feat(events): an event action's progress() on a live run's public page (MODULE_API 1.12.0)

An event action may declare an optional `progress(envelope)`: how its
step stands while the run is live. Core accepts two shapes and
interprets neither:

- a count: { label, left, of }, rendered "Bandits: 3 of 8 left";
- a percentage: { label, percent }, rendered "The Juggernaut: 62%".

How core asks:

- `events/progress.js` asks each step of a live run whose action has
  one. It passes the step's own held ledger rows and the reader's
  account id, so the module applies its own visibility.
- Each call has a 2 s deadline. A throw, a late answer or any other
  shape is a line not shown, never an error on the page.
- One answer per run and reader is cached for 5 s.
- The public event's live occurrence carries the lines as `progress`.
  The route takes an optional session for the reader.
- The page renders them under the phase label and re-reads them every
  15 s while the event is live.

Core stays game-agnostic: no game's words are in it. Additive, so a
minor bump. Module-uo declares ^1.10.0, registers no action with
progress(), and its actions and pages are unchanged.

From RunicNPC stage 8 (D304, D305).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/src/router/v1/public/events.controller.js

@@ -50,7 +50,12 @@ async function getEvent(req, res) {
     // string: the model matches it against this definition's own runs and
     // ignores anything else, so a garbage value renders the page rather than an
     // error. See the model's note on why it is not refused.
-    const result = await events.event(req.params.slug, { runId: req.query.run || null })
+    // `userId` is the reader's, when they sent a session (`optionalAuth`): a
+    // module's progress line may show a signed-in reader more than a stranger.
+    const result = await events.event(req.params.slug, {
+      runId: req.query.run || null,
+      userId: req.user && req.user.id != null ? req.user.id : null,
+    })
     return answer(res, result)
   } catch (err) {
     return fail(res, err, 'public event')

server/src/router/v1/public/events.router.js

@@ -15,6 +15,7 @@ const express = require('express')
 
 const ctrl = require('./events.controller')
 const siteMode = require('../../../middleware/siteMode')
+const { optionalAuth } = require('../../../auth/session.middleware')
 
 const eventsRouter = express.Router()
 
@@ -48,12 +49,14 @@ eventsRouter.get(
   '/:slug',
   // #swagger.tags = ['Public · Events']
   // #swagger.summary = 'One event'
-  // #swagger.description = 'The storyline, the arc it belongs to, what is live, what is next, what happened recently, and a results table once one has been published. A draft, an archived definition and an unlisted one all answer 404, indistinguishable from a slug that never existed. The plan behind the event — phases, steps, actions and their params — is never published; a live run carries the LABEL of the phase it is in and nothing more.'
+  // #swagger.description = 'The storyline, the arc it belongs to, what is live, what is next, what happened recently, and a results table once one has been published. A draft, an archived definition and an unlisted one all answer 404, indistinguishable from a slug that never existed. The plan behind the event — phases, steps, actions and their params — is never published; a live run carries the LABEL of the phase it is in and nothing more, and `progress`: how its steps stand, each line a label with either `left` of `of` or a `percent`, in the words the steps\' modules chose. What a module shows may depend on who is reading, so sending a session is optional and may widen it.'
   // #swagger.parameters['slug'] = { in: 'path', required: true, schema: { type: 'string' }, description: 'The event slug.' }
   // #swagger.parameters['run'] = { in: 'query', required: false, schema: { type: 'string' }, description: 'Which occurrence the results are about — what an announcement\'s link carries, so a mail about last Friday does not open next Friday\'s. A run that does not belong to this event is ignored rather than refused.' }
+  // #swagger.security = [{}, { "cookieAuth": [] }, { "bearerAuth": [] }]
   /* #swagger.responses[200] = { description: 'The event', content: { "application/json": { schema: { $ref: "#/components/schemas/PublicEvent" } } } } */
   /* #swagger.responses[404] = { description: 'No such public event', content: { "application/json": { schema: { $ref: "#/components/schemas/Error" } } } } */
   siteMode,
+  optionalAuth,
   ctrl.getEvent,
 )