@bongos/core 1.21.175 → 1.21.177

package/modules/raise/public/raise.css

@@ -0,0 +1,234 @@
+/* cloudbongos.com/raise — palette and type follow the platform's branding
+   (config/branding.neutral.json theme.ui): Manrope + JetBrains Mono, paper grey,
+   near-black ink, salmon accent reserved for what is live or pressable. */
+
+:root {
+  --bg: #edecee;
+  --card: #fbfafc;
+  --deep: #e2e1e4;
+  --ink: #17181a;
+  --ink-soft: #55565a;
+  --ink-faint: #65656a;
+  --rule: #c6c6c8;
+  --rule-soft: #dcdbdd;
+  --accent: #fb9569;
+  --accent-deep: #a3481a;
+  --sea: #5b6fd0;
+  --on-accent: #17181a;
+  --font: "Manrope", "Segoe UI", system-ui, -apple-system, sans-serif;
+  --mono: "JetBrains Mono", ui-monospace, SFMono-Regular, Menlo, monospace;
+  --radius: 10px;
+  color-scheme: light;
+}
+@media (prefers-color-scheme: dark) {
+  :root:not([data-mode="light"]) {
+    --bg: #000; --card: #111113; --deep: #1c1c1f; --ink: #edecee; --ink-soft: #b4b3b8;
+    --ink-faint: #9a999e; --rule: #3a3a3e; --rule-soft: #26262a; --accent-deep: #fb9569;
+    color-scheme: dark;
+  }
+}
+:root[data-mode="dark"] {
+  --bg: #000; --card: #111113; --deep: #1c1c1f; --ink: #edecee; --ink-soft: #b4b3b8;
+  --ink-faint: #9a999e; --rule: #3a3a3e; --rule-soft: #26262a; --accent-deep: #fb9569;
+  color-scheme: dark;
+}
+
+/* the two logo variants: Ink and one light / Night ink */
+.logo--dark { display: none; }
+@media (prefers-color-scheme: dark) {
+  :root:not([data-mode="light"]) .logo--light { display: none; }
+  :root:not([data-mode="light"]) .logo--dark { display: inline-block; }
+}
+:root[data-mode="dark"] .logo--light { display: none; }
+:root[data-mode="dark"] .logo--dark { display: inline-block; }
+
+*, *::before, *::after { box-sizing: border-box; }
+html { scroll-behavior: smooth; scroll-padding-top: 80px; -webkit-text-size-adjust: 100%; }
+@media (prefers-reduced-motion: reduce) { html { scroll-behavior: auto; } }
+body {
+  margin: 0; background: var(--bg); color: var(--ink);
+  font: 400 17px/1.65 var(--font); -webkit-font-smoothing: antialiased;
+}
+a { color: inherit; text-decoration-color: var(--rule); text-underline-offset: 3px; }
+a:hover { text-decoration-color: var(--accent); }
+:focus-visible { outline: 2px solid var(--accent); outline-offset: 2px; border-radius: 4px; }
+h1, h2, h3 { font-weight: 500; letter-spacing: -0.02em; line-height: 1.15; margin: 0; text-wrap: balance; }
+h1 { font-size: clamp(36px, 6vw, 60px); font-weight: 400; }
+h2 { font-size: clamp(26px, 3.4vw, 36px); font-weight: 400; margin-bottom: 20px; }
+h3 { font-size: 18px; }
+p { margin: 0 0 16px; max-width: 64ch; }
+.eyebrow { font: 400 12px/1.4 var(--mono); letter-spacing: .08em; text-transform: uppercase; color: var(--ink-faint); margin: 0 0 14px; }
+.wordmark { font: 300 22px/1 var(--font); letter-spacing: -.01em; white-space: nowrap; }
+.tba { font-family: var(--mono); font-size: .82em; color: var(--ink-faint); border-bottom: 1px dashed var(--rule); white-space: nowrap; }
+.cite { font: 400 11px var(--mono); margin-left: 3px; color: var(--ink-faint); }
+.cite--pending { color: var(--ink-faint); font-family: var(--mono); font-size: 12px; }
+.pending { color: var(--ink-faint); font-style: italic; }
+
+.btn {
+  display: inline-flex; align-items: center; justify-content: center; gap: 8px;
+  font: 600 16px var(--font); color: var(--on-accent); background: var(--accent);
+  border: 0; border-radius: 999px; padding: 13px 26px; cursor: pointer;
+  transition: transform .12s ease, filter .12s ease;
+}
+.btn:hover:not(:disabled) { filter: brightness(1.05); transform: translateY(-1px); }
+.btn:disabled { background: var(--deep); color: var(--ink-faint); cursor: not-allowed; }
+
+.draft {
+  background: var(--ink); color: var(--bg); font: 400 13px/1.5 var(--mono);
+  text-align: center; padding: 8px 16px;
+}
+
+/* ── header ─────────────────────────────────────────────── */
+.top {
+  position: sticky; top: 0; z-index: 10; display: flex; align-items: center; gap: 16px;
+  padding: 12px clamp(16px, 4vw, 40px); background: color-mix(in srgb, var(--bg) 88%, transparent);
+  backdrop-filter: blur(10px); -webkit-backdrop-filter: blur(10px); border-bottom: 1px solid var(--rule-soft);
+}
+.brand { display: flex; align-items: center; gap: 10px; text-decoration: none; }
+.top__tag { font: 400 12px var(--mono); color: var(--ink-faint); letter-spacing: .06em; text-transform: uppercase; }
+.top__actions { margin-left: auto; display: flex; align-items: center; gap: 14px; }
+.top__leave { font-size: 14px; color: var(--ink-soft); }
+.mode-toggle { background: none; border: 1px solid var(--rule); color: var(--ink); width: 34px; height: 34px; border-radius: 50%; cursor: pointer; font-size: 16px; line-height: 1; }
+@media (max-width: 560px) { .top__tag { display: none; } }
+
+/* ── layout ─────────────────────────────────────────────── */
+.layout { display: grid; grid-template-columns: 1fr; max-width: 1180px; margin: 0 auto; padding: 0 16px; }
+@media (min-width: 1000px) { .layout { grid-template-columns: 200px 1fr; gap: 56px; padding: 0 40px; } }
+.index { display: none; }
+@media (min-width: 1000px) {
+  .index { display: block; position: sticky; top: 96px; align-self: start; padding-top: 72px; }
+  .index ol { list-style: none; margin: 0; padding: 0; counter-reset: i; }
+  .index li { counter-increment: i; margin: 0 0 10px; }
+  .index a { display: block; font-size: 14px; color: var(--ink-faint); text-decoration: none; padding-left: 14px; border-left: 2px solid transparent; }
+  .index a::before { content: counter(i, decimal-leading-zero) "  "; font: 400 11px var(--mono); }
+  .index a:hover, .index a[aria-current="true"] { color: var(--ink); border-left-color: var(--accent); }
+}
+.content { min-width: 0; max-width: 760px; }
+section { padding: 72px 0; border-bottom: 1px solid var(--rule-soft); }
+.hero { padding-top: clamp(48px, 9vw, 104px); }
+.hero h1 { margin-bottom: 22px; }
+.lede { font-size: clamp(18px, 2.2vw, 21px); color: var(--ink-soft); max-width: 46ch; }
+.sub { margin: 40px 0 16px; }
+
+/* ── roles, benefits, markets ───────────────────────────── */
+.roles, .markets { display: grid; gap: 12px; margin: 28px 0 8px; grid-template-columns: repeat(auto-fit, minmax(min(100%, 170px), 1fr)); }
+@media (min-width: 520px) { .roles { grid-template-columns: repeat(2, 1fr); } }
+.role, .market { background: var(--card); border: 1px solid var(--rule-soft); border-radius: var(--radius); padding: 20px; }
+.role h3, .market h3 { margin-bottom: 8px; }
+.role p { font-size: 15px; color: var(--ink-soft); margin: 0; }
+.market__fig { margin: 0; }
+.benefits { margin: 8px 0 0; display: grid; gap: 22px; }
+.benefits div { display: grid; gap: 4px; }
+@media (min-width: 640px) { .benefits div { grid-template-columns: 160px 1fr; gap: 24px; } }
+.benefits dt { font-weight: 600; }
+.benefits dd { margin: 0; color: var(--ink-soft); max-width: 58ch; }
+.beliefs { margin: 0; padding-left: 20px; display: grid; gap: 12px; }
+.beliefs li { max-width: 62ch; color: var(--ink-soft); }
+.beliefs li::marker { color: var(--accent); }
+.leads { padding-left: 20px; margin: 0; }
+
+/* ── video slots ────────────────────────────────────────── */
+.video { margin: 36px 0 0; }
+.video video, .video__ph { display: block; width: 100%; aspect-ratio: 16 / 9; border-radius: var(--radius); background: var(--ink); }
+.video__ph {
+  display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 12px;
+  background: var(--deep); border: 1px dashed var(--rule); color: var(--ink-faint); font: 400 13px var(--mono);
+}
+.video__play { width: 0; height: 0; border-left: 18px solid var(--rule); border-top: 11px solid transparent; border-bottom: 11px solid transparent; }
+.video figcaption { font-size: 14px; color: var(--ink-faint); margin-top: 10px; }
+
+/* ── the raise ──────────────────────────────────────────── */
+.progress { margin: 28px 0; }
+.progress__track { height: 12px; background: var(--deep); border-radius: 999px; overflow: hidden; }
+.progress__fill { height: 100%; width: 0; background: var(--accent); border-radius: 999px; transition: width .8s ease; }
+.progress--nogoal .progress__track { background: repeating-linear-gradient(-45deg, var(--deep) 0 8px, var(--rule-soft) 8px 16px); }
+.progress__label { font: 400 13px var(--mono); color: var(--ink-faint); margin-top: 10px; }
+
+.calc { margin-top: 44px; background: var(--card); border: 1px solid var(--rule-soft); border-radius: 16px; padding: clamp(20px, 4vw, 36px); }
+.calc h3 { font-size: 22px; font-weight: 400; margin-bottom: 20px; }
+.calc__input { display: flex; align-items: center; border: 1px solid var(--rule); border-radius: 12px; padding: 0 16px; background: var(--bg); max-width: 360px; }
+.calc__input:focus-within { border-color: var(--accent); }
+.calc__cur { font-size: 26px; color: var(--ink-faint); }
+.calc__input input { flex: 1; min-width: 0; border: 0; background: none; color: var(--ink); font: 300 30px var(--font); padding: 12px 8px; outline: none; }
+.calc__out { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 16px; margin: 24px 0 8px; }
+.calc__out dt { font: 400 12px var(--mono); letter-spacing: .06em; text-transform: uppercase; color: var(--ink-faint); }
+.calc__out dd { margin: 4px 0 0; font-size: 28px; font-weight: 300; }
+.calc__note { font-size: 14px; color: var(--ink-faint); min-height: 1em; }
+.calc__thanks { color: var(--ink-soft); margin-top: 14px; }
+.fine { font-size: 13px; color: var(--ink-faint); margin: 22px 0 0; }
+
+/* ── founders ───────────────────────────────────────────── */
+.founders { display: grid; gap: 28px; grid-template-columns: repeat(auto-fit, minmax(min(100%, 300px), 1fr)); }
+.founder { display: grid; grid-template-columns: 72px 1fr; gap: 18px; align-items: start; }
+.founder__photo { width: 72px; height: 72px; border-radius: 50%; object-fit: cover; background: var(--deep); }
+.founder__photo--initials { display: flex; align-items: center; justify-content: center; font: 300 24px var(--font); color: var(--ink-soft); border: 1px solid var(--rule-soft); }
+.founder h3 { margin-bottom: 2px; }
+.founder__leads { font: 400 12px var(--mono); letter-spacing: .06em; text-transform: uppercase; color: var(--ink-faint); margin: 0 0 10px; }
+.founder p { font-size: 15px; }
+.founder__link { font-size: 14px; color: var(--ink-soft); }
+
+.foot { padding: 40px 0 64px; font-size: 13px; color: var(--ink-faint); }
+.foot p { max-width: none; }
+
+/* ── gate + NDA ─────────────────────────────────────────── */
+.gate-body { min-height: 100vh; display: grid; place-items: center; padding: 24px 16px; }
+.gate { width: 100%; max-width: 440px; }
+.gate__brand { display: flex; align-items: center; gap: 14px; margin-bottom: 40px; }
+.gate__brand .wordmark { font-size: 28px; }
+.gate h1 { font-size: 36px; margin-bottom: 12px; }
+.gate__lede { color: var(--ink-soft); }
+.gate__error { background: color-mix(in srgb, var(--accent) 18%, var(--card)); border: 1px solid var(--accent); border-radius: 8px; padding: 10px 14px; font-size: 15px; }
+.gate__form { display: grid; gap: 16px; margin-top: 24px; }
+.gate__form label { display: grid; gap: 6px; font-size: 14px; font-weight: 500; }
+.gate__form input[type="text"], .gate__form input[type="url"], .gate__form input[type="password"] {
+  font: 400 16px var(--font); color: var(--ink); background: var(--card);
+  border: 1px solid var(--rule); border-radius: 10px; padding: 12px 14px;
+}
+.gate__form input:focus { outline: none; border-color: var(--accent); }
+.gate__form .btn { justify-self: start; margin-top: 6px; }
+
+.doc { max-width: 720px; margin: 0 auto; padding: 56px 16px 80px; }
+.doc h1 { font-size: clamp(28px, 4vw, 40px); margin-bottom: 32px; }
+.doc h3 { margin: 28px 0 10px; font-size: 17px; }
+.doc p { font-size: 15px; color: var(--ink-soft); max-width: none; }
+
+.gate__terms { font-size: 14px; color: var(--ink-soft); margin: 0; }
+.role ul { margin: 0; padding-left: 18px; font-size: 15px; color: var(--ink-soft); }
+.hero { border-bottom: 0; padding-bottom: 0; }
+.draft { letter-spacing: .2em; }
+
+/* ── team: Sign in with Bongos + in-place editing ───────── */
+.btn--ghost { background: transparent; color: var(--ink); border: 1px solid var(--rule); padding: 10px 20px; font-size: 15px; }
+.btn--ghost:hover { border-color: var(--accent); }
+.gate__team { margin-top: 36px; padding-top: 24px; border-top: 1px solid var(--rule-soft); display: flex; align-items: center; justify-content: space-between; gap: 12px; flex-wrap: wrap; font-size: 14px; color: var(--ink-soft); text-decoration: none; }
+.gate__team a { text-decoration: none; }
+
+.editbar {
+  position: sticky; top: 0; z-index: 20; display: flex; flex-wrap: wrap; align-items: center; gap: 10px 14px;
+  padding: 8px clamp(16px, 4vw, 40px); background: var(--sea); color: #fff; font-size: 14px;
+}
+.editbar ~ .top { position: static; }
+.editbar__who { font-family: var(--mono); font-size: 12px; letter-spacing: .04em; }
+.editbar__btn { font: 600 14px var(--font); border: 1px solid rgba(255,255,255,.6); background: transparent; color: #fff; border-radius: 999px; padding: 6px 14px; cursor: pointer; }
+.editbar__btn--save { background: var(--accent); border-color: var(--accent); color: var(--on-accent); }
+.editbar__btn:disabled { opacity: .6; cursor: wait; }
+.editbar__status { margin-left: auto; font-size: 13px; }
+.editbar__nums { display: flex; flex-wrap: wrap; gap: 8px 12px; width: 100%; order: 10; padding: 4px 0 2px; }
+.editbar__nums label { display: flex; align-items: center; gap: 6px; font-size: 13px; }
+.editbar__nums input { width: 9em; font: 400 14px var(--font); border: 0; border-radius: 6px; padding: 4px 8px; color: #17181a; background: #fbfafc; }
+[hidden] { display: none !important; }
+
+.is-editing [data-k] { outline: 1px dashed color-mix(in srgb, var(--sea) 55%, transparent); outline-offset: 3px; border-radius: 3px; cursor: text; }
+.is-editing [data-k]:hover { outline-style: solid; }
+.is-editing [data-k]:focus { outline: 2px solid var(--sea); }
+.is-editing [data-k].is-changed { background: color-mix(in srgb, var(--accent) 16%, transparent); }
+[data-k]:empty::before { content: attr(data-placeholder); color: var(--ink-faint); font-family: var(--mono); font-size: .82em; }
+.cite a { text-decoration: none; }
+
+/* merged text blocks */
+.prose > p:last-child { margin-bottom: 0; }
+.prose { margin-bottom: 16px; }
+.cite { margin-left: 0; }
+.tok { white-space: nowrap; }
+.is-editing .tok, .is-editing .cite { background: color-mix(in srgb, var(--sea) 18%, transparent); border-radius: 3px; padding: 0 2px; cursor: default; }
+.is-editing [data-kind="para"], .is-editing [data-kind="list"] { padding: 4px 6px; margin-left: -6px; margin-right: -6px; }

package/modules/raise/public/raise.js

@@ -0,0 +1,91 @@
+(function () {
+  // ── light / dark toggle ─────────────────────────────────
+  var root = document.documentElement;
+  var toggle = document.querySelector('[data-mode-toggle]');
+  if (toggle) toggle.addEventListener('click', function () {
+    var dark = root.getAttribute('data-mode') === 'dark' ||
+      (!root.getAttribute('data-mode') && matchMedia('(prefers-color-scheme: dark)').matches);
+    var next = dark ? 'light' : 'dark';
+    root.setAttribute('data-mode', next);
+    try { localStorage.setItem('cb-color-mode', next); } catch (e) {}
+  });
+
+  // ── progress bar ────────────────────────────────────────
+  var fill = document.querySelector('.progress__fill');
+  if (fill) requestAnimationFrame(function () { fill.style.width = (Number(fill.dataset.pct) || 0) + '%'; });
+
+  // ── section index: highlight the section in view ────────
+  var links = Array.prototype.slice.call(document.querySelectorAll('.index a'));
+  if (links.length && 'IntersectionObserver' in window) {
+    var byId = {};
+    links.forEach(function (a) { byId[a.getAttribute('href').slice(1)] = a; });
+    var io = new IntersectionObserver(function (entries) {
+      entries.forEach(function (e) {
+        if (!e.isIntersecting) return;
+        links.forEach(function (a) { a.removeAttribute('aria-current'); });
+        var a = byId[e.target.id]; if (a) a.setAttribute('aria-current', 'true');
+      });
+    }, { rootMargin: '-40% 0px -55% 0px' });
+    Object.keys(byId).forEach(function (id) { var s = document.getElementById(id); if (s) io.observe(s); });
+  }
+
+  // ── contribution calculator ─────────────────────────────
+  var calc = document.querySelector('[data-calc]');
+  if (!calc) return;
+  var cfg = JSON.parse(calc.getAttribute('data-calc'));
+  var input = calc.querySelector('[data-calc-amount]');
+  var shareEl = calc.querySelector('[data-calc-share]');
+  var equityEl = calc.querySelector('[data-calc-equity]');
+  var noteEl = calc.querySelector('[data-calc-note]');
+  var btn = calc.querySelector('[data-calc-interest]');
+  var thanks = calc.querySelector('[data-calc-thanks]');
+
+  function pct(x) {
+    var p = x * 100;
+    return (p >= 10 ? p.toFixed(1) : p >= 1 ? p.toFixed(2) : p.toFixed(3)) + '%';
+  }
+  function amount() { return Number(String(input.value).replace(/[^0-9.]/g, '')) || 0; }
+
+  function update() {
+    var a = amount();
+    var notes = [];
+    shareEl.textContent = a ? (cfg.goalUsd ? pct(a / cfg.goalUsd) : 'TBA') : '—';
+
+    var equity = null;
+    if (cfg.instrument === 'safe' && cfg.capUsd) {
+      equity = a / cfg.capUsd;
+    } else if (cfg.instrument === 'priced' && cfg.preMoneyUsd && cfg.goalUsd) {
+      equity = a / (cfg.preMoneyUsd + cfg.goalUsd);
+    }
+    equityEl.textContent = a ? (equity === null ? 'TBA' : pct(equity)) : '—';
+    noteEl.textContent = notes.join(' ');
+    btn.disabled = !a;
+  }
+
+  input.addEventListener('input', function () {
+    var digits = input.value.replace(/[^0-9]/g, '').slice(0, 9);
+    input.value = digits ? Number(digits).toLocaleString('en-US') : '';
+    thanks.hidden = true;
+    update();
+  });
+
+  btn.addEventListener('click', function () {
+    var a = amount();
+    if (!a) return;
+    btn.disabled = true;
+    fetch('/api/bongos/raise/interest', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      credentials: 'same-origin',
+      body: JSON.stringify({ amount: a })
+    }).then(function (r) {
+      if (!r.ok) throw new Error(r.status);
+      thanks.hidden = false;
+    }).catch(function () {
+      noteEl.textContent = 'Not sent. Try again.';
+      btn.disabled = false;
+    });
+  });
+
+  update();
+})();

package/modules/raise/raise.js

@@ -0,0 +1,174 @@
+// modules/raise/raise.js — the /raise investor page's pure logic (task 1004847):
+// how a block of page copy is rendered, how an edit is normalized before it is
+// stored, how the raise numbers are cleaned, and how an investor's sign-in is
+// checked. No database and no Express here, so tests/raise.mjs drives all of it.
+//
+// THE TEXT MODEL. Every piece of page copy is a plain-text block, and its key
+// says its shape:
+//   *.body / *.bio   paragraphs, one per line
+//   *.items          list items, one per line
+//   anything else    a single line (headings, labels)
+// Inside the text, {goal} {lead} {runway} show the live raise numbers, and
+// [Label] shows a citation link when settings.json lists that label. Builders
+// edit the rendered page in place; edit.js reads it back into this text.
+
+'use strict';
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const CONTENT_DIR = path.join(__dirname, 'content');
+const TOKENS = ['goal', 'lead', 'runway'];
+const SETTING_KEYS = ['goalUsd', 'committedUsd', 'lead', 'runwayYears'];
+const MAX_BLOCK = 20000;
+const EDIT_MIN_RANK = 'xenos'; // owner, 2026-10-25: any active builder may edit (no rank gate)
+
+// `_note` keys explain a content file to the person editing it; they are not data.
+function stripNotes(v) {
+  if (Array.isArray(v)) return v.map(stripNotes);
+  if (!v || typeof v !== 'object') return v;
+  return Object.fromEntries(Object.entries(v).filter(([k]) => k !== '_note').map(([k, x]) => [k, stripNotes(x)]));
+}
+const readJson = (file) => stripNotes(JSON.parse(fs.readFileSync(file, 'utf8')));
+
+// The shipped content changes only with a deploy, so it is read once, at load.
+const DEFAULT_COPY = Object.freeze(readJson(path.join(CONTENT_DIR, 'copy.json')));
+const DEFAULT_SETTINGS = readJson(path.join(CONTENT_DIR, 'settings.json'));
+const NDA_BODY = fs.readFileSync(path.join(CONTENT_DIR, 'nda.html'), 'utf8');
+const NDA_VERSION = crypto.createHash('sha256').update(NDA_BODY).digest('hex').slice(0, 12);
+/** The default copy and starting settings shipped with the module (fresh copies; callers may merge into them). */
+const defaultCopy = () => ({ ...DEFAULT_COPY });
+const defaultSettings = () => structuredClone(DEFAULT_SETTINGS);
+const ndaBody = () => NDA_BODY;
+/** A short hash of the NDA text, stored with every sign-in so we know which text was accepted. */
+const ndaVersion = () => NDA_VERSION;
+
+/**
+ * Whether a block key may be saved from the page: every key copy.json ships,
+ * plus one bio per founder in settings.json — so adding a founder there is
+ * enough to make their bio editable, with no copy.json change.
+ */
+function isEditableKey(key) {
+  if (Object.hasOwn(DEFAULT_COPY, key)) return true;
+  const m = /^founder\.(\d{1,2})\.bio$/.exec(key);
+  return !!m && Number(m[1]) >= 1 && Number(m[1]) <= (DEFAULT_SETTINGS.founders || []).length;
+}
+
+const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+const usd = (n) => '$' + Math.round(n).toLocaleString('en-US');
+const TBA = '<span class="tba">TBA</span>';
+
+/** A block's shape from its key: 'para' | 'list' | 'line'. */
+const kindOf = (key) => (/\.(body|bio)$/.test(key) ? 'para' : /\.items$/.test(key) ? 'list' : 'line');
+
+/** Clean an edited block into its stored text: one line for a line block, trimmed non-empty lines otherwise. */
+function normalizeBlock(key, raw) {
+  const t = String(raw ?? '').replace(/\r\n?/g, '\n').replace(/\u00a0/g, ' ');
+  if (kindOf(key) === 'line') return t.replace(/\s*\n\s*/g, ' ').trim();
+  return t.split('\n').map((l) => l.trim()).filter(Boolean).join('\n');
+}
+
+// One line of copy → HTML. Escaped FIRST, so nothing a builder types can become
+// markup; only the two known patterns are then turned into locked pieces that
+// edit.js reads back as {token} / [Label].
+function renderInline(line, ctx) {
+  return esc(line)
+    .replace(/\{(\w+)\}/g, (m, tok) => (TOKENS.includes(tok)
+      ? `<span class="tok" data-tok="${tok}" contenteditable="false">${ctx.tokens[tok]}</span>`
+      : m))
+    .replace(/\[([^\]\n]{1,60})\]/g, (m, label) => {
+      const url = ctx.citations[label.replace(/&amp;/g, '&')];
+      return url && /^https:\/\//.test(url)
+        ? `<sup class="cite" data-cite="${label}" contenteditable="false"><a href="${esc(url)}" target="_blank" rel="noopener noreferrer">[${label}]</a></sup>`
+        : m;
+    });
+}
+
+/** A whole block → the inner HTML of its element (paragraphs, list items, or one line). */
+function renderBlock(key, text, ctx) {
+  const v = text ?? '';
+  const kind = kindOf(key);
+  if (kind === 'line') return renderInline(v, ctx);
+  const tag = kind === 'list' ? 'li' : 'p';
+  return v.split('\n').filter(Boolean).map((l) => `<${tag}>${renderInline(l, ctx)}</${tag}>`).join('');
+}
+
+/** The rendering context: live raise numbers as HTML, and the citation table. */
+function renderContext(settings) {
+  const s = settings || {};
+  return {
+    citations: Object.fromEntries(Object.entries(s.citations || {}).filter(([k]) => k !== '_note')),
+    tokens: {
+      goal: s.goalUsd ? usd(s.goalUsd) : TBA,
+      lead: s.lead ? esc(s.lead) : TBA,
+      runway: s.runwayYears ? esc(s.runwayYears) : TBA,
+    },
+  };
+}
+
+/**
+ * Fill a view template. {{t:key}} → escaped plain text, {{b:key}} → a rendered
+ * block, {{name}} → a value from `vars` (already HTML; the caller escapes).
+ */
+function fill(tpl, vars, text = {}, ctx = null) {
+  return tpl
+    .replace(/\{\{t:([\w.]+)\}\}/g, (_, k) => esc(text[k] ?? ''))
+    .replace(/\{\{b:([\w.]+)\}\}/g, (_, k) => renderBlock(k, text[k], ctx))
+    .replace(/\{\{(\w+)\}\}/g, (_, k) => (k in vars ? vars[k] : ''));
+}
+
+/** Turn a raise number typed on the page into its stored form; '' clears it back to TBA. Throws on nonsense. */
+function cleanSetting(key, raw) {
+  if (!SETTING_KEYS.includes(key)) throw new Error(`Unknown setting: ${key}`);
+  const v = String(raw ?? '').trim();
+  if (v === '') return key === 'committedUsd' ? 0 : null;
+  if (key === 'lead') return v.slice(0, 200);
+  const n = Number(v.replace(/[$,\s]/g, ''));
+  if (!Number.isFinite(n) || n < 0 || n > 1e10) throw new Error(`${key} must be a number`);
+  return key === 'runwayYears' ? Math.round(n * 10) / 10 : Math.round(n);
+}
+
+// ── investor sign-in ──
+
+/** The value for RAISE_PASSWORD_HASH: scrypt with a random salt. */
+function hashPassword(pw) {
+  const salt = crypto.randomBytes(16);
+  return `scrypt:${salt.toString('hex')}:${crypto.scryptSync(String(pw), salt, 32).toString('hex')}`;
+}
+/** True when `pw` matches the stored scrypt hash; false for a missing or malformed hash. */
+function passwordOk(pw, stored) {
+  const [kind, saltHex, hashHex] = String(stored || '').split(':');
+  if (kind !== 'scrypt' || !/^[0-9a-f]+$/.test(saltHex || '') || !/^[0-9a-f]{64}$/.test(hashHex || '')) return false;
+  const want = Buffer.from(hashHex, 'hex');
+  const got = crypto.scryptSync(String(pw ?? ''), Buffer.from(saltHex, 'hex'), want.length);
+  return crypto.timingSafeEqual(want, got);
+}
+
+const validLinkedin = (u) => /^https?:\/\/([a-z]{2,3}\.)?linkedin\.com\/in\/[^\s/?#]+\/?(\?.*)?$/i.test(String(u || ''));
+
+/** Validate the gate form; returns { ok, value } or { error } with a message fit to show the visitor. */
+function normalizeSignin(form) {
+  const name = String(form.name || '').trim().replace(/\s+/g, ' ');
+  const linkedin = String(form.linkedin || '').trim();
+  if (name.length < 2 || name.length > 120) return { error: 'Enter your full name.', value: { name, linkedin } };
+  if (!validLinkedin(linkedin)) return { error: 'Enter your LinkedIn profile link (linkedin.com/in/…).', value: { name, linkedin } };
+  return { ok: true, value: { name, linkedin } };
+}
+
+/** A fresh opaque investor session token and the hash that is stored for it. */
+function newSessionToken() {
+  const token = crypto.randomBytes(32).toString('base64url');
+  return { token, hash: hashToken(token) };
+}
+const hashToken = (t) => crypto.createHash('sha256').update(String(t)).digest('hex');
+
+/** Visitor-typed text going into Discord: no pings, no formatting. */
+const plainForDiscord = (s) => String(s).replace(/[\\`*_~|>@#[\]()]/g, (c) => '\\' + c).slice(0, 300);
+
+module.exports = {
+  TOKENS, SETTING_KEYS, MAX_BLOCK, EDIT_MIN_RANK, TBA,
+  defaultCopy, defaultSettings, ndaBody, ndaVersion, isEditableKey,
+  esc, usd, kindOf, normalizeBlock, renderInline, renderBlock, renderContext, fill, cleanSetting,
+  hashPassword, passwordOk, validLinkedin, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
+};

package/modules/raise/routes/raise.js

@@ -0,0 +1,152 @@
+// modules/raise/routes/raise.js — every write the /raise investor page makes
+// (task 1004847), plus the registration of the `raise.web` port that serves the
+// page itself (web.js).
+//
+//   POST /raise/enter     an investor signs in (name, LinkedIn, password) — form post
+//   POST /raise/interest  a signed-in investor names a non-binding amount
+//   POST /raise/edit      a builder saves edits to the page copy and raise numbers
+//
+// The investor's password is the instance's RAISE_PASSWORD_HASH (scrypt, made
+// with raise.js hashPassword — the module CLAUDE.md has the one-liner) — never
+// stored in git.
+
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const R = require('../raise');
+const P = require('../page');
+const db = require('../db');
+const web = require('../web');
+
+const log = api.logger('raise');
+// req.ip only: the platform trusts exactly one proxy hop ('trust proxy' 1), so
+// this is the address the proxy chain vouches for. A raw header such as
+// X-Real-IP is whatever the client typed, and keying the limit on it would let
+// every attempt claim a fresh address.
+const ipOf = (req) => String(req.ip || '').slice(0, 64);
+
+// A wrong password costs an attempt; ten in fifteen minutes from one address
+// pauses that address. In memory: a restart forgives, which is fine for a gate
+// whose password is shared by hand.
+const WINDOW_MS = 15 * 60e3;
+const attempts = new Map();
+let lastSweep = 0;
+function tooManyAttempts(ip) {
+  const now = Date.now();
+  // Drop every address whose attempts have all aged out, at most once a minute,
+  // so one-off visitors do not accumulate for the life of the process.
+  if (now - lastSweep > 60e3) {
+    lastSweep = now;
+    for (const [k, list] of attempts) if (!list.some((t) => now - t < WINDOW_MS)) attempts.delete(k);
+  }
+  const list = (attempts.get(ip) || []).filter((t) => now - t < WINDOW_MS);
+  if (list.length) attempts.set(ip, list); else attempts.delete(ip);
+  return list.length >= 10;
+}
+function failAttempt(ip) {
+  const list = attempts.get(ip) || [];
+  list.push(Date.now());
+  attempts.set(ip, list);
+}
+
+module.exports = function buildRaiseRouter() {
+  // The page is served through a port, not a route: it answers on the apex at
+  // /raise, outside the /api/bongos mount. hasProvider-guarded because the loader
+  // runs this factory again whenever a test rebuilds the router.
+  if (!api.hasProvider('raise.web')) api.registerProvider('raise.web', web);
+
+  const router = express.Router();
+  const form = express.urlencoded({ extended: false, limit: '8kb' });
+  const small = express.json({ limit: '1kb' });
+  const big = express.json({ limit: '256kb' });
+
+  // rank: public — the investor sign-in: an authentication entry point gated by
+  //   the shared password itself (scrypt-checked, attempts limited per address).
+  router.post('/raise/enter', form, async (req, res) => {
+    if (api.validateOrRespond(req, res, {
+      name: { type: 'string', maxLength: 200 },
+      linkedin: { type: 'string', maxLength: 500 },
+      password: { type: 'string', maxLength: 200 },
+    })) return;
+    const ip = ipOf(req);
+    P.pageHeaders(res);
+    const gate = (status, msg, values) => res.status(status).type('html').send(P.renderGate(msg, values));
+    const v = R.normalizeSignin(req.body || {});
+    if (tooManyAttempts(ip)) return gate(429, 'Too many attempts. Try again in 15 minutes.', v.value);
+    if (v.error) return gate(400, v.error, v.value);
+    if (!R.passwordOk(req.body.password, process.env.RAISE_PASSWORD_HASH)) {
+      failAttempt(ip);
+      return gate(401, 'That password isn’t right.', v.value);
+    }
+    try {
+      const { token, hash } = R.newSessionToken();
+      const ndaVersion = R.ndaVersion();
+      // signing in is the NDA acceptance ("By signing in you accept terms of non-disclosure.")
+      // one transaction: a sign-in row never exists without its session
+      await api.withTx((client) => db.createSignin({
+        ...v.value, ndaVersion, ip, userAgent: String(req.headers['user-agent'] || '').slice(0, 400),
+        tokenHash: hash, days: P.INVESTOR_DAYS,
+      }, (text, params) => client.query(text, params)));
+      P.notify(`**Raise page sign-in:** ${R.plainForDiscord(v.value.name)} — <${R.plainForDiscord(v.value.linkedin)}> (accepted NDA ${ndaVersion})`);
+      res.set('Set-Cookie', P.sessionCookie(token, P.INVESTOR_DAYS * 86400, req.secure));
+      return res.redirect(303, P.BASE);
+    } catch (err) {
+      log.error({ err }, 'raise: sign-in failed');
+      return gate(500, 'Something went wrong. Try again.', v.value);
+    }
+  });
+
+  // rank: public — a signed-in INVESTOR's non-binding indication; investors are
+  //   not builders, so the gate is the raise session cookie, checked here.
+  router.post('/raise/interest', small, async (req, res) => {
+    if (api.validateOrRespond(req, res, { amount: { required: true, type: 'number' } })) return;
+    const investor = await P.readInvestor(req);
+    if (!investor) return res.fail('cookie_required', 401);
+    const amount = Math.round(Number(req.body && req.body.amount));
+    if (!Number.isFinite(amount) || amount < 1 || amount > 100e6) return res.fail('invalid_raise_amount', 400);
+    await db.recordInterest({ signinId: investor.signin_id, name: investor.name, amountUsd: amount, ip: ipOf(req) });
+    P.notify(`**Raise interest (non-binding):** ${R.plainForDiscord(investor.name)} — ${R.usd(amount)}`);
+    return res.json({ ok: true });
+  });
+
+  // Any active builder may edit (owner, 2026-10-25) — requireRank at the lowest
+  // rank is "signed in and active", with the full deny gates of requireBuilder.
+  // The custom header + JSON body mean a form on another site cannot submit it.
+  router.post('/raise/edit', api.requireBuilder, api.requireRank(R.EDIT_MIN_RANK), big, async (req, res) => {
+    if (req.headers['x-raise-edit'] !== '1') return res.fail('raise_edit_header_required', 400);
+    // copy/settings are dynamic-key maps; each key and value is checked below
+    // against content/copy.json and SETTING_KEYS before anything is written.
+    if (api.validateOrRespond(req, res, { copy: { type: 'object' }, settings: { type: 'object' } })) return;
+    const body = req.body || {};
+    const copyIn = body.copy && typeof body.copy === 'object' ? body.copy : {};
+    const numsIn = body.settings && typeof body.settings === 'object' ? body.settings : {};
+    const defaults = R.defaultCopy();
+    const { copy: current, settings } = await P.loadState();
+    const copy = [];
+    const nums = [];
+    for (const [key, raw] of Object.entries(copyIn)) {
+      if (!R.isEditableKey(key)) return res.fail('invalid_raise_block', 400, { key });
+      const after = R.normalizeBlock(key, raw);
+      if (after.length > R.MAX_BLOCK) return res.fail('raise_block_too_long', 400, { key });
+      if (after === (current[key] ?? '')) continue;
+      copy.push({ key, before: current[key] ?? '', after, revert: after === (defaults[key] ?? '') });
+    }
+    for (const [key, raw] of Object.entries(numsIn)) {
+      let after;
+      try { after = R.cleanSetting(key, raw); } catch (e) { return res.fail('invalid_raise_setting', 400, { key, message: e.message }); }
+      if (after === (settings[key] ?? null)) continue;
+      nums.push({ key, before: settings[key] ?? null, after });
+    }
+    const changed = copy.length + nums.length;
+    if (!changed) return res.json({ ok: true, changed: 0 });
+    await api.withTx((client) => db.applyEdits(client, {
+      builderId: req.builder.id, login: req.builder.github_login, copy, settings: nums,
+    }));
+    const keys = [...copy.map((c) => c.key), ...nums.map((s) => `settings.${s.key}`)];
+    P.notify(`**Raise page edited** by @${R.plainForDiscord(req.builder.github_login)} — ${changed} change${changed === 1 ? '' : 's'}: ${R.plainForDiscord(keys.join(', '))}`);
+    return res.json({ ok: true, changed });
+  });
+
+  return router;
+};