@bongos/core 1.24.24 → 1.24.26

package/tests/hall_loading.mjs

@@ -0,0 +1,153 @@
+// tests/hall_loading.mjs — the hall's one loader, the Bongos mark (task 1005043, goal 1000095).
+//
+// Owner ask, 2026-11-03: a smooth load screen with the Bongos logo anywhere the
+// hall waits for data, in the spirit of monday.com's Vibe data loaders. One CSS
+// component in style.css (.hall-loading) draws the mark from shell.js's
+// brand-mark geometry; a page opts in by putting the class on the placeholder it
+// already had. These cases read the real sheets and pages: the loader keeps
+// DESIGN.md's motion and colour rules, its rest frame is the logo, and no hall
+// page is left with a bare "Loading…" line or a blank wait.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules/hall-ui/public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const STYLE = read('style.css');
+const SHELL = read('shell.js');
+
+// The loader's section of style.css, from its banner to the next rule family.
+const START = STYLE.indexOf('/* ---- the loader (task 1005043)');
+const LOADER = STYLE.slice(START, STYLE.indexOf('/* collapsible card body', START));
+
+function keyframes(name) {
+  const m = STYLE.match(new RegExp(`@keyframes ${name} \\{`));
+  assert.ok(m, `@keyframes ${name} exists`);
+  let depth = 1, i = m.index + m[0].length;
+  for (; i < STYLE.length && depth; i++) depth += STYLE[i] === '{' ? 1 : STYLE[i] === '}' ? -1 : 0;
+  return STYLE.slice(m.index + m[0].length, i - 1);
+}
+
+test('the loader is drawn from the Bongos mark, in three sizes', () => {
+  assert.ok(START > 0 && LOADER.length > 500, 'the loader section is found in style.css');
+  for (const sel of ['.hall-loading {', '.hall-loading::before {', '.hall-loading::after {', '.hall-loading--page {', '.hall-loading--inline {']) {
+    assert.ok(LOADER.includes(sel), `${sel} is declared`);
+  }
+  // The same ring arc, core and dot the shell's brand mark draws, so the loader IS the logo.
+  const ring = SHELL.match(/<path class="mr" d="([^"]+)"/)[1];
+  assert.ok(LOADER.includes(`d='${ring}'`), 'the ring is the brand mark\'s arc');
+  assert.ok(SHELL.includes('<circle class="mp" cx="100" cy="100" r="55"'), 'the brand mark\'s core');
+  assert.ok(LOADER.includes("circle cx='100' cy='100' r='55'"), 'is the loader\'s core');
+  assert.ok(SHELL.includes('<circle cx="156" cy="46" r="12" fill="#fb9569"/>'), 'the brand mark\'s dot');
+  assert.ok(LOADER.includes("circle cx='156' cy='46' r='12'"), 'is the loader\'s dot');
+});
+
+test('it moves in CSS only, on transform and filter only, and rests on the logo', () => {
+  const frames = { 'hall-loading-arrive': keyframes('hall-loading-arrive'), 'hall-loading-turn': keyframes('hall-loading-turn'), 'hall-loading-breathe': keyframes('hall-loading-breathe') };
+  for (const [name, body] of Object.entries(frames)) {
+    const props = [...body.matchAll(/([a-z-]+)\s*:/g)].map((m) => m[1]);
+    assert.ok(props.length, `${name} animates something`);
+    for (const prop of props) assert.ok(['transform', 'filter'].includes(prop), `${name} animates ${prop}, not transform or filter`);
+  }
+  // The rest frame: the turn has no `from`, so 0deg (the logo's own pose, dot top right)
+  // is where it starts and where the Kill Switch leaves it; the arrival and the breath
+  // have no `to`, so their resting value is the element as styled, fully shown.
+  assert.match(frames['hall-loading-turn'], /^\s*to \{ transform: rotate\(1turn\); \}\s*$/);
+  assert.match(frames['hall-loading-arrive'], /^\s*from \{/);
+  assert.match(frames['hall-loading-breathe'], /^\s*from \{/);
+  // The Kill Switch stops every animation, pseudo-elements included.
+  assert.match(STYLE, /@media \(prefers-reduced-motion: reduce\) \{\s*\*, \*::before, \*::after \{\s*animation: none !important;/);
+  // No motion authored in JavaScript: nothing in the hall drives the loader from script.
+  for (const f of fs.readdirSync(HALL).filter((n) => n.endsWith('.js'))) {
+    assert.doesNotMatch(read(f), /hall-loading[^'"\n]*['"]\)?\.(animate|style)\b/, `${f} does not animate the loader`);
+  }
+});
+
+test('every colour is a token; the black in the masks is alpha, not paint', () => {
+  const css = LOADER.replace(/\/\*[\s\S]*?\*\//g, '');
+  assert.doesNotMatch(css, /#[0-9a-fA-F]{3,8}\b|rgba?\(|hsla?\(/, 'no colour literal');
+  const paints = [...css.matchAll(/(?:background|color):\s*([^;]+);/g)].map((m) => m[1].trim());
+  assert.ok(paints.length >= 3, 'the ink, the dot and the caption are painted');
+  for (const p of paints) assert.match(p, /^(var\(--[a-z-]+\)|color-mix\(in srgb, var\(--ink\) \d+%, var\(--bg-card\)\))$/, `${p} is a token or a mix of one`);
+  // The one accent is the dot: the live thing on a waiting page (the One Warm Thing Rule).
+  assert.equal((css.match(/var\(--accent\)/g) || []).length, 1, 'the accent paints the dot alone');
+  const masks = [...css.matchAll(/url\("data:image\/svg\+xml,([^"]+)"\)/g)].map((m) => decodeURIComponent(m[1]));
+  assert.equal(masks.length, 2, 'two masks: the ring and core, and the dot');
+  for (const m of masks) assert.doesNotMatch(m.replace(/stroke='black'|fill='none'/g, ''), /fill='|stroke='|#/, 'a mask carries no colour of its own');
+});
+
+test('the page loaders step aside by themselves, and never show without :has()', () => {
+  assert.match(STYLE, /\.hall-loading--wait, \.hall-loading--zones \{ display: none; \}/);
+  assert.match(STYLE, /@supports selector\(:has\(a\)\) \{\s*\.hall-loading--wait:not\(:has\(~ :not\(\[hidden\], script, template, style\)\)\) \{ display: flex; \}\s*\.hall-loading--zones:not\(:has\(~ :not\(\[hidden\]\) > :not\(\[hidden\], script, template, style\)\)\) \{ display: flex; \}\s*\}/);
+  // A page whose sections all start [hidden] carries the --wait loader FIRST in its main.
+  for (const page of ['board-room', 'deploy', 'fleet', 'gate', 'government', 'market-watch-settings', 'project-settings', 'sessions']) {
+    const html = read(`${page}.html`);
+    const main = html.slice(html.indexOf('<main id="hall-main">'));
+    const first = main.replace(/<main id="hall-main">\s*(<!--[\s\S]*?-->\s*)*/, '');
+    assert.match(first, /^<p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…<\/p>/, `${page} opens its main on the page loader`);
+    const after = first.slice(first.indexOf('</p>') + 4);
+    const kids = [...after.matchAll(/^ {8}<(section|div|p|nav)\b([^>]*)>/gm)];
+    assert.ok(kids.length >= 2, `${page} has sections after the loader`);
+    for (const [, tag, attrs] of kids) assert.match(attrs, /\bhidden\b/, `${page}: a <${tag}> after the loader starts hidden, or the loader would never show`);
+  }
+  assert.match(read('index.html'), /<section class="view" id="view-home"[^>]*>\s*<!--[^>]*-->\s*<p class="hall-loading hall-loading--page hall-loading--zones" role="status">Loading…<\/p>/, 'Home waits on its zones');
+  assert.match(read('watch.html'), /<main id="hall-main">\s*<!--[^>]*-->\s*<p class="hall-loading hall-loading--page hall-loading--zones" role="status">Loading…<\/p>/, 'Watch waits on its panes');
+  // Settings' layout is never [hidden] while it loads, so its loader is put away by hideLayout().
+  assert.match(read('settings.html'), /id="settings-groups"[^>]*>\s*<!--[^>]*-->\s*<p class="hall-loading hall-loading--page" id="settings-loading" role="status">/);
+  assert.match(read('settings.js'), /function hideLayout\(hide\) \{[\s\S]*?getElementById\('settings-loading'\)[\s\S]*?loading\.hidden = true;/);
+});
+
+test('no hall page waits on a bare line of text any more', () => {
+  // A placeholder an element's own script rewrites IN PLACE keeps its plain words:
+  // the class would stay behind on the finished sentence. Each is named with why.
+  const IN_PLACE = new Set([
+    'atlas.html#caption',             // the map's caption, rewritten by atlas.js
+    'sessions.html#ledger-status',    // the ledger's status line, rewritten by sessions.js
+    'goals.html#goal-deps-card-lede', // the dependency card's lede, rewritten by goals-page.js
+    'goals.html#goal-deps-lede',
+    'profile.html#activity-placeholder', // reused for the signed-out notice by profile.js
+  ]);
+  const WAIT = /<(p|div|li|span|td)\b([^>]*)>\s*(?:Loading|Reading|Opening|Checking)\b[^<]*…\s*<\/\1>|<(p|div|li|span|td)\b([^>]*)>…<\/\4>/g;
+  const misses = [];
+  for (const f of fs.readdirSync(HALL).filter((n) => n.endsWith('.html'))) {
+    for (const m of read(f).matchAll(WAIT)) {
+      const attrs = m[2] || m[5] || '';
+      if (/page-head__sub/.test(attrs)) continue; // the page head is hidden on every page but Home (task 1004836)
+      const id = (attrs.match(/\bid="([^"]+)"/) || [])[1];
+      if (id && IN_PLACE.has(`${f}#${id}`)) continue;
+      if (!/\bhall-loading\b/.test(attrs)) misses.push(`${f}: ${m[0].slice(0, 90)}`);
+    }
+  }
+  assert.deepEqual(misses, [], 'every waiting placeholder wears the loader');
+  // The table placeholder rows keep their cell, with the loader inside it.
+  assert.match(read('work.html'), /<td colspan="6" class="ledger__empty"><span class="hall-loading" role="status">Loading…<\/span><\/td>/);
+  assert.match(read('hall-widgets.js'), /<td colspan="4" class="ledger__empty"><span class="hall-loading" role="status">Loading…<\/span><\/td>/);
+});
+
+test('the placeholders the page scripts write wear it too, and a failure stops it', () => {
+  const WRITTEN = {
+    'blockers.js': '<li class="hall-loading hall-loading--page" role="status">Loading…</li>',
+    'goals.js': '<div class="hall-loading" role="status">Loading your goals…</div>',
+    'lightbulb.js': '<p class="hall-loading" role="status">Loading…</p>',
+    'task-detail.js': '<p class="hall-loading hall-loading--inline" role="status">Loading versions…</p>',
+    'criterion-uat-ui.js': '<p class="hall-loading hall-loading--inline" role="status">Loading…</p>',
+    'watch.js': '<p class="hall-loading" role="status">Reading…</p>',
+    'studio.js': '<p class="hall-loading" role="status">Reading the reviews…</p>',
+    'settings-specialities.js': '<p class="hall-loading hall-loading--inline" role="status">Loading this project’s skills…</p>',
+    'settings-software-update.js': '<p class="hall-loading hall-loading--inline" role="status">Checking for a newer version…</p>',
+    'goals-page.js': '<div class="hall-loading" role="status">Loading…</div>',
+  };
+  for (const [f, markup] of Object.entries(WRITTEN)) assert.ok(read(f).includes(markup), `${f} writes the loader`);
+  // Blockers' first paint replaces the list wholesale, so its loader cannot outlive the rows.
+  assert.match(read('blockers.js'), /listEl\.innerHTML = rows\.length/);
+  // Collab used to be blank on a failed read; with loaders in its lists it must stop them.
+  const collab = read('collab.js');
+  const failure = collab.slice(collab.lastIndexOf('load().catch('));
+  assert.match(failure, /\['for-me', 'mine', 'all'\]\.forEach\(\(k\) => \{ const host = \$\(`#cb-\$\{k\}`\); if \(host\) host\.innerHTML = ''; \}\);/);
+  // The skeleton bars and the goal list's rings breathe in the loader's beat.
+  assert.match(STYLE, /\.kit-skel \{[^}]*animation: hall-loading-breathe \.8s ease-in-out infinite alternate-reverse;/);
+  assert.match(read('goals.css'), /\.gr-skel__ring \{[^}]*animation: hall-loading-breathe \.8s ease-in-out infinite alternate-reverse;/);
+});

package/tests/software_update.mjs

@@ -39,11 +39,12 @@ const NOTES = {
   '1.20.0': [{ id: 200, text: 'The start of a new line.' }],
 };
 
-/** A registry that answers the packument and the NEWEST version's tarball. */
-function registry({ versions = VERSIONS, notes = NOTES, pkStatus = 200, tgzStatus = 200, tgz } = {}) {
+/** A registry that answers the packument and the NEWEST version's tarball. `latest` is the
+ *  release label (ADR 0361): every version above it is a candidate. */
+function registry({ versions = VERSIONS, notes = NOTES, pkStatus = 200, tgzStatus = 200, tgz, latest } = {}) {
   const newest = versions[versions.length - 1];
   return fakeHttpsGet({
-    [PACKUMENT_URL]: { status: pkStatus, body: npmPackument({ versions, latest: newest, times: TIMES }) },
+    [PACKUMENT_URL]: { status: pkStatus, body: npmPackument({ versions, latest: latest === undefined ? newest : latest, times: TIMES }) },
     [tgzUrl(newest)]: { status: tgzStatus, body: tgz || npmTarball({ notes }) },
   });
 }
@@ -148,6 +149,44 @@ test('a project far behind lists the newest forty and counts the rest', async ()
   assert.equal(u.whats_new.versions[0].version, '1.19.51');
 });
 
+// ---- released vs candidate (task 1004593, ADR 0361 D5) --------------------------------
+// The live defect, 2026-10-06, uattest (1.21.66, patch): npm `latest` was 1.21.66 and 1.21.69
+// sat above it as a candidate. Settings offered 1.21.69; /deploy and the banner offered
+// nothing. A project that follows releases must be offered what the runner would move it to.
+
+test('a project that follows releases is offered nothing above the release label', async () => {
+  const reg = registry({ latest: '1.19.11' });
+  const u = await read('1.19.10', reg);
+  assert.equal(u.reading, 'ok');
+  assert.equal(u.follow, 'released', 'no follow given: the default, exactly as the runner');
+  assert.equal(u.offered, '1.19.11', '1.19.12 and 1.19.13 are candidates, never offered here');
+  assert.equal(u.newest, '1.19.11', 'and the newest it reports is the newest it could take, not a candidate');
+  assert.deepEqual(u.whats_new.versions.map((v) => v.version), ['1.19.11'], 'what\'s new stops at the offer');
+});
+
+test('the uattest case: running the released version with only candidates above it is up to date', async () => {
+  const reg = registry({ latest: '1.19.10' });
+  const u = await read('1.19.10', reg);
+  assert.equal(u.reading, 'ok');
+  assert.equal(u.offered, null, 'Settings now agrees with /deploy: nothing it can take');
+  assert.equal(u.whats_new, null);
+  assert.deepEqual(reg.asked, [PACKUMENT_URL], 'and nothing is downloaded for a version it will never offer');
+});
+
+test('the platform\'s own hall follows candidates and is offered them', async () => {
+  const u = await read('1.19.10', registry({ latest: '1.19.10' }), { follow: 'candidates' });
+  assert.equal(u.follow, 'candidates');
+  assert.equal(u.offered, '1.19.13');
+  assert.equal(u.newest, '1.20.0');
+});
+
+test('a registry with no release label is no answer for a release follower — never "up to date"', async () => {
+  const u = await read('1.19.10', registry({ latest: null }));
+  assert.equal(u.reading, 'no_answer');
+  assert.match(u.error, /released/);
+  assert.equal(u.offered, null);
+});
+
 test('a second look within minutes asks the registry nothing new', async () => {
   const reg = registry();
   const store = fresh();
@@ -465,6 +504,39 @@ test('the platform, which runs the door, keeps /deploy behind its own page gate'
   assert.match(String(r.location), /auth|sign/i, 'and is sent to sign in, as before');
 });
 
+// ── the door on the hub's apex (task 1004736) ─────────────────────────────────
+//
+// Every hosted project's Update button is `<hub origin>/deploy?project=<slug>` — the IdP
+// origin, or HUB_UPGRADE_URL built from the hub's public origin — and on cloudbongos.com
+// that origin is the apex, where /deploy was a 404 (2026-10-14). The page is the hall's,
+// on builders.<apex>. The hub answers the apex address with the hall's, so every link
+// already written into a project's web.env works without that project moving its core.
+
+function getOn(port, p, host) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path: p, headers: { Host: host } }, (res) => { res.resume(); res.on('end', () => resolve({ status: res.statusCode, location: res.headers.location })); });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('the apex /deploy sends the owner to the hall\'s door for the same project (task 1004736)', async () => {
+  const port = await startServer({ [MODULE_ENV]: '1' });
+  for (const p of ['/deploy?project=toast', '/deploy.html?project=toast', '/deploy/?project=toast']) {
+    const r = await getOn(port, p, 'hall.test');
+    assert.equal(r.status, 302, p);
+    assert.equal(r.location, 'https://builders.hall.test/deploy?project=toast', `${p}: the project is carried, so the door opens on it`);
+  }
+  const bare = await getOn(port, '/deploy', 'hall.test');
+  assert.equal(bare.location, 'https://builders.hall.test/deploy', 'no project → the door itself');
+  for (const p of ['/deployments', '/deploy/x', '/api/deploy']) {
+    const r = await getOn(port, p, 'hall.test');
+    assert.notEqual(String(r.location || '').includes('builders.hall.test/deploy'), true, `${p} is not the door`);
+  }
+  const onHall = await getOn(port, '/deploy?project=toast', 'builders.hall.test');
+  assert.doesNotMatch(String(onHall.location || ''), /^https:\/\/builders\./, 'on the hall itself the page is served, not bounced');
+});
+
 // ── the project's OWN update rule reaches the offer (task 1004535) ────────────
 //
 // The live defect, 2026-10-02: cloudbongos's rule on /deploy is `minor` and the sweep
@@ -510,6 +582,25 @@ test('the REAL default reads the provisioning.selfUpdateChannel port — and wit
   }
 });
 
+test('the route hands the reader the follow of the hall it serves: candidates only where the door runs (task 1004593)', async () => {
+  const cases = [
+    [{ provisioning: true, idp: null }, 'candidates', 'the platform\'s own hall, the one project that takes every candidate'],
+    [{ provisioning: false, idp: { origin: 'https://cloudbongos.com', clientId: 'uattest' } }, 'released', 'a hosted project'],
+    [{ provisioning: false, idp: null }, 'released', 'a self-hosted instance'],
+  ];
+  for (const [inputs, want, what] of cases) {
+    let seen;
+    const r = await drive({ softwareUpdate: async (a) => { seen = a; return STUB_UPDATE; }, canUpdate: async () => true, doorInputs: () => inputs });
+    assert.equal(r.status, 200, what);
+    assert.equal(seen.follow, want, what);
+  }
+});
+
+test('[source] the upgrade request asks with the same follow as the panel (task 1004593)', () => {
+  const seg = ROUTE_SRC.slice(ROUTE_SRC.indexOf("'/software-update/request'"), ROUTE_SRC.indexOf("'/project/manage-link'"));
+  assert.match(seg, /softwareUpdate\(\{ running, channel, follow: followFor\(door\) \}\)/, 'the version asked for is one the runner would take');
+});
+
 test('[source] the port the route reads is the port the provisioning module registers and declares (task 1004535)', () => {
   const port = 'provisioning.selfUpdateChannel';
   const route = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/core-update.js'), 'utf8');