@bongos/core 1.21.31 → 1.21.32

package/modules/hall-ui/public/roadmap.js

@@ -147,6 +147,59 @@
     return `<a class="rm-gmore" href="${tasksLink(v.id)}" aria-label="${escapeHtml(label)}" title="${escapeHtml(label)}">View tasks ${arrowSvg}</a>`;
   }
 
+  // The focus star (task 1004551). The focus version is the project's default — chosen by
+  // an Archon here, stored server-side, never inferred. Filled = current focus. Archons
+  // get a button that sets/clears it; everyone else gets the same star read-only. The
+  // button is a convenience: PUT /versions/focus refuses non-Archons on the server.
+  const focus = { id: null, canSet: false };
+  const FOCUS_FAIL = 'Could not change the focus version. Reload and try again.';
+  function starHtml(v) {
+    const on = focus.id === v.id;
+    const glyph = on ? '★' : '☆';
+    const base = `class="rm-star${on ? ' rm-star--on' : ''}" data-vid="${escapeHtml(v.id)}"`;
+    if (focus.canSet) {
+      const tip = on ? 'Clear the focus version.' : 'Make this the project’s focus version.';
+      return `<button type="button" ${base} aria-pressed="${on}" title="${tip}" aria-label="${tip}">${glyph}</button>`;
+    }
+    const tip = (on ? 'This is the project’s focus version. ' : 'Not the focus version. ') + 'Only an Archon can set the focus.';
+    return `<span ${base} role="img" title="${tip}" aria-label="${tip}">${glyph}</span>`;
+  }
+
+  // Never throws except to hand a sign-in redirect back to boot(); a failed focus read
+  // just means no star is lit.
+  async function loadFocus() {
+    try {
+      const f = await getJSON(`${API}/versions/focus`);
+      focus.id = f.focus_version_id || null;
+      focus.canSet = f.can_set === true;
+    } catch (err) {
+      if (err && err.message === 'redirecting to auth') throw err;
+      focus.id = null; focus.canSet = false;
+    }
+  }
+
+  // Flip the stars in place: the PUT already answered with the new focus, so there is
+  // nothing to refetch.
+  function paintStars() {
+    document.querySelectorAll('.rm-star').forEach((el) => {
+      const tmp = document.createElement('div');
+      tmp.innerHTML = starHtml({ id: el.dataset.vid });
+      el.replaceWith(tmp.firstElementChild);
+    });
+  }
+
+  async function toggleFocus(vid) {
+    const next = focus.id === vid ? null : vid;
+    const res = await api.request('PUT', `${API}/versions/focus`, { body: { version_id: next } });
+    if (!res.ok) {
+      const e = res.data && res.data.error;
+      toast((e && e.message) || FOCUS_FAIL);
+      return;
+    }
+    focus.id = res.data.focus_version_id || null;
+    paintStars();
+  }
+
   // ---- card renderers -------------------------------------------------------
 
   function featCard(v) {
@@ -155,7 +208,7 @@
         <div class="rm-featgrid__l">
           <div class="rm-feat-top">
             <div class="rt">
-              <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+              <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
               <h3 class="rm-name">${escapeHtml(v.name)}</h3>
               <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
             </div>
@@ -176,7 +229,7 @@
     return `<article class="rm-card">
       <div class="rm-feat-top">
         <div class="rt">
-          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
           <h3 class="rm-name">${escapeHtml(v.name)}</h3>
           <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
         </div>
@@ -218,7 +271,7 @@
     return `<article class="rm-card rm-card--staged" style="grid-column:1 / -1">
       <div class="rm-featgrid">
         <div class="rm-featgrid__l">
-          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
           <h3 class="rm-name">${escapeHtml(v.name)}</h3>
           <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
           <div class="rm-staged-state">
@@ -236,7 +289,7 @@
     return `<article class="rm-card rm-card--parked" style="grid-column:1 / -1">
       <div class="rm-feat-top">
         <div class="rt">
-          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span></div>
+          <div class="rm-row">${phase(v)}<span class="rm-id">${escapeHtml(v.id)}</span>${starHtml(v)}</div>
           <h3 class="rm-name">${escapeHtml(v.name)}</h3>
           <p class="rm-desc rm-desc--clamp">${escapeHtml(v.desc)}</p>
         </div>
@@ -381,9 +434,10 @@
   async function render() {
     const root = $('#rm-root');
     const [progress, versions] = await Promise.all([
+      loadFocus(),
       getJSON(`${API}/public/progress`).then((d) => d.progress || []),
       getJSON(`${API}/public/versions`).then((d) => d.versions || []).catch(() => []),
-    ]);
+    ]).then(([, p, v]) => [p, v]);
     const all = mergeVersions(progress, versions);
 
     // Goal summaries only for versions we actually show goals on (everything but
@@ -442,5 +496,10 @@
     }
   }
 
+  document.addEventListener('click', (e) => {
+    const b = e.target.closest && e.target.closest('button.rm-star');
+    if (b) toggleFocus(b.dataset.vid).catch(() => toast(FOCUS_FAIL));
+  });
+
   boot();
 })();

package/modules/lifecycle/routes/versions.js

@@ -45,6 +45,26 @@ module.exports = function buildVersionsRouter() {
     res.json({ versions: all.slice(offset, offset + limit), page: api.pageMeta(limit, offset, all.length) });
   });
 
+  // The project's focus version (task 1004551) — the one the Roadmap stars. Read: any signed-in builder. Write: Archon only,
+  // enforced here on the server, not just by the button hiding. No row = no focus.
+  // rank: any-builder — read-only; returns { focus_version_id: string|null, can_set }.
+  // can_set tells the page whether to draw a button — a hint only; PUT is the gate.
+  router.get('/versions/focus', auth.requireBuilder, asyncHandler('GET /versions/focus', async (req, res) => {
+    const rank = String((req.builder && req.builder.rank) || '').toLowerCase();
+    res.json({ focus_version_id: await api.projectSettings.getFocusVersionId(), can_set: rank === 'archon' });
+  }, { message: false }));
+
+  // rank: archon (atom version.focus.set, system) — body { version_id } sets the focus; { version_id: null } clears it.
+  // An unknown version id is refused rather than stored.
+  router.put('/versions/focus', auth.requireBuilder, auth.requirePermission('version.focus.set'), asyncHandler('PUT /versions/focus', async (req, res) => {
+    if (validateOrRespond(req, res, { version_id: { type: 'string', maxLength: 64 } })) return;
+    const raw = (req.body || {}).version_id;
+    if (raw === undefined || (raw !== null && !raw.trim())) return res.fail('bad_version_id', { status: 400, message: 'Pick a version to star, or send null to clear the focus.' });
+    if (raw !== null && !(await db.getVersion(raw.trim()))) return res.fail('unknown_version', { status: 404, message: `There is no version "${raw.trim()}" to star.` });
+    const focus = await api.projectSettings.setFocusVersionId(raw === null ? null : raw.trim(), req.builder && req.builder.id);
+    res.json({ ok: true, focus_version_id: focus });
+  }, { message: false }));
+
   // rank: public — read-only progress aggregate; mirrors /public/progress.
   router.get('/versions/progress', async (_req, res) => {
     const progress = await db.versionProgress();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.31",
+  "version": "1.21.32",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.31",
+      "version": "1.21.32",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.31",
+  "version": "1.21.32",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8942,5 +8942,11 @@
       "id": "1004550",
       "text": "Setting up a new project is quicker: the final check screen now takes one click to accept, with less text and no per-row confirm buttons."
     }
+  ],
+  "1.21.32": [
+    {
+      "id": "1004551",
+      "text": "An Archon can star a version on the Roadmap as the project's focus; it persists across reloads, and everyone else sees the star read-only (the server refuses non-Archons)."
+    }
   ]
 }

package/src/bongos/project-settings.js

@@ -48,6 +48,7 @@ const { logger } = require('./logger');
 // cannot collide with this one.
 const SETTING_KEYS = {
   ROT_DAYS: 'attention.rot_days',
+  FOCUS_VERSION: 'roadmap.focus_version',
 };
 
 // The last-resort rot timer, in days. 30 because that is the shortest window in
@@ -176,6 +177,31 @@ function describeRotTimer(resolved) {
   return `${base} — ignoring ${r.invalid.where}="${r.invalid.raw}" (${r.invalid.reason})`;
 }
 
+// getFocusVersionId() — the version the project is focused on, or null.
+// NO ROW (or an empty value) MEANS NO FOCUS: the focus is chosen by an Archon in the
+// UI (task 1004551), never inferred in code, so absence is an answer and a default is
+// never seeded. Whether the id still names a real version is the caller's concern —
+// the write path refuses unknown ids, and a reader of a since-deleted version simply
+// finds no card to star.
+async function getFocusVersionId() {
+  const row = await getSetting(SETTING_KEYS.FOCUS_VERSION);
+  return row && row.value ? String(row.value) : null;
+}
+
+// setFocusVersionId(versionId, builderId) — set the focus, or clear it with null.
+// Clearing deletes the row rather than storing '' so "never set" and "cleared" are the
+// same state, as the null-is-meaningful rule on getSetting requires.
+async function setFocusVersionId(versionId, builderId = null) {
+  if (versionId == null || versionId === '') {
+    await pool.query('DELETE FROM project_settings WHERE key = $1', [SETTING_KEYS.FOCUS_VERSION]);
+    // The row is gone, so updated_by cannot say who cleared it; the log line does.
+    logger.info(`project focus version cleared by builder ${builderId == null ? 'unknown' : builderId}`);
+    return null;
+  }
+  await setSetting(SETTING_KEYS.FOCUS_VERSION, versionId, builderId);
+  return String(versionId);
+}
+
 // parseDays is exported for the tests only — the range check and the default are
 // asserted against the SAME constants the resolver reads, because a test that
 // re-typed 30 or 365 would be the second copy of the number this file exists to
@@ -190,4 +216,6 @@ module.exports = {
   setSetting,
   resolveRotDays,
   describeRotTimer,
+  getFocusVersionId,
+  setFocusVersionId,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.31'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.32'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -444,6 +444,8 @@ module.exports = {
     get KEYS() { return require('./bongos/project-settings').SETTING_KEYS; },
     get get() { return require('./bongos/project-settings').getSetting; },
     get set() { return require('./bongos/project-settings').setSetting; },
+    get getFocusVersionId() { return require('./bongos/project-settings').getFocusVersionId; },
+    get setFocusVersionId() { return require('./bongos/project-settings').setFocusVersionId; },
     get describeRotTimer() { return require('./bongos/project-settings').describeRotTimer; },
     // The RANGE CHECK, shared rather than re-typed. The settings page validates a
     // submitted timer with the very parser the resolver reads it back through, so the

package/tests/focus_version.mjs

@@ -0,0 +1,96 @@
+// tests/focus_version.mjs — the roadmap focus star (task 1004551): the settings accessor,
+// the Archon-only write route and the any-builder read, run against a fake pool and fake
+// requests. No DB needed.
+//
+// Run:  node --test tests/focus_version.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+process.env.NODE_ENV = 'test';
+const require = createRequire(import.meta.url);
+
+// A one-table fake pool, installed before project-settings loads.
+const store = new Map();
+const poolPath = require.resolve('../src/bongos/pool.js');
+require(poolPath);
+require.cache[poolPath].exports.pool = {
+  async query(sql, p) {
+    if (/^\s*SELECT/i.test(sql)) { const v = store.get(p[0]); return { rows: v == null ? [] : [{ key: p[0], value: v }] }; }
+    if (/^\s*INSERT/i.test(sql)) { store.set(p[0], p[1]); return { rows: [{ key: p[0], value: p[1] }] }; }
+    if (/^\s*DELETE/i.test(sql)) { store.delete(p[0]); return { rows: [] }; }
+    throw new Error(`unexpected sql: ${sql}`);
+  },
+};
+const ps = require('../src/bongos/project-settings.js');
+const db = require('../modules/lifecycle/db.js');
+const router = require('../modules/lifecycle/routes/versions.js')();
+
+const src = (rel) => readFileSync(new URL('../' + rel, import.meta.url), 'utf8');
+db.getVersion = async (id) => (id === 'BONGOS-V2' ? { id } : null);
+
+// The route's own handler is the LAST layer on its stack (after the auth middleware).
+function handler(method, path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods[method]);
+  assert.ok(layer, `${method} ${path} is registered`);
+  return { chain: layer.route.stack, last: layer.route.stack[layer.route.stack.length - 1].handle };
+}
+async function call(method, path, req) {
+  const out = { status: 200, body: null };
+  const res = {
+    status(n) { out.status = n; return this; },
+    json(b) { out.body = b; return this; },
+    fail(code, o) { const a = typeof o === 'number' ? { status: o } : (o || {}); out.status = a.status; out.body = { error: { code, message: a.message || code } }; return this; },
+  };
+  await handler(method, path).last({ body: {}, builder: { id: 9, rank: 'archon' }, ...req }, res, (e) => { throw e; });
+  return out;
+}
+
+test('no row means no focus', async () => {
+  store.clear();
+  assert.equal(await ps.getFocusVersionId(), null);
+});
+
+test('PUT stores a known version and GET returns it', async () => {
+  store.clear();
+  const put = await call('put', '/versions/focus', { body: { version_id: 'BONGOS-V2' } });
+  assert.equal(put.body.focus_version_id, 'BONGOS-V2');
+  assert.equal(store.get(ps.SETTING_KEYS.FOCUS_VERSION), 'BONGOS-V2');
+  const got = await call('get', '/versions/focus', {});
+  assert.deepEqual(got.body, { focus_version_id: 'BONGOS-V2', can_set: true });
+});
+
+test('PUT with null clears the focus (the row is gone, not blank)', async () => {
+  store.set(ps.SETTING_KEYS.FOCUS_VERSION, 'BONGOS-V2');
+  const put = await call('put', '/versions/focus', { body: { version_id: null } });
+  assert.equal(put.body.focus_version_id, null);
+  assert.equal(store.has(ps.SETTING_KEYS.FOCUS_VERSION), false);
+});
+
+test('an unknown version is refused with a readable message and nothing is stored', async () => {
+  store.clear();
+  const put = await call('put', '/versions/focus', { body: { version_id: 'NOPE' } });
+  assert.equal(put.status, 404);
+  assert.match(put.body.error.message, /NOPE/);
+  assert.equal(store.size, 0);
+});
+
+test('a missing or blank version_id is refused, not treated as a clear', async () => {
+  for (const body of [{}, { version_id: '  ' }]) {
+    const put = await call('put', '/versions/focus', { body });
+    assert.equal(put.status, 400);
+  }
+});
+
+test('a non-Archon reads the focus but is told it cannot set it', async () => {
+  store.set(ps.SETTING_KEYS.FOCUS_VERSION, 'BONGOS-V2');
+  const got = await call('get', '/versions/focus', { builder: { id: 4, rank: 'metic' } });
+  assert.deepEqual(got.body, { focus_version_id: 'BONGOS-V2', can_set: false });
+});
+
+test('the write route carries the Archon-only permission gate; the read route does not', () => {
+  assert.match(src('modules/lifecycle/routes/versions.js'), /router\.put\('\/versions\/focus',\s*auth\.requireBuilder,\s*auth\.requirePermission\('version\.focus\.set'\)/);
+  assert.doesNotMatch(src('modules/lifecycle/routes/versions.js').match(/router\.get\('\/versions\/focus',[^\n]*/)[0], /requireRank/);
+});