@bongos/core 1.25.17 → 1.25.18

package/tests/module_api.mjs

@@ -55,6 +55,7 @@ const PUBLISHED_SURFACE = [
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'readApplicantViewFromHub', // added by task 1002304 (ADR 0365 D5): the same NARROW hub read as readApplicantProfileFromHub, answering { profile, guild } so the reviewer queue can group a guild's applicants. The guild rides only beside a profile, and the older port is kept so a module on it reads exactly what it did
+  'readAppStatusFromHub', // added by task 1004571: where THIS project's app runs, read from the hub for the options menu's app-host panel. The same NARROW-port reason as readApplicantProfileFromHub: it carries this instance's hub client secret, so it takes no argument and a module can neither widen nor re-address it
   'notifyHubOfInvite', // added by task 1002818 (ADR 0353): tell the hub about one of THIS project's invites (or its rescind) so the invitee sees it in My Projects. The same NARROW-port reason as readApplicantProfileFromHub: the call carries this instance's hub client secret, so a module passes one login and one direction and can neither widen nor re-address it
   'inviteExpiry', // added by task 1002969 (ADR 0356): the ONE read-time definition of when a recruit invite's door closes. The sign-in gate reads it in core; the onboarding queues and the hub's notice list are modules, so without the doorway each would restate the 30 days and the predicate, and two copies can close a door on different days
   'readApplicationVouch', // added by task 1002285 (ADR 0201 D2): the public access-request write's check of the hub's application vouch. NARROW for the same reason — core supplies the hub key and this instance's client_id, so a module passes a token and a login and can neither swap the key nor re-address the audience

package/tests/module_loader.mjs

@@ -278,7 +278,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'front-door-guide', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'app-host', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'front-door-guide', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();

package/tests/npm_release_where.mjs

@@ -290,8 +290,14 @@ test('the module declares the task page section and ships its widget; the seam g
   assert.deepEqual(manifest.contributes.uiSections, ['task-where']);
   assert.ok(manifest.contributes.routes.includes('task-where'));
   assert.ok(fs.existsSync(path.join(ROOT, 'modules/npm-release/public/task-widget.js')));
-  const guard = fs.readFileSync(path.join(ROOT, 'scripts/bongos/seam-wiring-guard.js'), 'utf8');
-  assert.match(guard, /alternates: \(dir\) => \[path\.join\(dir, 'public', 'task-widget\.js'\)\]/);
+  // Ask the guard itself (task 1004571 converted this from a source-text match): a module
+  // whose only widget is task-widget.js counts as wired, and with no widget it does not.
+  const { scanSeamWiring } = require('../scripts/bongos/seam-wiring-guard.js');
+  const dir = path.join(ROOT, 'modules/npm-release');
+  const only = (file) => ({ exists: (p) => p === path.join(dir, 'public', file) });
+  const mod = [{ key: 'npm-release', dir, manifest: { contributes: { uiSections: ['task-where'] } } }];
+  assert.deepEqual(scanSeamWiring(mod, only('task-widget.js')).findings, []);
+  assert.equal(scanSeamWiring(mod, { exists: () => false }).findings.length, 1);
 });
 
 test('the server injects task widgets just before task.js, and names no module doing it', () => {
@@ -302,8 +308,12 @@ test('the server injects task widgets just before task.js, and names no module d
   assert.ok(out.indexOf('/builders/md-reader.js') < out.indexOf('task-widget.js'));
   assert.match(out, /<script src="\/modules\/npm-release\/public\/task-widget\.js" defer><\/script>/);
   assert.equal(injectModuleHallWidgets(page, [], 'task'), page, 'no module, no change');
-  const index = '<script src="/builders/builders.js?v=1"></script>';
+  // The index's builders.js is deferred, so its widgets are too (unchanged). Since task
+  // 1004571 a widget loads the way its consumer does, so a plain consumer gets a plain one.
+  const index = '<script src="/builders/builders.js?v=1" defer></script>';
   assert.match(injectModuleHallWidgets(index, [{ key: 'x', src: '/m.js' }]), /^<script src="\/m\.js" defer><\/script><script src="\/builders\/builders\.js/, 'the index injection is unchanged');
+  const plain = '<script src="/builders/settings.js?v=1"></script>';
+  assert.match(injectModuleHallWidgets(plain, [{ key: 'x', src: '/m.js' }], 'settings'), /^<script src="\/m\.js"><\/script><script src="\/builders\/settings\.js/);
   const si = fs.readFileSync(path.join(ROOT, 'src/bongos/serve-internal.js'), 'utf8');
   assert.match(si, /hallWidgetScripts\(\{ isEnabled: isModuleEnabled, file: 'task-widget\.js' \}\),\s*\n\s*'task',/);
 });