@nanobpm/urban 0.41.0 → 0.43.0

package/src/runtime/core/modules/api.test.ts

@@ -6,7 +6,7 @@ import type { AppManifest } from "../manifest.ts";
 import type { EngineClient, HostContext, HttpRequest } from "../host.ts";
 import { makeRouter } from "../router.ts";
 import { DataLayer } from "./datasource.ts";
-import { mountApi, resolveOperationHandler, apiDocsPath, NotImplemented, type ApiHandle, type OperationHandler } from "./api.ts";
+import { mountApi, resolveOperationHandler, apiDocsPath, deriveSwaggerUrls, NotImplemented, type ApiHandle, type OperationHandler } from "./api.ts";
 
 function req(
   method: string,
@@ -746,12 +746,137 @@ test("serves the Swagger UI page at {base}-docs by default", async () => {
   assert.match(res.headers?.["content-type"] ?? "", /text\/html/);
   const body = res.body ?? "";
   assert.match(body, /swagger-ui/);
-  // The UI reads the spec via a DOCUMENT-relative URL (issue #151) so it resolves through the
-  // Nano console reverse proxy, not a root-absolute path that escapes to the console origin.
-  assert.match(body, /url: "api-docs\/openapi\.json"/);
+  // The page derives ABSOLUTE spec + server URLs from window.location (issue #151 + the trailing-
+  // slash 404): the embedded derivation is passed the mount-root docs base, operations base, and a
+  // document-relative fallback. It must never hard-code a root-absolute "/app/api-docs/openapi.json"
+  // that would escape the Nano console reverse-proxy prefix.
+  assert.match(body, /window\.location\.href/);
+  assert.match(body, /"\/app\/api-docs"/); // docsBase handed to the client derivation
+  assert.match(body, /"\/app\/api"/); //     operations base handed to the client derivation
+  assert.match(body, /"api-docs\/openapi\.json"/); // document-relative fallback
   assert.doesNotMatch(body, /url: "\/app\/api-docs\/openapi\.json"/);
 });
 
+test("the rendered docs page runs its derivation end-to-end and targets the app through the proxy", async () => {
+  const { router } = build({ spec: "openapi.json" }, {});
+  const res = await router(req("GET", "/app/api-docs"));
+  const body = res.body ?? "";
+  // Extract the inline bootstrap <script> (the one that is NOT the swagger-ui-bundle src include).
+  const scripts = [...body.matchAll(/<script>([\s\S]*?)<\/script>/g)].map((m) => m[1]);
+  assert.ok(scripts.length >= 1, "expected an inline bootstrap script");
+  const boot = scripts[scripts.length - 1];
+  // 1) It must be syntactically valid JS (guards the `${derive.toString()}` template interpolation).
+  const runBoot = new Function("window", "SwaggerUIBundle", "fetch", boot);
+  // 2) Execute it in a mocked browser at the EXACT reported failing URL (proxy prefix + trailing
+  //    slash) and assert the servers override Swagger UI receives is the app's /app/api under the
+  //    proxy — never the /app/api-docs/api that produced the 404.
+  const specDoc = { openapi: "3.0.3", paths: {}, servers: [{ url: "api" }] };
+  let received: unknown;
+  const swaggerStub = (opts: { spec?: { servers?: unknown } }): unknown => {
+    received = opts.spec?.servers;
+    return {};
+  };
+  const proxySlashUrl = "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api-docs/";
+  const win: { location: { href: string }; ui?: unknown } = { location: { href: proxySlashUrl } };
+  let fetched = "";
+  const fetchStub = (url: string): Promise<{ ok: boolean; json: () => Promise<unknown> }> => {
+    fetched = url;
+    return Promise.resolve({ ok: true, json: () => Promise.resolve(specDoc) });
+  };
+  runBoot(win, swaggerStub, fetchStub);
+  await new Promise((r) => setTimeout(r, 0)); // let the fetch().then microtasks settle
+  assert.equal(
+    fetched,
+    "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api-docs/openapi.json",
+    "spec is fetched at an absolute, proxy-prefixed URL (immune to the trailing slash)",
+  );
+  assert.deepEqual(received, [
+    { url: "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api" },
+    // ^ Try it out now targets the app's operations base under the proxy, not /app/api-docs/api.
+  ]);
+});
+
+test("deriveSwaggerUrls: absolute spec+server from the page URL, immune to trailing slash + proxy prefix", () => {
+  const docsBase = "/app/api-docs";
+  const apiBase = "/app/api";
+  const rel = "api-docs/openapi.json";
+  // Direct CLI (:3000), no trailing slash — the canonical case.
+  assert.deepEqual(deriveSwaggerUrls("http://127.0.0.1:3000/app/api-docs", docsBase, apiBase, rel), {
+    specUrl: "http://127.0.0.1:3000/app/api-docs/openapi.json",
+    server: "http://127.0.0.1:3000/app/api",
+  });
+  // Direct CLI WITH a trailing slash — a relative "servers: api" used to resolve to
+  // /app/api-docs/api here (the reported 404). The absolute derivation is unaffected.
+  assert.deepEqual(deriveSwaggerUrls("http://127.0.0.1:3000/app/api-docs/", docsBase, apiBase, rel), {
+    specUrl: "http://127.0.0.1:3000/app/api-docs/openapi.json",
+    server: "http://127.0.0.1:3000/app/api",
+  });
+  // Under the Nano console reverse proxy — the mount prefix is preserved in both URLs.
+  assert.deepEqual(
+    deriveSwaggerUrls(
+      "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api-docs",
+      docsBase,
+      apiBase,
+      rel,
+    ),
+    {
+      specUrl: "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api-docs/openapi.json",
+      server: "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api",
+    },
+  );
+  // Proxy WITH a trailing slash — the exact failure the user reported. Now correct.
+  assert.deepEqual(
+    deriveSwaggerUrls(
+      "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api-docs/",
+      docsBase,
+      apiBase,
+      rel,
+    ),
+    {
+      specUrl: "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api-docs/openapi.json",
+      server: "http://127.0.0.1:8080/console/app-view/Nano_Workforce/app/api",
+    },
+  );
+  // A query string / fragment on the docs URL is ignored (pathname only).
+  assert.equal(
+    deriveSwaggerUrls("http://127.0.0.1:3000/app/api-docs?x=1#y", docsBase, apiBase, rel).server,
+    "http://127.0.0.1:3000/app/api",
+  );
+});
+
+test("deriveSwaggerUrls: a custom docs path keeps the proxy prefix too", () => {
+  // A string `docs` override lands the page at a root-level `/help`; the derivation still recovers
+  // the (proxy-prefixed) mount root by stripping that suffix and re-appending the operations base.
+  assert.deepEqual(
+    deriveSwaggerUrls(
+      "http://127.0.0.1:8080/console/app-view/App/help/",
+      "/help",
+      "/app/api",
+      "help/openapi.json",
+    ),
+    {
+      specUrl: "http://127.0.0.1:8080/console/app-view/App/help/openapi.json",
+      server: "http://127.0.0.1:8080/console/app-view/App/app/api",
+    },
+  );
+});
+
+test("deriveSwaggerUrls: falls back to the document-relative spec when the path doesn't match or href is bad", () => {
+  const docsBase = "/app/api-docs";
+  const apiBase = "/app/api";
+  const rel = "api-docs/openapi.json";
+  // Page path doesn't end in docsBase (unexpected) → keep the relative fallback, no server override.
+  assert.deepEqual(deriveSwaggerUrls("http://127.0.0.1:3000/elsewhere", docsBase, apiBase, rel), {
+    specUrl: rel,
+    server: null,
+  });
+  // Malformed href → same safe fallback (no throw).
+  assert.deepEqual(deriveSwaggerUrls("not a url", docsBase, apiBase, rel), {
+    specUrl: rel,
+    server: null,
+  });
+});
+
 test("the trailing-slash docs variant 308-redirects to the canonical path", async () => {
   const { router } = build({ spec: "openapi.json" }, {});
   // The router exact-matches non-prefix routes, so `${base}-docs/` (common from proxies/browsers)

package/src/runtime/core/modules/api.ts

@@ -70,10 +70,54 @@ function escapeHtml(s: string): string {
   );
 }
 
+/**
+ * Derive the ABSOLUTE spec + operations-server URLs the Swagger UI page should use, from the docs
+ * page's own address (`pageHref`), the mount-root-relative docs path (`docsBase`, e.g.
+ * `/app/api-docs`) and operations base (`apiBase`, e.g. `/app/api`).
+ *
+ * Why this can't be done server-side: the docs page can load at `<docsBase>` OR `<docsBase>/` (a
+ * trailing slash — reverse proxies and some webviews append one), and behind the Nano console
+ * proxy it carries a path prefix (`/console/app-view/<name>`). A document-relative spec URL or a
+ * relative `servers` entry resolves DIFFERENTLY depending on that trailing slash — which sent
+ * "Try it out" to `<mount>/app/api-docs/api/<op>` (a 404) instead of `<mount>/app/api/<op>`. The
+ * app never sees the proxy prefix, so `window.location` in the browser is the only place with the
+ * full mount path.
+ *
+ * We strip any trailing slash from the page path, then strip the known `docsBase` suffix to recover
+ * the (proxy-prefixed) mount root, and re-append `docsBase`/`apiBase` as ORIGIN-absolute URLs — so
+ * Swagger UI performs no further relative resolution and is immune to the trailing slash. When the
+ * page path doesn't end in `docsBase` (unexpected) or the href is malformed, we fall back to the
+ * document-relative `relSpec` and leave `servers` to the served spec (`server: null`).
+ *
+ * This runs in the browser: it is embedded verbatim into the docs page via `.toString()` so the
+ * shipped page and these unit tests exercise the exact same code (no drift). Keep it dependency-free
+ * and free of template literals / `${}` (it is interpolated into a template literal).
+ */
+export function deriveSwaggerUrls(
+  pageHref: string,
+  docsBase: string,
+  apiBase: string,
+  relSpec: string,
+): { specUrl: string; server: string | null } {
+  try {
+    const loc = new URL(pageHref);
+    const path = loc.pathname.replace(/\/+$/, "");
+    if (path.length >= docsBase.length && path.slice(path.length - docsBase.length) === docsBase) {
+      const mount = loc.origin + path.slice(0, path.length - docsBase.length);
+      return { specUrl: mount + docsBase + "/openapi.json", server: mount + apiBase };
+    }
+  } catch {
+    // Malformed href — fall through to the document-relative fallback below.
+  }
+  return { specUrl: relSpec, server: null };
+}
+
 /** The self-contained Swagger UI page. Static HTML: it renders even when the spec is momentarily
- *  unreadable (Swagger UI fetches `specUrl` itself and surfaces any load/parse error in-page),
- *  which keeps the docs route decoupled from spec-load failures. */
-function swaggerUiPage(title: string, specUrl: string): string {
+ *  unreadable (on a fetch/parse failure it hands `specUrl` to Swagger UI, which surfaces the error
+ *  in-page), which keeps the docs route decoupled from spec-load failures. The client derives
+ *  absolute spec + server URLs from `window.location` via `deriveSwaggerUrls` so "Try it out"
+ *  targets the app regardless of a trailing slash on the docs URL or a reverse-proxy prefix. */
+function swaggerUiPage(title: string, specUrl: string, docsBase: string, apiBase: string): string {
   const css = `https://cdn.jsdelivr.net/npm/swagger-ui-dist@${SWAGGER_UI_VERSION}/swagger-ui.css`;
   const bundle = `https://cdn.jsdelivr.net/npm/swagger-ui-dist@${SWAGGER_UI_VERSION}/swagger-ui-bundle.js`;
   return `<!doctype html>
@@ -89,7 +133,22 @@ function swaggerUiPage(title: string, specUrl: string): string {
 <div id="swagger-ui"></div>
 <script src="${bundle}" crossorigin="anonymous"></script>
 <script>
-window.ui = SwaggerUIBundle({ url: ${JSON.stringify(specUrl)}, dom_id: '#swagger-ui', deepLinking: true });
+(function () {
+  var derive = ${deriveSwaggerUrls.toString()};
+  var urls = derive(window.location.href, ${JSON.stringify(docsBase)}, ${JSON.stringify(apiBase)}, ${JSON.stringify(specUrl)});
+  function boot(opts) { window.ui = SwaggerUIBundle(opts); }
+  fetch(urls.specUrl)
+    .then(function (r) { return r.ok ? r.json() : null; })
+    .then(function (spec) {
+      if (spec && urls.server) { spec.servers = [{ url: urls.server }]; }
+      boot(spec
+        ? { spec: spec, dom_id: '#swagger-ui', deepLinking: true }
+        : { url: urls.specUrl, dom_id: '#swagger-ui', deepLinking: true });
+    })
+    .catch(function () {
+      boot({ url: urls.specUrl, dom_id: '#swagger-ui', deepLinking: true });
+    });
+})();
 </script>
 </body>
 </html>`;
@@ -312,12 +371,13 @@ export function mountApi(ctx: RuntimeContext, app: AppApi): ApiHandle {
   const dir = binding.dir ?? "operations";
   const surfaceEject = binding.eject === true;
   const specRoutePath = `${docsBase}/openapi.json`;
-  // The Swagger UI page is served at `docsBase` (no trailing slash — the slash variant 308-
-  // redirects onto it), so its browser-relative base is the PARENT directory. Hand Swagger UI a
-  // DOCUMENT-relative spec URL and `servers` entry so both rebase onto the app's mount root:
-  // correct at the origin root (CLI :3000) AND under the Nano console reverse proxy
-  // (/console/app-view/<name>/), where a root-absolute "/app/…" escapes the prefix and hits the
-  // console origin instead of the app (issue #151).
+  // Fallback values for the RAW served spec + docs page. The interactive Swagger UI computes
+  // ABSOLUTE spec + server URLs client-side from `window.location` (see `deriveSwaggerUrls`), which
+  // is immune to a trailing slash on the docs URL and to the Nano console reverse-proxy prefix
+  // (/console/app-view/<name>/). These document-relative values remain (a) the client's fallback
+  // when the page path unexpectedly doesn't end in `docsBase`, and (b) what a non-interactive
+  // consumer reading `openapi.json` directly sees. They still rebase onto the app's mount root
+  // rather than using a root-absolute "/app/…" that would escape the proxy prefix (issue #151).
   const lastSegment = (p: string): string => p.split("/").filter(Boolean).pop() ?? "";
   const parentPath = (p: string): string => {
     const parts = p.split("/").filter(Boolean);
@@ -328,8 +388,7 @@ export function mountApi(ctx: RuntimeContext, app: AppApi): ApiHandle {
   const specDocUrl = `${lastSegment(docsBase)}/openapi.json`;
   // `servers` can only be relativized when the operations `base` shares the docs page's parent
   // directory (the default `${base}-docs` sibling). For a fully custom `docs` path under a
-  // different parent, keep the root-absolute base (works direct; try-it-out through the proxy is
-  // the documented limitation in #151).
+  // different parent, keep the root-absolute base for the raw spec.
   const serversUrl = parentPath(base) === parentPath(docsBase) ? lastSegment(base) : base;
 
   // Resolve + parse the spec lazily on first request and cache it (mirroring the lazy module load
@@ -741,7 +800,7 @@ export function mountApi(ctx: RuntimeContext, app: AppApi): ApiHandle {
     return json({ ...d, servers: [{ url: serversUrl }] });
   };
   const docsTitle = `${ctx.manifest.name ?? "App"} — API docs`;
-  const serveDocs = (): HttpResponse => html(swaggerUiPage(docsTitle, specDocUrl));
+  const serveDocs = (): HttpResponse => html(swaggerUiPage(docsTitle, specDocUrl, docsBase, base));
   // A permanent redirect for the trailing-slash variant (`${docsBase}/`). The router only does
   // exact matches for non-prefix routes, so without this a reverse proxy or browser that appends
   // a slash would 404 on the Swagger UI. 308 preserves the method and points at the canonical

package/src/runtime/core/modules/cancel.test.ts

@@ -311,3 +311,31 @@ test("a thrown cancel whose verify read also fails is reported as an honest fail
     await h.close();
   }
 });
+
+test("a thrown cancel whose verify read comes back empty (gone) is an unverified failure, not a false success", async () => {
+  // The engine-restart trap: the cancel POST throws (dead keep-alive socket / the brief window
+  // the gateway is down), then the verify search hits the just-restarted engine whose query store
+  // has NOT yet rehydrated the still-running instance — so the read comes back empty ("gone").
+  // A throw is not a committed 204, and absence from the read model is not proof of termination, so
+  // reporting success here is the "worst possible lie": the button says cancelled while the run
+  // keeps going. It must be an honest ok:false so the caller surfaces it and the user retries.
+  const { engine } = cancelEngine({
+    states: {}, // read model transiently empty (mid-restart), though instance "100" is still live
+    onCancel: () => {
+      throw new Error("fetch failed");
+    },
+  });
+  const h = await withHarness(engine);
+  try {
+    const r = await cancelInstanceReconciling(h.api, [PR_BINDING], "100");
+    assert.equal(r.ok, false); // NOT a false success
+    assert.equal(r.state, "gone");
+    assert.equal(r.reconciled, 0);
+    assert.match(r.error ?? "", /fetch failed/);
+    const row = await h.table.get("100");
+    assert.equal(row?.status, "converging"); // never flip a possibly-live run to a terminal status
+    assert.ok(h.logs.some((l) => l.level === "error"));
+  } finally {
+    await h.close();
+  }
+});

package/src/runtime/core/modules/cancel.ts

@@ -13,9 +13,9 @@
 //
 // This primitive keys success on the engine's response, then reconciles off the read model: a
 // non-throwing `cancelInstance` is a committed termination (trusted even if the read model still
-// lags at ACTIVE), while a throw whose instance reads back still-ACTIVE is an honest failure. It
-// reuses the instanceTracking bindings' `onTerminated.set` patch, so the immediate reconcile can
-// never drift from the poll reconciler's.
+// lags at ACTIVE), while a throw that does not read back a positively-terminal state (still ACTIVE,
+// or absent from the read model) is an honest failure. It reuses the instanceTracking bindings'
+// `onTerminated.set` patch, so the immediate reconcile can never drift from the poll reconciler's.
 
 import type { AppApi } from "../context.ts";
 import type { InstanceTracking } from "../manifest.ts";
@@ -44,10 +44,14 @@ type CancelApi = Pick<AppApi, "engine" | "data" | "log">;
  * Outcome rules:
  *  - `cancelInstance` returns without throwing → the engine accepted the termination (a committed
  *    204); trust it even if the read model still lags at ACTIVE.
- *  - `cancelInstance` throws but the instance reads back non-ACTIVE (already TERMINATED/COMPLETED
- *    /gone) → the cancel was effectively idempotent; treat as success.
- *  - `cancelInstance` throws and the instance is still ACTIVE → an honest failure: report it and
- *    do NOT touch any row (the instance is still running).
+ *  - `cancelInstance` throws but the instance reads back positively terminal (TERMINATED/COMPLETED)
+ *    → the cancel was effectively idempotent; treat as success. Only a TERMINATED read reconciles a
+ *    row here (see below); a COMPLETED read intentionally reconciles nothing.
+ *  - `cancelInstance` throws and the read is NOT positively terminal — still ACTIVE, or "gone"
+ *    (absent from the read model, which after an engine restart can transiently lack a live
+ *    instance) → an honest failure: report it and do NOT touch any row (the instance may still be
+ *    running). A throw is not a committed cancel, and absence from the read model is not proof of
+ *    termination, so success is never inferred from it.
  *
  * Reconcile only on `TERMINATED`: a COMPLETED instance's terminal row-write is owned by the app's
  * own finalize logic, and a gone/ACTIVE instance has nothing to flip here.
@@ -68,11 +72,19 @@ export async function cancelInstanceReconciling(
 
   const state = await readState(api, key, threw);
 
-  if (threw && state === "ACTIVE") {
-    // The cancel genuinely failed and the instance is still running — never flip a row to a
-    // terminal status while the engine keeps executing it.
-    api.log("error", "cancel: engine termination failed, instance still active", {
+  if (threw && state !== "TERMINATED" && state !== "COMPLETED") {
+    // The cancel threw, so we never got a committed 204 — and the verify read did NOT positively
+    // confirm a terminal state. Two shapes land here, both honest failures:
+    //   • state === "ACTIVE": the instance is demonstrably still running.
+    //   • state === "gone":   the read model has no record of the key. A throw makes this
+    //     ambiguous — after an engine restart the query store can transiently lack a live instance
+    //     before it rehydrates, so "gone" is absence-of-evidence, NOT proof of termination.
+    // Trust neither as success: claiming a cancel that may not have happened (while the run keeps
+    // executing) is the worst possible lie for a cancel button. Report ok:false so the caller
+    // surfaces it and retries; never flip a tracked row to terminal while the instance may live.
+    api.log("error", "cancel: engine termination not confirmed, instance may still be active", {
       processInstanceKey: key,
+      state,
       error: errorMessage(threw),
     });
     return { ok: false, processInstanceKey: key, state, reconciled: 0, error: errorMessage(threw) };

package/src/runtime/core/modules/pages.test.ts

@@ -138,6 +138,36 @@ test("the shell styles the app through the shared --nano-* token contract", asyn
   assert.match(html, /:root:not\(\[data-appearance\]\)/);
 });
 
+test("the warn badge stays legible in light appearance", async () => {
+  const res = await dispatch("GET", "/");
+  const html = res.body ?? "";
+  // The warn badge sits on --nano-warn, which is a bright amber in dark mode
+  // (dark text reads well) but a dark orange in light mode (#b45309), where the
+  // same dark text collapses to near-zero contrast. Both light paths — the
+  // console-themed [data-appearance="light"] and the standalone
+  // prefers-color-scheme fallback — must flip the warn label to white so it
+  // stays readable.
+  assert.match(html, /:root\[data-appearance="light"\]\s*\.pc-badge-warn\s*\{\s*color:#fff;\s*\}/);
+  assert.match(
+    html,
+    /@media \(prefers-color-scheme: light\)\s*\{\s*:root:not\(\[data-appearance\]\)\s*\.pc-badge-warn\s*\{\s*color:#fff;\s*\}\s*\}/,
+  );
+});
+
+test("grid cells wrap long, space-less values so one cell can't overflow the table", async () => {
+  // Regression: a dataGrid cell holding a long space-less value (e.g. a JSON
+  // blob or a 40-char SHA) has no soft-wrap opportunity, so with table-layout
+  // auto it forces its column to the value's full width and pushes the whole
+  // table past the page. The shared grid CSS must let such a cell break so the
+  // column can shrink to fit its container.
+  const res = await dispatch("GET", "/");
+  const html = res.body ?? "";
+  const rule = (html.match(/table\.pc-grid th,\s*table\.pc-grid td\s*\{[^}]*\}/) ?? [""])[0];
+  assert.ok(rule, "grid th/td rule must be present");
+  assert.match(rule, /overflow-wrap:anywhere/);
+  assert.match(rule, /max-width:/);
+});
+
 test("GET /app/runtime.js serves the renderer module", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   assert.match(res.headers?.["content-type"] ?? "", /javascript/);
@@ -290,6 +320,24 @@ test("renderer wires a column's linkField to a new-tab anchor", async () => {
   assert.match(js, /rel: "noopener noreferrer"/);
 });
 
+test("renderer wires a column's badge to a tone-classed pill shown only when present", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // A column declaring `badge` renders a compact circular pill (e.g. a red "1"
+  // flagging an incident) only when the field value is non-empty; an empty value
+  // leaves the cell blank so the column is unobtrusive until it matters. Guard
+  // the shape: presence-gated on the trimmed field, tone is allow-listed
+  // (default danger), the label defaults to "1", and the full field text becomes
+  // the tooltip.
+  assert.match(js, /if\s*\(col\.badge\)/);
+  assert.match(js, /text\.trim\(\)\s*===\s*""/);
+  assert.match(js, /t\s*===\s*"warn"\s*\|\|\s*t\s*===\s*"ok"\s*\|\|\s*t\s*===\s*"info"\s*\?\s*t\s*:\s*"danger"/);
+  assert.match(js, /col\.badge\.label\s*==\s*null\s*\?\s*"1"/);
+  assert.match(js, /class:\s*"pc-badge pc-badge-"\s*\+\s*tone/);
+  assert.match(js, /title:\s*text/);
+  assert.match(js, /"aria-label":\s*text/);
+});
+
 test("renderer wires a column's processExplorer link to the console explorer", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   const js = res.body ?? "";
@@ -353,6 +401,22 @@ test("the renderer honours numeric actionForm fields", async () => {
   assert.match(js, /if \(!Number\.isFinite\(num\)\) continue;/);
 });
 
+test("the renderer honours boolean (checkbox) actionForm fields", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // Fields declared `type: "checkbox"` render a real <input type="checkbox">…
+  assert.match(js, /f\.type === "checkbox"/);
+  assert.match(js, /el\("input", \{ type: "checkbox" \}\)/);
+  // …whose default checked state comes from `default`/`checked` on the field…
+  assert.match(js, /f\.default === true \|\| f\.checked === true/);
+  // …and whose submitted value is always a real boolean (never a string), so a
+  // strict `=== true` check on the action side sees the intended value.
+  assert.match(js, /variables\[k\] = input\.checked === true;/);
+  // A post-submit reset restores a checkbox to its declared default (read off the
+  // input's defaultChecked) rather than clearing `.value` (a no-op for a checkbox).
+  assert.match(js, /input\.checked = input\.defaultChecked;/);
+});
+
 test("renderer makes collapsible nodes persist their state across sessions", async () => {
   // A node with `collapsible` gets a clickable header that hides/shows the card
   // body, and the collapsed state is written to localStorage keyed by the home
@@ -464,6 +528,62 @@ test("the renderer ships a nav node (menu bar / rail) with in-app + external lin
   assert.match(js, /pc-main-col/);
 });
 
+test("the renderer ships a button node that opens a copy-pasteable modal", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // button is a first-class node type.
+  assert.match(js, /button: renderButton/);
+  assert.match(js, /function renderButton\(node\)/);
+  // A ghost variant renders the muted outline style; a button carries its modal.
+  assert.match(js, /p\.variant === "ghost"/);
+  assert.match(js, /btn\.addEventListener\("click", \(\) => openModal\(m\)\)/);
+  // The modal is appended to <body>, is dismissable, and cleans up its keydown.
+  assert.match(js, /function openModal\(m\)/);
+  assert.match(js, /class: "pc-modal-overlay"/);
+  assert.match(js, /"aria-modal": "true"/);
+  assert.match(js, /if \(ev\.key === "Escape"\) \{ close\(\); return; \}/);
+  assert.match(js, /document\.removeEventListener\("keydown", onKey\)/);
+  // {{appBase}} in copy text is rebased onto the absolute mount root so an
+  // external agent gets a fetchable URL.
+  assert.match(js, /function resolveCopyText\(text\)/);
+  assert.match(js, /split\("\{\{appBase\}\}"\)\.join\(APP_BASE\.toString\(\)\)/);
+  // Copy is clipboard-first with a sandbox-safe execCommand fallback.
+  assert.match(js, /async function copyToClipboard\(text\)/);
+  assert.match(js, /navigator\.clipboard\.writeText/);
+  assert.match(js, /document\.execCommand\("copy"\)/);
+  // The fallback textarea is torn down in a finally so a throwing select()/
+  // execCommand never leaves a detached node accreting in <body> on retry.
+  assert.match(js, /finally \{ ta\.remove\(\); \}/);
+  // The dialog carries an accessible name (labelled by its title, or a fallback
+  // aria-label) so screen readers don't announce an unnamed dialog.
+  assert.match(js, /"aria-labelledby": titleId/);
+  assert.match(js, /"aria-label": "Dialog"/);
+  // An open modal is registered with teardown() so a page switch disposes it
+  // instead of leaking a stale overlay + document-level keydown listener.
+  assert.match(js, /disposers\.push\(close\)/);
+  // A manual close removes its own disposer entry, so repeated open/close cycles
+  // don't accrete dead close() closures on the disposers stack.
+  assert.match(js, /disposers\.indexOf\(close\)/);
+  assert.match(js, /disposers\.splice\(i, 1\)/);
+  // Focus is restored to the previously-focused element on close, and Tab is
+  // trapped inside the dialog so it can't reach the inert page behind the overlay.
+  assert.match(js, /const prevFocus = document\.activeElement/);
+  assert.match(js, /if \(ev\.key !== "Tab"\) return/);
+  assert.match(js, /ev\.preventDefault\(\); last\.focus\(\)/);
+  assert.match(js, /ev\.preventDefault\(\); first\.focus\(\)/);
+  // Only one modal opens at a time: a second open (e.g. double-click) is dropped
+  // so overlays and document-level keydown listeners never stack.
+  assert.match(js, /let modalOpen = false/);
+  assert.match(js, /if \(modalOpen\) return/);
+  assert.match(js, /modalOpen = true/);
+  assert.match(js, /modalOpen = false/);
+  // The aria-labelledby title id is unique per modal instance so it can't
+  // collide with a pre-existing page id and mis-associate the label.
+  assert.match(js, /let modalSeq = 0/);
+  assert.match(js, /"pc-modal-title-" \+ \(\+\+modalSeq\)/);
+});
+
+
 test("GET /app/data/<source>/<table> returns rows", async () => {
   const res = await dispatch("GET", "/app/data/app/orders");
   assert.equal(res.status, 200);