@bongos/core 1.20.59 → 1.20.61

package/tests/provisioning_look.mjs

@@ -0,0 +1,376 @@
+// tests/provisioning_look.mjs — a project's look, night tint and logo, platform side
+// (task 1004421, BV2.PS06; ADR 0358).
+//
+// The load-bearing assertions:
+//   • the vocabulary IS the style library plus `own` and `custom` — a look added to
+//     modules/ui-design/styles/ without joining the list (or the reverse) fails here;
+//   • the accent nudge ADJUSTS, never refuses: every colour round the hue wheel comes
+//     back readable in both modes, a readable one comes back untouched, and a moved
+//     one keeps its hue;
+//   • the wizard's copy of that nudge IS the server's, character for character;
+//   • a logo is screened by its BYTES — an SVG, a renamed file or an oversized one is
+//     refused before anything is stored;
+//   • the routes are the owner's (404 for anyone else), store the ADJUSTED accent and
+//     say so, refuse a custom look with no accent, and push like PATCH …/settings;
+//   • the public logo read serves only a content-addressed name, as an image only.
+//
+// DB-free: data access is stubbed on the cached module objects (the
+// provisioning_repo_private_route.mjs pattern), over a real mounted router.
+//
+// Run:  node tests/provisioning_look.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const provisioning = require('../modules/provisioning/provisioning.js');
+const look = require('../modules/provisioning/look.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── contrast, restated independently of look.js so the nudge is checked, not echoed ──
+const lin = (c) => { c /= 255; return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4; };
+const lum = ([r, g, b]) => 0.2126 * lin(r) + 0.7152 * lin(g) + 0.0722 * lin(b);
+const ratio = (a, b) => { const [hi, lo] = [lum(a), lum(b)].sort((x, y) => y - x); return (hi + 0.05) / (lo + 0.05); };
+const rgb = (hex) => { const n = parseInt(hex.slice(1), 16); return [(n >> 16) & 255, (n >> 8) & 255, n & 255]; };
+const mix = (a, p, b) => a.map((v, i) => v * p + b[i] * (1 - p));
+function readsEverywhere(hex) {
+  const c = rgb(hex);
+  const fails = [];
+  if (ratio([42, 19, 5], c) < 4.5) fails.push('dark ink on the accent fill');
+  for (const [name, ground] of [['paper', [237, 236, 238]], ['card', [251, 250, 252]]]) {
+    if (ratio(mix(c, 0.45, [36, 14, 0]), ground) < 4.5) fails.push(`light accent ink on ${name}`);
+  }
+  for (const [name, ground] of [['black', [0, 0, 0]], ['dark card', [16, 16, 18]],
+    ['tinted night', mix(c, 0.06, [0, 0, 0])], ['tinted card', mix(c, 0.05, [16, 16, 18])]]) {
+    if (ratio(c, ground) < 4.5) fails.push(`accent on ${name}`);
+  }
+  const info = mix([91, 111, 208], 0.8, [255, 255, 255]);
+  if (ratio(info, mix(info, 0.14, mix(c, 0.05, [16, 16, 18]))) < 4.5) fails.push('info chip on the tinted card');
+  return fails;
+}
+const hueOf = (hex) => {
+  const [r, g, b] = rgb(hex).map((v) => v / 255);
+  const max = Math.max(r, g, b), min = Math.min(r, g, b), d = max - min;
+  if (!d) return null;
+  const h = max === r ? ((g - b) / d + 6) % 6 : max === g ? (b - r) / d + 2 : (r - g) / d + 4;
+  return h * 60;
+};
+const hslHex = (h, s, l) => {
+  const a = s * Math.min(l, 1 - l), k = (n) => (n + h / 30) % 12;
+  const f = (n) => Math.round(255 * (l - a * Math.max(-1, Math.min(k(n) - 3, 9 - k(n), 1))));
+  return '#' + [f(0), f(8), f(4)].map((x) => x.toString(16).padStart(2, '0')).join('');
+};
+
+console.log('\nThe vocabulary is the style library:');
+
+await ta('LIBRARY_LOOKS is exactly the style directories, and the setting adds own + custom around them', async () => {
+  const dirs = fs.readdirSync(path.join(ROOT, 'modules', 'ui-design', 'styles'))
+    .filter((d) => fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'styles', d, 'pack.json'))).sort();
+  assert.deepEqual([...look.LIBRARY_LOOKS].sort(), dirs);
+  assert.deepEqual(look.LOOK_SETTINGS_VOCAB.look, ['own', ...look.LIBRARY_LOOKS, 'custom']);
+  assert.deepEqual(provisioning.SETTINGS_VOCAB.look, look.LOOK_SETTINGS_VOCAB.look, 'the look is a policy setting');
+  assert.deepEqual(provisioning.SETTINGS_VOCAB.night_tint, ['on', 'off']);
+});
+
+await ta('the defaults change nothing: own pack, and a tint that only a look can switch on', async () => {
+  const s = provisioning.effectiveSettings({ settings: {} });
+  assert.equal(s.look, 'own');
+  assert.equal(s.night_tint, 'on');
+  const vars = provisioning.settingsEnvVars({ settings: {} }, 'X');
+  assert.equal(vars.X_LOOK, 'own');
+  assert.equal(vars.X_LOOK_ACCENT, '');
+  assert.equal(vars.X_LOGO_URL, '');
+});
+
+await ta('the companions carry only a well-formed value — a stored accent or address that is not one goes out empty', async () => {
+  const good = provisioning.settingsEnvVars({ settings: { look: 'custom', look_accent: '#B48CF2', logo_url: 'https://x.test/api/bongos/provisioning/logos/a.png' } }, 'X');
+  assert.equal(good.X_LOOK_ACCENT, '#b48cf2');
+  assert.equal(good.X_LOGO_URL, 'https://x.test/api/bongos/provisioning/logos/a.png');
+  const bad = provisioning.settingsEnvVars({ settings: { look_accent: 'red', logo_url: 'javascript:alert(1)' } }, 'X');
+  assert.equal(bad.X_LOOK_ACCENT, '');
+  assert.equal(bad.X_LOGO_URL, '');
+  const spaced = provisioning.settingsEnvVars({ settings: { logo_url: 'https://x.test/a b.png' } }, 'X');
+  assert.equal(spaced.X_LOGO_URL, '', 'a space would split the env line');
+});
+
+console.log('\nThe accent nudge adjusts, never refuses:');
+
+await ta('a colour that already reads in both modes comes back untouched', async () => {
+  for (const hex of ['#fb9569', '#b48cf2', '#6fb3e3', '#e3c39c']) {
+    assert.deepEqual(look.lookAdjustAccent(hex), { hex, adjusted: false }, hex);
+    assert.deepEqual(readsEverywhere(hex), [], hex);
+  }
+});
+
+await ta('every colour round the hue wheel comes back readable everywhere the hall paints it, its hue kept', async () => {
+  const fails = [];
+  let moved = 0;
+  for (let h = 0; h < 360; h += 10) {
+    for (const s of [0, 0.4, 0.8, 1]) {
+      for (const l of [0, 0.15, 0.35, 0.5, 0.65, 0.85, 1]) {
+        const hex = hslHex(h, s, l);
+        const out = look.lookAdjustAccent(hex);
+        if (!out) { fails.push(`${hex}: refused`); continue; }
+        const why = readsEverywhere(out.hex);
+        if (why.length) fails.push(`${hex} → ${out.hex}: ${why.join(', ')}`);
+        if (out.adjusted) moved++;
+        const before = hueOf(hex), after = hueOf(out.hex);
+        if (s >= 0.4 && l > 0 && l < 1 && before !== null && after !== null) {
+          const dh = Math.min(Math.abs(before - after), 360 - Math.abs(before - after));
+          if (dh > 8) fails.push(`${hex} → ${out.hex}: hue moved ${dh.toFixed(1)}°`);
+        }
+      }
+    }
+  }
+  assert.deepEqual(fails, []);
+  assert.ok(moved > 100, `sanity: the sweep must actually exercise the nudge (moved ${moved})`);
+});
+
+await ta('pure black and pure white are nudged to a readable grey, not refused', async () => {
+  for (const hex of ['#000000', '#ffffff']) {
+    const out = look.lookAdjustAccent(hex);
+    assert.ok(out && out.adjusted, hex);
+    assert.deepEqual(readsEverywhere(out.hex), [], `${hex} → ${out.hex}`);
+  }
+});
+
+await ta('only a #rrggbb is a colour', async () => {
+  for (const v of ['', 'red', '#fff', '#12345g', null, undefined, 'rgb(1,2,3)']) assert.equal(look.lookAdjustAccent(v), null, String(v));
+  assert.deepEqual(look.lookAdjustAccent('B48CF2'), { hex: '#b48cf2', adjusted: false }, 'a missing # is forgiven');
+});
+
+await ta("the wizard's copy of lookAdjustAccent IS the server's, character for character", async () => {
+  const fnText = (src) => {
+    const start = src.indexOf('function lookAdjustAccent(');
+    assert.ok(start >= 0, 'function lookAdjustAccent( not found');
+    let depth = 0;
+    for (let i = src.indexOf('{', start); i < src.length; i++) {
+      if (src[i] === '{') depth++;
+      else if (src[i] === '}' && --depth === 0) return src.slice(start, i + 1).replace(/\r\n/g, '\n').split('\n').map((l) => l.trim()).join('\n');
+    }
+    throw new Error('unbalanced');
+  };
+  const server = fnText(fs.readFileSync(path.join(ROOT, 'modules', 'provisioning', 'look.js'), 'utf8'));
+  const client = fnText(fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8'));
+  assert.equal(client, server, 'edit both copies together (ADR 0358 D4)');
+});
+
+console.log('\nA logo is screened by its bytes:');
+
+const PNG = Buffer.concat([Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]), Buffer.alloc(40, 1)]);
+const JPG = Buffer.concat([Buffer.from([0xff, 0xd8, 0xff, 0xe0]), Buffer.alloc(40, 2)]);
+const WEBP = Buffer.concat([Buffer.from('RIFF'), Buffer.from([0, 0, 0, 0]), Buffer.from('WEBP'), Buffer.alloc(40, 3)]);
+const SVG = Buffer.from('<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script></svg>');
+
+await ta('PNG, JPEG and WebP pass, each named by its own magic number and hashed', async () => {
+  for (const [buf, type, ext] of [[PNG, 'image/png', 'png'], [JPG, 'image/jpeg', 'jpg'], [WEBP, 'image/webp', 'webp']]) {
+    const r = look.screenLogo(buf, type);
+    assert.equal(r.ok, true, type);
+    assert.equal(r.ext, ext);
+    assert.match(r.sha, /^[0-9a-f]{64}$/);
+  }
+});
+
+await ta('SVG is refused whatever it claims to be, and so is a renamed file, an empty one and an oversized one', async () => {
+  assert.equal(look.screenLogo(SVG, 'image/svg+xml').reason, 'bad_type');
+  assert.equal(look.screenLogo(SVG, 'image/png').reason, 'sniff_mismatch', 'an SVG labelled PNG');
+  assert.equal(look.screenLogo(JPG, 'image/png').reason, 'sniff_mismatch', 'a JPEG labelled PNG');
+  assert.equal(look.screenLogo(Buffer.alloc(0), 'image/png').reason, 'empty');
+  const big = Buffer.concat([PNG, Buffer.alloc(look.LOGO_MAX_BYTES)]);
+  assert.equal(look.screenLogo(big, 'image/png').reason, 'too_big');
+  assert.equal(look.screenLogo(Buffer.concat([PNG.subarray(0, 8), Buffer.alloc(look.LOGO_MAX_BYTES - 8)]), 'image/png').ok, true, 'exactly the cap passes');
+});
+
+// ── the routes, over a real mounted router ───────────────────────────────────
+let instance = null;
+let stored = [];
+let events = [];
+let enqueued = [];
+let logos = new Map();
+provisioning.getInstanceById = async (_db, id) => (instance ? { ...instance, id } : null);
+provisioning.updateInstanceSettings = async (_db, id, patch) => {
+  stored.push(patch);
+  instance = { ...instance, settings: { ...(instance.settings || {}), ...patch } };
+  return { ...instance, id };
+};
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+provisioning.enqueueSettingsApply = async (_db, id, by) => { enqueued.push({ id, by }); return { intent: { id: 3, action: 'settings-apply', state: 'pending' }, created: true }; };
+provisioning.recordSettingsPushOwed = async () => {};
+look.upsertLogo = async (_db, id, s, buf) => { logos.set(id, { sha: s.sha, ext: s.ext, mime: s.mime, bytes: buf }); };
+look.deleteLogo = async (_db, id) => { logos.delete(id); };
+look.readLogo = async (_db, sha, ext) => [...logos.values()].find((l) => l.sha === sha && l.ext === ext) || null;
+
+const api = require('../src/module-api.js');
+let builder = null;
+api.requireBuilder = (req, _res, next) => { req.builder = builder; next(); };
+api.logger = () => ({ error() {}, warn() {}, info() {}, debug() {} });
+api.branding = () => ({ domains: { publicOrigin: 'https://platform.test' } });
+
+const express = require('express');
+const buildRouter = require('../modules/provisioning/routes/look.js');
+const app = express();
+app.use((req, res, next) => (/\/logo$/.test(req.path) ? next() : express.json()(req, res, next)));
+app.use((_req, res, next) => {
+  res.fail = (code, opts) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', buildRouter());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function call(method, p, body) {
+  return new Promise((resolve, reject) => {
+    const payload = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${p}`, { method, headers: payload ? { 'Content-Type': 'application/json' } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const raw = Buffer.concat(chunks);
+        let j = null; try { j = JSON.parse(raw.toString('utf8')); } catch { /* binary */ }
+        resolve({ status: res.statusCode, body: j, raw, headers: res.headers });
+      });
+    });
+    req.on('error', reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+const OWNER = { id: 7, rank: 'thetes' };
+function reset(patch = {}) {
+  instance = { owner_builder_id: 7, slug: 'kestrel', status: 'active', hosting_shape: 'cloud-host', settings: {}, ...patch };
+  stored = []; events = []; enqueued = []; logos = new Map(); builder = OWNER;
+}
+
+console.log('\nThe routes:');
+
+await ta("another builder's project is a 404 on every route, and nothing is written", async () => {
+  reset();
+  builder = { id: 99, rank: 'metic' };
+  for (const [m, p, b] of [['GET', '/provisioning/instances/5/look'], ['PATCH', '/provisioning/instances/5/look', { look: 'grove' }],
+    ['PUT', '/provisioning/instances/5/logo', { image_b64: PNG.toString('base64'), content_type: 'image/png' }], ['DELETE', '/provisioning/instances/5/logo']]) {
+    const r = await call(m, p, b);
+    assert.equal(r.status, 404, `${m} ${p}`);
+  }
+  assert.equal(stored.length + enqueued.length + logos.size, 0);
+});
+
+await ta('a library look on a live project is stored, audited and pushed with a restart', async () => {
+  reset();
+  const r = await call('PATCH', '/provisioning/instances/5/look', { look: 'grove', night_tint: 'off' });
+  assert.equal(r.status, 200, r.raw.toString());
+  assert.deepEqual(stored, [{ look: 'grove', night_tint: 'off' }]);
+  assert.equal(r.body.look.look, 'grove');
+  assert.equal(r.body.look.night_tint, 'off');
+  assert.equal(r.body.push.restart, true);
+  assert.equal(enqueued.length, 1, 'the settings-apply intent is queued');
+  assert.equal(events[0].actor, 'api:self');
+  assert.equal(r.body.adjusted, null);
+});
+
+await ta('a custom accent is stored ADJUSTED, and the reply names both colours', async () => {
+  reset();
+  const r = await call('PATCH', '/provisioning/instances/5/look', { look: 'custom', accent: '#1A2B3C' });
+  assert.equal(r.status, 200, r.raw.toString());
+  const kept = look.lookAdjustAccent('#1a2b3c').hex;
+  assert.deepEqual(stored[0], { look: 'custom', look_accent: kept });
+  assert.deepEqual(r.body.adjusted, { from: '#1a2b3c', to: kept });
+  assert.equal(r.body.look.look_accent, kept);
+  assert.deepEqual(readsEverywhere(kept), []);
+});
+
+await ta('a custom look with no accent anywhere is refused; one already stored is enough', async () => {
+  reset();
+  let r = await call('PATCH', '/provisioning/instances/5/look', { look: 'custom' });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error.code, 'accent_required');
+  assert.equal(stored.length, 0);
+  reset({ settings: { look_accent: '#b48cf2' } });
+  r = await call('PATCH', '/provisioning/instances/5/look', { look: 'custom' });
+  assert.equal(r.status, 200, r.raw.toString());
+});
+
+await ta('an accent that is not a colour, an unknown look and an empty body are 400s', async () => {
+  reset();
+  assert.equal((await call('PATCH', '/provisioning/instances/5/look', { look: 'custom', accent: 'tomato' })).body.error.code, 'bad_accent');
+  assert.equal((await call('PATCH', '/provisioning/instances/5/look', { look: 'neon' })).status, 400);
+  assert.equal((await call('PATCH', '/provisioning/instances/5/look', {})).body.error.code, 'bad_look');
+  assert.equal(stored.length, 0);
+});
+
+await ta('the same look re-sent writes nothing and restarts nothing', async () => {
+  reset({ settings: { look: 'grove' } });
+  const r = await call('PATCH', '/provisioning/instances/5/look', { look: 'grove' });
+  assert.equal(r.status, 200);
+  assert.equal(stored.length, 0);
+  assert.equal(enqueued.length, 0);
+  assert.match(r.body.push.message, /No change/);
+});
+
+await ta('a project still standing up stores the look and takes it at standup — no restart queued', async () => {
+  reset({ status: 'provisioning' });
+  const r = await call('PATCH', '/provisioning/instances/5/look', { look: 'blueprint' });
+  assert.equal(r.status, 200);
+  assert.equal(enqueued.length, 0);
+  assert.match(r.body.push.message, /finishes standing up/);
+});
+
+await ta('a logo is stored, the hall is told its https address, and the public read serves it as an image only', async () => {
+  reset();
+  const r = await call('PUT', '/provisioning/instances/5/logo', { image_b64: PNG.toString('base64'), content_type: 'image/png' });
+  assert.equal(r.status, 200, r.raw.toString());
+  const { sha } = look.screenLogo(PNG, 'image/png');
+  const url = `https://platform.test/api/bongos/provisioning/logos/${sha}.png`;
+  assert.equal(r.body.look.logo_url, url);
+  assert.equal(enqueued.length, 1);
+  const g = await call('GET', `/provisioning/logos/${sha}.png`);
+  assert.equal(g.status, 200);
+  assert.equal(g.headers['content-type'], 'image/png');
+  assert.equal(g.headers['x-content-type-options'], 'nosniff');
+  assert.match(g.headers['content-security-policy'], /sandbox/);
+  assert.match(g.headers['cache-control'], /immutable/);
+  assert.ok(g.raw.equals(PNG), 'the bytes come back as stored');
+});
+
+await ta('an SVG logo is refused and nothing is stored', async () => {
+  reset();
+  const r = await call('PUT', '/provisioning/instances/5/logo', { image_b64: SVG.toString('base64'), content_type: 'image/svg+xml' });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error.code, 'logo_bad_type');
+  assert.equal(logos.size + stored.length, 0);
+});
+
+await ta('removing the logo empties the address and pushes it', async () => {
+  reset({ settings: { logo_url: 'https://platform.test/api/bongos/provisioning/logos/x.png' } });
+  logos.set(5, { sha: 'x', ext: 'png', bytes: PNG });
+  const r = await call('DELETE', '/provisioning/instances/5/logo');
+  assert.equal(r.status, 200, r.raw.toString());
+  assert.deepEqual(stored, [{ logo_url: '' }]);
+  assert.equal(r.body.look.logo_url, null);
+  assert.equal(logos.size, 0);
+});
+
+await ta('the public read answers only a content-addressed name', async () => {
+  reset();
+  for (const name of ['5.png', '../etc/passwd', `${'a'.repeat(64)}.svg`, `${'a'.repeat(64)}.png`]) {
+    assert.equal((await call('GET', `/provisioning/logos/${encodeURIComponent(name)}`)).status, 404, name);
+  }
+});
+
+server.close();
+console.log(`\nprovisioning_look: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/provisioning_settings.mjs

@@ -164,7 +164,7 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
   reset();
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
   // the planet rides beside the settings (task 1003347): no default — null = the platform's own pick
   assert.deepEqual(r.body.planet, { planet_template: null, planet_accent: null, card_backdrop: null });
   assert.deepEqual(r.body.options, {
@@ -183,6 +183,9 @@ await ta('owner reads DEFAULTS (public / apply) on a row with empty settings —
     // policy axis, offered to the form like the rest. What makes it different is
     // its CONSEQUENCE: it is the only setting that can refuse a module outright.
     spend_payer: ['none', 'project', 'builder'],
+    // the look a hall wears and its night tint (task 1004421, ADR 0358) — policy
+    // axes like the rest: they ride web.env and a restart applies them
+    look: ['own', 'chrome-world', 'expedition', 'grove', 'blueprint', 'custom'], night_tint: ['on', 'off'],
     planet_template: [...provisioning.PLANET_TEMPLATES], planet_accent: ['sea', 'terracotta', 'gold-soft', 'sun-lit', 'accent'],
     // the card's backdrop (task 1003352) is the same kind of key: platform-drawn,
     // closed list, no default, no push — so it rides the same vocab
@@ -195,14 +198,14 @@ await ta('a stored planet reads back; a name that left the vocabulary reads null
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: null, card_backdrop: null });
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the planet is not a setting: the policy read is untouched');
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'the planet is not a setting: the policy read is untouched');
 });
 
 await ta('stored keys overlay the defaults', async () => {
   reset({ inst: { owner_builder_id: 7, slug: 'spike', status: 'active', settings: { joinability: 'invite_only' } } });
   const r = await get('/provisioning/instances/18/settings');
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(r.body.settings, { platform_visibility: 'public', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
 });
 
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
@@ -230,7 +233,7 @@ await ta('owner changes one key — merged, returned effective, audited api:self
   reset();
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'the SAVED value — the response never claims the instance runs it (task 1003140)');
   assert.equal(r.body.push.queued, true, 'an active co-tenant gets the live push (task 1003140)');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { joinability: 'open' } }], 'exactly the sent key, nothing else');
   assert.equal(events.length, 1);
@@ -243,7 +246,7 @@ await ta('owner changes both keys in one call', async () => {
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'invite_only' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'invite_only', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
 });
 
 await ta('the OWN-SCOPE WALL: another builder\'s PATCH → 404 and the write path is never reached', async () => {
@@ -282,7 +285,7 @@ await ta('the owner sets the door to stealth — stored, echoed effective, audit
   reset();
   const r = await patch('/provisioning/instances/18/settings', { visibility: 'stealth' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'stealth', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
   assert.deepEqual(updateCalls, [{ id: 18, patch: { visibility: 'stealth' } }], 'exactly the sent key, nothing else');
   assert.equal(events[0].actor, 'api:self');
   assert.match(events[0].detail, /visibility=stealth/);
@@ -342,7 +345,7 @@ await ta('the owner picks a planet: saved, echoed as `planet`, audited — and N
   const r = await patch('/provisioning/instances/18/settings', { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' });
   assert.equal(r.status, 200, r.raw);
   assert.deepEqual(r.body.planet, { planet_template: 'bead-obsidian-tint', planet_accent: 'sea', card_backdrop: null });
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the policy half is untouched');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'the policy half is untouched');
   assert.deepEqual(updateCalls, [{ id: 18, patch: { planet_template: 'bead-obsidian-tint', planet_accent: 'sea' } }]);
   assert.equal(r.body.push.queued, false);
   assert.equal(r.body.push.restart, false, 'an active co-tenant would get a push for a POLICY change — never for the planet');

package/tests/provisioning_settings_apply.mjs

@@ -272,7 +272,7 @@ await ta('ACTIVE cloud-host: the row is written FIRST, then a settings-apply int
   reset();
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'apply', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' }, 'the SAVED (requested) value — never `settings`, which a form would render as live');
   assert.equal(r.body.settings, undefined);
   assert.deepEqual(updateCalls.map((c) => c.patch), [{ platform_visibility: 'gated' }]);
   assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the runner reads the row — the write must precede the intent');
@@ -335,7 +335,7 @@ await ta('an enqueue that THROWS still answers 200 "saved" — never a 500 that
   enqueueThrows = new Error('db down');
   const r = await patch('/provisioning/instances/18/settings', { joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'public', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
   assert.equal(updateCalls.length, 1, 'the write landed');
   receiptShape(r.body.push, { queued: false, restart: true, reachable: true });
   assert.match(r.body.push.message, /Saved, but the restart could not be queued/);
@@ -348,7 +348,7 @@ await ta('same values as already stored → no write, no event, no intent, "No c
   reset({ inst: { ...ACTIVE, settings: { platform_visibility: 'gated', joinability: 'open' } } });
   const r = await patch('/provisioning/instances/18/settings', { platform_visibility: 'gated', joinability: 'open' });
   assert.equal(r.status, 200, r.raw);
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' });
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' });
   assert.equal(updateCalls.length, 0, 'nothing written (no updated_at reshuffle)');
   assert.equal(events.length, 0, 'no "settings changed" event for a change that is not one');
   assert.equal(enqueueCalls.length, 0, 'a whole-form save must not bounce a live project');
@@ -479,7 +479,7 @@ await ta('save A queues → save B 409s while A RUNS → A settles → the UNCHA
   assert.equal(enqueueCalls.length, enqueuedBefore + 1, 'exactly one new intent');
   assert.equal(updateCalls.length, writesBefore, 'nothing re-written — the value was already stored in step 2');
   assert.deepEqual(owedCalls[owedCalls.length - 1], { id: 18, owed: false }, 'and the debt is settled');
-  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none' },
+  assert.deepEqual(r.body.saved, { platform_visibility: 'gated', joinability: 'open', visibility: 'public', join_grant: 'full', artist_gate: 'strict', spend_payer: 'none', look: 'own', night_tint: 'on' },
     'the value that finally ships is the one the owner saved');
 });
 

package/tests/provisioning_settings_env.mjs

@@ -121,6 +121,9 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
     // transport because src/modules.js reads it at CONFIG LOAD, which means the
     // instance must already have it in web.env before the first require.
     CLOUDBONGOS_SPEND_PAYER: 'none',
+    // The look and its night tint (ADR 0358, task 1004421), with their two companions:
+    // a custom look's accent and the logo address, empty when there is none.
+    CLOUDBONGOS_LOOK: 'own', CLOUDBONGOS_NIGHT_TINT: 'on', CLOUDBONGOS_LOOK_ACCENT: '', CLOUDBONGOS_LOGO_URL: '',
   });
   // varsOf splits on '=', so an empty value reads as '' on both sides — the point
   // of the comparison is that the standup lines carry exactly the same key set.
@@ -128,6 +131,7 @@ t('settingsEnvVars is the single source both legs derive from — same keys, sam
   assert.deepEqual(provisioning.settingsEnvVars({}, 'X'), {
     X_PLATFORM_VISIBILITY: 'public', X_JOINABILITY: 'apply', X_VISIBILITY: 'public', X_JOIN_GRANT: 'full',
     X_ARTIST_GATE: 'strict', X_ARTIST_GATE_SINCE: '', X_SPEND_PAYER: 'none',
+    X_LOOK: 'own', X_NIGHT_TINT: 'on', X_LOOK_ACCENT: '', X_LOGO_URL: '',
   }, 'defaults, explicitly');
 });
 

package/tests/wizard_draft_resume.mjs

@@ -90,9 +90,9 @@ test('post-auth: the real step is rendered', () => {
 
 test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
   assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
-  // 11 is the done panel (9 before task 1004417's front door, 8 before task 1004351), reached by its own branch
+  // 12 is the done panel (11 before task 1004421's Look step, 9 before task 1004417's front door, 8 before task 1004351), reached by its own branch
   // above this slice; 0 is the gate. Neither is a resumable wizard position, so the placeholder is allowed to stand.
-  for (const bad of [0, 11, 99]) {
+  for (const bad of [0, 12, 99]) {
     assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
   }
 });

package/tests/wizard_front_door.mjs

@@ -53,7 +53,7 @@ test('the front door stands between sign-in and the name step: gate 0, terms 1,
 
 test('the rail is the numbered steps\' — it steps aside on both front-door screens, statically too', () => {
   const beats = [...HUB.matchAll(/<li[^>]*data-step="(\d+)"/g)].map((m) => Number(m[1]));
-  assert.deepEqual(beats, [3, 4, 5, 6, 7, 8, 9, 10], 'the rail numbers name…create, never the front door');
+  assert.deepEqual(beats, [3, 4, 5, 6, 7, 8, 9, 10, 11], 'the rail numbers name…create, never the front door');
   assert.match(HUB, /<div class="card wizFront">/, 'a no-script visitor on the static first screen sees no rail');
   assert.match(STYLE, /#view-new \.card\.wizFront \.steps\{display:none;\}/);
 });
@@ -250,7 +250,7 @@ test('the create carries the tick, and is never filed without it', () => {
 test('the tick is part of the draft and of the reset, and the draft key moved with the renumbering', () => {
   assert.match(SCRIPT, /var state = \{ step: 0,[^}]*termsAck: false \};/, 'the initial state declares it');
   assert.match(SCRIPT, /state = \{ step: 1,[^}]*termsAck: false \};/, 'and "start another project" clears it — each project records its own');
-  assert.match(SCRIPT, /var DRAFT_KEY = 'cb-create-draft-v6';/, 'a draft saved under the old numbering is ignored, not replayed onto the wrong screen');
+  assert.match(SCRIPT, /var DRAFT_KEY = 'cb-create-draft-v7';/, 'a draft saved under the old numbering is ignored, not replayed onto the wrong screen');
 });
 
 // ── the look-before-you-ship kit walks it ─────────────────────────────────────

package/tests/wizard_intent_resume.mjs

@@ -15,12 +15,12 @@
 // ruled out the task's other option (drop the record at a terminal state).
 //
 // The reset fires only when there is a SECOND DRAFT to lose, and the draft's own step is
-// what says so. A landed create clears DRAFT_KEY — but show(11) then persists the done
+// what says so. A landed create clears DRAFT_KEY — but show(12) then persists the done
 // panel's position straight back into it, so a plain "is there a draft?" test is always
 // yes and would skip the reset forever, leaving the finished project's name sitting in
 // the fresh form. (That is exactly what the first cut of this change shipped into a
 // render: "still watching Mercury" above a name field still reading "Mercury".) Only
-// steps 1-10 are wizard steps (1-8 before task 1004417's front door took 1 and 2);
+// steps 1-11 are wizard steps (1-10 before task 1004421's Look step, 1-8 before task 1004417's front door took 1 and 2);
 // anything else is the done panel's own bookkeeping.
 //
 // Harness: there is no jsdom in this repo, so this follows tests/wizard_draft_resume.mjs
@@ -58,8 +58,8 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
   assert.ok(offerSlice, 'paintResumeOffer() was not found in projects.html');
   assert.match(enterSlice, /if \(focus && !resumeIntent\) \{/, 'the intent branch is part of the slice');
   assert.match(enterSlice, /startProgress\(created\.id\);/, 'so is the resume branch it guards');
-  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 10/,
-    'the STORED draft\'s step decides, not state.step — state.step is 11 for the whole life of a finished standup');
+  assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 11/,
+    'the STORED draft\'s step decides, not state.step — state.step is 12 for the whole life of a finished standup');
   assert.match(SCRIPT, /if \(created && created\.id\) \{ enterCreated\(created, !!focus\); return; \}/,
     'enter() still hands the created record straight to it');
 });
@@ -73,7 +73,7 @@ function runEnter({ focus, resumeIntent = false, draft = null, record }) {
   const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0 };
   // state.step is the DONE step for the whole life of a finished standup — the value
   // a draft-blind reading would have trusted
-  const state = { step: draft ? draft.step : 11, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
+  const state = { step: draft ? draft.step : 12, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
   const sandbox = {
     record, focus, resumeIntent, state,
     DRAFT_KEY: 'draft',
@@ -99,7 +99,7 @@ const REC = { id: 'inst-1', name: 'Acme', slug: 'acme', domain: 'acme.example',
 
 test('a reload / Back / identity settle (focus false) still resumes the done panel, watch and all', () => {
   const { calls, state } = runEnter({ focus: false, record: REC });
-  assert.deepEqual(calls.show, [[11, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
+  assert.deepEqual(calls.show, [[12, false]], 'the done panel, and no focus steal on a non-deliberate arrival');
   assert.equal(calls.resets, 0, 'nothing is reset — this is the same standup continuing');
   assert.equal(calls.done, 1, 'the checklist is re-rendered');
   assert.deepEqual(calls.progress, ['inst-1'], 'the progress watch is restarted from the record');
@@ -127,7 +127,7 @@ test('…and the standup stays one click away, named, on the resume link', () =>
 
 test('the resume link gets the done panel back — the record was never cleared', () => {
   const { calls, sandbox } = runEnter({ focus: true, resumeIntent: true, record: REC });
-  assert.deepEqual(calls.show, [[11, true]], 'a deliberate resume moves focus to the done panel');
+  assert.deepEqual(calls.show, [[12, true]], 'a deliberate resume moves focus to the done panel');
   assert.deepEqual(calls.progress, ['inst-1'], 'the watch comes back with it');
   assert.equal(sandbox.resumeIntent, false, 'the flag is ONE-SHOT — the next plain nav click must mean "new" again');
   assert.deepEqual(calls.offer, [null], 'and the offer comes down behind it');
@@ -145,20 +145,21 @@ test('a second draft already under way is NOT wiped by navigating back to the wi
 });
 
 test('the done panel\'s own saved step is NOT a second draft — it must not block the reset', () => {
-  // Caught in a render, not in a unit test: show(11) calls saveDraft(), so DRAFT_KEY is
+  // Caught in a render, not in a unit test: show(12) calls saveDraft(), so DRAFT_KEY is
   // non-empty again the moment a create lands. Reading "is there a draft?" left the
   // finished project's name in the fresh form, under a line offering to resume it.
-  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 11, name: 'Mercury' } });
+  const { calls, state } = runEnter({ focus: true, record: REC, draft: { step: 12, name: 'Mercury' } });
   assert.equal(calls.resets, 1, 'the done step is bookkeeping, not a project being typed');
   assert.deepEqual(calls.show, [[1, false]], 'out-of-range steps land on step 1, the front door');
   assert.equal(state.name, '', 'and the finished project\'s name does not survive into it');
   assert.equal(calls.done, 0, 'never back onto the done panel');
 });
 
-test('a draft on the app step or the review is live too — the last two numbered steps (task 1004351)', () => {
-  // The app step moved the review from 7 to 8, and the front door (task 1004417) to 10. A
-  // guard left behind would reset a second project sitting on its review, silently wiping it.
-  for (const step of [9, 10]) {
+test('a draft on the app step, the Look step or the review is live too — the last three numbered steps (task 1004351)', () => {
+  // The app step moved the review from 7 to 8, the front door (task 1004417) to 10 and the
+  // Look step (task 1004421) to 11. A guard left behind would reset a second project
+  // sitting on its review, silently wiping it.
+  for (const step of [9, 10, 11]) {
     const { calls, state } = runEnter({ focus: true, record: REC, draft: { step } });
     assert.equal(calls.resets, 0, `step ${step} is a live draft`);
     assert.deepEqual(calls.show, [[step, true]]);
@@ -174,8 +175,8 @@ test('a draft on the front door is live too — a founder part-way through it ke
   }
 });
 
-test('a draft whose step is missing or junk resets too — only 1-10 preserves anything', () => {
-  for (const draft of [{ step: 0 }, { step: 11 }, { name: 'half-typed' }]) {
+test('a draft whose step is missing or junk resets too — only 1-11 preserves anything', () => {
+  for (const draft of [{ step: 0 }, { step: 12 }, { name: 'half-typed' }]) {
     const { calls } = runEnter({ focus: true, record: REC, draft });
     assert.equal(calls.resets, 1, `step ${JSON.stringify(draft.step)} is not a wizard step`);
     assert.deepEqual(calls.show, [[1, false]]);