@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/test/runtime-bundle-error-mapping.test.ts

@@ -1,43 +0,0 @@
-// Phase 19 / DDR-044 — runtime-bundle error-message remediation.
-// When Bun.build fails because the global install cache is corrupted
-// (EISDIR/ENOENT on a cached package's entry file), surface an actionable
-// `bun pm cache rm <pkg>` hint instead of just relaying the raw log.
-
-import { describe, expect, test } from 'bun:test';
-
-import { bunCacheRemediation } from '../runtime-bundle.ts';
-
-describe('bunCacheRemediation', () => {
-  test('returns null on unrelated build failures (real syntax errors etc.)', () => {
-    expect(bunCacheRemediation('react', '[error] Unexpected token <')).toBeNull();
-    expect(bunCacheRemediation('react-dom', '[error] Could not resolve "missing-pkg"')).toBeNull();
-  });
-
-  test('matches EISDIR on .bun/install/cache + names the base package', () => {
-    const log =
-      "[error] EISDIR reading '/Users/iagh/.bun/install/cache/react@19.2.6@@@1 @@1/index.js'";
-    const out = bunCacheRemediation('react', log);
-    expect(out).not.toBeNull();
-    expect(out).toMatch(/bun pm cache rm react/);
-    expect(out).toMatch(/bad state/);
-  });
-
-  test('matches ENOENT on .bun/install/cache too', () => {
-    const log = "[error] ENOENT: '/Users/x/.bun/install/cache/react-dom@19.0.0/index.js'";
-    const out = bunCacheRemediation('react-dom', log);
-    expect(out).toMatch(/bun pm cache rm react-dom/);
-  });
-
-  test('subpath specifiers strip to the base package for the cache rm command', () => {
-    // bun pm cache works on base package names — "react/jsx-runtime" → "react".
-    const log = "[error] EISDIR '/Users/x/.bun/install/cache/react@19.2.6/jsx-runtime.js'";
-    const out = bunCacheRemediation('react/jsx-runtime', log);
-    expect(out).toMatch(/bun pm cache rm react\b/);
-    expect(out).not.toMatch(/bun pm cache rm react\//);
-  });
-
-  test('case-insensitive match (Bun has bounced casing across versions)', () => {
-    const log = '[error] eisdir reading /Users/x/.bun/install/cache/react@19/index.js';
-    expect(bunCacheRemediation('react', log)).not.toBeNull();
-  });
-});

package/apps/studio/test/runtime-bundle.test.ts

@@ -1,69 +0,0 @@
-// runtime-bundle.ts — Phase 3.6 Task 6. Each runtime sub-bundle should:
-//   1. be self-contained for its own package (no `import "react"` left dangling
-//      in the react bundle itself, for instance);
-//   2. externalise the OTHER three runtime packages — so the four bundles
-//      stitched together via the importmap don't ship two React copies;
-//   3. expose its package's well-known named exports as real ESM bindings
-//      (not the silent-empty-export shape `export * from <cjs>` produces).
-
-import { describe, expect, test } from 'bun:test';
-
-import { getRuntimeBundle, packageForSlug, RUNTIME_PACKAGES, slugFor } from '../runtime-bundle.ts';
-
-describe('runtime-bundle', () => {
-  test('builds all four sub-bundles successfully', async () => {
-    for (const p of RUNTIME_PACKAGES) {
-      const b = await getRuntimeBundle(p);
-      expect(b.js.length).toBeGreaterThan(0);
-      expect(b.etag).toMatch(/^[0-9a-f]+$/);
-    }
-  });
-
-  test('react/jsx-runtime stays small (no React/ReactDOM inlined)', async () => {
-    const b = await getRuntimeBundle('react/jsx-runtime');
-    // Production jsx-runtime is self-contained (~3 KB) and doesn't require an
-    // explicit React import — the bundle should NOT carry a transitive copy
-    // of React's hooks or ReactDOM internals. Size cap is a coarse proxy.
-    expect(b.js.length).toBeLessThan(8 * 1024);
-    expect(b.js).not.toContain('createRoot(');
-    expect(b.js).not.toContain('useState');
-  });
-
-  test('react/jsx-runtime exposes jsx + jsxs + Fragment as ESM exports', async () => {
-    const b = await getRuntimeBundle('react/jsx-runtime');
-    expect(b.js).toMatch(/export\s*\{[\s\S]*\bjsx\b[\s\S]*\}/);
-    expect(b.js).toMatch(/export\s*\{[\s\S]*\bjsxs\b[\s\S]*\}/);
-    expect(b.js).toMatch(/export\s*\{[\s\S]*\bFragment\b[\s\S]*\}/);
-  });
-
-  test('react/jsx-dev-runtime bundle still builds (used in dev tooling)', async () => {
-    const b = await getRuntimeBundle('react/jsx-dev-runtime');
-    // Production-mode define(): the dev runtime still bundles (we list it in
-    // the importmap as a fallback), but its source path inside the bundle
-    // may be the production jsx-runtime depending on the package's own
-    // env switch. Either way it should produce a non-empty ESM module.
-    expect(b.js.length).toBeGreaterThan(0);
-    expect(b.js).toMatch(/export\s*\{/);
-  });
-
-  test('react-dom/client exposes createRoot + hydrateRoot', async () => {
-    const b = await getRuntimeBundle('react-dom/client');
-    expect(b.js).toMatch(/export\s*\{[\s\S]*\bcreateRoot\b[\s\S]*\}/);
-    expect(b.js).toMatch(/export\s*\{[\s\S]*\bhydrateRoot\b[\s\S]*\}/);
-  });
-
-  test('cache: second call returns same instance (no re-build)', async () => {
-    const a = await getRuntimeBundle('react');
-    const b = await getRuntimeBundle('react');
-    expect(b).toBe(a);
-  });
-
-  test('slug ⇄ package round-trip', () => {
-    for (const p of RUNTIME_PACKAGES) {
-      const s = slugFor(p);
-      expect(packageForSlug(s)).toBe(p);
-      expect(packageForSlug(`${s}.js`)).toBe(p);
-    }
-    expect(packageForSlug('nope.js')).toBeNull();
-  });
-});

package/apps/studio/test/sanitize-annotation-svg.test.ts

@@ -1,238 +0,0 @@
-// sanitizeAnnotationSvg — A3 (DDR-060 F1 re-audit). Strips executable constructs
-// from a persisted annotation SVG while leaving the legit presentational
-// vocabulary (strokesToSvg: path/rect/ellipse/g/line/polyline/text) byte-intact.
-
-import { describe, expect, test } from 'bun:test';
-
-import { sanitizeAnnotationSvg } from '../api.ts';
-
-// The exact shape strokesToSvg() emits — must survive sanitization unchanged.
-const LEGIT =
-  '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
-  '<path data-id="p1" data-tool="pen" stroke="#d63b1f" stroke-width="2" fill="none" d="M0 0 L10 10" pointer-events="stroke"/>' +
-  '<rect data-id="r1" data-tool="rect" stroke="#222" stroke-width="2" fill="none" x="5" y="5" width="20" height="20"/>' +
-  '<ellipse data-id="e1" data-tool="ellipse" stroke="#222" stroke-width="2" fill="none" cx="10" cy="10" rx="4" ry="4"/>' +
-  '<g data-id="a1" data-tool="arrow" stroke="#222" stroke-width="2" fill="none"><line x1="0" y1="0" x2="9" y2="9"/><polyline points="3,3 9,9 5,7" fill="#222"/></g>' +
-  '<text data-id="t1" data-tool="text" data-anchor-id="x" data-font-size="14" fill="#222" text-anchor="middle" dominant-baseline="middle">label</text>' +
-  '</svg>';
-
-describe('sanitizeAnnotationSvg — A3', () => {
-  test('leaves the legit annotation vocabulary byte-identical (zero regression)', () => {
-    expect(sanitizeAnnotationSvg(LEGIT)).toBe(LEGIT);
-  });
-
-  test('strips <script> blocks', () => {
-    const dirty = LEGIT.replace('</svg>', '<script>fetch("/_api/export")</script></svg>');
-    const out = sanitizeAnnotationSvg(dirty);
-    expect(out).not.toContain('<script');
-    expect(out).not.toContain('fetch("/_api/export")');
-  });
-
-  test('strips <foreignObject> (the SVG-XSS smuggle)', () => {
-    const dirty = LEGIT.replace(
-      '</svg>',
-      '<foreignObject><div onload="x"></div></foreignObject></svg>'
-    );
-    const out = sanitizeAnnotationSvg(dirty);
-    expect(out.toLowerCase()).not.toContain('foreignobject');
-  });
-
-  test('strips inline event-handler attributes (onload/onclick/…)', () => {
-    const dirty =
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
-      '<rect x="0" y="0" width="9" height="9" onload="alert(1)" onclick=\'evil()\'/>' +
-      '</svg>';
-    const out = sanitizeAnnotationSvg(dirty);
-    expect(out).not.toMatch(/\son\w+\s*=/i);
-    expect(out).toContain('<rect');
-    expect(out).toContain('width="9"');
-  });
-
-  // Phase 23 — `<image>` is now an allowlisted element, but ONLY a relative
-  // assets/<sha8>.<ext> href may survive on it. A javascript:/external href is
-  // stripped (the inert href-less <image> may remain — it fetches nothing);
-  // <use> stays fully dropped.
-  test('strips javascript:/external href on <image>; drops <use>', () => {
-    const dirty =
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
-      '<image href="javascript:alert(1)"/><use href="#x"/>' +
-      '</svg>';
-    const out = sanitizeAnnotationSvg(dirty);
-    expect(out.toLowerCase()).not.toContain('<use');
-    expect(out.toLowerCase()).not.toContain('javascript:');
-    // The <image> may survive as an inert element, but with NO href at all.
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-  });
-
-  // Bypasses the F1 confirming pass found against the prior denylist — the
-  // allowlist must close all of them.
-  test('drops namespaced <svg:script> (denylist missed this)', () => {
-    const out = sanitizeAnnotationSvg(
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><svg:script>alert(1)</svg:script></svg>'
-    );
-    expect(out.toLowerCase()).not.toContain('<svg:script');
-    expect(out.toLowerCase()).not.toContain('script>');
-  });
-
-  test('drops <style> (CSS @import / url(javascript:) exfil lane)', () => {
-    const out = sanitizeAnnotationSvg(
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><style>@import url("//evil")</style></svg>'
-    );
-    expect(out.toLowerCase()).not.toContain('<style');
-  });
-
-  test('strips style= (CSS url(javascript:)) and entity-encoded xlink:href on survivors', () => {
-    const out = sanitizeAnnotationSvg(
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
-        '<rect x="0" y="0" width="9" height="9" style="fill:url(javascript:alert(1))"/>' +
-        '<text xlink:href="javascript&#58;alert(1)">hi</text></svg>'
-    );
-    expect(out).not.toMatch(/\sstyle\s*=/i);
-    expect(out).not.toMatch(/href\s*=/i);
-    // The legit elements + safe attrs survive.
-    expect(out).toContain('<rect');
-    expect(out).toContain('width="9"');
-    expect(out).toContain('<text');
-  });
-
-  test('drops <set>/<animate> animation elements (attribute-name vector)', () => {
-    const out = sanitizeAnnotationSvg(
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect><set attributeName="onload" to="alert(1)"/></rect></svg>'
-    );
-    expect(out.toLowerCase()).not.toContain('<set');
-    expect(out.toLowerCase()).not.toContain('<animate');
-  });
-
-  // Phase 24 (DDR-067 security review) — a handler glued onto the previous
-  // attribute's closing quote with NO separating whitespace is a distinct
-  // attribute to HTML/SVG parsers; the old `\s`-anchored denylist missed it.
-  test('strips a quote-glued on*= handler (no separating whitespace)', () => {
-    const out = sanitizeAnnotationSvg(
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
-        '<circle cx="1" cy="1" r="2"onload="alert(document.cookie)"/>' +
-        '<rect x="0" y="0" width="9" height="9"onclick=\'evil()\'/></svg>'
-    );
-    // (a bare /on\w+=/ would false-match `data-mdcc-annotations="1"` — target
-    // the actual handler names instead)
-    expect(out).not.toMatch(/\bon(?:load|click|error|mouse\w+|focus)\s*=/i);
-    expect(out).not.toContain('alert(document.cookie)');
-    expect(out).not.toContain('evil()');
-    // The legit element + its real attributes survive intact.
-    expect(out).toContain('<circle');
-    expect(out).toContain('r="2"');
-    expect(out).toContain('<rect');
-    expect(out).toContain('width="9"');
-  });
-
-  // Phase 24 — the new shape/arrowhead vocabulary survives byte-intact.
-  test('keeps Phase 24 <polygon>/<circle> + data-* attrs byte-intact', () => {
-    const phase24 =
-      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
-      '<polygon data-id="pg" data-tool="polygon" stroke="#222" stroke-width="2" fill="none" data-shape="diamond" points="20,0 40,20 20,40 0,20"/>' +
-      '<g data-id="a" data-tool="arrow" stroke="#111" stroke-width="2" fill="none" data-start-head="circle" data-line-type="curved"><path d="M0 0 Q10 10 20 0"/><circle cx="20" cy="0" r="6" fill="#111"/></g>' +
-      '<g data-id="st" data-tool="sticky" data-r="8" data-fs="16" fill="#fce8a6" data-bold="1" data-align="center"><rect x="0" y="0" width="200" height="200" rx="8" ry="8"/><text data-sticky-body="1" x="12" y="12" font-size="16" fill="#1a1a1a" dominant-baseline="hanging">x</text></g>' +
-      '</svg>';
-    expect(sanitizeAnnotationSvg(phase24)).toBe(phase24);
-  });
-});
-
-// ── Phase 23 — <image> assets-href allow/deny matrix (Task 4, pairs with DDR) ──
-describe('sanitizeAnnotationSvg — Phase 23 <image> href allowlist', () => {
-  const wrap = (inner: string) =>
-    `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">${inner}</svg>`;
-
-  test('KEEPS a valid assets/<sha8>.<ext> href on <image> (all four exts)', () => {
-    for (const name of [
-      'a1b2c3d4.png',
-      'deadbeef.jpg',
-      'cafe1234.jpeg',
-      'f00dface.webp',
-      '0badf00d.gif',
-    ]) {
-      const svg = wrap(
-        `<image data-id="im" data-tool="image" x="0" y="0" width="40" height="40" href="assets/${name}" preserveAspectRatio="xMidYMid meet"/>`
-      );
-      expect(sanitizeAnnotationSvg(svg)).toBe(svg);
-    }
-  });
-
-  test('STRIPS an external https href (no off-origin fetch)', () => {
-    const out = sanitizeAnnotationSvg(
-      wrap(
-        '<image data-tool="image" x="0" y="0" width="9" height="9" href="https://evil.example/x.png"/>'
-      )
-    );
-    expect(out).not.toContain('https://evil.example');
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-  });
-
-  test('STRIPS a data: URL href (no base64 smuggle)', () => {
-    const out = sanitizeAnnotationSvg(
-      wrap('<image data-tool="image" href="data:image/svg+xml;base64,PHN2Zz4="/>')
-    );
-    expect(out.toLowerCase()).not.toContain('data:image');
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-  });
-
-  test('STRIPS a path-traversal href (single-segment guard)', () => {
-    for (const bad of [
-      'assets/../../etc/passwd',
-      'assets/../secret.png',
-      'assets/sub/dir/x.png',
-      'assets/x.svg',
-    ]) {
-      const out = sanitizeAnnotationSvg(wrap(`<image data-tool="image" href="${bad}"/>`));
-      expect(out).not.toContain(bad);
-      expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-    }
-  });
-
-  test('STRIPS an href on a NON-image element (rect href is never legit)', () => {
-    const out = sanitizeAnnotationSvg(
-      wrap('<rect data-tool="rect" x="0" y="0" width="9" height="9" href="assets/x.png"/>')
-    );
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-    expect(out).toContain('<rect');
-  });
-
-  test('STRIPS xlink:href (entity-encoded / namespaced) external on <image>', () => {
-    const out = sanitizeAnnotationSvg(
-      wrap('<image data-tool="image" xlink:href="javascript:alert(1)"/>')
-    );
-    expect(out.toLowerCase()).not.toContain('javascript:');
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-  });
-
-  test('CANNOT be tricked by a forged data-mdcc-asset marker carrying a scheme', () => {
-    // A hub-pushed SVG that pre-seeds the internal marker with a scheme must NOT
-    // round-trip back to an executable href (the post-pass re-validates).
-    const out = sanitizeAnnotationSvg(
-      wrap('<image data-tool="image" data-mdcc-asset="javascript:alert(1)"/>')
-    );
-    expect(out.toLowerCase()).not.toContain('javascript:');
-    expect(out.toLowerCase()).not.toContain('data-mdcc-asset');
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-  });
-
-  test('an input-supplied data-mdcc-asset marker is neutralized (only a real href hoists)', () => {
-    // The marker is an INTERNAL hop minted by the pre-pass from a real href. Any
-    // input-supplied marker — even one carrying a valid assets value — is
-    // stripped up front, so it can never become a surviving href on its own.
-    const out = sanitizeAnnotationSvg(
-      wrap('<image data-tool="image" data-mdcc-asset="assets/abcd1234.png"/>')
-    );
-    expect(out.toLowerCase()).not.toContain('data-mdcc-asset');
-    expect(out.toLowerCase()).not.toMatch(/href\s*=/);
-  });
-
-  test('still drops <script>/<svg:script> alongside a valid image (allowlist holds)', () => {
-    const out = sanitizeAnnotationSvg(
-      wrap(
-        '<image data-tool="image" href="assets/ok123456.png"/><svg:script>alert(1)</svg:script><script>x()</script>'
-      )
-    );
-    expect(out).toContain('href="assets/ok123456.png"');
-    expect(out.toLowerCase()).not.toContain('script');
-    expect(out).not.toContain('alert(1)');
-  });
-});

package/apps/studio/test/scaffold-design.test.ts

@@ -1,122 +0,0 @@
-import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { scaffoldDesign } from '../scaffold-design.ts';
-
-// DDR-166 Phase 1 — scaffoldDesign() now seeds THREE canvases (Welcome +
-// the two onboarding reference canvases), embedded as escaped template
-// literals. A bug in that escaping (an unescaped backtick/${ from the
-// source .design/ui/*.tsx files) would silently truncate the written file
-// into broken JS at scaffold time — every future new project would boot to
-// a corrupt canvas. Exercise the REAL function against a REAL temp dir, not
-// a mock, so a truncation shows up as a parse failure below.
-describe('scaffoldDesign — onboarding canvas seeding', () => {
-  function scaffold() {
-    const dir = mkdtempSync(join(tmpdir(), 'maude-scaffold-test-'));
-    const result = scaffoldDesign(dir, 'Scaffold Test');
-    return { dir, result };
-  }
-
-  test('writes ok:true and all three seeded canvases + their meta sidecars', () => {
-    const { dir, result } = scaffold();
-    try {
-      expect(result.ok).toBe(true);
-      for (const name of ['Welcome', 'How to use Maude', 'How to make video']) {
-        expect(existsSync(join(dir, '.design', 'ui', `${name}.tsx`))).toBe(true);
-        expect(existsSync(join(dir, '.design', 'ui', `${name}.meta.json`))).toBe(true);
-      }
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  test('the two onboarding canvases are non-trivially sized (catches a silent truncation)', () => {
-    const { dir } = scaffold();
-    try {
-      const useMaude = readFileSync(join(dir, '.design', 'ui', 'How to use Maude.tsx'), 'utf8');
-      const makeVideo = readFileSync(join(dir, '.design', 'ui', 'How to make video.tsx'), 'utf8');
-      // Real sizes are ~30KB/~24KB; a truncated-at-the-first-unescaped-backtick
-      // bug would cut this down to a few hundred bytes at most.
-      expect(useMaude.length).toBeGreaterThan(10_000);
-      expect(makeVideo.length).toBeGreaterThan(10_000);
-      // Both files must close their own template structure — the default
-      // export is the last thing in each source file.
-      expect(useMaude.trim().endsWith('}')).toBe(true);
-      expect(makeVideo.trim().endsWith('}')).toBe(true);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  test('every seeded .tsx parses as valid TSX (Bun.Transpiler) and has exactly one default export', () => {
-    const { dir } = scaffold();
-    try {
-      const transpiler = new Bun.Transpiler({ loader: 'tsx' });
-      for (const name of ['Welcome', 'How to use Maude', 'How to make video']) {
-        const src = readFileSync(join(dir, '.design', 'ui', `${name}.tsx`), 'utf8');
-        expect(() => transpiler.transformSync(src)).not.toThrow();
-        expect(src).toMatch(/export default function \w+/);
-      }
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  test('every seeded meta.json is valid JSON with a matching artboards list', () => {
-    const { dir } = scaffold();
-    try {
-      // Welcome's meta nests artboards under sections[0] (the older, still-live
-      // convention); the two onboarding canvases use a top-level `artboards`.
-      const welcome = JSON.parse(
-        readFileSync(join(dir, '.design', 'ui', 'Welcome.meta.json'), 'utf8')
-      );
-      expect(welcome.sections[0].artboards.length).toBe(1);
-      for (const [name, count] of [
-        ['How to use Maude', 10],
-        ['How to make video', 7],
-      ] as const) {
-        const meta = JSON.parse(
-          readFileSync(join(dir, '.design', 'ui', `${name}.meta.json`), 'utf8')
-        );
-        expect(Array.isArray(meta.artboards)).toBe(true);
-        expect(meta.artboards.length).toBe(count);
-      }
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  test('the two onboarding canvases self-declare their own tokens — no system/maude/ import', () => {
-    // Real bug caught while authoring this feature: the canvases originally
-    // imported system/maude/colors_and_type.css + preview/_components.css,
-    // which do NOT exist on a brand-new project (system/ is empty until
-    // /design:setup-ds runs) — every var(--token) would resolve to nothing,
-    // silently rendering unstyled black-on-black. Assert the fix holds.
-    const { dir } = scaffold();
-    try {
-      for (const name of ['How to use Maude', 'How to make video']) {
-        const src = readFileSync(join(dir, '.design', 'ui', `${name}.tsx`), 'utf8');
-        // Check for the actual import STATEMENT, not just the path appearing
-        // in an explanatory doc comment (which legitimately mentions it).
-        expect(src).not.toContain('import "../system/maude');
-        // The self-contained token block must still be present.
-        expect(src).toContain('const TOKENS');
-        expect(src).toContain('--bg-0');
-      }
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-
-  test('refuses to clobber an existing project (existing behavior, unchanged)', () => {
-    const { dir } = scaffold();
-    try {
-      const second = scaffoldDesign(dir, 'Scaffold Test');
-      expect(second.ok).toBe(false);
-      expect(second.error).toMatch(/already a Maude project/i);
-    } finally {
-      rmSync(dir, { recursive: true, force: true });
-    }
-  });
-});

package/apps/studio/test/server-lifecycle.test.ts

@@ -1,38 +0,0 @@
-// Smoke: boot → /_health 200 → _server.json written → shutdown.
-
-import { describe, expect, test } from 'bun:test';
-import { join } from 'node:path';
-
-import { rootIdentity } from '../http.ts';
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-describe('server lifecycle', () => {
-  test('boots, writes _server.json, responds to /_health', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const h = await fetch(`http://localhost:${port}/_health`);
-      expect(h.status).toBe(200);
-      const body = (await h.json()) as { ok: boolean; app: string; rootId: string };
-      expect(body.ok).toBe(true);
-      expect(body.app).toBe('design');
-      // Cloud Phase 27 D5 — the supervisor asks this route WHICH TREE it is
-      // serving, and kills a child that answers about another one. That check
-      // is only worth anything if both ends compute the identity the same way,
-      // which is what this asserts: the hash the server reports for the root it
-      // resolved is the hash the supervisor would compute for the root it
-      // handed over. And it is a hash, not the path — this route is on the
-      // untrusted canvas origin's allowlist.
-      expect(body.rootId).toBe(rootIdentity(root));
-      expect(body.rootId).not.toContain('/');
-
-      const info = await Bun.file(join(designRoot, '_server.json')).json();
-      expect(info.port).toBe(port);
-      expect(info.pid).toBeGreaterThan(0);
-      expect(info.url).toBe(`http://localhost:${port}`);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});