@bongos/core 1.24.15 → 1.24.17

package/modules/hall-ui/public/ai-studio.js

@@ -331,12 +331,12 @@
     const files = readyFiles();
     const c = lib.payChoices(state.keys, state.balance);
     const thumbs = files.slice(0, 3).map((f) => thumb(f)).join('');
-    const ownCard = c.own ? `
-      <button type="button" class="st-action ais-card ais-card--own" data-pay="own">
-        <span class="st-action__label">My own key</span>
-        <span class="ais-card__line">Free here. ${esc(c.own.billedBy)} bills you for it directly.</span>
-        <span class="ais-card__foot">${esc(c.own.name)} key ending ${esc(c.own.last4 || '')}</span>
-      </button>` : '';
+    const ownCard = c.owns.map((k) => `
+      <button type="button" class="st-action ais-card ais-card--own" data-pay="${esc(k.provider)}">
+        <span class="st-action__label">${c.owns.length > 1 ? `My ${esc(k.name)} key` : 'My own key'}</span>
+        <span class="ais-card__line">Free here. ${esc(k.billedBy)} bills you for it directly.</span>
+        <span class="ais-card__foot">${c.owns.length > 1 ? '' : `${esc(k.name)} `}key ending ${esc(k.last4 || '')}</span>
+      </button>`).join('');
     const balanceCard = c.payments ? `
       <button type="button" class="st-action ais-card ais-card--ours" data-pay="ours" ${c.short ? 'disabled' : ''}>
         <span class="st-action__label">My balance</span>
@@ -346,8 +346,8 @@
     let foot = 'You only pay for what it really cost. If it fails, nothing is taken.';
     let extra = '';
     if (c.payments && c.short) extra = `<p class="ais-faint">Your balance is under ${esc(c.setAside)}. <a href="/builders/ai-studio?view=balance">Add money</a> to pay this way.</p>`;
-    if (!c.own) extra += `<p class="ais-faint">Have your own OpenRouter or Gemini key? <a href="${SETTINGS_KEYS}">Add it in Settings</a> and make things for free here.</p>`;
-    if (!c.own && !c.payments) foot = 'Paying from a balance is not set up here yet, so add your own key in Settings to make something.';
+    if (!c.owns.length) extra += `<p class="ais-faint">Have your own OpenRouter or Gemini key? <a href="${SETTINGS_KEYS}">Add it in Settings</a> and make things for free here.</p>`;
+    if (!c.owns.length && !c.payments) foot = 'Paying from a balance is not set up here yet, so add your own key in Settings to make something.';
     page.innerHTML = `${stepHead('make')}
       <h1 class="ais-ask" data-head tabindex="-1">How do you want to pay?</h1>
       <div class="ais-row ais-row--summary">${thumbs}<span class="ais-grow ais-soft">${esc(lib.quoteLine(state.draft.prompt))}</span><a class="ais-link" href="/builders/ai-studio?step=describe" data-nav="step=describe">change</a></div>

package/modules/hall-ui/public/panel.css

@@ -341,3 +341,8 @@ button.craft-save { display: inline-flex; align-items: center; justify-content:
   .prow--pick { flex-direction: row; align-items: flex-start; }
   .pinput, .display-name-input, .artkey-input, .join input, .join-note { max-width: none; }
 }
+
+/* ---- Your age (task 1005028): four radio choices, one per line ---------------- */
+.age-choices { border: 0; padding: 0; margin: 0 0 var(--space-3, 14px); display: grid; gap: 2px; }
+.age-choices label { display: flex; align-items: center; gap: 10px; min-height: 32px; cursor: pointer; }
+.age-choices input { width: 18px; height: 18px; margin: 0; }

package/modules/hall-ui/public/settings-age.js

@@ -0,0 +1,65 @@
+// modules/hall-ui/public/settings-age.js — the "Your age" panel on /builders/settings
+// (task 1005028). Shows the age band on record and records a new one. AI Studio and
+// payouts read the latest record; the server only accepts it from a person signed in
+// on the website (POST /me/payout-age), so this page is the one way to write it.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const { $ } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg);
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+
+  const LABELS = { adult: '18 or older', '16_17': '16 to 17', '13_15': '13 to 15', under_13: 'Under 13' };
+
+  // The server's error envelope is { error: { message } }.
+  const why = (res) => (res.data && res.data.error && res.data.error.message) || `HTTP ${res.status}`;
+
+  const currentText = (tier) => (LABELS[tier]
+    ? `On record: ${LABELS[tier]}.`
+    : 'Nothing on record yet, so AI Studio stays closed to you.');
+
+  async function load() {
+    const res = await api.request('GET', `${API}/me/payouts`);
+    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); return; }
+    if (!res.ok) throw new Error(why(res));
+    const tier = res.data && res.data.age_tier;
+    $('#age-current').textContent = currentText(tier);
+    // Only a known band is looked up, so nothing from the response reaches a selector.
+    const pick = LABELS[tier] ? document.querySelector(`input[name="age-tier"][value="${tier}"]`) : null;
+    if (pick) pick.checked = true;
+  }
+
+  async function save() {
+    const chosen = document.querySelector('input[name="age-tier"]:checked');
+    const status = $('#age-status');
+    if (!chosen) { status.textContent = 'Pick the group you are in first.'; return; }
+    const btn = $('#age-save');
+    btn.disabled = true;
+    status.textContent = 'Saving…';
+    try {
+      const res = await api.request('POST', `${API}/me/payout-age`, { body: { tier: chosen.value } });
+      if (!res.ok) throw new Error(why(res));
+      status.textContent = '';
+      $('#age-current').textContent = currentText(chosen.value);
+      toast('Age saved.');
+    } catch (err) {
+      status.textContent = '';
+      toast(`Could not save your age: ${err.message}`);
+    } finally {
+      btn.disabled = false;
+    }
+  }
+
+  async function setup() {
+    try {
+      await load();
+      $('#age-scroll').hidden = false;
+      $('#age-save').addEventListener('click', save);
+    } catch (err) {
+      toast(`Could not load your age: ${err.message}`);
+    }
+  }
+
+  setup();
+})();

package/modules/hall-ui/public/settings.html

@@ -91,6 +91,31 @@
               <p class="section-note">Saves when you press Save; shows everywhere at once.</p>
             </section>
 
+            <!-- YOUR AGE — the band on record, and where you record it (task 1005028).
+                 AI Studio and payouts both read the latest payout_age_records row, and
+                 the only writer is POST /me/payout-age, which needs a person signed in
+                 on the website. Rendered by settings-age.js; only the band is kept. -->
+            <section class="scroll" id="age-scroll" aria-labelledby="age-h" data-group="account" hidden>
+              <h2 id="age-h" class="scroll__h">Your age</h2>
+              <p class="scroll__lede">
+                AI Studio and getting paid both depend on your age. Pick the group you
+                are in. Only the group is kept, never your birthday.
+              </p>
+              <p class="settings-card__hint" id="age-current" aria-live="polite"></p>
+              <fieldset class="age-choices" id="age-choices">
+                <legend class="field-label">I am</legend>
+                <label><input type="radio" name="age-tier" value="adult"> 18 or older</label>
+                <label><input type="radio" name="age-tier" value="16_17"> 16 to 17</label>
+                <label><input type="radio" name="age-tier" value="13_15"> 13 to 15</label>
+                <label><input type="radio" name="age-tier" value="under_13"> Under 13</label>
+              </fieldset>
+              <div class="display-name-row">
+                <button type="button" class="craft-save" id="age-save">Save</button>
+              </div>
+              <p class="settings-status" id="age-status" role="status" aria-live="polite"></p>
+              <p class="section-note">AI Studio is for adults only, because the AI companies behind it only serve adults.</p>
+            </section>
+
             <!-- PROFILE AND PRIVACY — one link out to the hub's account page
                  (task 1004259, ADR 0337 D4.3). Handle, bio, links, public/private,
                  recruiters and the hide-my-numbers switch belong to the platform
@@ -501,6 +526,7 @@
      settings.js, which sits close to the 1500-line size ratchet. -->
 <script src="/builders/settings-sessions.js?v=2026-08-29-sessions"></script>
 <script src="/builders/settings-passkeys.js?v=2026-10-15-passkeys"></script>
+<script src="/builders/settings-age.js?v=2026-10-30-age"></script>
 <script src="/builders/settings-ai-keys.js?v=2026-10-28-ai-keys"></script>
 <!-- task 1002514: the interaction-profile panel ("How Claude talks to you"), on
      the same precedent and for the same reason — settings.js is against the

package/modules/hall-ui/public/settings.js

@@ -1107,6 +1107,7 @@
   const PANEL_ANCHORS = {
     'connections': 'connections-scroll',
     'display-name': 'display-name-scroll',
+    'age': 'age-scroll',
     // task 1004259: the two privacy panels became one link-out row; their old
     // anchors still land on it (the hall profile links /settings#cross-project).
     'profile-privacy': 'account-hub-scroll',

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.15",
+  "version": "1.24.17",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.15",
+      "version": "1.24.17",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.15",
+  "version": "1.24.17",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10975,5 +10975,17 @@
       "id": "1004906",
       "text": "The payment processor is chosen: Stripe Connect. Each project's money will sit in its own Stripe account, so we never hold anyone's money. J.P. Morgan Payments is recorded as the backup. Nothing is bought or opened yet, and th"
     }
+  ],
+  "1.24.16": [
+    {
+      "id": "1005028",
+      "text": "Settings now has a Your age section where you record your age group, which switches on AI Studio for adults."
+    }
+  ],
+  "1.24.17": [
+    {
+      "id": "1005029",
+      "text": "Artists with both an OpenRouter and a Gemini key saved can now choose which one runs their AI request."
+    }
   ]
 }

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/ai_studio_generate.mjs

@@ -246,6 +246,8 @@ test('which key runs: theirs whenever they have one, unless they ask for ours',
   assert.deepEqual(K.chooseKey(['openrouter'], 'ours'), { source: 'ours' });
   assert.deepEqual(K.chooseKey([], 'own'), { error: 'no_own_key' });
   assert.deepEqual(K.chooseKey(['openrouter'], 'free'), { error: 'bad_pay_with' });
+  assert.deepEqual(K.chooseKey(['gemini', 'openrouter'], 'gemini'), { source: 'own', provider: 'gemini' }, 'a named key wins over the default');
+  assert.deepEqual(K.chooseKey(['openrouter'], 'gemini'), { error: 'no_own_key' });
 });
 
 test('on their own key no money moves: one own_key row, price 0, cost noted', async () => {

package/tests/hall_ai_studio.mjs

@@ -469,3 +469,18 @@ test('walls: the studio home shows the AI door only where the module is on', ()
   assert.match(js, /mods\.enabled\['ai-studio'\] !== true\) return;/, 'off by default: a missing flag hides the door');
   assert.match(js, /loadAi\(\)\]/);
 });
+
+test('page: with both own keys saved, step 3 offers one card each and sends the one pressed', async () => {
+  const both = { keys: [{ provider: 'openrouter', set: true, last4: '4f2a' }, { provider: 'gemini', set: true, last4: '9c1d' }] };
+  assert.deepEqual(lib.ownKeys(both).map((k) => k.provider), ['openrouter', 'gemini']);
+  const p = bootPage('?step=make&from=1001', { routes: { 'GET /api/bongos/ai-studio/keys': both } });
+  await settle();
+  const pays = p.page.querySelectorAll('[data-pay]').map((b) => b.getAttribute('data-pay'));
+  assert.deepEqual(pays, ['openrouter', 'gemini', 'ours']);
+  assert.match(p.page.innerHTML, /My Gemini key/);
+  const gem = p.page.querySelectorAll('[data-pay]').find((b) => b.getAttribute('data-pay') === 'gemini');
+  await gem.fire('click');
+  await settle();
+  const sent = p.calls.find((c) => c.method === 'POST' && c.url.endsWith('/ai-studio/requests'));
+  assert.equal(sent.body.pay_with, 'gemini');
+});

package/tests/settings_age.mjs

@@ -0,0 +1,110 @@
+// tests/settings_age.mjs — the "Your age" panel on /builders/settings (task 1005028).
+// WHY. AI Studio and payouts read the latest age record, and the only writer is a
+// route that needs a person signed in on the website. This page is the one way to
+// write it, so the panel must read the band, offer exactly the server's four bands,
+// and save through that route — a panel that drifted from the server's tiers would
+// offer a choice the server refuses.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import vm from 'node:vm';
+
+const require = createRequire(import.meta.url);
+const read = (f) => readFileSync(new URL(`../modules/hall-ui/public/${f}`, import.meta.url), 'utf8');
+const gates = require('../src/bongos/payout-gates.js');
+
+const html = read('settings.html');
+const js = read('settings-age.js');
+
+test('the panel offers exactly the age bands the server accepts', () => {
+  const offered = [...html.matchAll(/name="age-tier" value="([^"]+)"/g)].map((m) => m[1]).sort();
+  assert.deepEqual(offered, [...gates.AGE_TIERS].sort());
+});
+
+test('the section joins a rail group, starts hidden, and its script is loaded and self-boots', () => {
+  const section = html.match(/<section class="scroll" id="age-scroll"[^>]*>/);
+  assert.ok(section, 'the panel has a section');
+  assert.match(section[0], /data-group="account"/);
+  assert.match(section[0], /\bhidden\b/);
+  assert.match(html, /<script src="\/builders\/settings-age\.js/);
+  assert.match(js, /\$\('#age-scroll'\)\.hidden = false/);
+  assert.match(read('settings.js'), /'age': 'age-scroll'/, 'the deep link /settings#age resolves');
+});
+
+// Run the real script against a fake page and a fake client.
+async function run({ tier, saveStatus = 201, loadStatus = 200 }) {
+  const calls = [];
+  const el = () => ({ hidden: true, textContent: '', disabled: false, listeners: {}, addEventListener(e, f) { this.listeners[e] = f; } });
+  const nodes = { '#age-current': el(), '#age-status': el(), '#age-save': el(), '#age-scroll': el() };
+  let checked = null;
+  const radios = {};
+  const sandbox = {
+    window: {
+      OTB: { $: (q) => nodes[q], toast: (m) => calls.push(['toast', m]) },
+      BongosClient: {
+        createClient: () => ({
+          request: async (method, path, opts) => {
+            calls.push([method, path, opts && opts.body]);
+            if (method === 'GET') return loadStatus < 400 ? { ok: true, status: 200, data: { age_tier: tier } } : { ok: false, status: loadStatus, data: { error: { message: 'The server said so.' } } };
+            return saveStatus < 400 ? { ok: true, status: saveStatus, data: {} } : { ok: false, status: saveStatus, data: { error: { message: 'no' } } };
+          },
+        }),
+      },
+      location: { assign() {} },
+    },
+    document: {
+      querySelector: (q) => {
+        if (q === 'input[name="age-tier"]:checked') return checked;
+        const m = q.match(/value="([^"]+)"/);
+        return m ? (radios[m[1]] = radios[m[1]] || { value: m[1], checked: false }) : null;
+      },
+    },
+  };
+  vm.runInNewContext(js, sandbox);
+  await new Promise((r) => setTimeout(r, 0));
+  return { calls, nodes, radios, choose: (v) => { checked = { value: v }; } };
+}
+
+test('nothing on record says so, and shows the panel', async () => {
+  const r = await run({ tier: null });
+  assert.match(r.nodes['#age-current'].textContent, /Nothing on record/);
+  assert.equal(r.nodes['#age-scroll'].hidden, false);
+});
+
+test('the band on record is shown and preselected', async () => {
+  const r = await run({ tier: 'adult' });
+  assert.match(r.nodes['#age-current'].textContent, /18 or older/);
+  assert.equal(r.radios.adult.checked, true);
+});
+
+test('saving posts the chosen band to the server route, and refuses to post with nothing chosen', async () => {
+  const r = await run({ tier: null });
+  await r.nodes['#age-save'].listeners.click();
+  assert.equal(r.calls.filter((c) => c[0] === 'POST').length, 0, 'no choice, no request');
+  r.choose('adult');
+  await r.nodes['#age-save'].listeners.click();
+  // JSON, because an object born inside the vm fails strict deepEqual on its prototype.
+  assert.equal(JSON.stringify(r.calls.find((c) => c[0] === 'POST')), JSON.stringify(['POST', '/api/bongos/me/payout-age', { tier: 'adult' }]));
+  assert.match(r.nodes['#age-current'].textContent, /18 or older/);
+});
+
+test('a refused save keeps what was on record and tells the person', async () => {
+  const r = await run({ tier: null, saveStatus: 403 });
+  r.choose('adult');
+  await r.nodes['#age-save'].listeners.click();
+  assert.match(r.nodes['#age-current'].textContent, /Nothing on record/);
+  assert.ok(r.calls.some((c) => c[0] === 'toast' && /Could not save/.test(c[1])));
+});
+
+test('a failed read says what the server said and leaves the panel hidden', async () => {
+  const r = await run({ tier: null, loadStatus: 500 });
+  assert.equal(r.nodes['#age-scroll'].hidden, true);
+  assert.ok(r.calls.some((c) => c[0] === 'toast' && /The server said so./.test(c[1])), 'the envelope message, not a bare HTTP code');
+});
+
+test('a band the page does not know is never put into a selector', async () => {
+  const r = await run({ tier: 'x"],body[x="' });
+  assert.match(r.nodes['#age-current'].textContent, /Nothing on record/);
+  assert.equal(Object.keys(r.radios).length, 0);
+});