@nanobpm/urban 0.42.0 → 0.44.0

package/src/runtime/core/modules/cancel.ts

@@ -13,9 +13,9 @@
 //
 // This primitive keys success on the engine's response, then reconciles off the read model: a
 // non-throwing `cancelInstance` is a committed termination (trusted even if the read model still
-// lags at ACTIVE), while a throw whose instance reads back still-ACTIVE is an honest failure. It
-// reuses the instanceTracking bindings' `onTerminated.set` patch, so the immediate reconcile can
-// never drift from the poll reconciler's.
+// lags at ACTIVE), while a throw that does not read back a positively-terminal state (still ACTIVE,
+// or absent from the read model) is an honest failure. It reuses the instanceTracking bindings'
+// `onTerminated.set` patch, so the immediate reconcile can never drift from the poll reconciler's.
 
 import type { AppApi } from "../context.ts";
 import type { InstanceTracking } from "../manifest.ts";
@@ -44,10 +44,14 @@ type CancelApi = Pick<AppApi, "engine" | "data" | "log">;
  * Outcome rules:
  *  - `cancelInstance` returns without throwing → the engine accepted the termination (a committed
  *    204); trust it even if the read model still lags at ACTIVE.
- *  - `cancelInstance` throws but the instance reads back non-ACTIVE (already TERMINATED/COMPLETED
- *    /gone) → the cancel was effectively idempotent; treat as success.
- *  - `cancelInstance` throws and the instance is still ACTIVE → an honest failure: report it and
- *    do NOT touch any row (the instance is still running).
+ *  - `cancelInstance` throws but the instance reads back positively terminal (TERMINATED/COMPLETED)
+ *    → the cancel was effectively idempotent; treat as success. Only a TERMINATED read reconciles a
+ *    row here (see below); a COMPLETED read intentionally reconciles nothing.
+ *  - `cancelInstance` throws and the read is NOT positively terminal — still ACTIVE, or "gone"
+ *    (absent from the read model, which after an engine restart can transiently lack a live
+ *    instance) → an honest failure: report it and do NOT touch any row (the instance may still be
+ *    running). A throw is not a committed cancel, and absence from the read model is not proof of
+ *    termination, so success is never inferred from it.
  *
  * Reconcile only on `TERMINATED`: a COMPLETED instance's terminal row-write is owned by the app's
  * own finalize logic, and a gone/ACTIVE instance has nothing to flip here.
@@ -68,11 +72,19 @@ export async function cancelInstanceReconciling(
 
   const state = await readState(api, key, threw);
 
-  if (threw && state === "ACTIVE") {
-    // The cancel genuinely failed and the instance is still running — never flip a row to a
-    // terminal status while the engine keeps executing it.
-    api.log("error", "cancel: engine termination failed, instance still active", {
+  if (threw && state !== "TERMINATED" && state !== "COMPLETED") {
+    // The cancel threw, so we never got a committed 204 — and the verify read did NOT positively
+    // confirm a terminal state. Two shapes land here, both honest failures:
+    //   • state === "ACTIVE": the instance is demonstrably still running.
+    //   • state === "gone":   the read model has no record of the key. A throw makes this
+    //     ambiguous — after an engine restart the query store can transiently lack a live instance
+    //     before it rehydrates, so "gone" is absence-of-evidence, NOT proof of termination.
+    // Trust neither as success: claiming a cancel that may not have happened (while the run keeps
+    // executing) is the worst possible lie for a cancel button. Report ok:false so the caller
+    // surfaces it and retries; never flip a tracked row to terminal while the instance may live.
+    api.log("error", "cancel: engine termination not confirmed, instance may still be active", {
       processInstanceKey: key,
+      state,
       error: errorMessage(threw),
     });
     return { ok: false, processInstanceKey: key, state, reconciled: 0, error: errorMessage(threw) };

package/src/runtime/core/modules/pages.test.ts

@@ -138,6 +138,36 @@ test("the shell styles the app through the shared --nano-* token contract", asyn
   assert.match(html, /:root:not\(\[data-appearance\]\)/);
 });
 
+test("the warn badge stays legible in light appearance", async () => {
+  const res = await dispatch("GET", "/");
+  const html = res.body ?? "";
+  // The warn badge sits on --nano-warn, which is a bright amber in dark mode
+  // (dark text reads well) but a dark orange in light mode (#b45309), where the
+  // same dark text collapses to near-zero contrast. Both light paths — the
+  // console-themed [data-appearance="light"] and the standalone
+  // prefers-color-scheme fallback — must flip the warn label to white so it
+  // stays readable.
+  assert.match(html, /:root\[data-appearance="light"\]\s*\.pc-badge-warn\s*\{\s*color:#fff;\s*\}/);
+  assert.match(
+    html,
+    /@media \(prefers-color-scheme: light\)\s*\{\s*:root:not\(\[data-appearance\]\)\s*\.pc-badge-warn\s*\{\s*color:#fff;\s*\}\s*\}/,
+  );
+});
+
+test("grid cells wrap long, space-less values so one cell can't overflow the table", async () => {
+  // Regression: a dataGrid cell holding a long space-less value (e.g. a JSON
+  // blob or a 40-char SHA) has no soft-wrap opportunity, so with table-layout
+  // auto it forces its column to the value's full width and pushes the whole
+  // table past the page. The shared grid CSS must let such a cell break so the
+  // column can shrink to fit its container.
+  const res = await dispatch("GET", "/");
+  const html = res.body ?? "";
+  const rule = (html.match(/table\.pc-grid th,\s*table\.pc-grid td\s*\{[^}]*\}/) ?? [""])[0];
+  assert.ok(rule, "grid th/td rule must be present");
+  assert.match(rule, /overflow-wrap:anywhere/);
+  assert.match(rule, /max-width:/);
+});
+
 test("GET /app/runtime.js serves the renderer module", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   assert.match(res.headers?.["content-type"] ?? "", /javascript/);
@@ -290,6 +320,24 @@ test("renderer wires a column's linkField to a new-tab anchor", async () => {
   assert.match(js, /rel: "noopener noreferrer"/);
 });
 
+test("renderer wires a column's badge to a tone-classed pill shown only when present", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // A column declaring `badge` renders a compact circular pill (e.g. a red "1"
+  // flagging an incident) only when the field value is non-empty; an empty value
+  // leaves the cell blank so the column is unobtrusive until it matters. Guard
+  // the shape: presence-gated on the trimmed field, tone is allow-listed
+  // (default danger), the label defaults to "1", and the full field text becomes
+  // the tooltip.
+  assert.match(js, /if\s*\(col\.badge\)/);
+  assert.match(js, /text\.trim\(\)\s*===\s*""/);
+  assert.match(js, /t\s*===\s*"warn"\s*\|\|\s*t\s*===\s*"ok"\s*\|\|\s*t\s*===\s*"info"\s*\?\s*t\s*:\s*"danger"/);
+  assert.match(js, /col\.badge\.label\s*==\s*null\s*\?\s*"1"/);
+  assert.match(js, /class:\s*"pc-badge pc-badge-"\s*\+\s*tone/);
+  assert.match(js, /title:\s*text/);
+  assert.match(js, /"aria-label":\s*text/);
+});
+
 test("renderer wires a column's processExplorer link to the console explorer", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   const js = res.body ?? "";
@@ -316,6 +364,84 @@ test("renderer wires a column's processExplorer link to the console explorer", a
   assert.match(js, /ev\.preventDefault\(\)/);
 });
 
+test("renderer binds a route param: parseRoute splits page/param, filters + text consume it (#134)", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // A route is #/<page>/<url-encoded-param>. parseRoute splits on the FIRST "/"
+  // BEFORE decoding so a param carrying encoded slashes/hashes (a plan_key like
+  // "owner/repo#123") survives; the param segment is decoded verbatim into PARAM.
+  assert.match(js, /const slash = raw\.indexOf\("\/"\)/);
+  assert.match(js, /const paramRaw = slash >= 0 \? raw\.slice\(slash \+ 1\) : ""/);
+  assert.match(js, /param = paramRaw \? decodeURIComponent\(paramRaw\) : ""/);
+  assert.match(js, /let PARAM = parseRoute\(\)\.param/);
+  // renderPage refreshes PARAM from the current route on every (re)render.
+  assert.match(js, /const route = parseRoute\(\);\s*CURRENT = route\.page;\s*PARAM = route\.param;/s);
+  // A datasource filter with { eqParam: true } binds its value to the live PARAM,
+  // so one page template scopes every section to the selected entity.
+  assert.match(js, /else if \(f\.eqParam\) qs\.push\("where=" \+ encodeURIComponent\(f\.field \+ ":" \+ PARAM\)\)/);
+  // {{param}} interpolates into text nodes as DOM text (never markup). A function
+  // replacement inserts PARAM literally, so replacement patterns inside a param id
+  // can't be reinterpreted.
+  assert.match(js, /function interpParam\(s\)/);
+  assert.match(js, /replace\(\/\\\{\\\{param\\\}\\\}\/g, \(\) => PARAM\)/);
+  assert.match(js, /interpParam\(node\.props\.text\)/);
+  // A grid whose active filter binds to the route param renders zero rows (no data
+  // request) when no param is present, rather than emitting a where clause of
+  // field-colon-empty (server reads that as field equals empty string and would
+  // surface empty-valued rows).
+  assert.match(js, /const paramScoped = \(activeFilter \|\| \[\]\)\.some\(\(f\) => f && f\.eqParam\)/);
+  assert.match(js, /paramScoped && PARAM === ""\s*\?\s*\{ rows: \[\] \}/s);
+});
+
+test("renderer wires a column's page link to an in-app scoped hash route", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // link: { kind: "page", page, keyField } → an in-app #/<page>/<key> hash link
+  // (no new tab, no server hit). The page id is safe-id-validated, the key is
+  // trimmed + URL-encoded into the param tail, and a blank/keyless cell stays text.
+  assert.match(js, /col\.link && col\.link\.kind === "page" && col\.link\.page && col\.link\.keyField/);
+  assert.match(js, /safePageId\(col\.link\.page\)/);
+  assert.match(js, /"#\/" \+ encodeURIComponent\(col\.link\.page\) \+ "\/" \+ encodeURIComponent\(keyStr\)/);
+  // In-app: NOT a new-tab link (no target/rel on this anchor).
+  assert.match(js, /el\("a", \{ class: "pc-link", href \}, text\)/);
+});
+
+test("renderer groups a dataGrid by a field into persisted collapsible bands (waves)", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // groupBy partitions rows into collapsible groups; each header toggles its
+  // members as a unit and the collapsed state is persisted (survives poll+reload).
+  assert.match(js, /function appendRows\(rows\)/);
+  assert.match(js, /const groupBy = p\.groupBy/);
+  assert.match(js, /if \(!groupBy \|\| typeof groupBy !== "string"\) \{ for \(const row of rows\) renderRow\(row, null\); return; \}/);
+  // Numeric-aware ascending group order (waves 1,2,10 sort naturally).
+  assert.match(js, /const na = Number\(a\), nb = Number\(b\)/);
+  // Collapsed state persisted per page + node + group value via the shared helpers.
+  assert.match(js, /readCollapsed\(gkey, !!p\.groupDefaultCollapsed\)/);
+  assert.match(js, /writeCollapsed\(gkey, gcollapsed\)/);
+  assert.match(js, /"pc:collapsed:" \+ CURRENT \+ ":" \+ \(node\.id \|\| p\.title \|\| "grid"\) \+ ":g:" \+ gv/);
+  // A collapsed group hides every member row; expanded restores data rows and
+  // leaves detail rows at their own expansion state.
+  assert.match(js, /m\.tr\.hidden = gcollapsed/);
+  assert.match(js, /class: "pc-group-header"/);
+  // The group toggle exposes its expanded/collapsed state to assistive tech,
+  // mirroring makeCollapsible's header (screen readers announce the change).
+  assert.match(js, /btn\.setAttribute\("aria-expanded", String\(!gcollapsed\)\)/);
+  // refresh() renders through appendRows so grouping applies on every poll.
+  assert.match(js, /tbody\.replaceChildren\(\);\s*appendRows\(rows\);/s);
+});
+
+test("renderer supports an opt-in sticky nav bar", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  const css = (await dispatch("GET", "/")).body ?? "";
+  // A bar nav with { sticky: true } gets the pc-sticky class (rails are excluded).
+  assert.match(js, /const barSticky = !rail && p\.sticky === true/);
+  assert.match(js, /\(barSticky \? " pc-sticky" : ""\)/);
+  // The CSS pins it to the viewport top with a solid background.
+  assert.match(css, /\.pc-bar\.pc-sticky \{[^}]*position:sticky[^}]*top:0/);
+});
+
 test("renderer exposes an embed-gated host-navigation bridge", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   const js = res.body ?? "";
@@ -441,8 +567,15 @@ test("the renderer routes between pages by hash and tears down grid polls", asyn
   assert.match(js, /const PAGE_ID = \/\^\[A-Za-z0-9_-/);
   assert.match(js, /function safePageId\(value\)/);
   assert.match(js, /function currentPage\(\)/);
-  assert.match(js, /try \{\s*const raw = decodeURIComponent/s);
-  assert.match(js, /catch \(e\) \{\s*return HOME;/s);
+  // The hash is parsed into a page + optional param by parseRoute(); the page
+  // segment is decoded and safe-id-validated (falling back to HOME).
+  assert.match(js, /function parseRoute\(\)/);
+  assert.match(js, /const raw = \(location\.hash \|\| ""\)\.replace/s);
+  assert.match(js, /if \(safePageId\(p\)\) \{ page = p; pageOk = true; \}/s);
+  // A stray param is only carried when the page segment resolved to a real page,
+  // so a malformed/unknown page (#/not-a-page/x) falls back to HOME without
+  // inheriting x (which would otherwise silently scope home's eqParam grids).
+  assert.match(js, /if \(pageOk\) \{ try \{ param = paramRaw \? decodeURIComponent\(paramRaw\) : ""; \}/s);
   assert.match(js, /location\.hash/);
   assert.match(js, /window\.addEventListener\("hashchange", renderPage\)/);
   assert.match(js, /async function renderPage\(\)/);
@@ -480,6 +613,62 @@ test("the renderer ships a nav node (menu bar / rail) with in-app + external lin
   assert.match(js, /pc-main-col/);
 });
 
+test("the renderer ships a button node that opens a copy-pasteable modal", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // button is a first-class node type.
+  assert.match(js, /button: renderButton/);
+  assert.match(js, /function renderButton\(node\)/);
+  // A ghost variant renders the muted outline style; a button carries its modal.
+  assert.match(js, /p\.variant === "ghost"/);
+  assert.match(js, /btn\.addEventListener\("click", \(\) => openModal\(m\)\)/);
+  // The modal is appended to <body>, is dismissable, and cleans up its keydown.
+  assert.match(js, /function openModal\(m\)/);
+  assert.match(js, /class: "pc-modal-overlay"/);
+  assert.match(js, /"aria-modal": "true"/);
+  assert.match(js, /if \(ev\.key === "Escape"\) \{ close\(\); return; \}/);
+  assert.match(js, /document\.removeEventListener\("keydown", onKey\)/);
+  // {{appBase}} in copy text is rebased onto the absolute mount root so an
+  // external agent gets a fetchable URL.
+  assert.match(js, /function resolveCopyText\(text\)/);
+  assert.match(js, /split\("\{\{appBase\}\}"\)\.join\(APP_BASE\.toString\(\)\)/);
+  // Copy is clipboard-first with a sandbox-safe execCommand fallback.
+  assert.match(js, /async function copyToClipboard\(text\)/);
+  assert.match(js, /navigator\.clipboard\.writeText/);
+  assert.match(js, /document\.execCommand\("copy"\)/);
+  // The fallback textarea is torn down in a finally so a throwing select()/
+  // execCommand never leaves a detached node accreting in <body> on retry.
+  assert.match(js, /finally \{ ta\.remove\(\); \}/);
+  // The dialog carries an accessible name (labelled by its title, or a fallback
+  // aria-label) so screen readers don't announce an unnamed dialog.
+  assert.match(js, /"aria-labelledby": titleId/);
+  assert.match(js, /"aria-label": "Dialog"/);
+  // An open modal is registered with teardown() so a page switch disposes it
+  // instead of leaking a stale overlay + document-level keydown listener.
+  assert.match(js, /disposers\.push\(close\)/);
+  // A manual close removes its own disposer entry, so repeated open/close cycles
+  // don't accrete dead close() closures on the disposers stack.
+  assert.match(js, /disposers\.indexOf\(close\)/);
+  assert.match(js, /disposers\.splice\(i, 1\)/);
+  // Focus is restored to the previously-focused element on close, and Tab is
+  // trapped inside the dialog so it can't reach the inert page behind the overlay.
+  assert.match(js, /const prevFocus = document\.activeElement/);
+  assert.match(js, /if \(ev\.key !== "Tab"\) return/);
+  assert.match(js, /ev\.preventDefault\(\); last\.focus\(\)/);
+  assert.match(js, /ev\.preventDefault\(\); first\.focus\(\)/);
+  // Only one modal opens at a time: a second open (e.g. double-click) is dropped
+  // so overlays and document-level keydown listeners never stack.
+  assert.match(js, /let modalOpen = false/);
+  assert.match(js, /if \(modalOpen\) return/);
+  assert.match(js, /modalOpen = true/);
+  assert.match(js, /modalOpen = false/);
+  // The aria-labelledby title id is unique per modal instance so it can't
+  // collide with a pre-existing page id and mis-associate the label.
+  assert.match(js, /let modalSeq = 0/);
+  assert.match(js, /"pc-modal-title-" \+ \(\+\+modalSeq\)/);
+});
+
+
 test("GET /app/data/<source>/<table> returns rows", async () => {
   const res = await dispatch("GET", "/app/data/app/orders");
   assert.equal(res.status, 200);