@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/test/debug-bundle.test.ts

@@ -1,105 +0,0 @@
-// debug-bundle scrubber + ring — feature-bug-report-button.
-//
-// The scrubber is a PRIVACY GATE, not tidiness: docs/report-schema.md promises
-// every log line is deterministically cleaned server-side before it can enter
-// a report. Extend these tests FIRST when extending the scrubber.
-
-import { describe, expect, test } from 'bun:test';
-
-import {
-  buildDebugBundle,
-  installLogRing,
-  logRingLines,
-  recordLogLine,
-  scrub,
-} from '../debug-bundle.ts';
-
-describe('scrub()', () => {
-  test('repo-absolute paths collapse to <project>/ BEFORE home collapses to ~', () => {
-    const out = scrub('error at /Users/jane/git/acme/src/app.ts and /Users/jane/notes.txt', {
-      home: '/Users/jane',
-      repoRoot: '/Users/jane/git/acme',
-    });
-    expect(out).toBe('error at <project>/src/app.ts and ~/notes.txt');
-  });
-
-  test('GitHub tokens (classic + fine-grained) are redacted', () => {
-    const out = scrub('using ghp_AbC123xyzAbC123xyz and github_pat_11ABCDEF0abcdef', {
-      home: '/h',
-    });
-    expect(out).not.toContain('ghp_');
-    expect(out).not.toContain('github_pat_');
-    expect(out).toContain('[redacted]');
-  });
-
-  test('bearer headers, sk- keys and JWTs are redacted', () => {
-    const out = scrub(
-      'sent Bearer abc.def.ghi then sk-ant-api03-longsecretvalue then eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig-part',
-      { home: '/h' }
-    );
-    expect(out).toContain('Bearer [redacted]');
-    expect(out).not.toContain('sk-ant-api03');
-    expect(out).not.toContain('eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0');
-    // An `Authorization:` header form over-redacts (key rule wins) — that is
-    // acceptable: privacy failures here are leaks, never extra redaction.
-    const hdr = scrub('Authorization: Bearer abc.def.ghi', { home: '/h' });
-    expect(hdr).not.toContain('abc.def.ghi');
-  });
-
-  test('secret-shaped key=value keeps the key, redacts the value', () => {
-    const out = scrub('token=abc123secret api_key: "xyz789" password=hunter2', { home: '/h' });
-    expect(out).toContain('token=[redacted]');
-    expect(out).toContain('password=[redacted]');
-    expect(out).not.toContain('abc123secret');
-    expect(out).not.toContain('hunter2');
-  });
-
-  test('emails are redacted', () => {
-    expect(scrub('reported by jane.doe+test@example.co.uk', { home: '/h' })).toBe(
-      'reported by [email]'
-    );
-  });
-
-  test('clean text passes through untouched', () => {
-    const line = '[log] canvas ui/Dashboard.tsx rebuilt in 43ms';
-    expect(scrub(line, { home: '/h', repoRoot: '/r' })).toBe(line);
-  });
-});
-
-describe('log ring', () => {
-  test('caps at 500 lines, keeps the newest, tail selects the last N', () => {
-    for (let i = 0; i < 620; i++) recordLogLine(`line ${i}`);
-    const all = logRingLines(500);
-    expect(all.length).toBe(500);
-    expect(all[0]).toBe('line 120');
-    expect(all[all.length - 1]).toBe('line 619');
-    expect(logRingLines(3)).toEqual(['line 617', 'line 618', 'line 619']);
-  });
-
-  test('console tap mirrors into the ring and is idempotent', () => {
-    installLogRing();
-    installLogRing(); // second call must not double-wrap (no duplicate lines)
-    console.log('tap-check', { a: 1 });
-    const tail = logRingLines(5);
-    expect(tail.filter((l) => l.includes('tap-check')).length).toBe(1);
-    expect(tail.some((l) => l.includes('[log] tap-check {"a":1}'))).toBe(true);
-  });
-});
-
-describe('buildDebugBundle()', () => {
-  test('assembles scrubbed fields; canvas path scrubbed; no content leaks', () => {
-    recordLogLine('boot at /Users/jane/git/acme with token=verysecret');
-    const bundle = buildDebugBundle({
-      maudeVersion: '9.9.9',
-      projectName: 'acme',
-      activeCanvas: 'ui/Dashboard.tsx',
-      repoRoot: '/Users/jane/git/acme',
-    });
-    expect(bundle.app.maudeVersion).toBe('9.9.9');
-    expect(bundle.app.platform).toBe(process.platform);
-    expect(bundle.context.activeCanvas).toBe('ui/Dashboard.tsx');
-    expect(bundle.logs.serverLogTail).toContain('<project>');
-    expect(bundle.logs.serverLogTail).not.toContain('verysecret');
-    expect(bundle.logs.serverLogTail).not.toContain('/Users/jane/git/acme');
-  });
-});

package/apps/studio/test/design-setup-readiness.test.ts

@@ -1,155 +0,0 @@
-// Design-setup readiness probe (DDR-166 plan, Phase 2 / T6). A pure function
-// over a Context-shaped fixture — no server boot needed, `probeSetupReadiness`
-// only touches `ctx.cfg` + `ctx.paths` (both destructured, so a minimal fake
-// satisfies the type).
-
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import type { Context, DevServerConfig } from '../context.ts';
-import { probeSetupReadiness } from '../design-setup-readiness.ts';
-
-function fixtureCtx(opts: {
-  hasConfig?: boolean;
-  designSystems?: DevServerConfig['designSystems'];
-  canvasGroups?: DevServerConfig['canvasGroups'];
-  seedCanvas?: boolean;
-  seedTokens?: string[]; // ds names to write a real colors_and_type.css for
-  seedLogo?: string[]; // ds names to write a preview/logo.svg for
-}): Context {
-  const root = mkdtempSync(join(tmpdir(), 'maude-setup-readiness-'));
-  const designRoot = join(root, '.design');
-  mkdirSync(designRoot, { recursive: true });
-
-  const designSystems = opts.designSystems ?? [];
-  const canvasGroups = opts.canvasGroups ?? [
-    { label: 'Design system', path: 'system' },
-    { label: 'UI kit', path: 'ui' },
-  ];
-
-  for (const ds of designSystems) {
-    mkdirSync(join(designRoot, ds.path), { recursive: true });
-    if (opts.seedTokens?.includes(ds.name)) {
-      writeFileSync(join(designRoot, ds.path, 'colors_and_type.css'), ':root{}');
-    }
-    if (opts.seedLogo?.includes(ds.name)) {
-      mkdirSync(join(designRoot, ds.path, 'preview'), { recursive: true });
-      writeFileSync(join(designRoot, ds.path, 'preview', 'logo.svg'), '<svg/>');
-    }
-  }
-  if (opts.seedCanvas) {
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    writeFileSync(
-      join(designRoot, 'ui', 'Welcome.tsx'),
-      'export default function W(){return <main/>}\n'
-    );
-  }
-
-  const cfg: DevServerConfig = {
-    name: 'test',
-    projectLabel: null,
-    designRoot: '.design',
-    canvasGroups,
-    designSystems,
-    rootClass: 'app',
-    themeDefault: 'dark',
-    tokensCssRel: 'system/colors_and_type.css',
-    teamAccentDefault: null,
-    handoffTargets: [],
-    newCanvasDir: 'ui',
-    newComponentDir: 'ui/components',
-    _source: opts.hasConfig === false ? 'defaults' : '.design/config.json',
-  };
-
-  return {
-    cfg,
-    projectLabel: 'test',
-    paths: {
-      repoRoot: root,
-      designRel: '.design',
-      designRoot,
-      serverInfoFile: join(designRoot, '_server.json'),
-      activeFile: join(designRoot, '_active.json'),
-      commentsDir: join(designRoot, '_comments'),
-      canvasStateDir: join(designRoot, '_canvas-state'),
-      historyDir: join(designRoot, '_history'),
-      tokensUrlRel: 'system/colors_and_type.css',
-      systemDirRel: 'system',
-    },
-    bus: { on: () => () => {}, emit: () => {} },
-  } as Context;
-}
-
-describe('probeSetupReadiness', () => {
-  test('bare write_minimal_design scaffold: config missing, everything else missing too', async () => {
-    const report = await probeSetupReadiness(fixtureCtx({ hasConfig: false }));
-    expect(report.ready).toBe(false);
-    const byId = Object.fromEntries(report.items.map((i) => [i.id, i.status]));
-    expect(byId).toEqual({
-      project: 'missing',
-      'design-system': 'missing',
-      'first-canvas': 'missing',
-      'brand-assets': 'missing',
-    });
-  });
-
-  test('real config, no DS, no canvas: project present, rest missing', async () => {
-    const report = await probeSetupReadiness(fixtureCtx({ hasConfig: true }));
-    const byId = Object.fromEntries(report.items.map((i) => [i.id, i.status]));
-    expect(byId.project).toBe('present');
-    expect(byId['design-system']).toBe('missing');
-    expect(byId['first-canvas']).toBe('missing');
-    expect(byId['brand-assets']).toBe('missing');
-    expect(report.ready).toBe(false);
-  });
-
-  test('DS declared but tokens file absent: still missing (declared != on-disk)', async () => {
-    const report = await probeSetupReadiness(
-      fixtureCtx({
-        hasConfig: true,
-        designSystems: [
-          { name: 'acme', path: 'system/acme', tokensCssRel: 'system/acme/colors_and_type.css' },
-        ],
-      })
-    );
-    const item = report.items.find((i) => i.id === 'design-system')!;
-    expect(item.status).toBe('missing');
-    expect(item.detail).toContain('Declared in config');
-  });
-
-  test('all four present → ready: true', async () => {
-    const report = await probeSetupReadiness(
-      fixtureCtx({
-        hasConfig: true,
-        designSystems: [
-          { name: 'acme', path: 'system/acme', tokensCssRel: 'system/acme/colors_and_type.css' },
-        ],
-        seedTokens: ['acme'],
-        seedLogo: ['acme'],
-        seedCanvas: true,
-      })
-    );
-    expect(report.items.every((i) => i.status === 'present')).toBe(true);
-    expect(report.ready).toBe(true);
-  });
-
-  test('a "system" canvas group never counts as the first user canvas', async () => {
-    const root = mkdtempSync(join(tmpdir(), 'maude-setup-readiness-'));
-    const designRoot = join(root, '.design');
-    const canvasGroups = [{ label: 'Design system', path: 'system' }];
-    mkdirSync(join(designRoot, 'system'), { recursive: true });
-    writeFileSync(
-      join(designRoot, 'system', 'specimen.tsx'),
-      'export default function S(){return <main/>}\n'
-    );
-    const ctx = fixtureCtx({ hasConfig: true, canvasGroups });
-    // Overwrite paths.designRoot/repoRoot to point at this second fixture dir
-    // (fixtureCtx already made its own scratch dir we don't need here).
-    ctx.paths.repoRoot = root;
-    ctx.paths.designRoot = designRoot;
-    const report = await probeSetupReadiness(ctx);
-    expect(report.items.find((i) => i.id === 'first-canvas')!.status).toBe('missing');
-  });
-});

package/apps/studio/test/detach-component.test.ts

@@ -1,94 +0,0 @@
-// detach-component — feature-4 (2026-07-19). Detach = CLONE the component's
-// definition under a fresh name + repoint ONE usage at the clone. Behavior-
-// preserving for any component (no prop substitution); subsequent edits land on
-// the clone's single-usage definition → resolveEditScope reports LOCAL.
-
-import { describe, expect, test } from 'bun:test';
-
-import { applyDetachComponent, CanvasEditError, resolveEditScope } from '../canvas-edit.ts';
-import { transpileCanvasSource } from '../canvas-pipeline.ts';
-
-const CANVAS = '/abs/Canvas.tsx';
-
-function idsOf(source: string): Record<string, string> {
-  const { withIds } = transpileCanvasSource(CANVAS, source);
-  const out: Record<string, string> = {};
-  for (const m of withIds.matchAll(/<(\w+)([^>]*?)data-cd-id="([0-9a-f]{8})"/g)) {
-    if (!out[m[1] as string]) out[m[1] as string] = m[3] as string;
-  }
-  return out;
-}
-
-describe('canvas-edit / applyDetachComponent', () => {
-  const SRC = `
-function Card({ label }: { label: string }) {
-  return <article className="card"><h2>{label}</h2></article>;
-}
-export default function Demo() {
-  return <div><Card label="Alpha" /><Card label="Beta" /></div>;
-}
-`;
-
-  test('clones the definition + repoints ONE usage; the other usage is untouched', () => {
-    const ids = idsOf(SRC);
-    // Detach the FIRST instance (occurrence 0 of the shared inner article).
-    const out = applyDetachComponent(CANVAS, SRC, ids.article as string, 0);
-    expect(out.detachedName).toBe('CardDetached');
-    // Clone inserted (same body, new name); original definition intact.
-    expect(out.source).toContain('function CardDetached({ label }: { label: string })');
-    expect(out.source).toContain('function Card({ label }: { label: string })');
-    // First usage repointed, second untouched — props preserved verbatim.
-    expect(out.source).toContain('<CardDetached label="Alpha" />');
-    expect(out.source).toContain('<Card label="Beta" />');
-  });
-
-  test('after detach, edits on the detached instance resolve LOCAL', () => {
-    const ids = idsOf(SRC);
-    const out = applyDetachComponent(CANVAS, SRC, ids.article as string, 0);
-    // Recompute ids on the NEW source — the detached article now belongs to
-    // CardDetached, a single-usage component.
-    const { withIds } = transpileCanvasSource(CANVAS, out.source);
-    const detArticle = /<article([^>]*?)data-cd-id="([0-9a-f]{8})"/.exec(
-      withIds.slice(withIds.indexOf('CardDetached'))
-    );
-    // Sanity: some article id exists inside the detached definition region.
-    expect(detArticle).toBeTruthy();
-    const scope = resolveEditScope(CANVAS, out.source, detArticle?.[2] as string, 1);
-    expect(scope.scope).toBe('local');
-  });
-
-  test('non-self-closing usage: BOTH tags repoint', () => {
-    const src = `
-function Frame({ children }: { children?: unknown }) {
-  return <section className="frame">{children}</section>;
-}
-export default function Demo() {
-  return <div><Frame><p>a</p></Frame><Frame><p>b</p></Frame></div>;
-}
-`;
-    const ids = idsOf(src);
-    const out = applyDetachComponent(CANVAS, src, ids.section as string, 0);
-    expect(out.source).toContain('<FrameDetached><p>a</p></FrameDetached>');
-    expect(out.source).toContain('<Frame><p>b</p></Frame>');
-  });
-
-  test('name collisions bump the suffix', () => {
-    const src = `
-function Card() { return <article>x</article>; }
-function CardDetached() { return <aside>existing</aside>; }
-export default function Demo() {
-  return <div><Card /><Card /></div>;
-}
-`;
-    const ids = idsOf(src);
-    const out = applyDetachComponent(CANVAS, src, ids.article as string, 0);
-    expect(out.detachedName).toBe('CardDetached2');
-    expect(out.source).toContain('function CardDetached2()');
-  });
-
-  test('a plain (non-instance) element refuses', () => {
-    const src = `export default function Demo() { return <div><h1>T</h1></div>; }`;
-    const ids = idsOf(src);
-    expect(() => applyDetachComponent(CANVAS, src, ids.h1 as string, 0)).toThrow(CanvasEditError);
-  });
-});

package/apps/studio/test/dns-rebinding-guard.test.ts

@@ -1,101 +0,0 @@
-// DNS-rebinding guard on the main-origin source-write/read family.
-//
-// The dev-server binds 127.0.0.1, but `sameOriginWrite` is a *reflective* Origin
-// check — after a DNS-rebind (`evil.example → 127.0.0.1`) the browser sends
-// `Origin: http://evil.example:<port>` AND `Host: evil.example:<port>`, so both
-// sides of the origin comparison are attacker-controlled and equal → CSRF passes.
-// Every source-write/read route now also requires a loopback `Host` (the same
-// `isLoopbackHost` guard the /_api/git/* routes already carry). A real browser
-// always sends `Host: localhost|127.0.0.1:<port>` → passes; a rebound foreign
-// hostname → 403. Regression guard for the /flow:done DDR-150 attacker finding.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-describe('DNS-rebinding guard — source-write/read family requires a loopback Host', () => {
-  test('rebound Host 403s writes + reads; a loopback Host passes the guard', async () => {
-    const { root, designRoot } = makeSandbox();
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    writeFileSync(join(designRoot, 'ui', 'C.tsx'), 'export default function C(){return <main/>}\n');
-
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    try {
-      const base = `http://localhost:${port}`;
-      // A rebound page: its Host header is the attacker's rebound hostname.
-      const evilHost = `evil.example:${port}`;
-
-      // WRITE route (POST) — the loopback guard fires (before the op runs).
-      const wEvil = await fetch(`${base}/_api/toggle-hide`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', host: evilHost },
-        body: JSON.stringify({ canvas: 'ui/C.tsx', stableId: 'x' }),
-      });
-      expect(wEvil.status).toBe(403);
-
-      // A second write route, to prove it's the whole family, not one endpoint.
-      const wEvil2 = await fetch(`${base}/_api/edit-text`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', host: evilHost },
-        body: JSON.stringify({ canvas: 'ui/C.tsx', id: 'x', text: 'y' }),
-      });
-      expect(wEvil2.status).toBe(403);
-
-      // feature-background-export-notification-center (/flow:done security
-      // fan-out) — the export-jobs family joined the guard too: POST enqueue,
-      // GET list, GET download all require a loopback Host.
-      const wEvilExport = await fetch(`${base}/_api/export-jobs`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', host: evilHost },
-        body: JSON.stringify({ format: 'zip', scope: 'project-raw' }),
-      });
-      expect(wEvilExport.status).toBe(403);
-      const wEvilExportSync = await fetch(`${base}/_api/export`, {
-        method: 'POST',
-        headers: { 'content-type': 'application/json', host: evilHost },
-        body: JSON.stringify({ format: 'zip', scope: 'project-raw' }),
-      });
-      expect(wEvilExportSync.status).toBe(403);
-      const rEvilJobs = await fetch(`${base}/_api/export-jobs`, { headers: { host: evilHost } });
-      expect(rEvilJobs.status).toBe(403);
-      const rEvilDownload = await fetch(`${base}/_api/export-jobs/download?id=x`, {
-        headers: { host: evilHost },
-      });
-      expect(rEvilDownload.status).toBe(403);
-
-      // READ routes (GET) — a rebound same-origin page could otherwise CORS-read
-      // raw project source; the guard 403s them too.
-      const rEvil = await fetch(`${base}/_api/canvas-source?file=ui/C.tsx`, {
-        headers: { host: evilHost },
-      });
-      expect(rEvil.status).toBe(403);
-      const rEvil2 = await fetch(`${base}/_api/comp-clips?canvas=ui/C.tsx`, {
-        headers: { host: evilHost },
-      });
-      expect(rEvil2.status).toBe(403);
-
-      // A real browser (loopback Host) is NOT rejected by the rebind guard — the
-      // source read succeeds (200). Proves the guard doesn't false-positive on
-      // the legitimate local request every real user makes.
-      const rOk = await fetch(`${base}/_api/canvas-source?file=ui/C.tsx`, {
-        headers: { host: `localhost:${port}` },
-      });
-      expect(rOk.status).toBe(200);
-      // 127.0.0.1 Host is equally valid (the printed URL variant).
-      const rOk2 = await fetch(`${base}/_api/canvas-source?file=ui/C.tsx`, {
-        headers: { host: `127.0.0.1:${port}` },
-      });
-      expect(rOk2.status).toBe(200);
-      // Same false-positive check for the export-jobs family (loopback Host passes).
-      const rOkJobs = await fetch(`${base}/_api/export-jobs`, {
-        headers: { host: `localhost:${port}` },
-      });
-      expect(rOkJobs.status).toBe(200);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});

package/apps/studio/test/dom-selection.test.ts

@@ -1,198 +0,0 @@
-// dom-selection — resolveByDomPath, the structural fallback comments-overlay
-// (and future consumers) reach for when a stored `data-cd-id` selector no
-// longer identifies the intended element. This is the DDR-019 renumbering
-// scenario: a canvas rewrite (/design:edit regenerating JSX) shifts every
-// subsequent element's positional id within a component, so the id can end up
-// on an unrelated element, or on none at all. See
-// .ai/logs/rca/issue-comment-anchor-drift-and-popup-edge-clamp.md.
-//
-// Needs a live DOM (querySelectorAll / getAttribute walk) — register happy-dom
-// for THIS file only, like annotations-roundtrip.test.ts.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { GlobalRegistrator } from '@happy-dom/global-registrator';
-
-beforeAll(() => {
-  GlobalRegistrator.register();
-});
-afterAll(() => {
-  GlobalRegistrator.unregister();
-});
-
-import { buildComposeSelection, openCommentComposer, resolveByDomPath } from '../dom-selection.ts';
-
-function setArtboard(html: string): void {
-  document.body.innerHTML = `<div data-dc-screen="art1">${html}</div>`;
-}
-
-describe('resolveByDomPath', () => {
-  test('finds the structurally-matching element when a same-id decoy has the wrong tag', () => {
-    // Simulates the renumbering bug: the stored data-cd-id ("bbb22222") now
-    // belongs to an unrelated <div>, while the ORIGINAL <button> the comment
-    // was anchored to survives under a different id ("ccc33333"). The
-    // fallback must find the button by structure, not by the stale id.
-    setArtboard(`
-      <div data-cd-id="bbb22222" class="decoy">Wrong element now has the old id</div>
-      <section class="hero">
-        <button class="cta primary" data-cd-id="ccc33333">Buy now</button>
-      </section>
-    `);
-    const found = resolveByDomPath(document, {
-      artboardId: 'art1',
-      tag: 'button',
-      classes: 'cta primary',
-      dom_path: [
-        'html',
-        'body',
-        'div[data-dc-screen="art1"]',
-        'section.hero',
-        'button.cta.primary',
-      ],
-    });
-    expect(found).not.toBeNull();
-    expect(found?.getAttribute('data-cd-id')).toBe('ccc33333');
-  });
-
-  test('prefers the candidate with the longer matching ancestor suffix over a shallower same-tag sibling', () => {
-    setArtboard(`
-      <button class="cta primary" data-cd-id="aaa11111">Outer decoy button</button>
-      <section class="hero">
-        <button class="cta primary" data-cd-id="bbb22222">Nested target</button>
-      </section>
-    `);
-    const found = resolveByDomPath(document, {
-      artboardId: 'art1',
-      tag: 'button',
-      classes: 'cta primary',
-      dom_path: [
-        'html',
-        'body',
-        'div[data-dc-screen="art1"]',
-        'section.hero',
-        'button.cta.primary',
-      ],
-    });
-    expect(found?.getAttribute('data-cd-id')).toBe('bbb22222');
-  });
-
-  test('returns null when no element in the artboard shares the stored tag', () => {
-    setArtboard(`<div data-cd-id="aaa11111" class="cta primary">Not a button</div>`);
-    const found = resolveByDomPath(document, {
-      artboardId: 'art1',
-      tag: 'button',
-      classes: 'cta primary',
-      dom_path: ['html', 'body', 'div[data-dc-screen="art1"]', 'button.cta.primary'],
-    });
-    expect(found).toBeNull();
-  });
-
-  test('returns null with no dom_path or no tag (nothing to match against)', () => {
-    setArtboard(`<button class="cta primary" data-cd-id="aaa11111">Buy now</button>`);
-    expect(
-      resolveByDomPath(document, { artboardId: 'art1', tag: 'button', classes: 'cta primary' })
-    ).toBeNull();
-    expect(
-      resolveByDomPath(document, {
-        artboardId: 'art1',
-        classes: 'cta primary',
-        dom_path: ['button.cta.primary'],
-      })
-    ).toBeNull();
-  });
-
-  test('scopes the search to the given artboard — a matching element in a different artboard is ignored', () => {
-    document.body.innerHTML = `
-      <div data-dc-screen="art1">
-        <button class="cta primary" data-cd-id="aaa11111">Art1 button</button>
-      </div>
-      <div data-dc-screen="art2">
-        <section class="hero">
-          <button class="cta primary" data-cd-id="bbb22222">Art2 button</button>
-        </section>
-      </div>
-    `;
-    const found = resolveByDomPath(document, {
-      artboardId: 'art1',
-      tag: 'button',
-      classes: 'cta primary',
-      dom_path: [
-        'html',
-        'body',
-        'div[data-dc-screen="art2"]',
-        'section.hero',
-        'button.cta.primary',
-      ],
-    });
-    // The art2 button structurally matches perfectly, but art1 is the requested
-    // scope — the only art1 candidate is a shallower, shorter-suffix match.
-    expect(found?.getAttribute('data-cd-id')).toBe('aaa11111');
-  });
-});
-
-// issue-90 — right-click "Add comment" on empty canvas background or an
-// artboard's chrome/border (neither carries a `data-cd-id`) used to have no
-// menu entry at all, and even where the entry DID exist (on an element) it
-// never actually opened the composer (see `openCommentComposer` below).
-// `buildComposeSelection` is the shared builder canvas-shell.tsx's
-// context-menu registry now calls for all three target kinds.
-describe('buildComposeSelection', () => {
-  test('with an element under the cursor — delegates to hoverTargetToSelection (same anchor a comment-tool click gets)', () => {
-    setArtboard(`<button class="cta" data-cd-id="aaa11111">Buy now</button>`);
-    const el = document.querySelector('[data-cd-id="aaa11111"]');
-    const sel = buildComposeSelection({ el, cdId: 'aaa11111', artboardId: 'art1' }, 100, 200);
-    expect(sel.selector).toBe('[data-dc-screen="art1"] [data-cd-id="aaa11111"]');
-    expect(sel.id).toBe('aaa11111');
-    expect(sel.tag).toBe('button');
-  });
-
-  test('with no element (empty canvas background) — a FLOATING selection anchored to the click point', () => {
-    document.body.innerHTML = '';
-    const sel = buildComposeSelection({ el: null, cdId: null, artboardId: null }, 100, 200);
-    expect(sel.selector).toBe('');
-    expect(sel.tag).toBe('');
-    expect(sel.artboardId).toBeNull();
-    expect(sel.bounds).toEqual({ x: 88, y: 188, w: 24, h: 24 });
-  });
-
-  test('with no element but INSIDE an artboard (right-click on its chrome/border) — floating, but keeps the artboardId', () => {
-    document.body.innerHTML = '';
-    const sel = buildComposeSelection({ el: null, cdId: null, artboardId: 'art1' }, 50, 60);
-    expect(sel.selector).toBe('');
-    expect(sel.artboardId).toBe('art1');
-    expect(sel.bounds).toEqual({ x: 38, y: 48, w: 24, h: 24 });
-  });
-});
-
-describe('openCommentComposer', () => {
-  // The regression: canvas-shell.tsx's context-menu "Add comment" used to
-  // ONLY postMessage the parent shell (which merely mirrors the target for
-  // the StatusBar/sidebar) and never dispatched `cm:open-composer` — the one
-  // event `comments-overlay.tsx` listens on to actually render the composer.
-  // Selecting the menu item silently did nothing.
-  test('dispatches cm:open-composer carrying the selection + click point', () => {
-    let detail: { selection?: unknown; clientX?: number; clientY?: number } | null = null;
-    const onOpen = (e: Event) => {
-      detail = (e as CustomEvent).detail;
-    };
-    document.addEventListener('cm:open-composer', onOpen);
-    const sel = {
-      selector: '',
-      artboardId: null,
-      tag: '',
-      classes: '',
-      text: '',
-      dom_path: [],
-      bounds: { x: 30, y: 40, w: 24, h: 24 },
-      html: '',
-    };
-    try {
-      openCommentComposer(sel, 42, 52);
-    } finally {
-      document.removeEventListener('cm:open-composer', onOpen);
-    }
-    expect(detail).not.toBeNull();
-    expect(detail?.selection).toBe(sel);
-    expect(detail?.clientX).toBe(42);
-    expect(detail?.clientY).toBe(52);
-  });
-});