@bongos/core 1.23.22 → 1.24.1

package/tests/integration_fixture_ids.mjs

@@ -0,0 +1,82 @@
+// tests/integration_fixture_ids.mjs — no two real-Postgres tests hand-pick the same
+// fixture id (task 1005008).
+//
+// The integration tests share ONE database and seed rows at fixed ids in the
+// 9xxxxxxx range. Task 1004950's task_needs_db.mjs picked builder ids 90000401-403,
+// which page_tweak_no_block.mjs already used; that test failed part-way and its
+// cleanup could not delete its builders (rows its claims had written still pointed
+// at them), so the next file's INSERT hit a duplicate key and main's integration
+// job went red, blocking every release. An id two files share is a collision
+// waiting for one of them to leave a row behind.
+//
+// The ids already shared when this guard landed are frozen below. The list may
+// only shrink: give a new test ids nobody else uses (grep the range first).
+//
+// Run:  node tests/integration_fixture_ids.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { INTEGRATION, INTEGRATION_PARKED } = require('../scripts/bongos/run-unit-tests.js');
+const HERE = path.dirname(url.fileURLToPath(import.meta.url));
+
+// Shared before task 1005008, each by tests that have not collided in practice.
+const KNOWN_SHARED = new Set([
+  '90000301', '90000302', '90000303', // claim_gate_open_blocker, clawback_confirmed_backlog, reward_mode_cost_plus_only
+  '90000401', // page_tweak_no_block, goal_spec_task_db
+  '90000411', // page_tweak_no_block, task_criteria_unlink_db, session_cost_row_raise
+  '90000801', '90000802', // acclaim_feed_evidence_db, blocker_hall_live_proof
+]);
+
+function sharedIds() {
+  const owners = new Map();
+  let scanned = 0;
+  for (const name of [...INTEGRATION, ...INTEGRATION_PARKED]) {
+    const file = path.join(HERE, `${name}.mjs`);
+    if (!fs.existsSync(file)) continue;
+    scanned++;
+    for (const id of new Set(fs.readFileSync(file, 'utf8').match(/\b9\d{7}\b/g) || [])) {
+      if (!owners.has(id)) owners.set(id, []);
+      owners.get(id).push(name);
+    }
+  }
+  return { scanned, shared: [...owners].filter(([, names]) => names.length > 1) };
+}
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+
+const { scanned, shared } = sharedIds();
+
+t('the scan actually read the integration tests', () => {
+  assert.ok(scanned >= 40, `expected the integration set on disk, read ${scanned} file(s)`);
+});
+
+t('no new fixture id is shared between two integration tests', () => {
+  const fresh = shared.filter(([id]) => !KNOWN_SHARED.has(id));
+  assert.deepEqual(fresh.map(([id, names]) => `${id}: ${names.join(', ')}`), [],
+    'pick an unused id range for the newer test');
+});
+
+t('the frozen list only names ids that are still shared (shrink it when one is fixed)', () => {
+  const still = new Set(shared.map(([id]) => id));
+  assert.deepEqual([...KNOWN_SHARED].filter((id) => !still.has(id)), []);
+});
+
+t('task_needs_db uses its own ids (the collision that reddened main)', () => {
+  const src = fs.readFileSync(path.join(HERE, 'task_needs_db.mjs'), 'utf8');
+  const pt = fs.readFileSync(path.join(HERE, 'page_tweak_no_block.mjs'), 'utf8');
+  const ids = (s) => new Set(s.match(/\b9\d{7}\b/g) || []);
+  const overlap = [...ids(src)].filter((id) => ids(pt).has(id));
+  assert.deepEqual(overlap, []);
+});
+
+console.log(`\nintegration_fixture_ids (task 1005008): ${passed} passed, ${failed} failed`);
+if (failed) process.exitCode = 1;

package/tests/invite_expiry_db.mjs

@@ -110,7 +110,7 @@ try {
   await q(`INSERT INTO builders (id, github_login) VALUES (42, 'owner')`);
   for (const f of ['060_access_requests', 'core_230_access_requests_applicant_vouch',
     'core_254_access_requests_applicant_handle', 'core_255_access_requests_invite_kind',
-    'core_266_access_requests_invited_login_idx']) await q(coreSql(f));
+    'core_266_access_requests_invited_login_idx', 'core_282_builders_lower_login_idx']) await q(coreSql(f));
 
   // ── The instance: the door, the queues, the probe ────────────────────────
   console.log('the instance:');
@@ -135,6 +135,18 @@ try {
   await q('RESET enable_seqscan');
   ok(/idx_access_requests_invited_login/.test(plan), 'the sign-in gate can read invited rows through core_266\'s index');
 
+  // core_282 (task 1004923): the onboarding routes' "already a member?" probe
+  // compares lower(github_login), which only an expression index can serve.
+  await q('SET enable_seqscan = off');
+  const memberPlan = (await q('EXPLAIN SELECT 1 FROM builders WHERE lower(github_login) = lower($1) LIMIT 1', ['Owner']))
+    .rows.map((r) => r['QUERY PLAN']).join('\n');
+  await q('RESET enable_seqscan');
+  ok(/idx_builders_lower_login/.test(memberPlan), 'the member-by-login probe reads builders through core_282\'s index');
+  ok((await q('SELECT 1 FROM builders WHERE lower(github_login) = lower($1)', ['OWNER'])).rowCount === 1,
+    'and still matches a login case-insensitively');
+  await q(coreSql('core_282_builders_lower_login_idx'));
+  ok(true, 'core_282 re-runs cleanly (IF NOT EXISTS, ON CONFLICT DO NOTHING)');
+
   const hist = Object.fromEntries((await call('GET', '/api/gds/access-requests?status=invited')).json.requests.map((r) => [r.github_login, r]));
   ok(hist.fay.expired === true && hist.eve.expired === false && hist.cy.expired === false, 'the queue marks only the expired invite');
   ok(hist.cy.expires_at === null && new Date(hist.fay.expires_at) <= new Date() && new Date(hist.eve.expires_at) > new Date(),

package/tests/lib_sh_resolution.mjs

@@ -39,10 +39,6 @@ const fitness = require(path.join(GDS, 'fitness.js'));
 const SMOKES = [
   'lib.sh',
   'smoke-write.sh',
-  'smoke-batch-claim.sh',
-  'smoke-batch-release.sh',
-  'smoke-claim-consistency.sh',
-  'smoke-dependencies.sh',
   'portability-smoke-memory.sh',
 ];
 

package/tests/market_watch_data.mjs

@@ -0,0 +1,244 @@
+// tests/market_watch_data.mjs — the Market Watch data layer without a database (task
+// 1004936, goal 1000137): the seed built from the committed research files, the hub-only
+// and idempotent seed write, the pure derivations behind levels, streaks, sparklines and
+// the settings gauge, the read queries' project scoping, and the migration's own rules.
+//
+// The SQL itself runs against a real Postgres in tests/market_watch_data_db.mjs (the
+// INTEGRATION set); this file is the DB-free half and runs in the unit lane.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const seed = require('../modules/market-watch/seed.js');
+const db = require('../modules/market-watch/db.js');
+const hubSeed = require('../modules/market-watch/pollers/hub-seed.js');
+const MIGRATION = readFileSync(new URL('../modules/market-watch/migrations/market_watch_001_tables.sql', import.meta.url), 'utf8');
+
+const market = seed.readSeed('market-data.json');
+const partners = seed.readSeed('partners-data.json');
+const built = seed.buildSeed({ market, partners });
+
+// A pool that records every statement and answers each SELECT … id with one row.
+function fakePool({ failOn = null } = {}) {
+  const calls = [];
+  let id = 0;
+  const client = {
+    async query(sql, params = []) {
+      calls.push({ sql, params });
+      if (failOn && failOn.test(sql)) throw new Error('boom');
+      if (/^\s*SELECT id FROM/.test(sql)) return { rows: [{ id: ++id }], rowCount: 1 };
+      return { rows: [], rowCount: 1 };
+    },
+    release() { calls.push({ sql: 'RELEASE' }); },
+  };
+  return { calls, pool: { connect: async () => client, query: client.query } };
+}
+
+test('the seed carries all 36 researched companies and all 24 partners, scored and sourced', () => {
+  assert.equal(market.length, 36);
+  assert.equal(partners.length, 24);
+  const comps = built.items.filter((i) => i.kind === 'competitor');
+  const parts = built.items.filter((i) => i.kind === 'partner');
+  assert.equal(comps.length, 36);
+  assert.equal(parts.length, 24);
+  for (const it of built.items) {
+    const rubricKeys = seed.RUBRIC[it.kind].map((d) => d.key);
+    assert.deepEqual(Object.keys(it.scores).sort(), [...rubricKeys, 'overall'].sort(), `${it.name}: five rubric dimensions plus overall`);
+    for (const v of Object.values(it.scores)) assert.ok(v >= 0 && v <= 10, `${it.name}: ${v}`);
+    assert.ok(it.entries.length >= 1, `${it.name} has a case file`);
+    for (const e of it.entries) {
+      assert.match(e.sourceUrl, /^https?:\/\//, `${it.name}: every entry has a source`);
+      assert.ok([1, 2, 3].includes(e.confidence));
+      assert.ok(['insight', 'news', 'datapoint'].includes(e.type));
+    }
+  }
+  // The item key the migration enforces is unique across the seed, so no row is lost to it.
+  assert.equal(new Set(built.items.map((i) => `${i.kind}|${i.url}|${i.name}`)).size, 60);
+  // An unverified claim is never seeded as better than low confidence.
+  const unverified = built.items.flatMap((i) => i.entries).filter((e) => /unverified/i.test(e.takeaway));
+  assert.ok(unverified.length > 0);
+  for (const e of unverified) assert.equal(e.confidence, 1, e.takeaway);
+});
+
+test('the rules seed as version 1 with both rubrics, defined', () => {
+  assert.equal(built.rules.version, 1);
+  for (const kind of ['competitor', 'partner']) {
+    assert.equal(built.rules.rubric[kind].length, 5);
+    for (const d of built.rules.rubric[kind]) assert.ok(d.label && d.definition && d.weight > 0, JSON.stringify(d));
+  }
+  assert.ok(built.rules.searchQueries.length > 0 && built.rules.sources.length > 0 && built.rules.instructions.length > 0);
+});
+
+test('projectKey is the public origin, normalised, and refuses anything else', () => {
+  assert.equal(seed.projectKey('https://CloudBongos.com/'), 'https://cloudbongos.com');
+  assert.equal(seed.projectKey('http://localhost:3000'), 'http://localhost:3000');
+  for (const bad of ['', null, 'cloudbongos.com', 'https://x.com/path', 'ftp://x.com']) assert.equal(seed.projectKey(bad), null, String(bad));
+});
+
+test('the seed writes nothing off the hub, or with no origin', async () => {
+  const { pool, calls } = fakePool();
+  assert.deepEqual(await seed.seedHub({ pool, isHub: false, project: 'https://hub.example' }), { seeded: false, skipped: 'not_hub' });
+  assert.deepEqual(await seed.seedHub({ pool, isHub: 'true', project: 'https://hub.example' }), { seeded: false, skipped: 'not_hub' });
+  assert.deepEqual(await seed.seedHub({ pool, isHub: true, project: 'not an origin' }), { seeded: false, skipped: 'no_project_origin' });
+  assert.equal(calls.length, 0, 'not one statement');
+});
+
+test('on the hub it writes in one transaction, every insert idempotent and scoped to the project', async () => {
+  const { pool, calls } = fakePool();
+  const r = await seed.seedHub({ pool, isHub: true, project: 'https://Hub.example/' });
+  assert.equal(r.seeded, true);
+  assert.equal(r.project, 'https://hub.example');
+  assert.equal(calls[0].sql, 'BEGIN');
+  assert.equal(calls.at(-2).sql, 'COMMIT');
+  assert.equal(calls.at(-1).sql, 'RELEASE');
+  const inserts = calls.filter((c) => /^\s*INSERT/.test(c.sql));
+  assert.equal(inserts.length, 1 + 1 + 60 + 360 + built.items.reduce((a, i) => a + i.entries.length, 0));
+  for (const c of inserts) assert.match(c.sql, /ON CONFLICT .* DO NOTHING/s, c.sql);
+  for (const c of calls.filter((x) => /market_watch_(items|runs|rule_versions)/.test(x.sql) && x.params)) {
+    assert.equal(c.params[0], 'https://hub.example', 'project is $1 on every project-owned row');
+  }
+  // No person is invented: no seed statement writes an author, approver or adder.
+  for (const c of inserts) assert.doesNotMatch(c.sql, /author_id|approved_by|added_by|proposed_by/);
+});
+
+test('a failed write rolls back and releases', async () => {
+  const { pool, calls } = fakePool({ failOn: /INSERT INTO market_watch_score_snapshots/ });
+  await assert.rejects(seed.seedHub({ pool, isHub: true, project: 'https://hub.example' }), /boom/);
+  assert.ok(calls.some((c) => c.sql === 'ROLLBACK'));
+  assert.ok(!calls.some((c) => c.sql === 'COMMIT'));
+  assert.equal(calls.at(-1).sql, 'RELEASE');
+});
+
+test('the boot poller never throws into the server and counts a failure', async () => {
+  let reported = 0;
+  const r = await hubSeed.runOnce({ seedHub: async () => { throw new Error('db down'); }, reportError: () => { reported += 1; } });
+  assert.equal(r.seeded, false);
+  assert.equal(reported, 1);
+  const ok = await hubSeed.runOnce({ seedHub: async () => ({ seeded: false, skipped: 'not_hub' }) });
+  assert.equal(ok.skipped, 'not_hub');
+});
+
+// ---- the derivations ------------------------------------------------------
+
+const RUNS = [
+  { id: 4, status: 'done', created_at: '2026-11-11T00:00:00Z' },
+  { id: 1, status: 'done', created_at: '2026-10-28T00:00:00Z' },
+  { id: 3, status: 'skipped', created_at: '2026-11-07T00:00:00Z' },
+  { id: 2, status: 'partial', created_at: '2026-11-04T00:00:00Z' },
+];
+
+test('runs are numbered oldest first, and a run that never ran takes no number', () => {
+  const n = db.numberRuns(RUNS);
+  assert.deepEqual(n.map((r) => [r.id, r.n]), [[1, 1], [2, 2], [3, null], [4, 3]]);
+});
+
+test('level counts the runs that found something; streak counts the latest ones in a row', () => {
+  const n = db.numberRuns(RUNS);
+  assert.deepEqual(db.progress(n, []), { level: 1, streak: 0 }, 'a tracked item is level 1');
+  assert.deepEqual(db.progress(n, [1, 2, 4]), { level: 3, streak: 3 }, 'a skipped run does not break a streak');
+  assert.deepEqual(db.progress(n, [1, 4]), { level: 2, streak: 1 });
+  assert.deepEqual(db.progress(n, [1, 2]), { level: 2, streak: 0 }, 'nothing in the latest run');
+  assert.deepEqual(db.progress(n, ['4']), { level: 1, streak: 1 }, 'ids compare as strings (pg bigint)');
+});
+
+test('sparklines: one point per run that scored the item, null where a dimension was not scored', () => {
+  const n = db.numberRuns(RUNS);
+  const s = db.sparklines([
+    { run_id: 1, dimension: 'overall', value: '5.0' }, { run_id: 1, dimension: 'human_gates', value: '6' },
+    { run_id: 4, dimension: 'overall', value: '6.0' },
+    { run_id: 99, dimension: 'overall', value: '9' },
+  ], n);
+  assert.deepEqual(s.runs.map((r) => r.n), [1, 3]);
+  assert.deepEqual(s.series, { overall: [5, 6], human_gates: [6, null] });
+});
+
+test('the ask streak counts answered weeks back from the newest; an open unanswered week does not break it', () => {
+  assert.equal(db.weekStreak([{ id: 'w4', open: true }, { id: 'w3' }, { id: 'w2' }, { id: 'w1' }], ['w3', 'w2']), 2);
+  assert.equal(db.weekStreak([{ id: 'w4', open: false }, { id: 'w3' }], ['w3']), 0, 'a closed missed week breaks it');
+  assert.equal(db.weekStreak([{ id: 'w4', open: true }, { id: 'w3' }], ['w4', 'w3']), 2);
+  assert.equal(db.weekStreak([], []), 0);
+});
+
+test('the next run is due one cadence after the last; no run yet means due now', () => {
+  assert.equal(db.nextRunDue(null, 'weekly'), null);
+  assert.equal(db.nextRunDue('2026-11-01T09:00:00Z', 'weekly').toISOString(), '2026-11-08T09:00:00.000Z');
+  assert.equal(db.nextRunDue('2026-11-01T09:00:00Z', 'biweekly').toISOString(), '2026-11-15T09:00:00.000Z');
+  assert.throws(() => db.nextRunDue('2026-11-01T09:00:00Z', 'daily'), /unknown cadence/);
+  const [a, b] = db.monthBounds(new Date('2026-12-31T23:59:00Z'));
+  assert.equal(a.toISOString(), '2026-12-01T00:00:00.000Z');
+  assert.equal(b.toISOString(), '2027-01-01T00:00:00.000Z');
+});
+
+// ---- the reads are project-scoped ----------------------------------------
+
+test('every read refuses a missing project and passes it as $1', async () => {
+  const seen = [];
+  const pool = {
+    async query(sql, params) {
+      seen.push({ sql, params });
+      if (/sum\(ri\.cost_usd\), 0\) AS spent/.test(sql)) return { rows: [{ spent: '0' }] };
+      return { rows: [] };
+    },
+  };
+  const P = 'https://hub.example';
+  const reads = [
+    () => db.listItems(pool, { project: P }),
+    () => db.getItem(pool, { project: P, id: 1 }),
+    () => db.caseFile(pool, { project: P, itemId: 1 }),
+    () => db.scoreHistory(pool, { project: P, itemId: 1 }),
+    () => db.rules(pool, { project: P }),
+    () => db.proposals(pool, { project: P }),
+    () => db.weeklyAsk(pool, { project: P, weekOf: '2026-11-02' }),
+    () => db.askStreak(pool, { project: P, builderId: 1 }),
+    () => db.settingsView(pool, { project: P }),
+    () => db.remainingItems(pool, { project: P, runId: 1 }),
+  ];
+  for (const r of reads) await r();
+  assert.ok(seen.length >= reads.length);
+  for (const s of seen) {
+    assert.equal(s.params[0], P, s.sql);
+    assert.match(s.sql, /project = \$1/, s.sql);
+  }
+  for (const fn of ['listItems', 'caseFile', 'scoreHistory', 'rules', 'proposals', 'weeklyAsk', 'settingsView', 'remainingItems']) {
+    await assert.rejects(db[fn](pool, {}), /project key is required/, fn);
+  }
+  const v = await db.settingsView(pool, { project: P });
+  assert.deepEqual(v.settings, { ...db.DEFAULT_SETTINGS }, 'an unconfigured project reads the watch as off');
+  assert.equal(v.nextRunDue, null);
+});
+
+// ---- the migration's own rules -------------------------------------------
+
+test('the migration is additive, namespaced, idempotent, transactional and ASCII', () => {
+  assert.match(MIGRATION, /^\s*BEGIN;/m);
+  assert.match(MIGRATION, /^\s*COMMIT;/m);
+  const code = MIGRATION.replace(/--[^\n]*/g, ''); // the prose may say "never a DELETE"
+  assert.doesNotMatch(code, /\bDROP\b|\bTRUNCATE\b|\bDELETE\b/i);
+  assert.ok(/^[\x00-\x7F]*$/.test(MIGRATION), 'ASCII only');
+  const tables = [...MIGRATION.matchAll(/CREATE TABLE (IF NOT EXISTS )?(\w+)/g)];
+  assert.equal(tables.length, 10);
+  for (const t of tables) {
+    assert.ok(t[1], `${t[2]} is IF NOT EXISTS`);
+    assert.match(t[2], /^market_watch_/);
+  }
+  for (const i of MIGRATION.matchAll(/CREATE (UNIQUE )?INDEX (IF NOT EXISTS )?(\w+)/g)) assert.ok(i[2], `${i[3]} is IF NOT EXISTS`);
+});
+
+test('every seed ON CONFLICT target is a unique key the migration declares', () => {
+  const src = readFileSync(new URL('../modules/market-watch/seed.js', import.meta.url), 'utf8');
+  const want = {
+    '(project, version)': /UNIQUE \(project, version\)/,
+    '(project) WHERE trigger = \'seed\'': /market_watch_runs_one_seed\s+ON market_watch_runs \(project\) WHERE trigger = 'seed'/,
+    '(project, kind, url, name)': /UNIQUE \(project, kind, url, name\)/,
+    '(item_id, run_id, dimension)': /UNIQUE \(item_id, run_id, dimension\)/,
+    '(item_id, run_id, md5(takeaway))': /market_watch_log_entries_once\s+ON market_watch_log_entries \(item_id, run_id, md5\(takeaway\)\)/,
+  };
+  const targets = [...src.matchAll(/ON CONFLICT (.+?) DO NOTHING/g)].map((m) => m[1]);
+  assert.equal(targets.length, Object.keys(want).length);
+  for (const t of targets) {
+    assert.ok(want[t], `unexpected conflict target ${t}`);
+    assert.match(MIGRATION, want[t], t);
+  }
+});