@1agh/maude 1.0.11 → 1.2.0

package/apps/studio/api.ts

@@ -17,7 +17,10 @@ import path from 'node:path';
 import { createAssetMirror, s3ConfigFromEnv } from './assets-s3.ts';
 import { canvasArtifacts, locatorKeyFor, relocatedName } from './canvas-artifacts.ts';
 import { renderBriefBoard, validateCanvasName, validateFolderName } from './canvas-create.ts';
+import { rewriteRelativeImports } from './canvas-imports.ts';
 import { canvasSlugFromRel } from './canvas-slug.ts';
+import { atomicWrite } from './sync/atomic-write.ts';
+import { dedupeCommentsById } from './sync/comment-identity.ts';
 
 // Re-exported so existing external callers (canvas-list-watch.ts, tests) keep
 // importing it from api.ts — the actual implementation now lives in
@@ -720,7 +723,20 @@ export interface Api {
 }
 
 export interface ApiHooks {
-  onCommentsChanged: (file: string) => void;
+  /**
+   * Publish a comments mutation to the SHARED DOC (and the shell's sidebar).
+   *
+   * `comments` is the post-mutation list, handed over IN MEMORY — issue #111.
+   * The hook used to take only `file` and re-read `_comments/<slug>.json`
+   * itself, which put a full disk round-trip between the mutation's write and
+   * the doc publish. `Room.flush()` fires on ANY doc update (every hub update
+   * re-arms it), so on a hub-linked project a flush landed inside that window,
+   * projected the PRE-mutation doc back over the file, and the new comment was
+   * gone before the hook's own read reached it — "only the first comment
+   * stays". Passing the list removes the read, and `publishComments` awaits
+   * this hook BEFORE touching disk so the doc is never the stale side.
+   */
+  onCommentsChanged: (file: string, comments: Comment[]) => void | Promise<void>;
   /** Phase 8 Task 5 — fires after a successful PUT /_api/annotations write. */
   onAnnotationsChanged?: (file: string, svg: string) => void;
   /**
@@ -1095,7 +1111,14 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       // Phase 6 — default-fill `author` / `thread` / `mentions` for legacy
       // rows. No write-back here; the on-disk shape stays stable until the
       // next mutation persists the upgraded record.
-      return arr.map(backfillComment);
+      //
+      // Deduped by comment identity first (issue #112). This is the read half
+      // of the repair: a project whose `_comments/<slug>.json` was already
+      // doubled by the pre-fix sync lane heals the moment it is loaded, and no
+      // consumer — pins, sidebar, `/_comments`, the /design:edit agent — ever
+      // sees the same comment eight times. First occurrence wins, matching the
+      // rule the codec and the cold-start union use.
+      return dedupeCommentsById(arr).map(backfillComment);
     } catch {
       return [];
     }
@@ -1135,7 +1158,39 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
   }
 
   async function saveCommentsForFile(file: string, list: Comment[]) {
-    await Bun.write(commentsPath(file), JSON.stringify(list, null, 2));
+    // The write half of the #112 repair, and the reason it belongs HERE: this
+    // is the one choke point every writer passes through — the API mutations,
+    // and the collab room's `persistJson`, which materializes the Y.Array
+    // straight to disk. Deduping at the door means a doc caught mid-convergence
+    // (or a peer still running the old wholesale write) cannot persist a
+    // duplicated list as the canvas's new truth, which is how the doubling
+    // survived restarts and compounded.
+    await Bun.write(commentsPath(file), JSON.stringify(dedupeCommentsById(list), null, 2));
+  }
+
+  /**
+   * Land one comments mutation: SHARED DOC FIRST, disk second (issue #111).
+   *
+   * The order is the fix, not a style choice. Under DDR-064 the room's Y.Doc is
+   * the shared object and `_comments/<slug>.json` is its projection — and
+   * `Room.flush()` projects doc→file on an 800 ms trailing debounce that ANY
+   * doc update re-arms, hub traffic included. So on a linked project a flush is
+   * almost always pending, and any window in which the doc is behind the file
+   * is a window in which that flush silently writes the older list back.
+   *
+   * Publishing to the doc first removes the window instead of narrowing it: a
+   * flush firing at any point from here on carries a doc that already holds the
+   * mutation. Both halves are awaited, so the HTTP response cannot report a
+   * comment the doc never received.
+   *
+   * The list is deduped ONCE here so the doc and the file are handed byte-equal
+   * content — otherwise the file→doc import that follows the write would see a
+   * difference and re-enter the loop.
+   */
+  async function publishComments(file: string, list: Comment[]): Promise<void> {
+    const settled = dedupeCommentsById(list);
+    await onCommentsChanged(file, settled);
+    await saveCommentsForFile(file, settled);
   }
 
   async function loadAllComments(): Promise<Record<string, Comment[]>> {
@@ -1314,8 +1369,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       if (anchor.clipStableId != null || anchor.frame != null) c.timeline = anchor;
     }
     list.push(c);
-    await saveCommentsForFile(payload.file, list);
-    onCommentsChanged(payload.file);
+    await publishComments(payload.file, list);
     return c;
   }
 
@@ -1343,31 +1397,38 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       };
       entry.thread = [...entry.thread, reply];
       entry.mentions = mentionsUnion(entry);
-      await saveCommentsForFile(file, list);
-      onCommentsChanged(file);
+      await publishComments(file, list);
       return entry;
     }
     return null;
   }
 
+  // Mutations are ID-TOTAL, not first-match (issue #112). `loadAllComments`
+  // dedupes, so under normal operation there is exactly one entry per id and
+  // these behave as they always did. They stay total as defense in depth: the
+  // reporter's second symptom — "I can't then close or resolve the comments" —
+  // was a `findIndex` + `return` marking copy 1 of 8 resolved while the overlay
+  // (which filters `status !== 'resolved'`) kept drawing the other seven, and a
+  // delete removing one copy per click. A duplicated list can still reach these
+  // from an older peer mid-upgrade; resolve must resolve either way.
   async function commentsPatch(id: string, patch: Partial<Comment>) {
     const all = await loadAllComments();
     for (const [file, list] of Object.entries(all)) {
-      const i = list.findIndex((c) => c.id === id);
-      if (i < 0) continue;
-      const entry = list[i];
-      if (!entry) continue;
-      if (patch.status === 'resolved' || patch.status === 'open') {
-        entry.status = patch.status;
-        entry.resolved_at = patch.status === 'resolved' ? new Date().toISOString() : null;
-      }
-      if (typeof patch.text === 'string' && patch.text.trim()) {
-        entry.text = patch.text.trim().slice(0, 4000);
-        entry.mentions = mentionsUnion(entry);
+      const matches = list.filter((c) => c.id === id);
+      const first = matches[0];
+      if (!first) continue;
+      for (const entry of matches) {
+        if (patch.status === 'resolved' || patch.status === 'open') {
+          entry.status = patch.status;
+          entry.resolved_at = patch.status === 'resolved' ? new Date().toISOString() : null;
+        }
+        if (typeof patch.text === 'string' && patch.text.trim()) {
+          entry.text = patch.text.trim().slice(0, 4000);
+          entry.mentions = mentionsUnion(entry);
+        }
       }
-      await saveCommentsForFile(file, list);
-      onCommentsChanged(file);
-      return entry;
+      await publishComments(file, list);
+      return first;
     }
     return null;
   }
@@ -1375,11 +1436,9 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
   async function commentsDelete(id: string): Promise<boolean> {
     const all = await loadAllComments();
     for (const [file, list] of Object.entries(all)) {
-      const i = list.findIndex((c) => c.id === id);
-      if (i < 0) continue;
-      list.splice(i, 1);
-      await saveCommentsForFile(file, list);
-      onCommentsChanged(file);
+      const remaining = list.filter((c) => c.id !== id);
+      if (remaining.length === list.length) continue;
+      await publishComments(file, remaining);
       return true;
     }
     return false;
@@ -2946,6 +3005,44 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     return realTarget === realRoot || realTarget.startsWith(`${realRoot}${path.sep}`);
   }
 
+  /**
+   * Re-root a moved canvas's relative imports for its new folder depth
+   * (issue #114). `fromDir` / `toDir` are POSIX, design-root-relative.
+   *
+   * Runs AFTER the rename, on the file at its destination. Best-effort by
+   * design: the move has already committed, and failing it here would leave a
+   * half-moved tree — strictly worse than the un-rewritten imports that were
+   * the status quo. A no-op rewrite writes nothing.
+   */
+  async function rewriteCanvasImports(abs: string, fromDir: string, toDir: string): Promise<void> {
+    if (fromDir === toDir) return;
+    try {
+      // NEVER DEREFERENCE A SYMLINK HERE. The move's containment checks cover
+      // the source *directory* (`assertRealpathContained(path.dirname(...))`)
+      // and the destination, but never the source FILE — which was inert while
+      // the move was a bare `rename()`, because renaming a symlink moves the
+      // LINK and no out-of-root byte is ever touched. This function is the
+      // first code on the path that reads and writes the file's contents, so
+      // without this guard a planted `ui/evil.tsx -> /elsewhere/secrets.ts`
+      // would turn an ordinary drag-and-drop into an out-of-root read AND an
+      // out-of-root write. `lstat` does not follow; a link is skipped, not
+      // repaired — its target is not ours to rewrite.
+      const st = await lstat(abs);
+      if (!st.isFile()) return;
+      const source = await readFile(abs, 'utf8');
+      const next = rewriteRelativeImports(source, fromDir, toDir);
+      // atomicWrite, not `writeFile` — this lands on a `.tsx` the fs-mirror is
+      // watching, so a truncate-then-write can surface a partial-content watch
+      // event (the exact hazard atomic-write.ts was built for), and a crash
+      // mid-write would leave a truncated canvas.
+      if (next !== source) atomicWrite(abs, next);
+    } catch (err) {
+      console.warn(
+        `[move] could not rewrite relative imports in ${abs}: ${(err as Error).message}`
+      );
+    }
+  }
+
   // feature-file-tree-drag-drop-folders (Task 3) — move/rename a canvas + its
   // full artifact set (POST /_api/fs-move). Same main-origin-only trust
   // boundary as createCanvas/deleteCanvas (DDR-054): never reachable from the
@@ -3124,6 +3221,14 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       return { ok: false, status: 500, error: err instanceof Error ? err.message : 'move failed' };
     }
 
+    // The canvas is at a new depth now, so its relative specifiers point at the
+    // wrong place (issue #114). Bytes used to move without them, and the canvas
+    // 500s on the next build with `Could not resolve`. Best-effort: the move
+    // itself already succeeded, and a rewrite failure must not leave the tree
+    // half-moved — it leaves a build error the user can fix by hand, which is
+    // exactly where they were before this existed.
+    await rewriteCanvasImports(toAbs, path.posix.dirname(rel), path.posix.dirname(toRel));
+
     const moved: string[] = [path.relative(paths.repoRoot, toAbs)];
     for (const artifact of canvasArtifacts({ rel, paths })) {
       if (artifact.kind === 'primary') continue; // already moved above
@@ -3371,6 +3476,14 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       const toRel = toRelDir + fromRel.slice(relDir.length);
       const fromSlug = fileSlug(fromRel);
       const toSlug = fileSlug(toRel);
+      // Same depth change as moveCanvas, once per nested canvas (issue #114).
+      // A folder move relocates every canvas inside it by the same delta, but
+      // each one's own dir differs, so the rewrite is per file, not per folder.
+      await rewriteCanvasImports(
+        path.join(paths.designRoot, toRel),
+        path.posix.dirname(fromRel),
+        path.posix.dirname(toRel)
+      );
       for (const artifact of canvasArtifacts({ rel: fromRel, paths })) {
         if (artifact.kind !== 'slug-keyed') continue; // primary/siblings already moved with the dir
         const dest = relocatedName(artifact, fromRel, toRel, paths);

package/apps/studio/bin/_import-figma.mjs

@@ -29,12 +29,14 @@
 
 import { createHash } from 'node:crypto';
 import {
+  copyFileSync,
   existsSync,
   mkdirSync,
   mkdtempSync,
   readFileSync,
   renameSync,
   rmSync,
+  unlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { homedir, tmpdir } from 'node:os';
@@ -143,6 +145,50 @@ function makeStagingDir() {
   return mkdtempSync(join(tmpdir(), 'maude-figma-'));
 }
 
+/**
+ * Promote one staged file into the project tree.
+ *
+ * A bare `renameSync` is atomic — and SAME-FILESYSTEM ONLY. Staging lives under
+ * the OS temp root (or `~/.cache/maude/figma-staging` for the codegen lane)
+ * while the project can be anywhere: a second partition, an external drive, a
+ * container volume, a tmpfs `/tmp`. Those are different devices, so the rename
+ * threw `EXDEV: cross-device link not permitted` and the whole import died at
+ * the final step, after every byte of work was already done. It reproduces on
+ * any Linux box where `/tmp` is a tmpfs, which is most of them, and it is why
+ * the figma-explode suite was red.
+ *
+ * The atomicity is not negotiable — nothing may land half-written in the
+ * versioned tree — so this does NOT fall back to a plain copy. It copies into a
+ * sibling temp file IN THE DESTINATION DIRECTORY and renames within that
+ * directory: same filesystem by construction, so the step that publishes the
+ * file is still a single atomic rename.
+ */
+function promoteFile(src, dest) {
+  try {
+    renameSync(src, dest);
+    return;
+  } catch (err) {
+    if (err?.code !== 'EXDEV') throw err;
+  }
+  const tmp = `${dest}.${process.pid}.promote-tmp`;
+  copyFileSync(src, tmp);
+  try {
+    renameSync(tmp, dest);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {
+      /* best effort — the staged original is still intact */
+    }
+    throw err;
+  }
+  try {
+    unlinkSync(src);
+  } catch {
+    /* staging is reaped wholesale by its own finally */
+  }
+}
+
 /**
  * DDR-219 D8 — a staging directory outside the synced tree, under a STABLE
  * parent.
@@ -548,9 +594,9 @@ export async function importBoard({
     mkdirSync(join(root, designRootRel, 'ui'), { recursive: true });
     // Promote by rename — atomic, and nothing lands in the versioned tree
     // until the whole translation has succeeded.
-    renameSync(stagedTsx, finalTsx);
-    renameSync(stagedMeta, finalMeta);
-    renameSync(stagedSvg, finalPath);
+    promoteFile(stagedTsx, finalTsx);
+    promoteFile(stagedMeta, finalMeta);
+    promoteFile(stagedSvg, finalPath);
     return {
       slug: annSlug,
       canvas: canvasRel,
@@ -977,8 +1023,8 @@ export async function importPages({
         mkdirSync(outDir, { recursive: true });
         const finalTsx = assertContained(root, designRootRel, join(outDir, `${title}.tsx`));
         const finalMeta = assertContained(root, designRootRel, join(outDir, `${title}.meta.json`));
-        renameSync(stagedTsx, finalTsx);
-        renameSync(stagedMeta, finalMeta);
+        promoteFile(stagedTsx, finalTsx);
+        promoteFile(stagedMeta, finalMeta);
 
         // The page's annotation layer has TWO sources, and the second one is the
         // reason a tree-walking import felt half-migrated:
@@ -1060,7 +1106,7 @@ export async function importPages({
             designRootRel,
             join(root, designRootRel, `${annSlug}.annotations.svg`)
           );
-          renameSync(stagedAnn, finalAnn);
+          promoteFile(stagedAnn, finalAnn);
         }
         written.push({
           title,
@@ -1240,8 +1286,8 @@ export async function importFrames({
       mkdirSync(uiDir, { recursive: true });
       const finalTsx = assertContained(root, designRootRel, join(uiDir, `${base}.tsx`));
       const finalMeta = assertContained(root, designRootRel, join(uiDir, `${base}.meta.json`));
-      renameSync(stagedTsx, finalTsx);
-      renameSync(stagedMeta, finalMeta);
+      promoteFile(stagedTsx, finalTsx);
+      promoteFile(stagedMeta, finalMeta);
       written.push({
         slug: base,
         path: finalTsx,
@@ -1559,8 +1605,8 @@ export async function explodeArtboard({
     const stagedMeta = join(staging, 'canvas.meta.json');
     writeFileSync(stagedTsx, tsxOut, 'utf8');
     writeFileSync(stagedMeta, `${JSON.stringify(nextMeta, null, 2)}\n`, 'utf8');
-    renameSync(stagedTsx, tsxPath);
-    renameSync(stagedMeta, metaPath);
+    promoteFile(stagedTsx, tsxPath);
+    promoteFile(stagedMeta, metaPath);
 
     return {
       canvas: rel,
@@ -1624,7 +1670,7 @@ export async function importTokens({ url, root, designRootRel = '.design', dryRu
       designRootRel,
       join(outDir, `figma-tokens-${target.fileKey.slice(0, 8).toLowerCase()}.json`)
     );
-    renameSync(staged, finalPath);
+    promoteFile(staged, finalPath);
     return { ...result, path: finalPath };
   } finally {
     rmSync(staging, { recursive: true, force: true });

package/apps/studio/bin/_seed-fixture.mjs

@@ -0,0 +1,163 @@
+#!/usr/bin/env node
+// Generate a synthetic `.design/` with the SHAPE of a large real project.
+//
+// WHY THIS EXISTS. Every defect in feature-large-project-seed only appears at
+// scale: the request ceiling needs >200 paths to bite, the hourly write quota
+// needs >2 GiB, the doručenka's unbounded map needs thousands of rows before
+// its cost shows, and the door's 95 MB ceiling needs a file that exceeds it.
+// The only project that reproduced all of them is 8.8 GB and 47 751 files, so
+// "run it against alligators" was the entire test plan — which meant the
+// regression surface was one person's laptop.
+//
+// SPARSE BY DEFAULT. The bytes are allocated, not written: a 3 GB fixture
+// costs a few hundred milliseconds and almost no disk on APFS/ext4, because
+// nothing here needs the content to be anything in particular. Pass
+// `--real-bytes` when a test genuinely needs them materialised (hashing
+// throughput, compression), and expect it to be slow.
+//
+// Deliberately NOT a `maude design` verb: it is a test fixture generator, and
+// putting it on the user-facing surface would invite someone to run it at a
+// real project. Internal, like `_screenshot-playwright.mjs`.
+//
+// Usage:
+//   node apps/studio/bin/_seed-fixture.mjs --out /tmp/big --files 3000 --bytes 2GB
+//   node apps/studio/bin/_seed-fixture.mjs --out /tmp/big --files 50 --bytes 10MB --real-bytes
+
+import {
+  closeSync,
+  ftruncateSync,
+  mkdirSync,
+  openSync,
+  rmSync,
+  writeFileSync,
+  writeSync,
+} from 'node:fs';
+import { join } from 'node:path';
+
+function parseBytes(raw) {
+  const m = String(raw ?? '')
+    .trim()
+    .match(/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB)?$/i);
+  if (!m) return null;
+  const mult = { b: 1, kb: 1024, mb: 1024 ** 2, gb: 1024 ** 3 }[(m[2] ?? 'B').toLowerCase()];
+  return Math.round(Number(m[1]) * mult);
+}
+
+function parseArgs(argv) {
+  const out = { files: 3000, bytes: 2 * 1024 ** 3, out: null, realBytes: false, force: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--files') out.files = Number(argv[++i]);
+    else if (a === '--bytes') out.bytes = parseBytes(argv[++i]);
+    else if (a === '--out') out.out = argv[++i];
+    else if (a === '--real-bytes') out.realBytes = true;
+    else if (a === '--force') out.force = true;
+  }
+  return out;
+}
+
+const args = parseArgs(process.argv.slice(2));
+if (!args.out || !Number.isFinite(args.files) || args.files < 1 || !Number.isFinite(args.bytes)) {
+  process.stderr.write(
+    'usage: _seed-fixture.mjs --out <dir> [--files N] [--bytes 2GB] [--real-bytes] [--force]\n'
+  );
+  process.exit(2);
+}
+
+// REFUSE TO WRITE INTO SOMETHING THAT LOOKS REAL. This generator creates and
+// deletes a `.design/` tree; pointing it at a project by accident would be
+// unrecoverable, and `--force` is the only way past.
+const root = args.out;
+const designRoot = join(root, '.design');
+if (!args.force && !/(^\/tmp\/|^\/private\/tmp\/|fixture|scratch)/.test(root)) {
+  process.stderr.write(
+    `refusing to generate into ${root} — it does not look like a scratch path.\n` +
+      'Use a path under /tmp, or one containing "fixture"/"scratch", or pass --force.\n'
+  );
+  process.exit(2);
+}
+rmSync(designRoot, { recursive: true, force: true });
+
+/** Allocate a file of `size` without writing `size` bytes. */
+function makeFile(abs, size, real) {
+  if (real) {
+    // A repeating pattern rather than zeros, so a compression-sensitive test
+    // is not accidentally measuring a best case.
+    const chunk = Buffer.alloc(Math.min(size, 1 << 20), 0);
+    for (let i = 0; i < chunk.length; i++) chunk[i] = (i * 31) & 0xff;
+    const fd = openSync(abs, 'w');
+    let left = size;
+    while (left > 0) {
+      const n = Math.min(left, chunk.length);
+      writeSync(fd, chunk, 0, n);
+      left -= n;
+    }
+    closeSync(fd);
+    return;
+  }
+  const fd = openSync(abs, 'w');
+  ftruncateSync(fd, size); // sparse — allocated, not written
+  closeSync(fd);
+}
+
+const dirs = [
+  'system/fixture-ds/assets/photos',
+  'system/fixture-ds/assets/photos-cut',
+  'system/fixture-ds/assets/video',
+  'system/fixture-ds/assets/graphics',
+  'system/fixture-ds/preview',
+  'ui',
+];
+for (const d of dirs) mkdirSync(join(designRoot, d), { recursive: true });
+
+writeFileSync(
+  join(designRoot, 'config.json'),
+  `${JSON.stringify({ designSystems: ['fixture-ds'], canvasGroups: [{ path: 'ui' }] }, null, 2)}\n`
+);
+
+// The canvas layer — small, numerous, and the part a real project actually
+// edits. Kept to ~2 % of the file count, matching the observed ratio
+// (149 .tsx against 4 237 .jpg).
+const canvasCount = Math.max(1, Math.round(args.files * 0.02));
+for (let i = 0; i < canvasCount; i++) {
+  writeFileSync(
+    join(designRoot, 'ui', `screen-${i}.tsx`),
+    `export default function Screen${i}() {\n  return null;\n}\n`
+  );
+  writeFileSync(
+    join(designRoot, 'ui', `screen-${i}.meta.json`),
+    `${JSON.stringify({ title: `Screen ${i}`, status: 'draft' })}\n`
+  );
+}
+
+// The asset bulk. Sizes are drawn deterministically around the observed
+// distribution (0.5–3 MB stills), so a run is reproducible.
+const assetCount = Math.max(0, args.files - canvasCount * 2);
+let remaining = args.bytes;
+let made = 0;
+const folders = ['photos', 'photos-cut', 'graphics'];
+for (let i = 0; i < assetCount && remaining > 0; i++) {
+  const folder = folders[i % folders.length];
+  const share = Math.max(1024, Math.round(remaining / (assetCount - i)));
+  const size = Math.min(remaining, share);
+  makeFile(join(designRoot, 'system/fixture-ds/assets', folder, `a${i}.jpg`), size, args.realBytes);
+  remaining -= size;
+  made += 1;
+}
+
+// TWO FILES OVER THE DOOR'S 95 MB CEILING, because that is the case with no
+// backoff answer — the real project has exactly two (164.9 MB, 465.8 MB) and
+// they are what proved the client and the door disagreed about the limit.
+const over = [
+  ['system/fixture-ds/assets/video/over-cap-1.mp4', 165 * 1024 ** 2],
+  ['system/fixture-ds/assets/video/over-cap-2.mp4', 466 * 1024 ** 2],
+];
+for (const [rel, size] of over) makeFile(join(designRoot, rel), size, args.realBytes);
+
+const totalFiles = canvasCount * 2 + made + over.length;
+process.stdout.write(
+  `${designRoot}\n` +
+    `  ${totalFiles} files · ${(args.bytes / 1024 ** 3).toFixed(2)} GB nominal` +
+    `${args.realBytes ? ' (materialised)' : ' (sparse)'}\n` +
+    `  ${canvasCount} canvases · ${made} assets · ${over.length} over the 95 MB door ceiling\n`
+);

package/apps/studio/canvas-imports.ts

@@ -0,0 +1,89 @@
+// Relative-import rewriting for a canvas that CHANGES FOLDER (issue #114).
+//
+// THE BUG THIS MODULE EXISTS TO FIX. `moveCanvas` / `moveFolder` relocated a
+// canvas with a bare `rename()` — bytes moved, specifiers didn't. A canvas
+// dragged from `ui/` into `ui/print/` kept
+//
+//     import { … } from "../system/alligators/preview/_kit";
+//     import "../system/alligators/preview/_layout.css";
+//
+// which is only correct one level up, so the canvas 500s on the next build with
+// `Could not resolve`. Nothing anywhere in the tree rewrote imports; the
+// capability simply did not exist. It reads like a sync bug from the outside
+// (the broken file shows up on every peer), which is how it got reported
+// alongside one — but it is entirely local to the move.
+//
+// Deliberately regex-over-known-vocabulary rather than a parser: it matches the
+// house style of the other static readers (`_canvas-rects-static.mjs`), it
+// cannot fail closed on a canvas whose syntax a parser would reject, and the
+// vocabulary is small and fixed. Only `./`- and `../`-prefixed specifiers are
+// touched — a bare or aliased specifier (`react`, `@maude/canvas-lib`) is
+// resolved by the bundler, not by depth, and rewriting one would break it.
+
+import path from 'node:path';
+
+/**
+ * Every shape that can carry a module specifier in a canvas body, as
+ * [pattern, index of the capture group holding the quoted specifier].
+ *
+ *   from "…"      — `import x from`, `export … from`
+ *   import "…"    — side-effect import (this is the one that carries `_layout.css`)
+ *   import("…")   — dynamic import
+ *
+ * `require("…")` is deliberately absent: canvases are ESM (Bun.build), and a
+ * `require` in one is not something this should quietly rewrite.
+ */
+const SPECIFIER_PATTERNS: readonly RegExp[] = [
+  /(\bfrom\s*)(["'])([^"']+)\2/g,
+  /(\bimport\s*)(["'])([^"']+)\2/g,
+  /(\bimport\s*\(\s*)(["'])([^"']+)\2/g,
+];
+
+/** Is this a path-relative specifier (the only kind whose meaning depends on
+ *  which folder the importing file sits in)? */
+export function isRelativeSpecifier(spec: string): boolean {
+  return spec.startsWith('./') || spec.startsWith('../');
+}
+
+/**
+ * Re-root one relative specifier from `fromDir` to `toDir`.
+ *
+ * Both dirs are POSIX, design-root-relative (`''` = the design root itself).
+ * Returns the specifier unchanged when it isn't relative.
+ */
+export function rerootSpecifier(spec: string, fromDir: string, toDir: string): string {
+  if (!isRelativeSpecifier(spec)) return spec;
+  // What the specifier pointed AT, as a design-root-relative path. `join` +
+  // `normalize` collapse the `..` segments; a target above the design root stays
+  // expressed with leading `..` and re-roots just as correctly.
+  const target = path.posix.normalize(path.posix.join(fromDir, spec));
+  let next = path.posix.relative(toDir, target);
+  // `relative` drops the leading `./` that makes a same-dir specifier relative
+  // rather than bare — without it `sibling.css` would resolve as a PACKAGE.
+  if (!next.startsWith('.')) next = `./${next}`;
+  // A trailing slash in the source (`from "../lib/"`) is meaningful to a
+  // resolver; `normalize`/`relative` drop it, so put it back.
+  if (spec.endsWith('/') && !next.endsWith('/')) next = `${next}/`;
+  return next;
+}
+
+/**
+ * Rewrite every relative import in `source` for a file that moved from
+ * `fromDir` to `toDir` (both POSIX, design-root-relative).
+ *
+ * Returns the source unchanged when the two dirs are the same or nothing
+ * relative was found, so a caller can cheaply skip the write.
+ */
+export function rewriteRelativeImports(source: string, fromDir: string, toDir: string): string {
+  const from = path.posix.normalize(fromDir === '' ? '.' : fromDir);
+  const to = path.posix.normalize(toDir === '' ? '.' : toDir);
+  if (from === to) return source;
+  let out = source;
+  for (const pattern of SPECIFIER_PATTERNS) {
+    out = out.replace(pattern, (whole, lead: string, quote: string, spec: string) => {
+      if (!isRelativeSpecifier(spec)) return whole;
+      return `${lead}${quote}${rerootSpecifier(spec, from, to)}${quote}`;
+    });
+  }
+  return out;
+}