@bongos/core 1.21.74 → 1.21.76

package/tests/hall_studio_home.mjs

@@ -418,12 +418,50 @@ try {
     assert.equal(none.el('st-older').hidden, true, 'no review waiting: no door');
   });
 
+  await test('From the live site (task 1004499): the public pages\' reviews, each opening its doc here', async () => {
+    const N = require('../modules/page-notes/notes.js');
+    // the route's own mapper over two listForSurface rows
+    const rows = [
+      { id: 31, page_id: 'site:projects', page_path: '/projects', page_title: 'Projects', status: 'filed', submitted_at: day(1), idea_ids: [1, 2], author_name: 'Ana', excerpt: 'The map labels <b>overlap</b>.\n![shot](/api/bongos/page-notes/images/4)' },
+      { id: 32, page_id: 'site:home', page_path: '/', page_title: '', status: 'splitting', submitted_at: day(0), idea_ids: [], author_name: 'Bo', excerpt: 'Hero is too dark.' },
+    ].map(N.siteListItem);
+    const s = bootStudio({ answers: { ...HOME, 'GET /page-notes/site': ok({ notes: rows }) } });
+    await s.settle();
+    assert.equal(s.el('st-site-detail').textContent, '2 reviews from the live site');
+    await s.click('st-site');
+    assert.equal(s.el('st-panel-title').textContent, 'From the live site');
+    const body = s.el('st-panel-body').innerHTML;
+    assert.deepEqual([...body.matchAll(/class="st-site" href="([^"]*)"/g)].map((m) => m[1]), ['/builders/studio?note=31', '/builders/studio?note=32'], 'each row opens its doc in the Studio');
+    assert.match(body, /st-site__page">Projects</);
+    assert.match(body, /st-site__page">\/</, 'an untitled page falls back to its path');
+    assert.match(body, /Ana · [^<]* · 2 ideas/);
+    assert.match(body, /Bo · [^<]* · splitting/);
+    assert.match(body, /The map labels &lt;b&gt;overlap&lt;\/b&gt;\. \[image\]</, 'the excerpt is escaped and its picture named, not shown');
+    const long = bootStudio({ answers: { ...HOME, 'GET /page-notes/site': ok({ notes: [{ ...rows[1], excerpt: 'word '.repeat(60) }] }) } });
+    await long.settle();
+    await long.click('st-site');
+    const cut = /st-site__text">([^<]*)</.exec(long.el('st-panel-body').innerHTML)[1];
+    assert.ok(cut.length <= 140 && /word…$/.test(cut), `a long excerpt ends on a whole word and says it goes on: ${cut}`);
+    await s.clickIn('st-panel', '[data-close-panel]');
+
+    const none = bootStudio({ answers: { ...HOME, 'GET /page-notes/site': ok({ notes: [] }) } });
+    await none.settle();
+    assert.equal(none.el('st-site-detail').textContent, 'no reviews from the live site yet');
+    await none.click('st-site');
+    assert.match(none.el('st-panel-body').innerHTML, /None yet\./);
+
+    const down = bootStudio({ answers: HOME });
+    await down.settle();
+    await down.click('st-site');
+    assert.match(down.el('st-panel-body').innerHTML, /could not be read just now/);
+  });
+
   await test('the markup: one h1 (the greeting), the tally and four doors, the libs before the page, the full-screen switch', () => {
     const nc = HTML.replace(/<!--[\s\S]*?-->/g, '');
     assert.equal((nc.match(/<h1\b/g) || []).length, 1);
     assert.match(nc, /<h1[^>]*id="studio-greet"[^>]*data-words/);
     assert.match(nc, /<p[^>]*id="studio-sub"[^>]*data-words/);
-    for (const id of ['st-tally', 'st-resume', 'st-flow', 'studio-approvals', 'st-status', 'st-older']) assert.match(nc, new RegExp(`id="${id}"`));
+    for (const id of ['st-tally', 'st-resume', 'st-flow', 'studio-approvals', 'st-status', 'st-site', 'st-older']) assert.match(nc, new RegExp(`id="${id}"`));
     assert.match(nc, /<body[^>]*data-fullscreen-switch/);
     const at = (f) => nc.indexOf(f);
     assert.ok(at('tweak-editor-lib.js') < at('studio-lib.js') && at('studio-lib.js') < at('/studio.js'), 'the libs, then the page');

package/tests/landing_legal_pages.mjs

@@ -206,7 +206,8 @@ for (const p of PAGES) {
     const html = read(p.file);
     const styles = [...html.matchAll(/<style>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
     assert.doesNotMatch(styles, /\.(shell|bar|barMark|barLeft|barRight|trig|who|signinDoor|menuBand|band[A-Z]\w*)\b[^{}]*\{/, 'no bar or band rule in the page');
-    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
+    // then the Artist review button's loader (task 1004499), the page's last tag
+    assert.match(html, /<\/footer>\n<script src="\/assets\/hub-bar\.js"><\/script>\n<!-- [^\n]*-->\n<script src="\/assets\/artist-review\.js" data-hall="\{\{buildersOrigin\}\}"><\/script>\n<\/body>/, 'one shared script, after the markup it drives');
     assert.doesNotMatch(html, /<script>/, 'and no inline copy of the bands');
     assert.match(html, /<a data-link-hall href="\{\{buildersOrigin\}\}">Builders' hall<\/a><\/nav><\/footer>/, 'the hall keeps a door in the footer row now the bar has no Hall pill, as on /account');
   });

package/tests/module_store_listing.mjs

@@ -0,0 +1,156 @@
+// tests/module_store_listing.mjs — the store catalog under the quality floor (task
+// 1003807, criterion wa5-curated-listing, ADR 0343 D2/D5). Two halves, no port and
+// no real DB:
+//   - the rule: placeVersion, pure — the Security gate excludes, "New" is listed
+//     unranked, a real score must reach the floor;
+//   - the route: the real GET /store/modules handler off the real router, with
+//     pool.js replaced in the require cache (the module_upgrade_updates.mjs harness).
+//
+// Run:  node tests/module_store_listing.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+// ---- the fake registry the route reads ----
+const state = { modules: {}, versions: [], scores: [] };
+const pool = {
+  async query(sql, params = []) {
+    if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
+      return {
+        rows: state.versions
+          .filter((v) => state.modules[v.module_key] && state.modules[v.module_key].status === 'listed')
+          .map((v) => ({ ...v, version_id: v.id, title: state.modules[v.module_key].title })),
+      };
+    }
+    if (/FROM module_assessment_scores/.test(sql)) {
+      const ids = params[0].map(String);
+      const newest = new Map();
+      for (const s of state.scores) {
+        if (!ids.includes(String(s.version_id))) continue;
+        const have = newest.get(s.version_id);
+        if (!have || s.computed_at > have.computed_at || (s.computed_at === have.computed_at && s.id > have.id)) newest.set(s.version_id, s);
+      }
+      return { rows: [...newest.values()] };
+    }
+    return { rows: [] };
+  },
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
+
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const { QUALITY_FLOOR, placeVersion } = require('../src/bongos/module-listing.js');
+
+function handlerFor(router, method, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, names: stack.map((s) => s.name) };
+}
+
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined, headers: {},
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set(k, v) { this.headers[k] = v; return this; },
+    fail(code, opts) { this.statusCode = opts.status; this.body = { error: code, ...opts }; return this; },
+  };
+  let nextErr = null;
+  await handle(req, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+const score = (extra = {}) => ({ overall: 70, security_passed: true, is_new: false, ...extra });
+
+// ---------------------------------------------------------------------------
+// the rule (pure)
+// ---------------------------------------------------------------------------
+
+test('the floor is 50 out of 100 (owner decision, 2026-10-01)', () => {
+  assert.equal(QUALITY_FLOOR, 50);
+});
+
+test('placeVersion: the Security gate must have PASSED — false or not run yet excludes', () => {
+  assert.equal(placeVersion(score({ security_passed: false })).placement, 'excluded');
+  assert.equal(placeVersion(score({ security_passed: null })).placement, 'excluded');
+  assert.equal(placeVersion(score({ security_passed: false, is_new: true })).placement, 'excluded');
+  assert.equal(placeVersion(score({ security_passed: false })).reason, 'security_not_passed');
+});
+
+test('placeVersion: no score row at all is excluded, not failed silently', () => {
+  assert.deepEqual(placeVersion(null), { placement: 'excluded', reason: 'not_assessed' });
+});
+
+test('placeVersion: a New version that passed the gate is listed as new, whatever its number', () => {
+  assert.equal(placeVersion(score({ is_new: true, overall: 10 })).placement, 'new');
+  assert.equal(placeVersion(score({ is_new: true, overall: null })).placement, 'new');
+});
+
+test('placeVersion: a scored version must reach the floor — at the floor is in, one below is out', () => {
+  assert.equal(placeVersion(score({ overall: 50 })).placement, 'listed');
+  assert.equal(placeVersion(score({ overall: 100 })).placement, 'listed');
+  assert.deepEqual(placeVersion(score({ overall: 49 })), { placement: 'excluded', reason: 'below_floor' });
+  assert.equal(placeVersion(score({ overall: null })).placement, 'excluded');
+});
+
+// ---------------------------------------------------------------------------
+// the route
+// ---------------------------------------------------------------------------
+
+test('GET /store/modules: any signed-in builder, no extra permission', () => {
+  const { names } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  assert.equal(names.length, 2, `expected requireBuilder + handler, got ${names.join(', ')}`);
+});
+
+test('GET /store/modules: lists by the newest version\'s current score, drops what falls short', async () => {
+  state.modules = {
+    good: { status: 'listed', title: 'Good' },
+    fresh: { status: 'listed', title: 'Fresh' },
+    low: { status: 'listed', title: 'Low' },
+    unsafe: { status: 'listed', title: 'Unsafe' },
+    unscored: { status: 'listed', title: 'Unscored' },
+    gone: { status: 'delisted', title: 'Gone' },
+    fixed: { status: 'listed', title: 'Fixed' },
+  };
+  state.versions = [
+    { id: 1, module_key: 'good', version: '1.9.0', published_at: 't1' },
+    { id: 2, module_key: 'good', version: '1.10.0', published_at: 't2' },
+    { id: 3, module_key: 'fresh', version: '0.1.0', published_at: 't3' },
+    { id: 4, module_key: 'low', version: '1.0.0', published_at: 't4' },
+    { id: 5, module_key: 'unsafe', version: '1.0.0', published_at: 't5' },
+    { id: 6, module_key: 'unscored', version: '1.0.0', published_at: 't6' },
+    { id: 7, module_key: 'gone', version: '1.0.0', published_at: 't7' },
+    { id: 8, module_key: 'fixed', version: '2.0.0', published_at: 't8' },
+  ];
+  state.scores = [
+    { id: 1, version_id: 1, computed_at: 1, ...score({ overall: 20 }) }, // an OLDER version scored low
+    { id: 2, version_id: 2, computed_at: 1, ...score({ overall: 80 }) },
+    { id: 3, version_id: 3, computed_at: 1, ...score({ is_new: true, overall: 30 }) },
+    { id: 4, version_id: 4, computed_at: 1, ...score({ overall: 49 }) },
+    { id: 5, version_id: 5, computed_at: 1, ...score({ overall: 95, security_passed: false }) },
+    { id: 6, version_id: 7, computed_at: 1, ...score({ overall: 99 }) },
+    { id: 7, version_id: 8, computed_at: 1, ...score({ overall: 40 }) }, // superseded by the newer row
+    { id: 8, version_id: 8, computed_at: 2, ...score({ overall: 60 }) },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const res = await invoke(handle, {});
+  assert.equal(res.statusCode, 200);
+  assert.equal(res.headers['Cache-Control'], 'no-store');
+  assert.equal(res.body.floor, 50);
+  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['fixed', '2.0.0', 60], ['good', '1.10.0', 80]]);
+  assert.deepEqual(res.body.new.map((m) => [m.key, m.is_new, m.overall]), [['fresh', true, null]]);
+  const all = [...res.body.listed, ...res.body.new].map((m) => m.key);
+  for (const k of ['low', 'unsafe', 'unscored', 'gone']) assert.ok(!all.includes(k), `${k} must not be listed`);
+});
+
+test('GET /store/modules: an empty store answers empty lists and the floor', async () => {
+  state.modules = {}; state.versions = []; state.scores = [];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const res = await invoke(handle, {});
+  assert.deepEqual(res.body, { floor: 50, listed: [], new: [] });
+});

package/tests/page_notes_db.mjs

@@ -54,8 +54,11 @@ await pool.query('INSERT INTO builders (id, github_login, display_name) VALUES (
 
 const MIGRATION = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_001_notes.sql'), 'utf8');
 await pool.query(MIGRATION);
+// task 1004499: the Studio's site list reads by page_id prefix
+const MIGRATION_2 = fs.readFileSync(path.join(ROOT, 'modules/page-notes/migrations/page_notes_002_surface_index.sql'), 'utf8');
+await pool.query(MIGRATION_2);
 const PAGE = 'builders:pn-test-page';
-const clean = () => pool.query('DELETE FROM page_notes_docs WHERE page_id LIKE $1', ['builders:pn-test-%']);
+const clean = () => pool.query('DELETE FROM page_notes_docs WHERE page_id LIKE $1 OR page_id LIKE $2', ['builders:pn-test-%', 'pntest:%']);
 await clean();
 
 const PNG = Buffer.from('89504e470d0a1a0a0000000d4948445200000001000000010806000000', 'hex');
@@ -135,6 +138,30 @@ await test('deleting a doc takes its images with it', async () => {
 
 await clean();
 await pool.query('DELETE FROM builders WHERE id = ANY($1::bigint[])', [[A, B]]).catch(() => {});
+await test('THE SITE LIST (task 1004499): one surface, submitted only, newest first, read through its own index', async () => {
+  await pool.query(MIGRATION_2);
+  const mk = async (author, page, at) => {
+    const n = await db.openDraft({ authorId: author, pageId: page, pagePath: '/', pageTitle: page }, q);
+    await pool.query("UPDATE page_notes_docs SET status = 'filed', submitted_at = $2, body_md = 'words' WHERE id = $1", [n.id, at]);
+    return String(n.id);
+  };
+  const older = await mk(A, 'pntest:home', '2026-10-01T00:00:00Z');
+  const newer = await mk(B, 'pntest:projects', '2026-10-02T00:00:00Z');
+  await db.openDraft({ authorId: A, pageId: 'pntest:terms', pagePath: '/terms', pageTitle: 'Terms' }, q);
+  await mk(A, 'builders:pn-test-other', '2026-10-03T00:00:00Z');
+  const rows = await db.listForSurface('pntest', { limit: 20 }, q);
+  assert.deepEqual(rows.map((r) => String(r.id)), [newer, older], 'the surface only, drafts left out, newest first');
+  const c = await pool.connect();
+  try {
+    await c.query('BEGIN');
+    await c.query('SET LOCAL enable_seqscan = off');
+    const plan = (await c.query("EXPLAIN SELECT id FROM page_notes_docs n WHERE n.page_id LIKE 'site:%' AND n.status <> 'draft'")).rows.map((r) => r['QUERY PLAN']).join('\n');
+    assert.match(plan, /page_notes_by_surface/, plan);
+    await c.query('ROLLBACK');
+  } finally { c.release(); }
+  await clean();
+});
+
 await pool.end();
 console.log(`page_notes_db: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/page_notes_panel.mjs

@@ -79,7 +79,7 @@ test('THE PALETTE: in the top bar in Artistry alone, right before the switch, an
   assert.deepEqual(p.tools().map((t) => t.id), ['craft-tool-palette', 'craft-tool-paintbrush'], 'the palette, then the paintbrush (task 1004497)');
   assert.equal(p.tools()[0].nextSibling, p.tools()[1], 'the palette comes first');
   assert.equal(p.tools()[1].nextSibling, p.sw, 'and the pair sits right before the mode switch');
-  assert.equal(p.tools()[0].getAttribute('aria-label'), 'Write feedback on this page');
+  assert.equal(p.tools()[0].getAttribute('aria-label'), 'Artist review: write feedback on this page', 'one name with the public site\'s button (task 1004499)');
   for (const m of ['building', 'governing']) {
     p.craft.choose(m);
     assert.equal(p.tools().length, 0, `no palette in ${m}`);
@@ -141,8 +141,14 @@ test('the doc names its page the way the page inventory does', () => {
   assert.deepEqual(JSON.parse(JSON.stringify(R.page())), { id: 'builders:studio', path: '/studio', title: 'Studio' });
 });
 
-test('colours live in style.css, and the panel and tool are styled there', () => {
+test('colours live in the sheets, and the panel and tool are styled there', () => {
   assert.doesNotMatch(NOTES, /#[0-9a-f]{3,6}\b|rgba?\(/i, 'no colour literal in the panel script');
   const css = fs.readFileSync(path.join(HALL, 'style.css'), 'utf8');
-  for (const sel of ['.craft-tool {', '.pn {', '.pn__panel {', '.pn__text {', '.pn-doc__img {']) assert.ok(css.includes(sel), sel);
+  assert.ok(css.includes('.craft-tool {'), '.craft-tool {');
+  // Task 1004499: the panel has its own sheet so the public site can wear it;
+  // the hall pulls it in through style.css, ahead of every rule.
+  const pn = fs.readFileSync(path.join(HALL, 'page-notes.css'), 'utf8');
+  for (const sel of ['.pn {', '.pn__panel {', '.pn__text {', '.pn-doc__img {']) assert.ok(pn.includes(sel) && !css.includes(sel), sel);
+  const at = css.indexOf('@import url("page-notes.css");');
+  assert.ok(at !== -1 && at < css.indexOf('{'), 'style.css imports the sheet before any rule');
 });