@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/sync-file-pull.test.ts

@@ -1,333 +0,0 @@
-// The file plane's downward half — what lands, what is refused, and what a
-// conflict costs (never work, silently).
-
-import { describe, expect, test } from 'bun:test';
-
-import { createHash } from 'node:crypto';
-import {
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  utimesSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-
-import { classifyProjectFile } from '../sync/file-membership.ts';
-import { fetchFileManifest, pullFiles, type RemoteFileEntry } from '../sync/file-pull.ts';
-
-const sha = (body: string): string => createHash('sha256').update(body).digest('hex');
-
-interface FakeFile {
-  body: string;
-  mtimeMs?: number;
-  /** Override the manifest's class hint (for disagreement tests). */
-  class?: string;
-}
-
-/** A fake hub: one manifest, one file store, a request log. */
-function makeHub(files: Record<string, FakeFile>) {
-  const requests: string[] = [];
-  const fetchImpl = (async (url: RequestInfo | URL) => {
-    const u = String(url);
-    requests.push(u);
-    if (u.endsWith('/api/files')) {
-      const list = Object.entries(files).map(([p, f]) => ({
-        path: p,
-        sha256: sha(f.body),
-        size: Buffer.byteLength(f.body),
-        mtimeMs: f.mtimeMs ?? 1_000_000,
-        class: f.class ?? classifyProjectFile(p),
-      }));
-      return new Response(JSON.stringify({ files: list, count: list.length }), { status: 200 });
-    }
-    const m = u.match(/\/_project-file\/(.+)$/);
-    if (m) {
-      const rel = decodeURIComponent(m[1] ?? '');
-      const f = files[rel];
-      if (!f) return new Response('nf', { status: 404 });
-      return new Response(f.body, { status: 200 });
-    }
-    return new Response('nf', { status: 404 });
-  }) as typeof fetch;
-  return { fetchImpl, requests };
-}
-
-const silent = { log: () => {}, warn: () => {} };
-
-function makeRoot(): string {
-  return mkdtempSync(path.join(tmpdir(), 'maude-filepull-'));
-}
-
-function pull(
-  designRoot: string,
-  fetchImpl: typeof fetch,
-  overrides: Partial<Parameters<typeof pullFiles>[0]> = {}
-) {
-  return pullFiles({
-    designRoot,
-    hubUrl: 'http://hub.test',
-    token: () => 'tok',
-    allowCodeModules: false,
-    fetchImpl,
-    log: silent,
-    ...overrides,
-  });
-}
-
-describe('file-pull — the RCA gap closes', () => {
-  test('a fresh empty root receives the whole miss-list shape', async () => {
-    const root = makeRoot();
-    try {
-      const { fetchImpl } = makeHub({
-        'system/ds/brand.css': { body: ':root{}' },
-        'system/ds/README.md': { body: '# ds' },
-        'system/ds/preview/_layout.css': { body: '.x{}' },
-        'system/ds/assets/logos/logo.svg': { body: '<svg/>' },
-        'assets/c0fa9c7f.png': { body: 'PNG' },
-        'system/ds/EMPTY.md': { body: '' }, // an empty doc is a real file
-      });
-      const out = await pull(root, fetchImpl);
-      expect(out.pulled.sort()).toEqual([
-        'assets/c0fa9c7f.png',
-        'system/ds/EMPTY.md',
-        'system/ds/README.md',
-        'system/ds/assets/logos/logo.svg',
-        'system/ds/brand.css',
-        'system/ds/preview/_layout.css',
-      ]);
-      expect(readFileSync(path.join(root, 'system/ds/brand.css'), 'utf8')).toBe(':root{}');
-      expect(readFileSync(path.join(root, 'system/ds/EMPTY.md'), 'utf8')).toBe('');
-      expect(out.failed).toEqual([]);
-      expect(out.dropped).toEqual([]);
-      // No half-written residue anywhere.
-      expect(existsSync(path.join(root, 'system/ds/brand.css.part'))).toBe(false);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('code modules are dropped without the owner gate, and land with it', async () => {
-    const root = makeRoot();
-    try {
-      const { fetchImpl } = makeHub({
-        'system/ds/preview/_brand-css.ts': { body: 'export {}' },
-      });
-      const denied = await pull(root, fetchImpl);
-      expect(denied.pulled).toEqual([]);
-      expect(denied.dropped.length).toBe(1);
-      expect(denied.dropped[0]?.reason).toMatch(/owner/);
-      expect(existsSync(path.join(root, 'system/ds/preview/_brand-css.ts'))).toBe(false);
-
-      const allowed = await pull(root, fetchImpl, { allowCodeModules: true });
-      expect(allowed.pulled).toEqual(['system/ds/preview/_brand-css.ts']);
-      expect(readFileSync(path.join(root, 'system/ds/preview/_brand-css.ts'), 'utf8')).toBe(
-        'export {}'
-      );
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('file-pull — the receiver re-validates every path', () => {
-  test('a hostile manifest cannot land config, runtime state, or traversal', async () => {
-    const root = makeRoot();
-    try {
-      const { fetchImpl, requests } = makeHub({
-        'config.json': { body: '{"linkedHub":{"url":"http://evil"}}', class: 'companion-text' },
-        '_server.json': { body: '{}', class: 'companion-text' },
-        '_untrusted/INDEX.json': { body: '{}', class: 'companion-text' },
-        '../escape.css': { body: 'x', class: 'companion-text' },
-        '_history/old.css': { body: 'x', class: 'companion-text' },
-      });
-      const out = await pull(root, fetchImpl);
-      expect(out.pulled).toEqual([]);
-      expect(out.dropped.length).toBe(5);
-      expect(existsSync(path.join(root, 'config.json'))).toBe(false);
-      expect(existsSync(path.join(root, '_server.json'))).toBe(false);
-      // Refused entries cost ZERO byte fetches — only the manifest request.
-      expect(requests.filter((u) => u.includes('_project-file'))).toEqual([]);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test("the hub's class field is a hint — disagreement drops the entry", async () => {
-    const root = makeRoot();
-    try {
-      const { fetchImpl } = makeHub({
-        'system/ds/brand.css': { body: ':root{}', class: 'inert-media' },
-      });
-      const out = await pull(root, fetchImpl);
-      expect(out.pulled).toEqual([]);
-      expect(out.dropped[0]?.reason).toMatch(/hub says 'inert-media'/);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('a css that is a canvas sidecar HERE is refused, whatever the hub offers', async () => {
-    const root = makeRoot();
-    try {
-      // This peer holds the canvas body, so its sibling css is the CRDT css
-      // lane — plane B must not write it.
-      mkdirSync(path.join(root, 'system/ds/preview'), { recursive: true });
-      writeFileSync(path.join(root, 'system/ds/preview/specimen.tsx'), 'export default 1');
-      const { fetchImpl } = makeHub({
-        'system/ds/preview/specimen.css': { body: '.pwn{}', class: 'companion-text' },
-      });
-      const out = await pull(root, fetchImpl);
-      expect(out.pulled).toEqual([]);
-      expect(out.dropped[0]?.reason).toMatch(/canvas-owned/);
-      expect(existsSync(path.join(root, 'system/ds/preview/specimen.css'))).toBe(false);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('a body whose hash is not what the manifest promised never lands', async () => {
-    const root = makeRoot();
-    try {
-      const { fetchImpl } = makeHub({
-        'system/ds/brand.css': { body: ':root{}' },
-      });
-      // Serve DIFFERENT bytes than the manifest hashed (a racing write, or a
-      // hub lying about content) — the landing is refused, retried next pass.
-      const lying = (async (url: RequestInfo | URL) => {
-        const u = String(url);
-        if (u.includes('_project-file')) return new Response('EVIL');
-        return fetchImpl(url);
-      }) as typeof fetch;
-      const out = await pull(root, lying);
-      expect(out.pulled).toEqual([]);
-      expect(out.failed[0]?.reason).toMatch(/hash mismatch/);
-      expect(existsSync(path.join(root, 'system/ds/brand.css'))).toBe(false);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('file-pull — reconciliation', () => {
-  test('an equal hash skips, costing no byte fetch (echo-guard by construction)', async () => {
-    const root = makeRoot();
-    try {
-      mkdirSync(path.join(root, 'system/ds'), { recursive: true });
-      writeFileSync(path.join(root, 'system/ds/brand.css'), ':root{}');
-      const { fetchImpl, requests } = makeHub({
-        'system/ds/brand.css': { body: ':root{}' },
-      });
-      const out = await pull(root, fetchImpl);
-      expect(out.skipped).toBe(1);
-      expect(out.pulled).toEqual([]);
-      expect(requests.filter((u) => u.includes('_project-file'))).toEqual([]);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('a newer remote wins, and the losing local copy parks in _trash — never silent loss', async () => {
-    const root = makeRoot();
-    try {
-      mkdirSync(path.join(root, 'system/ds'), { recursive: true });
-      const abs = path.join(root, 'system/ds/brand.css');
-      writeFileSync(abs, 'LOCAL');
-      utimesSync(abs, new Date(1000), new Date(1000));
-      const { fetchImpl } = makeHub({
-        'system/ds/brand.css': { body: 'REMOTE', mtimeMs: 5_000_000 },
-      });
-      const out = await pull(root, fetchImpl, { now: () => 424242 });
-      expect(out.pulled).toEqual(['system/ds/brand.css']);
-      expect(readFileSync(abs, 'utf8')).toBe('REMOTE');
-      expect(out.conflicts).toEqual([
-        {
-          rel: 'system/ds/brand.css',
-          winner: 'hub',
-          trashedTo: '_trash/system/ds/brand.css-conflict-424242',
-        },
-      ]);
-      expect(
-        readFileSync(path.join(root, '_trash/system/ds/brand.css-conflict-424242'), 'utf8')
-      ).toBe('LOCAL');
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('an older remote loses: the local copy stays, no bytes move', async () => {
-    const root = makeRoot();
-    try {
-      mkdirSync(path.join(root, 'system/ds'), { recursive: true });
-      const abs = path.join(root, 'system/ds/brand.css');
-      writeFileSync(abs, 'LOCAL');
-      // Local mtime is "now" (fresh write); the remote claims epoch-old.
-      const { fetchImpl, requests } = makeHub({
-        'system/ds/brand.css': { body: 'REMOTE', mtimeMs: 1 },
-      });
-      const out = await pull(root, fetchImpl);
-      expect(out.pulled).toEqual([]);
-      expect(readFileSync(abs, 'utf8')).toBe('LOCAL');
-      expect(out.conflicts).toEqual([{ rel: 'system/ds/brand.css', winner: 'local' }]);
-      expect(requests.filter((u) => u.includes('_project-file'))).toEqual([]);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-
-  test('the per-pass cap is loud, and the remainder waits for the next pass', async () => {
-    const root = makeRoot();
-    try {
-      const files: Record<string, FakeFile> = {};
-      for (let i = 0; i < 205; i++)
-        files[`docs/note-${String(i).padStart(3, '0')}.md`] = { body: `n${i}` };
-      const { fetchImpl } = makeHub(files);
-      const warns: string[] = [];
-      const out = await pull(root, fetchImpl, {
-        log: { log: () => {}, warn: (m: string) => warns.push(m) },
-      });
-      expect(out.pulled.length).toBe(200);
-      expect(warns.some((w) => w.includes('205'))).toBe(true);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  });
-});
-
-describe('fetchFileManifest — never fatal, always filtered', () => {
-  test('an unreachable hub, a refusal, and junk all answer null', async () => {
-    const down = (async () => {
-      throw new Error('ECONNREFUSED');
-    }) as unknown as typeof fetch;
-    expect(await fetchFileManifest('http://hub.test', 'tok', down)).toBe(null);
-    const refusing = (async () => new Response('no', { status: 401 })) as typeof fetch;
-    expect(await fetchFileManifest('http://hub.test', 'tok', refusing)).toBe(null);
-    const junk = (async () => new Response('{"files": "nope"}')) as typeof fetch;
-    expect(await fetchFileManifest('http://hub.test', 'tok', junk)).toBe(null);
-  });
-
-  test('malformed entries are filtered before anything reads them', async () => {
-    const sneaky = (async () =>
-      new Response(
-        JSON.stringify({
-          files: [
-            { path: 'ok.md', sha256: sha('x'), size: 1, mtimeMs: 1, class: 'companion-text' },
-            { path: '', sha256: sha('x'), size: 1, mtimeMs: 1 },
-            { path: 'bad-sha.md', sha256: 'nope', size: 1, mtimeMs: 1 },
-            { sha256: sha('x') },
-            null,
-            'string',
-          ],
-        })
-      )) as typeof fetch;
-    const entries = (await fetchFileManifest(
-      'http://hub.test',
-      'tok',
-      sneaky
-    )) as RemoteFileEntry[];
-    expect(entries.map((e) => e.path)).toEqual(['ok.md']);
-  });
-});

package/apps/studio/test/sync-fresh-link-parity.test.ts

@@ -1,267 +0,0 @@
-// THE ACCEPTANCE GATE — feature-sync-file-plane.
-//
-// The RCA's shape, made a test: a fresh link delivered 79/79 canvases and
-// lost 103 files, because sync's unit was a canvas and everything else had no
-// lane. The user-visible contract this feature ships is "what's in the folder
-// syncs": a fresh, EMPTY design root linked to a project ends up
-// FILE-FOR-FILE equal to the source — minus exactly `config.json` (the trust
-// anchors) and Maude runtime state, which must never travel.
-//
-// The hub half is REAL: the actual `handleFilesRoute` / `handleProjectFileRoute`
-// handlers (apps/hub/src/file-manifest.mjs) mounted on a real `node:http`
-// server over a real source tree. Token VERIFICATION is injected (the same
-// `verify` seam the documents-route harness uses — the sqlite token store is
-// a native module bun cannot open); the real store is exercised by the hub's
-// own node suite. The peer half is the real `pullFiles`. What is SIMULATED is
-// plane A: the canvas body and its named sidecars are pre-written on the peer
-// the way the Yjs canvas lanes deliver them — that transport has its own
-// suite (sync-runtime, two-client-sync); this test's subject is everything
-// plane A does NOT carry, and the disjointness between the two.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-
-import {
-  type Dirent,
-  mkdirSync,
-  mkdtempSync,
-  readdirSync,
-  readFileSync,
-  rmSync,
-  writeFileSync,
-} from 'node:fs';
-import { createServer, type Server } from 'node:http';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-
-import { handleFilesRoute, handleProjectFileRoute } from '../../hub/src/file-manifest.mjs';
-// `matchesScope` is pure; the token STORE itself is native sqlite the bun
-// runtime cannot open, so verification is injected below (the same `verify`
-// seam the documents-route harness uses).
-import { matchesScope } from '../../hub/src/tokens.mjs';
-import { isRuntimeStateRel } from '../sync/file-membership.ts';
-import { pullFiles } from '../sync/file-pull.ts';
-
-const TOKEN = 'parity-peer-token';
-const verify = (t: string) => (t === TOKEN ? { scope: '*', label: 'peer' } : null);
-
-const CANVAS_GROUPS = [{ path: 'ui' }, { path: 'system' }];
-
-/** The RCA fixture: one canvas plus every file class the fresh link lost. */
-function seedSource(root: string): void {
-  mkdirSync(path.join(root, 'ui'), { recursive: true });
-  mkdirSync(path.join(root, 'system/ds/preview'), { recursive: true });
-  mkdirSync(path.join(root, 'system/ds/assets/logos'), { recursive: true });
-  mkdirSync(path.join(root, 'assets'), { recursive: true });
-  mkdirSync(path.join(root, '_history/junk'), { recursive: true });
-  writeFileSync(
-    path.join(root, 'config.json'),
-    JSON.stringify({ canvasGroups: CANVAS_GROUPS, linkedHub: { url: 'http://x', syncFiles: true } })
-  );
-  // Plane A's cargo — the canvas and its named sidecars.
-  writeFileSync(path.join(root, 'ui/welcome.tsx'), 'export default () => null');
-  writeFileSync(path.join(root, 'ui/welcome.meta.json'), '{"title":"Welcome"}');
-  writeFileSync(path.join(root, 'system/ds/preview/specimen.tsx'), 'export default 1');
-  writeFileSync(path.join(root, 'system/ds/preview/specimen.css'), '.spec{}');
-  // Plane B's cargo — the 103-file gap's representatives.
-  writeFileSync(path.join(root, 'system/ds/brand.css'), ':root { --bg-0: #fff }');
-  writeFileSync(path.join(root, 'system/ds/README.md'), '# the design system');
-  writeFileSync(path.join(root, 'system/ds/preview/_layout.css'), '.layout{}');
-  writeFileSync(path.join(root, 'system/ds/preview/_brand-css.ts'), 'import "./x.css"');
-  writeFileSync(path.join(root, 'system/ds/assets/logos/logo.svg'), '<svg/>');
-  writeFileSync(path.join(root, 'assets/c0fa9c7f.png'), Buffer.from([0x89, 0x50, 0x4e, 0x47]));
-  // What must NEVER travel.
-  writeFileSync(path.join(root, '_history/junk/old.tsx'), 'stale');
-  writeFileSync(path.join(root, '_server.json'), '{"pid":1}');
-}
-
-/** Plane A's delivery, simulated: what the canvas CRDT lanes put on a fresh
- *  peer (body + named sidecars), byte-identical to the source. */
-function deliverPlaneA(source: string, peer: string): void {
-  for (const rel of [
-    'ui/welcome.tsx',
-    'ui/welcome.meta.json',
-    'system/ds/preview/specimen.tsx',
-    'system/ds/preview/specimen.css',
-  ]) {
-    mkdirSync(path.dirname(path.join(peer, rel)), { recursive: true });
-    writeFileSync(path.join(peer, rel), readFileSync(path.join(source, rel)));
-  }
-}
-
-/** Every file in a tree, designRoot-relative, sorted. */
-function walkTree(root: string): string[] {
-  const out: string[] = [];
-  const walk = (dir: string, rel: string): void => {
-    let entries: Dirent[];
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
-      if (entry.isDirectory()) walk(path.join(dir, entry.name), childRel);
-      else if (entry.isFile()) out.push(childRel);
-    }
-  };
-  walk(root, '');
-  return out.sort();
-}
-
-/** The parity domain: everything except the trust anchors + runtime state. */
-function syncableSet(root: string): string[] {
-  return walkTree(root).filter((rel) => rel !== 'config.json' && !isRuntimeStateRel(rel));
-}
-
-let sourceRoot: string;
-let server: Server;
-let hubUrl: string;
-
-beforeAll(async () => {
-  sourceRoot = mkdtempSync(path.join(tmpdir(), 'maude-parity-src-'));
-  seedSource(sourceRoot);
-
-  // The REAL hub handlers on a real socket — encoding, headers and streaming
-  // all take the same path production takes.
-  server = createServer((req, res) => {
-    const pathname = (req.url ?? '').split('?')[0] ?? '';
-    const bearer = (req.headers.authorization ?? '').replace(/^Bearer\s+/i, '').trim() || null;
-    if (pathname === '/api/files') {
-      handleFilesRoute({
-        path: pathname,
-        method: req.method ?? 'GET',
-        bearer,
-        verify,
-        matchesScope,
-        designRoot: sourceRoot,
-        respondJson: (status: number, payload: unknown) => {
-          const body = JSON.stringify(payload);
-          res.writeHead(status, { 'Content-Type': 'application/json' }).end(body);
-        },
-      });
-      return;
-    }
-    void handleProjectFileRoute({
-      request: req,
-      response: res,
-      pathname,
-      method: req.method ?? 'GET',
-      dataDir: '/nonexistent', // unused — `verify` is injected
-      secret: '',
-      verify,
-      designRoot: sourceRoot,
-      matchesScope,
-    }).then((handled: boolean) => {
-      if (!handled) res.writeHead(404).end('not found');
-    });
-  });
-  await new Promise<void>((resolve) => {
-    server.listen(0, '127.0.0.1', resolve);
-  });
-  const addr = server.address();
-  hubUrl = `http://127.0.0.1:${typeof addr === 'object' && addr ? addr.port : 0}`;
-});
-
-afterAll(async () => {
-  await new Promise((resolve) => server.close(resolve));
-  rmSync(sourceRoot, { recursive: true, force: true });
-});
-
-const silent = { log: () => {}, warn: () => {} };
-
-describe('fresh-link parity — the whole project arrives', () => {
-  test('an empty peer converges to file-for-file equality minus config + runtime state', async () => {
-    const peerRoot = mkdtempSync(path.join(tmpdir(), 'maude-parity-peer-'));
-    try {
-      deliverPlaneA(sourceRoot, peerRoot);
-      const result = await pullFiles({
-        designRoot: peerRoot,
-        hubUrl,
-        token: () => TOKEN,
-        canvasGroups: CANVAS_GROUPS,
-        allowCodeModules: true, // an owner's fresh link
-        log: silent,
-      });
-      expect(result.failed).toEqual([]);
-      expect(result.dropped).toEqual([]);
-
-      // THE acceptance assertion: the RCA's `diff -rq`, as a set + bytes.
-      const want = syncableSet(sourceRoot);
-      expect(syncableSet(peerRoot)).toEqual(want);
-      for (const rel of want) {
-        expect(readFileSync(path.join(peerRoot, rel))).toEqual(
-          readFileSync(path.join(sourceRoot, rel))
-        );
-      }
-
-      // …and the excluded set is EXCLUDED, not merely equal.
-      const arrived = walkTree(peerRoot);
-      expect(arrived.includes('config.json')).toBe(false);
-      expect(arrived.some((rel) => rel.startsWith('_history/'))).toBe(false);
-      expect(arrived.includes('_server.json')).toBe(false);
-
-      // A second pass is the steady state: everything skips, nothing moves.
-      const again = await pullFiles({
-        designRoot: peerRoot,
-        hubUrl,
-        token: () => TOKEN,
-        canvasGroups: CANVAS_GROUPS,
-        allowCodeModules: true,
-        log: silent,
-      });
-      expect(again.pulled).toEqual([]);
-      expect(again.skipped).toBe(result.pulled.length);
-      expect(again.conflicts).toEqual([]);
-    } finally {
-      rmSync(peerRoot, { recursive: true, force: true });
-    }
-  });
-
-  test('without the owner gate the same link arrives minus code modules only', async () => {
-    const peerRoot = mkdtempSync(path.join(tmpdir(), 'maude-parity-member-'));
-    try {
-      deliverPlaneA(sourceRoot, peerRoot);
-      const result = await pullFiles({
-        designRoot: peerRoot,
-        hubUrl,
-        token: () => TOKEN,
-        canvasGroups: CANVAS_GROUPS,
-        allowCodeModules: false, // a member's fresh link
-        log: silent,
-      });
-      const want = syncableSet(sourceRoot).filter(
-        (rel) => rel !== 'system/ds/preview/_brand-css.ts'
-      );
-      expect(syncableSet(peerRoot)).toEqual(want);
-      expect(result.dropped.map((d) => d.rel)).toEqual(['system/ds/preview/_brand-css.ts']);
-    } finally {
-      rmSync(peerRoot, { recursive: true, force: true });
-    }
-  });
-
-  test('the wire itself never offers a canvas body — disjointness holds end-to-end', async () => {
-    const res = await fetch(`${hubUrl}/api/files`, {
-      headers: { authorization: `Bearer ${TOKEN}` },
-    });
-    const body = (await res.json()) as { files: { path: string; class: string }[] };
-    const offered = body.files.map((f) => f.path);
-    for (const owned of [
-      'ui/welcome.tsx',
-      'ui/welcome.meta.json',
-      'system/ds/preview/specimen.tsx',
-      'system/ds/preview/specimen.css',
-    ]) {
-      expect(offered.includes(owned)).toBe(false);
-    }
-    for (const never of ['config.json', '_server.json', '_history/junk/old.tsx']) {
-      expect(offered.includes(never)).toBe(false);
-    }
-    // …and refusing to SERVE them outright, even when asked by name.
-    for (const refused of ['config.json', 'ui/welcome.tsx', '_server.json']) {
-      const read = await fetch(`${hubUrl}/_project-file/${encodeURIComponent(refused)}`, {
-        headers: { authorization: `Bearer ${TOKEN}` },
-      });
-      expect(read.status).toBe(404);
-    }
-  });
-});