@bongos/core 1.17.0

package/tests/platform_boot.mjs

@@ -0,0 +1,167 @@
+// tests/platform_boot.mjs — the GDS-only entrypoint boots with no game in the
+// process (ADR 0062 R51, task 1190).
+//
+// This is the R51 done-when, executable: boot the platform (src/platform-server.js),
+// reach /api/gds/healthz + the builders' hall + the status dashboard, and assert
+// that NO game route or asset is reachable in the process. DB-free — /healthz,
+// the static hall/status HTML, and the 404 tail need no Postgres — so it runs in
+// the unit gate (the pg Pool is constructed lazily and never queried here).
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import platformMod from '../src/platform-server.js';
+
+const { buildPlatformApp } = platformMod;
+
+let server;
+let port;
+
+before(async () => {
+  const app = buildPlatformApp();
+  server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+
+after(async () => {
+  await new Promise((resolve) => server.close(resolve));
+});
+
+// Minimal request helper: connect to 127.0.0.1 but send an explicit Host header
+// so we can exercise the apex / builders.* / status.* host routing (fetch treats
+// `host` as a forbidden header and would not let us set it).
+function request(pathname, host = '127.0.0.1') {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, path: pathname, method: 'GET', headers: { Host: host } },
+      (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }));
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('R51: /api/gds/healthz is reachable (no DB needed)', async () => {
+  const res = await request('/api/gds/healthz');
+  assert.equal(res.status, 200);
+  const json = JSON.parse(res.body);
+  assert.equal(json.ok, true);
+});
+
+test('R55: the hall live channel (SSE) is mounted game-lessly', async () => {
+  // The done-when for R55 (task 1194 / ADR 0069): the hall's live updates work
+  // on a Cloud Bongos boot with NO game in the process. The Colyseus room could
+  // never run here (no Colyseus); the SSE endpoint lives in the GDS router, so
+  // it IS mounted. An unauthenticated request gets 401 (requireBuilder) — which
+  // proves the route exists and is gated, NOT a 404. No cookie ⇒ no DB lookup,
+  // so this stays in the DB-free unit gate and never opens a hanging stream.
+  const res = await request('/api/gds/live');
+  assert.equal(res.status, 401, '/api/gds/live must be mounted + auth-gated, not 404');
+});
+
+test('R51: the builders’ hall is reachable on the builders host', async () => {
+  const res = await request('/', 'builders.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.headers['content-type'] || '', /text\/html/);
+  // A non-empty HTML document — the hall shell, not the 404 tail.
+  assert.ok(res.body.length > 500, 'hall HTML should be a full document');
+  assert.doesNotMatch(res.body, /404 — not found/);
+});
+
+test('R51: the status dashboard is reachable on the status host', async () => {
+  const res = await request('/', 'status.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.headers['content-type'] || '', /text\/html/);
+  assert.ok(res.body.length > 500, 'status HTML should be a full document');
+});
+
+test('R51: NO game vendored libs are reachable', async () => {
+  for (const p of ['/vendor/phaser.min.js', '/vendor/colyseus.js']) {
+    const res = await request(p);
+    assert.equal(res.status, 404, `${p} must not be served by a game-less boot`);
+  }
+});
+
+test('R51: NO game tile assets are reachable', async () => {
+  for (const p of ['/assets/tiles/atlas.json', '/assets/tiles/manifest.json']) {
+    const res = await request(p);
+    assert.equal(res.status, 404, `${p} must not be served by a game-less boot`);
+  }
+});
+
+test('the apex host serves the landing page — not the game — on a game-less boot', async () => {
+  // On server.js (the game boot) GET / on the apex serves the Phaser game shell.
+  // Here there is no game: the apex serves the minimal landing page (task 1374),
+  // with branding injected — NOT a game document, NOT the themed island 404, and
+  // NOT the bare "404 — not found" tail the apex returned before the landing.
+  const res = await request('/', 'game.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.headers['content-type'] || '', /text\/html/);
+  assert.doesNotMatch(res.body, /phaser/i);          // no game client shell
+  assert.doesNotMatch(res.body, /404 — not found/);  // not the bare apex tail
+  // it IS the landing, with the branding pack injected (look + identity from config)
+  assert.match(res.body, /window\.__BRANDING__=/);
+  assert.match(res.body, /Enter the Hall/);
+  // the platform-level create door (goal 35, task 2084) — gated by sign-in client-side
+  assert.match(res.body, /Create a project/);
+});
+
+test('the apex host serves the branded /create page (goal 35, task 2081)', async () => {
+  // The project-creation experience is a platform-level page on the apex,
+  // branding-injected exactly like the landing (same landingPage memo).
+  const res = await request('/create', 'game.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.headers['content-type'] || '', /text\/html/);
+  assert.match(res.body, /window\.__BRANDING__=/);
+  assert.match(res.body, /Create a project/);
+  // the wizard files the request against the provisioning API, nothing else
+  assert.match(res.body, /provisioning\/instances/);
+});
+
+test('R51: an API-shaped 404 still gets a self-describing JSON body', async () => {
+  // The platform tail keeps server.js's contract: a mis-prefixed GDS call gets
+  // JSON, not HTML, so a CLI/JSON client never JSON.parse-faults on an HTML 404.
+  const res = await request('/tasks');
+  assert.equal(res.status, 404);
+  assert.match(res.headers['content-type'] || '', /application\/json/);
+  const json = JSON.parse(res.body);
+  assert.ok(json.error || json.message, 'API-shaped 404 carries an error/message');
+});
+
+test('R56: /api/gds/public/branding exposes the client-safe currency projection', async () => {
+  const res = await request('/api/gds/public/branding');
+  assert.equal(res.status, 200);
+  const json = JSON.parse(res.body);
+  assert.ok(json.currency && typeof json.currency.label === 'string', 'carries currency.label');
+  // server-only fields must NOT be exposed on the public surface
+  assert.equal(json.domains, undefined);
+  assert.equal(json.repo, undefined);
+});
+
+test('R56: the served hall injects window.__BRANDING__ synchronously', async () => {
+  const res = await request('/', 'builders.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.body, /window\.__BRANDING__=/);
+  assert.match(res.body, /"currency"/);
+});
+
+test('R60: the served hall injects window.__MODULES__ (feature-module flags) synchronously', async () => {
+  // The hall's dev-box/discord UI gating (R60, task 1199) reads
+  // window.__MODULES__.enabled[...]; serve-internal must inject it the same
+  // synchronous way as __BRANDING__, or the frontend gate has nothing to read.
+  const res = await request('/', 'builders.test.local');
+  assert.equal(res.status, 200);
+  assert.match(res.body, /window\.__MODULES__=/);
+  // Shape contract the frontend depends on: an `enabled` map keyed by module.
+  const m = res.body.match(/window\.__MODULES__=(\{.*?\});/);
+  assert.ok(m, 'a __MODULES__ assignment is present');
+  const parsed = JSON.parse(m[1]);
+  assert.equal(typeof parsed.enabled, 'object');
+  assert.equal(typeof parsed.enabled['dev-box'], 'boolean');
+  assert.equal(typeof parsed.enabled.discord, 'boolean');
+});

package/tests/pre_compact.mjs

@@ -0,0 +1,60 @@
+// tests/pre_compact.mjs — System 2 (task 1349). Pure helpers of the PreCompact
+// hook: the flag-gate decision + the directive formatter. DB-free, no I/O.
+// Run: node tests/pre_compact.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { gateDecision, buildDirective, FLAG } = require('../.claude/hooks/pre-compact.js');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); console.log(`  ok  ${name}`); passed++; }
+  catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
+}
+
+test('gate is OFF by default (flag unset)', () => {
+  assert.deepEqual(gateDecision({}, 'PreCompact'), { run: false, mode: 'off' });
+  assert.deepEqual(gateDecision({ [FLAG]: '0' }, 'PreCompact'), { run: false, mode: 'off' });
+  assert.deepEqual(gateDecision({ [FLAG]: 'true' }, 'PreCompact'), { run: false, mode: 'off' });
+});
+
+test('gate ON: PreCompact event → batched path; other event → advisory fallback', () => {
+  assert.deepEqual(gateDecision({ [FLAG]: '1' }, 'PreCompact'), { run: true, mode: 'precompact' });
+  assert.deepEqual(gateDecision({ [FLAG]: '1' }, 'Stop'), { run: true, mode: 'stop-advisory' });
+  assert.deepEqual(gateDecision({ [FLAG]: '1' }, undefined), { run: true, mode: 'stop-advisory' });
+});
+
+test('buildDirective: empty eviction set → empty string (no-op)', () => {
+  assert.equal(buildDirective({ evict: [], stubs: {}, summary: {} }), '');
+});
+
+test('buildDirective: lists stubs + the retrieval-first recovery rule', () => {
+  const classification = {
+    evict: [
+      { tool_use_id: 'a', tokens: 100, reason: 'superseded' },
+      { tool_use_id: 'b', tokens: 50, reason: 'stale_dump' },
+    ],
+    stubs: { a: '[evicted ~100 tok: Read of x — stale; recover via re-Read x or /recall]', b: '[evicted ~50 tok: Grep output — old; recover via /recall]' },
+    summary: { evict_blocks: 2, evict_tokens: 150, evict_pct: 30, by_reason: { superseded: 100, duplicate: 0, stale_dump: 50 } },
+  };
+  const d = buildDirective(classification);
+  assert.match(d, /In-session compaction \(System 2\)/);
+  assert.match(d, /REPLACE each listed tool_result with its stub/);
+  assert.match(d, /\/recall/);
+  assert.match(d, /Read of x/);
+  // biggest first
+  assert.ok(d.indexOf('Read of x') < d.indexOf('Grep output'));
+});
+
+test('buildDirective: caps the injected stub list and summarizes the rest', () => {
+  const evict = [], stubs = {};
+  for (let i = 0; i < 50; i++) { evict.push({ tool_use_id: `t${i}`, tokens: 10, reason: 'duplicate' }); stubs[`t${i}`] = `[evicted t${i}]`; }
+  const d = buildDirective({ evict, stubs, summary: { evict_blocks: 50, evict_tokens: 500, evict_pct: 40, by_reason: { superseded: 0, duplicate: 500, stale_dump: 0 } } }, { maxStubs: 5 });
+  const stubCount = (d.match(/\[evicted t/g) || []).length;
+  assert.equal(stubCount, 5);
+  assert.match(d, /and 45 more/);
+});
+
+console.log(`\npre_compact: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/preview_server.mjs

@@ -0,0 +1,127 @@
+// tests/preview_server.mjs
+//
+// Hermetic unit coverage for the #1065 sandbox-freshness helpers in
+// src/preview-server.js: previewCacheControl (no-store on non-hashed game code,
+// immutable on content-hashed atlases) and injectLivereload (the auto-reload tag
+// injection). Importing the module must NOT bind a port (the listen path is
+// guarded by require.main === module). NO network, NO server.
+//
+// Run:  node tests/preview_server.mjs   (also runs in the unit gate)
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { previewCacheControl, injectLivereload, renderArtGallery } = require('../src/preview-server.js');
+
+// A minimal valid 1×1 PNG (transparent), base64-decoded to bytes.
+const TINY_PNG = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==',
+  'base64');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
+}
+
+t('previewCacheControl: content-hashed atlas → immutable', () => {
+  assert.equal(previewCacheControl('public/assets/tiles/atlas-deadbeef12.png'), 'public, max-age=31536000, immutable');
+  assert.equal(previewCacheControl('atlas-0a1b2c3d.json'), 'public, max-age=31536000, immutable');
+});
+
+t('previewCacheControl: non-hashed game code/markup → no-store', () => {
+  for (const f of ['public/index.html', 'public/game/main.js', 'public/assets/tiles/atlas-index.json', 'foo.json']) {
+    assert.equal(previewCacheControl(f), 'no-store', `${f} must be no-store`);
+  }
+});
+
+t('previewCacheControl: other static assets → short TTL', () => {
+  assert.equal(previewCacheControl('public/assets/sprite.png'), 'public, max-age=300');
+  assert.equal(previewCacheControl('public/fonts/x.woff2'), 'public, max-age=300');
+});
+
+t('previewCacheControl: a non-hashed atlas-like png is NOT immutable', () => {
+  // a plain atlas.png without the hash segment is not the immutable form
+  assert.equal(previewCacheControl('public/assets/tiles/atlas.png'), 'public, max-age=300');
+});
+
+t('injectLivereload: injects the tag before </body>', () => {
+  const out = injectLivereload('<html><body><div id="game"></div></body></html>');
+  assert.match(out, /<script src="\/__preview\/livereload\.js"><\/script><\/body>/);
+  // exactly one injection
+  assert.equal((out.match(/__preview\/livereload\.js/g) || []).length, 1);
+});
+
+t('injectLivereload: appends when there is no </body>', () => {
+  const out = injectLivereload('<html>no body close</html>');
+  assert.match(out, /__preview\/livereload\.js"><\/script>$/);
+});
+
+t('injectLivereload: embeds the per-page stamp global BEFORE the reload script', () => {
+  // The client baselines its reload check off window.__OTB_PREVIEW_STAMP (the
+  // stamp the page was served with), so a restart in the first poll interval is
+  // still detected. The stamp must be present and ordered before the poller.
+  const out = injectLivereload('<html><body>x</body></html>', 'STAMP123');
+  assert.match(out, /window\.__OTB_PREVIEW_STAMP="STAMP123"/);
+  assert.ok(out.indexOf('__OTB_PREVIEW_STAMP') < out.indexOf('livereload.js'),
+    'stamp global must be set before the livereload script runs');
+});
+
+// ── renderArtGallery (#1262): live gallery rendered from the tiles dir ──────────
+function withTilesDir(fn) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-art-'));
+  try { return fn(dir); } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+}
+
+t('renderArtGallery: empty / missing dir → null (caller shows no-art page)', () => {
+  withTilesDir((dir) => assert.equal(renderArtGallery(dir), null));
+  assert.equal(renderArtGallery('/no/such/path/at/all'), null);
+});
+
+t('renderArtGallery: renders every PNG present, base64-inlined', () => {
+  withTilesDir((dir) => {
+    fs.writeFileSync(path.join(dir, 'amphora.png'), TINY_PNG);
+    fs.writeFileSync(path.join(dir, 'cypress_tree.png'), TINY_PNG);
+    const html = renderArtGallery(dir);
+    assert.match(html, /<code>amphora<\/code>/);
+    assert.match(html, /<code>cypress_tree<\/code>/);
+    assert.match(html, /data:image\/png;base64,/);
+    assert.equal((html.match(/<figure/g) || []).length, 2);
+    assert.match(html, /2 tile\(s\) made/);
+  });
+});
+
+t('renderArtGallery: shows the score badge from <id>__best_score.txt when present', () => {
+  withTilesDir((dir) => {
+    fs.writeFileSync(path.join(dir, 'grass_base.png'), TINY_PNG);
+    fs.writeFileSync(path.join(dir, 'grass_base__best_score.txt'), '9.22\n');
+    const html = renderArtGallery(dir);
+    assert.match(html, /<span class="score">9\.22<\/span>/);
+  });
+});
+
+t('renderArtGallery: a tile WITHOUT a score file still renders (badge omitted)', () => {
+  withTilesDir((dir) => {
+    fs.writeFileSync(path.join(dir, 'small_boat.png'), TINY_PNG);
+    const html = renderArtGallery(dir);
+    assert.match(html, /<code>small_boat<\/code>/);
+    assert.doesNotMatch(html, /class="score"/);
+  });
+});
+
+t('renderArtGallery: ignores non-PNG files (e.g. the __best_score.txt sidecars)', () => {
+  withTilesDir((dir) => {
+    fs.writeFileSync(path.join(dir, 'one.png'), TINY_PNG);
+    fs.writeFileSync(path.join(dir, 'one__best_score.txt'), '7.0');
+    fs.writeFileSync(path.join(dir, 'notes.md'), '# not a tile');
+    const html = renderArtGallery(dir);
+    assert.equal((html.match(/<figure/g) || []).length, 1);
+  });
+});
+
+console.log(`\npreview_server: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/profile_route.mjs

@@ -0,0 +1,197 @@
+// tests/profile_route.mjs
+//
+// Guards GET /builders/:id/profile — the public builder-profile read (task 1467,
+// goal 25 "bx-identity"). The route is intentionally UNAUTHENTICATED, so its one
+// load-bearing invariant is that it must NEVER leak the private columns that
+// db.getBuilderById also returns (anthropic_email / anthropic_user_id /
+// monthly_budget_usd / system_role / box_blocked* / deactivated_reason). It
+// whitelists a public subset off the row; this test proves the whitelist holds,
+// that the shape is right, and that unknown/invalid ids answer 404/400.
+//
+// Stub auth + db + the lifecycle/reward ports (no network, no Postgres) exactly
+// as tests/onboarding_route_signals.mjs does for the sibling public route.
+//
+// Run:  node tests/profile_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.error(`  FAIL ${name}\n       ${e.message}`); }
+}
+
+// ---- the fixtures ---------------------------------------------------------
+
+// A FULL builder row exactly as db.getBuilderById returns it (SELECT in
+// db-kernel.js) — including every PRIVATE column. The secret sentinel strings
+// let us assert nothing leaks anywhere in the serialized response, not just on
+// the builder object.
+const SECRET_EMAIL = 'do-not-leak@example.com';
+const SECRET_USER = 'usr_do_not_leak';
+const SECRET_REASON = 'DO_NOT_LEAK_REASON';
+const FULL_ROW = {
+  id: 95,
+  github_id: 424242,
+  github_login: 'jaxri',
+  display_name: 'Jackson Rini',
+  avatar_url: 'https://example.test/a.png',
+  total_credits: 3917,
+  karma: 12,
+  created_at: '2026-01-01T00:00:00.000Z',
+  rank: 'metic',
+  status: 'active',
+  deactivated_at: null,
+  reactivated_at: null,
+  deactivated_reason: SECRET_REASON,
+  preferred_disciplines: ['engineer'],
+  system_role: 'superadmin',
+  anthropic_email: SECRET_EMAIL,
+  anthropic_user_id: SECRET_USER,
+  monthly_budget_usd: 500,
+  box_blocked: true,
+  box_blocked_reason: SECRET_REASON,
+  box_blocked_at: '2026-01-01T00:00:00.000Z',
+  box_blocked_by: 7,
+};
+
+// The columns that must NEVER appear on the returned builder object.
+const PRIVATE_KEYS = [
+  'github_id', 'status', 'deactivated_at', 'reactivated_at', 'deactivated_reason',
+  'system_role', 'anthropic_email', 'anthropic_user_id', 'monthly_budget_usd',
+  'box_blocked', 'box_blocked_reason', 'box_blocked_at', 'box_blocked_by',
+];
+// The public subset the route DOES return.
+const PUBLIC_KEYS = [
+  'id', 'github_login', 'display_name', 'avatar_url', 'rank',
+  'total_credits', 'karma', 'created_at', 'preferred_disciplines',
+];
+
+// ---- stubs ----------------------------------------------------------------
+
+// auth: the profile route is public, but the router factory references
+// auth.requireBuilder/requireRank when defining OTHER routes — give it shims.
+const authPath = require.resolve('../src/bongos/auth.js');
+require.cache[authPath] = {
+  id: authPath, filename: authPath, loaded: true,
+  exports: {
+    requireBuilder: (_req, _res, next) => next(),
+    requireRank: () => (_req, _res, next) => next(),
+  },
+};
+
+// db: only getBuilderById (the residue read the route touches). Returns the full
+// row for the known id, null otherwise (drives the 404 branch).
+const dbPath = require.resolve('../src/bongos/db.js');
+require.cache[dbPath] = {
+  id: dbPath, filename: dbPath, loaded: true,
+  exports: {
+    RANKS: ['xenos', 'thetes', 'metic', 'archon'],
+    getBuilderById: async (id) => (Number(id) === FULL_ROW.id ? { ...FULL_ROW } : null),
+  },
+};
+
+// The lifecycle (ship counts + recent ships) and reward (achievements) reads
+// resolve through kernel ports — register stub providers, the production wiring.
+const seams = require('../src/module-seams.js');
+seams._reset();
+seams.registerProvider('lifecycle', {
+  countShippedTasksForBuilder: async () => 3,
+  recentShippedTasksByBuilder: async () => ([
+    { id: 42, title: 'Ship a thing', value_summary: 'Shipped X', version_id: 'BONGOS-V1', status: 'shipped', shipped_at: '2026-06-01T00:00:00.000Z', credits_reward: 30, credits_awarded: 28 },
+  ]),
+});
+seams.registerProvider('reward', {
+  getBuilderAchievements: async () => ([
+    { builder_id: 95, achievement_id: 'first-ship', unlocked_at: '2026-02-01T00:00:00.000Z', unlocked_by_task_id: 10, name: 'First ship', description: 'Shipped your first work', icon: '🚢', credit_bonus: 5, sort_order: 1 },
+  ]),
+});
+
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildBuildersRouter = require('../src/bongos/routes/builders.js');
+
+function buildApp() {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail); // res.fail() ahead of the routers, exactly as the real app does
+  app.use('/api/gds', buildBuildersRouter());
+  return app;
+}
+
+function listen(app) {
+  return new Promise((resolve) => {
+    const server = app.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port }));
+  });
+}
+
+function get(port, path) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch (_) {}
+        resolve({ status: res.statusCode, json, text });
+      });
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+const { server, port } = await listen(buildApp());
+
+await t('known id → 200 with the public field subset', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  assert.ok(r.json && r.json.builder, 'response has a builder object');
+  for (const k of PUBLIC_KEYS) {
+    assert.ok(k in r.json.builder, `builder should expose public field "${k}"`);
+  }
+  assert.equal(r.json.builder.id, 95);
+  assert.equal(r.json.builder.github_login, 'jaxri');
+  assert.equal(r.json.builder.rank, 'metic');
+  assert.equal(r.json.shipped_count, 3);
+  assert.ok(Array.isArray(r.json.recent_ships) && r.json.recent_ships.length === 1);
+  assert.ok(Array.isArray(r.json.achievements) && r.json.achievements.length === 1);
+});
+
+await t('known id → NO private column leaks on the builder object', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  for (const k of PRIVATE_KEYS) {
+    assert.ok(!(k in r.json.builder), `private field "${k}" must NOT be present on the builder`);
+  }
+});
+
+await t('known id → no secret sentinel leaks ANYWHERE in the response body', async () => {
+  const r = await get(port, '/api/gds/builders/95/profile');
+  assert.equal(r.status, 200);
+  for (const secret of [SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
+    assert.ok(!r.text.includes(secret), `response body must not contain the secret "${secret}"`);
+  }
+});
+
+await t('unknown id → 404 builder_not_found', async () => {
+  const r = await get(port, '/api/gds/builders/99999/profile');
+  assert.equal(r.status, 404);
+  assert.equal(r.json && r.json.error && r.json.error.code, 'builder_not_found');
+});
+
+await t('non-numeric id → 400 bad_builder_id', async () => {
+  const r = await get(port, '/api/gds/builders/not-a-number/profile');
+  assert.equal(r.status, 400);
+  assert.equal(r.json && r.json.error && r.json.error.code, 'bad_builder_id');
+});
+
+server.close();
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);