@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/shared-doc-migrate.test.ts

@@ -1,369 +0,0 @@
-// Phase 9.2 (DDR-064) Phase E — the one-time authoritative seed (Task 9).
-//
-// Pins the fix for Risk 1, the duplication-on-merge trap: a shared doc must be
-// populated from ONE source. These tests prove migrateSeed never duplicates
-// comments and is idempotent across re-runs (server restarts).
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import * as Y from 'yjs';
-
-import { createPersistence, Y_TYPES } from '../collab/persistence.ts';
-import type { Context } from '../context.ts';
-import { applyCommentsToDoc, applyCssToDoc, applyHtmlToDoc } from '../sync/codec.ts';
-import { hashBytes } from '../sync/echo-guard.ts';
-import { docIsEmpty, migrateSeed } from '../sync/migrate-seed.ts';
-
-let dir: string;
-beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), 'migrate-seed-'));
-});
-afterEach(() => {
-  rmSync(dir, { recursive: true, force: true });
-});
-
-function paths() {
-  return {
-    html: join(dir, 'screen.html'),
-    comments: join(dir, 'screen.comments.json'),
-    annotations: join(dir, 'screen.annotations.svg'),
-    meta: join(dir, 'screen.meta.json'),
-    css: join(dir, 'screen.css'),
-  };
-}
-
-describe('docIsEmpty', () => {
-  test('true for a fresh doc, false once any type is populated', () => {
-    const doc = new Y.Doc();
-    expect(docIsEmpty(doc)).toBe(true);
-    doc.getArray(Y_TYPES.comments).push([{ id: 'c1' }]);
-    expect(docIsEmpty(doc)).toBe(false);
-  });
-});
-
-describe('migrateSeed — adopt (hub was empty)', () => {
-  test('seeds an empty doc from local files and reports local-adopt', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>local body</main>');
-    writeFileSync(p.comments, JSON.stringify([{ id: 'c1', text: 'local' }]));
-
-    const doc = new Y.Doc();
-    const result = await migrateSeed({ slug: 's', doc, paths: p });
-
-    expect(result).toBe('local-adopt');
-    expect(doc.getText('html').toString()).toBe('<main>local body</main>');
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'c1', text: 'local' }]);
-  });
-
-  test('empty doc + no local files → "empty" (nothing to seed)', async () => {
-    const doc = new Y.Doc();
-    expect(await migrateSeed({ slug: 's', doc, paths: paths() })).toBe('empty');
-    expect(docIsEmpty(doc)).toBe(true);
-  });
-});
-
-describe('migrateSeed — idempotent (no duplication on re-run)', () => {
-  test('adopting twice leaves comments un-duplicated', async () => {
-    const p = paths();
-    writeFileSync(
-      p.comments,
-      JSON.stringify([
-        { id: 'c1', text: 'x' },
-        { id: 'c2', text: 'y' },
-      ])
-    );
-
-    const doc = new Y.Doc();
-    expect(await migrateSeed({ slug: 's', doc, paths: p })).toBe('local-adopt');
-    expect(doc.getArray(Y_TYPES.comments).length).toBe(2);
-
-    // Second run (e.g. server restart): the doc is now non-empty → hub-wins
-    // branch → no re-adopt → still exactly 2 comments, byte-identical.
-    expect(await migrateSeed({ slug: 's', doc, paths: p })).toBe('hub-wins');
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([
-      { id: 'c1', text: 'x' },
-      { id: 'c2', text: 'y' },
-    ]);
-  });
-});
-
-describe('room file-seed disable (the other half of the Risk-1 fix)', () => {
-  test('persistence.seed is a no-op for a pinned slug — never touches api or the doc', async () => {
-    let apiCalled = false;
-    // Minimal api stub; seed must short-circuit before reaching it.
-    const api = {
-      loadCommentsForFile: async () => {
-        apiCalled = true;
-        return [];
-      },
-      loadAnnotations: async () => {
-        apiCalled = true;
-        return null;
-      },
-    } as unknown as import('../api.ts').Api;
-    const ctx = { paths: { designRoot: dir } } as unknown as Context;
-
-    const persistence = createPersistence({
-      ctx,
-      api,
-      fileForSlug: async () => 'ui/x.html',
-      // Mirrors createCollab's predicate: don't seed a pinned (provider-attached)
-      // slug under sharedDoc — the migrate-seed + provider own population.
-      shouldSeed: (slug) => slug !== 'pinned',
-    });
-
-    const doc = new Y.Doc();
-    await persistence.seed('pinned', doc);
-    // Returned before touching the api or mutating the doc → no duplicate items
-    // can be introduced by the file-seed after the migrate-seed ran.
-    expect(apiCalled).toBe(false);
-    expect(docIsEmpty(doc)).toBe(true);
-  });
-});
-
-describe('migrateSeed — hub-wins (the duplication trap avoided)', () => {
-  test('a doc already holding hub comments is NOT merged with the local file → no dup', async () => {
-    const p = paths();
-    // Local file (e.g. copied via git) holds the SAME logical comment id…
-    writeFileSync(p.comments, JSON.stringify([{ id: 'c1', text: 'from disk' }]));
-
-    // …but the doc already received it from the hub (a DIFFERENT CRDT item).
-    const doc = new Y.Doc();
-    applyCommentsToDoc(doc, [{ id: 'c1', text: 'from hub' }], 'hub');
-
-    const result = await migrateSeed({ slug: 's', doc, paths: p });
-
-    // Hub wins; the local file is NOT pushed as a second item — exactly ONE c1
-    // (DDR-102 id-union keeps the doc's version for a shared id).
-    expect(result).toBe('hub-wins');
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'c1', text: 'from hub' }]);
-  });
-
-  test('snapshots divergent local files to historyDir before the hub-wins overwrite', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>LOCAL divergent</main>');
-    writeFileSync(p.comments, JSON.stringify([{ id: 'local' }]));
-
-    const doc = new Y.Doc();
-    applyHtmlToDoc(doc, '<main>HUB</main>', 'hub'); // doc holds hub state
-
-    const historyDir = join(dir, '_history', 's');
-    // DDR-102: this divergence (no journal, no doc stamp) resolves
-    // conflict-hub-wins — the legacy whole-set safety copy still happens.
-    const result = await migrateSeed({ slug: 's', doc, paths: p, historyDir });
-
-    expect(result).toBe('conflict-hub-wins');
-    // The pre-migration snapshot captured the local files for rollback.
-    const snapped = readdirSync(join(historyDir, 'pre-shared-doc-migration'));
-    expect(snapped).toContain('screen.html');
-    expect(snapped).toContain('screen.comments.json');
-  });
-});
-
-// ---------------------------------------------------------------------------
-// DDR-102 — the shared-doc path consumes the same cold-start decision table:
-// journal-gated fast-forward, dual snapshot + newest-wins on divergence,
-// comments id-union.
-describe('migrateSeed — DDR-102 divergence matrix', () => {
-  function makeJournal(initial: Record<string, { bodyHash: string }> = {}) {
-    const entries = new Map(Object.entries(initial));
-    return {
-      get: (slug: string) => entries.get(slug) ?? null,
-      record: (slug: string, hashes: { bodyHash?: string; cssHash?: string }) => {
-        const prev = entries.get(slug);
-        entries.set(slug, { bodyHash: hashes.bodyHash ?? prev?.bodyHash ?? '' });
-      },
-      invalidateIfHubChanged: () => {},
-      flush: () => {},
-      stop: () => {},
-      size: () => entries.size,
-    };
-  }
-
-  test('journal match → fast-forward (hub keeps), no snapshot, no conflict', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>synced-v1</main>');
-    const doc = new Y.Doc();
-    applyHtmlToDoc(doc, '<main>hub-v2</main>', 'hub');
-
-    const journal = makeJournal({ s: { bodyHash: hashBytes('<main>synced-v1</main>') } });
-    const snapshots: string[] = [];
-    const conflicts: unknown[] = [];
-    const result = await migrateSeed({
-      slug: 's',
-      doc,
-      paths: p,
-      journal,
-      snapshot: async (_c, reason) => {
-        snapshots.push(reason);
-        return 'ts';
-      },
-      onConflict: (info) => {
-        conflicts.push(info);
-      },
-    });
-
-    expect(result).toBe('hub-wins');
-    expect(doc.getText('html').toString()).toBe('<main>hub-v2</main>'); // doc untouched
-    expect(snapshots).toHaveLength(0);
-    expect(conflicts).toHaveLength(0);
-  });
-
-  test('diverged + local newer → conflict-local-wins: doc REBUILT from local in one MIGRATION tx', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>local-newer</main>');
-    writeFileSync(p.css, '.local{}');
-    const doc = new Y.Doc();
-    doc.transact(() => {
-      applyHtmlToDoc(doc, '<main>hub-older</main>', 'hub');
-      applyCssToDoc(doc, '.hub{}', 'hub');
-      doc.getMap('syncMeta').set('bodyEditAt', Date.now() - 60_000);
-    });
-
-    const snapshots: Array<{ content: string; reason: string }> = [];
-    const conflicts: Array<{ winner?: string; snapshots?: { local?: string; hub?: string } }> = [];
-    const result = await migrateSeed({
-      slug: 's',
-      doc,
-      paths: p,
-      journal: makeJournal(),
-      snapshot: async (content, reason) => {
-        snapshots.push({ content, reason });
-        return `ts-${snapshots.length}`;
-      },
-      onConflict: (info) => {
-        conflicts.push(info);
-      },
-    });
-
-    expect(result).toBe('conflict-local-wins');
-    expect(doc.getText('html').toString()).toBe('<main>local-newer</main>');
-    // css follows the body winner.
-    expect(doc.getText('css').toString()).toBe('.local{}');
-    // Dual snapshot captured BOTH pre-resolution versions.
-    expect(snapshots.map((s) => s.reason)).toEqual(['pre-sync-local', 'pre-sync-hub']);
-    expect(snapshots[0].content).toBe('<main>local-newer</main>');
-    expect(snapshots[1].content).toBe('<main>hub-older</main>');
-    expect(conflicts[0].winner).toBe('local');
-    expect(conflicts[0].snapshots).toEqual({ local: 'ts-1', hub: 'ts-2' });
-  });
-
-  test('diverged + hub newer (stamp) → conflict-hub-wins: doc untouched', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>local-older</main>');
-    const doc = new Y.Doc();
-    doc.transact(() => {
-      applyHtmlToDoc(doc, '<main>hub-newer</main>', 'hub');
-      doc.getMap('syncMeta').set('bodyEditAt', Date.now() + 60_000);
-    });
-
-    const conflicts: Array<{ winner?: string }> = [];
-    const result = await migrateSeed({
-      slug: 's',
-      doc,
-      paths: p,
-      journal: makeJournal(),
-      onConflict: (info) => {
-        conflicts.push(info);
-      },
-    });
-
-    expect(result).toBe('conflict-hub-wins');
-    expect(doc.getText('html').toString()).toBe('<main>hub-newer</main>');
-    expect(conflicts[0].winner).toBe('hub');
-  });
-
-  test('doc holds comments but NO body + local body → body-seed-up (gap closed)', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>only-local-body</main>');
-    const doc = new Y.Doc();
-    doc.getArray(Y_TYPES.comments).push([{ id: 'h1' }]); // doc non-empty, body empty
-
-    const result = await migrateSeed({ slug: 's', doc, paths: p, journal: makeJournal() });
-
-    expect(result).toBe('body-seed-up');
-    expect(doc.getText('html').toString()).toBe('<main>only-local-body</main>');
-    // Hub comments survive untouched.
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'h1' }]);
-  });
-
-  test('comments id-union: local-only comments survive a hub-wins cutover', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>same</main>');
-    writeFileSync(
-      p.comments,
-      JSON.stringify([
-        { id: 'c1', text: 'shared' },
-        { id: 'c3', text: 'local-only' },
-      ])
-    );
-    const doc = new Y.Doc();
-    doc.transact(() => {
-      applyHtmlToDoc(doc, '<main>same</main>', 'hub');
-      applyCommentsToDoc(
-        doc,
-        [
-          { id: 'c1', text: 'shared (hub copy wins)' },
-          { id: 'c2', text: 'hub-only' },
-        ],
-        'hub'
-      );
-    });
-
-    const result = await migrateSeed({ slug: 's', doc, paths: p });
-
-    expect(result).toBe('hub-wins');
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([
-      { id: 'c1', text: 'shared (hub copy wins)' },
-      { id: 'c2', text: 'hub-only' },
-      { id: 'c3', text: 'local-only' },
-    ]);
-  });
-});
-
-// DDR-102 fail-closed (security review F1) — the shared-doc path must also
-// refuse a hub-wins cutover when the local snapshot didn't land.
-describe('migrateSeed — fail-closed on snapshot failure (DDR-102 F1)', () => {
-  function makeJournal() {
-    const entries = new Map<string, { bodyHash: string }>();
-    return {
-      get: (slug: string) => entries.get(slug) ?? null,
-      record: (slug: string, h: { bodyHash?: string; cssHash?: string }) =>
-        entries.set(slug, { bodyHash: h.bodyHash ?? entries.get(slug)?.bodyHash ?? '' }),
-      invalidateIfHubChanged: () => {},
-      flush: () => {},
-      stop: () => {},
-      size: () => entries.size,
-    };
-  }
-
-  test('hub newer BUT local snapshot null → rebuild doc from local (no overwrite), conflict-local-wins', async () => {
-    const p = paths();
-    writeFileSync(p.html, '<main>local-work</main>');
-    const doc = new Y.Doc();
-    doc.transact(() => {
-      applyHtmlToDoc(doc, '<main>hub-stale</main>', 'hub');
-      doc.getMap('syncMeta').set('bodyEditAt', Date.now() + 60_000); // hub would win
-    });
-
-    const conflicts: Array<{ winner?: string; snapshotFailed?: boolean }> = [];
-    const result = await migrateSeed({
-      slug: 's',
-      doc,
-      paths: p,
-      journal: makeJournal(),
-      snapshot: async () => null, // _history write fails
-      onConflict: (info) => {
-        conflicts.push(info);
-      },
-    });
-
-    // Doc rebuilt from local → projection would write local back (no loss).
-    expect(result).toBe('conflict-local-wins');
-    expect(doc.getText('html').toString()).toBe('<main>local-work</main>');
-    expect(conflicts[0].winner).toBe('local');
-    expect(conflicts[0].snapshotFailed).toBe(true);
-  });
-});

package/apps/studio/test/shared-doc-projection.test.ts

@@ -1,238 +0,0 @@
-// Phase 9.2 (DDR-064) Phase C — loop-free disk projection (Tasks 6 + 7).
-//
-// Unit tests for sync/projection.ts in isolation (no runtime / no hub). They
-// pin the contract the shared-doc cutover relies on:
-//   - doc→file projects html/css/meta only (the collab room owns comments +
-//     annotations doc→file — no double-write);
-//   - file→doc imports all five types as a minimal DIFF (never wholesale),
-//     tagged FILE_IMPORT so it doesn't echo back to disk;
-//   - our own doc→file writes are dropped on their fs echo (hash guard);
-//   - a body file edit does NOT clobber concurrent in-doc comments (independent
-//     Y-types — the cross-type no-clobber guarantee);
-//   - an unparseable file is quarantined after 3 strikes (circuit breaker).
-//
-// NB: true char-level merge of CONCURRENT edits to the SAME body region is
-// Phase 10 (structured CRDT). Here the body is opaque Y.Text + prefix/suffix
-// diff: it preserves untouched regions, but a whole-file /design:edit that omits
-// a concurrent browser body edit will still supersede it. Browsers edit
-// comments/annotations (separate types), so that residual is out of Phase C
-// scope by design.
-
-import { describe, expect, test } from 'bun:test';
-import * as Y from 'yjs';
-
-import { Y_TYPES } from '../collab/persistence.ts';
-import { applyHtmlToDoc, MAX_HTML_BYTES } from '../sync/codec.ts';
-import { createEchoGuard, hashBytes } from '../sync/echo-guard.ts';
-import { ORIGINS } from '../sync/origins.ts';
-import { createDocProjection } from '../sync/projection.ts';
-
-const enc = (s: string) => new TextEncoder().encode(s);
-
-interface Write {
-  path: string;
-  bytes: string;
-}
-
-function makeProjection(paths: {
-  html: string;
-  comments: string;
-  annotations: string;
-  meta?: string;
-  css?: string;
-}) {
-  const doc = new Y.Doc();
-  const writes: Write[] = [];
-  const echoGuard = createEchoGuard();
-  const projection = createDocProjection({
-    slug: 'p',
-    doc,
-    paths,
-    echoGuard,
-    flushMs: 0, // synchronous flush on the next microtask
-    writer: (path, bytes) => writes.push({ path, bytes: bytes.toString() }),
-  });
-  projection.start();
-  return { doc, writes, echoGuard, projection };
-}
-
-const PATHS = {
-  html: '/d/ui/screen.html',
-  comments: '/d/_comments/ui-screen.json',
-  annotations: '/d/ui-screen.annotations.svg',
-  meta: '/d/ui/screen.meta.json',
-  css: '/d/ui/screen.css',
-};
-
-const tick = () => new Promise((r) => setTimeout(r, 0));
-
-describe('projection doc→file (html/css/meta only — room owns comments/annotations)', () => {
-  test('projects html / css / meta on a doc edit', async () => {
-    const { doc, writes, projection } = makeProjection(PATHS);
-    doc.getText('html').insert(0, '<button>hi</button>');
-    doc.getText('css').insert(0, '.b{color:red}');
-    // meta is stored as the canonical SHARED subset (a JSON string in Y.Text).
-    doc.getText('meta').insert(0, JSON.stringify({ title: 'Screen' }));
-    await projection.flush();
-
-    const byPath = Object.fromEntries(writes.map((w) => [w.path, w.bytes]));
-    expect(byPath[PATHS.html]).toBe('<button>hi</button>');
-    expect(byPath[PATHS.css]).toBe('.b{color:red}');
-    expect(JSON.parse(byPath[PATHS.meta])).toMatchObject({ title: 'Screen' });
-    await tick();
-  });
-
-  test('does NOT write comments or annotations doc→file (the room owns those)', async () => {
-    const { doc, writes, projection } = makeProjection(PATHS);
-    doc.getArray(Y_TYPES.comments).push([{ id: 'c1', text: 'hi' }]);
-    doc.getMap(Y_TYPES.annotations).set('svg', '<svg/>');
-    await projection.flush();
-    expect(writes.find((w) => w.path === PATHS.comments)).toBeUndefined();
-    expect(writes.find((w) => w.path === PATHS.annotations)).toBeUndefined();
-  });
-
-  test('never clobbers a non-empty body with an empty doc value (safe reconcile)', async () => {
-    const { writes, projection } = makeProjection(PATHS);
-    // doc html is empty → reconcile must not write an empty file over local.
-    projection.reconcile();
-    expect(writes.find((w) => w.path === PATHS.html)).toBeUndefined();
-  });
-});
-
-describe('projection file→doc (diff-import, all five types, FILE_IMPORT origin)', () => {
-  test('imports an external body edit into the doc', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    const body = '<main>edited</main>';
-    const changed = projection.applyFromFs({
-      path: PATHS.html,
-      bytes: enc(body),
-      hash: hashBytes(body),
-    });
-    expect(changed).toBe(true);
-    expect(doc.getText('html').toString()).toBe(body);
-  });
-
-  test('import is tagged FILE_IMPORT (so the projector does not re-project it)', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    let lastOrigin: unknown;
-    doc.on('update', (_u: Uint8Array, origin: unknown) => {
-      lastOrigin = origin;
-    });
-    const body = '<main>x</main>';
-    projection.applyFromFs({ path: PATHS.html, bytes: enc(body), hash: hashBytes(body) });
-    expect(lastOrigin).toBe(ORIGINS.FILE_IMPORT);
-  });
-
-  test('imports comments + annotations too', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    const comments = JSON.stringify([{ id: 'x', text: 'yo' }]);
-    expect(
-      projection.applyFromFs({
-        path: PATHS.comments,
-        bytes: enc(comments),
-        hash: hashBytes(comments),
-      })
-    ).toBe(true);
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'x', text: 'yo' }]);
-
-    const svg = '<svg><rect/></svg>';
-    expect(
-      projection.applyFromFs({ path: PATHS.annotations, bytes: enc(svg), hash: hashBytes(svg) })
-    ).toBe(true);
-    expect(doc.getMap(Y_TYPES.annotations).get('svg')).toBe(svg);
-  });
-
-  test('body import is a MINIMAL diff — preserves an untouched suffix region', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    doc.getText('html').insert(0, 'HELLO WORLD');
-    // Change only the prefix; the diff must keep " WORLD" in place (prefix/suffix
-    // elimination), not delete-all + insert-all.
-    const next = 'HOWDY WORLD';
-    projection.applyFromFs({ path: PATHS.html, bytes: enc(next), hash: hashBytes(next) });
-    expect(doc.getText('html').toString()).toBe(next);
-    // Cross-check the codec produced a minimal op (the same primitive the
-    // projector uses) — a wholesale replace would not preserve the suffix.
-    const probe = new Y.Doc();
-    probe.getText('html').insert(0, 'HELLO WORLD');
-    expect(applyHtmlToDoc(probe, next, 'x')).toBe(true);
-  });
-});
-
-describe('projection loop-freedom', () => {
-  test('drops the fs echo of our own doc→file write (hash guard)', async () => {
-    const { doc, projection } = makeProjection(PATHS);
-    doc.getText('html').insert(0, '<x/>');
-    await projection.flush();
-    // The fs.watch fires for our own write — same bytes → same hash → dropped,
-    // doc unchanged, no re-import.
-    let updates = 0;
-    doc.on('update', () => {
-      updates++;
-    });
-    const changed = projection.applyFromFs({
-      path: PATHS.html,
-      bytes: enc('<x/>'),
-      hash: hashBytes('<x/>'),
-    });
-    expect(changed).toBe(false);
-    expect(updates).toBe(0);
-  });
-
-  test('a body file edit does NOT clobber concurrent in-doc comments (cross-type no-clobber)', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    // Browser added a comment (lives in the comments Y.Array).
-    doc.getArray(Y_TYPES.comments).push([{ id: 'live', text: 'mine' }]);
-    // Concurrently /design:edit rewrites the whole body file.
-    const body = '<main>rewritten by design:edit</main>';
-    projection.applyFromFs({ path: PATHS.html, bytes: enc(body), hash: hashBytes(body) });
-    // Body updated; the concurrent comment SURVIVED (independent Y-type).
-    expect(doc.getText('html').toString()).toBe(body);
-    expect(doc.getArray(Y_TYPES.comments).toArray()).toEqual([{ id: 'live', text: 'mine' }]);
-  });
-});
-
-describe('projection hub→disk hardening (security re-audit A2 + A3)', () => {
-  test('A2 — refuses to materialize an oversized (hub-pushed) body to disk', async () => {
-    const { doc, writes, projection } = makeProjection(PATHS);
-    // Simulate a hub raw-update that bypassed the codec import cap: an oversized
-    // body lands directly in the shared doc.
-    doc.getText('html').insert(0, 'x'.repeat(MAX_HTML_BYTES + 1));
-    await projection.flush();
-    // The doc→file lane must refuse it — no disk-fill DoS.
-    expect(writes.find((w) => w.path === PATHS.html)).toBeUndefined();
-  });
-
-  test('A3 — a meta file with __proto__ is imported without polluting Object.prototype', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    const malicious = JSON.stringify({ __proto__: { polluted: 'yes' }, title: 'ok' });
-    projection.applyFromFs({ path: PATHS.meta, bytes: enc(malicious), hash: hashBytes(malicious) });
-    // The dangerous key was stripped at parse time — no prototype pollution and
-    // the stored shared meta carries only the safe key.
-    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
-    const stored = doc.getText('meta').toString();
-    expect(stored).not.toContain('__proto__');
-    expect(stored).not.toContain('polluted');
-    expect(stored).toContain('ok');
-  });
-});
-
-describe('projection circuit breaker', () => {
-  test('quarantines an unparseable meta file after 3 strikes (until checksum changes)', () => {
-    const { doc, projection } = makeProjection(PATHS);
-    const broken = '{ not json';
-    const ev = { path: PATHS.meta, bytes: enc(broken), hash: hashBytes(broken) };
-    // First three attempts: parse fails → false, strikes accumulate.
-    expect(projection.applyFromFs(ev)).toBe(false);
-    expect(projection.applyFromFs(ev)).toBe(false);
-    expect(projection.applyFromFs(ev)).toBe(false);
-    // Now quarantined for that hash — still false, but short-circuited.
-    expect(projection.applyFromFs(ev)).toBe(false);
-
-    // A DIFFERENT (valid) payload clears the quarantine and applies.
-    const ok = JSON.stringify({ title: 'Fixed' });
-    expect(projection.applyFromFs({ path: PATHS.meta, bytes: enc(ok), hash: hashBytes(ok) })).toBe(
-      true
-    );
-    expect(doc.getText('meta').toString()).toContain('Fixed');
-  });
-});

package/apps/studio/test/shell-importmap.test.ts

@@ -1,56 +0,0 @@
-// shell-importmap.test.ts — regression guard for the bug that broke
-// PhotoBgRemoveHarness's first real run (feature-photo-editor, Task 18):
-// `@imgly/background-removal` was added to `RUNTIME_PACKAGES` (runtime-bundle.ts,
-// Task 7/11) and its `/_canvas-runtime/@imgly_background-removal.js` bundle was
-// built + floor-checked, but the hand-maintained `<script type="importmap">` in
-// `_shell.html` never got the matching entry — so any CANVAS-side code
-// (`import('@imgly/background-removal')`, only ever exercised by the shell's
-// OWN client bundle until this task) hit a browser-native "Failed to resolve
-// module specifier" the moment it actually ran inside a canvas iframe.
-//
-// The invariant: every entry in RUNTIME_PACKAGES must have a matching
-// `_shell.html` importmap key pointing at `/_canvas-runtime/<slugFor(pkg)>.js`.
-// canvas-build.ts externalises the WHOLE list unconditionally (`externalSpecifiers
-// = new Set(RUNTIME_PACKAGES)`), so a package added there without a matching
-// importmap entry silently ships a canvas-side dead import until something
-// actually calls it at runtime — this test catches it at build time instead.
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { DEV_SERVER_ROOT } from '../paths.ts';
-import { RUNTIME_PACKAGES, slugFor } from '../runtime-bundle.ts';
-
-const SHELL_HTML_PATH = join(
-  DEV_SERVER_ROOT,
-  '..',
-  '..',
-  'plugins',
-  'design',
-  'templates',
-  '_shell.html'
-);
-
-describe('_shell.html importmap agrees with RUNTIME_PACKAGES', () => {
-  const shellHtml = readFileSync(SHELL_HTML_PATH, 'utf8');
-  const importmapMatch = shellHtml.match(/<script type="importmap">([\s\S]*?)<\/script>/);
-  test('the importmap script block exists', () => {
-    expect(importmapMatch).not.toBeNull();
-  });
-  const importmap = JSON.parse(importmapMatch?.[1] ?? '{}') as { imports?: Record<string, string> };
-  const imports = importmap.imports ?? {};
-
-  for (const pkg of RUNTIME_PACKAGES) {
-    test(`"${pkg}" resolves to its /_canvas-runtime/ bundle`, () => {
-      // RELATIVE (`./`), and that leading dot is load-bearing (Cloud Phase 27).
-      // An importmap value resolves against the DOCUMENT's base URL, so a
-      // root-absolute `/_canvas-runtime/…` is correct only where the shell is
-      // served from the origin root. On the fleet's shared canvas host the
-      // shell lives under `/<project>/`, and every bundle 404'd there — the
-      // grey-canvas failure the per-project origin was introduced to end.
-      // Relative is right in BOTH shapes, so it is the one form to hold.
-      expect(imports[pkg]).toBe(`./_canvas-runtime/${slugFor(pkg)}.js`);
-    });
-  }
-});