@bongos/core 1.24.57 → 1.24.59

package/tests/deploy_handoff.mjs

@@ -85,7 +85,7 @@ afterEach(() => { for (const id of armed) clearTimeout(id); armed.clear(); });
 const settle = (ms = 0) => new Promise((r) => setTimeout(r, ms));
 const plain = (x) => JSON.parse(JSON.stringify(x));
 
-function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }] } = {}) {
+function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin }); } }, preview = PREVIEW, post = { ok: true, status: 200, data: { ok: true } }, rows = [{ id: '14', slug: 'toast', domain: 'toast.cloudbongos.com' }], search = '?project=toast&handoff=1' } = {}) {
   const told = [];
   const requests = [];
   const listeners = {};
@@ -105,7 +105,7 @@ function boot({ opener = { postMessage(msg, origin) { told.push({ msg, origin })
   if (opener) opener.postMessage = (msg, origin) => told.push({ msg, origin });
   const windowObj = {
     OTB: realOTB(), document: documentObj, opener, __handoffHearMs: 30,
-    location: { protocol: 'https:', pathname: '/deploy', search: '?project=toast&handoff=1', assign() {} },
+    location: { protocol: 'https:', pathname: '/deploy', search, assign() {} },
     addEventListener: (ev, fn) => { (listeners[ev] ||= []).push(fn); },
     setTimeout: (fn, ms) => { const id = setTimeout(fn, ms); armed.add(id); return id; },
     close() { closed = true; },
@@ -150,6 +150,27 @@ test('the go from the project\'s own hall moves it to that version, says so, and
   assert.match(b.body.innerHTML, /The update has started/);
 });
 
+// task 1005128: a hosted project whose server never learned its slug sends ?host=<address>.
+test('?host= finds the project by its registered address, among the visitor\'s own, and moves it the same way', async () => {
+  const rows = [{ id: '9', slug: 'other', domain: 'other.cloudbongos.com' }, { id: '14', slug: 'toast', domain: 'Toast.CloudBongos.com' }];
+  const b = boot({ rows, search: '?host=toast.cloudbongos.com&handoff=1' });
+  await settle(5);
+  assert.deepEqual(plain(b.told), [{ msg: { tag: 'bongos-update', step: 'ready' }, origin: 'https://toast.cloudbongos.com' }]);
+  b.message(GO);
+  await settle(5);
+  assert.equal(b.posts().length, 1);
+  assert.equal(b.posts()[0].path, '/api/bongos/provisioning/instances/14/core-upgrade');
+
+  const none = boot({ rows, search: '?host=nobody.cloudbongos.com&handoff=1' });
+  await settle(5);
+  assert.equal(none.posts().length, 0);
+  assert.match(none.body.innerHTML, /No project called nobody\.cloudbongos\.com/);
+
+  const slugIsNotHost = boot({ rows, search: '?host=toast&handoff=1' });
+  await settle(5);
+  assert.equal(slugIsNotHost.told.length, 0, 'a bare slug in ?host= matches no address');
+});
+
 test('a go from another site, or another window, moves nothing', async () => {
   const b = boot();
   await settle(5);

package/tests/deploy_page_projects.mjs

@@ -34,14 +34,14 @@ const preview = (id, slug, over = {}) => ({
 
 // The fleet as the control plane really reports it: mostly torn down, a couple live.
 const FLEET = [
-  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'cloud-host' },
+  { id: '31', slug: 'mercury', status: 'active', hosting_shape: 'cloud-host', domain: 'mercury.cloudbongos.com' },
   { id: '32', slug: 'hoodify-finance', status: 'active', hosting_shape: 'co-tenant' },
   { id: '33', slug: 'walk-lantern', status: 'torn_down', hosting_shape: 'cloud-host' },
   { id: '34', slug: 'testccc', status: 'torn_down', hosting_shape: 'cloud-host' },
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'cloud-host' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null, href = null } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200, scope = null, search = null, href = null } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
@@ -99,7 +99,7 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
       sleep: (ms) => new Promise((r) => setTimeout(r, ms)) }, // dom-utils' OTB.sleep (task 1004893)
     // `search` is what decides which project the page is about. A stub without it is the
     // shape the page has to survive, and the default here keeps that path exercised.
-    location: { assign() {}, search: scope ? `?project=${encodeURIComponent(scope)}` : '', ...(href ? { href } : {}) },
+    location: { assign() {}, search: search != null ? search : (scope ? `?project=${encodeURIComponent(scope)}` : ''), ...(href ? { href } : {}) },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
   // setTimeout made every case whose preview never converges sit out the page's full
@@ -155,6 +155,38 @@ test('?project= renders THAT project, by slug, and still only one row', async ()
   assert.ok(!b.gets.includes('/provisioning/control-plane'), 'and the self row is not even read');
 });
 
+// task 1005128: a hosted project whose server never learned its slug sends its owner by address.
+test('?host= renders the project registered at THAT address, named by its slug, on its own id', async () => {
+  const b = boot({ search: '?host=Mercury.CloudBongos.com' });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /mercury/);
+  assert.doesNotMatch(html, /hoodify-finance/, 'no other project');
+  assert.ok(!b.gets.includes('/provisioning/control-plane'), 'the self row is not read');
+  b.els.get('dp-preview-31')._on.click();
+  b.els.get('dp-confirm-31')._on.click();
+  await b.settle();
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1);
+  assert.equal(moves[0].path, '/provisioning/instances/31/core-upgrade');
+});
+
+test('?host= matches only a registered address: a slug, or an address nobody registered, finds nothing', async () => {
+  for (const search of ['?host=mercury', '?host=nobody.cloudbongos.com', '?host=hoodify-finance']) {
+    const b = boot({ search });
+    await b.settle();
+    assert.match(b.panel(), /no project by that name is hosted here/, search);
+    assert.equal(b.posts.length, 0, search);
+  }
+});
+
+test('?project= wins over ?host= when both are given', async () => {
+  const b = boot({ search: '?project=hoodify-finance&host=mercury.cloudbongos.com' });
+  await b.settle();
+  assert.match(b.panel(), /hoodify-finance/);
+  assert.doesNotMatch(b.panel(), /mercury/);
+});
+
 test('a scoped project is offered its own move, on its own id', async () => {
   const b = boot({ scope: 'mercury' });
   await b.settle();

package/tests/design_counts_ratchet.mjs

@@ -99,6 +99,8 @@ const GENERATOR_SOURCES = [
   'modules/hall-ui/public/controls.css',
   'modules/hall-ui/public/dom-utils.js',
   'scripts/bongos/gen-brand.js',
+  'src/brand-mark.js',
+  'src/html-escape.js',
   'DESIGN.md',
 ];
 
@@ -132,3 +134,39 @@ test('the freshness gate passes on a fresh tree and fails when the token sheet c
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+// task 1005133: the logo set joins the gate. Editing the one source (mark.svg) without
+// running gen-brand.js fails it; so does a PNG whose source page moved (the pack's ground)
+// or a PNG swapped by hand — the PNGs are checked by hash, not just their pixel size.
+test('the freshness gate covers the logo set: mark.svg, the pack and both PNGs', () => {
+  const dir = copiedTree();
+  const brand = path.join(dir, 'modules/ui-design/public/brand');
+  const gate = () => checkDesignGeneratorsFresh(dir).filter((x) => x.startsWith('the logo set'));
+  try {
+    assert.deepEqual(gate(), [], 'the copied logo set should start fresh');
+
+    const mark = path.join(brand, 'mark.svg');
+    const src = fs.readFileSync(mark, 'utf8');
+    const moved = src.replace(/(id="mark-dot"[^>]*?\br=")(\d+)/, (_, a, r) => a + (Number(r) + 1));
+    assert.notEqual(moved, src, 'mark.svg should carry the moon\'s radius');
+    fs.writeFileSync(mark, moved);
+    assert.ok(gate().some((x) => /mark-light\.svg/.test(x)), `editing mark.svg must fail the gate: ${gate().join('\n')}`);
+    fs.writeFileSync(mark, src);
+    assert.deepEqual(gate(), [], 'restoring mark.svg restores the gate');
+
+    const pngFile = path.join(brand, 'og-card.png');
+    const png = fs.readFileSync(pngFile);
+    const swapped = Buffer.from(png); swapped[swapped.length - 20] ^= 0xff; // same size, other bytes
+    fs.writeFileSync(pngFile, swapped);
+    assert.ok(gate().some((x) => /og-card\.png \(the file is not the one --png wrote\)/.test(x)), gate().join('\n'));
+    fs.writeFileSync(pngFile, png);
+
+    const packFile = path.join(dir, 'config/branding.neutral.json');
+    const pack = JSON.parse(fs.readFileSync(packFile, 'utf8'));
+    pack.theme.ui.colors.bg = '#edeced';
+    fs.writeFileSync(packFile, JSON.stringify(pack, null, 2));
+    assert.ok(gate().some((x) => /apple-touch-icon\.png \(its source page changed/.test(x)), gate().join('\n'));
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});

package/tests/design_reference.mjs

@@ -88,7 +88,7 @@ test('the shared components, the logo and the naming rule are on the page', () =
   }
   assert.equal((PAGE.match(/data-ref="tones"[^>]*>(.*?)<\/div>/) || [])[1].match(/status-pill--/g).length, 6, 'six tones');
   assert.match(PAGE, /<use href="\/modules\/ui-design\/public\/brand\/mark\.svg#mark"\/>/, 'the mark is drawn from its one source');
-  assert.match(PAGE, /<span class="ref-lockup__name">cloud bongos<\/span>/, 'the wordmark is lowercase (DESIGN.md Naming)');
+  assert.match(PAGE, /<span class="ref-lockup__name">\{\{productName\}\}<\/span>/, 'the wordmark is the pack\'s name, stamped at serve time (task 1005135)');
   assert.match(PAGE, /Never &quot;CloudBongos&quot;/, 'the naming rule is read from DESIGN.md');
   for (const f of ['mark-light.svg', 'mark-dark.svg', 'mark-mono.svg', 'favicon.svg']) assert.ok(PAGE.includes(`brand/${f}"`), `lists ${f}`);
 });

package/tests/provision_settings_apply.mjs

@@ -658,5 +658,57 @@ t('both tenant shapes get the hub door for THEIR slug; no other shape gets the k
   }
 });
 
+console.log('\nthe backfill — every core move writes the Update button\'s address (task 1005128):');
+
+t('a web.env with no line gets it; one already right is left alone; an empty file or a shape with no door is never patched', () => {
+  const saved = process.env.PROVISION_HUB_ORIGIN;
+  process.env.PROVISION_HUB_ORIGIN = 'https://hub.example.com';
+  try {
+    const U = require('../scripts/bongos/provision-units.js');
+    const key = `${NEUTRAL_PREFIX}_HUB_UPGRADE_URL`;
+    const want = 'https://hub.example.com/deploy?project=toast';
+    const toast = { slug: 'toast', hosting_shape: 'cloud-host' };
+    const before = 'PORT=3011\nPGDATABASE=toast\n';
+    const after = U.hubUpgradeEnvPatch(before, toast);
+    assert.match(after, new RegExp(`^${key}=https://hub\\.example\\.com/deploy\\?project=toast$`, 'm'), 'the line is added');
+    assert.match(after, /^PORT=3011$/m, 'every other line kept');
+    assert.match(after, /^PGDATABASE=toast$/m);
+    assert.equal(U.hubUpgradeEnvPatch(after, toast), null, 'already right: nothing to write');
+    assert.match(U.hubUpgradeEnvPatch(`${before}${key}=\n`, toast), new RegExp(`^${key}=${want.replace(/[.?]/g, '\\$&')}$`, 'm'), 'an empty line is filled');
+    assert.equal(U.hubUpgradeEnvPatch('', toast), null, 'an empty file is never patched into a one-line body');
+    assert.equal(U.hubUpgradeEnvPatch(null, toast), null);
+    assert.equal(U.hubUpgradeEnvPatch(before, { slug: 'x', hosting_shape: 'byo-host' }), null, 'no door on this hub, nothing written');
+  } finally {
+    if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;
+  }
+});
+
+t('the move writes it before it runs, and a failed read or write never stops the move', () => {
+  const saved = process.env.PROVISION_HUB_ORIGIN;
+  process.env.PROVISION_HUB_ORIGIN = 'https://hub.example.com';
+  try {
+    const { backfillHubUpgradeUrl } = require('../scripts/bongos/provision-core-upgrade.js');
+    const toast = { slug: 'toast', hosting_shape: 'cloud-host' };
+    const writes = [];
+    const logs = [];
+    const deps = { privileged: true, log: (l) => logs.push(l), controlWriteFile: (p, body, o) => writes.push({ p, body, o }) };
+    const exec = (cmd) => (/cat .*web\.env$/.test(cmd) ? { stdout: 'PORT=3011\n' } : { stdout: '' });
+    assert.equal(backfillHubUpgradeUrl(toast, deps, exec), true);
+    assert.equal(writes.length, 1);
+    assert.match(writes[0].p, /toast\/web\.env$/);
+    assert.match(writes[0].body, /_HUB_UPGRADE_URL=https:\/\/hub\.example\.com\/deploy\?project=toast$/m);
+    assert.equal(writes[0].o.mode, 0o600);
+    assert.equal(backfillHubUpgradeUrl(toast, deps, () => ({ softFailed: true })), false, 'unreadable: nothing written');
+    const ran = [];
+    assert.equal(backfillHubUpgradeUrl({ slug: 'x; rm -rf /', hosting_shape: 'cloud-host' }, deps, (c) => { ran.push(c); return { stdout: 'PORT=1\n' }; }), false, 'a slug that is not a slug');
+    assert.deepEqual(ran, [], 'and no command is built from it');
+    assert.equal(backfillHubUpgradeUrl(toast, { ...deps, controlWriteFile: () => { throw new Error('EACCES'); } }, exec), false, 'a refused write is logged, not thrown');
+    assert.ok(logs.some((l) => /the move goes on/.test(l)));
+    assert.equal(writes.length, 1);
+  } finally {
+    if (saved === undefined) delete process.env.PROVISION_HUB_ORIGIN; else process.env.PROVISION_HUB_ORIGIN = saved;
+  }
+});
+
 console.log(`\nprovision_settings_apply: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/software_update.mjs

@@ -219,8 +219,7 @@ async function drive(deps) {
   const build = require('../src/bongos/routes/core-update.js');
   const express = require('express');
   const app = express();
-  // The ask state's stored row is the DB's; these tests never reach one (task 1004595).
-  app.use(build({ askDeps: () => ({ hub: 'https://cloudbongos.com', getSetting: async () => null }), ...deps }));
+  app.use(build({ ...deps }));
   auth.requireBuilder = saved;
   const server = app.listen(0);
   await new Promise((r) => server.once('listening', r));
@@ -261,6 +260,33 @@ test('HUB_UPGRADE_URL is taken only as a hub /deploy address; anything else stay
   }
 });
 
+// Task 1005128: toast predates HUB_UPGRADE_URL and federates no sign-in, so it fell to `cli`
+// and its owner was offered "Ask for this upgrade". A project on a name under its hub's own
+// domain is the hub's, so it goes to the hub's door by its address.
+test('a hosted project with neither address still gets the hub\'s door, by its own address (task 1005128)', async () => {
+  const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+    doorInputs: () => ({ provisioning: false, idp: null, hubUpgradeUrl: null, hub: 'https://cloudbongos.com', host: 'Toast.CloudBongos.com' }) });
+  assert.deepEqual(r.body.door, { kind: 'hub', url: 'https://cloudbongos.com/deploy?host=toast.cloudbongos.com' });
+  assert.equal('ask' in r.body, false, 'the panel is never told to offer an ask');
+});
+
+test('only a name under the hub\'s domain is the hub\'s: a self-hosted name, the hub itself, or no hub stays cli (task 1005128)', async () => {
+  const cases = [
+    { hub: 'https://cloudbongos.com', host: 'shop.example.org' },
+    { hub: 'https://cloudbongos.com', host: 'cloudbongos.com' },
+    { hub: 'https://cloudbongos.com', host: 'evilcloudbongos.com' },
+    { hub: null, host: 'toast.cloudbongos.com' },
+    { hub: 'https://cloudbongos.com', host: 'localhost' },
+    { hub: 'https://cloudbongos.com', host: '' },
+    { hub: 'javascript:alert(1)', host: 'toast.cloudbongos.com' },
+  ];
+  for (const c of cases) {
+    const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true,
+      doorInputs: () => ({ provisioning: false, idp: null, ...c }) });
+    assert.deepEqual(r.body.door, { kind: 'cli', url: null }, JSON.stringify(c));
+  }
+});
+
 test('a self-hosted instance has no door to link, and says how it is upgraded instead', async () => {
   const r = await drive({ softwareUpdate: async () => STUB_UPDATE, canUpdate: async () => true, doorInputs: () => ({ provisioning: false, idp: null }) });
   assert.deepEqual(r.body.door, { kind: 'cli', url: null });
@@ -600,9 +626,13 @@ test('the route hands the reader the follow of the hall it serves: candidates on
   }
 });
 
-test('[source] the upgrade request asks with the same follow as the panel (task 1004593)', () => {
-  const seg = ROUTE_SRC.slice(ROUTE_SRC.indexOf("'/software-update/request'"), ROUTE_SRC.indexOf("'/project/manage-link'"));
-  assert.match(seg, /softwareUpdate\(\{ running, channel, follow: followFor\(door\) \}\)/, 'the version asked for is one the runner would take');
+test('[source] there is no "Ask for this upgrade" route or panel any more (task 1005128)', () => {
+  assert.equal(ROUTE_SRC.includes('/software-update/request'), false, 'the route is gone');
+  assert.equal(fs.existsSync(path.join(ROOT, 'src/bongos/upgrade-request.js')), false, 'and its module');
+  for (const f of ['modules/hall-ui/public/settings-software-update.js', 'modules/hall-ui/public/update-pill.js']) {
+    const src = fs.readFileSync(path.join(ROOT, f), 'utf8');
+    assert.equal(/software-update\/request|Ask for this/.test(src), false, f);
+  }
 });
 
 test('[source] the port the route reads is the port the provisioning module registers and declares (task 1004535)', () => {

package/tests/update_pill.mjs

@@ -93,13 +93,18 @@ test('what the update brings: the first lines, dashes as commas (V4), and an hon
   assert.equal(long.more, true, 'older versions left out make the count a floor');
 });
 
-test('the door decides the button: local, hub (by its origin), ask, the command, or none', () => {
+test('the door decides the button: local, hub (by its origin), the command, or none', () => {
   assert.deepEqual(P.doorPlan(SW({ kind: 'local', url: '/deploy' })), { kind: 'local' });
   assert.deepEqual(P.doorPlan(SW({ kind: 'hub', url: HUB })), { kind: 'hub', url: HUB, origin: 'https://cloudbongos.com' });
   assert.equal(P.doorPlan(SW({ kind: 'hub', url: 'https://cloudbongos.com/elsewhere' })).kind, 'none', 'only a hub /deploy address');
   assert.equal(P.doorPlan(SW({ kind: 'hub', url: 'javascript:alert(1)' })).kind, 'none');
   assert.equal(P.doorPlan(SW({ kind: 'cli', url: null })).kind, 'cli');
-  assert.equal(P.doorPlan(SW({ kind: 'cli', url: null }, { ask: { available: true } })).kind, 'ask');
+  // task 1005128: there is no "ask" plan any more, whatever a stale reading carries.
+  assert.equal(P.doorPlan(SW({ kind: 'cli', url: null }, { ask: { available: true } })).kind, 'cli');
+  // A hosted project whose server never learned its slug goes to the hub by its address.
+  const BY_HOST = 'https://cloudbongos.com/deploy?host=toast.cloudbongos.com';
+  assert.deepEqual(P.doorPlan(SW({ kind: 'hub', url: BY_HOST })), { kind: 'hub', url: BY_HOST, origin: 'https://cloudbongos.com' });
+  assert.equal(P.doorPlan(SW({ kind: 'hub', url: 'https://cloudbongos.com/deploy?who=x' })).kind, 'none', 'only ?project= or ?host=');
   assert.equal(P.doorPlan(SW({ kind: 'local', url: '/deploy' }, { can_update: 'yes' })).kind, 'none', 'can_update is strictly true');
   assert.equal(P.doorPlan(null).kind, 'none');
 });
@@ -379,7 +384,7 @@ test('a blocked window is said, with a second press that opens it', async () =>
   assert.ok(again, 'a button to try again');
 });
 
-test('a self-hosted project names the command; an operator-run one offers to ask; a viewer who may not, nothing', async () => {
+test('a self-hosted project names the command; nobody is ever offered to ask; a viewer who may not, nothing', async () => {
   const cli = boot({ sw: SW({ kind: 'cli', url: null }) });
   await settle(); cli.press(cli.pill()); await settle();
   assert.match(cli.card().innerHTML, /<code>bongos upgrade<\/code>/);
@@ -387,8 +392,7 @@ test('a self-hosted project names the command; an operator-run one offers to ask
 
   const ask = boot({ sw: SW({ kind: 'cli', url: null }, { ask: { available: true, hub_host: 'cloudbongos.com' } }) });
   await settle(); ask.press(ask.pill()); await settle();
-  assert.match(ask.card().innerHTML, /id="upd-ask"/);
-  assert.match(ask.card().innerHTML, /the team at cloudbongos\.com/);
+  assert.doesNotMatch(ask.card().innerHTML, /upd-ask|Ask for this/, 'task 1005128: no ask, ever');
 
   const no = boot({ sw: SW({ kind: 'local', url: '/deploy' }, { can_update: false }) });
   await settle(); no.press(no.pill()); await settle();

package/tests/wordmark_and_faces.mjs

@@ -0,0 +1,111 @@
+// tests/wordmark_and_faces.mjs — the logo wordmark is the pack's name in lowercase, and
+// no served page loads a retired face (task 1005135, goal 1000138).
+//
+// DESIGN.md "Naming": beside the mark the name is lowercase ("cloud bongos"), and
+// platform code never hardcodes either spelling; it reads the pack. The UI check found
+// the status page, the 404/500 pages and the API docs showing "Cloud Bongos" beside the
+// mark, and /brand baking the neutral pack's name into its generated HTML. The sign-in
+// error and confirming-access pages still loaded Cinzel and EB Garamond. This pins:
+//   1. every wordmark beside the mark is the {{productName}} hole (stamped from the pack
+//      at serve time), never a typed-in name, and the rule that styles it lowercases it;
+//   2. no served page source (the auth pages, the sign-in shell, the error page, the API
+//      docs, the status page, the hall, the landing) names Cinzel or Garamond, and the
+//      rendered auth pages carry the pack's own font links instead;
+//   3. the error page declares no colour of its own: it reads the hall sheet's tier.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const stripComments = (s) => s.replace(/\/\*[\s\S]*?\*\//g, '').replace(/<!--[\s\S]*?-->/g, '').replace(/(^|[^:'"`\\])\/\/[^\n]*/g, '$1');
+
+const { errorPageTemplate } = require('../src/error-page.js');
+const { clientBranding } = require('../src/branding.js');
+const authRoutes = require('../src/bongos/routes/auth.js');
+const signIn = require('../src/bongos/sign-in-pages.js');
+
+// The CSS rule for a selector, from a sheet or an inline <style>. Throws when missing.
+function ruleOf(css, selector) {
+  const esc = selector.replace(/[.*+?^${}()|[\]\\#]/g, '\\$&');
+  const m = stripComments(css).match(new RegExp(`(?:^|[}\\s,])${esc}\\s*\\{([^}]*)\\}`));
+  assert.ok(m, `a rule for ${selector}`);
+  return m[1];
+}
+const lowercased = (body) => /text-transform\s*:\s*lowercase/.test(body);
+
+// Each wordmark beside the mark: [where, the markup that must carry the pack's hole, the
+// sheet that styles it, the selector of its rule].
+const WORDMARKS = [
+  ['the status page', read('modules/status-ui/public/index.html'), /<span class="topbar__name">\{\{productName\}\}<\/span>/, read('modules/status-ui/public/style.css'), '.topbar__name'],
+  ['the 404 page', errorPageTemplate(404), /<a class="name" href="\/">\{\{productName\}\}<\/a>/, errorPageTemplate(404), '.name'],
+  ['the 500 page', errorPageTemplate(500), /<a class="name" href="\/">\{\{productName\}\}<\/a>/, errorPageTemplate(500), '.name'],
+  ['the API docs', read('public-docs/index.html'), /<span class="wordmark">\{\{productName\}\}<\/span>/, read('public-docs/index.html'), '#topbar .wordmark'],
+  ['/brand (bar)', read('modules/ui-design/public/brand.html'), /<a class="ref-head__brand"[^>]*>.*<span>\{\{productName\}\}<\/span><\/a>/, read('modules/ui-design/public/brand.css'), '.ref-head__brand'],
+  ['/brand (lockup)', read('modules/ui-design/public/brand.html'), /<span class="ref-lockup__name">\{\{productName\}\}<\/span>/, read('modules/ui-design/public/brand.css'), '.ref-lockup'],
+  ['the hall', read('modules/hall-ui/public/style.css'), /\.brand-mark\s*\{/, read('modules/hall-ui/public/style.css'), '.brand-mark'],
+];
+
+test('every wordmark beside the mark is the pack\'s name, lowercased by its rule', () => {
+  for (const [where, markup, hole, css, selector] of WORDMARKS) {
+    assert.match(markup, hole, `${where}: the wordmark is the {{productName}} hole`);
+    assert.ok(lowercased(ruleOf(css, selector)), `${where}: ${selector} sets text-transform: lowercase`);
+  }
+});
+
+test('no typed-in product name beside the mark', () => {
+  // A capitalised (or any) literal in a wordmark element is exactly the regression.
+  const literal = /class="(?:topbar__name|name|wordmark|ref-lockup__name)"[^>]*>(?!\{\{)[^<]+</;
+  for (const [where, markup] of WORDMARKS) assert.doesNotMatch(markup, literal, `${where}: no literal name in the wordmark`);
+  assert.doesNotMatch(read('modules/ui-design/public/brand.html'), /ref-head__brand[^>]*>.*<span>(?!\{\{)[^<]+<\/span><\/a>/, '/brand bar: no literal name');
+  // the generator writes the hole, never the pack's name it happened to read
+  assert.doesNotMatch(read('modules/ui-design/scripts/gen-design-reference.js'), /productName\)?\.toLowerCase\(\)|product\.toLowerCase\(\)/);
+});
+
+const RETIRED = /Cinzel|Garamond/i;
+const SERVED = [
+  'src/bongos/routes/auth.js', 'src/bongos/sign-in-pages.js', 'src/bongos/routes/auth-google.js', 'src/error-page.js',
+  'public-docs/index.html', 'modules/status-ui/public/index.html', 'modules/status-ui/public/style.css',
+  'modules/ui-design/public/brand.html', 'modules/ui-design/public/brand.css',
+  'modules/hall-ui/public/style.css', 'modules/hall-ui/public/controls.css',
+];
+
+test('no served page source loads a retired face', () => {
+  for (const rel of SERVED) {
+    if (!fs.existsSync(path.join(ROOT, rel))) continue;
+    // read raw: a comment stripper over JS eats template strings (a `/*` in a URL glob),
+    // so these files name the retired faces nowhere at all, comments included
+    assert.doesNotMatch(read(rel), RETIRED, `${rel} names a retired face`);
+  }
+});
+
+test('the auth pages carry the pack\'s faces and the shared sheet, and nothing else', () => {
+  const links = (clientBranding().theme && clientBranding().theme.fonts && clientBranding().theme.fonts.links) || [];
+  const pages = [
+    ['sign-in error', authRoutes.renderAuthErrorPage('Sign-in failed', 'The sign-in did not complete.')],
+    ['confirming access', authRoutes.renderAccessPendingPage('someone', '/api/bongos/auth/web/start')],
+    ['sign-in chooser', signIn.renderSignInChooser({ githubHref: '/g', googleHref: '/o' })],
+  ];
+  for (const [name, html] of pages) {
+    assert.ok(html.includes('<link rel="stylesheet" href="/builders/style.css">'), `${name}: the hall sheet`);
+    for (const href of links) assert.ok(html.includes(href.replace(/&/g, '&amp;')), `${name}: the pack's font link ${href}`);
+    const own = html.match(/https:\/\/fonts\.googleapis\.com\/css2\?[^"]*/g) || [];
+    for (const href of own) assert.ok(links.some((l) => l.replace(/&/g, '&amp;') === href || l === href), `${name}: ${href} is not the pack's`);
+  }
+});
+
+test('the error page declares no colour of its own', () => {
+  for (const status of [404, 500]) {
+    const html = errorPageTemplate(status);
+    const style = (html.match(/<style>([\s\S]*?)<\/style>/) || [])[1] || '';
+    assert.ok(style, 'the page has its layout rules');
+    const declarations = style.replace(/--[\w-]+\s*:[^;}]*/g, '');
+    assert.doesNotMatch(style, /--(bg|ink|accent|rule)[\w-]*\s*:/, 'no colour token is defined on the page');
+    assert.doesNotMatch(declarations, /#[0-9a-f]{3,8}\b|rgba?\(/i, 'no typed-in colour');
+    assert.ok(html.includes('<link rel="stylesheet" href="/modules/hall-ui/public/style.css">'), 'the colours come from the shared sheet');
+  }
+});

package/src/bongos/upgrade-request.js

@@ -1,158 +0,0 @@
-'use strict';
-
-// src/bongos/upgrade-request.js — "Ask for this upgrade" on Settings → Software update
-// (task 1004595).
-//
-// WHY. A project that Cloud Bongos hosts is upgraded by the people who run its server,
-// not by its owner. Its Settings page said "Update ready" and then nothing: no button,
-// no next step (Will, mercury, 2026-10-06, 46 versions behind with nobody told). This
-// file gives that owner one press that reaches the operator, and remembers that it was
-// pressed so the page can say the request is pending.
-//
-// THE CHANNEL IS ONE THAT ALREADY EXISTS: the direct feedback door (task 1004591). The
-// project issues a one-time receipt for the signed-in builder in its OWN receipt store
-// (src/bongos/routes/feedback.js), then posts the request straight to the hub's
-// POST /api/bongos/sso/feedback/direct. The hub redeems the receipt at this project's
-// public URL, so the request lands in the maintainers' backlog attributed to the person
-// who really pressed the button, with no new credential and no new hub route.
-//
-// ONE REQUEST PER TARGET VERSION. Asking again for a version already asked for is
-// answered from the stored row and sends nothing. A different version may be asked for
-// once the cooldown has passed, so a project that falls further behind can say so,
-// without a press per patch release flooding the backlog.
-
-const crypto = require('node:crypto');
-
-const SETTING_KEY = 'software_update.request';
-const COOLDOWN_MS = 24 * 60 * 60 * 1000;
-const HUB_TIMEOUT_MS = 15000;
-
-const VERSION_RE = /^\d{1,4}\.\d{1,5}\.\d{1,6}$/;
-const LOGIN_RE = /^[A-Za-z0-9-]{1,39}$/;
-
-// The host this hall answers on, as the hub will need it to redeem the receipt: a bare
-// public DNS name. Anything else (an IP, a port, localhost, a dev name) cannot be
-// reached by the hub, so it is not askable. Mirrors the hub's own projectOrigin check.
-function projectHost(raw) {
-  const host = String(raw || '').trim().toLowerCase();
-  if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(host)) return null;
-  if (/^\d+(\.\d+)+$/.test(host)) return null;
-  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
-  return host;
-}
-
-function hubHostOf(hub) {
-  try { return new URL(String(hub)).host.toLowerCase(); } catch { return null; }
-}
-
-// Is this a project the hub's operator runs? Its door is the hub's, or it answers on a
-// name under the hub's own domain (the same rule the hub uses to call a sender "verified").
-function isOperatorRun({ doorKind, host, hub }) {
-  if (doorKind === 'local' || !hub) return false;
-  if (doorKind === 'hub') return true;
-  const h = hubHostOf(hub);
-  return !!(h && host && (host === h || host.endsWith(`.${h}`)));
-}
-
-// The stored request, or null. A row this file did not write reads as no request.
-function parseStored(row) {
-  if (!row || typeof row.value !== 'string') return null;
-  let v;
-  try { v = JSON.parse(row.value); } catch { return null; }
-  if (!v || !VERSION_RE.test(String(v.version || ''))) return null;
-  const at = Date.parse(v.requested_at);
-  if (!Number.isFinite(at)) return null;
-  return {
-    version: String(v.version),
-    requested_at: new Date(at).toISOString(),
-    by: typeof v.by === 'string' && LOGIN_RE.test(v.by) ? v.by : null,
-  };
-}
-
-// What the page needs: may it offer the button, and what was asked before.
-// `ask_again_after` is when a request for a DIFFERENT version would be taken.
-function askState({ offered, host, doorKind, hub, stored }) {
-  const available = !!offered && isOperatorRun({ doorKind, host, hub }) && !!projectHost(host);
-  const ask = { available, hub_host: hub ? hubHostOf(hub) : null, requested: stored || null, ask_again_after: null };
-  if (stored) ask.ask_again_after = new Date(Date.parse(stored.requested_at) + COOLDOWN_MS).toISOString();
-  return ask;
-}
-
-// The text the operator reads. Its first line becomes the hub task's title.
-function requestMessage({ host, running, wanted, login }) {
-  const who = login && LOGIN_RE.test(login) ? `@${login}` : 'its owner';
-  return [
-    `Upgrade request: ${host} asks for core ${wanted} (it runs ${running || 'an unknown version'})`,
-    '',
-    `${who} pressed "Ask for this upgrade" in Settings, Software update on ${host}.`,
-    'This project cannot upgrade itself: the people who run its server do it.',
-    `Move its core to ${wanted} or newer, or tell them when it will be.`,
-  ].join('\n');
-}
-
-/**
- * Send one upgrade request, or answer from the stored one. Never throws for an
- * expected refusal; returns { status, body } for the route to send.
- *
- * deps: { hub, issueReceipt(receipt) → id|null, fetchImpl, getSetting, setSetting, now }
- */
-async function requestUpgrade({ host, running, wanted, builder, doorKind }, deps) {
-  const now = deps.now || Date.now;
-  const hub = deps.hub;
-  const target = projectHost(host);
-  if (!wanted || !VERSION_RE.test(String(wanted))) return { status: 409, body: { error: 'nothing_to_ask', message: 'This project is up to date.' } };
-  if (!target || !isOperatorRun({ doorKind, host: target, hub })) {
-    return { status: 409, body: { error: 'not_operator_run', message: 'This project is not upgraded by an operator, so there is no one to ask.' } };
-  }
-
-  const stored = parseStored(await deps.getSetting(SETTING_KEY));
-  if (stored && stored.version === wanted) return { status: 200, body: { ok: true, already: true, request: stored } };
-  if (stored && now() < Date.parse(stored.requested_at) + COOLDOWN_MS) {
-    const retry = Math.ceil((Date.parse(stored.requested_at) + COOLDOWN_MS - now()) / 1000);
-    return { status: 429, body: { error: 'asked_recently', message: 'This project already asked for an upgrade today. Ask again tomorrow.', retry_after_seconds: retry, request: stored } };
-  }
-
-  const login = builder && typeof builder.github_login === 'string' && LOGIN_RE.test(builder.github_login) ? builder.github_login : null;
-  const message = requestMessage({ host: target, running, wanted, login });
-  const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
-  const receipt = deps.issueReceipt({
-    github_id: String(builder && builder.github_id),
-    github_login: login,
-    sha256,
-    kind: 'bug',
-    core_version: running || null,
-  });
-  if (!receipt) return { status: 429, body: { error: 'rate_limited', message: 'Too many requests just now. Try again in ten minutes.', retry_after_seconds: 600 } };
-
-  let res;
-  try {
-    res = await (deps.fetchImpl || fetch)(`${String(hub).replace(/\/+$/, '')}/api/bongos/sso/feedback/direct`, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
-      body: JSON.stringify({ origin: `https://${target}`, receipt, message, kind: 'bug', context: {} }),
-      redirect: 'error',
-      signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
-    });
-  } catch {
-    return { status: 502, body: { error: 'operator_unreachable', message: 'Could not reach the people who run this project. Try again in a few minutes.' } };
-  }
-  if (res.status === 429) return { status: 429, body: { error: 'rate_limited', message: 'Too many requests just now. Try again in an hour.', retry_after_seconds: 3600 } };
-  if (res.status !== 202) {
-    return { status: 502, body: { error: 'operator_unreachable', message: `The request was not taken (HTTP ${res.status}). Try again later.` } };
-  }
-
-  const request = { version: String(wanted), requested_at: new Date(now()).toISOString(), by: login };
-  await deps.setSetting(SETTING_KEY, JSON.stringify(request), builder && builder.id != null ? builder.id : null);
-  return { status: 201, body: { ok: true, already: false, request } };
-}
-
-module.exports = {
-  SETTING_KEY,
-  COOLDOWN_MS,
-  projectHost,
-  isOperatorRun,
-  parseStored,
-  askState,
-  requestMessage,
-  requestUpgrade,
-};