@bongos/core 1.21.175 → 1.21.176

package/tests/provisioning_capacity.mjs

@@ -2,7 +2,7 @@
 //
 // The box-capacity ceiling (ADR 0285, task 1003927): the shared arithmetic in
 // modules/provisioning/capacity.js, the runner preflight in
-// scripts/gds/provision-capacity.js, its composition into provisionInstance and
+// scripts/bongos/provision-capacity.js, its composition into provisionInstance and
 // the drain loop, and the `capacity` block on GET /provisioning/fleet.
 //
 // Before this, nothing enforced the ceiling the ADR measured: the runner stood up
@@ -22,10 +22,10 @@ import capacityDefault, {
   DEFAULT_CEILING, DEFAULT_MEM_FLOOR_MB, PLACED_STATES,
   parseMeminfo, placementBox, ceilingFor, placementVerdict, capacitySummary, countPlaced, fleetCapacity,
 } from '../modules/provisioning/capacity.js';
-import { MEMINFO_CMD, capacityPreflight, statusCapacityLine } from '../scripts/gds/provision-capacity.js';
+import { MEMINFO_CMD, capacityPreflight, statusCapacityLine } from '../scripts/bongos/provision-capacity.js';
 
 const require = createRequire(import.meta.url);
-const P = require('../scripts/gds/provision.js');
+const P = require('../scripts/bongos/provision.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -151,7 +151,7 @@ await ta('fleetCapacity (the API + CLI summary) measures THIS host and counts th
   delete process.env.PROVISION_BOX_CEILING;
 });
 
-console.log('\nthe runner preflight (scripts/gds/provision-capacity.js):');
+console.log('\nthe runner preflight (scripts/bongos/provision-capacity.js):');
 
 const cloudHost = { id: 7, slug: 'lantern', hosting_shape: 'cloud-host', status: 'requested', owner_builder_id: 3, port: null, db_name: 'lantern', domain: null };
 
@@ -210,7 +210,7 @@ await ta('at 80% it still places, but the log names the resize trigger', async (
 });
 
 await ta('a co-tenant under remote-exec is measured on the BOX executor against the overflow base (41 on 4 GB)', async () => {
-  const { CONFIG } = require('../scripts/gds/provision-config.js');
+  const { CONFIG } = require('../scripts/bongos/provision-config.js');
   const prior = CONFIG.remoteHost;
   CONFIG.remoteHost = 'cohost';
   try {

package/tests/provisioning_credential_preflight.mjs

@@ -133,7 +133,7 @@ await ta('GitHub unreachable → ADMITTED, matching the runner: an outage must n
 // ── the parse must not drift from the runner's ──────────────────────────────────
 
 await ta('parseTargetRef accepts every form the runner accepts, and rejects what it rejects', async () => {
-  // A divergence from scripts/gds/provision-repo.js parseTargetRef would be silent: this
+  // A divergence from scripts/bongos/provision-repo.js parseTargetRef would be silent: this
   // would admit refs the runner cannot parse, or refuse ones it can.
   for (const ref of ['octo-owner/demo', 'git@github.com:octo-owner/demo.git', 'https://github.com/octo-owner/demo', 'https://github.com/octo-owner/demo.git']) {
     assert.deepEqual(parseTargetRef(ref), { owner: 'octo-owner', name: 'demo' }, `should parse ${ref}`);

package/tests/provisioning_disconnect.mjs

@@ -5,7 +5,7 @@
 // "Take it offline" only tears a project down: the database, backups and address stay
 // reserved (ADR 0181). The owner asked for a separate, truer delete. The web tier's half
 // is the same shape as every other provisioning action — it only ENQUEUES; the runner does
-// the destruction (scripts/gds/provision-disconnect.js, tests/provision_disconnect.mjs).
+// the destruction (scripts/bongos/provision-disconnect.js, tests/provision_disconnect.mjs).
 //
 // What these tests pin:
 //   • the schema: a 'disconnect' intent action, admitted by migration provisioning_016,

package/tests/provisioning_error_note_scope.mjs

@@ -23,7 +23,7 @@ import { makeRunner } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const P = require('../scripts/gds/provision.js');
+const P = require('../scripts/bongos/provision.js');
 const { clearErrorNote, ownsErrorNote } = require('../modules/provisioning/error-note.js');
 const provisioning = require('../modules/provisioning/provisioning.js');
 
@@ -133,9 +133,9 @@ await test('provisioning.js re-exports both from error-note.js', () => {
 
 await test('each success leg clears with its OWN action, and no unscoped clear is left', () => {
   const want = {
-    'scripts/gds/provision.js': ['domain-attach', 'settings-apply', 'restart'],
-    'scripts/gds/provision-core-upgrade.js': ['core-upgrade'],
-    'scripts/gds/provision-repo-private.js': ['repo-private'],
+    'scripts/bongos/provision.js': ['domain-attach', 'settings-apply', 'restart'],
+    'scripts/bongos/provision-core-upgrade.js': ['core-upgrade'],
+    'scripts/bongos/provision-repo-private.js': ['repo-private'],
   };
   for (const [file, actions] of Object.entries(want)) {
     const src = readFileSync(path.join(ROOT, file), 'utf8');

package/tests/provisioning_paid_shape_gate.mjs

@@ -4,7 +4,7 @@
 //
 // Before this, the create route's only gate was requireBuilder, and `hosting_shape` was
 // caller-supplied and validated only against the allowed set. `dedicated` was then the ONE
-// shape whose runner leg created a real DigitalOcean droplet (scripts/gds/provision.js —
+// shape whose runner leg created a real DigitalOcean droplet (scripts/bongos/provision.js —
 // billed monthly, defaulting to s-2vcpu-4gb), so any authenticated builder — a Xenos
 // included — could queue recurring infrastructure spend the owner never approved. The route
 // that SPENDS was less gated than force-teardown, which stops spending and sits behind
@@ -263,7 +263,7 @@ await ta('control-plane: still refused for a builder holding EVERY permission',
   // `core-upgrade.js` picks the self row with `WHERE hosting_shape = 'control-plane'
   // LIMIT 1` — so a second row makes "which machine is the control plane" a question
   // with a caller-influenced answer. No rank makes that a coherent request; the self
-  // row is enrolled by scripts/gds/enroll-control-plane.js.
+  // row is enrolled by scripts/bongos/enroll-control-plane.js.
   held = ['provisioning.fleet.manage'];
   lastCreateArgs = null;
   const res = await post('/provisioning/instances', { slug: 'demo', hosting_shape: 'control-plane', no_address: true });

package/tests/provisioning_planet_physics.mjs

@@ -64,6 +64,9 @@ await t('every enumerated question has a closed answer list, and every count a r
     if (q.kind === 'count') {
       assert.ok(Number.isInteger(q.min) && q.max > q.min, `${key} has a range`);
       assert.ok(!(key in provisioning.PROJECT_DETAIL_VOCAB), `${key} has no answer list to offer`);
+    } else if (q.kind === 'text') {
+      assert.ok(q.max > 0, `${key} has a length ceiling`);
+      assert.ok(!(key in provisioning.PROJECT_DETAIL_VOCAB), `${key} has no answer list to offer`);
     } else {
       assert.ok(['one', 'many'].includes(q.kind), `${key} is a known kind`);
       assert.ok(Array.isArray(q.values) && q.values.length, `${key} has a closed list`);
@@ -117,6 +120,19 @@ await t('badProjectDetail refuses every kind of wrong answer LOUDLY, naming the
   assert.equal(badProjectDetail(KESTREL), null, 'the canvas sample is clean');
 });
 
+await t('the group owner and its free-text kind: stored trimmed, refused empty, over-long or with control characters, un-answered by null', () => {
+  assert.equal(badProjectDetail({ entity: 'intent-group', entity_group_type: '  A book club  ' }), null);
+  assert.deepEqual(provisioning.normalizeProjectDetail({ entity: 'intent-group', entity_group_type: '  A book club  ' }),
+    { entity: 'intent-group', entity_group_type: 'A book club' }, 'trimmed on the way in');
+  for (const bad of ['', '   ', 'x'.repeat(121), 'two\nlines', 'bell\u0007', 42, true]) {
+    const fault = badProjectDetail({ entity_group_type: bad });
+    assert.ok(fault, JSON.stringify(bad) + ' is refused');
+    assert.match(fault.message, /"entity_group_type" must be text of 1 to 120 characters/);
+  }
+  assert.equal(badProjectDetail({ entity_group_type: 'x'.repeat(120) }), null, 'the ceiling itself is allowed');
+  assert.equal(badProjectDetail({ entity_group_type: null }), null, 'null un-answers it');
+});
+
 await t('null un-answers every kind of question — and only null does', () => {
   const nulls = Object.fromEntries(Object.keys(KESTREL).map((k) => [k, null]));
   assert.equal(badProjectDetail(nulls), null, 'null is accepted for every question');

package/tests/provisioning_runner_drift_notice.mjs

@@ -234,7 +234,7 @@ t('the module crosses NO require boundary into core — the checker is a subproc
   }
   const notifySrc = readFileSync(new URL('../modules/provisioning/pollers/runner-drift-notify.js', import.meta.url), 'utf8');
   assert.match(notifySrc, /execFile/, 'the checker is spawned');
-  assert.match(notifySrc, /runner-drift\.js', '--instance-root'|scripts\/gds\/runner-drift\.js/, 'and it is the checker that is spawned');
+  assert.match(notifySrc, /runner-drift\.js', '--instance-root'|scripts\/(?:gds|bongos)\/runner-drift\.js/, 'and it is the checker that is spawned');
 });
 
 t('postNotice is NOT re-exported — the sweep takes it straight from its owner', () => {
@@ -262,7 +262,7 @@ await ta('readRunnerDrift: it spawns the checker with the instance root, from th
   const units = await notify.readRunnerDrift({ instanceRoot: '/srv/instance', execFileImpl });
   assert.deepEqual(units, []);
   assert.equal(seen.cmd, 'node');
-  assert.deepEqual(seen.args, ['scripts/gds/runner-drift.js', '--instance-root', '/srv/instance', '--json']);
+  assert.deepEqual(seen.args, ['scripts/bongos/runner-drift.js', '--instance-root', '/srv/instance', '--json']);
   assert.match(seen.opts.cwd, /cloud-bongos/, 'invoked from the repo root regardless of cwd');
   assert.ok(seen.opts.timeout > 0, 'a hung systemctl costs the check, not the tick');
 });

package/tests/provisioning_settings_env.mjs

@@ -220,7 +220,7 @@ t('the stamp can neither leak as a setting nor be written by a client patch', ()
 console.log('\nwebEnvBody — the settings ride the real per-instance env file:');
 
 t('the runner writes them into web.env alongside PORT and PGDATABASE', () => {
-  const provision = require('../scripts/gds/provision.js');
+  const provision = require('../scripts/bongos/provision.js');
   const body = provision.webEnvBody(
     { slug: 'spike-harbor', port: 3010, db_name: 'spike-harbor', target_ref: 'jaxri/spike-harbor',
       hosting_shape: 'cloud-host', settings: { platform_visibility: 'gated' } }, {});

package/tests/pruned_lockfile_integrity.mjs

@@ -18,7 +18,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { prunePackageLock, CORE_DEP_NAMES } = require('../scripts/gds/package-core.js');
+const { prunePackageLock, CORE_DEP_NAMES } = require('../scripts/bongos/package-core.js');
 const realLock = require('../package-lock.json');
 
 let passed = 0, failed = 0;

package/tests/public_mirror_export.mjs

@@ -19,7 +19,7 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 const X = require('../scripts/public-mirror-export.js');
 const { pickSnapshotCommit, parseLsTree, isBinary, redactBlob, buildProvenance } = X;
-const { buildRedactionRules, collectSensitiveLiterals } = require('../scripts/gds/mirror-redact.js');
+const { buildRedactionRules, collectSensitiveLiterals } = require('../scripts/bongos/mirror-redact.js');
 
 const BRANDING = { domains: { publicOrigin: 'https://widgetco.com' }, repo: { owner: 'zoltan', name: 'widgetco' } };
 const rules = buildRedactionRules(BRANDING);

package/tests/publish_integration_gate.mjs

@@ -21,7 +21,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 const require = createRequire(import.meta.url);
-const gate = require('../scripts/gds/publish-integration-gate.js');
+const gate = require('../scripts/bongos/publish-integration-gate.js');
 const { decideIntegrationGate, waitForIntegration, reportLines, main, runsUrl } = gate;
 
 let passed = 0;
@@ -171,7 +171,7 @@ await test('publish.yml can read the integration runs, and asks about the commit
   assert.doesNotMatch(YML, /actions: write/, 'read only');
   const g = steps[stepIndex(/id: integ\n/)];
   assert.ok(g, 'the integration gate step exists');
-  assert.match(g, /node scripts\/gds\/publish-integration-gate\.js --sha "\$\(git rev-parse HEAD\)"/, 'HEAD — the checkout is ref: main, not the trigger sha');
+  assert.match(g, /node scripts\/(?:gds|bongos)\/publish-integration-gate\.js --sha "\$\(git rev-parse HEAD\)"/, 'HEAD — the checkout is ref: main, not the trigger sha');
   assert.match(g, /GH_TOKEN: \$\{\{ github\.token \}\}/);
 });
 

package/tests/publish_manifest.mjs

@@ -1,7 +1,7 @@
 // tests/publish_manifest.mjs
 //
 // GDS-V4 R71 (task 1210) — locks the Cloud Bongos public-mirror publish boundary
-// (scripts/gds/publish-manifest.js, ADR 0098 / ADR 0065 §4). A silent leak from a
+// (scripts/bongos/publish-manifest.js, ADR 0098 / ADR 0065 §4). A silent leak from a
 // publish boundary is catastrophic, so this guards three things:
 //   1. representative publishable / excluded paths classify correctly,
 //   2. default-deny + deny-wins-over-allow hold,
@@ -25,7 +25,7 @@ import url from 'node:url';
 
 const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
-const m = require('../scripts/gds/publish-manifest.js');
+const m = require('../scripts/bongos/publish-manifest.js');
 const {
   isPublishable,
   matchesDeny,
@@ -49,8 +49,8 @@ function t(name, fn) {
 const PUBLISH = [
   'src/bongos/auth.js',                       // the rank/permission machinery IS the methodology
   'src/bongos/permission-path-check.js',
-  'scripts/gds/ship.js',                   // the ship/grade pipeline publishes (sans secrets)
-  'scripts/gds/publish-manifest.js',
+  'scripts/bongos/ship.js',                   // the ship/grade pipeline publishes (sans secrets)
+  'scripts/bongos/publish-manifest.js',
   'scripts/migrate.sh',
   'migrations/182_some_change.sql',
   'tests/publish_manifest.mjs',
@@ -101,7 +101,7 @@ const EXCLUDE = [
   'src/preview-server.js',
   'server.js',                             // repo-root game+platform entry (top-level require('colyseus')); the core boots via src/platform-server.js (task 2134)
   'scripts/art/orchestrate.js',            // art-feature tooling under scripts/ (legacy location)
-  'scripts/gds/art-stage.js',              // art sandbox-staging CLI (requires modules/art-pipeline); excluded with the art feature (task 2135)
+  'scripts/bongos/art-stage.js',              // art sandbox-staging CLI (requires modules/art-pipeline); excluded with the art feature (task 2135)
   'scripts/tile-add.js',
   // host-feature tests that statically import an excluded module's source: shipped in the
   // core package they'd MODULE_NOT_FOUND; excluded with the feature they cover (task 2147)
@@ -292,7 +292,7 @@ t('no publishable test statically imports an excluded module (R89 boundary)', ()
   for (const name of fs.readdirSync(testsDir)) {
     if (!/\.(mjs|js|cjs)$/.test(name)) continue;
     // Skip self: the regex specimens below are deliberate full import forms;
-    // this file's real imports pull scripts/gds code only, never modules/.
+    // this file's real imports pull scripts/bongos code only, never modules/.
     if (name === 'publish_manifest.mjs') continue;
     const rel = `tests/${name}`;
     const bad = new Set();

package/tests/publish_watch.mjs

@@ -15,7 +15,7 @@ import { shallowCloneReason } from './helpers.mjs';
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(import.meta.dirname, '..');
 
-const pw = require(path.join(ROOT, 'scripts', 'gds', 'publish-watch.js'));
+const pw = require(path.join(ROOT, 'scripts', 'bongos', 'publish-watch.js'));
 
 const REL = (v, iso, sha = 'abcdef1234567890') =>
   `${sha}|${iso}|release: core ${v} — CI auto-patch carrier (publish-on-merge, ADR 0161)`;

package/tests/push_path_brief.mjs

@@ -18,7 +18,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const brief = require('../scripts/gds/push-path-brief.js');
+const brief = require('../scripts/bongos/push-path-brief.js');
 
 let passed = 0, failed = 0;
 function t(name, fn) {
@@ -68,7 +68,7 @@ t('the line is the exported static constant — nothing is interpolated', () =>
 
 const script = path.join(
   path.dirname(fileURLToPath(import.meta.url)),
-  '..', 'scripts', 'gds', 'push-path-brief.js',
+  '..', 'scripts', 'bongos', 'push-path-brief.js',
 );
 function runCli(env) {
   return spawnSync(process.execPath, [script, '--line'], {

package/tests/raise.mjs

@@ -0,0 +1,248 @@
+// tests/raise.mjs — the /raise investor page (task 1004847, ADR 0384).
+//
+// Two altitudes: the pure rules in modules/raise/raise.js (how copy renders and
+// is stored, the raise numbers, the investor password), and the page + its
+// write routes over real HTTP with the db functions replaced on the cached
+// module object (the page_notes.mjs pattern), so the walls — who sees the page,
+// who may write, what a save may touch — are exercised end to end.
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const R = require('../modules/raise/raise.js');
+
+// ---------- pure ----------
+
+test('a block key names its shape', () => {
+  assert.equal(R.kindOf('problem.body'), 'para');
+  assert.equal(R.kindOf('founder.2.bio'), 'para');
+  assert.equal(R.kindOf('beliefs.items'), 'list');
+  assert.equal(R.kindOf('raise.title'), 'line');
+});
+
+test('an edit is stored as clean text: one line for a heading, trimmed lines otherwise', () => {
+  assert.equal(R.normalizeBlock('raise.title', '  The\n Pre-seed Raise '), 'The Pre-seed Raise');
+  assert.equal(R.normalizeBlock('benefits.body', ' One. \r\n\r\n  Two.\n'), 'One.\nTwo.');
+});
+
+test('copy is escaped before anything else, so typed markup stays text', () => {
+  const ctx = R.renderContext({});
+  assert.equal(R.renderBlock('x.body', '<script>alert(1)</script>\nb & c', ctx), '<p>&lt;script&gt;alert(1)&lt;/script&gt;</p><p>b &amp; c</p>');
+  assert.equal(R.renderBlock('x.items', 'a\nb', ctx), '<li>a</li><li>b</li>');
+});
+
+test('{goal} {lead} {runway} show the live numbers as locked pieces, TBA when unset', () => {
+  const live = R.renderInline('raise {goal}, led by {lead}, {runway} years {other}', R.renderContext({ goalUsd: 500000, lead: 'A & B', runwayYears: 2 }));
+  assert.match(live, /data-tok="goal" contenteditable="false">\$500,000</);
+  assert.match(live, /data-tok="lead" contenteditable="false">A &amp; B</);
+  assert.match(live, /data-tok="runway" contenteditable="false">2</);
+  assert.match(live, /\{other\}/, 'an unknown token stays as typed');
+  assert.match(R.renderInline('{goal}', R.renderContext({})), /class="tba">TBA/);
+});
+
+test('[Label] links only to a listed https citation', () => {
+  const ctx = R.renderContext({ citations: { 'Goldman Sachs': 'https://example.com/gs', Bad: 'javascript:alert(1)' } });
+  assert.match(R.renderInline('by 2030 [Goldman Sachs], x', ctx), /<sup class="cite" data-cite="Goldman Sachs" contenteditable="false"><a href="https:\/\/example.com\/gs"/);
+  assert.equal(R.renderInline('[Bad]', ctx), '[Bad]');
+  assert.equal(R.renderInline('[Unknown]', ctx), '[Unknown]');
+});
+
+test('a raise number is cleaned or refused; empty clears it', () => {
+  assert.equal(R.cleanSetting('goalUsd', '$1,500,000'), 1500000);
+  assert.equal(R.cleanSetting('runwayYears', '2.25'), 2.3);
+  assert.equal(R.cleanSetting('lead', '  Acme  '), 'Acme');
+  assert.equal(R.cleanSetting('goalUsd', ''), null);
+  assert.equal(R.cleanSetting('committedUsd', ''), 0);
+  assert.throws(() => R.cleanSetting('goalUsd', 'lots'));
+  assert.throws(() => R.cleanSetting('goalUsd', '-5'));
+  assert.throws(() => R.cleanSetting('instrument', '1'));
+});
+
+test('the investor password is checked against a scrypt hash, and a missing hash lets nobody in', () => {
+  const h = R.hashPassword('open sesame');
+  assert.equal(R.passwordOk('open sesame', h), true);
+  assert.equal(R.passwordOk('open sesame!', h), false);
+  assert.equal(R.passwordOk('open sesame', undefined), false);
+  assert.equal(R.passwordOk('', 'scrypt:zz:zz'), false);
+});
+
+test('the gate wants a real name and a LinkedIn profile link', () => {
+  assert.equal(R.normalizeSignin({ name: '  Ada   Lovelace ', linkedin: 'https://www.linkedin.com/in/ada' }).value.name, 'Ada Lovelace');
+  assert.ok(R.normalizeSignin({ name: 'A', linkedin: 'https://www.linkedin.com/in/ada' }).error);
+  assert.ok(R.normalizeSignin({ name: 'Ada', linkedin: 'https://evil.example/in/ada' }).error);
+});
+
+test('the shipped copy is well-formed: every key renders, Lars\'s text is there verbatim', () => {
+  const copy = R.defaultCopy();
+  const ctx = R.renderContext(R.defaultSettings());
+  for (const [k, v] of Object.entries(copy)) {
+    assert.equal(typeof v, 'string', k);
+    assert.equal(R.normalizeBlock(k, v), v, `${k} is stored in its normalized form`);
+    R.renderBlock(k, v, ctx);
+  }
+  assert.match(copy['problem.body'], /The result is the gamification of capitalism\.$/);
+  assert.match(R.renderBlock('problem.body', copy['problem.body'], ctx), /data-cite="Goldman Sachs"/);
+  assert.equal(R.ndaVersion().length, 12);
+});
+
+test('a founder\'s bio is editable for every founder in settings.json, and no further', () => {
+  const n = R.defaultSettings().founders.length;
+  assert.equal(R.isEditableKey(`founder.${n}.bio`), true);
+  assert.equal(R.isEditableKey(`founder.${n + 1}.bio`), false);
+  assert.equal(R.isEditableKey('founder.0.bio'), false);
+  assert.equal(R.isEditableKey('hero.title'), true);
+  assert.equal(R.isEditableKey('constructor'), false);
+});
+
+test('content notes are explanation, not data', () => {
+  const s = R.defaultSettings();
+  assert.equal('_note' in s, false);
+  assert.equal('_note' in s.instrument, false);
+  assert.equal('_note' in s.videos, false);
+  assert.equal('_note' in R.defaultCopy(), false);
+});
+
+// ---------- the page and its routes ----------
+
+const db = require('../modules/raise/db.js');
+const api = require('../src/module-api.js');
+const store = { signins: [], sessions: new Map(), interest: [], copy: {}, settings: {}, edits: [] };
+db.createSignin = async (row) => { const id = store.signins.length + 1; store.signins.push({ id, ...row }); store.sessions.set(row.tokenHash, id); return id; };
+db.getSession = async (hash) => { const id = store.sessions.get(hash); const s = id && store.signins[id - 1]; return s ? { signin_id: id, name: s.name, linkedin: s.linkedin } : null; };
+db.endSession = async (hash) => { store.sessions.delete(hash); };
+db.recordInterest = async (row) => { store.interest.push(row); };
+db.getCopy = async () => ({ ...store.copy });
+db.getSettings = async () => ({ ...store.settings });
+db.applyEdits = async (_client, { login, copy, settings }) => {
+  for (const c of copy) { if (c.revert) delete store.copy[c.key]; else store.copy[c.key] = c.after; store.edits.push({ login, ...c }); }
+  for (const s of settings) { store.settings[s.key] = s.after; store.edits.push({ ...s, login, key: `settings.${s.key}` }); }
+};
+let viewer = null; // the signed-in builder, or null
+api.requireBuilder = (req, res, next) => { if (!viewer) return res.status(401).json({ error: { code: 'unauthenticated' } }); req.builder = viewer; next(); };
+api.requireRank = () => (req, res, next) => next();
+api.withTx = (fn) => fn({});
+api.resolveSession = async () => (viewer ? { builder_id: viewer.id, github_login: viewer.github_login, rank: viewer.rank, status: 'active' } : null);
+process.env.RAISE_PASSWORD_HASH = R.hashPassword('preseed-test');
+delete process.env.RAISE_DISCORD_WEBHOOK;
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code } });
+  next();
+});
+app.use('/api/bongos', require('../modules/raise/routes/raise.js')());
+const web = api.resolveOptional('raise.web');
+app.use('/raise', (req, res, next) => Promise.resolve(web.handle(req, res, next)).catch(next));
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const origin = `http://127.0.0.1:${server.address().port}`;
+test.after(() => server.close());
+
+const get = (path, cookie) => fetch(origin + path, { headers: cookie ? { cookie } : {}, redirect: 'manual' });
+const enter = (fields) => fetch(origin + '/api/bongos/raise/enter', {
+  method: 'POST', redirect: 'manual',
+  headers: { 'content-type': 'application/x-www-form-urlencoded' },
+  body: new URLSearchParams(fields).toString(),
+});
+const INVESTOR = { name: 'Test Investor', linkedin: 'https://www.linkedin.com/in/test-investor' };
+
+test('a stranger gets the gate, never the copy', async () => {
+  const r = await get('/raise');
+  const html = await r.text();
+  assert.equal(r.status, 200);
+  assert.match(html, /By signing in you accept/);
+  assert.match(html, /Sign in with Bongos/);
+  assert.doesNotMatch(html, /gamification of capitalism/);
+  assert.equal(r.headers.get('x-robots-tag'), 'noindex, nofollow, noarchive');
+  assert.equal((await get('/raise/media/x.mp4')).status, 401);
+  assert.equal((await get('/raise/assets/logo-ink.svg')).status, 200, 'the gate needs its logo');
+  assert.match(await (await get('/raise/nda')).text(), /CONFIDENTIALITY|Confidential/i);
+});
+
+test('a wrong password is refused and the visitor keeps what they typed', async () => {
+  const r = await enter({ ...INVESTOR, password: 'nope' });
+  assert.equal(r.status, 401);
+  const html = await r.text();
+  assert.match(html, /password isn’t right/);
+  assert.match(html, /value="Test Investor"/);
+  assert.equal(store.signins.length, 0);
+});
+
+let investorCookie;
+test('the right password records the NDA acceptance and opens the page', async () => {
+  const r = await enter({ ...INVESTOR, password: 'preseed-test' });
+  assert.equal(r.status, 303);
+  investorCookie = r.headers.get('set-cookie').split(';')[0];
+  assert.match(investorCookie, /^raise_s=[\w-]{20,}$/);
+  assert.equal(store.signins[0].name, 'Test Investor');
+  assert.equal(store.signins[0].ndaVersion, R.ndaVersion());
+  const html = await (await get('/raise', investorCookie)).text();
+  assert.match(html, /gamification of capitalism/);
+  assert.doesNotMatch(html, /data-editbar/, 'an investor gets no edit bar');
+});
+
+test('an investor can say they are interested, and cannot edit', async () => {
+  const ok = await fetch(origin + '/api/bongos/raise/interest', { method: 'POST', headers: { 'content-type': 'application/json', cookie: investorCookie }, body: '{"amount":25000}' });
+  assert.equal(ok.status, 200);
+  assert.equal(store.interest[0].amountUsd, 25000);
+  const anon = await fetch(origin + '/api/bongos/raise/interest', { method: 'POST', headers: { 'content-type': 'application/json' }, body: '{"amount":5}' });
+  assert.equal(anon.status, 401);
+  const edit = await fetch(origin + '/api/bongos/raise/edit', { method: 'POST', headers: { 'content-type': 'application/json', 'x-raise-edit': '1', cookie: investorCookie }, body: '{"copy":{"hero.title":"x"}}' });
+  assert.equal(edit.status, 401);
+});
+
+const save = (body, headers = { 'x-raise-edit': '1' }) => fetch(origin + '/api/bongos/raise/edit', {
+  method: 'POST', headers: { 'content-type': 'application/json', ...headers }, body: JSON.stringify(body),
+});
+
+test('a builder sees the edit bar and saves copy and numbers, each change logged', async () => {
+  viewer = { id: 7, github_login: 'builder7', rank: 'xenos' };
+  try {
+    assert.match(await (await get('/raise')).text(), /data-editbar/);
+    const r = await save({ copy: { 'benefits.body': 'One.\n\nTwo.', 'raise.title': 'The Pre-seed Raise' }, settings: { goalUsd: '750,000' } });
+    assert.deepEqual(await r.json(), { ok: true, changed: 2 }, 'an unchanged block is not a change');
+    assert.equal(store.copy['benefits.body'], 'One.\nTwo.');
+    assert.equal(store.settings.goalUsd, 750000);
+    assert.deepEqual(store.edits.map((e) => [e.login, e.key]), [['builder7', 'benefits.body'], ['builder7', 'settings.goalUsd']]);
+    const html = await (await get('/raise')).text();
+    assert.match(html, /<p>One\.<\/p><p>Two\.<\/p>/);
+    assert.match(html, /\$750,000/);
+    // putting a block back to the shipped text drops the saved row
+    await save({ copy: { 'benefits.body': R.defaultCopy()['benefits.body'] } });
+    assert.equal('benefits.body' in store.copy, false);
+  } finally { viewer = null; }
+});
+
+test('a save is refused without the edit header, for an unknown block, or for a bad number', async () => {
+  viewer = { id: 7, github_login: 'builder7', rank: 'xenos' };
+  try {
+    assert.equal((await save({ copy: { 'hero.title': 'x' } }, {})).status, 400);
+    assert.equal((await save({ copy: { 'evil.key': 'x' } })).status, 400);
+    assert.equal((await save({ settings: { goalUsd: 'lots' } })).status, 400);
+    assert.equal((await save({ settings: { instrument: 'safe' } })).status, 400);
+  } finally { viewer = null; }
+  assert.equal((await save({ copy: { 'hero.title': 'x' } })).status, 401, 'signed out');
+});
+
+test('leaving ends the investor session', async () => {
+  const r = await get('/raise/leave', investorCookie);
+  assert.equal(r.status, 303);
+  assert.doesNotMatch(await (await get('/raise', investorCookie)).text(), /gamification of capitalism/);
+});
+
+test('the wrong-password limit cannot be dodged by claiming a new address each time', async () => {
+  for (let i = 0; i < 10; i++) {
+    const r = await fetch(origin + '/api/bongos/raise/enter', {
+      method: 'POST', redirect: 'manual',
+      headers: { 'content-type': 'application/x-www-form-urlencoded', 'x-real-ip': `10.0.0.${i}`, 'x-forwarded-for': `10.1.0.${i}` },
+      body: new URLSearchParams({ ...INVESTOR, password: 'wrong' }).toString(),
+    });
+    assert.ok([401, 429].includes(r.status), `attempt ${i + 1}`);
+  }
+  // an earlier test already spent one attempt from this address; with every
+  // header above spoofed differently, all ten still counted against it
+  const blocked = await enter({ ...INVESTOR, password: 'preseed-test' });
+  assert.equal(blocked.status, 429, 'the eleventh try from the same real address is paused, right password or not');
+});

package/tests/rank_roles_audit.mjs

@@ -32,7 +32,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { findRanksWithoutRoles, summarize } = require(path.join(ROOT, 'scripts', 'gds', 'audit-rank-roles.js'));
+const { findRanksWithoutRoles, summarize } = require(path.join(ROOT, 'scripts', 'bongos', 'audit-rank-roles.js'));
 const { LIVE_RANK_LADDER } = require(path.join(ROOT, 'src', 'bongos', 'db-kernel.js'));
 
 let passed = 0;

package/tests/rank_tier_single_source.mjs

@@ -36,7 +36,7 @@ const coreDb = require(path.join(ROOT, 'src', 'bongos', 'db.js'));
 const lifecycleDb = require(path.join(ROOT, 'modules', 'lifecycle', 'db.js'));
 const ppc = require(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'));
 const rrc = require(path.join(ROOT, 'src', 'bongos', 'route-rank-check.js'));
-const sequence = require(path.join(ROOT, 'scripts', 'gds', 'sequence.js'));
+const sequence = require(path.join(ROOT, 'scripts', 'bongos', 'sequence.js'));
 const catalog = require(path.join(ROOT, 'modules', 'government', 'catalog.js'));
 
 const LADDER = kernel.LIVE_RANK_LADDER;
@@ -185,7 +185,7 @@ test('hall static tier maps match the kernel map', () => {
 const MAP_ALLOWLIST = new Set([
   'src/bongos/db.js',
   'src/bongos/permission-path-check.js',
-  'scripts/gds/sequence.js',
+  'scripts/bongos/sequence.js',
   'modules/hall-ui/public/builders.js',
   // task 1003206 carved the hall page scripts up. builders.js KEPT its map (the
   // renderers read it through the injected ctx), while goals-page.js's travelled

package/tests/rate_limit_public.mjs

@@ -3,7 +3,7 @@
 // Unit + integration smoke for the public-read rate limiter (red-team #604 /
 // task 1035). The unauthenticated /api/gds/public/* surface had ZERO rate
 // limiting — the global write limiter bypasses reads by design — so the 90-day
-// aggregate endpoints (/public/uptime, /public/repo-health) were a DoS / cost-
+// aggregate endpoint (/public/repo-health) was a DoS / cost-
 // amplification target. publicReadRateLimitMiddleware caps reads at
 // PUBLIC_READ_LIMIT / 60s per IP.
 //

package/tests/read_default_meter.mjs

@@ -78,7 +78,7 @@ function buildRouter() {
   router.use(mod);
   const pub = express.Router();
   pub.use('/public', publicReadRateLimitMiddleware);
-  pub.get('/public/uptime', ok);
+  pub.get('/public/repo-health', ok);
   router.use(pub);
   return { router, guard };
 }
@@ -115,7 +115,7 @@ test('HEAD is metered like GET; a write is not this limiter\'s business', () =>
 test('a route with its own meter is not counted here — nested, prefix-mounted and explicit alike', () => {
   const { guard } = buildRouter();
   const ip = '198.51.100.5';
-  const exempt = ['/own-budget', '/feed', '/probe', '/from-module', '/public/uptime', '/public/anything'];
+  const exempt = ['/own-budget', '/feed', '/probe', '/from-module', '/public/repo-health', '/public/anything'];
   for (let i = 0; i < DEFAULT_READ_LIMIT + 50; i++) {
     for (const p of exempt) assert.equal(hit(guard, 'GET', p, ip).nexted, true, `${p} is not on the ceiling`);
   }

package/tests/read_session_export.mjs

@@ -8,7 +8,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { reduce } = require('../scripts/gds/read-session-export.js');
+const { reduce } = require('../scripts/bongos/read-session-export.js');
 
 let passed = 0, failed = 0;
 const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };

package/tests/rebase_gate_set_aside.mjs

@@ -20,7 +20,7 @@ const { rebaseRequiredHint } = require('../modules/lifecycle/routes/claims.js');
 const { test, summary } = makeRunner();
 
 const row = (id, reason) => ({ id, title: `t${id}`, needs_rebase_reason: reason, needs_rebase_at: null });
-const GUARD = 'strand:branch_modifies_executed_code:.gitattributes,scripts/gds/git-merge-regen.js';
+const GUARD = 'strand:branch_modifies_executed_code:.gitattributes,scripts/bongos/git-merge-regen.js';
 
 await test('a strand parked on a server-side guard is set aside: it never gates', () => {
   const s = gate.splitRebaseGate([row(1, GUARD)], { limit: 1 });

package/tests/recall_cli.mjs

@@ -11,7 +11,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { parseArgs, truncate } = require('../scripts/gds/recall.js');
+const { parseArgs, truncate } = require('../scripts/bongos/recall.js');
 
 let passed = 0;
 let failed = 0;