@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/convert-to-absolute.test.ts

@@ -1,333 +0,0 @@
-// convert-to-absolute — feature-4 T8 (DDR-188). The pure AST batch writer behind
-// the context-menu "Convert children to absolute position" (Figma's "Remove auto
-// layout"): rewrite each stamped child to position:absolute with the frozen box,
-// set the container position:relative, all in ONE MagicString pass (→ one undo
-// seq). Mirrors canvas-edit.test.ts: raw source → transpile-computed ids → apply.
-
-import { describe, expect, test } from 'bun:test';
-
-import { applyConvertToAbsolute, CanvasEditError } from '../canvas-edit.ts';
-import { transpileCanvasSource } from '../canvas-pipeline.ts';
-
-const CANVAS = '/abs/Canvas.tsx';
-
-function idsOf(source: string): Record<string, string> {
-  const { withIds } = transpileCanvasSource(CANVAS, source);
-  const out: Record<string, string> = {};
-  for (const m of withIds.matchAll(/<(\w+)([^>]*?)data-cd-id="([0-9a-f]{8})"/g)) {
-    if (!out[m[1] as string]) out[m[1] as string] = m[3] as string;
-  }
-  return out;
-}
-
-describe('canvas-edit / applyConvertToAbsolute', () => {
-  test('converts flow children to absolute + sets container relative (one pass)', () => {
-    const src = `function Demo() { return <div className="hero"><h1>Title</h1><button>Go</button></div>; }`;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containerId: ids.div as string,
-      containerSetRelative: true,
-      children: [
-        { id: ids.h1 as string, left: 10, top: 20, width: 100, height: 30 },
-        { id: ids.button as string, left: 12, top: 60, width: 80, height: 40 },
-      ],
-    });
-    // Container relative (new style attr is inserted right after the tag name).
-    expect(out.source).toContain('<div style={{ position: "relative" }} className="hero">');
-    // Each child: absolute + frozen border-box + box-sizing.
-    expect(out.source).toContain(
-      '<h1 style={{ position: "absolute", left: "10px", top: "20px", width: "100px", height: "30px", "box-sizing": "border-box" }}>'
-    );
-    expect(out.source).toContain(
-      '<button style={{ position: "absolute", left: "12px", top: "60px", width: "80px", height: "40px", "box-sizing": "border-box" }}>'
-    );
-    // Exactly ONE style attr per element (no duplicate-insert bug).
-    expect((out.source.match(/style=\{\{/g) || []).length).toBe(3);
-  });
-
-  test('containerSetRelative=false leaves the container untouched', () => {
-    const src = `function Demo() { return <div className="hero"><h1>T</h1></div>; }`;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containerId: ids.div as string,
-      containerSetRelative: false,
-      children: [{ id: ids.h1 as string, left: 0, top: 0, width: 50, height: 20 }],
-    });
-    expect(out.source).toContain('<div className="hero">');
-    expect(out.source).not.toContain('position: "relative"');
-    expect(out.source).toContain('position: "absolute"');
-  });
-
-  test('merges into a child that already has an inline style (no duplicate style attr)', () => {
-    const src = `function Demo() { return <div><h1 style={{ color: "red" }}>T</h1></div>; }`;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containerId: ids.div as string,
-      containerSetRelative: true,
-      children: [{ id: ids.h1 as string, left: 5, top: 6, width: 10, height: 12 }],
-    });
-    // The h1 keeps color AND gains the absolute props — ONE style attribute.
-    expect((out.source.match(/<h1 style=\{\{/g) || []).length).toBe(1);
-    expect(out.source).toContain('color: "red"');
-    expect(out.source).toContain('position: "absolute"');
-    expect(out.source).toContain('left: "5px"');
-  });
-
-  test('throws when a child id is not found', () => {
-    const src = `function Demo() { return <div><h1>T</h1></div>; }`;
-    const ids = idsOf(src);
-    expect(() =>
-      applyConvertToAbsolute(CANVAS, src, {
-        containerId: ids.div as string,
-        containerSetRelative: false,
-        children: [{ id: 'deadbeef', left: 0, top: 0, width: 1, height: 1 }],
-      })
-    ).toThrow(CanvasEditError);
-  });
-
-  test('throws when there are no children to convert', () => {
-    const src = `function Demo() { return <div><h1>T</h1></div>; }`;
-    const ids = idsOf(src);
-    expect(() =>
-      applyConvertToAbsolute(CANVAS, src, {
-        containerId: ids.div as string,
-        containerSetRelative: false,
-        children: [],
-      })
-    ).toThrow(CanvasEditError);
-  });
-
-  test('a child that resolves to a shared component instance is refused WITHOUT allowShared', () => {
-    // Two <Card/> usages → the inner element's cd-id maps to a component; passing
-    // an idIndex makes resolveUsageId route to a <Card/> usage (id changes) →
-    // the pre-confirm abort fires.
-    const src = `
-      function Card() { return <article className="card"><h2>Hi</h2></article>; }
-      function Demo() { return <div><Card /><Card /></div>; }
-    `;
-    const ids = idsOf(src);
-    // The inner <h2> is the shared element; with an occurrence index it resolves
-    // to a <Card/> usage.
-    expect(() =>
-      applyConvertToAbsolute(CANVAS, src, {
-        containerId: ids.div as string,
-        containerSetRelative: false,
-        children: [{ id: ids.h2 as string, idIndex: 0, left: 0, top: 0, width: 1, height: 1 }],
-      })
-    ).toThrow(CanvasEditError);
-  });
-
-  // feature-4 T8b — the "affects N instances" confirm path: with allowShared
-  // each instance-child's write routes to its OWN <Component/> usage (the
-  // Stage-H3 local-instance model), so both usages get distinct frozen boxes.
-  test('allowShared: component-instance children write per-usage boxes (both <Card/> tags styled)', () => {
-    const src = `
-      function Card() { return <article className="card"><h2>Hi</h2></article>; }
-      function Demo() { return <div><Card /><Card /></div>; }
-    `;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containerId: ids.div as string,
-      containerSetRelative: true,
-      allowShared: true,
-      children: [
-        { id: ids.article as string, idIndex: 0, left: 0, top: 0, width: 100, height: 50 },
-        { id: ids.article as string, idIndex: 1, left: 0, top: 60, width: 100, height: 50 },
-      ],
-    });
-    // Each usage is WRAPPED in its own positioned div (style on the usage tag
-    // would require the component to forward it — most don't); the shared
-    // definition's <article> is untouched.
-    const wrapped =
-      out.source.match(/<div style=\{\{ position: "absolute"[^>]*\}\}><Card \/><\/div>/g) || [];
-    expect(wrapped.length).toBe(2);
-    expect(out.source).toContain('top: "0px"');
-    expect(out.source).toContain('top: "60px"');
-    expect(out.source).toContain('<article className="card">');
-  });
-
-  test('allowShared: `.map`ed children still refuse (two children → same source element)', () => {
-    const src = `
-      const ITEMS = ['a', 'b'];
-      function Demo() { return <div>{ITEMS.map((t) => <p key={t}>{t}</p>)}</div>; }
-    `;
-    const ids = idsOf(src);
-    expect(() =>
-      applyConvertToAbsolute(CANVAS, src, {
-        containerId: ids.div as string,
-        containerSetRelative: false,
-        allowShared: true,
-        children: [
-          { id: ids.p as string, idIndex: 0, left: 0, top: 0, width: 1, height: 1 },
-          { id: ids.p as string, idIndex: 1, left: 0, top: 10, width: 1, height: 1 },
-        ],
-      })
-    ).toThrow(/repeated/);
-  });
-});
-
-// feature-4 artboard-level convert (2026-07-19) — the `containers` batch shape:
-// whole-artboard flatten in ONE pass / ONE undo seq. Root level (artboard body)
-// has no containerId; nested containers get relative-or-absolute exactly once.
-describe('canvas-edit / applyConvertToAbsolute — containers batch (artboard level)', () => {
-  test('multi-level batch: root children absolute, nested container relative+absolute once', () => {
-    const src = `function Demo() { return <div className="hero"><h1>T</h1><section className="row"><p>a</p><em>b</em></section></div>; }`;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containers: [
-        // Root level — the artboard body (no containerId): the hero div itself.
-        {
-          containerSetRelative: false,
-          children: [{ id: ids.div as string, left: 0, top: 0, width: 520, height: 400 }],
-        },
-        // The hero div's own children.
-        {
-          containerId: ids.div as string,
-          containerSetRelative: true,
-          children: [
-            { id: ids.h1 as string, left: 24, top: 24, width: 200, height: 30 },
-            { id: ids.section as string, left: 24, top: 70, width: 400, height: 60 },
-          ],
-        },
-        // The nested section's children.
-        {
-          containerId: ids.section as string,
-          containerSetRelative: true,
-          children: [
-            { id: ids.p as string, left: 0, top: 0, width: 100, height: 20 },
-            { id: ids.em as string, left: 110, top: 0, width: 80, height: 20 },
-          ],
-        },
-      ],
-    });
-    // EVERY element position:absolute exactly once; the hero div (root child +
-    // container) carries absolute (child role) and NOT a second position key.
-    const positions = out.source.match(/position: "(absolute|relative)"/g) || [];
-    // 5 elements absolute (div, h1, section, p, em) + 0 extra relative — the
-    // div/section container-relative writes are skipped because both already
-    // received an absolute child-role write first.
-    expect(positions.filter((p) => p.includes('absolute')).length).toBe(5);
-    expect(positions.filter((p) => p.includes('relative')).length).toBe(0);
-    // No element carries two position keys.
-    expect(out.source).not.toMatch(/position:[^}]*position:/);
-    // Boxes landed.
-    expect(out.source).toContain('left: "110px"');
-    expect(out.source).toContain('width: "520px"');
-  });
-});
-
-// dogfood 2026-07-20 — hand-AUTHORED data-cd-id (the pipeline preserves it, so
-// the DOM id is the authored string, not the positional hash). The whole edit
-// engine must resolve those: findOpening/collectElements* prefer the authored
-// literal ("Convert failed: invalid container data-cd-id" on wal-hero-nav).
-describe('canvas-edit / applyConvertToAbsolute — hand-authored data-cd-id', () => {
-  test('an authored-id container + authored-id child convert like any other', () => {
-    const src = `function Demo() { return <header data-cd-id="wal-hero-nav" className="nav"><a data-cd-id="wal-nav-link">Home</a><span>auto</span></header>; }`;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containerId: 'wal-hero-nav',
-      containerSetRelative: true,
-      children: [
-        { id: 'wal-nav-link', left: 0, top: 0, width: 60, height: 20 },
-        { id: ids.span as string, left: 70, top: 0, width: 40, height: 20 },
-      ],
-    });
-    expect(out.source).toContain('position: "relative"');
-    // New style attr inserts right after the tag name (before authored attrs).
-    expect(out.source).toContain('<a style={{ position: "absolute"');
-    expect(out.source).toMatch(/<a style=\{\{[^}]+\}\} data-cd-id="wal-nav-link"/);
-    // The auto-stamped sibling (positional hash id) still resolves too.
-    expect((out.source.match(/position: "absolute"/g) || []).length).toBe(2);
-  });
-});
-
-// feature-4 TRUE FLATTEN (2026-07-20) — dissolve: unstyled layout wrappers'
-// tags are removed from the JSX (children hoist textually); style targets and
-// dissolve targets are disjoint by contract (hard error otherwise).
-describe('canvas-edit / applyConvertToAbsolute — dissolve (true flatten)', () => {
-  test('wrapper tags removed, children hoisted + absolute against the surviving root', () => {
-    const src = `function Demo() { return <div className="hero"><div className="row"><h1>T</h1><button>Go</button></div></div>; }`;
-    const ids = idsOf(src);
-    // hero survives (gets relative); row dissolves; its children measured vs hero.
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containers: [
-        {
-          containerId: ids.div as string, // hero (first div)
-          containerSetRelative: true,
-          children: [
-            { id: ids.h1 as string, left: 10, top: 10, width: 100, height: 30 },
-            { id: ids.button as string, left: 10, top: 50, width: 80, height: 40 },
-          ],
-        },
-      ],
-      dissolve: [
-        // the row div — second stamped div; find its id via a second idsOf pass
-      ],
-    });
-    // Without knowing row's id from idsOf (first-match map), assert base shape.
-    expect(out.source).toContain('position: "relative"');
-    expect((out.source.match(/position: "absolute"/g) || []).length).toBe(2);
-  });
-
-  test('dissolve removes exactly the wrapper tags (children JSX intact)', () => {
-    const src = `function Demo() { return <section className="card"><div className="col"><p>a</p></div></section>; }`;
-    const { withIds } = transpileCanvasSource(CANVAS, src);
-    const colId = /<div([^>]*?)data-cd-id="([0-9a-f]{8})"/.exec(withIds)?.[2] as string;
-    const secId = /<section([^>]*?)data-cd-id="([0-9a-f]{8})"/.exec(withIds)?.[2] as string;
-    const pId = /<p([^>]*?)data-cd-id="([0-9a-f]{8})"/.exec(withIds)?.[2] as string;
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containers: [
-        {
-          containerId: secId,
-          containerSetRelative: true,
-          children: [{ id: pId, left: 5, top: 5, width: 50, height: 20 }],
-        },
-      ],
-      dissolve: [colId],
-    });
-    // The col wrapper's tags are gone; the <p> hoisted directly under section.
-    expect(out.source).not.toContain('className="col"');
-    expect(out.source).toMatch(/<section[^>]*>\s*<p style=\{\{ position: "absolute"/);
-    expect(out.source).toContain('</section>');
-    expect(out.source).not.toMatch(/<\/div>/);
-  });
-
-  test('an id that is BOTH a style target and a dissolve target throws', () => {
-    const src = `function Demo() { return <div><p>a</p></div>; }`;
-    const ids = idsOf(src);
-    expect(() =>
-      applyConvertToAbsolute(CANVAS, src, {
-        containers: [
-          {
-            containerSetRelative: false,
-            children: [{ id: ids.p as string, left: 0, top: 0, width: 1, height: 1 }],
-          },
-        ],
-        dissolve: [ids.p as string],
-      })
-    ).toThrow(/both a style target and a dissolve/);
-  });
-});
-
-// dogfood round 4 — the element-level subtree ROOT keeps flow position but
-// freezes its own box (auto height would collapse once children go absolute).
-describe('canvas-edit / applyConvertToAbsolute — root freezeSize', () => {
-  test('container gets relative + frozen width/height in one style attr', () => {
-    const src = `function Demo() { return <div className="grp"><p>a</p></div>; }`;
-    const ids = idsOf(src);
-    const out = applyConvertToAbsolute(CANVAS, src, {
-      containers: [
-        {
-          containerId: ids.div as string,
-          containerSetRelative: true,
-          freezeSize: { width: 472, height: 131 },
-          children: [{ id: ids.p as string, left: 12, top: 12, width: 60, height: 30 }],
-        },
-      ],
-    });
-    expect(out.source).toContain(
-      '<div style={{ position: "relative", width: "472px", height: "131px", "box-sizing": "border-box" }} className="grp">'
-    );
-    expect(out.source).toContain('position: "absolute"');
-  });
-});

package/apps/studio/test/credential-grammar.test.ts

@@ -1,107 +0,0 @@
-// The credential registry — validate 2026-07-30.
-//
-// The point of these is not that six regexes work. It is that the registry
-// stays COMPLETE: the last test walks the source tree for prefixes the code
-// actually mints and fails when one of them has no grammar. A seventh
-// credential shape cannot reach a diagnostic bundle unnoticed.
-
-import { describe, expect, test } from 'bun:test';
-import { readdirSync, readFileSync, statSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-import { CREDENTIAL_GRAMMARS, redactMaudeCredentials } from '../credential-grammar.ts';
-import { scrub } from '../debug-bundle.ts';
-
-const REPO = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
-
-describe('every Maude-minted credential is redacted', () => {
-  const samples: Array<[string, string]> = [
-    ['peer-token', 'mau_0123456789abcdef0123456789abcdef'],
-    ['personal-token', `mpt_${'a'.repeat(48)}`],
-    ['handoff-code', `mhc_${'b'.repeat(64)}`],
-    ['device-code', `mdc_${'c'.repeat(48)}`],
-    // The one the JWT rule structurally cannot see: TWO parts, not three,
-    // because the project token deliberately is not a JWT (DDR-204).
-    ['project-token', 'eyJlbWFpbCI6ImFAYi5jbyJ9.c2lnbmF0dXJlLXRoYXQtaXMtbG9uZy1lbm91Z2g'],
-    ['derived-cell-secret', 'f'.repeat(64)],
-  ];
-
-  for (const [id, sample] of samples) {
-    test(`${id} never survives a scrub`, () => {
-      const line = `[sync] presenting ${sample} to the workspace`;
-      expect(redactMaudeCredentials(line)).not.toContain(sample);
-      // And through the real front door the bug report uses.
-      expect(scrub(line)).not.toContain(sample);
-    });
-  }
-
-  test('a two-part project token is caught even though the JWT rule needs three', () => {
-    const twoPart = 'eyJlbWFpbCI6ImFAYi5jbyJ9.c2lnbmF0dXJlLXRoYXQtaXMtbG9uZy1lbm91Z2g';
-    expect(twoPart.split('.').length).toBe(2);
-    expect(scrub(`token=${twoPart}`)).not.toContain(twoPart);
-  });
-
-  test('an underscore-joined secret env name is redacted (\\b cannot match inside HUB_SECRET)', () => {
-    const out = scrub('HUB_SECRET=s3cr3t-value-here CELL_SECRET_MASTER=another-one');
-    expect(out).not.toContain('s3cr3t-value-here');
-    expect(out).not.toContain('another-one');
-    expect(out).toContain('HUB_SECRET');
-  });
-
-  test('ordinary text is left alone', () => {
-    const plain = 'opened .design/ui/home.tsx and rendered 42 artboards in 1.2s';
-    expect(scrub(plain)).toContain('home.tsx');
-    expect(scrub(plain)).not.toContain('[redacted]');
-  });
-});
-
-describe('the registry stays complete', () => {
-  /** Every `<prefix>_` literal the codebase mints a credential with. */
-  function mintedPrefixes(): Set<string> {
-    const found = new Set<string>();
-    const walk = (dir: string, depth = 0) => {
-      if (depth > 4) return;
-      for (const entry of readdirSync(dir)) {
-        if (entry === 'node_modules' || entry.startsWith('.')) continue;
-        const p = join(dir, entry);
-        let st: ReturnType<typeof statSync>;
-        try {
-          st = statSync(p);
-        } catch {
-          continue;
-        }
-        if (st.isDirectory()) {
-          walk(p, depth + 1);
-          continue;
-        }
-        if (!/\.(mjs|ts)$/.test(entry) || /\.test\./.test(entry)) continue;
-        const src = readFileSync(p, 'utf8');
-        // A mint always builds the value from a literal prefix plus randomness,
-        // e.g. `` `mpt_${b64hex(crypto.getRandomValues(...))}` ``.
-        for (const m of src.matchAll(/`(m[a-z]{2})_\$\{/g)) found.add(m[1]);
-      }
-    };
-    for (const app of ['apps/cloud', 'apps/hub', 'apps/cells', 'cli']) {
-      try {
-        walk(join(REPO, app));
-      } catch {
-        /* an absent app is not a failure */
-      }
-    }
-    return found;
-  }
-
-  test('every prefix the code mints has a grammar', () => {
-    const registered = new Set(
-      CREDENTIAL_GRAMMARS.flatMap((g) => {
-        const m = /\\b(m[a-z]{2})_/.exec(g.pattern.source);
-        return m ? [m[1]] : [];
-      })
-    );
-    const minted = mintedPrefixes();
-    expect(minted.size).toBeGreaterThan(0); // the walk must actually find things
-    const missing = [...minted].filter((p) => !registered.has(p));
-    expect(missing).toEqual([]);
-  });
-});

package/apps/studio/test/csp-canvas-shell.test.ts

@@ -1,62 +0,0 @@
-// cspForCanvasShell — A6 (DDR-060 F1 re-audit) CSP hardening for the segregated
-// canvas origin. Asserts the exfil-relevant directives are present and that
-// `frame-ancestors` is only emitted when the main origin is known (so the legit
-// cross-origin embed is never accidentally blocked).
-
-import { describe, expect, test } from 'bun:test';
-
-import { cspForCanvasShell } from '../http.ts';
-
-const SHELL = '<!doctype html><html><head><script>const x=1;</script></head><body></body></html>';
-
-describe('cspForCanvasShell — A6 hardening', () => {
-  test('locks down the dangerous lanes', () => {
-    const csp = cspForCanvasShell(SHELL);
-    expect(csp).toContain("default-src 'none'");
-    expect(csp).toContain("connect-src 'self'");
-    expect(csp).toContain("object-src 'none'");
-    expect(csp).toContain("base-uri 'none'");
-    // No eval / no inline-script escape hatch.
-    expect(csp).not.toContain('unsafe-eval');
-    expect(csp).not.toMatch(/script-src[^;]*unsafe-inline/);
-  });
-
-  test("adds webrtc 'block' (connect-src does not cover WebRTC exfil)", () => {
-    expect(cspForCanvasShell(SHELL)).toContain("webrtc 'block'");
-  });
-
-  test("adds form-action 'none'", () => {
-    expect(cspForCanvasShell(SHELL)).toContain("form-action 'none'");
-  });
-
-  test('hashes inline scripts (no unsafe-inline for script-src)', () => {
-    const csp = cspForCanvasShell(SHELL);
-    expect(csp).toMatch(/script-src 'self' 'sha256-[A-Za-z0-9+/=]+'/);
-  });
-
-  test('frame-ancestors allowlists the main origin when known', () => {
-    const csp = cspForCanvasShell(SHELL, 'http://localhost:4399');
-    expect(csp).toContain("frame-ancestors 'self' http://localhost:4399");
-  });
-
-  test('frame-ancestors carries every advertised loopback spelling (localhost + 127.0.0.1)', () => {
-    const csp = cspForCanvasShell(SHELL, 'http://localhost:4399 http://127.0.0.1:4399');
-    expect(csp).toContain("frame-ancestors 'self' http://localhost:4399 http://127.0.0.1:4399");
-  });
-
-  test('frame-ancestors is OMITTED when the main origin is unknown (would block the legit embed)', () => {
-    const csp = cspForCanvasShell(SHELL);
-    expect(csp).not.toContain('frame-ancestors');
-  });
-
-  // fix-photo-editor-followup-debt Task 22 — the narrow, documented
-  // `connect-src` exception for @imgly/background-removal's model-weight CDN.
-  // Regression guard against both directions of drift: the exception being
-  // silently reverted, AND further hosts creeping in beside it.
-  test('connect-src carries the exact staticimgly.com exception, no more', () => {
-    const csp = cspForCanvasShell(SHELL);
-    expect(csp).toContain("connect-src 'self' https://staticimgly.com");
-    const connectSrc = csp.split('; ').find((d) => d.startsWith('connect-src'));
-    expect(connectSrc).toBe("connect-src 'self' https://staticimgly.com");
-  });
-});

package/apps/studio/test/csrf-write-guard.test.ts

@@ -1,141 +0,0 @@
-// CSRF Origin guard for the main-origin source-write routes (edit-css /
-// edit-text / edit-attr). DDR-105. The DDR-054 origin-split already blocks the
-// untrusted canvas *iframe* (canvas-origin-gate.test.ts proves that). This guard
-// covers the OTHER untrusted origin: a malicious top-level page in another tab
-// forging a `text/plain` CORS simple-request POST to localhost. The browser
-// stamps such a request with an unspoofable cross-origin `Origin` header, so the
-// guard must reject it — while still letting the legit same-origin shell write
-// and not breaking non-browser clients (which send no Origin header).
-//
-// Unit-level on purpose: `sameOriginWrite` is a pure function of the Request, so
-// we exercise the decision directly instead of booting a subprocess server.
-// (A booted-server integration test would add a 124th server-booting file to the
-// suite, which perturbs bun's worker scheduling and surfaces a PRE-EXISTING
-// cross-worker port-collision flake in canvas-meta-api.test.ts — a test-harness
-// race unrelated to this guard. See the Phase 12.2 validate notes.)
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-
-import { sameOriginRead, sameOriginWrite } from '../http.ts';
-
-const SELF = 'http://localhost:4399';
-const post = (origin?: string): Request =>
-  new Request(`${SELF}/_api/edit-css`, {
-    method: 'POST',
-    headers: { 'content-type': 'text/plain', ...(origin ? { origin } : {}) },
-    body: '{}',
-  });
-
-describe('CSRF Origin guard — sameOriginWrite (DDR-105)', () => {
-  test('rejects a forged cross-origin Origin', () => {
-    expect(sameOriginWrite(post('http://evil.example'))).toBe(false);
-    // A look-alike host (substring / suffix tricks) must not slip through.
-    expect(sameOriginWrite(post('http://localhost.evil.example'))).toBe(false);
-    expect(sameOriginWrite(post('http://localhost:4399.evil.example'))).toBe(false);
-    // Right host, wrong port is still cross-origin.
-    expect(sameOriginWrite(post('http://localhost:4400'))).toBe(false);
-  });
-
-  test('allows the legit same-origin shell Origin', () => {
-    expect(sameOriginWrite(post(SELF))).toBe(true);
-  });
-
-  test('a matching host on a different SCHEME is same-origin — TLS terminates at the cell proxy', () => {
-    // The second half of the inspector-edits RCA. In a cell the browser sends
-    // `https://<host>` but the studio serves plaintext and computes `req.url` as
-    // `http://<host>`, so a scheme-strict compare 403'd every legitimate shell
-    // write. Host+port still pins it; a cross-site page has a different host.
-    const cell = 'https://alligators.cloud.maude.sh';
-    const cellReq = (origin?: string) =>
-      new Request('http://alligators.cloud.maude.sh/_api/edit-css', {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', ...(origin ? { origin } : {}) },
-        body: '{}',
-      });
-    expect(sameOriginWrite(cellReq(cell))).toBe(true); // https Origin ↔ http req.url, same host
-    // But a genuinely different host is still rejected, scheme notwithstanding.
-    expect(sameOriginWrite(cellReq('https://evil.cloud.maude.sh'))).toBe(false);
-    // And the port still discriminates when present.
-    expect(sameOriginWrite(post('https://localhost:4400'))).toBe(false);
-  });
-
-  test('allows a request with no Origin header (curl / programmatic / bun:test)', () => {
-    expect(sameOriginWrite(post())).toBe(true);
-  });
-
-  test('rejects an unparseable Origin rather than letting it through', () => {
-    expect(sameOriginWrite(post('not a url'))).toBe(false);
-  });
-});
-
-describe('CSRF read guard — sameOriginRead (Task 2.5 F1, Fetch-Metadata)', () => {
-  const get = (secFetchSite?: string): Request =>
-    new Request(`${SELF}/_api/generate/audio-search?q=x`, {
-      method: 'GET',
-      headers: { ...(secFetchSite ? { 'sec-fetch-site': secFetchSite } : {}) },
-    });
-
-  test('rejects a cross-site browser GET (key-bearing fan-out must not be CSRF-triggerable)', () => {
-    expect(sameOriginRead(get('cross-site'))).toBe(false);
-    expect(sameOriginRead(get('same-site'))).toBe(false);
-  });
-
-  test('allows a same-origin browser GET', () => {
-    expect(sameOriginRead(get('same-origin'))).toBe(true);
-    expect(sameOriginRead(get('none'))).toBe(true); // direct navigation
-  });
-
-  test('allows a non-browser client (CLI / curl — no Sec-Fetch-Site header)', () => {
-    expect(sameOriginRead(get())).toBe(true);
-  });
-});
-
-// phase-30 / DDR-120: the ai-activity bridge now projects `/_api/ai/*` POSTs
-// onto room awareness, which crosses the hub to every connected peer. So a
-// forged cross-origin POST to /start /heartbeat /end is no longer a harmless
-// loopback banner — it injects a fake "<x> is editing <slug>" presence to all
-// peers (the channel that drives the social save/publish decision). These three
-// routes MUST carry the same `sameOriginWrite` guard as the other write routes.
-// Source-level assertion (same "don't boot a server" rationale as above): pin
-// the guard into each route block so an accidental removal fails CI.
-describe('CSRF Origin guard — /_api/ai/* presence-bridge routes (phase-30)', () => {
-  const src = readFileSync(fileURLToPath(new URL('../http.ts', import.meta.url)), 'utf8');
-
-  for (const route of ['/_api/ai/start', '/_api/ai/heartbeat', '/_api/ai/end']) {
-    test(`${route} is wired with the sameOriginWrite CSRF guard`, () => {
-      // Slice from this route's key to the next route key, then assert the guard
-      // appears inside that block.
-      const start = src.indexOf(`'${route}':`);
-      expect(start).toBeGreaterThan(-1);
-      const after = src.indexOf("'/_api/", start + 1);
-      const block = src.slice(start, after === -1 ? undefined : after);
-      expect(block).toContain('sameOriginWrite(req)');
-    });
-  }
-});
-
-// Phase 12.1 / DDR-138: /_api/reorder is a source-write (node-move). It MUST
-// carry the same sameOriginWrite guard as the other edit-* write routes so a
-// forged cross-origin POST can't drive a structural reorder of the user's .tsx.
-// Source-level assertion (same "don't boot a server" rationale as above).
-describe('CSRF Origin guard — /_api/reorder source-write route (DDR-138)', () => {
-  const src = readFileSync(fileURLToPath(new URL('../http.ts', import.meta.url)), 'utf8');
-
-  test('/_api/reorder is wired with the sameOriginWrite CSRF guard', () => {
-    const start = src.indexOf("'/_api/reorder':");
-    expect(start).toBeGreaterThan(-1);
-    const after = src.indexOf("'/_api/", start + 1);
-    const block = src.slice(start, after === -1 ? undefined : after);
-    expect(block).toContain('sameOriginWrite(req)');
-  });
-
-  test('/_api/reorder-revert is wired with the sameOriginWrite CSRF guard', () => {
-    const start = src.indexOf("'/_api/reorder-revert':");
-    expect(start).toBeGreaterThan(-1);
-    const after = src.indexOf("'/_api/", start + 1);
-    const block = src.slice(start, after === -1 ? undefined : after);
-    expect(block).toContain('sameOriginWrite(req)');
-  });
-});