@bongos/core 1.21.175 → 1.21.177

package/modules/raise/db.js

@@ -0,0 +1,95 @@
+// modules/raise/db.js — the thin SQL behind the /raise investor page (task
+// 1004847). Every function takes an optional executor so a test can hand in a
+// fake query function; the default is the shared pool.
+
+'use strict';
+
+const { pool } = require('../../src/module-api');
+
+const exec = (executor) => executor || ((text, params) => pool.query(text, params));
+
+/** Record an investor's sign-in (their NDA acceptance) and open a session for it. */
+async function createSignin({ name, linkedin, ndaVersion, ip, userAgent, tokenHash, days }, executor) {
+  const q = exec(executor);
+  const r = await q(
+    `INSERT INTO raise_signins (name, linkedin, nda_version, ip, user_agent)
+     VALUES ($1, $2, $3, $4, $5) RETURNING id`,
+    [name, linkedin, ndaVersion, ip || null, userAgent || null],
+  );
+  const signinId = r.rows[0].id;
+  await q(
+    `INSERT INTO raise_sessions (token_hash, signin_id, expires_at)
+     VALUES ($1, $2, now() + ($3 || ' days')::interval)`,
+    [tokenHash, signinId, String(days)],
+  );
+  return signinId;
+}
+
+/** The live investor session for a token hash, or null (expired rows read as absent). */
+async function getSession(tokenHash, executor) {
+  const r = await exec(executor)(
+    `SELECT s.signin_id, g.name, g.linkedin
+       FROM raise_sessions s JOIN raise_signins g ON g.id = s.signin_id
+      WHERE s.token_hash = $1 AND s.expires_at > now()`,
+    [tokenHash],
+  );
+  return r.rows[0] || null;
+}
+
+async function endSession(tokenHash, executor) {
+  await exec(executor)('DELETE FROM raise_sessions WHERE token_hash = $1', [tokenHash]);
+}
+
+async function recordInterest({ signinId, name, amountUsd, ip }, executor) {
+  await exec(executor)(
+    'INSERT INTO raise_interest (signin_id, name, amount_usd, ip) VALUES ($1, $2, $3, $4)',
+    [signinId || null, name, amountUsd, ip || null],
+  );
+}
+
+/** Saved copy as { key: body }. */
+async function getCopy(executor) {
+  const r = await exec(executor)('SELECT key, body FROM raise_copy');
+  return Object.fromEntries(r.rows.map((x) => [x.key, x.body]));
+}
+
+/** Saved raise numbers as { key: value }. */
+async function getSettings(executor) {
+  const r = await exec(executor)('SELECT key, value FROM raise_settings');
+  return Object.fromEntries(r.rows.map((x) => [x.key, x.value]));
+}
+
+/**
+ * Apply one save from the page in a single transaction: copy upserts (or a delete
+ * when a block is put back to its shipped default), setting upserts, and one
+ * raise_edits row per change. `client` is a transaction client (api.withTx).
+ */
+async function applyEdits(client, { builderId, login, copy = [], settings = [] }) {
+  for (const c of copy) {
+    if (c.revert) await client.query('DELETE FROM raise_copy WHERE key = $1', [c.key]);
+    else {
+      await client.query(
+        `INSERT INTO raise_copy (key, body, updated_by) VALUES ($1, $2, $3)
+         ON CONFLICT (key) DO UPDATE SET body = EXCLUDED.body, updated_by = EXCLUDED.updated_by, updated_at = now()`,
+        [c.key, c.after, builderId],
+      );
+    }
+    await client.query(
+      'INSERT INTO raise_edits (builder_id, login, key, before, after) VALUES ($1, $2, $3, $4, $5)',
+      [builderId, login, c.key, JSON.stringify(c.before), JSON.stringify(c.after)],
+    );
+  }
+  for (const s of settings) {
+    await client.query(
+      `INSERT INTO raise_settings (key, value, updated_by) VALUES ($1, $2, $3)
+       ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value, updated_by = EXCLUDED.updated_by, updated_at = now()`,
+      [s.key, JSON.stringify(s.after), builderId],
+    );
+    await client.query(
+      'INSERT INTO raise_edits (builder_id, login, key, before, after) VALUES ($1, $2, $3, $4, $5)',
+      [builderId, login, `settings.${s.key}`, JSON.stringify(s.before), JSON.stringify(s.after)],
+    );
+  }
+}
+
+module.exports = { createSignin, getSession, endSession, recordInterest, getCopy, getSettings, applyEdits };

package/modules/raise/migrations/raise_001_tables.sql

@@ -0,0 +1,71 @@
+-- raise_001_tables.sql — the /raise investor page's records (task 1004847).
+--
+-- The page has two kinds of visitor. An INVESTOR signs in with their name, their
+-- LinkedIn link and a shared password, and signing in is their acceptance of the
+-- NDA; they may say they are interested in an amount (non-binding). A BUILDER of
+-- this instance signs in the ordinary way and edits the page's copy and raise
+-- numbers in place. Every one of those acts is a row here.
+--
+-- The page COPY and STARTING numbers ship with the module (content/*.json); these
+-- tables hold only what changed on the live page, so an edit always wins over the
+-- shipped default and deleting a row reverts that block to it.
+
+-- An investor's sign-in: who they said they are, and which NDA text they accepted.
+CREATE TABLE IF NOT EXISTS raise_signins (
+  id           BIGSERIAL   PRIMARY KEY,
+  name         TEXT        NOT NULL,
+  linkedin     TEXT        NOT NULL,
+  nda_version  TEXT        NOT NULL,
+  ip           TEXT,
+  user_agent   TEXT,
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- An investor's browser session. Only the SHA-256 of the cookie token is stored,
+-- so a database read cannot be replayed as a sign-in.
+CREATE TABLE IF NOT EXISTS raise_sessions (
+  token_hash   TEXT        PRIMARY KEY,
+  signin_id    BIGINT      NOT NULL REFERENCES raise_signins(id) ON DELETE CASCADE,
+  expires_at   TIMESTAMPTZ NOT NULL,
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS raise_sessions_expires_idx ON raise_sessions (expires_at);
+
+-- "I'm interested": a non-binding amount an investor named.
+CREATE TABLE IF NOT EXISTS raise_interest (
+  id           BIGSERIAL   PRIMARY KEY,
+  signin_id    BIGINT      REFERENCES raise_signins(id) ON DELETE SET NULL,
+  name         TEXT        NOT NULL,
+  amount_usd   BIGINT      NOT NULL CHECK (amount_usd > 0),
+  ip           TEXT,
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- A block of page copy as last saved from the page (key = a content/copy.json key).
+CREATE TABLE IF NOT EXISTS raise_copy (
+  key          TEXT        PRIMARY KEY,
+  body         TEXT        NOT NULL,
+  updated_by   BIGINT      REFERENCES builders(id),
+  updated_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- A raise number as last saved from the page (goalUsd, committedUsd, lead, runwayYears).
+CREATE TABLE IF NOT EXISTS raise_settings (
+  key          TEXT        PRIMARY KEY,
+  value        JSONB,
+  updated_by   BIGINT      REFERENCES builders(id),
+  updated_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Every change made from the page: who, which block or number, and before/after —
+-- the page's history, so any edit can be seen and undone by hand.
+CREATE TABLE IF NOT EXISTS raise_edits (
+  id           BIGSERIAL   PRIMARY KEY,
+  builder_id   BIGINT      REFERENCES builders(id),
+  login        TEXT        NOT NULL,
+  key          TEXT        NOT NULL,
+  before       JSONB,
+  after        JSONB,
+  created_at   TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS raise_edits_key_idx ON raise_edits (key, created_at DESC);

package/modules/raise/module.json

@@ -0,0 +1,28 @@
+{
+  "key": "raise",
+  "title": "Raise (investor page)",
+  "description": "The instance's fundraising page at /raise (task 1004847): a password-gated investor page (signing in accepts the NDA; non-binding 'I'm interested' amounts) whose copy and raise numbers any active builder edits in place, with every change logged. Moved in from a standalone service on cloudbongos.com so builders contribute to it through normal tasks. default:false — enabled only on the hub; its copy is Cloud Bongos's own raise.",
+  "version": "1.0.0",
+  "coreVersion": "^1.19.0",
+  "category": {
+    "parent": "money"
+  },
+  "author": "Cloud Bongos LLC",
+  "origin": "Cloud Bongos (cloudbongos.com)",
+  "license": "AGPL-3.0",
+  "maintainer": "Cloud Bongos maintainers",
+  "default": false,
+  "maintenance": {
+    "status": "maintained"
+  },
+  "migrations": true,
+  "contributes": {
+    "routes": [
+      "raise"
+    ]
+  },
+  "provides": [
+    "raise.web"
+  ],
+  "consumes": []
+}

package/modules/raise/page.js

@@ -0,0 +1,194 @@
+// modules/raise/page.js — who is looking at /raise, and the HTML they get
+// (task 1004847). Shared by the page server (web.js, behind the `raise.web`
+// port) and the write routes (routes/raise.js), so a failed sign-in re-renders
+// exactly the gate the visitor came from.
+//
+// Two kinds of visitor:
+//   investor — holds a raise_s cookie for a live raise_sessions row
+//   editor   — holds this instance's ordinary builder session, and is active
+//              (owner, 2026-10-25: any builder may edit; no rank gate)
+// Anyone else gets the gate. The page body is only ever built for one of the
+// two, so the copy cannot be read from page source without signing in.
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+const R = require('./raise');
+const db = require('./db');
+
+const BASE = '/raise';
+const API = '/api/bongos/raise';
+const COOKIE = 'raise_s';
+const INVESTOR_DAYS = 90;
+const VIEWS = path.join(__dirname, 'views');
+const PUBLIC = path.join(__dirname, 'public');
+
+// Templates and the asset stamp change only with a deploy, so they are read
+// once at load — nothing on the request path touches the disk except assets.
+const VIEW = Object.freeze(Object.fromEntries(['page.html', 'gate.html', 'nda.html']
+  .map((f) => [f, fs.readFileSync(path.join(VIEWS, f), 'utf8')])));
+const view = (name) => VIEW[name];
+
+/** Content-stamp for asset URLs, so a deploy is never hidden behind a cached stylesheet. */
+const ASSET_VERSION = (() => {
+  let v = 0;
+  for (const f of ['raise.css', 'raise.js', 'edit.js']) {
+    try { v = Math.max(v, fs.statSync(path.join(PUBLIC, f)).mtimeMs); } catch { /* absent asset */ }
+  }
+  return Math.round(v).toString(36);
+})();
+
+function readCookie(req, name) {
+  for (const part of String(req.headers.cookie || '').split(';')) {
+    const [k, ...v] = part.trim().split('=');
+    if (k === name && v.length) return v.join('=');
+  }
+  return null;
+}
+
+/** Set-Cookie for the investor session (host-only, sent to /raise and its API). */
+function sessionCookie(token, maxAgeSec, secure) {
+  return `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${secure ? '; Secure' : ''}`;
+}
+
+/** The investor session behind this request's cookie, or null. */
+async function readInvestor(req) {
+  const token = readCookie(req, COOKIE);
+  if (!token || token.length > 100) return null;
+  return db.getSession(R.hashToken(token));
+}
+
+/** The builder session behind this request, if it may edit the page; else null. */
+async function readEditor(req) {
+  let s = null;
+  try { s = await api.resolveSession(req); } catch { return null; }
+  if (!s || s.status !== 'active' || !s.rank) return null;
+  return { builderId: s.builder_id, login: s.github_login, name: s.display_name || s.github_login };
+}
+
+/** Shipped defaults overlaid with what was saved from the page. */
+async function loadState() {
+  const [savedCopy, savedSettings] = await Promise.all([db.getCopy(), db.getSettings()]);
+  return {
+    copy: { ...R.defaultCopy(), ...savedCopy },
+    settings: { ...R.defaultSettings(), ...savedSettings },
+  };
+}
+
+function videoSlot(file, title) {
+  if (file) {
+    return `<figure class="video"><video controls preload="metadata" playsinline aria-label="${R.esc(title)}" src="${BASE}/media/${encodeURIComponent(file)}"></video></figure>`;
+  }
+  return `<figure class="video video--empty" aria-label="${R.esc(title)} (video TBA)"><div class="video__ph"><span class="video__play" aria-hidden="true"></span><span>video TBA</span></div></figure>`;
+}
+
+function founderCard(f, i, text, editor, ctx) {
+  const initials = String(f.name).split(/\s+/).map((w) => w[0]).join('').slice(0, 2);
+  const photo = f.photo
+    ? `<img class="founder__photo" src="${BASE}/media/${encodeURIComponent(f.photo)}" alt="">`
+    : `<div class="founder__photo founder__photo--initials" aria-hidden="true">${R.esc(initials)}</div>`;
+  const key = `founder.${i + 1}.bio`;
+  const bioText = text[key] || '';
+  const bio = editor || bioText
+    ? `<div class="prose" data-k="${key}" data-kind="para" data-placeholder="bio TBA">${R.renderBlock(key, bioText, ctx)}</div>`
+    : '<p class="tba">bio TBA</p>';
+  return `<article class="founder">${photo}<div><h3>${R.esc(f.name)}</h3>${bio}<a class="founder__link" href="${R.esc(f.linkedin)}" target="_blank" rel="noopener noreferrer">LinkedIn ↗</a></div></article>`;
+}
+
+function editBar(editor, s) {
+  const n = (v) => (v == null ? '' : R.esc(v));
+  return `<div class="editbar" data-editbar>
+  <span class="editbar__who">Team · @${R.esc(editor.login)}</span>
+  <button type="button" class="editbar__btn" data-edit-start>Edit page</button>
+  <form class="editbar__nums" data-edit-nums hidden>
+    <label>Goal $<input name="goalUsd" inputmode="numeric" value="${n(s.goalUsd)}"></label>
+    <label>Committed $<input name="committedUsd" inputmode="numeric" value="${n(s.committedUsd)}"></label>
+    <label>Lead <input name="lead" value="${n(s.lead)}"></label>
+    <label>Runway (years) <input name="runwayYears" inputmode="decimal" value="${n(s.runwayYears)}"></label>
+  </form>
+  <span class="editbar__status" data-edit-status role="status"></span>
+  <button type="button" class="editbar__btn" data-edit-cancel hidden>Cancel</button>
+  <button type="button" class="editbar__btn editbar__btn--save" data-edit-save hidden>Save</button>
+</div>`;
+}
+
+/** The full page for a signed-in investor or editor. */
+async function renderPage({ editor }) {
+  const { copy, settings: c } = await loadState();
+  const ctx = R.renderContext(c);
+  const goal = c.goalUsd;
+  const committed = c.committedUsd || 0;
+  const pct = goal ? Math.min(100, (committed / goal) * 100) : 0;
+  const calc = {
+    goalUsd: goal || null,
+    instrument: c.instrument?.type || null,
+    capUsd: c.instrument?.capUsd || null,
+    preMoneyUsd: c.instrument?.preMoneyUsd || null,
+  };
+  const v = ASSET_VERSION;
+  return R.fill(view('page.html'), {
+    base: BASE,
+    assetVersion: v,
+    editorAssets: editor ? `<script src="${BASE}/assets/edit.js?v=${v}" defer></script>` : '',
+    draftBanner: c.draft ? '<div class="draft" role="note">DRAFT</div>' : '',
+    editBar: editor ? editBar(editor, c) : '',
+    entity: R.esc(c.entity),
+    progressPct: pct.toFixed(1),
+    progressLabel: goal ? `${R.usd(committed)} / ${R.usd(goal)}` : `${R.usd(committed)} / TBA`,
+    progressHidden: goal ? '' : ' progress--nogoal',
+    calcData: R.esc(JSON.stringify(calc)),
+    videoRoles: videoSlot(c.videos?.roles, 'The four roles in practice'),
+    videoCurrent: videoSlot(c.videos?.current, 'Cloud Bongos today'),
+    videoGovernment: videoSlot(c.videos?.government, 'Government, as it runs today'),
+    videoSystem: videoSlot(c.videos?.system, 'The whole system, working together'),
+    founders: (c.founders || []).map((f, i) => founderCard(f, i, copy, editor, ctx)).join('\n'),
+  }, copy, ctx);
+}
+
+/** The sign-in gate, optionally with an error and the visitor's typed values. */
+function renderGate(error, values = {}) {
+  return R.fill(view('gate.html'), {
+    base: BASE,
+    api: API,
+    error: error ? `<p class="gate__error" role="alert">${R.esc(error)}</p>` : '',
+    name: R.esc(values.name || ''),
+    linkedin: R.esc(values.linkedin || ''),
+    bongos: `<div class="gate__team"><span>Working on Cloud Bongos?</span><a class="btn btn--ghost" href="/api/bongos/auth/web/start?return=${encodeURIComponent(BASE)}">Sign in with Bongos</a></div>`,
+  });
+}
+
+function renderNda() {
+  return R.fill(view('nda.html'), { base: BASE, body: R.ndaBody() });
+}
+
+/** Post a line to the optional raise Discord webhook; never fails the request. */
+function notify(content) {
+  const hook = process.env.RAISE_DISCORD_WEBHOOK;
+  if (!hook) return;
+  fetch(hook, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({ content, allowed_mentions: { parse: [] } }),
+    signal: AbortSignal.timeout(5000),
+  }).catch(() => { /* a notification is best-effort */ });
+}
+
+// The security headers every /raise response carries: never indexed, never
+// framed, scripts and styles only from this site and Google Fonts.
+const CSP = "default-src 'self'; img-src 'self' data:; media-src 'self'; style-src 'self' https://fonts.googleapis.com; font-src https://fonts.gstatic.com; script-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'";
+function pageHeaders(res) {
+  res.set({
+    'X-Robots-Tag': 'noindex, nofollow, noarchive',
+    'Referrer-Policy': 'no-referrer',
+    'Content-Security-Policy': CSP,
+    'Cache-Control': 'no-store',
+  });
+}
+
+module.exports = {
+  BASE, API, COOKIE, INVESTOR_DAYS, PUBLIC,
+  readCookie, sessionCookie, readInvestor, readEditor, loadState,
+  renderPage, renderGate, renderNda, notify, pageHeaders,
+};

package/modules/raise/public/edit.js

@@ -0,0 +1,152 @@
+// In-place editing for the Cloud Bongos team. Only served to a teammate signed
+// in with Bongos; the server re-checks the team list on every save.
+(function () {
+  var bar = document.querySelector('[data-editbar]');
+  if (!bar) return;
+  var startBtn = bar.querySelector('[data-edit-start]');
+  var saveBtn = bar.querySelector('[data-edit-save]');
+  var cancelBtn = bar.querySelector('[data-edit-cancel]');
+  var nums = bar.querySelector('[data-edit-nums]');
+  var status = bar.querySelector('[data-edit-status]');
+  var blocks = Array.prototype.slice.call(document.querySelectorAll('[data-k]'));
+  var original = {};
+  var numOriginal = {};
+  var editing = false;
+  var NBSP = new RegExp(String.fromCharCode(160), 'g');
+
+  // ── reading a block back into its stored text ──
+  // Paragraph and list blocks hold one <p>/<li> per line; Enter makes a new one.
+  // The raise numbers and citations are locked pieces that read back as
+  // {goal} / [Goldman Sachs], so they survive any edit around them.
+  var BLOCK = /^(P|DIV|LI|UL|OL|H\d|BLOCKQUOTE)$/;
+  function inline(node) {
+    if (node.nodeType === 3) return node.nodeValue;
+    if (node.nodeType !== 1) return '';
+    if (node.dataset && node.dataset.tok) return '{' + node.dataset.tok + '}';
+    if (node.dataset && node.dataset.cite) return '[' + node.dataset.cite + ']';
+    if (node.tagName === 'BR') return '\n';
+    var out = '';
+    for (var c = node.firstChild; c; c = c.nextSibling) out += inline(c);
+    return out;
+  }
+  function clean(t) { return t.replace(NBSP, ' ').replace(/[ \t]+/g, ' ').trim(); }
+  function textOf(el) {
+    if (el.dataset.kind === 'line') return clean(inline(el).replace(/\n/g, ' '));
+    var lines = [];
+    var loose = '';
+    function flush() { if (loose) { lines.push(loose); loose = ''; } }
+    (function walk(parent) {
+      for (var c = parent.firstChild; c; c = c.nextSibling) {
+        var isPiece = c.nodeType === 1 && c.dataset && (c.dataset.tok || c.dataset.cite);
+        if (c.nodeType === 1 && BLOCK.test(c.tagName) && !isPiece) {
+          flush();
+          if (c.querySelector('p,li,div')) walk(c);
+          else lines.push(inline(c));
+        } else {
+          loose += inline(c);
+        }
+      }
+    })(el);
+    flush();
+    return lines.join('\n').split('\n').map(clean).filter(Boolean).join('\n');
+  }
+
+  function setEditing(on) {
+    editing = on;
+    document.documentElement.classList.toggle('is-editing', on);
+    startBtn.hidden = on;
+    saveBtn.hidden = !on;
+    cancelBtn.hidden = !on;
+    nums.hidden = !on;
+    blocks.forEach(function (el) {
+      if (on) {
+        original[el.dataset.k] = textOf(el);
+        el.contentEditable = 'true';
+        el.spellcheck = true;
+      } else {
+        el.removeAttribute('contenteditable');
+        el.classList.remove('is-changed');
+      }
+    });
+    Array.prototype.forEach.call(nums.elements, function (input) {
+      if (on) numOriginal[input.name] = input.value;
+    });
+  }
+
+  function changes() {
+    var copy = {};
+    var settings = {};
+    blocks.forEach(function (el) {
+      var t = textOf(el);
+      if (t !== original[el.dataset.k]) copy[el.dataset.k] = t;
+    });
+    Array.prototype.forEach.call(nums.elements, function (input) {
+      if (input.value !== numOriginal[input.name]) settings[input.name] = input.value;
+    });
+    return { copy: copy, settings: settings, count: Object.keys(copy).length + Object.keys(settings).length };
+  }
+
+  document.addEventListener('input', function (e) {
+    if (!editing) return;
+    var el = e.target.closest && e.target.closest('[data-k]');
+    if (el) el.classList.toggle('is-changed', textOf(el) !== original[el.dataset.k]);
+    var n = changes().count;
+    status.textContent = n ? n + ' unsaved change' + (n === 1 ? '' : 's') : '';
+  });
+
+  // Headings and labels are one line; Enter only makes new paragraphs/items in
+  // the paragraph and list blocks.
+  document.addEventListener('keydown', function (e) {
+    var el = editing && e.key === 'Enter' && e.target.closest && e.target.closest('[data-k]');
+    if (el && (el.dataset.kind === 'line' || e.shiftKey)) e.preventDefault();
+  });
+
+  // Paste as plain text so formatting from other documents doesn't come along.
+  document.addEventListener('paste', function (e) {
+    if (!editing || !(e.target.closest && e.target.closest('[data-k]'))) return;
+    e.preventDefault();
+    var t = (e.clipboardData || window.clipboardData).getData('text/plain');
+    document.execCommand('insertText', false, t);
+  });
+
+  // Links inside the page shouldn't navigate away mid-edit.
+  document.addEventListener('click', function (e) {
+    if (editing && e.target.closest && e.target.closest('[data-k] a, .index a')) e.preventDefault();
+  });
+
+  window.addEventListener('beforeunload', function (e) {
+    if (editing && changes().count) { e.preventDefault(); e.returnValue = ''; }
+  });
+
+  startBtn.addEventListener('click', function () { status.textContent = ''; setEditing(true); });
+
+  cancelBtn.addEventListener('click', function () {
+    if (changes().count && !confirm('Discard your unsaved changes?')) return;
+    editing = false;
+    location.reload();
+  });
+
+  saveBtn.addEventListener('click', function () {
+    var c = changes();
+    if (!c.count) { setEditing(false); status.textContent = 'No changes.'; return; }
+    saveBtn.disabled = true;
+    status.textContent = 'Saving…';
+    fetch('/api/bongos/raise/edit', {
+      method: 'POST',
+      credentials: 'same-origin',
+      headers: { 'content-type': 'application/json', 'x-raise-edit': '1' },
+      body: JSON.stringify({ copy: c.copy, settings: c.settings })
+    }).then(function (r) {
+      return r.json().then(function (j) {
+        if (!r.ok || !j.ok) throw new Error((j.error && (j.error.message || j.error.code)) || 'Save failed.');
+        return j;
+      });
+    }).then(function () {
+      editing = false;
+      location.reload();
+    }).catch(function (err) {
+      status.textContent = err.message;
+      saveBtn.disabled = false;
+    });
+  });
+})();

package/modules/raise/public/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200"><style>.p{fill:#17181a}.r{stroke:#17181a}@media (prefers-color-scheme:dark){.p{fill:#e2e1e4}.r{stroke:#e2e1e4}}</style><path class="r" d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke-width="24" stroke-linecap="round"/><circle class="p" cx="100" cy="100" r="50"/><circle cx="156" cy="46" r="18" fill="#fb9569"/></svg>

package/modules/raise/public/logo-ink.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" role="img" aria-label="Cloud Bongos"><path d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke="#17181a" stroke-width="15" stroke-linecap="round"/><circle cx="100" cy="100" r="55" fill="#17181a"/><circle cx="156" cy="46" r="12" fill="#fb9569"/></svg>

package/modules/raise/public/logo-night.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 200 200" role="img" aria-label="Cloud Bongos"><path d="M137 31 A78 78 0 1 0 170 66" fill="none" stroke="#e2e1e4" stroke-width="15" stroke-linecap="round"/><circle cx="100" cy="100" r="55" fill="#e2e1e4"/><circle cx="156" cy="46" r="12" fill="#fb9569"/></svg>

package/modules/raise/public/mode.js

@@ -0,0 +1,8 @@
+// Same contract as cloudbongos.com: an explicit choice is stored as cb-color-mode,
+// otherwise the OS preference decides. Runs before first paint.
+(function () {
+  try {
+    var m = localStorage.getItem('cb-color-mode');
+    if (m === 'light' || m === 'dark') document.documentElement.setAttribute('data-mode', m);
+  } catch (e) {}
+})();