@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/tool-palette-insert-anchor.test.ts

@@ -1,86 +0,0 @@
-// tool-palette.tsx — Stage I3 tail (feature-element-editing-robustness). The
-// "+ Element" affordance's anchor resolver: appends relative to the ACTIVE
-// artboard's last existing child (mirrors the context-menu's element-relative
-// insert, since an artboard's own `<article data-dc-screen>` carries no
-// `data-cd-id` of its own — DCArtboard doesn't forward it to the DOM), falling
-// back to the artboard's own `data-dc-screen` id (inside-end) when it has no
-// such child yet — the empty-artboard fix for the previously-silent no-op.
-//
-// Needs a live DOM (querySelector/:scope) — register happy-dom for this file
-// only, like canvas-hmr-runtime.test.tsx.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { GlobalRegistrator } from '@happy-dom/global-registrator';
-
-beforeAll(() => {
-  GlobalRegistrator.register();
-});
-afterAll(() => {
-  GlobalRegistrator.unregister();
-});
-
-import { resolveInsertAnchor } from '../tool-palette.tsx';
-
-describe('tool-palette / resolveInsertAnchor', () => {
-  test('anchors on the last data-cd-id child of the CURRENT (aria-current) artboard', () => {
-    document.body.innerHTML = `
-      <article data-dc-screen="a1">
-        <div class="dc-artboard-body">
-          <div data-cd-id="11111111">one</div>
-          <div data-cd-id="22222222">two</div>
-        </div>
-      </article>
-      <article data-dc-screen="a2" aria-current="true">
-        <div class="dc-artboard-body">
-          <div data-cd-id="33333333">three</div>
-          <div data-cd-id="44444444">four</div>
-        </div>
-      </article>
-    `;
-    expect(resolveInsertAnchor(document)).toEqual({ refId: '44444444', position: 'after' });
-  });
-
-  test('falls back to the FIRST artboard when none is aria-current', () => {
-    document.body.innerHTML = `
-      <article data-dc-screen="a1">
-        <div class="dc-artboard-body"><div data-cd-id="aaaaaaaa">x</div></div>
-      </article>
-      <article data-dc-screen="a2">
-        <div class="dc-artboard-body"><div data-cd-id="bbbbbbbb">y</div></div>
-      </article>
-    `;
-    expect(resolveInsertAnchor(document)).toEqual({ refId: 'aaaaaaaa', position: 'after' });
-  });
-
-  test('skips a chrome direct-child with no data-cd-id, picking the last STAMPED one', () => {
-    document.body.innerHTML = `
-      <article data-dc-screen="a1" aria-current="true">
-        <div class="dc-artboard-body">
-          <div data-cd-id="11111111">one</div>
-          <div class="some-chrome-node">no cd-id</div>
-        </div>
-      </article>
-    `;
-    expect(resolveInsertAnchor(document)).toEqual({ refId: '11111111', position: 'after' });
-  });
-
-  test('falls back to the artboard id (inside-end) for an EMPTY artboard — no longer a silent no-op', () => {
-    document.body.innerHTML = `
-      <article data-dc-screen="a1" aria-current="true">
-        <div class="dc-artboard-body"></div>
-      </article>
-    `;
-    expect(resolveInsertAnchor(document)).toEqual({ artboardId: 'a1', position: 'inside-end' });
-  });
-
-  test('returns null when there is no artboard at all', () => {
-    document.body.innerHTML = '<div>no artboards here</div>';
-    expect(resolveInsertAnchor(document)).toBeNull();
-  });
-
-  test('returns null when the artboard has no .dc-artboard-body wrapper', () => {
-    document.body.innerHTML =
-      '<article data-dc-screen="a1"><div data-cd-id="11111111">x</div></article>';
-    expect(resolveInsertAnchor(document)).toBeNull();
-  });
-});

package/apps/studio/test/tool-palette.test.tsx

@@ -1,55 +0,0 @@
-// tool-palette — Phase 5.1 centered icon toolbar.
-//
-// The palette pulls live state via three context hooks (tool mode, viewport
-// controller, annotations visibility) and the icon set is dependency-free, so
-// the SSR render path is the cleanest unit-test surface. We confirm:
-//   - one icon button per default tool registered in ToolProvider
-//   - the active tool gets aria-pressed=true
-//   - the zoom display shows the live percentage
-//   - the icon module exports a glyph for every default tool id
-
-import { describe, expect, test } from 'bun:test';
-
-import { renderToStaticMarkup } from 'react-dom/server';
-
-import { TOOL_ICONS } from '../canvas-icons.tsx';
-import { ToolPalette } from '../tool-palette.tsx';
-import { AnnotationsVisibilityProvider } from '../use-annotations-visibility.tsx';
-import { DEFAULT_TOOLS, ToolProvider } from '../use-tool-mode.tsx';
-
-describe('canvas-icons / TOOL_ICONS', () => {
-  test('exposes a component for every default tool id', () => {
-    for (const t of DEFAULT_TOOLS) {
-      expect(TOOL_ICONS[t.id]).toBeDefined();
-    }
-  });
-
-  test('icons render as <svg> elements with currentColor stroke', () => {
-    for (const t of DEFAULT_TOOLS) {
-      const Icon = TOOL_ICONS[t.id];
-      if (!Icon) continue;
-      const html = renderToStaticMarkup(<Icon />);
-      expect(html).toContain('<svg');
-      expect(html).toContain('stroke="currentColor"');
-    }
-  });
-});
-
-describe('tool-palette / SSR render contract', () => {
-  // First render under SSR returns null (the `mounted` gate is intentional —
-  // avoids hydration drift). We assert the empty mount + then re-render
-  // hydrated by passing a different initial setup, but bun's SSR only runs
-  // the first render. Adequate to confirm the import + provider stack don't
-  // throw, which catches typo/cycle regressions in the new chrome modules.
-  test('mounts inside ToolProvider + visibility provider without throwing', () => {
-    expect(() =>
-      renderToStaticMarkup(
-        <AnnotationsVisibilityProvider>
-          <ToolProvider>
-            <ToolPalette />
-          </ToolProvider>
-        </AnnotationsVisibilityProvider>
-      )
-    ).not.toThrow();
-  });
-});

package/apps/studio/test/tour-overlay.test.tsx

@@ -1,90 +0,0 @@
-// tour-overlay — Phase 3. Render contract for the hand-rolled tour engine.
-//
-// renderToStaticMarkup doesn't run effects, so the rect stays null on the
-// server render → the overlay falls back to a centered card + scrim. We assert
-// the a11y dialog contract + step/nav wiring; keyboard/focus-trap behavior is a
-// live-only concern (verified via agent-browser).
-
-import { describe, expect, test } from 'bun:test';
-import { renderToStaticMarkup } from 'react-dom/server';
-import { TourOverlay } from '../client/tour/overlay.jsx';
-import { QUICK_SETUP_TOUR } from '../client/tour/quick-setup-tour.js';
-
-const STEP = { target: '.x', title: 'Welcome', body: 'Body copy here' };
-
-describe('TourOverlay', () => {
-  test('renders an accessible dialog with the first step', () => {
-    const html = renderToStaticMarkup(
-      <TourOverlay open steps={[STEP]} onClose={() => {}} onComplete={() => {}} />
-    );
-    expect(html).toContain('mdcc-tour');
-    expect(html).toContain('role="dialog"');
-    expect(html).toContain('aria-modal="true"');
-    expect(html).toContain('Welcome');
-    expect(html).toContain('Body copy here');
-    expect(html).toContain('1 / 1');
-    expect(html).toContain('mdcc-tour__scrim'); // no rect on the server → scrim, not spotlight
-  });
-
-  test('single step shows Done (not Next) and no Back', () => {
-    const html = renderToStaticMarkup(
-      <TourOverlay open steps={[STEP]} onClose={() => {}} onComplete={() => {}} />
-    );
-    expect(html).toContain('Done');
-    expect(html).not.toContain('mdcc-tour__back');
-  });
-
-  test('multi-step first page shows Next, the counter, and no Back yet', () => {
-    const steps = [STEP, { ...STEP, title: 'Two' }, { ...STEP, title: 'Three' }];
-    const html = renderToStaticMarkup(
-      <TourOverlay open steps={steps} onClose={() => {}} onComplete={() => {}} />
-    );
-    expect(html).toContain('1 / 3');
-    expect(html).toContain('Next');
-    expect(html).not.toContain('mdcc-tour__back'); // i === 0
-  });
-
-  test('a step with a render graphic widens the card and draws the graphic (Phase 29 / E4)', () => {
-    function Graphic() {
-      return <div className="cm-info">TWO-LAYER-DIAGRAM</div>;
-    }
-    const html = renderToStaticMarkup(
-      <TourOverlay
-        open
-        steps={[{ render: Graphic, title: 'Working together', body: 'Two layers.' }]}
-        onClose={() => {}}
-        onComplete={() => {}}
-      />
-    );
-    expect(html).toContain('mdcc-tour__card--graphic');
-    expect(html).toContain('mdcc-tour__graphic');
-    expect(html).toContain('TWO-LAYER-DIAGRAM');
-    expect(html).toContain('Working together');
-  });
-
-  test('QUICK_SETUP_TOUR (DDR-166 plan, Phase 2 / T7) is a well-formed, renderable deck', () => {
-    expect(QUICK_SETUP_TOUR.length).toBeGreaterThan(1);
-    for (const step of QUICK_SETUP_TOUR) {
-      expect(typeof step.title).toBe('string');
-      expect(step.title.length).toBeGreaterThan(0);
-      expect(typeof step.body).toBe('string');
-      expect(step.body.length).toBeGreaterThan(0);
-    }
-    const html = renderToStaticMarkup(
-      <TourOverlay open steps={QUICK_SETUP_TOUR} onClose={() => {}} onComplete={() => {}} />
-    );
-    expect(html).toContain('mdcc-tour__title');
-    expect(html).toContain(`1 / ${QUICK_SETUP_TOUR.length}`);
-  });
-
-  test('closed or empty renders nothing', () => {
-    expect(
-      renderToStaticMarkup(
-        <TourOverlay open={false} steps={[STEP]} onClose={() => {}} onComplete={() => {}} />
-      )
-    ).toBe('');
-    expect(
-      renderToStaticMarkup(<TourOverlay open steps={[]} onClose={() => {}} onComplete={() => {}} />)
-    ).toBe('');
-  });
-});

package/apps/studio/test/trusted-request-host.test.ts

@@ -1,66 +0,0 @@
-// `isTrustedRequestHost` — the mode-aware DNS-rebind guard.
-// RCA: issue-cloud-inspector-edits-refused-by-loopback-guard.
-//
-// The bug: 97 studio route handlers gated on `isLoopbackHost(Host)`, and in a
-// cell the hub proxy rewrites Host to the project's PUBLIC name (D4), so that
-// check could never pass — every Inspector/artboard edit 403'd while annotations
-// (no such guard) synced. The fix keeps the loopback check verbatim OUTSIDE
-// workspace mode and, INSIDE a cell, accepts the proxy's unforgeable
-// `x-maude-role` vouch instead (the proxy strips every inbound `x-maude-*`
-// before injecting its own, so the header's presence proves hub provenance).
-
-import { afterEach, describe, expect, test } from 'bun:test';
-
-import { isTrustedRequestHost } from '../http.ts';
-
-const WS = 'MAUDE_WORKSPACE_MODE';
-const prior = process.env[WS];
-afterEach(() => {
-  if (prior === undefined) delete process.env[WS];
-  else process.env[WS] = prior;
-});
-
-const req = (host: string | null, extra: Record<string, string> = {}) =>
-  new Request('http://x/_api/edit-css', {
-    headers: { ...(host ? { host } : {}), ...extra },
-  });
-
-describe('local mode — loopback Host only (verbatim DNS-rebind guard)', () => {
-  test('loopback Hosts pass', () => {
-    delete process.env[WS];
-    expect(isTrustedRequestHost(req('localhost:4399'))).toBe(true);
-    expect(isTrustedRequestHost(req('127.0.0.1:4399'))).toBe(true);
-    expect(isTrustedRequestHost(req('[::1]:4399'))).toBe(true);
-  });
-
-  test('a rebound foreign Host is refused — even carrying x-maude-role', () => {
-    delete process.env[WS];
-    expect(isTrustedRequestHost(req('evil.example:4399'))).toBe(false);
-    // Outside a cell the injected header means nothing: there is no proxy in
-    // front to have stamped it, so it is attacker-supplied and ignored.
-    expect(isTrustedRequestHost(req('evil.example:4399', { 'x-maude-role': 'owner' }))).toBe(false);
-  });
-});
-
-describe('workspace mode — the hub proxy vouch is accepted', () => {
-  test('a public Host WITH an injected role is trusted (the cell shell-edit path)', () => {
-    process.env[WS] = '1';
-    expect(
-      isTrustedRequestHost(req('alligators.cloud.maude.sh', { 'x-maude-role': 'owner' }))
-    ).toBe(true);
-    expect(
-      isTrustedRequestHost(req('alligators.cloud.maude.sh', { 'x-maude-role': 'member' }))
-    ).toBe(true);
-  });
-
-  test('a public Host WITHOUT an injected role is still refused', () => {
-    process.env[WS] = '1';
-    // No proxy vouch ⇒ no proof of hub provenance ⇒ the guard holds.
-    expect(isTrustedRequestHost(req('alligators.cloud.maude.sh'))).toBe(false);
-  });
-
-  test('loopback still passes in workspace mode (the studio binds 127.0.0.1)', () => {
-    process.env[WS] = '1';
-    expect(isTrustedRequestHost(req('127.0.0.1:4399'))).toBe(true);
-  });
-});

package/apps/studio/test/undo-sequence-byte-compare.test.ts

@@ -1,211 +0,0 @@
-// Stage K (Task K1, feature-element-editing-robustness) — the scripted
-// mixed-op undo sequence the plan's INV-1 asks for: resize → delete → insert
-// → move → spacing-drag → Cmd+Z ×5 → canvas byte-identical to the start.
-//
-// Drives the SAME HTTP routes the client's undo mechanisms call:
-//   - CSS-shaped ops (resize/move/spacing) undo by re-POSTing `/_api/edit-css`
-//     with the pre-edit value — exactly what `recordSourceEdit` +
-//     `commands/edit-source-command.ts`'s `undo()` do (do/undo are both a
-//     single `applyFn` call with a different `value`, so there is no
-//     separate "revert" endpoint to test — the HTTP-level round-trip IS the
-//     undo mechanism).
-//   - Structural ops (delete/insert) undo via `/_api/reorder-revert`, the
-//     whole-file seq-log swap Stage I reuses from Phase 12.1's reorder undo
-//     (`commands/reorder-command.ts`) rather than a bespoke command per op.
-//
-// `/_api/reorder-revert` 409s if the file drifted since the logged seq (its
-// own doc comment: "refuses 409 when the canvas changed since") — so the 5
-// undos below MUST run in strict reverse (LIFO) order, exactly like a real
-// Cmd+Z stack, or the structural reverts would fail closed. That ordering
-// constraint is itself part of what this test proves.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-// Style values use DOUBLE quotes throughout — matching this codebase's own
-// authored-JSX convention (canvas-lib.tsx, scaffold-design.ts): editCss's
-// underlying write is a JSON.stringify literal, which is always
-// double-quoted regardless of the original source's quote style. A
-// single-quoted fixture would make a value round-trip only VALUE-identical,
-// not byte-identical (a cosmetic quote-style delta, not a real undo gap) —
-// double-quoting the fixture up front keeps this test's byte-compare
-// meaningful instead of tripping over that unrelated cosmetic mismatch.
-const CANVAS_SRC = `export default function Seq() {
-  return (
-    <DesignCanvas>
-      <DCArtboard id="home" label="Home" width={1440} height={1024}>
-        <figure style={{ position: "absolute", left: "20px", top: "20px", width: "100px", height: "60px" }}>Box</figure>
-        <div>A</div>
-        <div>B</div>
-        <div>C</div>
-        <section style={{ display: "flex", paddingLeft: "8px" }}>
-          <span>x</span>
-          <span>y</span>
-        </section>
-      </DCArtboard>
-    </DesignCanvas>
-  );
-}
-`;
-
-interface LocatorEntry {
-  line: number;
-  jsxPath: string[];
-}
-
-async function locatorMap(main: string, designRoot: string): Promise<Record<string, LocatorEntry>> {
-  const r = await fetch(`${main}/.design/ui/Seq.tsx`, { signal: AbortSignal.timeout(2000) });
-  expect(r.status).toBe(200);
-  const locator = JSON.parse(readFileSync(join(designRoot, '_locator.json'), 'utf8'));
-  return locator['ui/Seq'] as Record<string, LocatorEntry>;
-}
-
-/** First (only, in this fixture) data-cd-id whose JSX tag is `tag`. */
-function idOf(map: Record<string, LocatorEntry>, tag: string): string {
-  const hit = Object.entries(map).find(([, e]) => e.jsxPath[e.jsxPath.length - 1] === tag);
-  expect(hit).toBeDefined();
-  return hit?.[0] as string;
-}
-
-function idsByTag(map: Record<string, LocatorEntry>, tag: string): string[] {
-  return Object.entries(map)
-    .filter(([, e]) => e.jsxPath[e.jsxPath.length - 1] === tag)
-    .sort((a, b) => a[1].line - b[1].line)
-    .map(([id]) => id);
-}
-
-async function editCss(
-  main: string,
-  body: { canvas: string; id: string; property: string; value: string }
-): Promise<{ ok: boolean; error?: string }> {
-  const res = await fetch(`${main}/_api/edit-css`, {
-    method: 'POST',
-    body: JSON.stringify(body),
-    signal: AbortSignal.timeout(2000),
-  });
-  return (await res.json()) as { ok: boolean; error?: string };
-}
-
-describe('Stage K1 — mixed resize/delete/insert/move/spacing undo sequence', () => {
-  test('5 undos (LIFO) return the canvas byte-identical to its start', async () => {
-    const { root, designRoot } = makeSandbox();
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    writeFileSync(join(designRoot, 'ui', 'Seq.tsx'), CANVAS_SRC);
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    const main = `http://localhost:${port}`;
-    const canvasPath = join(designRoot, 'ui', 'Seq.tsx');
-    const original = readFileSync(canvasPath, 'utf8');
-    expect(original).toBe(CANVAS_SRC);
-
-    try {
-      // ── 1. resize (CSS-shaped) ──────────────────────────────────────────
-      let map = await locatorMap(main, designRoot);
-      const boxId = idOf(map, 'figure');
-      const resize = await editCss(main, {
-        canvas: 'ui/Seq',
-        id: boxId,
-        property: 'width',
-        value: '140px',
-      });
-      expect(resize.ok).toBe(true);
-      expect(readFileSync(canvasPath, 'utf8')).toContain('width: "140px"');
-
-      // ── 2. delete (structural) ──────────────────────────────────────────
-      map = await locatorMap(main, designRoot);
-      const [aId, bId] = idsByTag(map, 'div');
-      const del = await fetch(`${main}/_api/delete-element`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/Seq', id: bId }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(del.status).toBe(200);
-      const delJson = (await del.json()) as { ok: boolean; seq: number };
-      expect(delJson.ok).toBe(true);
-      expect(
-        [...readFileSync(canvasPath, 'utf8').matchAll(/<div>([ABC])</g)].map((m) => m[1])
-      ).toEqual(['A', 'C']);
-
-      // ── 3. insert (structural) ──────────────────────────────────────────
-      const ins = await fetch(`${main}/_api/insert-element`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/Seq', refId: aId, position: 'after', kind: 'div' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(ins.status).toBe(200);
-      const insJson = (await ins.json()) as { ok: boolean; seq: number; newId: string | null };
-      expect(insJson.ok).toBe(true);
-
-      // ── 4. move (CSS-shaped, same box element as step 1) ────────────────
-      map = await locatorMap(main, designRoot);
-      const boxIdAfterStructural = idOf(map, 'figure');
-      const move = await editCss(main, {
-        canvas: 'ui/Seq',
-        id: boxIdAfterStructural,
-        property: 'left',
-        value: '60px',
-      });
-      expect(move.ok).toBe(true);
-      expect(readFileSync(canvasPath, 'utf8')).toContain('left: "60px"');
-
-      // ── 5. spacing-drag (CSS-shaped, padding-left) ──────────────────────
-      map = await locatorMap(main, designRoot);
-      const sectionId = idOf(map, 'section');
-      const spacing = await editCss(main, {
-        canvas: 'ui/Seq',
-        id: sectionId,
-        property: 'padding-left',
-        value: '24px',
-      });
-      expect(spacing.ok).toBe(true);
-      expect(readFileSync(canvasPath, 'utf8')).toContain('paddingLeft: "24px"');
-
-      // ── Cmd+Z ×5 — strict LIFO ───────────────────────────────────────────
-      const undo5 = await editCss(main, {
-        canvas: 'ui/Seq',
-        id: sectionId,
-        property: 'padding-left',
-        value: '8px',
-      });
-      expect(undo5.ok).toBe(true);
-
-      const undo4 = await editCss(main, {
-        canvas: 'ui/Seq',
-        id: boxIdAfterStructural,
-        property: 'left',
-        value: '20px',
-      });
-      expect(undo4.ok).toBe(true);
-
-      const undo3 = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/Seq', seq: insJson.seq, dir: 'undo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(undo3.status).toBe(200);
-
-      const undo2 = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/Seq', seq: delJson.seq, dir: 'undo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(undo2.status).toBe(200);
-
-      const undo1 = await editCss(main, {
-        canvas: 'ui/Seq',
-        id: boxId,
-        property: 'width',
-        value: '100px',
-      });
-      expect(undo1.ok).toBe(true);
-
-      // ── Assert: byte-identical to the pre-sequence source ───────────────
-      expect(readFileSync(canvasPath, 'utf8')).toBe(original);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});