@bongos/core 1.19.789 → 1.19.791

package/tests/provisioning_paid_shape_gate.mjs

@@ -161,10 +161,20 @@ await ta('a case-variant shape does not slip past the gate INTO a dedicated row'
   }
 });
 
-await ta('HOSTING_SHAPES still carries exactly the three shapes the gate reasons about', () => {
-  // If a fourth, also-metered shape is ever added, this test is the tripwire that says the
-  // gate's single-shape assumption needs revisiting.
-  assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(), ['co-tenant', 'dedicated', 'standalone']);
+await ta('HOSTING_SHAPES carries the shapes the gate reasons about, and control-plane is NOT metered', () => {
+  // This tripwire fired for the first time at task 1003159, which added a fourth
+  // shape — 'control-plane', the platform's own box, enrolled so the owner's deploy
+  // door has a row to point at (ADR 0293 D2). Its question was "is the new shape
+  // also metered?", and the answer is NO, stated here rather than implied by
+  // absence: the control plane is infrastructure the project already runs and pays
+  // for, not a droplet allocated per request, so nothing about standing it up is
+  // billed through this gate. It is also not creatable through the create route at
+  // all — the self row is enrolled by the platform, not asked for by a builder.
+  assert.deepEqual([...provisioning.HOSTING_SHAPES].sort(),
+    ['co-tenant', 'control-plane', 'dedicated', 'standalone']);
+  // The assumption the tripwire actually guards is that exactly ONE shape is
+  // metered. A fifth shape that IS billed must widen the gate itself, in
+  // paid-shape-gate.js, and not merely this list.
 });
 
 server.close();

package/tests/provisioning_restart.mjs

@@ -29,7 +29,7 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
@@ -51,17 +51,33 @@ const PROMISE = /shortly|briefly|minute|second|soon\b/i;
 
 console.log('the module slice — constants, the migration, the enqueue classifier:');
 
-t("INTENT_ACTIONS includes 'restart', in lockstep with the provisioning_011 CHECK", () => {
+t("INTENT_ACTIONS includes 'restart', in lockstep with the LATEST action CHECK", () => {
+  // Pinned to provisioning_011 by name until task 1003159, which added
+  // 'core-upgrade' in provisioning_016 — and a lockstep assertion aimed at a
+  // superseded migration compares the live vocabulary against a frozen one, so it
+  // reds on the next widening rather than on a real drift. It now reads whichever
+  // migration most recently defines the CHECK, the shape
+  // tests/claimable_blocker_status.mjs uses for the claimable view.
   assert.ok(provisioning.INTENT_ACTIONS.includes('restart'));
-  const sql = readFileSync(new URL('../modules/provisioning/migrations/provisioning_011_restart.sql', import.meta.url), 'utf8');
+  const migDir = new URL('../modules/provisioning/migrations/', import.meta.url);
+  const defining = readdirSync(migDir)
+    .filter((f) => f.endsWith('.sql'))
+    .filter((f) => /CHECK \(action IN \(/.test(readFileSync(new URL(f, migDir), 'utf8')))
+    .sort();
+  assert.ok(defining.length, 'some migration defines the action CHECK');
+  const latest = defining[defining.length - 1];
+  const sql = readFileSync(new URL(latest, migDir), 'utf8');
   const m = /CHECK \(action IN \(([^)]*)\)\)/.exec(sql);
   assert.ok(m, 'the migration widens the action CHECK');
-  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, ''));
-  assert.ok(inSql.includes('restart'), 'this migration is the one that admitted it');
-  // The NEWEST action migration owns the strict set equality (provisioning_016,
-  // tests/provisioning_disconnect.mjs); an older one is a prefix of the set.
-  for (const a of inSql) assert.ok(provisioning.INTENT_ACTIONS.includes(a), `${a} is still an INTENT_ACTION`);
-  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_011_restart'\)/, 'self-registers');
+  const inSql = m[1].split(',').map((s) => s.trim().replace(/^'|'$/g, '')).sort();
+  // The NEWEST migration owns the strict set equality — the CHECK a live DB ends up
+  // with is the last one applied, so this is the assertion that would catch an action
+  // added in code but never admitted by the schema. That is provisioning_018 today:
+  // 016_disconnect and 018_core_upgrade_intent each rewrite the CHECK, so the later
+  // one must carry BOTH actions or the earlier one's is silently dropped.
+  assert.deepEqual(inSql, [...provisioning.INTENT_ACTIONS].sort(), 'the CHECK and INTENT_ACTIONS carry the same set');
+  const sql011 = readFileSync(new URL('provisioning_011_restart.sql', migDir), 'utf8');
+  assert.match(sql011, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_011_restart'\)/, 'self-registers');
 });
 
 t('RESTART_FROM is exactly {active} — every other state is already served by the provision path', () => {

package/tests/provisioning_settings_apply.mjs

@@ -84,8 +84,17 @@ await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carr
   const r = await provisioning.enqueueSettingsApply(db, 18, 'api:self');
   assert.equal(r.created, true);
   assert.equal(r.conflict, undefined);
-  assert.match(calls[0].sql, /INSERT INTO provisioning_intents/);
-  assert.deepEqual(calls[0].params, [18, 'settings-apply', 'api:self']);
+  // calls[0] is the self-row guard's shape lookup (ADR 0293 D2) — every enqueue now
+  // asks "is this the control plane?" before it writes. Assert on the INSERT itself
+  // rather than on a position, so this test says what it means and does not move
+  // again the next time a check joins the front of this function.
+  const insert = calls.find((c) => /INSERT INTO provisioning_intents/.test(c.sql));
+  assert.ok(insert, 'the enqueue reaches its INSERT');
+  assert.match(calls[0].sql, /SELECT hosting_shape FROM provisioning_instances/, 'and the guard ran FIRST');
+  // The trailing null is the target_version enqueueIntent gained in task 1003159:
+  // only a 'core-upgrade' names one, and the column's CHECK is an EQUIVALENCE, so a
+  // settings-apply carrying a target would be refused by the database.
+  assert.deepEqual(insert.params, [18, 'settings-apply', 'api:self', null]);
 });
 
 await ta('enqueueSettingsApply: an identical PENDING push already open → created:false, no conflict (it carries this change)', async () => {

package/tests/provisioning_teardown_intent.mjs

@@ -55,6 +55,13 @@ function fakeIntentDb(seed = []) {
   return {
     rows,
     query: async (sql, params) => {
+      // The self-row guard's shape lookup (task 1003159, ADR 0293 D2): every enqueue
+      // now asks "is this the control plane?" before it writes. These cases are all
+      // ORDINARY instances, so the honest answer is a tenant shape — answering
+      // 'control-plane' here would refuse every teardown in this file.
+      if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) {
+        return { rows: [{ hosting_shape: 'co-tenant' }] };
+      }
       if (/INSERT INTO provisioning_intents/.test(sql)) {
         const [instance_id, action, requested_by] = params;
         if (open(instance_id).length) {

package/tests/task_visuals.mjs

@@ -13,13 +13,16 @@ import { createRequire } from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
 import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
 const require = createRequire(import.meta.url);
 
 // Point storage at a throwaway dir BEFORE requiring the module.
 const TMP = path.join(os.tmpdir(), `otb-taskvisual-${process.pid}`);
 process.env.TASK_VISUALS_DIR = TMP;
 const tv = require('../modules/lifecycle/task-visuals.js');
-const kit = require('../modules/hall-ui/public/hall-kit.js');
+// The renderers left hall-kit.js for hall-visual.js (task 1003835) — the task
+// record page draws a visual and needs nothing else the kit holds.
+const vis = require('../modules/hall-ui/public/hall-visual.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -140,7 +143,7 @@ await t('persistImageBuffer: writes a name the serve route accepts, under the ri
   assert.equal(tv.taskIdFromName(r.file), 1003109);
   assert.equal(r.url, `/api/bongos/task-visuals/${r.file}`);
   // Both prefixes are permanent aliases, so a URL minted under either resolves.
-  assert.equal(kit.isTaskVisualUrl(r.url), true);
+  assert.equal(vis.isTaskVisualUrl(r.url), true);
   assert.equal(r.bytes, PNG.length);
   const onDisk = await fs.readFile(path.join(TMP, r.file));
   assert.deepEqual(onDisk, PNG);
@@ -170,23 +173,23 @@ await t('deleteStored: removes by name or URL, is idempotent, refuses a traversa
 });
 
 // ---- the client-side URL guard --------------------------------------------
-await t('hall-kit: only a server-minted visual URL is ever rendered', () => {
-  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
-  assert.equal(kit.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
+await t('hall-visual: only a server-minted visual URL is ever rendered', () => {
+  assert.equal(vis.isTaskVisualUrl('/api/gds/task-visuals/task-1003109-0011223344556677.png'), true);
+  assert.equal(vis.isTaskVisualUrl('/api/bongos/task-visuals/task-1-aabbccddeeff0011.webp'), true);
   // Anything that is not that exact shape renders nothing — including an
   // absolute URL to another origin, and a javascript: payload.
-  assert.equal(kit.isTaskVisualUrl('https://evil.example/x.png'), false);
-  assert.equal(kit.isTaskVisualUrl('javascript:alert(1)'), false);
-  assert.equal(kit.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
-  assert.equal(kit.isTaskVisualUrl(''), false);
-  assert.equal(kit.isTaskVisualUrl(null), false);
-});
-
-await t('hall-kit: no visual renders nothing at all — never a placeholder', () => {
-  assert.equal(kit.shipVisualThumbHtml({ id: 1 }), '');
-  assert.equal(kit.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
-  assert.equal(kit.shipVisualThumbHtml(null), '');
-  const html = kit.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
+  assert.equal(vis.isTaskVisualUrl('https://evil.example/x.png'), false);
+  assert.equal(vis.isTaskVisualUrl('javascript:alert(1)'), false);
+  assert.equal(vis.isTaskVisualUrl('/api/gds/task-visuals/../../secrets'), false);
+  assert.equal(vis.isTaskVisualUrl(''), false);
+  assert.equal(vis.isTaskVisualUrl(null), false);
+});
+
+await t('hall-visual: no visual renders nothing at all — never a placeholder', () => {
+  assert.equal(vis.shipVisualThumbHtml({ id: 1 }), '');
+  assert.equal(vis.shipVisualThumbHtml({ id: 1, visual_url: null }), '');
+  assert.equal(vis.shipVisualThumbHtml(null), '');
+  const html = vis.shipVisualThumbHtml({ id: 1, visual_url: '/api/gds/task-visuals/task-1-0011223344556677.png', visual_alt: 'a "before" shot' });
   assert.ok(html.includes('ship-visual-thumb'));
   // The caption is attacker-adjacent text (a builder wrote it) — it must be escaped.
   assert.ok(html.includes('"before"'));
@@ -194,18 +197,18 @@ await t('hall-kit: no visual renders nothing at all — never a placeholder', ()
 });
 
 // ---- the full-size figure (task 1003829) -----------------------------------
-await t('hall-kit: the full-size figure is the same guard, at reading size', () => {
+await t('hall-visual: the full-size figure is the same guard, at reading size', () => {
   // Same no-placeholder rule as the thumbnail: nothing at all without a visual.
-  assert.equal(kit.taskVisualFigureHtml({ id: 1 }), '');
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
-  assert.equal(kit.taskVisualFigureHtml(null), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1 }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: null }), '');
+  assert.equal(vis.taskVisualFigureHtml(null), '');
   // And the same URL wall — an off-origin src or a javascript: payload is not
   // "rendered without a caption", it is not rendered.
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
-  assert.equal(kit.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: 'https://evil.example/x.png' }), '');
+  assert.equal(vis.taskVisualFigureHtml({ id: 1, visual_url: 'javascript:alert(1)' }), '');
 
   const url = '/api/gds/task-visuals/task-1-0011223344556677.png';
-  const html = kit.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
+  const html = vis.taskVisualFigureHtml({ id: 1, visual_url: url, visual_alt: 'a "before" shot' });
   assert.ok(html.includes('<figure class="task-visual">'));
   assert.ok(html.includes('class="task-visual__img"'));
   // The caption is the SHIPPER's text — attacker-adjacent, so escaped in both
@@ -215,19 +218,80 @@ await t('hall-kit: the full-size figure is the same guard, at reading size', ()
 
   // The caller owns the size, so it owns the class base; anything but
   // [A-Za-z0-9_-] is stripped rather than interpolated into the attribute.
-  const studio = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
+  const studio = vis.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'studio-plate' });
   assert.ok(studio.includes('<figure class="studio-plate">'));
   assert.ok(studio.includes('class="studio-plate__img"'));
-  const hostile = kit.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
+  const hostile = vis.taskVisualFigureHtml({ id: 1, visual_url: url }, { className: 'x" onload="a' });
   assert.ok(hostile.includes('<figure class="xonloada">'), hostile);
 
   // No written alt → no caption at all. The fallback alt is a machine sentence
   // for a screen reader, never a caption shown to a reader.
-  const bare = kit.taskVisualFigureHtml({ id: 7, visual_url: url });
+  const bare = vis.taskVisualFigureHtml({ id: 7, visual_url: url });
   assert.ok(!bare.includes('figcaption'));
   assert.ok(bare.includes('alt="Visual for task 7"'));
 });
 
+// ---- the convergence is the deliverable (task 1003835) ---------------------
+//
+// Reading the source is the right altitude here: the defect this task closes is
+// a SECOND definition existing, which no behavioural assertion against one of
+// them can see. A duplicate renderer passes every test above.
+
+const HALL = (f) => fsSync.readFileSync(new URL(`../modules/hall-ui/public/${f}`, import.meta.url), 'utf8');
+
+await t('hall-kit no longer defines a visual renderer', () => {
+  const kitSrc = HALL('hall-kit.js');
+  // The function DEFINITIONS are what must be gone — the pointer comment naming
+  // them is the thing that tells the next reader where they went, so match on
+  // the definition syntax rather than on the bare name.
+  assert.ok(!/function\s+taskVisualFigureHtml\s*\(/.test(kitSrc), 'hall-kit.js still defines taskVisualFigureHtml');
+  assert.ok(!/function\s+shipVisualThumbHtml\s*\(/.test(kitSrc), 'hall-kit.js still defines shipVisualThumbHtml');
+  assert.ok(!/function\s+isTaskVisualUrl\s*\(/.test(kitSrc), 'hall-kit.js still defines isTaskVisualUrl');
+  // …and it must not re-export them either, or callers keep two ways in.
+  const kitApi = require('../modules/hall-ui/public/hall-kit.js');
+  assert.equal(kitApi.taskVisualFigureHtml, undefined);
+  assert.equal(kitApi.shipVisualThumbHtml, undefined);
+  assert.equal(kitApi.isTaskVisualUrl, undefined);
+});
+
+await t('task.js renders through the shared module, not its own <figure>', () => {
+  const src = HALL('task.js');
+  assert.ok(src.includes('vis.taskVisualFigureHtml(t, { className: \'tk-visual\' })'),
+    'task.js should delegate to OTBVisual with its own class base');
+  // The hand-rolled markup is the thing that came back three times. If any of it
+  // reappears in this file, the convergence has been undone.
+  assert.ok(!src.includes('<figure class="tk-visual">'), 'task.js hand-rolls the figure again');
+  assert.ok(!src.includes('tk-visual__img'), 'task.js hand-rolls the img class again');
+  assert.ok(!src.includes('task-visuals/task-'), 'task.js carries its own copy of the URL guard again');
+});
+
+await t('every page whose script draws a visual actually loads hall-visual.js', () => {
+  // A missing <script> is the one failure this split introduces, and it is
+  // silent: the guard in each caller degrades to rendering nothing, so a visual
+  // would simply stop appearing with no error anywhere.
+  for (const page of ['index.html', 'profile.html', 'studio.html', 'task.html']) {
+    assert.ok(HALL(page).includes('/builders/hall-visual.js'), `${page} does not load hall-visual.js`);
+  }
+});
+
+await t('the callers reach for OTBVisual, and no longer for the kit', () => {
+  for (const f of ['hall-render.js', 'profile.js', 'studio.js', 'task.js']) {
+    const src = HALL(f);
+    assert.ok(!/OTBKit(\.|\[')?\s*(shipVisualThumbHtml|taskVisualFigureHtml|isTaskVisualUrl)/.test(src),
+      `${f} still reads a visual renderer off OTBKit`);
+  }
+  assert.ok(HALL('hall-render.js').includes('window.OTBVisual.shipVisualThumbHtml'));
+  assert.ok(HALL('studio.js').includes('vis.taskVisualFigureHtml('));
+});
+
+await t('the dead .td-visual rules are gone, and nothing emits the class', () => {
+  // task 1003829's comment and this task's own brief both asserted a second
+  // renderer in task-detail.js. `git log -S` shows that file never carried one:
+  // the CSS was the fossil of a renderer that was planned and not built.
+  assert.ok(!HALL('style.css').includes('.td-visual'), 'style.css still carries the dead rules');
+  assert.ok(!HALL('task-detail.js').includes('td-visual'));
+});
+
 // ---- cleanup ---------------------------------------------------------------
 await fs.rm(TMP, { recursive: true, force: true });