@1agh/maude 1.0.11 → 1.2.0

package/apps/studio/test/fixtures/perf-canvas.mjs

@@ -1,201 +0,0 @@
-// perf-canvas.mjs — deterministic large-canvas fixture generator.
-//
-// Produces the synthetic worst-case the render-performance work is measured
-// against: N artboards on one world plane plus M annotation stickies, with NO
-// filters, blends or feTurbulence. That absence is the point — the earlier
-// moodboard RCA (.ai/archive/logs/rca/issue-canvas-pan-zoom-jank-large-
-// moodboard.md) covered the expensive-paint regime; the failures this fixture
-// reproduces (a 128-artboard onboarding flow, a sticky-dense FigJam board) are
-// the opposite shape: cheap paint, huge node count. Mixing filters back in
-// would re-measure the case that is already fixed.
-//
-// Written as .mjs rather than the .ts the plan named, because the probe
-// (`_perf-probe.mjs`) runs under plain node and imports this module directly;
-// bun tests import .mjs identically, so nothing is lost.
-//
-// Deterministic by construction — no Date.now(), no Math.random(). Two runs
-// produce byte-identical files, so a re-measured baseline compares like with
-// like.
-
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-
-/** Grid geometry — mirrors DesignCanvas's own default grid vocabulary. */
-const BOARD_W = 1280;
-const BOARD_H = 800;
-const GUTTER = 80;
-const COLS = 8;
-
-/** Sticky geometry, matching the imported-FigJam shape (240px square, r=8). */
-const STICKY = 240;
-const STICKY_GAP = 40;
-const STICKY_COLS = 12;
-
-// Fixed word pool — index-addressed, never shuffled, so labels stay stable
-// across regenerations.
-const WORDS = [
-  'Onboarding',
-  'Signup',
-  'Paywall',
-  'Empty state',
-  'Error',
-  'Success',
-  'Profile',
-  'Settings',
-  'Search',
-  'Detail',
-  'Checkout',
-  'Review',
-];
-
-const STICKY_TEXT = [
-  'Ship the import path',
-  'Cut the cold start',
-  'Fewer modal steps',
-  'Copy is too long',
-  'Needs an empty state',
-  'Great onboarding',
-  'Slow on mobile',
-  'Loved the polish',
-];
-
-/** Deterministic pseudo-shuffle: a fixed odd stride over the pool. */
-function pick(pool, i) {
-  return pool[(i * 7) % pool.length];
-}
-
-/**
- * Body markup for one artboard. Deliberately ~35 DOM nodes — a realistic mock,
- * not an empty box. An empty artboard would understate reconciliation cost and
- * flatter every measurement taken against this fixture.
- */
-function artboardBody(i) {
-  const rows = Array.from(
-    { length: 6 },
-    (_, r) => `
-          <div style={{ display: 'flex', gap: 12, alignItems: 'center' }}>
-            <div style={{ width: 32, height: 32, borderRadius: 6, background: 'var(--bg-2, #e8e3d8)' }} />
-            <div style={{ flex: 1 }}>
-              <div style={{ height: 10, width: '${40 + ((i + r) % 5) * 10}%', borderRadius: 3, background: 'var(--bg-3, #ddd6c8)' }} />
-              <div style={{ height: 8, width: '${25 + ((i + r) % 4) * 8}%', marginTop: 6, borderRadius: 3, background: 'var(--bg-2, #e8e3d8)' }} />
-            </div>
-            <div style={{ width: 56, height: 24, borderRadius: 4, background: 'var(--accent, #6b5bd6)', opacity: 0.18 }} />
-          </div>`
-  ).join('');
-
-  return `
-        <div style={{ padding: 32, display: 'flex', flexDirection: 'column', gap: 16 }}>
-          <h2 style={{ margin: 0, font: '600 24px/1.2 var(--font-sans, system-ui)' }}>${pick(WORDS, i)} ${i}</h2>
-          <p style={{ margin: 0, font: '400 14px/1.5 var(--font-sans, system-ui)', opacity: 0.7 }}>
-            Synthetic perf fixture board ${i} — no filters, no blends, cheap paint.
-          </p>${rows}
-        </div>`;
-}
-
-/** Build the canvas .tsx source for `boards` artboards. */
-export function renderCanvasSource(boards) {
-  const items = Array.from({ length: boards }, (_, i) => {
-    const col = i % COLS;
-    const row = Math.floor(i / COLS);
-    const x = col * (BOARD_W + GUTTER);
-    const y = row * (BOARD_H + GUTTER);
-    return `      <DCArtboard
-        id="b${i}"
-        label="${pick(WORDS, i)} ${i}"
-        width={${BOARD_W}}
-        height={${BOARD_H}}
-        x={${x}}
-        y={${y}}
-        fixed
-      >${artboardBody(i)}
-      </DCArtboard>`;
-  }).join('\n');
-
-  return `// GENERATED by apps/studio/test/fixtures/perf-canvas.mjs — do not hand-edit.
-// Synthetic render-performance fixture: ${boards} artboards, no filters/blends.
-import { DCArtboard, DesignCanvas } from '@maude/canvas-lib';
-
-export default function Canvas() {
-  return (
-    <DesignCanvas>
-${items}
-    </DesignCanvas>
-  );
-}
-`;
-}
-
-/** Build the `.meta.json` sidecar carrying the artboard grid positions. */
-export function renderMeta(boards) {
-  const artboards = Array.from({ length: boards }, (_, i) => ({
-    id: `b${i}`,
-    x: (i % COLS) * (BOARD_W + GUTTER),
-    y: Math.floor(i / COLS) * (BOARD_H + GUTTER),
-  }));
-  return {
-    title: `Perf fixture (${boards} boards)`,
-    subtitle: 'Generated render-performance fixture — safe to delete.',
-    tags: ['perf-fixture'],
-    status: 'draft',
-    layout: { artboards },
-  };
-}
-
-/**
- * Build the annotations SVG carrying `strokes` stickies. Shape copied from a
- * real imported-FigJam board so the layer exercises the same code path
- * (`data-mdcc-annotations`, `data-tool="sticky"`, rect + body text per group).
- */
-export function renderAnnotations(strokes) {
-  if (strokes <= 0) return null;
-  const nodes = Array.from({ length: strokes }, (_, i) => {
-    const col = i % STICKY_COLS;
-    const row = Math.floor(i / STICKY_COLS);
-    const x = col * (STICKY + STICKY_GAP);
-    // Park the sticky field below the artboard grid so the two layers are
-    // measurable together without overlapping hit-test surfaces.
-    const y = 100000 + row * (STICKY + STICKY_GAP);
-    return (
-      `<g data-id="perf_${i}" data-tool="sticky" data-r="8" data-fs="14" fill="#cfc4ec">` +
-      `<rect x="${x}" y="${y}" width="${STICKY}" height="${STICKY}" rx="8" ry="8"/>` +
-      `<text data-sticky-body="1" x="${x + 12}" y="${y + 12}" font-size="14" fill="#1a1a1a" dominant-baseline="hanging">` +
-      `${pick(STICKY_TEXT, i)} ${i}</text></g>`
-    );
-  }).join('');
-  return `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">${nodes}</svg>`;
-}
-
-/**
- * Write the fixture into a design root.
- *
- * @param {object} opts
- * @param {string} opts.designRoot  Absolute path to a `.design/` directory.
- * @param {number} [opts.boards]    Artboard count (default 128 — the SPKIE repro).
- * @param {number} [opts.strokes]   Sticky count (default 150 — the Team Retro repro).
- * @param {string} [opts.slug]      Canvas basename (default `perf-fixture`).
- * @returns {{canvasPath: string, metaPath: string, annotationsPath: string|null, canvasRel: string}}
- */
-export function writePerfCanvas({
-  designRoot,
-  boards = 128,
-  strokes = 150,
-  slug = 'perf-fixture',
-}) {
-  const canvasPath = join(designRoot, 'ui', `${slug}.tsx`);
-  const metaPath = join(designRoot, 'ui', `${slug}.meta.json`);
-  mkdirSync(dirname(canvasPath), { recursive: true });
-
-  writeFileSync(canvasPath, renderCanvasSource(boards), 'utf8');
-  writeFileSync(metaPath, `${JSON.stringify(renderMeta(boards), null, 2)}\n`, 'utf8');
-
-  // Annotations live at the design root under the flattened `<dir>-<slug>`
-  // naming the annotations API uses, NOT beside the canvas.
-  let annotationsPath = null;
-  const svg = renderAnnotations(strokes);
-  if (svg) {
-    annotationsPath = join(designRoot, `ui-${slug.replace(/-/g, '_')}.annotations.svg`);
-    writeFileSync(annotationsPath, svg, 'utf8');
-  }
-
-  return { canvasPath, metaPath, annotationsPath, canvasRel: `ui/${slug}.tsx` };
-}

package/apps/studio/test/fixtures/phase-20-annotations.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><path data-id="p1" data-tool="pen" stroke="#d63b1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" d="M0 0 L10 10 L20 5" pointer-events="stroke"/><rect data-id="r1" data-tool="rect" stroke="#222" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#fff4d6" x="10" y="20" width="30" height="40"/><ellipse data-id="e1" data-tool="ellipse" stroke="#222" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#e6f4ea" cx="100" cy="100" rx="40" ry="25"/><g data-id="a1" data-tool="arrow" stroke="#1a8f3e" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none"><line x1="0" y1="0" x2="100" y2="0"/><polyline points="85.5844981135613,6.94213982588093 100,0 85.5844981135613,-6.94213982588093" fill="#1a8f3e"/></g><text data-id="t1" data-tool="text" data-anchor-id="r1" data-font-size="14" fill="#1a1a1a" text-anchor="middle" dominant-baseline="middle">needs work</text></svg>

package/apps/studio/test/fixtures/phase-21-annotations.svg

@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><g data-id="st1" data-tool="sticky" data-r="8" data-fs="14" fill="#ffe27a"><rect x="40" y="50" width="200" height="160" rx="8" ry="8"/><text data-sticky-body="1" x="52" y="62" font-size="14" fill="#1a1a1a" dominant-baseline="hanging">ship it</text></g><rect data-id="r1" data-tool="rect" stroke="#3b82f6" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="10" y="20" width="120" height="80" rx="8" ry="8" data-r="8"/><g data-id="a1" data-tool="arrow" stroke="#e5484d" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" data-start-head="triangle" data-dash="1"><line x1="0" y1="0" x2="80" y2="40" stroke-dasharray="6 4"/><polyline points="17.99801569252915,0.2672660312767773 0,0 11.012622240538908,14.238052935257258" fill="#e5484d"/><polyline points="62.00198430747085,39.732733968723224 80,40 68.98737775946108,25.761947064742742" fill="#e5484d"/></g></svg>

package/apps/studio/test/fixtures/video-comp-fixture.tsx

@@ -1,82 +0,0 @@
-// video-comp-fixture.tsx — DDR-148 canonical video-comp fixture.
-//
-// A reusable comp exercising the full authoring vocabulary: a frame-driven
-// animated title, two "clips" joined by a crossfade in a <TransitionSeries>,
-// and a music-bed <Audio> with a volume envelope. Used by:
-//   • video-comp-fixture.test.ts — builds it through the real canvas pipeline
-//     (buildCanvasModule) and asserts remotion / @remotion/transitions stay
-//     external + <VideoComp> is present (CI-safe, no browser).
-//   • the live E2E sweep (drop → scrub → export) as a stable target.
-//
-// Deterministic BY CONSTRUCTION — every value is a pure function of the frame.
-
-import { DCArtboard, DCSection, DesignCanvas, VideoComp } from '@maude/canvas-lib';
-import { linearTiming, TransitionSeries } from '@remotion/transitions';
-import { fade } from '@remotion/transitions/fade';
-import { AbsoluteFill, Audio, interpolate, useCurrentFrame } from 'remotion';
-
-const CLIP = 45;
-const XF = 15;
-const TOTAL = 2 * CLIP - XF; // two clips + one crossfade
-
-const Beat = ({ label, bg }: { label: string; bg: string }) => {
-  const frame = useCurrentFrame();
-  const y = interpolate(frame, [0, 14], [24, 0], { extrapolateRight: 'clamp' });
-  const opacity = interpolate(frame, [0, 14], [0, 1], { extrapolateRight: 'clamp' });
-  return (
-    <AbsoluteFill
-      style={{
-        background: bg,
-        color: '#fff',
-        alignItems: 'center',
-        justifyContent: 'center',
-        fontFamily: 'system-ui, sans-serif',
-        fontSize: 72,
-        fontWeight: 800,
-      }}
-    >
-      <div style={{ transform: `translateY(${y}px)`, opacity }}>{label}</div>
-    </AbsoluteFill>
-  );
-};
-
-function Fixture() {
-  return (
-    <AbsoluteFill>
-      <TransitionSeries>
-        <TransitionSeries.Sequence durationInFrames={CLIP}>
-          <Beat label="MAUDE" bg="#0f172a" />
-        </TransitionSeries.Sequence>
-        <TransitionSeries.Transition
-          presentation={fade()}
-          timing={linearTiming({ durationInFrames: XF })}
-        />
-        <TransitionSeries.Sequence durationInFrames={CLIP}>
-          <Beat label="VIDEO" bg="#7c2d12" />
-        </TransitionSeries.Sequence>
-      </TransitionSeries>
-      <Audio
-        src="assets/music.mp3"
-        volume={(f) => interpolate(f, [TOTAL - 15, TOTAL], [0.7, 0], { extrapolateLeft: 'clamp' })}
-      />
-    </AbsoluteFill>
-  );
-}
-
-export default function Canvas() {
-  return (
-    <DesignCanvas>
-      <DCSection id="video-comp-fixture" title="Video-comp fixture">
-        <DCArtboard id="fixture" label="Fixture" width={640} height={360}>
-          <VideoComp
-            component={Fixture}
-            durationInFrames={TOTAL}
-            fps={30}
-            width={640}
-            height={360}
-          />
-        </DCArtboard>
-      </DCSection>
-    </DesignCanvas>
-  );
-}

package/apps/studio/test/fixtures/wedged-claude-auth.sh

@@ -1,11 +0,0 @@
-#!/bin/sh
-# Test fixture for issue #107 (defender M2 / attacker F3) — a `claude` stand-in
-# that reproduces the wedge shape: it exits immediately, but leaves a background
-# descendant holding fd 1 (stdout). `proc.kill()` signals only the direct child,
-# so the pipe never reaches EOF and a read that waits for EOF hangs forever.
-# `readBounded` must give up on its own deadline instead.
-if [ "$1" = "auth" ] && [ "$2" = "status" ]; then
-  sleep 120 &
-  exit 0
-fi
-exit 1

package/apps/studio/test/footage-store.test.ts

@@ -1,100 +0,0 @@
-// footage-store — round-trip + rejection coverage (feature-footage-analysis-director).
-// Uses a real temp designRoot on disk (Bun.write/Bun.file). Mirrors the photo
-// store's contract: valid analysis + EDL persist and read back; invalid input
-// returns a discriminated {ok:false,status} (never throws); traversal params in
-// the asset/slug are rejected by construction.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import type { Context } from '../context.ts';
-import { assetSha8, createFootageStore, edlSlug } from '../footage-store.ts';
-
-let root: string;
-let store: ReturnType<typeof createFootageStore>;
-
-beforeAll(() => {
-  root = mkdtempSync(path.join(tmpdir(), 'footage-store-'));
-  const designRoot = path.join(root, '.design');
-  // Only the fields footage-store touches are needed.
-  store = createFootageStore({ paths: { designRoot } } as unknown as Context);
-});
-afterAll(() => rmSync(root, { recursive: true, force: true }));
-
-describe('assetSha8 / edlSlug extraction', () => {
-  test('accepts the sha8 in every form', () => {
-    for (const p of ['assets/a1b2c3d4.mp4', '/assets/a1b2c3d4.png', 'a1b2c3d4.mov', 'a1b2c3d4'])
-      expect(assetSha8(p)).toBe('a1b2c3d4');
-  });
-  test('rejects traversal / non-hex', () => {
-    for (const p of ['../x', 'assets/../x', 'not-hex!', '', null]) expect(assetSha8(p)).toBeNull();
-  });
-  test('slug accepts kebab, rejects traversal / dots', () => {
-    expect(edlSlug('alligators-reel')).toBe('alligators-reel');
-    for (const s of ['../evil', 'has.dot', 'UPPER', '/abs', '']) expect(edlSlug(s)).toBeNull();
-  });
-});
-
-describe('analysis round-trip', () => {
-  test('saves a valid analysis and reads it back', async () => {
-    const res = await store.saveAnalysis('assets/a1b2c3d4.mp4', {
-      asset: 'assets/a1b2c3d4.mp4',
-      durationSec: 10,
-      shots: [{ start: 0, end: 3, usable: true, quality: 0.8 }],
-    });
-    expect(res.ok).toBe(true);
-    if (res.ok) expect(res.path).toBe('assets/a1b2c3d4.footage.json');
-    const back = await store.getAnalysis('a1b2c3d4');
-    expect(back?.shots?.[0].quality).toBe(0.8);
-    expect(back?.version).toBe(1);
-  });
-
-  test('rejects an invalid analysis with a 400 (never throws)', async () => {
-    const res = await store.saveAnalysis('assets/a1b2c3d4.mp4', { shots: [{ start: 5, end: 5 }] });
-    expect(res.ok).toBe(false);
-    if (!res.ok) expect(res.status).toBe(400);
-  });
-
-  test('rejects a bad asset param with a 400', async () => {
-    const res = await store.saveAnalysis('../evil', {});
-    expect(res.ok).toBe(false);
-    if (!res.ok) expect(res.status).toBe(400);
-  });
-
-  test('getAnalysis returns null for an absent sidecar', async () => {
-    expect(await store.getAnalysis('ffffffff')).toBeNull();
-  });
-});
-
-describe('EDL round-trip', () => {
-  test('saves a valid EDL under <slug>.edl.json and reads it back', async () => {
-    const res = await store.saveEdl('alligators-reel', {
-      title: 'Reel',
-      fps: 30,
-      width: 1920,
-      height: 1080,
-      beats: [{ clip: 'assets/a1b2c3d4.mp4', startSec: 0, durationFrames: 60, name: 'intro' }],
-    });
-    expect(res.ok).toBe(true);
-    if (res.ok) expect(res.path).toBe('alligators-reel.edl.json');
-    const back = await store.getEdl('alligators-reel');
-    expect(back?.beats?.[0].name).toBe('intro');
-    expect(back?.version).toBe(1);
-  });
-
-  test('rejects an EDL with an unbundled transition', async () => {
-    const res = await store.saveEdl('bad-reel', {
-      beats: [
-        {
-          clip: 'assets/a1b2c3d4.mp4',
-          startSec: 0,
-          durationFrames: 30,
-          transition: { presentation: 'zoom', frames: 5 },
-        },
-      ],
-    });
-    expect(res.ok).toBe(false);
-    if (!res.ok) expect(res.status).toBe(400);
-  });
-});

package/apps/studio/test/fs-mkdir-api.test.ts

@@ -1,248 +0,0 @@
-// /_api/fs-mkdir — feature-file-tree-drag-drop-folders (Task 4). Folder-name
-// validation, containment, `.gitkeep`, collision.
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { validateFolderName } from '../canvas-create.ts';
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-describe('validateFolderName', () => {
-  test('accepts ordinary names (incl. spaces + accents)', () => {
-    for (const n of ['Marketing', 'checkout-flow', 'Krok_1', 'Přihlášení']) {
-      const v = validateFolderName(n);
-      expect(v.ok).toBe(true);
-      expect(v.name).toBe(n);
-    }
-  });
-
-  const REJECT: Array<[string, unknown]> = [
-    ['empty', ''],
-    ['non-string', 123],
-    ['parent traversal', '../evil'],
-    ['forward slash', 'a/b'],
-    ['back slash', 'a\\b'],
-    ['leading dot', '.hidden'],
-    ['JSX break-out chars', 'a<b>'],
-    ['double quote', 'a"b'],
-    ['too long (61)', 'x'.repeat(61)],
-  ];
-  for (const [label, value] of REJECT) {
-    test(`rejects ${label}`, () => {
-      expect(validateFolderName(value).ok).toBe(false);
-    });
-  }
-});
-
-function mkdirReq(port: number, parent: string | undefined, name: string) {
-  return fetch(`http://localhost:${port}/_api/fs-mkdir`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify({ parent, name }),
-  });
-}
-
-describe('/_api/fs-mkdir — POST round-trip', () => {
-  test('creates an empty folder with a .gitkeep', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const r = await mkdirReq(port, 'ui', 'New Folder');
-      expect(r.status).toBe(201);
-      const j = (await r.json()) as { ok: boolean; dir: string };
-      expect(j.ok).toBe(true);
-      expect(j.dir).toBe('.design/ui/New Folder');
-      expect(existsSync(join(designRoot, 'ui', 'New Folder'))).toBe(true);
-      expect(existsSync(join(designRoot, 'ui', 'New Folder', '.gitkeep'))).toBe(true);
-      expect(readFileSync(join(designRoot, 'ui', 'New Folder', '.gitkeep'), 'utf8')).toBe('');
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('defaults parent to the design root when omitted', async () => {
-    const { root } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      // "ui" IS a managed canvas group, so a folder directly under it works;
-      // an omitted parent (designRoot itself) is NOT inside any canvas group
-      // and must be refused — mirrors moveCanvas's group-membership rule.
-      const r = await mkdirReq(port, undefined, 'Root Folder');
-      expect(r.status).toBe(400);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('supports nested parents', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      await mkdirReq(port, 'ui', 'Parent');
-      const r = await mkdirReq(port, 'ui/Parent', 'Child');
-      expect(r.status).toBe(201);
-      expect(existsSync(join(designRoot, 'ui', 'Parent', 'Child', '.gitkeep'))).toBe(true);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('refuses a parent that escapes the design root (400)', async () => {
-    const { root } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const r = await mkdirReq(port, '../../../../tmp', 'Escape');
-      expect(r.status).toBe(400);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('refuses a parent inside the design-system group (400)', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      mkdirSync(join(designRoot, 'system'), { recursive: true });
-      const r = await mkdirReq(port, 'system', 'NotAllowed');
-      expect(r.status).toBe(400);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('rejects an invalid name (400)', async () => {
-    const { root } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const r = await mkdirReq(port, 'ui', '../evil');
-      expect(r.status).toBe(400);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('a collision with an existing folder returns 409', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      mkdirSync(join(designRoot, 'ui', 'Already'), { recursive: true });
-      const r = await mkdirReq(port, 'ui', 'Already');
-      expect(r.status).toBe(409);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('a collision with an existing FILE (not just a dir) also returns 409', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      mkdirSync(join(designRoot, 'ui'), { recursive: true });
-      // NAME_RE forbids '.', so an extension-less file is the only way a
-      // FILE can collide with a valid folder name — statp() must catch it
-      // the same as a directory collision above.
-      writeFileSync(join(designRoot, 'ui', 'Taken'), 'not a folder');
-      const r = await mkdirReq(port, 'ui', 'Taken');
-      expect(r.status).toBe(409);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('emits a canvas-list-update "mkdir" action over the inspector WS', async () => {
-    const { root } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    let socket: WebSocket | null = null;
-    try {
-      const messages: Array<{ type: string; payload?: Record<string, unknown> }> = [];
-      const sock = new WebSocket(`ws://localhost:${port}/_ws`);
-      socket = sock;
-      await new Promise<void>((res, rej) => {
-        sock.addEventListener('open', () => res());
-        sock.addEventListener('error', () => rej(new Error('ws error')));
-        setTimeout(() => rej(new Error('ws open timeout')), 2000);
-      });
-      sock.addEventListener('message', (ev) => {
-        try {
-          messages.push(JSON.parse(String(ev.data)));
-        } catch {
-          /* ignore */
-        }
-      });
-      const r = await mkdirReq(port, 'ui', 'Live Folder');
-      expect(r.status).toBe(201);
-
-      const deadline = Date.now() + 2000;
-      let hit: (typeof messages)[number] | undefined;
-      while (Date.now() < deadline && !hit) {
-        hit = messages.find(
-          (m) => m.type === 'canvas-list-update' && m.payload?.action === 'mkdir'
-        );
-        if (!hit) await Bun.sleep(25);
-      }
-      expect(hit?.payload?.dir).toBe('.design/ui/Live Folder');
-    } finally {
-      try {
-        socket?.close();
-      } catch {
-        /* ignore */
-      }
-      await killProc(proc);
-    }
-  }, 10_000);
-
-  test('unknown method (GET) returns 405', async () => {
-    const { root } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const r = await fetch(`http://localhost:${port}/_api/fs-mkdir`, { method: 'GET' });
-      expect(r.status).toBe(405);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  test('rejects a cross-origin mkdir (CSRF guard)', async () => {
-    const { root } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const r = await fetch(`http://localhost:${port}/_api/fs-mkdir`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json', Origin: 'http://evil.example' },
-        body: JSON.stringify({ parent: 'ui', name: 'Forged' }),
-      });
-      expect(r.status).toBe(403);
-    } finally {
-      await killProc(proc);
-    }
-  });
-
-  // Security review finding — see the matching test in canvas-move-api.test.ts.
-  test('refuses creating a folder under a symlinked parent', async () => {
-    const { root, designRoot } = makeSandbox();
-    const outside = join(root, 'OUTSIDE');
-    mkdirSync(outside, { recursive: true });
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      symlinkSync(outside, join(designRoot, 'ui', 'link'));
-      const r = await mkdirReq(port, 'ui/link', 'Nested');
-      expect(r.status).toBe(400);
-      expect(existsSync(join(outside, 'Nested'))).toBe(false);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});