@bongos/core 1.17.0

package/modules/hall-ui/public/md-reader.js

@@ -0,0 +1,234 @@
+// md-reader.js — a small, dependency-free markdown reader for in-hall docs.
+//
+// Task 1472: the drachmae-and-karma onboarding doc needs a rendered in-hall
+// page (the primer proves the pattern, but its parser is baked into primer.js
+// and coupled to the primer's ack/diagram chrome). This factors the reusable
+// core out into `window.OTBMdReader` so any hall doc-reader page can fetch a
+// canonical `docs/onboarding/*.md` and render it client-side with no build
+// step and no external markdown dependency.
+//
+// Covers the subset our onboarding docs actually use: h1–h3, paragraphs,
+// unordered/ordered lists (single level), tables, fenced code, hr,
+// blockquotes (which the primer's own parser does NOT handle — the drachmae
+// doc uses them heavily), and inline `code` / **bold** / *italic* / [link].
+// The repo-relative link rewriter is parameterized (base dir + GitHub bases +
+// a diagrams route) so each page points relative paths at the right place.
+//
+// (The primer's copy predates this and can adopt OTBMdReader in a later pass —
+// captured as an idea at ship; leaving primer.js untouched here keeps this
+// change off the sign-in-gated onboarding page.)
+
+(function () {
+  'use strict';
+
+  function escapeHtml(s) {
+    return String(s)
+      .replace(/&/g, '&')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;')
+      .replace(/"/g, '&quot;')
+      .replace(/'/g, '&#39;');
+  }
+
+  // Stable slug for heading anchors — lowercase, strip punctuation, dash-join.
+  // Matches the primer's slugify so in-doc anchor links behave identically.
+  function slugify(text) {
+    return String(text)
+      .toLowerCase()
+      .replace(/[—–]/g, '-')
+      .replace(/[^a-z0-9\s-]/g, '')
+      .trim()
+      .replace(/\s+/g, '-')
+      .replace(/-+/g, '-');
+  }
+
+  function normalizePath(p) {
+    const parts = p.split('/');
+    const out = [];
+    for (const part of parts) {
+      if (part === '' || part === '.') continue;
+      if (part === '..') { out.pop(); continue; }
+      out.push(part);
+    }
+    return out.join('/') + (p.endsWith('/') ? '/' : '');
+  }
+
+  // Build a link resolver bound to where THIS doc lives in the repo. Relative
+  // repo paths (../adr/…, diagrams/…) are rewritten to something that resolves
+  // in the browser instead of 404-ing under /builders/*:
+  //   - http(s):// or #anchor or mailto:/tel:  → unchanged
+  //   - the diagrams dir                        → the in-hall diagrams route
+  //   - everything else                         → GitHub blob/tree (bases fetched
+  //     from /api/gds/public/repo-info; null until then → pass through, 404s
+  //     harmlessly rather than crashing).
+  // opts: { baseDir, getBlobBase, getTreeBase, diagramsHref }
+  function makeResolveLinkHref(opts) {
+    const baseDir = (opts && opts.baseDir) || '';
+    const getBlobBase = (opts && opts.getBlobBase) || (() => null);
+    const getTreeBase = (opts && opts.getTreeBase) || (() => null);
+    const diagramsHref = (opts && opts.diagramsHref) || '/builders/diagrams';
+    return function resolveLinkHref(href) {
+      if (!href) return href;
+      if (/^https?:\/\//i.test(href)) return href;
+      if (href.startsWith('#')) return href;
+      if (href.startsWith('mailto:') || href.startsWith('tel:')) return href;
+      // The onboarding diagrams live at /builders/diagrams/* in the hall.
+      if (href === 'diagrams/' || href === 'diagrams') return diagramsHref;
+      let resolved;
+      if (href.startsWith('/')) {
+        resolved = href.replace(/^\/+/, '');
+      } else {
+        resolved = normalizePath(baseDir + href);
+      }
+      // The diagrams PNGs referenced by relative path resolve in-hall too.
+      const dm = resolved.match(/(?:^|\/)diagrams\/([\w.-]+\.png)$/);
+      if (dm) return `${diagramsHref}/${dm[1]}`;
+      const trailingSlash = resolved.endsWith('/');
+      const lastSeg = resolved.replace(/\/+$/, '').split('/').pop() || '';
+      const isDir = trailingSlash || !lastSeg.includes('.');
+      const cleanResolved = resolved.replace(/^\/+/, '').replace(/\/+$/, '');
+      const base = isDir ? getTreeBase() : getBlobBase();
+      if (!base) return href;
+      return `${base}/${cleanResolved}`;
+    };
+  }
+
+  // Inline substitutions on already-escaped text. Code spans are protected
+  // first via placeholders so bold/italic/link rules don't touch their guts.
+  function renderInline(escapedText, resolveLinkHref) {
+    const resolve = resolveLinkHref || ((h) => h);
+    const codeSpans = [];
+    let out = escapedText.replace(/`([^`]+)`/g, (_m, g1) => {
+      codeSpans.push(g1);
+      return ` CODE${codeSpans.length - 1} `;
+    });
+    out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_m, text, url) => {
+      const safeUrl = url.replace(/&amp;/g, '&').replace(/&#39;/g, "'");
+      const resolved = resolve(safeUrl);
+      let linkHost = '';
+      try { linkHost = new URL(resolved, location.href).hostname; } catch (_) { /* relative */ }
+      const instApex = location.hostname.split('.').slice(-2).join('.');
+      const sameInstance = !!linkHost && (linkHost === location.hostname || linkHost === instApex || linkHost.endsWith('.' + instApex));
+      const external = /^https?:\/\//.test(resolved) && !sameInstance;
+      const attrs = external ? ' target="_blank" rel="noopener"' : '';
+      return `<a href="${escapeHtml(resolved)}"${attrs}>${text}</a>`;
+    });
+    out = out.replace(/\*\*([^*]+)\*\*/g, '<strong>$1</strong>');
+    out = out.replace(/(^|[^*])\*([^*]+)\*(?!\*)/g, '$1<em>$2</em>');
+    out = out.replace(/ CODE(\d+) /g, (_m, idx) => `<code>${escapeHtml(codeSpans[Number(idx)])}</code>`);
+    return out;
+  }
+
+  function splitTableRow(line) {
+    const cells = line.split('|').map((c) => c.trim());
+    if (cells.length && cells[0] === '') cells.shift();
+    if (cells.length && cells[cells.length - 1] === '') cells.pop();
+    return cells;
+  }
+
+  // Block grammar (line-by-line). Returns { html, headings } where headings is
+  // [{ level, text, id }] for building a TOC + scrollspy.
+  function parseMarkdown(md, resolveLinkHref) {
+    const lines = String(md).replace(/\r\n?/g, '\n').split('\n');
+    const out = [];
+    const headings = [];
+    let i = 0;
+
+    while (i < lines.length) {
+      const raw = lines[i];
+
+      // Fenced code block.
+      if (raw.startsWith('```')) {
+        i += 1;
+        const codeLines = [];
+        while (i < lines.length && !lines[i].startsWith('```')) { codeLines.push(lines[i]); i += 1; }
+        i += 1; // consume closing ```
+        out.push(`<pre><code>${escapeHtml(codeLines.join('\n'))}</code></pre>`);
+        continue;
+      }
+
+      // Headings.
+      let hm;
+      if ((hm = raw.match(/^(#{1,3})\s+(.+?)\s*$/))) {
+        const level = hm[1].length;
+        const text = hm[2];
+        const id = slugify(text);
+        headings.push({ level, text, id });
+        out.push(`<h${level} id="${escapeHtml(id)}">${renderInline(escapeHtml(text), resolveLinkHref)}</h${level}>`);
+        i += 1;
+        continue;
+      }
+
+      // Horizontal rule.
+      if (/^---+\s*$/.test(raw)) { out.push('<hr>'); i += 1; continue; }
+
+      // Blank line — paragraph separator.
+      if (/^\s*$/.test(raw)) { i += 1; continue; }
+
+      // Blockquote — consecutive '> ' lines collapse into one <blockquote>.
+      // (The drachmae doc leans on these for its "why / note" asides.)
+      if (/^>\s?/.test(raw)) {
+        const quoteLines = [];
+        while (i < lines.length && /^>\s?/.test(lines[i])) {
+          quoteLines.push(lines[i].replace(/^>\s?/, ''));
+          i += 1;
+        }
+        const inner = quoteLines.join(' ').trim();
+        out.push(`<blockquote><p>${renderInline(escapeHtml(inner), resolveLinkHref)}</p></blockquote>`);
+        continue;
+      }
+
+      // Table: header row '| … |' followed by a separator row.
+      if (/^\|/.test(raw) && i + 1 < lines.length && /^\|[\s\-:|]+\|\s*$/.test(lines[i + 1])) {
+        const headerCells = splitTableRow(raw);
+        i += 2;
+        const bodyRows = [];
+        while (i < lines.length && /^\|/.test(lines[i])) { bodyRows.push(splitTableRow(lines[i])); i += 1; }
+        let html = '<table><thead><tr>';
+        for (const c of headerCells) html += `<th>${renderInline(escapeHtml(c), resolveLinkHref)}</th>`;
+        html += '</tr></thead><tbody>';
+        for (const row of bodyRows) {
+          html += '<tr>';
+          for (const c of row) html += `<td>${renderInline(escapeHtml(c), resolveLinkHref)}</td>`;
+          html += '</tr>';
+        }
+        html += '</tbody></table>';
+        out.push(html);
+        continue;
+      }
+
+      // Lists (unordered '- ' or ordered '1. '); consecutive items collapse.
+      if (/^(-|\d+\.)\s+/.test(raw)) {
+        const ordered = /^\d+\.\s+/.test(raw);
+        const items = [];
+        while (i < lines.length && /^(-|\d+\.)\s+/.test(lines[i])) {
+          const content = lines[i].replace(/^(-|\d+\.)\s+/, '');
+          items.push(`<li>${renderInline(escapeHtml(content), resolveLinkHref)}</li>`);
+          i += 1;
+        }
+        out.push(`<${ordered ? 'ol' : 'ul'}>${items.join('')}</${ordered ? 'ol' : 'ul'}>`);
+        continue;
+      }
+
+      // Paragraph — collect consecutive non-special lines.
+      const paraLines = [raw];
+      i += 1;
+      while (i < lines.length &&
+             !/^\s*$/.test(lines[i]) &&
+             !/^(#{1,3})\s/.test(lines[i]) &&
+             !/^---+\s*$/.test(lines[i]) &&
+             !/^```/.test(lines[i]) &&
+             !/^>\s?/.test(lines[i]) &&
+             !/^\|/.test(lines[i]) &&
+             !/^(-|\d+\.)\s+/.test(lines[i])) {
+        paraLines.push(lines[i]);
+        i += 1;
+      }
+      out.push(`<p>${renderInline(escapeHtml(paraLines.join(' ')), resolveLinkHref)}</p>`);
+    }
+
+    return { html: out.join('\n'), headings };
+  }
+
+  window.OTBMdReader = { escapeHtml, slugify, normalizePath, makeResolveLinkHref, renderInline, splitTableRow, parseMarkdown };
+})();

package/modules/hall-ui/public/modules.html

@@ -0,0 +1,119 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Modules — {{worldName}}</title>
+  <meta name="description" content="What this instance runs: enable or disable modules, see which are your own vs. core-loaded, and submit one upstream.">
+  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
+  <link rel="preconnect" href="https://fonts.googleapis.com">
+  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">
+  <link rel="stylesheet" href="/builders/style.css?v=2026-07-02-shell1">
+  <style>
+    /* Page-local styles for Modules, layered on the shared design tokens
+       (style.css) — same pattern as settings.html's page-local block. */
+    .mod-grid {
+      display: grid;
+      grid-template-columns: repeat(auto-fill, minmax(280px, 1fr));
+      gap: 14px;
+      margin-top: 10px;
+    }
+    .mod-card {
+      border: 1px solid var(--border);
+      border-radius: var(--radius-sm);
+      background: var(--surface);
+      padding: 14px 16px;
+    }
+    .mod-card__head { display: flex; align-items: center; justify-content: space-between; gap: 10px; }
+    .mod-card__title { font-weight: 650; font-size: 14.5px; color: var(--ink); }
+    .mod-card__key { font-size: 12px; color: var(--ink-faint); font-family: ui-monospace, "SF Mono", Menlo, monospace; }
+    .mod-card__desc { font-size: 13px; color: var(--ink-soft); margin: 8px 0; }
+    .mod-chips { display: flex; flex-wrap: wrap; gap: 6px; margin: 8px 0; }
+    .mod-chip {
+      font-size: 11.5px;
+      color: var(--ink-soft);
+      background: var(--surface-2);
+      border: 1px solid var(--border);
+      border-radius: 999px;
+      padding: 3px 10px;
+    }
+    .mod-chip--core { color: var(--info); border-color: color-mix(in srgb, var(--info) 45%, var(--border)); }
+    .mod-chip--own { color: var(--accent-text); border-color: color-mix(in srgb, var(--accent) 45%, var(--border)); }
+    .mod-card__actions { display: flex; align-items: center; justify-content: space-between; gap: 10px; margin-top: 10px; }
+    button.mod-toggle {
+      font-family: var(--font-body);
+      font-size: 12.5px;
+      font-weight: 600;
+      padding: 5px 16px;
+      min-width: 78px;
+      border-radius: 999px;
+      border: 1px solid var(--border-strong);
+      background: var(--surface);
+      color: var(--ink-soft);
+      cursor: pointer;
+    }
+    button.mod-toggle[data-on="1"] { background: var(--accent); border-color: var(--accent); color: #fff; }
+    button.mod-toggle:disabled { opacity: 0.5; cursor: default; }
+    button.mod-submit {
+      font-family: var(--font-body);
+      font-size: 12px;
+      font-weight: 600;
+      padding: 5px 12px;
+      border-radius: var(--radius-sm);
+      border: 1px solid var(--border-strong);
+      background: transparent;
+      color: var(--ink-soft);
+      cursor: pointer;
+    }
+    button.mod-submit:disabled { opacity: 0.45; cursor: not-allowed; }
+    .mod-empty { color: var(--ink-faint); font-style: italic; font-size: 13px; padding: 10px 0; }
+    .mod-note { font-size: 12px; color: var(--ink-faint); margin-top: 4px; }
+  </style>
+</head>
+<body data-page="modules" data-page-title="Modules">
+
+<div class="app">
+  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
+  <div class="app-scrim" id="app-scrim" hidden></div>
+  <div class="app-body">
+    <header class="app-topbar" id="app-topbar"></header>
+    <div class="app-content">
+      <div class="page-head"><p class="page-head__sub" id="modules-sub">Loading modules…</p></div>
+
+      <main>
+        <!-- Built by this project — modules with no foreign origin (ADR 0107 §9). -->
+        <section class="scroll" id="own-scroll" aria-labelledby="own-h">
+          <h2 id="own-h" class="scroll__h">Built by this project</h2>
+          <p class="scroll__lede">Modules this instance built itself. Toggle which ones are active; Metic+ can flip the switch, everyone can see the state.</p>
+          <div class="mod-grid" id="own-grid"><div class="mod-empty">Loading…</div></div>
+        </section>
+
+        <!-- Core-loaded — pulled in from the shared Cloud Bongos catalog. Empty
+             until the upstream/submit pipeline (task 1770/1772) actually lands one. -->
+        <section class="scroll" id="core-scroll" aria-labelledby="core-h">
+          <h2 id="core-h" class="scroll__h">Core-loaded (from Cloud Bongos)</h2>
+          <p class="scroll__lede">Modules built by other Cloud Bongos instances and pulled into this one. None yet — this instance hasn't adopted a module from the shared catalog.</p>
+          <div class="mod-grid" id="core-grid"><div class="mod-empty">None yet.</div></div>
+        </section>
+
+        <!-- Submit for review — the front door to bongos module submit (ADR 0107 §1/§9). -->
+        <section class="scroll" id="submit-scroll" aria-labelledby="submit-h">
+          <h2 id="submit-h" class="scroll__h">Contribute a module upstream</h2>
+          <p class="scroll__lede" id="submit-lede">Submit one of this project's own modules for review, so it can join the shared Cloud Bongos catalog with your name and this project credited.</p>
+          <p class="settings-status" id="submit-status" role="status" aria-live="polite"></p>
+        </section>
+      </main>
+
+      <footer class="app-foot" id="app-foot"></footer>
+    </div>
+  </div>
+</div>
+
+<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
+
+<script src="/builders/shell.js?v=2026-07-02-shell1"></script>
+<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
+<script src="/builders/modules.js?v=2026-07-03-modtab"></script>
+</body>
+</html>

package/modules/hall-ui/public/modules.js

@@ -0,0 +1,154 @@
+// public-builders/modules.js — the hall "Modules" tab (/builders/modules).
+//
+// ADR 0107 §9 / task 1776. Three jobs:
+//   1. List every on-disk module, split "built by this project" vs. "core-loaded
+//      from Cloud Bongos" (src/module-loader/provenance.js decides the split —
+//      see GET /api/bongos/modules).
+//   2. Enable/disable — a toggle over config/modules.json (POST /modules/:key/enable).
+//      Any signed-in builder sees the state; only metic+archon can flip it (the
+//      server enforces this — a lower-rank click just gets a 403 + a friendly
+//      toast, same as every other rank-gated write in this hall).
+//   3. "Submit for review" front door — returns 501 today (the submit pipeline,
+//      task 1770, hasn't landed) so the button stays visibly disabled with a
+//      tooltip rather than pretending to queue something.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  // Generated typed client (task 1996 / R09), served as window.BongosClient by
+  // /lib/bongos-client.js. baseUrl:'' passes the full `${API}/...` URLs below
+  // through unchanged; result-mode ({ status, ok, data }) preserves control flow 1:1.
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml, $, toast } = window.OTB;
+
+  let viewerRank = 'xenos';
+  let canToggle = false;
+
+  function provenanceChip(m) {
+    return m.provenance === 'core'
+      ? '<span class="mod-chip mod-chip--core">core-loaded</span>'
+      : '<span class="mod-chip mod-chip--own">built here</span>';
+  }
+
+  function attributionChips(m) {
+    const chips = [];
+    if (m.author) chips.push(`<span class="mod-chip">by ${escapeHtml(m.author)}</span>`);
+    if (m.origin) chips.push(`<span class="mod-chip">from ${escapeHtml(m.origin)}</span>`);
+    if (m.license) chips.push(`<span class="mod-chip">${escapeHtml(m.license)}</span>`);
+    return chips.join('');
+  }
+
+  function cardHTML(m) {
+    return `
+      <div class="mod-card" data-key="${escapeHtml(m.key)}">
+        <div class="mod-card__head">
+          <div>
+            <div class="mod-card__title">${escapeHtml(m.title || m.key)}</div>
+            <div class="mod-card__key">${escapeHtml(m.key)}</div>
+          </div>
+        </div>
+        <p class="mod-card__desc">${escapeHtml(m.description || '')}</p>
+        <div class="mod-chips">${provenanceChip(m)}${attributionChips(m)}</div>
+        <div class="mod-card__actions">
+          <button type="button" class="mod-toggle" data-on="${m.enabled ? '1' : '0'}"
+            ${canToggle ? '' : 'disabled title="Metic+ can enable or disable a module"'}>
+            ${m.enabled ? 'Enabled' : 'Disabled'}
+          </button>
+        </div>
+      </div>`;
+  }
+
+  function render(data) {
+    const own = data.modules.filter((m) => m.provenance === 'own');
+    const core = data.modules.filter((m) => m.provenance === 'core');
+
+    const sub = $('#modules-sub');
+    if (sub) sub.textContent = `${data.modules.length} module(s) — ${own.length} built by this project, ${core.length} core-loaded.`;
+
+    const ownGrid = $('#own-grid');
+    if (ownGrid) ownGrid.innerHTML = own.length ? own.map(cardHTML).join('') : '<div class="mod-empty">None on disk.</div>';
+
+    const coreGrid = $('#core-grid');
+    if (coreGrid) coreGrid.innerHTML = core.length ? core.map(cardHTML).join('') : '<div class="mod-empty">None yet.</div>';
+
+    const submitStatus = $('#submit-status');
+    if (submitStatus) {
+      submitStatus.innerHTML = own.length
+        ? own.map((m) => `
+          <span style="display:inline-flex;align-items:center;gap:8px;margin:4px 12px 4px 0;">
+            <button type="button" class="mod-submit" data-submit-key="${escapeHtml(m.key)}"
+              ${data.submit_pipeline_live ? '' : 'disabled title="Submit pipeline not live yet — tracked by task 1770"'}>
+              Submit "${escapeHtml(m.key)}" for review
+            </button>
+          </span>`).join('')
+        : '<span class="mod-note">No modules of this project\'s own to submit.</span>';
+    }
+
+    // Wire toggles.
+    document.querySelectorAll('.mod-toggle').forEach((btn) => {
+      btn.addEventListener('click', onToggle);
+    });
+    document.querySelectorAll('[data-submit-key]').forEach((btn) => {
+      btn.addEventListener('click', onSubmit);
+    });
+  }
+
+  async function onToggle(ev) {
+    const btn = ev.currentTarget;
+    const card = btn.closest('.mod-card');
+    const key = card && card.dataset.key;
+    if (!key) return;
+    const next = btn.dataset.on !== '1';
+    btn.disabled = true;
+    try {
+      const res = await api.request('POST', `${API}/modules/${encodeURIComponent(key)}/enable`, { body: { enabled: next } });
+      const body = res.data || {};
+      if (!res.ok) throw new Error(body.message || `enable → ${res.status}`);
+      btn.dataset.on = next ? '1' : '0';
+      btn.textContent = next ? 'Enabled' : 'Disabled';
+      toast(body.note || (next ? `${key} enabled.` : `${key} disabled.`), { duration: 3200 });
+    } catch (err) {
+      console.error('[modules] toggle failed', err);
+      toast(err.message || 'Could not change that module.', { duration: 3200 });
+    } finally {
+      btn.disabled = !canToggle;
+    }
+  }
+
+  async function onSubmit(ev) {
+    const btn = ev.currentTarget;
+    const key = btn.dataset.submitKey;
+    try {
+      const res = await api.request('POST', `${API}/modules/${encodeURIComponent(key)}/submit`);
+      const body = res.data || {};
+      toast(body.message || 'Not available yet.', { duration: 4200 });
+    } catch (err) {
+      toast('Could not reach the submit endpoint.', { duration: 3200 });
+    }
+  }
+
+  async function load() {
+    try {
+      const meRes = await api.request('GET', `${API}/me`);
+      if (meRes.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+      const mePayload = meRes.data || {};
+      const builder = (mePayload && mePayload.builder) ? mePayload.builder : mePayload;
+      viewerRank = (builder && builder.rank) || 'xenos';
+      canToggle = viewerRank === 'metic' || viewerRank === 'archon';
+
+      const res = await api.request('GET', `${API}/modules`);
+      if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+      if (!res.ok) throw new Error(`modules → ${res.status}`);
+      const data = res.data;
+      render(data);
+    } catch (err) {
+      console.error('[modules] failed to load', err);
+      const sub = $('#modules-sub');
+      if (sub) sub.textContent = 'Could not load modules. Return to the hall and try again.';
+      toast('Could not load modules.', { duration: 3200 });
+    }
+  }
+
+  load();
+})();