@1agh/maude 1.0.11 → 1.3.0

package/cli/lib/ddr-to-kgai.test.mjs

@@ -1,118 +0,0 @@
-import assert from 'node:assert/strict';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-import { buildDdrBatch } from './ddr-to-kgai.mjs';
-
-function fixtureDir(files) {
-  const dir = mkdtempSync(join(tmpdir(), 'ddr-'));
-  mkdirSync(dir, { recursive: true });
-  for (const [name, body] of Object.entries(files)) writeFileSync(join(dir, name), body);
-  return dir;
-}
-
-const DDR1 = `# DDR-001: First decision
-
-**Status:** Accepted
-**Date:** 2026-01-01
-**Tags:** infra, monorepo, ci
-
-## Context
-The problem is X.
-
-## Decision
-We pick A because it is simplest and safest.
-`;
-
-const DDR2 = `# DDR-002: Second decision
-
-**Status:** Accepted
-**Date:** 2026-02-02
-**Tags:** auth
-
-**Supersedes:** DDR-001
-**Related:** DDR-003
-
-## Decision
-We replace the earlier approach. See DDR-001 for history and DDR-003 alongside.
-`;
-
-test('each DDR yields one decision with area + title + date + rationale', () => {
-  const { batch, stats } = buildDdrBatch(fixtureDir({ 'DDR-001-x.md': DDR1 }), {});
-  assert.equal(batch.decisions.length, 1);
-  const d = batch.decisions[0];
-  assert.equal(d.title, 'First decision');
-  assert.equal(d.date, '2026-01-01');
-  assert.match(d.rationale, /simplest and safest/);
-  // area = primary tag, decision element, ABOUT link
-  const kinds = d.mutations.map((m) => `${m.op}:${m.kind || m.link || ''}`);
-  assert.ok(kinds.includes('upsert_element:area'));
-  assert.ok(kinds.includes('upsert_element:decision'));
-  assert.ok(kinds.includes('add_link:ABOUT'));
-  assert.equal(stats.files, 1);
-});
-
-test('secondary tags become topic elements + TOUCHES links', () => {
-  const { batch } = buildDdrBatch(fixtureDir({ 'DDR-001-x.md': DDR1 }), {});
-  const muts = batch.decisions[0].mutations;
-  const topics = muts
-    .filter((m) => m.op === 'upsert_element' && m.kind === 'topic')
-    .map((m) => m.name);
-  assert.deepEqual(topics.sort(), ['ci', 'monorepo']); // primary 'infra' is the area, not a topic
-  assert.ok(muts.some((m) => m.link === 'TOUCHES'));
-});
-
-test('typed Supersedes marker wins; bare mention does not duplicate it', () => {
-  const { batch } = buildDdrBatch(fixtureDir({ 'DDR-002-y.md': DDR2 }), {});
-  const links = batch.decisions[0].mutations.filter((m) => m.op === 'add_link');
-  const sup = links.filter((l) => l.link === 'SUPERSEDES' && l.to === 'decision:DDR-001');
-  assert.equal(
-    sup.length,
-    1,
-    'exactly one SUPERSEDES → DDR-001 (typed marker, not duplicated by the bare mention)'
-  );
-  // DDR-003 came from **Related:** → REFERENCES
-  assert.ok(links.some((l) => l.link === 'REFERENCES' && l.to === 'decision:DDR-003'));
-});
-
-test('scope tags are added per decision when scope is set (model A)', () => {
-  const { batch } = buildDdrBatch(fixtureDir({ 'DDR-001-x.md': DDR1 }), {
-    repo: 'maude',
-    dept: 'dev',
-  });
-  const muts = batch.decisions[0].mutations;
-  assert.ok(muts.some((m) => m.op === 'upsert_element' && m.kind === 'repo' && m.name === 'maude'));
-  assert.ok(muts.some((m) => m.link === 'IN_REPO' && m.to === 'repo:maude'));
-  assert.ok(muts.some((m) => m.link === 'IN_DEPT' && m.to === 'dept:dev'));
-});
-
-test('no scope ⇒ no scope mutations', () => {
-  const { batch } = buildDdrBatch(fixtureDir({ 'DDR-001-x.md': DDR1 }), {});
-  const muts = batch.decisions[0].mutations;
-  assert.ok(!muts.some((m) => m.link === 'IN_REPO' || m.link === 'IN_DEPT'));
-});
-
-test('non-DDR files are ignored', () => {
-  const { batch } = buildDdrBatch(fixtureDir({ 'DDR-001-x.md': DDR1, 'README.md': '# index' }), {});
-  assert.equal(batch.decisions.length, 1);
-});
-
-test('decision names are namespaced by repo so DDR numbers do not collide cross-repo', () => {
-  const files = { 'DDR-001-a.md': '# DDR-001: Alpha\n\n**Tags:** infra\n' };
-  const a = buildDdrBatch(fixtureDir(files), { repo: 'vantage', dept: 'marketing' });
-  const b = buildDdrBatch(fixtureDir(files), { repo: 'AI-StudyMate', dept: 'dev' });
-  const nameOf = (batch) => batch.decisions[0].mutations.find((m) => m.kind === 'decision').name;
-  assert.equal(nameOf(a.batch), 'vantage/DDR-001');
-  assert.equal(nameOf(b.batch), 'AI-StudyMate/DDR-001');
-  assert.notEqual(nameOf(a.batch), nameOf(b.batch));
-});
-
-test('area elements are NOT namespaced — concepts must converge across repos', () => {
-  const { batch } = buildDdrBatch(
-    fixtureDir({ 'DDR-001-a.md': '# DDR-001: Alpha\n\n**Tags:** security\n' }),
-    { repo: 'vantage', dept: 'marketing' }
-  );
-  const area = batch.decisions[0].mutations.find((m) => m.kind === 'area');
-  assert.equal(area.name, 'security');
-});

package/cli/lib/design-ownership.test.mjs

@@ -1,329 +0,0 @@
-// Two modes, no hybrid — DDR-228.
-//
-// What is pinned here is mostly the SAFETY of the transitions rather than
-// their mechanics: a mode switch runs against whatever state a person's tree
-// happens to be in, so the properties that matter are "nothing on disk moved",
-// "nothing unrelated got staged", and "the reverse puts it back".
-
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import {
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { after, describe, it } from 'node:test';
-
-import {
-  adoptToHub,
-  applyOwnershipBlock,
-  buildOwnershipBlock,
-  detachToRepo,
-  findOwnershipBlock,
-  isGitRepo,
-  isHubOwned,
-  ownershipState,
-  removeOwnershipBlock,
-  stignoreLineFor,
-  syncthingFolderRoot,
-  trackedDesignPaths,
-} from './design-ownership.mjs';
-
-const made = [];
-after(() => {
-  for (const d of made) rmSync(d, { recursive: true, force: true });
-});
-
-function gitAvailable() {
-  try {
-    execFileSync('git', ['--version'], { stdio: 'ignore' });
-    return true;
-  } catch {
-    return false;
-  }
-}
-const gitOk = gitAvailable();
-
-/** A real repo with a committed `.design/` — the Mode-A starting point. */
-function repoWithDesign() {
-  const root = mkdtempSync(join(tmpdir(), 'ownership-'));
-  made.push(root);
-  const git = (...a) => execFileSync('git', a, { cwd: root, stdio: 'ignore' });
-  git('init', '-q');
-  git('config', 'user.email', 't@t.test');
-  git('config', 'user.name', 'T');
-  mkdirSync(join(root, '.design/system/ds'), { recursive: true });
-  writeFileSync(join(root, '.design/config.json'), '{}');
-  writeFileSync(join(root, '.design/system/ds/brand.css'), ':root{}');
-  writeFileSync(join(root, 'README.md'), '# repo');
-  git('add', '-A');
-  git('commit', '-qm', 'seed');
-  return root;
-}
-
-describe('the ignore block', () => {
-  it('is one rule, and it is idempotent', () => {
-    const first = applyOwnershipBlock('', '.design');
-    assert.equal(first.action, 'added');
-    assert.ok(isHubOwned(first.contents));
-    assert.match(first.contents, /^\/\.design\/$/m);
-
-    const second = applyOwnershipBlock(first.contents, '.design');
-    assert.equal(second.action, 'updated');
-    assert.equal(second.contents.match(/maude:hub-owned:begin/g).length, 1);
-  });
-
-  it('goes at the END — gitignore is last-match-wins', () => {
-    const existing = 'node_modules/\n!.design/keep-me\n';
-    const { contents } = applyOwnershipBlock(existing, '.design');
-    assert.ok(
-      contents.indexOf('/.design/') > contents.indexOf('!.design/keep-me'),
-      'a rule that has to hold cannot sit above one that re-includes the path'
-    );
-  });
-
-  it('removes cleanly, leaving the rest of the file alone', () => {
-    const existing = 'node_modules/\ndist/\n';
-    const { contents: withBlock } = applyOwnershipBlock(existing, '.design');
-    const { contents: back, action } = removeOwnershipBlock(withBlock);
-    assert.equal(action, 'removed');
-    assert.ok(!isHubOwned(back));
-    assert.match(back, /node_modules\//);
-    assert.match(back, /dist\//);
-  });
-
-  it('removing when absent is not an error', () => {
-    assert.equal(removeOwnershipBlock('node_modules/\n').action, 'absent');
-  });
-
-  it('honours a non-default design root', () => {
-    assert.match(buildOwnershipBlock('design'), /^\/design\/$/m);
-  });
-});
-
-describe('adopt — A to B', { skip: gitOk ? false : 'git not available' }, () => {
-  it('untracks the folder and leaves every byte on disk', () => {
-    const root = repoWithDesign();
-    assert.equal(trackedDesignPaths(root).length, 2);
-
-    const res = adoptToHub(root);
-    assert.equal(res.untracked, 2);
-
-    // THE safety property: `--cached` touches the index, never the tree.
-    assert.equal(readFileSync(join(root, '.design/system/ds/brand.css'), 'utf8'), ':root{}');
-    assert.equal(existsSync(join(root, '.design/config.json')), true);
-    assert.equal(trackedDesignPaths(root).length, 0);
-    assert.ok(isHubOwned(readFileSync(join(root, '.gitignore'), 'utf8')));
-  });
-
-  it('stages the removals and .gitignore — and nothing else', () => {
-    const root = repoWithDesign();
-    // An unrelated edit, dirty in the tree exactly as a real person's would be.
-    writeFileSync(join(root, 'README.md'), '# repo, mid-edit');
-    writeFileSync(join(root, 'notes.txt'), 'scratch');
-
-    adoptToHub(root);
-
-    const staged = execFileSync('git', ['diff', '--cached', '--name-only'], {
-      cwd: root,
-      encoding: 'utf8',
-    })
-      .split('\n')
-      .filter(Boolean)
-      .sort();
-    assert.deepEqual(staged, ['.design/config.json', '.design/system/ds/brand.css', '.gitignore']);
-    // Their work is untouched, staged or otherwise.
-    assert.equal(readFileSync(join(root, 'README.md'), 'utf8'), '# repo, mid-edit');
-    assert.equal(existsSync(join(root, 'notes.txt')), true);
-  });
-
-  it('is safe to run twice', () => {
-    const root = repoWithDesign();
-    adoptToHub(root);
-    const again = adoptToHub(root);
-    assert.equal(again.untracked, 0);
-    assert.equal(
-      readFileSync(join(root, '.gitignore'), 'utf8').match(/maude:hub-owned:begin/g).length,
-      1
-    );
-  });
-
-  it('--dry-run says what it would do and does none of it', () => {
-    const root = repoWithDesign();
-    const res = adoptToHub(root, { dryRun: true });
-    assert.equal(res.untracked, 2);
-    assert.equal(existsSync(join(root, '.gitignore')), false);
-    assert.equal(trackedDesignPaths(root).length, 2);
-  });
-});
-
-describe('detach — B back to A', { skip: gitOk ? false : 'git not available' }, () => {
-  it('un-ignores the folder and leaves committing to the person', () => {
-    const root = repoWithDesign();
-    adoptToHub(root);
-    execFileSync('git', ['commit', '-qm', 'adopt'], { cwd: root, stdio: 'ignore' });
-
-    const res = detachToRepo(root);
-    assert.equal(res.action, 'removed');
-    assert.ok(!isHubOwned(readFileSync(join(root, '.gitignore'), 'utf8')));
-
-    // Not committed, and not even staged — theirs to decide. But git can SEE
-    // them again, which is the whole point of the transition.
-    const untracked = execFileSync('git', ['ls-files', '--others', '--exclude-standard'], {
-      cwd: root,
-      encoding: 'utf8',
-    });
-    assert.match(untracked, /\.design\/system\/ds\/brand\.css/);
-  });
-
-  it('round-trips: adopt then detach restores what git can see', () => {
-    const root = repoWithDesign();
-    const before = trackedDesignPaths(root).sort();
-    adoptToHub(root);
-    execFileSync('git', ['commit', '-qm', 'adopt'], { cwd: root, stdio: 'ignore' });
-    detachToRepo(root);
-    execFileSync('git', ['add', '--', '.design'], { cwd: root, stdio: 'ignore' });
-    execFileSync('git', ['commit', '-qm', 'detach'], { cwd: root, stdio: 'ignore' });
-    assert.deepEqual(trackedDesignPaths(root).sort(), before);
-  });
-});
-
-describe('the hybrid is a NAMED state, not an accident', { skip: gitOk ? false : 'no git' }, () => {
-  it('linked + still tracked reads as hybrid', () => {
-    const root = repoWithDesign();
-    const st = ownershipState(root, { linked: true });
-    assert.equal(st.mode, 'hybrid');
-    assert.equal(st.ignored, false);
-    assert.equal(st.trackedCount, 2);
-  });
-
-  it('linked + ignored + untracked reads as hub-owned', () => {
-    const root = repoWithDesign();
-    adoptToHub(root);
-    assert.equal(ownershipState(root, { linked: true }).mode, 'hub-owned');
-  });
-
-  it('unlinked is repo-owned whatever the gitignore says', () => {
-    const root = repoWithDesign();
-    assert.equal(ownershipState(root, { linked: false }).mode, 'repo-owned');
-  });
-});
-
-describe('Syncthing rides a lane gitignore cannot close', () => {
-  it('finds the managed folder root from a nested repo', () => {
-    const st = mkdtempSync(join(tmpdir(), 'stfolder-'));
-    made.push(st);
-    mkdirSync(join(st, '.stfolder'), { recursive: true });
-    mkdirSync(join(st, 'personal/maude'), { recursive: true });
-    assert.equal(syncthingFolderRoot(join(st, 'personal/maude')), st);
-  });
-
-  it('is null outside one', () => {
-    const plain = mkdtempSync(join(tmpdir(), 'plain-'));
-    made.push(plain);
-    assert.equal(syncthingFolderRoot(plain), null);
-  });
-
-  it('names the .stignore line relative to the managed root', () => {
-    assert.equal(
-      stignoreLineFor('/tree/personal/maude', '.design', '/tree'),
-      '/personal/maude/.design'
-    );
-  });
-});
-
-describe('no git repo — the question does not arise', () => {
-  it('reads as hub-owned when linked, and every transition is a no-op', () => {
-    const plain = mkdtempSync(join(tmpdir(), 'nogit-'));
-    made.push(plain);
-    mkdirSync(join(plain, '.design'), { recursive: true });
-    writeFileSync(join(plain, '.design/config.json'), '{}');
-
-    assert.equal(isGitRepo(plain), false);
-    assert.equal(ownershipState(plain, { linked: true }).mode, 'hub-owned');
-    assert.equal(adoptToHub(plain).action, 'no-git');
-    assert.equal(detachToRepo(plain).action, 'no-git');
-    // And nothing was written — Maude does not require git, so it does not
-    // start leaving gitignores in projects that have no repo.
-    assert.equal(existsSync(join(plain, '.gitignore')), false);
-  });
-});
-
-describe('a .gitignore is a shared, untrusted file', () => {
-  // The repo is committed and DDR-054 says peers can write it. The first
-  // version matched the markers as a bare substring and replaced everything
-  // between the first BEGIN and the first END — so a peer could wrap a
-  // victim's real rules in our markers and have `adopt` delete them.
-  const hostile = [
-    'node_modules/',
-    '# maude:hub-owned:begin',
-    '.env',
-    '*.pem',
-    'secrets/',
-    '# maude:hub-owned:end',
-  ].join('\n');
-
-  it('refuses to rewrite a block it did not write', () => {
-    const res = applyOwnershipBlock(hostile, '.design');
-    assert.equal(res.action, 'refused-malformed');
-    assert.equal(res.contents, hostile, 'not one rule touched');
-    assert.match(res.contents, /\.env/);
-    assert.match(res.contents, /secrets\//);
-  });
-
-  it('and refuses to remove one either', () => {
-    assert.equal(removeOwnershipBlock(hostile).action, 'refused-malformed');
-  });
-
-  it('a lone marker is malformed, not "already hub-owned"', () => {
-    // The cheaper half of the same finding: `ignored` derived from one marker
-    // made a hybrid report itself as settled, so the state DDR-228 exists to
-    // end would persist undetected.
-    assert.equal(isHubOwned('# maude:hub-owned:begin\nnode_modules/\n'), false);
-    assert.equal(findOwnershipBlock('# maude:hub-owned:begin\n').reason, 'malformed');
-  });
-
-  it('a marker inside a comment is not a marker', () => {
-    assert.equal(isHubOwned('# see # maude:hub-owned:begin for details\n'), false);
-  });
-
-  it('our own block still round-trips', () => {
-    const { contents } = applyOwnershipBlock('node_modules/\n', '.design');
-    assert.equal(isHubOwned(contents), true);
-    const back = removeOwnershipBlock(contents);
-    assert.equal(back.action, 'removed');
-    assert.match(back.contents, /node_modules\//);
-  });
-
-  it('adopt refuses outright rather than untracking against a file it cannot read', {
-    skip: gitOk ? false : 'git not available',
-  }, () => {
-    const root = repoWithDesign();
-    writeFileSync(join(root, '.gitignore'), hostile);
-    const res = adoptToHub(root);
-    assert.equal(res.action, 'refused-malformed');
-    assert.equal(res.untracked, 0);
-    assert.equal(trackedDesignPaths(root).length, 2, 'the design root is still tracked');
-    assert.equal(readFileSync(join(root, '.gitignore'), 'utf8'), hostile);
-  });
-
-  it('refuses to write through a symlinked .gitignore', {
-    skip: gitOk ? false : 'git not available',
-  }, () => {
-    const root = repoWithDesign();
-    const outside = mkdtempSync(join(tmpdir(), 'gi-target-'));
-    made.push(outside);
-    const victim = join(outside, 'important.txt');
-    writeFileSync(victim, 'do not overwrite me');
-    symlinkSync(victim, join(root, '.gitignore'));
-
-    assert.throws(() => adoptToHub(root), /not a regular file/);
-    assert.equal(readFileSync(victim, 'utf8'), 'do not overwrite me');
-  });
-});

package/cli/lib/fetch-asset.test.mjs

@@ -1,213 +0,0 @@
-// DDR-147 § Security follow-up item 1 — the hardened `maude design fetch-asset`
-// helper (apps/studio/bin/_fetch-asset.mjs). This suite locks the SECURITY CORE
-// that the untrusted-fetch rails promise: the resolved-IP SSRF classifier
-// (reject loopback / link-local / RFC-1918 / CGNAT / multicast / reserved, v4 +
-// v6 incl. IPv4-mapped + NAT64), https-only URL parsing, the png/jpg/gif/webp
-// magic sniff (SVG/HTML rejected), the content-addressed name contract, and the
-// realpath containment assertion. Runs under `pnpm test` (node --test cli/**).
-//
-// The network path (curl) is exercised by the manual smoke in the RCA/PR; these
-// are the offline, deterministic guards a regression would trip.
-
-import assert from 'node:assert/strict';
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const REPO = resolve(HERE, '..', '..');
-const MOD = resolve(REPO, 'apps', 'studio', 'bin', '_fetch-asset.mjs');
-
-const {
-  classifyAddress,
-  parseIPv4,
-  parseIPv6,
-  parseHttpsTarget,
-  sniffImageExt,
-  assetName,
-  containedAssetPath,
-  FetchAssetError,
-} = await import(MOD);
-
-// ── SSRF classifier: BLOCKED addresses ───────────────────────────────────────
-test('classifyAddress blocks private / loopback / link-local / reserved IPv4', () => {
-  const blocked = [
-    '127.0.0.1',
-    '127.9.9.9',
-    '10.0.0.1',
-    '10.255.255.255',
-    '172.16.0.1',
-    '172.31.255.255',
-    '192.168.1.1',
-    '169.254.169.254', // AWS/GCP IMDS
-    '169.254.0.1',
-    '100.64.0.1', // CGNAT
-    '100.127.255.255',
-    '0.0.0.0',
-    '224.0.0.1', // multicast
-    '239.255.255.255',
-    '240.0.0.1', // reserved
-    '255.255.255.255',
-    '198.18.0.1', // benchmark
-    '192.0.2.5', // TEST-NET-1
-    '192.0.0.1', // IETF
-  ];
-  for (const ip of blocked) {
-    assert.ok(classifyAddress(ip), `expected ${ip} to be BLOCKED but it was allowed`);
-  }
-});
-
-test('classifyAddress allows genuine public IPv4 (incl. just-outside-range boundaries)', () => {
-  const allowed = [
-    '8.8.8.8',
-    '1.1.1.1',
-    '93.184.216.34', // example.com
-    '172.15.255.255', // just below 172.16/12
-    '172.32.0.1', // just above 172.31
-    '100.63.255.255', // just below CGNAT
-    '100.128.0.1', // just above CGNAT
-    '169.253.255.255', // just below link-local
-    '11.0.0.1',
-    '192.167.255.255',
-    '192.169.0.1',
-    '223.255.255.255', // just below multicast
-  ];
-  for (const ip of allowed) {
-    assert.equal(classifyAddress(ip), null, `expected ${ip} to be ALLOWED but it was blocked`);
-  }
-});
-
-test('classifyAddress blocks loopback / link-local / ULA / multicast + embedded-v4 IPv6', () => {
-  const blocked = [
-    '::1', // loopback
-    '::', // unspecified
-    'fe80::1', // link-local
-    'fe80::abcd:1234',
-    'fc00::1', // ULA
-    'fd12:3456::1', // ULA
-    'ff02::1', // multicast
-    '::ffff:127.0.0.1', // IPv4-mapped loopback
-    '::ffff:10.0.0.1', // IPv4-mapped private
-    '::ffff:169.254.169.254', // IPv4-mapped IMDS
-    '64:ff9b::127.0.0.1', // NAT64 → loopback
-    '64:ff9b::192.168.0.1', // NAT64 → private
-  ];
-  for (const ip of blocked) {
-    assert.ok(classifyAddress(ip), `expected ${ip} to be BLOCKED but it was allowed`);
-  }
-});
-
-test('classifyAddress allows genuine public IPv6 (incl. IPv4-mapped public)', () => {
-  const allowed = [
-    '2001:4860:4860::8888', // Google DNS
-    '2606:4700:4700::1111', // Cloudflare DNS
-    '::ffff:8.8.8.8', // IPv4-mapped PUBLIC → allowed via embedded classify
-    '2a00:1450:4001:81b::200e',
-  ];
-  for (const ip of allowed) {
-    assert.equal(classifyAddress(ip), null, `expected ${ip} to be ALLOWED but it was blocked`);
-  }
-});
-
-test('classifyAddress fail-closes on non-IP / garbage input', () => {
-  for (const bad of ['not-an-ip', 'example.com', '', '999.999.999.999', 'gggg::1']) {
-    assert.ok(classifyAddress(bad), `expected ${JSON.stringify(bad)} to be treated as blocked`);
-  }
-});
-
-// ── IP parsers ───────────────────────────────────────────────────────────────
-test('parseIPv4 rejects malformed dotted-quads', () => {
-  for (const bad of ['1.2.3', '1.2.3.4.5', '256.1.1.1', '01.2.3.4', '1.2.3.a', '', '-1.2.3.4']) {
-    assert.equal(parseIPv4(bad), null, `expected ${JSON.stringify(bad)} to fail parse`);
-  }
-  assert.deepEqual([...parseIPv4('1.2.3.4')], [1, 2, 3, 4]);
-  assert.deepEqual([...parseIPv4('255.255.255.255')], [255, 255, 255, 255]);
-});
-
-test('parseIPv6 handles ::, embedded IPv4, zone id; rejects malformed', () => {
-  assert.ok(parseIPv6('::1'));
-  assert.ok(parseIPv6('::'));
-  assert.ok(parseIPv6('fe80::1%en0')); // zone id stripped
-  assert.ok(parseIPv6('2001:db8::1'));
-  assert.ok(parseIPv6('::ffff:1.2.3.4'));
-  for (const bad of ['gggg::', '1::2::3', '12345::', '1.2.3.4', '']) {
-    assert.equal(parseIPv6(bad), null, `expected ${JSON.stringify(bad)} to fail parse`);
-  }
-});
-
-// ── URL target ───────────────────────────────────────────────────────────────
-test('parseHttpsTarget accepts https and extracts host/port', () => {
-  assert.deepEqual(parseHttpsTarget('https://example.com/a.png'), {
-    host: 'example.com',
-    port: 443,
-  });
-  assert.deepEqual(parseHttpsTarget('https://cdn.example.com:8443/x'), {
-    host: 'cdn.example.com',
-    port: 8443,
-  });
-});
-
-test('parseHttpsTarget rejects non-https, credentials, and hostless URLs', () => {
-  const bad = [
-    'http://example.com/a.png',
-    'ftp://example.com/a.png',
-    'file:///etc/passwd',
-    'https://user:pass@example.com/a.png',
-    'not a url',
-  ];
-  for (const u of bad) {
-    assert.throws(() => parseHttpsTarget(u), FetchAssetError, `expected ${u} to throw`);
-  }
-});
-
-// ── image sniff ──────────────────────────────────────────────────────────────
-test('sniffImageExt recognises png/jpg/gif/webp and rejects SVG/HTML/empty', () => {
-  const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0]);
-  const jpg = Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0, 0]);
-  const gif = Buffer.from([0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0, 0]);
-  const webp = Buffer.from([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50]);
-  assert.equal(sniffImageExt(png), 'png');
-  assert.equal(sniffImageExt(jpg), 'jpg');
-  assert.equal(sniffImageExt(gif), 'gif');
-  assert.equal(sniffImageExt(webp), 'webp');
-  assert.equal(sniffImageExt(Buffer.from('<svg xmlns="...')), null);
-  assert.equal(sniffImageExt(Buffer.from('<!DOCTYPE html>')), null);
-  assert.equal(sniffImageExt(Buffer.from([])), null);
-  // RIFF that is NOT webp (e.g. wav) must not sniff as an image.
-  assert.equal(
-    sniffImageExt(Buffer.from([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x41, 0x56, 0x45])),
-    null
-  );
-});
-
-// ── naming + containment ─────────────────────────────────────────────────────
-test('assetName is content-addressed <sha8>.<ext> and deterministic', () => {
-  const bytes = Buffer.from('hello world');
-  const n1 = assetName(bytes, 'png');
-  const n2 = assetName(bytes, 'png');
-  assert.equal(n1, n2);
-  assert.match(n1, /^[a-f0-9]{8}\.png$/);
-  assert.notEqual(assetName(Buffer.from('other'), 'jpg'), n1);
-});
-
-test('containedAssetPath resolves under <root>/<designRoot>/assets and rejects escape', () => {
-  const { assetsDir, fileAbs } = containedAssetPath('/repo', '.design', 'a1b2c3d4.png');
-  assert.equal(assetsDir, resolve('/repo/.design/assets'));
-  assert.equal(fileAbs, resolve('/repo/.design/assets/a1b2c3d4.png'));
-  // A traversal name escapes → throws.
-  assert.throws(() => containedAssetPath('/repo', '.design', '../../etc/passwd'), FetchAssetError);
-  // A design-root that climbs out of the repo → throws.
-  assert.throws(() => containedAssetPath('/repo', '../../etc', 'a1b2c3d4.png'), FetchAssetError);
-});
-
-// ── wiring: verb registered + helper files ship ──────────────────────────────
-test('fetch-asset is a registered `maude design` bin verb with both helper files present', () => {
-  assert.ok(existsSync(resolve(REPO, 'apps/studio/bin/fetch-asset.sh')), 'fetch-asset.sh missing');
-  assert.ok(
-    existsSync(resolve(REPO, 'apps/studio/bin/_fetch-asset.mjs')),
-    '_fetch-asset.mjs missing'
-  );
-  const design = readFileSync(resolve(REPO, 'cli/commands/design.mjs'), 'utf8');
-  assert.match(design, /'fetch-asset'/, "'fetch-asset' not in design.mjs BIN_VERBS");
-});