@bongos/core 1.24.30 → 1.24.31

package/tests/market_watch_pages.mjs

@@ -439,3 +439,165 @@ test('MARKET WATCH OFF: both pages show the quiet off line, not an error, and as
     assert.equal(p.els['mw-fail'].hidden, true);
   }
 });
+
+// ---- the owner's Settings tab (task 1005045) ---------------------------------------
+//
+// Owner decision 2026-11-03 (idea 1001310): one sidebar item. The settings that had their
+// own page at /market-watch-settings are a Settings tab on this page, shown to the owner
+// (archon, cosmetic — the four settings routes keep their own wall, ADR 0016) and to
+// nobody else. These boot the real market-watch.js with the kit and the settings script
+// stood in, so what is asserted is which tabs the page builds for which viewer.
+
+function bootDesk({ rank, homeStatus = 200, modules = { enabled: { 'market-watch': true } }, meStatus = 200, shared } = {}) {
+  const els = {};
+  const el = (id) => (els[id] = els[id] || { id, hidden: true, innerHTML: '', textContent: '', style: {}, value: '', dataset: {}, title: '', addEventListener() {}, querySelectorAll: () => [], setAttribute() {} });
+  const listeners = {};
+  const fetches = [];
+  const tabsMade = [];
+  const settingsLoads = [];
+  const window = {
+    __MODULES__: modules,
+    OTBMarketWatch: MW,
+    OTBKit: { makeTabs: (opts) => { tabsMade.push(opts); return { activate() {}, active: () => opts.initial || opts.tabs[0].id }; } },
+    OTBMarketWatchSettings: { load: () => { settingsLoads.push(1); } },
+    __hallReads: shared === undefined ? undefined : { '/me': shared },
+    location: { pathname: '/market-watch', search: '', hash: '', assign() {} },
+    localStorage: { getItem: () => null, setItem() {} },
+  };
+  const document = {
+    title: 'Market Watch — Hub',
+    getElementById: el,
+    querySelectorAll: () => [],
+    addEventListener: (ev, fn) => { listeners[ev] = fn; },
+  };
+  const answer = (status, body) => ({ status, ok: status === 200, json: async () => body });
+  const ctx = vm.createContext({
+    window, document, URLSearchParams, console,
+    fetch: async (url) => {
+      fetches.push(url);
+      if (/\/me$/.test(url)) return answer(meStatus, { builder: { id: '1', rank } });
+      if (/market-watch\/home$/.test(url)) return answer(homeStatus, homeStatus === 200 ? home() : { error: { code: 'not_found' } });
+      return answer(404, {});
+    },
+  });
+  vm.runInContext(readFileSync(new URL('../modules/hall-ui/public/market-watch.js', import.meta.url), 'utf8'), ctx);
+  return { els: new Proxy(els, { get: (_, id) => el(id) }), fetches, tabsMade, settingsLoads, ready: () => listeners.DOMContentLoaded() };
+}
+
+test('SETTINGS TAB: the owner gets a Watch tab and a Settings tab, linked by #settings, and the settings load', async () => {
+  const p = bootDesk({ rank: 'archon' });
+  await p.ready();
+  assert.equal(p.els['mw-desk'].hidden, false, 'the desk still draws');
+  assert.equal(p.tabsMade.length, 1, 'one tab strip');
+  const t = JSON.parse(JSON.stringify(p.tabsMade[0]));
+  assert.deepEqual(t.tabs.map((x) => [x.id, x.label, x.panel]), [['watch', 'Watch', 'mw-panel-watch'], ['settings', 'Settings', 'mw-panel-settings']]);
+  assert.equal(t.hash, true, '#settings is the address the old URL redirects to');
+  assert.equal(t.initial, 'watch', 'the owner lands on the watch, like everyone else');
+  assert.equal(p.els['mw-tabs'].hidden, false, 'the strip shows');
+  assert.equal(p.settingsLoads.length, 1, 'the settings read is made once');
+});
+
+test('SETTINGS TAB: a non-owner sees no tab strip and no settings, and the settings are never read', async () => {
+  for (const rank of ['metic', 'thetes', 'xenos', null]) {
+    const p = bootDesk({ rank });
+    await p.ready();
+    assert.equal(p.els['mw-desk'].hidden, false, `${rank}: the desk draws`);
+    assert.equal(p.tabsMade.length, 0, `${rank}: no tab strip`);
+    assert.equal(p.els['mw-tabs'].hidden, true, `${rank}: the strip stays hidden`);
+    assert.equal(p.els['mw-panel-settings'].hidden, true, `${rank}: the settings panel stays hidden`);
+    assert.equal(p.settingsLoads.length, 0, `${rank}: the owner-only read is not made`);
+  }
+  // An unreadable /me is not an owner.
+  const blind = bootDesk({ rank: 'archon', meStatus: 500 });
+  await blind.ready();
+  assert.equal(blind.tabsMade.length, 0, 'an unreadable identity builds no settings tab');
+});
+
+test('SETTINGS TAB: where Market Watch is off there is nothing to set, so no tab (and still nothing asked)', async () => {
+  const off = bootDesk({ rank: 'archon', modules: { enabled: { 'market-watch': false } } });
+  await off.ready();
+  assert.equal(off.tabsMade.length, 0);
+  assert.equal(off.fetches.length, 0, 'an off module is not asked, and neither is /me');
+  const unmounted = bootDesk({ rank: 'archon', modules: undefined, homeStatus: 404 });
+  await unmounted.ready();
+  assert.equal(unmounted.els['mw-off'].hidden, false);
+  assert.equal(unmounted.tabsMade.length, 0, 'unmounted routes have no settings either');
+});
+
+test('SETTINGS TAB: the page carries every setting the old page did, in a hidden owner panel, and the old page is gone', () => {
+  const pub = (f) => new URL(`../modules/hall-ui/public/${f}`, import.meta.url);
+  const html = readFileSync(pub('market-watch.html'), 'utf8');
+  const panel = html.match(/<section[^>]*id="mw-panel-settings"[^>]*>[\s\S]*?<\/section>\s*<!-- \/mw-panel-settings -->/);
+  assert.ok(panel, 'one settings panel, closed by its marker comment');
+  assert.match(panel[0].split('>')[0], /\bhidden\b/, 'the panel starts hidden: nobody sees it until the owner check passes');
+  for (const id of ['mws-power', 'mws-cap', 'mws-cad', 'mws-weeks', 'mws-key-in', 'mws-key-save', 'mws-key-clear', 'mws-sealed', 'mws-off', 'mws-error']) {
+    assert.match(panel[0], new RegExp(`id="${id}"`), `${id} is on the tab`);
+  }
+  assert.match(panel[0], /href="\/market-watch-rules"/, 'the link to the rules is on the tab');
+  // While GET /market-watch/settings is in flight every section below is [hidden], so the
+  // panel opens on the self-hiding page loader (records/loader.md) rather than a blank tab.
+  const inner = panel[0].slice(panel[0].indexOf('>') + 1).replace(/^\s*(<!--[\s\S]*?-->\s*)*/, '');
+  assert.match(inner, /^<p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…<\/p>/, 'the settings tab opens on the page loader');
+  const after = inner.slice(inner.indexOf('</p>') + 4);
+  const kids = [...after.matchAll(/^ {10}<(section|div|p)\b([^>]*)>/gm)];
+  assert.ok(kids.length >= 4, `the loader's siblings were read (${kids.length})`);
+  for (const [, tag, attrs] of kids) assert.match(attrs, /\bhidden\b/, `a <${tag}> after the loader starts hidden, or the loader would never show`);
+  assert.match(html, /<div[^>]*id="mw-tabs"[^>]*hidden/, 'the tab strip starts hidden');
+  assert.match(html, /<div[^>]*id="mw-panel-watch"/, 'the watch is its own panel');
+  assert.match(html, /market-watch-settings\.css/);
+  assert.match(html, /<script src="\/builders\/market-watch-settings\.js"><\/script>\s*<script src="\/builders\/market-watch\.js"><\/script>/,
+    'the settings script loads before the page script that calls it');
+  for (const f of ['market-watch-settings.html', 'market-watch-settings.states.json']) {
+    assert.throws(() => readFileSync(pub(f)), /ENOENT/, `${f} is gone — the settings live on the tab`);
+  }
+  // The settings script no longer boots itself: it reads only when the page says so.
+  const js = readFileSync(pub('market-watch-settings.js'), 'utf8');
+  assert.doesNotMatch(js, /addEventListener\('DOMContentLoaded'/, 'no self-boot: a non-owner page never asks for the settings');
+  assert.match(js, /window\.OTBMarketWatchSettings = \{ load \}/);
+});
+
+test('SETTINGS TAB: the old settings URL redirects to the tab, and no gate dispatches to it', () => {
+  const serve = readFileSync(new URL('../src/bongos/serve-internal.js', import.meta.url), 'utf8');
+  const decl = 'const RETIRED_MW_SETTINGS_RE = ';
+  const i = serve.indexOf(decl);
+  assert.ok(i > 0, 'the old URL keeps a matcher, so a bookmark still lands');
+  const block = serve.slice(i, i + 700);
+  assert.ok(block.includes('res.redirect(302,'), 'a temporary redirect, never cached past a re-point');
+  assert.ok(block.includes('/market-watch${qs}#settings'), 'landing on the Settings tab, query string kept');
+  const rx = eval(serve.slice(i + decl.length, serve.indexOf(';', i))); // eslint-disable-line no-eval
+  for (const p of ['/builders/market-watch-settings', '/builders/market-watch-settings/', '/builders/market-watch-settings.html']) {
+    assert.ok(rx.test(p), `${p} reaches the redirect`);
+  }
+  for (const p of ['/builders/market-watch', '/builders/market-watch-rules', '/api/bongos/market-watch/settings', '/builders/market-watch-settingsx']) {
+    assert.ok(!rx.test(p), `${p} is not redirected`);
+  }
+  const mwRe = serve.match(/const MARKET_WATCH_PAGE_RE = (\/[^\n]*?\/);/);
+  assert.ok(mwRe, 'the Market Watch page gate is still a literal');
+  const gate = eval(mwRe[1]); // eslint-disable-line no-eval
+  assert.ok(!gate.test('/builders/market-watch-settings'), 'the page gate no longer names the retired page');
+  for (const p of ['/builders/market-watch', '/builders/market-watch-item', '/builders/market-watch-rules']) assert.ok(gate.test(p), p);
+});
+
+test('SETTINGS TAB: the page adopts the shell\'s one /me read instead of asking again', async () => {
+  const owner = bootDesk({ rank: 'archon', shared: Promise.resolve({ builder: { id: '1', rank: 'archon' } }) });
+  await owner.ready();
+  assert.equal(owner.tabsMade.length, 1, 'the shared answer is enough to know the owner');
+  assert.ok(!owner.fetches.some((u) => /\/me$/.test(u)), 'no second /me request');
+  for (const answer of [{ builder: { id: '2', rank: 'metic' } }, false, null]) {
+    const p = bootDesk({ rank: 'archon', shared: Promise.resolve(answer) });
+    await p.ready();
+    assert.equal(p.tabsMade.length, 0, `${JSON.stringify(answer)}: no tab`);
+    assert.ok(!p.fetches.some((u) => /\/me$/.test(u)), 'and no fallback request either');
+  }
+});
+
+test('SETTINGS TAB: a watch that fails to read keeps the owner\'s tab, so the switch and key stay reachable', async () => {
+  const p = bootDesk({ rank: 'archon', homeStatus: 500 });
+  await p.ready();
+  assert.equal(p.els['mw-fail'].hidden, false, 'the failure line shows on the Watch tab');
+  assert.equal(p.tabsMade.length, 1, 'the settings are their own read, so the owner still gets them');
+  assert.equal(p.settingsLoads.length, 1);
+  const member = bootDesk({ rank: 'metic', homeStatus: 500 });
+  await member.ready();
+  assert.equal(member.tabsMade.length, 0, 'and a non-owner still gets none');
+});

package/tests/nav_permission_atoms.mjs

@@ -94,8 +94,8 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // "Upgraded to core X" notice after a move; task 1004826: Standing is Accomplishments;
 // task 1004846: the new logo (its bump landed late, in task 1004852); task 1004938: the
 // Market Watch settings nav item and its fuel glyph; task 1005041: the Update pill replaced the
-// core-update banner.
-const SHELL_SHA = '9e32caf8aa17dd36';
+// core-update banner; task 1005045: the Market Watch settings item left (one sidebar item).
+const SHELL_SHA = '4a4b9795cdea422c';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/modules/hall-ui/public/market-watch-settings.html

@@ -1,115 +0,0 @@
-<!doctype html>
-<html lang="en">
-<head>
-  <meta charset="utf-8">
-  <meta name="viewport" content="width=device-width, initial-scale=1">
-  <title>Market Watch settings — {{worldName}}</title>
-  <meta name="description" content="Turn Market Watch on or off, set its monthly AI cap and how often it runs, see what it spent this month, and set the project's Anthropic key.">
-  <link rel="icon" href="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 32 32'><text x='16' y='24' font-size='24' text-anchor='middle' font-family='sans-serif'>⌂</text></svg>">
-  <link rel="preconnect" href="https://fonts.googleapis.com">
-  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-  <link rel="stylesheet" href="/builders/style.css?v=2026-09-23-changelist1">
-  <link rel="stylesheet" href="/builders/market-watch-settings.css">
-</head>
-<body data-page="market-watch-settings" data-page-title="Market Watch">
-
-<div class="app">
-  <aside class="app-sidebar" id="app-sidebar" aria-label="Primary"></aside>
-  <div class="app-scrim" id="app-scrim" hidden></div>
-  <div class="app-body">
-    <header class="app-topbar" id="app-topbar"></header>
-    <div class="app-content">
-      <!-- The page's one h1, for screen readers: no page shows its head (task 1004836). -->
-      <div class="page-head page-head--board">
-        <h1 class="page-head__h">Market Watch settings</h1>
-      </div>
-
-      <main id="hall-main">
-        <!-- task 1005043: the page loader, shown until any section below is revealed. -->
-        <p class="hall-loading hall-loading--page hall-loading--wait" role="status">Loading…</p>
-        <!-- What a reader who is not the owner sees. The routes are the wall (403); this is
-             only what stands in for an empty gauge. -->
-        <section class="scroll" id="mws-sealed" aria-labelledby="mws-sealed-h" hidden>
-          <h2 class="scroll__h" id="mws-sealed-h">Owner only</h2>
-          <p class="scroll__lede">Only the project owner can see and change Market Watch settings.</p>
-        </section>
-
-        <section class="scroll" id="mws-off" aria-labelledby="mws-off-h" hidden>
-          <h2 class="scroll__h" id="mws-off-h">Market Watch is not on this project</h2>
-          <p class="scroll__lede">Turn the Market Watch module on under <a href="/modules">Modules</a> first. Its settings appear here once it is running.</p>
-        </section>
-
-        <p class="mws-error" id="mws-error" role="alert" hidden></p>
-
-        <!-- The fuel gauge (docs/design/mocks/market-watch/settings.html, option B). Drawn
-             by market-watch-settings.js from GET /market-watch/settings. -->
-        <section class="scroll mws" id="mws-body" aria-label="Market Watch settings" hidden>
-          <div class="mws-hero">
-            <div class="mws-ring" id="mws-ring">
-              <svg viewBox="0 0 100 100" aria-hidden="true">
-                <circle class="mws-ring__track" cx="50" cy="50" r="44" pathLength="100"/>
-                <circle class="mws-ring__spent" id="mws-arc" cx="50" cy="50" r="44" pathLength="100" stroke-dasharray="0 100"/>
-                <circle class="mws-ring__next" id="mws-arc2" cx="50" cy="50" r="44" pathLength="100" stroke-dasharray="0 100"/>
-              </svg>
-              <div class="mws-ring__c">
-                <div>
-                  <div class="mws-ring__big" id="mws-spent">$0</div>
-                  <div class="mws-soft" id="mws-of"></div>
-                  <div class="mws-pill" id="mws-left"></div>
-                </div>
-              </div>
-            </div>
-
-            <div class="mws-controls">
-              <button type="button" class="mws-power" id="mws-power" aria-pressed="false">
-                <span id="mws-power-t">Market Watch is off</span><i aria-hidden="true">&#x23FB;</i>
-              </button>
-
-              <div class="mws-slide">
-                <label class="mws-soft" for="mws-cap">monthly AI cap</label>
-                <span class="mws-cap" id="mws-cap-t">$20</span>
-                <input type="range" min="5" max="60" step="5" value="20" id="mws-cap">
-                <span class="mws-soft" id="mws-hint"></span>
-              </div>
-
-              <div class="mws-cad" id="mws-cad" role="group" aria-label="how often it runs">
-                <button type="button" class="mws-chip" data-c="weekly">weekly</button>
-                <button type="button" class="mws-chip" data-c="biweekly">every 2 weeks</button>
-                <button type="button" class="mws-chip" data-c="monthly">monthly</button>
-              </div>
-            </div>
-          </div>
-
-          <div class="mws-lbl" id="mws-weeks-h">the last weeks</div>
-          <ol class="mws-weeks" id="mws-weeks" aria-labelledby="mws-weeks-h"></ol>
-          <div class="mws-legend" id="mws-legend"></div>
-
-          <!-- The project's own Anthropic key: write-only. The page only ever learns whether
-               one is set; it can replace it or clear it, never read it. -->
-          <div class="mws-lbl">anthropic key</div>
-          <div class="mws-key" id="mws-key">
-            <span class="mws-key__state" id="mws-key-state">not set</span>
-            <input type="password" id="mws-key-in" autocomplete="off" spellcheck="false" placeholder="paste the project's key" aria-label="the project's Anthropic key">
-            <button type="button" class="btn" id="mws-key-save">Save</button>
-            <button type="button" class="btn btn--ghost" id="mws-key-clear" hidden>Clear</button>
-          </div>
-          <p class="mws-soft mws-key__note" id="mws-key-note">Runs use this key, so the project's Anthropic account pays for them. It is stored encrypted and never shown again.</p>
-        </section>
-      </main>
-
-      <footer class="app-foot" id="app-foot"></footer>
-    </div>
-  </div>
-</div>
-
-<div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
-
-<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
-<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
-<script src="/builders/craft-mode.js?v=2026-10-30-market-watch"></script>
-<script src="/builders/shell.js?v=2026-11-03-update-pill"></script>
-<script src="/builders/palette.js" defer></script>
-<script src="/builders/hall-kit.js"></script>
-<script src="/builders/market-watch-settings.js"></script>
-</body>
-</html>

package/modules/hall-ui/public/market-watch-settings.states.json

@@ -1,14 +0,0 @@
-{
-  "_": "MARKET WATCH SETTINGS (task 1004938; design of record docs/design/mocks/market-watch/settings.html, option B, the fuel gauge) through modules/ui-design/kit/render.js. The page reads ONE owner-only route, GET /market-watch/settings, so against the kit's own stub it renders its 'module is off' state (the 404), which the floors must hold too. To look at the populated gauge run it against the hall-preview harness, whose market-watch__settings.json fixture carries the mockup's month (12.40 of 20 spent, six runs, one skipped at the cap):\n\n  node scripts/hall-preview/server.js --port 4620 --fixture-me --rank archon\n  node modules/ui-design/kit/render.js --states modules/hall-ui/public/market-watch-settings.states.json --base-in http://localhost:4620 --base-out http://localhost:4620",
-  "page": "/builders/market-watch-settings",
-  "surface": "hall-ui",
-  "stub": { "prefix": "/builders/" },
-  "modeQuery": false,
-  "ignoreRequests": ["/api/(gds|bongos)/"],
-  "ignoreConsole": ["/api/(gds|bongos)/", "\\b401\\b", "\\b403\\b", "\\b404\\b", "Unauthorized", "Forbidden", "Not Found", "load failed"],
-  "states": {
-    "gauge": { "auth": true, "actions": [["wait", 900], ["clickIfVisible", "[data-craft-close]"], ["wait", 300]], "expect": { "visible": ["#mws-body"] } },
-    "out": { "auth": false, "actions": [["wait", 600]] }
-  },
-  "reducedMotion": { "auth": true, "actions": [["wait", 800]] }
-}