  });
+}
+
+describe('/_api/fs-mkdir — POST round-trip', () => {
+  test('creates an empty folder with a .gitkeep', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await mkdirReq(port, 'ui', 'New Folder');
+      expect(r.status).toBe(201);
+      const j = (await r.json()) as { ok: boolean; dir: string };
+      expect(j.ok).toBe(true);
+      expect(j.dir).toBe('.design/ui/New Folder');
+      expect(existsSync(join(designRoot, 'ui', 'New Folder'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'New Folder', '.gitkeep'))).toBe(true);
+      expect(readFileSync(join(designRoot, 'ui', 'New Folder', '.gitkeep'), 'utf8')).toBe('');
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('defaults parent to the design root when omitted', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      // "ui" IS a managed canvas group, so a folder directly under it works;
+      // an omitted parent (designRoot itself) is NOT inside any canvas group
+      // and must be refused — mirrors moveCanvas's group-membership rule.
+      const r = await mkdirReq(port, undefined, 'Root Folder');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('supports nested parents', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      await mkdirReq(port, 'ui', 'Parent');
+      const r = await mkdirReq(port, 'ui/Parent', 'Child');
+      expect(r.status).toBe(201);
+      expect(existsSync(join(designRoot, 'ui', 'Parent', 'Child', '.gitkeep'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses a parent that escapes the design root (400)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await mkdirReq(port, '../../../../tmp', 'Escape');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses a parent inside the design-system group (400)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'system'), { recursive: true });
+      const r = await mkdirReq(port, 'system', 'NotAllowed');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('rejects an invalid name (400)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await mkdirReq(port, 'ui', '../evil');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a collision with an existing folder returns 409', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui', 'Already'), { recursive: true });
+      const r = await mkdirReq(port, 'ui', 'Already');
+      expect(r.status).toBe(409);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a collision with an existing FILE (not just a dir) also returns 409', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      // NAME_RE forbids '.', so an extension-less file is the only way a
+      // FILE can collide with a valid folder name — statp() must catch it
+      // the same as a directory collision above.
+      writeFileSync(join(designRoot, 'ui', 'Taken'), 'not a folder');
+      const r = await mkdirReq(port, 'ui', 'Taken');
+      expect(r.status).toBe(409);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('emits a canvas-list-update "mkdir" action over the inspector WS', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    let socket: WebSocket | null = null;
+    try {
+      const messages: Array<{ type: string; payload?: Record<string, unknown> }> = [];
+      const sock = new WebSocket(`ws://localhost:${port}/_ws`);
+      socket = sock;
+      await new Promise<void>((res, rej) => {
+        sock.addEventListener('open', () => res());
+        sock.addEventListener('error', () => rej(new Error('ws error')));
+        setTimeout(() => rej(new Error('ws open timeout')), 2000);
+      });
+      sock.addEventListener('message', (ev) => {
+        try {
+          messages.push(JSON.parse(String(ev.data)));
+        } catch {
+          /* ignore */
+        }
+      });
+      const r = await mkdirReq(port, 'ui', 'Live Folder');
+      expect(r.status).toBe(201);
+
+      const deadline = Date.now() + 2000;
+      let hit: (typeof messages)[number] | undefined;
+      while (Date.now() < deadline && !hit) {
+        hit = messages.find(
+          (m) => m.type === 'canvas-list-update' && m.payload?.action === 'mkdir'
+        );
+        if (!hit) await Bun.sleep(25);
+      }
+      expect(hit?.payload?.dir).toBe('.design/ui/Live Folder');
+    } finally {
+      try {
+        socket?.close();
+      } catch {
+        /* ignore */
+      }
+      await killProc(proc);
+    }
+  }, 10_000);
+
+  test('unknown method (GET) returns 405', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await fetch(`http://localhost:${port}/_api/fs-mkdir`, { method: 'GET' });
+      expect(r.status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('rejects a cross-origin mkdir (CSRF guard)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await fetch(`http://localhost:${port}/_api/fs-mkdir`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Origin: 'http://evil.example' },
+        body: JSON.stringify({ parent: 'ui', name: 'Forged' }),
+      });
+      expect(r.status).toBe(403);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  // Security review finding — see the matching test in canvas-move-api.test.ts.
+  test('refuses creating a folder under a symlinked parent', async () => {
+    const { root, designRoot } = makeSandbox();
+    const outside = join(root, 'OUTSIDE');
+    mkdirSync(outside, { recursive: true });
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      symlinkSync(outside, join(designRoot, 'ui', 'link'));
+      const r = await mkdirReq(port, 'ui/link', 'Nested');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(outside, 'Nested'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/whats-new.json

@@ -1,6 +1,24 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "maude-cloud-signin-attach",
+      "version": "0.50.0",
+      "date": "2026-07-30",
+      "kind": "feature",
+      "title": "Sign in to Maude Cloud from the studio",
+      "summary": "The sidebar footer now signs you into Maude Cloud with a short code — no pasted addresses or keys — and connects this project to your cloud workspace in one click.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "file-tree-move-and-folders",
+      "version": "0.50.0",
+      "date": "2026-07-30",
+      "kind": "feature",
+      "title": "Organize your files — folders, drag & drop, move",
+      "summary": "The file tree is a real file explorer now. Create folders from the header or right-click a canvas or folder for Move to… / New folder here / Delete folder — or just drag a canvas (or a whole folder) onto another folder, including back out to the top level. Every history, comment, annotation, and camera position moves with it, and every move shows an Undo toast.",
+      "surface": "design-ui"
+    },
     {
       "id": "figma-smart-select",
       "version": "0.47.0",

package/cli/bin/maude.mjs

@@ -21,6 +21,7 @@ const COMMANDS = {
   kg: () => import('../commands/kg.mjs'),
   help: () => import('../commands/help.mjs'),
   hub: () => import('../commands/hub.mjs'),
+  share: () => import('../commands/share.mjs'),
   version: () => import('../commands/version.mjs'),
 };
 

package/cli/commands/hub-workspace.mjs

@@ -13,7 +13,7 @@
 // It does NOT claim to own the deployment afterwards — see `operatorDuties`.
 
 import { spawn } from 'node:child_process';
-import { randomBytes } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 
@@ -26,6 +26,7 @@ import {
   renderEnv,
   validateWorkspaceConfig,
   verificationPlan,
+  workspaceBaseUrl,
 } from '../lib/workspace-plan.mjs';
 
 export function usage() {
@@ -45,6 +46,13 @@ export function usage() {
   --s3-secret-access-key SECRET
   --s3-region REGION       default "auto"
   --dev-minio              run a local MinIO under the compose 'dev' profile
+  --local                  TESTING: serve plain HTTP on localhost, no
+                           certificate, no ACME. --domain defaults to
+                           "localhost" and must stay a loopback NAME.
+                           Lets you exercise the whole stack — and every
+                           verification step — on a laptop, with no domain and
+                           no paid account. Never serve a real workspace this
+                           way: sign-in passwords would travel in the clear.
   --seed-repo URL          clone an existing project; omit to start fresh
   --image-tag TAG          default "latest" — pin it before you rely on this
   --config FILE            read all of the above from a JSON file
@@ -63,7 +71,9 @@ export function usage() {
 }
 
 export async function run({ args, pkgRoot }) {
-  const { flags } = parseArgs(args, { booleans: ['dry-run', 'json', 'dev-minio'] });
+  const { flags } = parseArgs(args, {
+    booleans: ['help', 'dry-run', 'json', 'dev-minio', 'local'],
+  });
   if (flags.help) {
     process.stdout.write(usage());
     return;
@@ -79,6 +89,7 @@ export async function run({ args, pkgRoot }) {
       ? { adminPassword: flags['admin-password'] ?? raw.adminPassword }
       : {}),
     devMinio: flags['dev-minio'] === true || raw.devMinio === true,
+    local: flags.local === true || raw.local === true,
     seedRepo: flags['seed-repo'] ?? raw.seedRepo,
     imageTag: flags['image-tag'] ?? raw.imageTag,
     ...(flags['s3-endpoint'] || raw.s3
@@ -169,12 +180,27 @@ export async function run({ args, pkgRoot }) {
 
   process.stdout.write(`Wrote ${files.map((f) => f.name).join(', ')} to ${outDir}\n`);
   process.stdout.write('Starting the stack…\n');
-  const up = await sh('docker', ['compose', 'up', '-d'], { cwd: outDir });
+  // `--dev-minio` renders MinIO behind the `dev` compose profile, and a profile
+  // service does NOT start on a plain `compose up`. Rendering the bucket into
+  // the hub's config while never starting the bucket is the shape of failure
+  // that reports "storage configured" and then cannot store anything.
+  const composeArgs = config.s3?.dev
+    ? ['compose', '--profile', 'dev', 'up', '-d']
+    : ['compose', 'up', '-d'];
+  const up = await sh('docker', composeArgs, { cwd: outDir });
   if (up.code !== 0) {
     process.stderr.write(`docker compose up failed:\n${up.stderr}\n`);
     process.exit(1);
   }
 
+  // `compose up -d` returns when the containers are STARTED, not when they are
+  // SERVING. Verifying immediately reported "the workspace answers — ✗
+  // unreachable" against a stack that was healthy three seconds later: a false
+  // failure, which corrodes trust in the suite exactly as fast as a false pass.
+  // Bounded, and it gives up rather than waiting forever — a stack that never
+  // comes up must still be reported.
+  await waitForHealth(workspaceBaseUrl(config));
+
   // Verification is the deliverable. A URL printed without a proven round-trip
   // tells the operator something this command does not know.
   process.stdout.write('\nVerifying — this is the part that matters:\n');
@@ -202,7 +228,7 @@ export async function run({ args, pkgRoot }) {
     printDuties(duties);
     process.stdout.write(
       failed === 0
-        ? `\nWorkspace verified: https://${config.domain}\n`
+        ? `\nWorkspace verified: ${workspaceBaseUrl(config)}\n`
         : `\n${failed} check(s) did NOT pass. The stack is running but is not proven — fix and re-run.\n`
     );
   }
@@ -260,6 +286,29 @@ function sh(cmd, args, opts = {}) {
   });
 }
 
+/**
+ * Poll `/health` until the stack is serving, or give up.
+ *
+ * Deliberately silent on success and NEVER fatal: if the wait expires, the
+ * verification steps run anyway and report the real failure. This function
+ * removes a timing artefact; it must not become a second place that decides
+ * whether the deployment is good.
+ */
+async function waitForHealth(base, { timeoutMs = 45_000, intervalMs = 1_000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  let announced = false;
+  while (Date.now() < deadline) {
+    const res = await tryFetch(`${base}/health`);
+    if (res.ok) return true;
+    if (!announced) {
+      process.stdout.write('Waiting for the stack to answer…\n');
+      announced = true;
+    }
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+  return false;
+}
+
 async function which(bin) {
   const res = await sh(process.platform === 'win32' ? 'where' : 'which', [bin]);
   return res.code === 0;
@@ -272,8 +321,8 @@ async function which(bin) {
  * NEVER reports success. Counting an unrun check as passed is the single
  * fastest way to make a verification suite worthless.
  */
-async function runVerification(step, { config, hubSecret }) {
-  const base = `https://${config.domain}`;
+async function runVerification(step, { config, hubSecret, adminPassword, outDir, pkgRoot }) {
+  const base = workspaceBaseUrl(config);
   switch (step.id) {
     case 'health': {
       const res = await tryFetch(`${base}/health`);
@@ -285,6 +334,16 @@ async function runVerification(step, { config, hubSecret }) {
       });
       return res.ok ? { ok: true } : { ok: false, note: res.note };
     }
+    case 'user-signin':
+      return verifySignin(base, config.adminEmail, adminPassword);
+    case 'git-commit':
+      return verifyGitHistory(outDir);
+    case 's3-object':
+      return verifyBucketRoundTrip(config, pkgRoot);
+    case 's3-no-expiry':
+      return verifyNoLifecycle(config, pkgRoot);
+    case 'restore-drill':
+      return verifyRestoreDrill(config);
     default:
       return {
         ok: false,
@@ -294,6 +353,234 @@ async function runVerification(step, { config, hubSecret }) {
   }
 }
 
+/**
+ * The credential the operator is about to be handed actually works.
+ *
+ * This is the check that would have caught the shipped bug where a provisioned
+ * workspace had no users at all: every other check passed, the URL printed,
+ * and the first person to try the login was the one who found out.
+ */
+async function verifySignin(base, email, password) {
+  if (!password) return { ok: false, note: 'no admin password was generated' };
+  try {
+    const res = await fetch(`${base}/auth/login`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ email, password }),
+      signal: AbortSignal.timeout(10_000),
+    });
+    if (!res.ok) return { ok: false, note: `HTTP ${res.status} — the first user cannot sign in` };
+    const body = await res.json().catch(() => null);
+    return body?.token ? { ok: true } : { ok: false, note: 'login returned no session token' };
+  } catch (err) {
+    return { ok: false, note: err.name === 'TimeoutError' ? 'timed out' : 'unreachable' };
+  }
+}
+
+/**
+ * The server-side checkout has real commits (Cloud Phase 16).
+ *
+ * Read from INSIDE the container, because that is where the history lives.
+ * Checking a path on the operator's laptop would pass on a machine that
+ * happens to have a repo and tell us nothing about the deployment.
+ */
+async function verifyGitHistory(outDir) {
+  const probe = await sh(
+    'docker',
+    ['compose', 'exec', '-T', 'hub', 'git', '-C', '/repo', 'log', '-1', '--format=%H %an'],
+    { cwd: outDir }
+  );
+  if (probe.code !== 0) {
+    const err = `${probe.stderr}`.toLowerCase();
+    // A fresh workspace has no commits because nobody has edited anything yet.
+    // That is the NORMAL state five seconds after provisioning, and reporting
+    // it as a failure trains the operator to ignore a red mark — which is
+    // precisely what makes a real one invisible later. Skipped says the truth:
+    // this was not proven, and here is what would prove it.
+    if (err.includes('does not have any commits') || err.includes('bad default revision')) {
+      return {
+        ok: false,
+        skipped: true,
+        note: 'the checkout is ready but empty — edit a canvas, then re-run to prove autosave commits',
+      };
+    }
+    if (err.includes('not a git repository')) {
+      return {
+        ok: false,
+        note: 'the workspace has no checkout — server-side history is not running',
+      };
+    }
+    if (err.includes('executable file not found') || err.includes('not found')) {
+      return { ok: false, note: 'git is missing from the hub image — history cannot be kept' };
+    }
+    return { ok: false, note: `git log failed: ${probe.stderr.trim().slice(0, 120)}` };
+  }
+  const line = probe.stdout.trim();
+  if (!line) {
+    return {
+      ok: false,
+      skipped: true,
+      note: 'the checkout is ready but empty — edit a canvas, then re-run',
+    };
+  }
+  return { ok: true, note: `HEAD by ${line.split(' ').slice(1).join(' ') || 'unknown'}` };
+}
+
+/** Load the hub's S3 client from the installed package. */
+async function loadS3(pkgRoot) {
+  for (const candidate of [
+    resolve(pkgRoot, 'apps/hub/src/s3.mjs'),
+    resolve(pkgRoot, '../apps/hub/src/s3.mjs'),
+  ]) {
+    const mod = await import(`file://${candidate}`).catch(() => null);
+    if (mod) return mod;
+  }
+  return null;
+}
+
+function s3ConfigFrom(config) {
+  const s = config.s3;
+  // The dev MinIO endpoint (`http://minio:9000`) is a compose-network name.
+  // These checks run on the OPERATOR's machine, which cannot resolve it — but
+  // the compose file publishes the port, so loopback is the same bucket.
+  const endpoint = s.dev ? s.endpoint.replace('//minio:', '//127.0.0.1:') : s.endpoint;
+  return {
+    endpoint,
+    bucket: s.bucket,
+    accessKeyId: s.accessKeyId,
+    secretAccessKey: s.secretAccessKey,
+    region: s.region ?? 'auto',
+  };
+}
+
+/**
+ * A real object goes into the bucket and comes back out.
+ *
+ * Content-addressed, so the sentinel is indistinguishable from a genuine
+ * asset — and it is removed afterwards, because a verification step that
+ * litters a customer's bucket is a verification step people turn off.
+ */
+async function verifyBucketRoundTrip(config, pkgRoot) {
+  if (!config.s3) return { ok: false, skipped: true, note: 'no object storage configured' };
+  const s3 = await loadS3(pkgRoot);
+  if (!s3)
+    return { ok: false, skipped: true, note: 'the hub S3 client was not found in this install' };
+  const cfg = s3ConfigFrom(config);
+  const bytes = Buffer.from(`maude workspace-up sentinel\n`);
+  const key = `assets/${createHash('sha256').update(bytes).digest('hex').slice(0, 8)}.bin`;
+  try {
+    // The stack was declared healthy by the HUB's health check; object storage
+    // is a different container and may still be starting. A one-shot attempt
+    // here reported "fetch failed" against a MinIO that was serving four
+    // seconds later — a false failure, which corrodes the suite as fast as a
+    // false pass.
+    await retry(() => s3.putObject(cfg, key, bytes), { attempts: 6, delayMs: 2000 });
+    const head = await s3.headObject(cfg, key);
+    if (!head) return { ok: false, note: 'the object was written but could not be read back' };
+    if (head.size !== bytes.length) {
+      return { ok: false, note: `read back ${head.size} bytes, wrote ${bytes.length}` };
+    }
+    return { ok: true };
+  } catch (err) {
+    if (/NoSuchBucket/i.test(err.message)) {
+      return {
+        ok: false,
+        note: `the bucket "${cfg.bucket}" does not exist at ${cfg.endpoint} — create it, then re-run`,
+      };
+    }
+    if (/InvalidAccessKeyId|SignatureDoesNotMatch/i.test(err.message)) {
+      return { ok: false, note: 'object storage rejected the credentials' };
+    }
+    return { ok: false, note: `bucket rejected the round trip: ${err.message.slice(0, 120)}` };
+  } finally {
+    await s3.deleteObject(s3ConfigFrom(config), key).catch(() => {});
+  }
+}
+
+/**
+ * No lifecycle rule can expire the media.
+ *
+ * The quiet catastrophe this guards: assets are content-addressed and
+ * referenced from git history forever, so an expiry rule deletes objects that
+ * canvases still point at, with no recovery path and no error at the time.
+ *
+ * A bucket with NO lifecycle configuration answers 404 — that is the pass.
+ */
+async function verifyNoLifecycle(config, pkgRoot) {
+  if (!config.s3) return { ok: false, skipped: true, note: 'no object storage configured' };
+  const s3 = await loadS3(pkgRoot);
+  if (!s3?.signRequest) {
+    return { ok: false, skipped: true, note: 'the hub S3 client was not found in this install' };
+  }
+  const cfg = s3ConfigFrom(config);
+  try {
+    const signed = s3.signRequest(cfg, { method: 'GET', key: '', query: { lifecycle: '' } });
+    const res = await fetch(signed.url, {
+      method: 'GET',
+      headers: signed.headers,
+      signal: AbortSignal.timeout(15_000),
+    });
+    if (res.status === 404) return { ok: true, note: 'no lifecycle configuration' };
+    if (!res.ok) {
+      // Cannot read the config ⇒ cannot claim it is safe. Skipped, never passed.
+      return {
+        ok: false,
+        skipped: true,
+        note: `could not read lifecycle config (HTTP ${res.status})`,
+      };
+    }
+    const xml = await res.text();
+    const rules = xml.match(/<Rule>/g)?.length ?? 0;
+    if (rules === 0) return { ok: true, note: 'no lifecycle rules' };
+    // Any rule at all is reported. Deciding which prefixes a rule matches from
+    // its XML is exactly the kind of parsing that is wrong in the one case
+    // that matters, so this reports rather than adjudicates.
+    return {
+      ok: false,
+      note: `${rules} lifecycle rule(s) on this bucket — confirm none can expire assets/`,
+    };
+  } catch (err) {
+    return {
+      ok: false,
+      skipped: true,
+      note: `lifecycle check failed: ${err.message.slice(0, 100)}`,
+    };
+  }
+}
+
+/** A backup nobody has restored is a hypothesis. Runs the real drill. */
+async function verifyRestoreDrill(config) {
+  if (!config.s3) return { ok: false, skipped: true, note: 'no backup target configured' };
+  // The drill needs the hub's own data dir, which lives inside the container.
+  // Deliberately left to the operator's `maude hub restore-drill` rather than
+  // reaching into a volume from out here: a half-run drill that reports
+  // success is worse than an honest skip, and this is the one check whose
+  // whole point is that somebody actually did it.
+  return {
+    ok: false,
+    skipped: true,
+    note: 'run `maude hub restore-drill` against this deployment — it needs the hub data dir',
+  };
+}
+
+/** Retry a flaky-at-startup operation. Rethrows the LAST error, so the
+ *  reported cause is the real one rather than "timed out". */
+async function retry(fn, { attempts, delayMs }) {
+  let last;
+  for (let i = 0; i < attempts; i++) {
+    try {
+      return await fn();
+    } catch (err) {
+      last = err;
+      // A definitive answer from the service is not worth retrying — only the
+      // "not listening yet" shape is.
+      if (!/fetch failed|ECONNREFUSED|socket hang up/i.test(err.message)) throw err;
+      if (i < attempts - 1) await new Promise((r) => setTimeout(r, delayMs));
+    }
+  }
+  throw last;
+}
+
 async function tryFetch(url, init) {
   try {
     const ctrl = new AbortController();
@@ -312,7 +599,7 @@ async function tryFetch(url, init) {
 function printDryRun({ config, outDir, files, plan, duties, reusedSecret }) {
   process.stdout.write(
     `maude hub workspace-up — DRY RUN, nothing was written\n\n` +
-      `  workspace   https://${config.domain}\n` +
+      `  workspace   ${workspaceBaseUrl(config)}${config.local ? '  (LOCAL — plain HTTP)' : ''}\n` +
       `  first user  ${config.adminEmail}\n` +
       `  storage     ${config.s3 ? `${config.s3.bucket} @ ${config.s3.endpoint}${config.s3.dev ? ' (dev MinIO)' : ''}` : 'none — media stays in git'}\n` +
       `  project     ${config.seedRepo ?? 'starts fresh'}\n` +