@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/perf-harness.ts

@@ -1,193 +0,0 @@
-#!/usr/bin/env bun
-// Performance harness for Phase 3.4 budgets.
-//
-//   bun run apps/studio/test/perf-harness.ts
-//
-// Boots the dev-server against a synthetic .design/ fixture, measures the
-// budget table from `.ai/plans/phase-3.4-architecture-refactor.md`, and writes
-// `test/perf-report.json` plus a one-line stdout summary.
-//
-// Budgets (relaxed per DDR-012):
-//   coldStartHttpMs        < 100   process spawn -> /_health 200
-//   bundleGzBytes          < 80 KB after Bun.build minify
-//   wsRoundTripP50         < 1
-//   wsRoundTripP99         < 5
-//
-// Non-blocking job — CI records the numbers and only fails on > 20 % regression
-// from the prior baseline. Locally `--strict` exits 1 on any budget miss.
-
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { gzipSync, spawn } from 'bun';
-
-const STRICT = process.argv.includes('--strict');
-const PORT = 4500 + Math.floor(Math.random() * 1000);
-
-const HERE = import.meta.dir;
-const REPO = join(HERE, '..');
-
-interface Report {
-  ts: string;
-  budgets: Record<string, { value: number; budget: number; unit: string; pass: boolean }>;
-  notes: string[];
-}
-
-function makeFixture(): string {
-  const root = mkdtempSync(join(tmpdir(), 'mdcc-perf-'));
-  mkdirSync(join(root, '.design', 'ui'), { recursive: true });
-  writeFileSync(join(root, '.design', 'config.json'), '{"name":"perf"}');
-  for (let i = 0; i < 10; i++) {
-    writeFileSync(
-      join(root, '.design', 'ui', `c${i}.html`),
-      `<!doctype html><html><body><div data-dc-screen="s${i}"><h1>${i}</h1></div></body></html>`
-    );
-  }
-  return root;
-}
-
-async function measureColdStart(root: string): Promise<number> {
-  const start = performance.now();
-  const proc = spawn({
-    cmd: ['bun', 'run', join(REPO, 'server.ts'), '--port', String(PORT), '--root', root],
-    cwd: REPO,
-    env: { ...process.env, NO_OPEN: '1', NODE_ENV: 'production' },
-    stdout: 'ignore',
-    stderr: 'ignore',
-  });
-  try {
-    while (performance.now() - start < 5000) {
-      try {
-        const r = await fetch(`http://localhost:${PORT}/_health`, {
-          signal: AbortSignal.timeout(50),
-        });
-        if (r.ok) return performance.now() - start;
-      } catch {
-        /* not up yet */
-      }
-      await Bun.sleep(5);
-    }
-    throw new Error('cold-start: server did not respond within 5 s');
-  } finally {
-    proc.kill();
-    await proc.exited;
-  }
-}
-
-async function measureBundleSize(): Promise<number> {
-  const buildResult = spawn({
-    cmd: [
-      'bun',
-      'run',
-      join(REPO, 'build.ts'),
-      '--release',
-      `--target=bun-${process.platform}-${process.arch}`,
-    ],
-    cwd: REPO,
-    stdout: 'ignore',
-    stderr: 'ignore',
-    env: { ...process.env, NODE_ENV: 'production' },
-  });
-  const code = await buildResult.exited;
-  if (code !== 0) throw new Error('build failed');
-  const bundle = await Bun.file(join(REPO, 'dist', 'client.bundle.js')).arrayBuffer();
-  const gz = gzipSync(new Uint8Array(bundle));
-  return gz.byteLength;
-}
-
-async function measureWsRoundTrip(root: string): Promise<{ p50: number; p99: number }> {
-  const proc = spawn({
-    cmd: ['bun', 'run', join(REPO, 'server.ts'), '--port', String(PORT + 1), '--root', root],
-    cwd: REPO,
-    env: { ...process.env, NO_OPEN: '1' },
-    stdout: 'ignore',
-    stderr: 'ignore',
-  });
-  try {
-    while (true) {
-      try {
-        const r = await fetch(`http://localhost:${PORT + 1}/_health`, {
-          signal: AbortSignal.timeout(50),
-        });
-        if (r.ok) break;
-      } catch {
-        /* */
-      }
-      await Bun.sleep(20);
-    }
-    const ws = new WebSocket(`ws://localhost:${PORT + 1}/_ws`);
-    await new Promise<void>((resolve, reject) => {
-      const t = setTimeout(() => reject(new Error('ws timeout')), 2000);
-      ws.addEventListener('open', () => {
-        clearTimeout(t);
-        resolve();
-      });
-      ws.addEventListener('error', reject);
-    });
-
-    const samples: number[] = [];
-    for (let i = 0; i < 500; i++) {
-      const t = performance.now();
-      ws.send(JSON.stringify({ type: 'active', file: `.design/ui/c${i % 10}.html` }));
-      // No round-trip echo for `active`; approximate by next-tick read.
-      await Bun.sleep(0);
-      samples.push(performance.now() - t);
-    }
-    ws.close();
-    samples.sort((a, b) => a - b);
-    return {
-      p50: samples[Math.floor(samples.length * 0.5)] ?? 0,
-      p99: samples[Math.floor(samples.length * 0.99)] ?? 0,
-    };
-  } finally {
-    proc.kill();
-    await proc.exited;
-  }
-}
-
-async function main() {
-  const root = makeFixture();
-  const report: Report = { ts: new Date().toISOString(), budgets: {}, notes: [] };
-
-  const cold = await measureColdStart(root);
-  report.budgets.coldStartHttpMs = {
-    value: Math.round(cold),
-    budget: 100,
-    unit: 'ms',
-    pass: cold < 100,
-  };
-
-  const gz = await measureBundleSize();
-  report.budgets.bundleGzBytes = {
-    value: gz,
-    budget: 80 * 1024,
-    unit: 'B',
-    pass: gz < 80 * 1024,
-  };
-
-  const ws = await measureWsRoundTrip(root);
-  report.budgets.wsRoundTripP50 = {
-    value: +ws.p50.toFixed(2),
-    budget: 1,
-    unit: 'ms',
-    pass: ws.p50 < 1,
-  };
-  report.budgets.wsRoundTripP99 = {
-    value: +ws.p99.toFixed(2),
-    budget: 5,
-    unit: 'ms',
-    pass: ws.p99 < 5,
-  };
-
-  writeFileSync(join(HERE, 'perf-report.json'), JSON.stringify(report, null, 2));
-
-  const summary = Object.entries(report.budgets)
-    .map(([k, v]) => `${v.pass ? '✓' : '✗'} ${k}=${v.value}${v.unit} (budget ${v.budget}${v.unit})`)
-    .join('  ');
-  console.log(summary);
-
-  const failed = Object.values(report.budgets).filter((b) => !b.pass).length;
-  if (STRICT && failed > 0) process.exit(1);
-}
-
-await main();

package/apps/studio/test/phase-3.6-smoke.test.ts

@@ -1,79 +0,0 @@
-// Phase 3.6 Task 11 — end-to-end smoke. Runs the full TSX pipeline against
-// the migrated canvases sitting in this repo's .design/ui/ folder, verifying:
-//
-//   - oxc-parser + magic-string two-pass transform produces parseable JS
-//   - locator map is non-trivially populated (every JSX element gets an entry)
-//   - Bun.build wraps the post-pass-1 source into a browser-loadable ESM
-//     (proves the codemod's output cooperates with canvas-build.ts)
-//   - handoff.emitRegistryItem produces a schema-valid registry-item.json
-//     with `data-cd-id` stripped + react/react-dom in the dep floor
-//
-// Skips itself cleanly when the canvases haven't been migrated (CI / fresh
-// checkout). The bun-only-locally guard keeps the suite portable.
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync } from 'node:fs';
-import path from 'node:path';
-
-import { buildCanvasModule } from '../canvas-build.ts';
-import { transpileCanvasSource } from '../canvas-pipeline.ts';
-import { emitRegistryItem } from '../handoff.ts';
-
-// apps/studio/test → ../../.. = repo root (DDR-095: was ../../../.. at the old
-// plugins/design/dev-server/test depth).
-const REPO_ROOT = path.resolve(import.meta.dir, '../../..');
-const DESIGN_ROOT = path.join(REPO_ROOT, '.design');
-const DOCS_SITE = path.join(DESIGN_ROOT, 'ui/Docs Site.tsx');
-const CANVAS_VIEWPORT = path.join(DESIGN_ROOT, 'ui/Canvas Viewport.tsx');
-
-const skipReason = (() => {
-  if (!existsSync(DOCS_SITE)) return `${DOCS_SITE} missing — run scripts/migrate-canvases.ts`;
-  if (!existsSync(CANVAS_VIEWPORT))
-    return `${CANVAS_VIEWPORT} missing — run scripts/migrate-canvases.ts`;
-  return null;
-})();
-
-const describeOrSkip = skipReason ? describe.skip : describe;
-
-describeOrSkip('Phase 3.6 smoke — migrated canvases through the full pipeline', () => {
-  test('canvas-pipeline transpiles Docs Site.tsx + emits a non-trivial locator', async () => {
-    const src = await Bun.file(DOCS_SITE).text();
-    const r = transpileCanvasSource(DOCS_SITE, src);
-    expect(r.js.length).toBeGreaterThan(0);
-    // Docs Site has 5 artboards × ~tens of elements each — well above the 100 floor.
-    expect(Object.keys(r.locator).length).toBeGreaterThan(100);
-    // ETag is deterministic across runs on identical source.
-    const again = transpileCanvasSource(DOCS_SITE, src);
-    expect(again.etag).toBe(r.etag);
-  });
-
-  test('canvas-pipeline transpiles Canvas Viewport.tsx', async () => {
-    const src = await Bun.file(CANVAS_VIEWPORT).text();
-    const r = transpileCanvasSource(CANVAS_VIEWPORT, src);
-    expect(r.js.length).toBeGreaterThan(0);
-    expect(Object.keys(r.locator).length).toBeGreaterThan(100);
-  });
-
-  test('canvas-build produces browser-loadable ESM for Docs Site.tsx', async () => {
-    const src = await Bun.file(DOCS_SITE).text();
-    const r = await buildCanvasModule(DOCS_SITE, src);
-    expect(r.js).toContain('export');
-    // React + jsx-runtime stay external (resolved via importmap in shell).
-    expect(r.js).toContain('react');
-  });
-
-  test('handoff.emitRegistryItem strips data-cd-id + floors react/react-dom', async () => {
-    const item = await emitRegistryItem({
-      canvasAbsPath: DOCS_SITE,
-      title: 'Docs Site',
-      description: 'Smoke regression target',
-    });
-    expect(item.$schema).toBe('https://ui.shadcn.com/schema/registry-item.json');
-    expect(item.type).toBe('registry:block');
-    expect(item.name).toBe('docs-site');
-    expect(item.dependencies).toContain('react');
-    expect(item.dependencies).toContain('react-dom');
-    expect(item.files[0]?.path).toBe('components/docs-site.tsx');
-    expect(item.files[0]?.content).not.toContain('data-cd-id');
-  });
-});

package/apps/studio/test/photo-bg-remove-validation.test.ts

@@ -1,71 +0,0 @@
-// photo-bg-remove.sh --asset validation — fix-photo-editor-followup-debt Task
-// 21. Drives the real bash script as a subprocess (mirrors annotate-write.test.ts's
-// spawn-a-bin pattern) against a temp design root, asserting the strict
-// `assets/<sha8>.<ext>` shape check (Task 1) rejects path traversal and
-// injection-shaped values with exit 2, while a well-formed reference proceeds
-// PAST validation (a missing on-disk asset then fails for a different, later
-// reason — exit 1 — proving the regex, not the filesystem check, isn't what
-// stopped it).
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-const BIN = new URL('../bin/photo-bg-remove.sh', import.meta.url).pathname;
-
-let root: string;
-
-beforeAll(() => {
-  root = mkdtempSync(join(tmpdir(), 'photo-bg-remove-test-'));
-  mkdirSync(join(root, '.design'), { recursive: true });
-});
-
-afterAll(() => {
-  rmSync(root, { recursive: true, force: true });
-});
-
-function run(asset: string): { code: number; err: string } {
-  const proc = Bun.spawnSync(['bash', BIN, '--asset', asset, '--root', root]);
-  return {
-    code: proc.exitCode,
-    err: new TextDecoder().decode(proc.stderr),
-  };
-}
-
-describe('photo-bg-remove.sh --asset validation', () => {
-  test('rejects path traversal', () => {
-    const res = run('assets/../../../etc/passwd');
-    expect(res.code).toBe(2);
-    expect(res.err).toContain('must look like assets/<sha8>.<ext>');
-  });
-
-  test('rejects an injection-shaped value (quotes/braces breaking out of the JSX splice)', () => {
-    const res = run('assets/aaaaaaaa.png" }; alert(1); ({ "y.png');
-    expect(res.code).toBe(2);
-  });
-
-  test('rejects backtick-embedded values', () => {
-    const res = run('assets/aaaaaaaa$(whoami).png');
-    expect(res.code).toBe(2);
-  });
-
-  test('rejects uppercase hex (sha8 is always lowercase in this codebase)', () => {
-    const res = run('assets/DEADBEEF.png');
-    expect(res.code).toBe(2);
-  });
-
-  test('rejects a bare prefix with no hex body', () => {
-    const res = run('assets/');
-    expect(res.code).toBe(2);
-  });
-
-  test('a well-formed reference proceeds past validation (fails later, not with exit 2)', () => {
-    const res = run('assets/deadbeef.png');
-    expect(res.code).not.toBe(2);
-    // No asset on disk under this temp root — fails at the existence check
-    // (exit 1), proving the regex accepted the shape and let it through.
-    expect(res.code).toBe(1);
-    expect(res.err).toContain('asset not found');
-  });
-});

package/apps/studio/test/photo-canvas-bundle.test.ts

@@ -1,79 +0,0 @@
-// photo-canvas-bundle.test.ts — the automated guard for the lazy-bundle
-// acceptance criterion + BUILDER's flagged top risk (feature-photo-editor).
-//
-// A canvas that uses <PhotoLayer> with a NEUTRAL edit must pay ZERO pixi.js cost:
-// the ~500 KB pixi runtime must stay behind a LAZY runtime `import("pixi.js")`,
-// never an eager top-level `import ... from "pixi.js"`. Canvas builds run with
-// `splitting: false`, so this is fragile — a future refactor that turns the
-// compositor's pixi import back into a static import (or statically imports
-// pipeline.ts from canvas-lib) would silently re-break it. This test bundles a
-// real canvas via the actual dev-server pipeline and inspects the output.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { buildCanvasModule } from '../canvas-build.ts';
-
-const CANVAS = `
-import { DesignCanvas, DCArtboard, PhotoLayer } from '@maude/canvas-lib';
-export default function C() {
-  return (
-    <DesignCanvas>
-      <DCArtboard id="a" width={200} height={200}>
-        <PhotoLayer source="assets/aaaa1111.png" edit={{}} width={120} height={120} alt="photo" />
-      </DCArtboard>
-    </DesignCanvas>
-  );
-}
-`;
-
-async function buildCanvas(source: string): Promise<string> {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-photo-bundle-'));
-  const abs = join(dir, 'probe.tsx');
-  writeFileSync(abs, source);
-  try {
-    const { js } = await buildCanvasModule(abs, source, {});
-    return js;
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-describe('lazy-bundle guarantee — <PhotoLayer> keeps pixi out of the eager graph', () => {
-  test('an unedited PhotoLayer canvas has NO eager `from "pixi.js"` import', async () => {
-    const js = await buildCanvas(CANVAS);
-    const eager = [...js.matchAll(/import\s[^;]*?from\s*["']pixi\.js["']/g)];
-    expect(eager.length).toBe(0);
-  });
-
-  test('pixi is reachable only via a lazy runtime import("pixi.js")', async () => {
-    const js = await buildCanvas(CANVAS);
-    expect(/import\(\s*["']pixi\.js["']\s*\)/.test(js)).toBe(true);
-  });
-
-  test('the canvas still bundles PhotoLayer itself (sanity — the import resolved)', async () => {
-    const js = await buildCanvas(CANVAS);
-    // isDefaultEdit is the schema helper <PhotoLayer> calls on the render path.
-    expect(js.includes('isDefaultEdit') || js.includes('PhotoLayer')).toBe(true);
-  });
-});
-
-describe('lazy-bundle guarantee — the export-capture bridge keeps dom-to-svg out of the eager graph', () => {
-  // DDR-231: every canvas mounts useExportCaptureBridge (via DesignCanvas), so
-  // an EAGER dom-to-svg import would tax every canvas load with the ~110 KB
-  // bundle. Same fragility as pixi: canvas builds run `splitting: false`, and
-  // a refactor that turns the bridge's `await import('dom-to-svg')` static
-  // silently re-breaks this.
-  test('a plain canvas has NO eager `from "dom-to-svg"` import', async () => {
-    const js = await buildCanvas(CANVAS);
-    const eager = [...js.matchAll(/import\s[^;]*?from\s*["']dom-to-svg["']/g)];
-    expect(eager.length).toBe(0);
-  });
-
-  test('dom-to-svg is reachable only via a lazy runtime import("dom-to-svg")', async () => {
-    const js = await buildCanvas(CANVAS);
-    expect(/import\(\s*["']dom-to-svg["']\s*\)/.test(js)).toBe(true);
-  });
-});

package/apps/studio/test/photo-edit-api.test.ts

@@ -1,201 +0,0 @@
-// photo-edit-api.test.ts — the /_api/photo-edit route + photo-store cap stack
-// (feature-photo-editor, Task 23; pairs with Stage C). Mirrors asset-api.test.ts
-// (real-server round-trip) + canvas-origin-gate.test.ts (dual-allowlist proof).
-//
-// Coverage per the plan: schema validation rejects malformed PhotoEdit JSON, the
-// size cap is enforced, path containment holds against a crafted `asset` param,
-// GET/PUT both work, and the route's presence in BOTH allowlists is asserted
-// (reachable + method-gated from the segregated canvas origin — the DDR-088
-// one-list-only 404 bug this test exists to prevent).
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { assetSha8 } from '../photo-store.ts';
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-const VALID_SHA = 'ab12cd34ef56';
-const VALID_ASSET = `assets/${VALID_SHA}.png`;
-
-// ── Pure: sha8 extraction is the primary traversal defense ───────────────────
-describe('assetSha8 — extraction + traversal rejection (pure)', () => {
-  test('accepts the forms a caller might hold', () => {
-    expect(assetSha8(VALID_ASSET)).toBe(VALID_SHA);
-    expect(assetSha8(`/assets/${VALID_SHA}.png`)).toBe(VALID_SHA);
-    expect(assetSha8(`${VALID_SHA}.jpg`)).toBe(VALID_SHA);
-    expect(assetSha8(VALID_SHA)).toBe(VALID_SHA);
-  });
-  test('rejects traversal / non-hex / empty', () => {
-    for (const bad of [
-      null,
-      undefined,
-      '',
-      '../../etc/passwd',
-      'assets/../../secret',
-      'assets/..%2f..%2fx', // query-decoded to `../../x` before we see it
-      '/etc/passwd',
-      'not-hex-zzz',
-      'ab12cd34/../x',
-      '../ab12cd34',
-    ]) {
-      expect(assetSha8(bad)).toBeNull();
-    }
-  });
-});
-
-// ── Real-server round-trip ───────────────────────────────────────────────────
-async function withServer(
-  fn: (port: number, designRoot: string) => Promise<void>,
-  extraEnv?: Record<string, string>
-) {
-  const sandbox = makeSandbox();
-  const port = nextPort();
-  const proc = await bootServer(sandbox.root, port, extraEnv);
-  try {
-    await fn(port, sandbox.designRoot);
-  } finally {
-    await killProc(proc);
-  }
-}
-
-const put = (port: number, asset: string, body: unknown) =>
-  fetch(`http://localhost:${port}/_api/photo-edit?asset=${encodeURIComponent(asset)}`, {
-    method: 'PUT',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-const get = (port: number, asset: string) =>
-  fetch(`http://localhost:${port}/_api/photo-edit?asset=${encodeURIComponent(asset)}`);
-
-describe('/_api/photo-edit — GET/PUT round-trip + cap stack (main origin)', () => {
-  test('PUT a valid edit persists it; GET reads it back; sidecar lands on disk', async () => {
-    await withServer(async (port, designRoot) => {
-      const edit = {
-        adjustments: { contrast: 0.3, brightness: -0.1 },
-        duotone: { enabled: true, colorA: '#1a1a2e', colorB: '#e94560', intensity: 0.8 },
-      };
-      const res = await put(port, VALID_ASSET, edit);
-      expect(res.status).toBe(200);
-      const j = await res.json();
-      expect(j.ok).toBe(true);
-      expect(j.path).toBe(`assets/${VALID_SHA}.photo.json`);
-      expect(j.edit.version).toBe(1); // stamped on write
-
-      // GET round-trips the same params.
-      const got = await (await get(port, VALID_ASSET)).json();
-      expect(got.adjustments.contrast).toBe(0.3);
-      expect(got.duotone.colorB).toBe('#e94560');
-
-      // The sidecar actually exists at the content-addressed path.
-      const disk = join(designRoot, 'assets', `${VALID_SHA}.photo.json`);
-      expect(existsSync(disk)).toBe(true);
-      expect(JSON.parse(readFileSync(disk, 'utf8')).version).toBe(1);
-    });
-  });
-
-  test('GET of an unedited asset returns {}', async () => {
-    await withServer(async (port) => {
-      const got = await (await get(port, 'assets/00ff00ff.png')).json();
-      expect(got).toEqual({});
-    });
-  });
-
-  test('PUT malformed JSON is rejected (unknown key / bad type / out-of-range)', async () => {
-    await withServer(async (port) => {
-      expect((await put(port, VALID_ASSET, { bogusKey: 1 })).status).toBe(400);
-      expect((await put(port, VALID_ASSET, { adjustments: { contrast: 'high' } })).status).toBe(
-        400
-      );
-      expect((await put(port, VALID_ASSET, { adjustments: { contrast: 5 } })).status).toBe(400);
-      expect((await put(port, VALID_ASSET, { duotone: { colorA: 'red' } })).status).toBe(400);
-      // A crafted non-relative asset path in the body is rejected too.
-      expect((await put(port, VALID_ASSET, { source: '/etc/passwd' })).status).toBe(400);
-    });
-  });
-
-  test('PUT with a crafted asset param (traversal) is rejected 400', async () => {
-    await withServer(async (port) => {
-      expect((await put(port, '../../etc/passwd', { adjustments: { contrast: 0.1 } })).status).toBe(
-        400
-      );
-      expect((await get(port, 'assets/../../secret')).status).toBe(200); // GET → {} (null-safe), never leaks
-      const leaked = await (await get(port, 'assets/../../secret')).json();
-      expect(leaked).toEqual({});
-    });
-  });
-
-  test('PUT an oversized body is rejected (size cap)', async () => {
-    await withServer(async (port) => {
-      // `source` is a valid relative asset path with no length cap in the schema,
-      // so it's the field that can legally exceed the 64 KB byte cap. Sits just
-      // above the store cap but below the route's readJson ceiling.
-      const big = { source: `assets/${'a'.repeat(66000)}` };
-      const res = await put(port, VALID_ASSET, big);
-      expect(res.status).toBe(413);
-    });
-  });
-
-  test('method gate — DELETE is 405', async () => {
-    await withServer(async (port) => {
-      const res = await fetch(`http://localhost:${port}/_api/photo-edit?asset=${VALID_ASSET}`, {
-        method: 'DELETE',
-      });
-      expect(res.status).toBe(405);
-    });
-  });
-});
-
-// ── Dual-allowlist: reachable + method-gated from the canvas origin ──────────
-async function readCanvasOrigin(designRoot: string): Promise<string> {
-  for (let i = 0; i < 40; i++) {
-    try {
-      const info = JSON.parse(readFileSync(join(designRoot, '_server.json'), 'utf8'));
-      if (info.canvasOrigin) return info.canvasOrigin as string;
-    } catch {
-      /* not written yet */
-    }
-    await Bun.sleep(50);
-  }
-  throw new Error('canvasOrigin never appeared in _server.json');
-}
-
-describe('/_api/photo-edit — dual-allowlist (canvas origin reachable, DDR-088)', () => {
-  test('canvas origin: GET is reachable (200, not 404) and DELETE is method-gated (405)', async () => {
-    await withServer(
-      async (_port, designRoot) => {
-        const canvas = await readCanvasOrigin(designRoot);
-        // If the route were in CANVAS_SAFE_API only (missing from server.ts's
-        // `routes` map), Bun's fetch fall-through would serve it as a FILE → 404.
-        // 200 here proves the handler runs → it's in the server.ts routes map too.
-        const gRes = await fetch(`${canvas}/_api/photo-edit?asset=${VALID_ASSET}`, {
-          signal: AbortSignal.timeout(3000),
-        });
-        expect(gRes.status).toBe(200);
-        // DELETE reaches the handler (405), not the file fall-through (404).
-        const dRes = await fetch(`${canvas}/_api/photo-edit?asset=${VALID_ASSET}`, {
-          method: 'DELETE',
-          signal: AbortSignal.timeout(3000),
-        });
-        expect(dRes.status).toBe(405);
-      },
-      { MAUDE_CANVAS_ORIGIN_SPLIT: '1' }
-    );
-  });
-
-  test('canvas origin: PUT succeeds (no sameOriginWrite block — the headless harness needs this)', async () => {
-    await withServer(
-      async (_port, designRoot) => {
-        const canvas = await readCanvasOrigin(designRoot);
-        const res = await fetch(`${canvas}/_api/photo-edit?asset=${VALID_ASSET}`, {
-          method: 'PUT',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ adjustments: { saturation: 0.5 } }),
-          signal: AbortSignal.timeout(3000),
-        });
-        expect(res.status).toBe(200);
-      },
-      { MAUDE_CANVAS_ORIGIN_SPLIT: '1' }
-    );
-  });
-});