fix(width): validate explicit width-point removal indices

Reapply on current upstream main.

crates/engine/src/tests_widthpoints.rs

@@ -30,6 +30,31 @@ fn dark(s: &Session, x: u32, y: u32) -> bool {
     vectorcraft_render::Renderer::new().render(&doc, 200, 200, vectorcraft_geom::Affine::IDENTITY, &opts).pixel(x, y)[0] < 128
 }
 
+/// Invalid entries in an explicit multi-point delete must not delete the valid entries.
+#[test]
+fn invalid_width_point_indices_leave_the_entire_profile_unchanged() {
+    let (mut s, id) = line_session();
+    set(&mut s, json!({"id": id.0, "t": 0.5, "left": 10, "right": 10}));
+    let before = points(&s, id);
+    let history = s.doc().unwrap().history.undo.len();
+    for bad in [
+        json!({"indices": [1, "bad"]}),
+        json!({"indices": [-1, 1]}),
+        json!({"indices": [1.5, 1]}),
+        json!({"indices": {"point": 1}}),
+        json!({"index": "bad"}),
+    ] {
+        let mut params = bad.as_object().unwrap().clone();
+        params.insert("id".into(), json!(id.0));
+        let err = s.execute("stroke.widthPoint.remove", &serde_json::Value::Object(params));
+        assert!(err.is_err(), "accepted malformed width point indices");
+        assert_eq!(points(&s, id), before);
+        assert_eq!(s.doc().unwrap().history.undo.len(), history);
+    }
+    s.execute("stroke.widthPoint.remove", &json!({"id": id.0, "indices": [1]})).unwrap();
+    assert_eq!(points(&s, id).len(), before.len() - 1);
+}
+
 #[test]
 fn a_point_moved_onto_another_makes_a_discontinuous_point_that_renders_a_step() {
     let (mut s, id) = line_session();