@bongos/core 1.19.402 → 1.19.404

package/tests/project_stats.mjs

@@ -27,7 +27,8 @@ beforeEach(() => { stats._reset(); });
 function json(body) {
   return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(body) });
 }
-// route a fake instance: { leaderboard: [...], enabled: {...} }
+// route a fake instance: { leaderboard: [...], enabled: {...}, tasks: [...],
+// days: 30|undefined (whether the remote honoured ?days=), index: {...} }
 function stub(map) {
   globalThis.fetch = (url) => {
     const u = new URL(url);
@@ -39,9 +40,17 @@ function stub(map) {
     if (u.pathname.endsWith('/modules')) {
       return site.enabled ? json({ enabled: site.enabled }) : Promise.reject(new Error('down'));
     }
+    if (u.pathname.endsWith('/recent-shipped')) {
+      return site.tasks ? json({ tasks: site.tasks, days: site.days }) : Promise.reject(new Error('down'));
+    }
+    if (u.pathname === '/api/bongos') {
+      return site.index ? json(site.index) : Promise.reject(new Error('404'));
+    }
     return Promise.reject(new Error('404'));
   };
 }
+const DAY = 24 * 60 * 60 * 1000;
+function shipped(daysAgo) { return { shipped_at: new Date(Date.now() - daysAgo * DAY).toISOString() }; }
 
 test('system accounts are excluded — they are machines, not builders', async () => {
   // measured live: raw leaderboards read 13/3/3 against real 11/1/1
@@ -208,7 +217,7 @@ test('concurrent requests for the same origin collapse into one fetch', async ()
     stats.getProjectStats(['https://8.8.8.8']),
     stats.getProjectStats(['https://8.8.8.8']),
   ]);
-  assert.equal(calls, 2, 'two endpoints for one origin, not six for three callers');
+  assert.equal(calls, 4, 'four feeds for one origin, not twelve for three callers');
 });
 
 test('a non-http origin is refused rather than fetched', async () => {
@@ -274,3 +283,120 @@ test('an origin named __proto__ cannot retarget the result prototype', async ()
   assert.equal(Object.getPrototypeOf(out), null, 'the result map is null-prototype');
   assert.equal(({}).builders, undefined, 'Object.prototype is untouched');
 });
+
+/* ── The poster card's fields (task 1003301) ────────────────────────────────
+   Faces, shipped-in-30-days and the hall address ride the SAME allSettled as
+   builders and tags, degrade to null exactly like them, and share the one
+   frozen null shape — a key that went missing would ship as undefined, which
+   JSON.stringify drops, which silently changes the wire. ── */
+
+const KEYS = ['builders', 'tags', 'owner', 'owner_avatar', 'faces', 'shipped_30d', 'shipped_30d_capped', 'hall_origin'];
+
+test('one frozen null shape carries every key, and both fallbacks are that shape', async () => {
+  assert.ok(Object.isFrozen(stats.NULL_STATS));
+  assert.deepEqual(Object.keys(stats.NULL_STATS).sort(), KEYS.slice().sort());
+  const failed = await stats.getProjectStats(['file:///etc/passwd']);   // the cached-failure literal
+  assert.equal(failed['file:///etc/passwd'], stats.NULL_STATS);
+  stub({});
+  const unreached = await stats.getProjectStats(['https://9.9.9.9']);   // the read fallback
+  for (const k of KEYS) assert.equal(unreached['https://9.9.9.9'][k], null, `${k} is null, never undefined`);
+});
+
+test('faces are the first five people with an http avatar, in the feed\'s order; machines and bad URLs are skipped', async () => {
+  const av = (n) => `https://avatars.example.com/${n}.png`;
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [
+        { github_login: 'a', avatar_url: av('a') }, { github_login: 'bfg-system', avatar_url: av('bot') },
+        { github_login: 'b', avatar_url: 'javascript:alert(1)' }, { github_login: 'c', avatar_url: av('c') },
+        { github_login: 'd', avatar_url: av('d') }, { github_login: 'e', avatar_url: av('e') },
+        { github_login: 'f', avatar_url: av('f') }, { github_login: 'g', avatar_url: av('g') },
+      ],
+      enabled: {},
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].faces, ['a', 'c', 'd', 'e', 'f'].map(av));
+  assert.equal(out['https://8.8.8.8'].builders, 7, 'the +N the card shows is counted against builders');
+});
+
+test('a leaderboard with no avatars yields an empty faces list — asked, none — not null', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [{ github_login: 'a' }], enabled: {} } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.deepEqual(out['https://8.8.8.8'].faces, []);
+});
+
+test('shipped_30d counts only rows inside the window, from shipped_at, whatever the remote returned', async () => {
+  stub({
+    'https://8.8.8.8': {
+      leaderboard: [], enabled: {},
+      tasks: [shipped(1), shipped(29), shipped(31), shipped(400), { shipped_at: null }, {}],
+    },
+  });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].shipped_30d, 2);
+  assert.equal(out['https://8.8.8.8'].shipped_30d_capped, false);
+});
+
+test('shipped_30d is capped ("N+") when the feed\'s row cap is full and every row is inside the window', async () => {
+  const full = (n) => Array.from({ length: n }, (_, i) => shipped(i % 20));
+  stub({
+    'https://1.1.1.1': { leaderboard: [], enabled: {}, tasks: full(200), days: 30 },   // ?days honoured: cap 200
+    'https://8.8.8.8': { leaderboard: [], enabled: {}, tasks: full(30) },              // older core, no days: cap 30
+    'https://9.9.9.9': { leaderboard: [], enabled: {}, tasks: full(199), days: 30 },   // under the cap
+  });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://8.8.8.8', 'https://9.9.9.9']);
+  assert.deepEqual([out['https://1.1.1.1'].shipped_30d, out['https://1.1.1.1'].shipped_30d_capped], [200, true]);
+  assert.deepEqual([out['https://8.8.8.8'].shipped_30d, out['https://8.8.8.8'].shipped_30d_capped], [30, true]);
+  assert.deepEqual([out['https://9.9.9.9'].shipped_30d, out['https://9.9.9.9'].shipped_30d_capped], [199, false]);
+});
+
+test('the shipped feed is asked for the window explicitly', async () => {
+  const urls = [];
+  globalThis.fetch = (url) => { urls.push(String(url)); return Promise.reject(new Error('down')); };
+  await stats.getProjectStats(['https://8.8.8.8']);
+  assert.ok(urls.includes(`https://8.8.8.8/api/bongos/public/recent-shipped?days=${stats.SHIPPED_WINDOW_DAYS}`));
+  assert.ok(urls.includes('https://8.8.8.8/api/bongos'), 'the discovery index answers the hall address');
+});
+
+test('hall_origin is the discovery index\'s hall only where it is a different host from the site', async () => {
+  stub({
+    'https://1.1.1.1': { leaderboard: [], enabled: {}, index: { hall: 'https://builders.example.com' } },
+    'https://8.8.8.8': { leaderboard: [], enabled: {}, index: { hall: 'https://8.8.8.8' } },      // single host
+    'https://9.9.9.9': { leaderboard: [], enabled: {}, index: { hall: 'javascript:alert(1)' } },
+    'https://4.4.4.4': { leaderboard: [], enabled: {} },                                           // no index (older core)
+  });
+  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://8.8.8.8', 'https://9.9.9.9', 'https://4.4.4.4']);
+  assert.equal(out['https://1.1.1.1'].hall_origin, 'https://builders.example.com');
+  assert.equal(out['https://8.8.8.8'].hall_origin, null, 'a hall at <site>/builders is the site\'s own door');
+  assert.equal(out['https://9.9.9.9'].hall_origin, null);
+  assert.equal(out['https://4.4.4.4'].hall_origin, null);
+});
+
+test('a dead shipped feed leaves the other quarters standing', async () => {
+  stub({ 'https://8.8.8.8': { leaderboard: [{ github_login: 'a' }], enabled: { game: true }, index: { hall: 'https://h.example.com' } } });
+  const out = await stats.getProjectStats(['https://8.8.8.8']);
+  assert.equal(out['https://8.8.8.8'].shipped_30d, null, 'the dead quarter is unknown');
+  assert.equal(out['https://8.8.8.8'].shipped_30d_capped, null);
+  assert.equal(out['https://8.8.8.8'].builders, 1);
+  assert.deepEqual(out['https://8.8.8.8'].tags, ['game']);
+  assert.equal(out['https://8.8.8.8'].hall_origin, 'https://h.example.com');
+});
+
+test('the origin\'s host is resolved once per sweep, not once per feed', async () => {
+  const src = await import('node:fs').then((fs) =>
+    fs.readFileSync(new URL('../modules/platform-identity/project-stats.js', import.meta.url), 'utf8'));
+  assert.match(src, /await assertPublicHost\(siteUrl\(origin\)\.hostname\);/, 'the guard runs in fetchStats, before the allSettled');
+  const getJson = (src.match(/async function getJson\(url\)\s*\{([\s\S]*?)\n\}/) || [, ''])[1];
+  assert.ok(getJson, 'getJson() must exist');
+  assert.doesNotMatch(getJson, /assertPublicHost/, 'no per-feed lookup');
+});
+
+test('httpUrl accepts only http(s) strings and caps them', () => {
+  assert.equal(stats.httpUrl('https://a.example/x.png'), 'https://a.example/x.png');
+  assert.equal(stats.httpUrl('http://a.example/x.png'), 'http://a.example/x.png');
+  assert.equal(stats.httpUrl('javascript:alert(1)'), null);
+  assert.equal(stats.httpUrl('//a.example/x.png'), null);
+  assert.equal(stats.httpUrl(42), null);
+  assert.equal(stats.httpUrl('https://a.example/' + 'x'.repeat(400)).length, 300);
+});

package/tests/projects_hub.mjs

@@ -483,13 +483,109 @@ test('the card claims only what the catalog and the project itself answer (C6)',
   for (const invented of [/\blive\b/i, /uptime/i, /\bCreated\b/]) {
     assert.doesNotMatch(card, invented, `the card must not invent ${invented}`);
   }
-  for (const id of ['cardBuilders', 'cardRuns', 'cardOwner', 'cardListed']) {
-    assert.match(card, new RegExp(`id="${id}"`), `the ${id} fact must be real markup (C7)`);
+  for (const id of ['cardBuilders', 'cardShipped', 'cardRuns', 'cardOwner', 'cardListed', 'cardArt', 'cardFaces', 'cardFigs']) {
+    assert.match(card, new RegExp(`id="${id}"`), `the ${id} region must be real markup (C7)`);
   }
   assert.match(card, />Listed</, 'the catalogue date wears its honest label');
   assert.doesNotMatch(card, /—/, 'an unanswerable card fact hides; it never dashes');
 });
 
+/* ── The poster (task 1003301; the v2 pick, direction §7) ───────────────────
+   Art, faces, two figures on the art, the facts as a ledger, one accent door
+   and a member-only hall entry. The load-bearing rule is the DEGRADATION
+   LADDER: every region hides on null, down to the card that shipped before. ── */
+
+test('every card region is a direct child of the card — the banner a bare img, the faces and figures paragraphs', () => {
+  const card = (HUB.match(/<div class="projCard"[\s\S]*?<div class="cardActions" id="cardActions"><\/div>/) || [''])[0];
+  assert.ok(card, 'the card must be findable');
+  assert.equal((card.match(/<div\b/g) || []).length, 2, 'the card and its actions strip are the only divs — a nested wrapper shortens the C6 slice');
+  assert.match(card, /<img class="cardArt" id="cardArt" alt="" hidden>/, 'the banner is a bare img, hidden until art arrives');
+  assert.match(card, /<p class="cardFigs" id="cardFigs" hidden>/, 'the figures ride a paragraph');
+  assert.match(card, /<p class="cardFaces" id="cardFaces" hidden>/, 'the faces ride a paragraph');
+  assert.match(card, /<span class="cardCall a" id="cardBuildersFig" hidden>[\s\S]*?<span class="fig" id="cardBuilders"><\/span><span class="cap">builders<\/span>/);
+  assert.match(card, /<span class="cardCall b" id="cardShippedFig" hidden>[\s\S]*?<span class="fig" id="cardShipped"><\/span><span class="cap">shipped in 30 days<\/span>/);
+  assert.equal((card.match(/<svg class="lead"/g) || []).length, 2, 'each callout carries its own leader');
+  assert.doesNotMatch(card, /id="cardBuildersL"/, 'Builders left the facts list for the figure band');
+});
+
+test('the ladder: each region hides on null and the other figure stands alone', () => {
+  const fig = (SCRIPT.match(/function cardFig\(id, value\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fig, 'cardFig() must exist');
+  assert.match(fig, /\$\(id \+ 'Fig'\)\.hidden = !value/, 'a null figure hides its whole callout, leader and caption with it');
+  assert.match(SCRIPT, /\$\('cardFigs'\)\.hidden = !figs;/, 'both null hides the band');
+  const sf = (SCRIPT.match(/function shippedFigure\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(sf, /p\.shipped_30d == null\) return ''/, 'null shipped hides; 0 renders');
+  assert.match(sf, /p\.shipped_30d_capped \? '\+' : ''/, 'at the feed cap the figure reads N+');
+  const faces = (SCRIPT.match(/function cardFaces\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(faces, 'cardFaces() must exist');
+  assert.match(faces, /\$\('cardFaces'\)\.hidden = !faces\.length/, 'no faces, no row — absent, not empty-looking');
+  assert.match(faces, /p\.faces\.map\(safeHttpUrl\)\.filter\(Boolean\)\.slice\(0, FACES_MAX\)/, 'five scheme-checked faces at most');
+  assert.match(faces, /p\.builders - faces\.length/, 'the +N counts the builders beyond the faces shown');
+  assert.match(SCRIPT, /var FACES_MAX = 5;/);
+  const art = (SCRIPT.match(/function cardArt\(url\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(art, 'cardArt() must exist');
+  assert.match(art, /classList\.toggle\('has-art', !!url\)/, 'art switches the whole layout');
+  assert.match(SCRIPT, /\$\('cardArt'\)\.addEventListener\('error', function \(\) \{ cardArt\(''\); \}\);/,
+    'a broken image demotes to the no-art layout, never a broken glyph');
+  assert.match(SCRIPT, /cardArt\(p\.isSelf \? '' : safeHttpUrl\(p\.art_url\)\)/, 'the art URL is scheme-checked client-side too');
+});
+
+test('exactly one hall-URL derivation: the DOM for the hub, the feed for a project, safeHttpUrl for both, and only where the hall is elsewhere', () => {
+  assert.equal((SCRIPT.match(/function hallUrlOf\(/g) || []).length, 1);
+  const fn = (SCRIPT.match(/function hallUrlOf\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'hallUrlOf() must exist');
+  assert.match(fn, /var a = \$\('selfHall'\);/, 'the hub\'s own hall is read from the stamped DOM anchor, never assembled in script');
+  assert.match(fn, /safeHttpUrl\(a\.getAttribute\('href'\)\)/);
+  assert.match(fn, /safeHttpUrl\(p\.hall_origin\)/, 'a project\'s hall is the feed field, scheme-checked');
+  assert.match(fn, /hostOf\(hall\) !== hostOf\(site\)/, 'address-gated: no door onto the room you are in');
+  assert.doesNotMatch(SCRIPT, /'[^'\n]*\{\{buildersOrigin\}\}/, 'no brand token is ever emitted into a script string');
+  assert.equal((SCRIPT.match(/isMember\(rel\) \? hallUrlOf\(p\) : ''/g) || []).length, 2, 'member-gated on the card AND on the row, one rule');
+  assert.match(SCRIPT, /'<a class="cardHall" id="cardHall" href="' \+ esc\(hall\)/, 'the card\'s hall door is escaped');
+  assert.match(SCRIPT, /'<a class="rowHall" href="' \+ esc\(hall\) \+ '" target="_blank" rel="noopener"/, 'the row\'s hall glyph is escaped and opens a new tab');
+  assert.match(SCRIPT, /: ''\) \+ hallGlyphHtml\(p, rel\) \+ '<\/td>'/, 'the glyph rides the existing door cell — no seventh column');
+});
+
+test('the platform row carries a stamped, hidden hall glyph the session unhides — same tab, no target', () => {
+  const selfRow = (HUB.match(/<tr id="selfRow">([\s\S]*?)<\/tr>/) || [, ''])[1];
+  assert.match(selfRow, /<a class="rowHall" id="selfHall" href="\{\{buildersOrigin\}\}"[^>]*hidden>/, 'server-stamped and hidden until the session says member');
+  assert.match(SCRIPT, /if \(sh\) sh\.hidden = !badge \|\| !hallUrlOf\(SELF_PROJECT\);/, 'member-gated and address-gated, and null-safe: the stamp drops the anchor whole when a pack names no hall');
+  assert.match(SCRIPT, /if \(p\.isSelf\) \{\r?\n\s*var a = \$\('selfHall'\);/);
+});
+
+test('the card\'s doors: one accent door, the hall entry beside it as text, the platform\'s door same-tab', () => {
+  assert.match(SCRIPT, /'<a class="cardOpen" id="cardOpen" href="' \+ esc\(href\) \+ '"' \+\r?\n\s*\(p\.isSelf \? '' : ' target="_blank" rel="noopener"'\)/);
+  assert.match(SCRIPT, /\(p\.isSelf \? 'Home →' : 'Open site →'\)/);
+  assert.match(SCRIPT, /HALL_GLYPH \+ 'Builders\\' hall<\/a>'/, 'the hall entry carries the glyph and its name');
+  assert.match(COSMOS, /\.projCard \.cardOpen\{[^}]*background:var\(--accent\);color:var\(--accent-on\)/, 'the one accent door');
+  assert.match(COSMOS, /\.projCard \.cardHall\{[^}]*color:var\(--accent-deep\)[^}]*text-decoration:underline/, 'the hall entry is the footer-link grammar');
+});
+
+test('the platform answers its own figures by the same rule: faces from its leaderboard, shipped from its own feed', () => {
+  assert.match(SCRIPT, /SELF_PROJECT\.faces = real\.map\(function \(b\) \{ return safeHttpUrl\(b\.avatar_url\); \}\)\.filter\(Boolean\)\.slice\(0, FACES_MAX\);/);
+  const fn = (SCRIPT.match(/function loadSelfShipped\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'loadSelfShipped() must exist');
+  assert.match(fn, /\/public\/recent-shipped\?days=30/, 'the window is asked for explicitly');
+  assert.match(fn, /Date\.parse\(t && t\.shipped_at\) >= since/, 'counted from shipped_at, inside the window');
+  assert.match(fn, /d\.tasks\.length >= 200 && n === d\.tasks\.length/, 'N+ at the feed\'s row cap');
+  assert.match(SCRIPT, /\.then\(loadSelfStats, loadSelfStats\)\r?\n\s*\.then\(loadSelfShipped, loadSelfShipped\);/, 'runs once at boot beside the leaderboard read');
+});
+
+test('the poster is in the world: 560 wide, one hairline, no shadow, the disc surviving over the art, the facts a ledger', () => {
+  const block = (COSMOS.match(/\.projCard\{[^}]*\}/) || [''])[0];
+  assert.match(block, /width:min\(560px,100%\)/);
+  assert.match(block, /border:1px solid var\(--rule\)/);
+  assert.match(block, /box-shadow:none/);
+  assert.match(block, /container-type:inline-size/, 'the disc and the callouts measure the card, not the viewport');
+  assert.match(COSMOS, /\.projCard \.cardArt\{[^}]*aspect-ratio:5\/2;object-fit:cover/, 'a fixed 5:2 crop');
+  assert.match(COSMOS, /\.projCard\.has-art \.cardDot\{[^}]*top:calc\(100cqw \/ 2\.5 - 27px\)[^}]*border:4px solid var\(--bg-card\)/, 'half over the banner\'s edge, ringed in the card ground');
+  assert.match(COSMOS, /\.projCard\.has-art \.cardCall::before\{[^}]*mask-image/, 'each callout carries a feathered patch of the card ground — a mask, not a shadow');
+  assert.match(COSMOS, /\.projCard \.cardMeta dt\{[^}]*font-family:var\(--label-face\)[^}]*border-top:1px solid var\(--rule-soft\)/, 'mono label on a hairline');
+  assert.match(COSMOS, /\.projCard \.cardMeta dd\{[^}]*text-align:right[^}]*border-top:1px solid var\(--rule-soft\)/, 'the value right and on the same hairline');
+  assert.match(COSMOS, /\.projCard \.cardRel\{[^}]*font-family:var\(--label-face\)/, 'the relationship is a mono label, not an accent pill');
+  assert.doesNotMatch(COSMOS, /\.projCard \.cardMeta \.tags/, 'the card no longer renders the module list');
+  assert.match(COSMOS, /\.rowHall\{[^}]*width:28px;height:28px/, 'the row glyph clears the 24px floor');
+});
+
 test('the row keeps its own Open link working underneath the card', () => {
   assert.match(SCRIPT, /if \(ev\.target\.closest && ev\.target\.closest\('a'\)\) return;/,
     'a click on the row\'s own anchor must not be swallowed by the card handler');
@@ -592,10 +688,15 @@ test('each card fact is wired to its data, not just present in the markup', () =
   assert.match(SCRIPT, /function cardFact/, 'the card fact writer must exist');
   assert.match(SCRIPT, /dd\.hidden = \$\(id \+ 'L'\)\.hidden = !value/,
     'a fact with no answer hides label and value together — never a dash');
-  assert.match(SCRIPT, /cardFact\('cardBuilders', p\.builders == null \? '' : String\(p\.builders\)\)/,
+  // since task 1003301 Builders is a FIGURE (a callout on the art), not a fact,
+  // and Runs on the poster is the project's ADDRESS — the table keeps the module list
+  assert.match(SCRIPT, /cardFig\('cardBuilders', p\.builders == null \? '' : String\(p\.builders\)\)/,
     'builders: 0 is a real answer, null hides');
-  assert.match(SCRIPT, /cardFact\('cardRuns', Array\.isArray\(p\.tags\) \? tagsHtml\(p\.tags\) : ''/,
-    'runs go through the one shared formatter');
+  assert.match(SCRIPT, /cardFig\('cardShipped', shippedFigure\(p\)\)/, 'the second figure is the 30-day count');
+  assert.match(SCRIPT, /cardFact\('cardRuns', runsOf\(p\)\)/, 'runs is the address on the poster');
+  const runs = (SCRIPT.match(/function runsOf\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(runs, /hostOf\(p\.origin\)/, 'the address is the catalog origin\'s host');
+  assert.match(SCRIPT, /'<td class="colTags">' \+ tagsHtml\(p\.tags\)/, 'the table row keeps the module list');
   assert.match(SCRIPT, /cardFact\('cardOwner', rel === 'owner' \? '' : ownerHtml\(p\), true\)/,
     'owner comes from the enrichment and yields to the rel chip saying "yours"');
   const oh = (SCRIPT.match(/function ownerHtml\(p\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];