@bongos/core 1.19.1039 → 1.19.1040

package/tests/npm_release_page.mjs

@@ -0,0 +1,173 @@
+// tests/npm_release_page.mjs — the npm-release module's deploy-page sections, EXECUTED
+// (task 1002622): modules/npm-release/public/work.js run in a DOM stub against a real
+// reading, and deploy.js's loader that decides whether that script is fetched at all.
+//
+// WHAT IS AT RISK. The page's whole reason to exist is naming the work, so the cases pin
+// that the work is named (every task, by title, linked), that a partial reading SAYS it is
+// partial, that a reader the route refuses sees nothing rather than an error, and that a
+// hall without the module never asks for its script.
+//
+// Run:  node tests/npm_release_page.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const WORK_SRC = fs.readFileSync(path.join(ROOT, 'modules/npm-release/public/work.js'), 'utf8');
+const DEPLOY_SRC = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/deploy.js'), 'utf8');
+// The fixture the hall-preview harness serves — a reading taken off the live registry.
+const FIXTURE = JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts/hall-preview/fixtures/npm-release__work.json'), 'utf8'));
+
+const escapeHtml = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+
+function makeEl() {
+  return { hidden: true, _html: '', set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; } };
+}
+
+/** Run work.js with `answer(query)` standing in for the route. */
+function bootWork(answer) {
+  const els = new Map([['nr-work', makeEl()], ['nr-versions', makeEl()]]);
+  const asked = [];
+  const clicks = [];
+  const head = [];
+  const documentObj = {
+    getElementById: (id) => els.get(id) || null,
+    addEventListener(ev, fn) { if (ev === 'click') clicks.push(fn); },
+    createElement: () => ({}),
+    head: { appendChild: (n) => head.push(n) },
+  };
+  const request = async (method, url) => {
+    const q = url.includes('?') ? url.slice(url.indexOf('?') + 1) : '';
+    asked.push(q);
+    return answer(q);
+  };
+  const windowObj = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: { escapeHtml, toast() {} },
+  };
+  class Element {}
+  const sandbox = { window: windowObj, document: documentObj, Element, console, setTimeout, Date, Set, Map, Promise, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(WORK_SRC, sandbox, { filename: 'work.js' });
+  const settle = async () => { for (let i = 0; i < 20; i++) await new Promise((r) => setTimeout(r, 0)); };
+  return { els, asked, head, settle, work: () => els.get('nr-work'), versions: () => els.get('nr-versions') };
+}
+
+const ok = (data) => ({ ok: true, status: 200, data });
+
+test('every recent task is named, by title, linked to its page', async () => {
+  const b = bootWork(() => ok(FIXTURE));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.equal(b.work().hidden, false);
+  for (const [stage, rows] of Object.entries(FIXTURE.stages)) {
+    // Stages longer than the fold show their first rows; the rest sit behind "Show all".
+    for (const t of rows.slice(0, 8)) {
+      assert.ok(html.includes(`href="/task/${t.id}"`), `${stage}: task ${t.id} is linked`);
+      assert.ok(html.includes(escapeHtml(t.title)), `${stage}: task ${t.id} is named`);
+    }
+  }
+  assert.match(html, /Show all 15/);
+});
+
+test('the counts strip carries every stage, and the stage sentence sits under its head', async () => {
+  const b = bootWork(() => ok(FIXTURE));
+  await b.settle();
+  const html = b.work().innerHTML;
+  for (const fig of ['Not merged', 'Unversioned', 'Not running', 'Unreleased', 'Released', 'No version']) {
+    assert.ok(html.includes(`>${fig}</span>`), fig);
+  }
+  assert.doesNotMatch(html, /ov-group__note/, 'a sentence in the note slot squeezes the head on a phone');
+  assert.match(html, /Already offered to other projects\./, 'said once for the group when true of every row');
+});
+
+test('the version history lists each version with its tasks, and asks for a short first page', async () => {
+  const b = bootWork(() => ok(FIXTURE));
+  await b.settle();
+  assert.equal(b.asked[0], 'limit=6');
+  const html = b.versions().innerHTML;
+  for (const v of FIXTURE.history.versions) assert.ok(html.includes(`data-version="${v.version}"`), v.version);
+  assert.match(html, /running here|released/);
+  assert.match(html, /Show older versions/);
+  assert.equal(b.head.length, 1, 'the module stylesheet is loaded once');
+});
+
+test('a partial reading says it is partial', async () => {
+  const partial = { ...FIXTURE, registry: { ok: false, error: 'the registry answered 503' }, notes: { ...FIXTURE.notes, error: 'could not download 1.19.1039' } };
+  const b = bootWork(() => ok(partial));
+  await b.settle();
+  const html = b.work().innerHTML;
+  assert.match(html, /Partial reading/);
+  assert.match(html, /registry could not be read \(the registry answered 503\)/);
+  assert.match(html, /could not download 1\.19\.1039/);
+});
+
+test('a version whose notes could not be read is never shown as a version with no work', async () => {
+  const d = JSON.parse(JSON.stringify(FIXTURE));
+  d.history.versions[0].entries = null;
+  d.history.versions[1].entries = [];
+  const b = bootWork(() => ok(d));
+  await b.settle();
+  const html = b.versions().innerHTML;
+  assert.match(html, /notes could not be read/);
+  assert.match(html, /housekeeping merges only/);
+});
+
+test('a reader the route refuses sees nothing, not an error', async () => {
+  for (const status of [401, 403, 404]) {
+    const b = bootWork(() => ({ ok: false, status, data: {} }));
+    await b.settle();
+    assert.equal(b.work().hidden, true, `${status} keeps the section hidden`);
+  }
+});
+
+test('a server failure is said in words', async () => {
+  const b = bootWork(() => ({ ok: false, status: 500, data: { error: { message: 'Could not read where the work is right now.' } } }));
+  await b.settle();
+  assert.equal(b.work().hidden, false);
+  assert.match(b.work().innerHTML, /Could not read where the work is right now\./);
+});
+
+test('task titles are escaped', async () => {
+  const d = JSON.parse(JSON.stringify(FIXTURE));
+  d.stages.not_merged[0].title = '<img src=x onerror=alert(1)>';
+  const b = bootWork(() => ok(d));
+  await b.settle();
+  assert.doesNotMatch(b.work().innerHTML, /<img src=x/);
+});
+
+// ---- deploy.js's loader ---------------------------------------------------------
+
+function bootDeploy({ modules, search = '' }) {
+  const appended = [];
+  const documentObj = {
+    getElementById: () => ({ hidden: false, textContent: '', innerHTML: '', addEventListener() {} }),
+    addEventListener(ev, fn) { if (ev === 'DOMContentLoaded') this._ready = fn; },
+    createElement: () => ({}),
+    body: { appendChild: (n) => appended.push(n) },
+  };
+  const request = async () => ({ ok: false, status: 403, data: {} });
+  const windowObj = {
+    BongosClient: { createClient: () => ({ request }) },
+    OTB: { escapeHtml, toast() {} },
+    location: { assign() {}, search },
+    __MODULES__: modules,
+    __deployPollMs: 0,
+  };
+  const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, Date, Set, Map, Promise, decodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(DEPLOY_SRC, sandbox, { filename: 'deploy.js' });
+  documentObj._ready();
+  return appended;
+}
+
+test('the deploy page loads the module script only for its own view, and only with the module on', () => {
+  const on = { enabled: { 'npm-release': true } };
+  assert.deepEqual(bootDeploy({ modules: on }).map((s) => s.src), ['/modules/npm-release/public/work.js']);
+  assert.deepEqual(bootDeploy({ modules: { enabled: { 'npm-release': false } } }), [], 'module off: no request for a script that would 404');
+  assert.deepEqual(bootDeploy({ modules: undefined }), [], 'no module record at all');
+  assert.deepEqual(bootDeploy({ modules: on, search: '?project=mercury' }), [], 'another project\'s view is not this package\'s');
+});

package/tests/npm_release_work.mjs

@@ -0,0 +1,350 @@
+// tests/npm_release_work.mjs — the npm-release module's "where is the work?" reading
+// (task 1002622): which stage every recent task has reached, and what each version carried.
+//
+// WHAT IS AT RISK. The owner's complaint was a deploy page that named none of the fifteen
+// tasks sitting between the version the hall ran and the newest one. The failure modes that
+// would bring that back are quiet ones: a task put in the wrong stage, a version whose notes
+// could not be read rendered as a version with no work, or a registry that did not answer
+// rendered as "nothing new". Each case below pins one of them.
+//
+// THE TRANSPORT IS FAKED, THE PARSING IS NOT. `get` returns a real stream of a real gzipped
+// tar built here, so the tar reader, gunzip, chunk boundaries and the registry's JSON are all
+// exercised as they run in production. Only the network is missing.
+//
+// Run:  node tests/npm_release_work.mjs
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import { EventEmitter } from 'node:events';
+import { Readable } from 'node:stream';
+import zlib from 'node:zlib';
+
+const require = createRequire(import.meta.url);
+const { readWork } = require('../modules/npm-release/work.js');
+const buildRouter = require('../modules/npm-release/routes/work.js');
+
+const ORIGIN = 'https://registry.npmjs.org';
+const PKG = '@bongos/core';
+
+// ---- a real tarball, built by hand ---------------------------------------------------
+
+function tarHeader(name, size, type = '0') {
+  const h = Buffer.alloc(512, 0);
+  h.write(name.slice(0, 100), 0, 'utf8');
+  h.write('0000644\0', 100, 'ascii');
+  h.write('0000000\0', 108, 'ascii');
+  h.write('0000000\0', 116, 'ascii');
+  h.write(`${size.toString(8).padStart(11, '0')}\0`, 124, 'ascii');
+  h.write('00000000000\0', 136, 'ascii');
+  h.write('        ', 148, 'ascii');
+  h.write(type, 156, 'ascii');
+  h.write('ustar\0', 257, 'ascii');
+  h.write('00', 263, 'ascii');
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(`${sum.toString(8).padStart(6, '0')}\0 `, 148, 'ascii');
+  return h;
+}
+function tarEntry(name, data, type = '0') {
+  const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const pad = Buffer.alloc((512 - (body.length % 512)) % 512, 0);
+  return Buffer.concat([tarHeader(name, body.length, type), body, pad]);
+}
+function paxEntry(path) {
+  // A pax record is "<len> <key>=<value>\n", where <len> counts its own digits too.
+  const rec = (k, v) => {
+    const body = ` ${k}=${v}\n`;
+    let n = body.length + 1;
+    while (String(n).length + body.length !== n) n = String(n).length + body.length;
+    return `${n}${body}`;
+  };
+  return tarEntry('PaxHeader/x', rec('path', path), 'x');
+}
+/** A gzipped npm-shaped tarball. `notes` null leaves release-notes.json out. */
+function tarball({ notes, padBytes = 40000, pax = false } = {}) {
+  const parts = [
+    tarEntry('package/package.json', JSON.stringify({ name: PKG })),
+    // A large file BEFORE the notes, so the reader has to skip across many chunks.
+    tarEntry('package/big.js', Buffer.alloc(padBytes, 97)),
+  ];
+  if (notes) {
+    const json = JSON.stringify(notes);
+    if (pax) parts.push(paxEntry('package/release-notes.json'), tarEntry('package/SHORTNAME', json));
+    else parts.push(tarEntry('package/release-notes.json', json));
+  }
+  parts.push(Buffer.alloc(1024, 0));
+  return zlib.gzipSync(Buffer.concat(parts));
+}
+
+// ---- a fake registry -----------------------------------------------------------------
+
+function packument({ versions, latest, times }) {
+  const doc = { name: PKG, 'dist-tags': { latest }, versions: {}, time: {} };
+  for (const v of versions) {
+    doc.versions[v] = { version: v, dist: { tarball: `${ORIGIN}/@bongos/core/-/core-${v}.tgz` } };
+    doc.time[v] = times[v];
+  }
+  return doc;
+}
+
+/** `get` answering from `routes` (url → { status, body }), recording every URL asked for. */
+function fakeGet(routes) {
+  const asked = [];
+  const get = (url, opts, cb) => {
+    asked.push(url);
+    const req = new EventEmitter();
+    req.destroy = () => {};
+    setImmediate(() => {
+      const r = routes[url];
+      if (!r) { req.emit('error', new Error(`no route for ${url}`)); return; }
+      const body = Buffer.isBuffer(r.body) ? r.body : Buffer.from(typeof r.body === 'string' ? r.body : JSON.stringify(r.body));
+      // Small chunks, so a tar header lands across a chunk boundary.
+      const chunks = [];
+      for (let i = 0; i < body.length; i += 777) chunks.push(body.subarray(i, i + 777));
+      const res = Readable.from(chunks);
+      res.statusCode = r.status || 200;
+      cb(res);
+    });
+    return req;
+  };
+  return { get, asked };
+}
+
+function fakePool(tasks, titles = {}) {
+  const queries = [];
+  return {
+    queries,
+    async query(sql, params) {
+      queries.push({ sql, params });
+      if (/FROM tasks t/.test(sql)) return { rows: tasks };
+      if (/WHERE id = ANY/.test(sql)) return { rows: params[0].filter((id) => titles[id]).map((id) => ({ id, title: titles[id] })) };
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+const freshStore = () => ({ packument: { at: 0, value: null, inflight: null }, notes: { version: null, at: 0, value: null, inflight: null } });
+
+// Versions 1.0.1 … 1.0.5, published a day apart, ending 2026-09-26T10:00Z.
+const TIMES = {
+  '1.0.1': '2026-09-22T10:00:00.000Z',
+  '1.0.2': '2026-09-23T10:00:00.000Z',
+  '1.0.3': '2026-09-24T10:00:00.000Z',
+  '1.0.4': '2026-09-25T10:00:00.000Z',
+  '1.0.5': '2026-09-26T10:00:00.000Z',
+};
+const NOTES = {
+  '1.0.1': [{ id: '11', text: 'An early fix.' }],
+  '1.0.2': [{ id: '12', text: 'Released and running.' }],
+  '1.0.3': [{ id: '13', text: 'Running here.' }, { text: 'A hand-landed change nobody numbered.' }],
+  '1.0.4': [],
+  '1.0.5': [{ id: '15', text: 'Published, not running yet.' }],
+};
+const INSTALLED_TO_103 = () => ({ '1.0.1': NOTES['1.0.1'], '1.0.2': NOTES['1.0.2'], '1.0.3': NOTES['1.0.3'] });
+
+const row = (id, status, at, extra = {}) => ({ id, title: `Task ${id} title`, status, at, value_summary: null, builder: 'Lars', ...extra });
+const TASKS = [
+  row('20', 'confirmed', '2026-09-26T11:00:00.000Z'),                        // done, not merged
+  row('15', 'shipped', '2026-09-26T09:00:00.000Z'),                          // in 1.0.5 > live 1.0.3
+  row('13', 'shipped', '2026-09-24T09:00:00.000Z'),                          // in 1.0.3 = live
+  row('12', 'shipped', '2026-09-23T09:00:00.000Z'),                          // in 1.0.2
+  row('21', 'shipped', '2026-09-26T12:00:00.000Z'),                          // after 1.0.5 went out
+  row('22', 'shipped', '2026-09-25T12:00:00.000Z'),                          // before it, named nowhere
+  row('23', 'shipped', '2026-09-24T08:00:00.000Z', { value_summary: 'A hand-landed change nobody numbered.' }),
+];
+
+function setup({ latest = '1.0.5', tgz = tarball({ notes: NOTES }), pkStatus = 200, tgzStatus = 200, installed = INSTALLED_TO_103, tasks = TASKS, titles = {} } = {}) {
+  const versions = Object.keys(TIMES);
+  const routes = {
+    [`${ORIGIN}/@bongos%2fcore`]: { status: pkStatus, body: pkStatus === 200 ? packument({ versions, latest, times: TIMES }) : 'nope' },
+    [`${ORIGIN}/@bongos/core/-/core-1.0.5.tgz`]: { status: tgzStatus, body: tgz },
+  };
+  const fg = fakeGet(routes);
+  const pool = fakePool(tasks, titles);
+  const store = freshStore();
+  const read = (over = {}) => readWork({ pool, pkg: PKG, live: '1.0.3', get: fg.get, store, installedNotes: installed, now: () => Date.parse('2026-09-26T13:00:00Z'), ...over });
+  return { read, asked: fg.asked, pool, store };
+}
+
+const ids = (list) => list.map((t) => t.id);
+
+// ---- the stages ---------------------------------------------------------------------
+
+test('every task lands in the stage it has actually reached', async () => {
+  const { read } = setup();
+  const d = await read();
+  assert.deepEqual(ids(d.stages.not_merged), ['20']);
+  assert.deepEqual(ids(d.stages.not_live), ['15']);
+  assert.deepEqual(ids(d.stages.released), ['13', '12', '23']);
+  assert.deepEqual(ids(d.stages.unversioned), ['21']);
+  assert.deepEqual(ids(d.stages.no_version), ['22']);
+  assert.deepEqual(d.stages.live_unreleased, []);
+  assert.equal(d.live, '1.0.3');
+  assert.equal(d.newest, '1.0.5');
+  assert.equal(d.released, '1.0.5');
+});
+
+test('a task published before this hall ran it says it was already offered', async () => {
+  const d = await setup().read();
+  const t = d.stages.not_live[0];
+  assert.equal(t.version, '1.0.5');
+  assert.equal(t.offered, true);
+});
+
+test('work running here but not released is its own stage', async () => {
+  // `latest` still on 1.0.2: 1.0.3 runs here and has not been released.
+  const d = await setup({ latest: '1.0.2' }).read();
+  assert.deepEqual(ids(d.stages.live_unreleased), ['13', '23']);
+  assert.deepEqual(ids(d.stages.released), ['12']);
+  assert.equal(d.stages.not_live[0].offered, undefined, 'not offered: 1.0.5 is past the release');
+});
+
+test('a merge with no task id is matched on the task\'s own ship summary', async () => {
+  const d = await setup().read();
+  const t = d.stages.released.find((x) => x.id === '23');
+  assert.equal(t.version, '1.0.3');
+});
+
+test('with no running version (another package), nothing is "not live"', async () => {
+  const d = await setup().read({ live: null });
+  assert.deepEqual(d.stages.not_live, []);
+  assert.ok(ids(d.stages.released).includes('15'));
+});
+
+// ---- where the notes come from --------------------------------------------------------
+
+test('notes past the installed copy are read out of the newest package', async () => {
+  const { read, asked } = setup();
+  const d = await read();
+  assert.ok(asked.includes(`${ORIGIN}/@bongos/core/-/core-1.0.5.tgz`));
+  assert.deepEqual(d.notes.source, { from: 'package', version: '1.0.5' });
+  assert.equal(d.notes.covers_to, '1.0.5');
+  assert.equal(d.notes.error, null);
+});
+
+test('a pax long-name header is followed to the notes file', async () => {
+  const d = await setup({ tgz: tarball({ notes: NOTES, pax: true }) }).read();
+  assert.equal(d.notes.covers_to, '1.0.5');
+  assert.deepEqual(ids(d.stages.not_live), ['15']);
+});
+
+test('when the installed notes already reach the newest version, nothing is downloaded', async () => {
+  const { read, asked } = setup({ installed: () => NOTES });
+  const d = await read();
+  assert.ok(!asked.some((u) => u.endsWith('.tgz')), 'no tarball download');
+  assert.deepEqual(d.notes.source, { from: 'installed', version: '1.0.5' });
+});
+
+test('a package without notes is an error, not an empty history', async () => {
+  const d = await setup({ tgz: tarball({ notes: null }) }).read();
+  assert.match(d.notes.error, /without release notes/);
+  // The installed copy stands in: the work up to 1.0.3 is still placed.
+  assert.deepEqual(d.notes.source, { from: 'installed', version: '1.0.3' });
+  assert.ok(ids(d.stages.released).includes('13'));
+  // 1.0.5 is listed as unread, never as "no work".
+  const v = d.history.versions.find((x) => x.version === '1.0.5');
+  assert.equal(v.entries, null);
+});
+
+test('a download that fails says so', async () => {
+  const d = await setup({ tgzStatus: 503 }).read();
+  assert.match(d.notes.error, /could not download 1\.0\.5/);
+});
+
+test('a registry that does not answer is reported, and the installed notes still place work', async () => {
+  const d = await setup({ pkStatus: 500 }).read();
+  assert.equal(d.registry.ok, false);
+  assert.match(d.registry.error, /500/);
+  assert.equal(d.newest, null);
+  assert.equal(d.released, null);
+  assert.ok(ids(d.stages.released).includes('13'), '1.0.3 work is still placed from the installed notes');
+});
+
+test('the package download is only ever followed on the registry\'s own origin', async () => {
+  const versions = Object.keys(TIMES);
+  const doc = packument({ versions, latest: '1.0.5', times: TIMES });
+  doc.versions['1.0.5'].dist.tarball = 'https://evil.example/core.tgz';
+  const fg = fakeGet({ [`${ORIGIN}/@bongos%2fcore`]: { body: doc } });
+  const d = await readWork({ pool: fakePool(TASKS), pkg: PKG, live: '1.0.3', get: fg.get, store: freshStore(), installedNotes: INSTALLED_TO_103 });
+  assert.ok(!fg.asked.some((u) => u.includes('evil.example')));
+  assert.match(d.notes.error, /no download/);
+});
+
+// ---- the cache --------------------------------------------------------------------------
+
+test('a second read within minutes asks the registry nothing new', async () => {
+  const { read, asked } = setup();
+  await read();
+  const before = asked.length;
+  await read();
+  assert.equal(asked.length, before);
+});
+
+test('a failed notes read is not retried on every page load', async () => {
+  const { read, asked } = setup({ tgzStatus: 503 });
+  await read();
+  await read();
+  assert.equal(asked.filter((u) => u.endsWith('.tgz')).length, 1);
+});
+
+// ---- the version history ----------------------------------------------------------------
+
+test('the history lists each version\'s tasks newest first, with titles from the ledger', async () => {
+  const d = await setup({ titles: { 11: 'Old fix title' } }).read();
+  const v = d.history.versions;
+  assert.deepEqual(v.map((x) => x.version), ['1.0.5', '1.0.4', '1.0.3', '1.0.2', '1.0.1']);
+  assert.equal(v[0].released, true);
+  assert.equal(v[2].live, true);
+  assert.deepEqual(v[1].entries, [], 'a housekeeping-only version is an empty list, not unread');
+  assert.equal(v[0].entries[0].title, 'Task 15 title');
+  assert.equal(v[4].entries[0].title, 'Old fix title', 'a task outside the window is looked up by id');
+  assert.equal(v[0].published_at, TIMES['1.0.5']);
+});
+
+test('the history pages with before + limit', async () => {
+  const { read } = setup();
+  const first = await read({ limit: 2 });
+  assert.deepEqual(first.history.versions.map((x) => x.version), ['1.0.5', '1.0.4']);
+  assert.equal(first.history.more, true);
+  const next = await read({ limit: 2, before: '1.0.4' });
+  assert.deepEqual(next.history.versions.map((x) => x.version), ['1.0.3', '1.0.2']);
+});
+
+test('the ledger window is clamped', async () => {
+  const { read, pool } = setup();
+  const windows = () => pool.queries.filter((q) => /FROM tasks t/.test(q.sql)).map((q) => q.params[0]);
+  await read({ days: '9999' });
+  await read({ days: 'nonsense' });
+  assert.deepEqual(windows(), [60, 14]);
+});
+
+// ---- the route ------------------------------------------------------------------------
+
+function routeLayers() {
+  const router = buildRouter({ read: async (args) => ({ ok: true, args }) });
+  const layer = router.stack.find((l) => l.route && l.route.path === '/npm-release/work');
+  return layer.route.stack.map((s) => s.handle);
+}
+
+test('the route is gated like the deploy page: a builder holding core.pin.move', async () => {
+  const handles = routeLayers();
+  assert.equal(handles.length, 3, 'requireBuilder, the permission gate, then the handler');
+  const src = (await import('node:fs')).readFileSync(new URL('../modules/npm-release/routes/work.js', import.meta.url), 'utf8');
+  assert.match(src, /api\.requireBuilder,\s*\n\s*api\.requirePermission\('core\.pin\.move'\)/);
+  assert.doesNotMatch(src, /api\.requireRank\(/);
+});
+
+test('the handler passes the query through and answers 500 plainly when the read throws', async () => {
+  const [, , ok] = routeLayers();
+  let body = null;
+  await ok({ query: { days: '7', before: '1.0.3', limit: '5' } }, { json(v) { body = v; } });
+  assert.equal(body.args.days, '7');
+  assert.equal(body.args.before, '1.0.3');
+
+  const router = buildRouter({ read: async () => { throw new Error('boom'); } });
+  const h = router.stack[0].route.stack.at(-1).handle;
+  let status = 0; let err = null;
+  await h({ query: {} }, { status(s) { status = s; return this; }, json(v) { err = v; } });
+  assert.equal(status, 500);
+  assert.equal(err.error.code, 'work_read_failed');
+});

package/tests/render_check.mjs

@@ -34,7 +34,8 @@ test('the page a builder changed comes before the pages a shared file reaches, s
 
 test('a path that is not a rendered surface, or a page with no states file, reaches nothing', () => {
   assert.deepEqual(names(['src/bongos/db.js', 'modules/hall-ui/public/goal-map.states.json', 'modules/hall-ui/routes/x.js']), []);
-  assert.deepEqual(names(['modules/hall-ui/public/deploy.html']), [], 'a page without a states file does not fall back to the pages that link to it');
+  // blockers, not deploy: /deploy gained a states file with the npm-release module (task 1002622).
+  assert.deepEqual(names(['modules/hall-ui/public/blockers.html']), [], 'a page without a states file does not fall back to the pages that link to it');
 });
 
 test('fitFindings names every element from the structured facts, once per element across renders, with its largest measure', () => {
@@ -102,7 +103,7 @@ test('the CLI renders nothing, and says why, when no page a states file describe
   const none = cli('src/bongos/db.js');
   assert.equal(none.status, 0);
   assert.match(none.stdout, /no rendered surface changed/);
-  const noStates = cli('modules/hall-ui/public/deploy.html');
+  const noStates = cli('modules/hall-ui/public/blockers.html');
   assert.equal(noStates.status, 0);
   assert.match(noStates.stdout, /1 rendered-surface file\(s\) changed, but no <page>\.states\.json reaches them/);
 });