@bongos/core 1.19.1016 → 1.19.1017

package/modules/platform-identity/routes/community-search.js

@@ -0,0 +1,120 @@
+// modules/platform-identity/routes/community-search.js — GET /community/search,
+// the PUBLIC builder-search read behind the future /community page (D4,
+// docs/specs/bongos-v1-community-tab.md; task 1002979, goal 1000110 CT3). A
+// sibling of public-profile.js and scouting.js — same module, same doorway,
+// DIFFERENT surface: this is name+discipline search under exactly the
+// public-profile visibility rules, never the project.curate/owner-gated
+// recruiting directory (routes/scouting.js `GET /scouting`) and never its
+// archon-floor pre-accept sliver (`GET /scouting/:handle`). The visibility
+// decision lives entirely in ../builder-search.js (account-visibility.js's
+// shared predicates); this file is the thin HTTP shell — validation, the
+// per-IP rate limit, the response envelope.
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const builderSearch = require('../builder-search');
+
+const { pool, corsPublicGet } = api;
+
+// Resolved at CALL time, never at load — the scouting.js precedent: a proof
+// that stubs a PARTIAL doorway (pool + the auth gates only) must still be able
+// to require() this file, and a module-scope api.logger() call would break
+// that. A logging line is not worth breaking a privacy proof over.
+let resolvedLog = null;
+const log = {
+  error: (msg) => {
+    if (!resolvedLog) resolvedLog = typeof api.logger === 'function' ? api.logger('platform-identity') : { error: () => {} };
+    resolvedLog.error(msg);
+  },
+};
+
+// Per-IP read cap for this UNAUTHENTICATED route (the public-profile.js R05
+// posture: the global limiter only meters WRITES, so an uncapped scraper could
+// otherwise run the trigram leg at line rate). Vendored, not shared — the core
+// /public/* limiter is not on the doorway, and each public GET here owns its
+// own budget rather than reaching into a sibling module's copy.
+const READ_RATE_WINDOW_MS = 60 * 1000;
+const READ_RATE_LIMIT = 60;
+const buckets = new Map(); // ip -> timestamp[]
+
+const sweepTimer = setInterval(() => {
+  const cutoff = Date.now() - READ_RATE_WINDOW_MS;
+  for (const [k, arr] of buckets) {
+    while (arr.length && arr[0] < cutoff) arr.shift();
+    if (arr.length === 0) buckets.delete(k);
+  }
+}, 5 * 60 * 1000);
+if (typeof sweepTimer.unref === 'function') sweepTimer.unref();
+
+function searchReadRateLimit(req, res, next) {
+  const now = Date.now();
+  const key = req.ip || req.socket?.remoteAddress || 'unknown';
+  let bucket = buckets.get(key);
+  if (!bucket) { bucket = []; buckets.set(key, bucket); }
+  const cutoff = now - READ_RATE_WINDOW_MS;
+  while (bucket.length && bucket[0] < cutoff) bucket.shift();
+  if (bucket.length >= READ_RATE_LIMIT) {
+    const retryAfter = Math.max(1, Math.ceil((bucket[0] + READ_RATE_WINDOW_MS - now) / 1000));
+    res.set('Retry-After', String(retryAfter));
+    res.set('X-RateLimit-Scope', 'community-search-read');
+    res.set('X-RateLimit-Limit', String(READ_RATE_LIMIT));
+    return res.fail('rate_limited', 429, { scope: 'community-search-read', retry_after_seconds: retryAfter });
+  }
+  bucket.push(now);
+  return next();
+}
+
+module.exports = function communitySearchRoutes() {
+  const router = express.Router();
+
+  router.use('/community/search', corsPublicGet('/community/search'));
+
+  // rank: public — a name/discipline search under EXACTLY the public-profile
+  // visibility rules (D4): a hide_stats account is findable by name but drops
+  // out of a discipline-filtered result (disciplines are rollup-derived, and
+  // the rollup is what hide_stats suppresses); private and provisional
+  // accounts never appear. no-store: the same hide-must-beat-the-cache posture
+  // as /profiles/:handle (ADR 0171 D5) — this reads the identical predicate
+  // and a flip must be reflected on the very next request.
+  router.get('/community/search', searchReadRateLimit, async (req, res) => {
+    const q = (typeof req.query.q === 'string' ? req.query.q : '').trim();
+    if (!q) {
+      return res.fail('bad_request', { status: 400, message: 'q (a non-empty search string) is required' });
+    }
+    if (q.length < builderSearch.MIN_QUERY_CHARS) {
+      return res.fail('query_too_short', { status: 400, message: `q must be at least ${builderSearch.MIN_QUERY_CHARS} characters` });
+    }
+    if (q.length > builderSearch.MAX_QUERY_CHARS) {
+      return res.fail('query_too_long', { status: 400, message: `q must be at most ${builderSearch.MAX_QUERY_CHARS} characters` });
+    }
+    const discipline = (typeof req.query.discipline === 'string' ? req.query.discipline : '').trim();
+    if (discipline.length > builderSearch.MAX_DISCIPLINE_CHARS) {
+      return res.fail('discipline_too_long', { status: 400, message: `discipline must be at most ${builderSearch.MAX_DISCIPLINE_CHARS} characters` });
+    }
+    try {
+      const { results, limit, offset } = await builderSearch.searchBuilders({
+        q, discipline, limit: req.query.limit, offset: req.query.offset, pool,
+      });
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        query: q,
+        discipline: discipline || null,
+        count: results.length,
+        results,
+        page: { limit, offset },
+      });
+    } catch (err) {
+      log.error(`GET /community/search failed: ${err && err.message}`);
+      res.fail('search_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
+  return router;
+};
+
+// Exported for tests — the pure rate-limit bucket logic + limits (the
+// modules/memory/routes/search.js precedent).
+module.exports._internals = { searchReadRateLimit, READ_RATE_LIMIT, READ_RATE_WINDOW_MS };

package/modules/platform-identity/routes/scouting.js

@@ -10,11 +10,14 @@
 // ../scouting-authz.js, which carries the full argument for why reading an
 // instance-asserted ownership claim is not the ADR 0201 D3 inversion.
 //
-// WHO APPEARS IN IT: consent is enforced IN listScoutingRollup itself, by the
-// shared scoutingListableSql predicate — active, publicly visible, not hidden,
-// and not opted out of recruiting (ADR 0171 D2/D3 + privacy spec D1). So this
-// surface honors both the hide flag and the recruiting opt-out by construction,
-// and widening WHO may read it could not widen WHAT is shown.
+// WHO APPEARS IN IT: consent is enforced in the two reads themselves, by shared
+// predicates. `builders` is listScoutingRollup over scoutingListableSql —
+// active, publicly visible, not hidden, not opted out (ADR 0171 D2/D3 + privacy
+// spec D1). `name_only` (ADR 0334, task 1002291) is the hidden-but-reachable
+// builder the spec's D2 lists "name-only": login, name and avatar, via
+// scouting-name-only.js. So the opt-out removes a builder and hide only strips
+// their row to identity, by construction; widening WHO may read it could not
+// widen WHAT is shown.
 //
 // TWO READS, TWO AUDIENCES — and the difference is the point (ADR 0215 D4, task
 // 1002968). `GET /scouting` is the DIRECTORY: the full rollup for builders who
@@ -37,6 +40,7 @@ const api = require('../../../src/module-api');
 const pi = require('../platform-identity');
 const scoutingAuthz = require('../scouting-authz');
 const recruiterSliver = require('../recruiter-sliver');
+const scoutingNameOnly = require('../scouting-name-only');
 
 const { pool, requireBuilder, parsePagination } = api;
 
@@ -77,12 +81,15 @@ module.exports = function scoutingRoutes() {
     async (req, res) => {
       const { limit } = parsePagination(req, { defaultLimit: 100, maxLimit: 500 });
       try {
-        const builders = await pi.listScoutingRollup({ limit, pool });
+        const [builders, nameOnly] = await Promise.all([
+          pi.listScoutingRollup({ limit, pool }),
+          scoutingNameOnly.listScoutingNameOnly({ limit, pool }),
+        ]);
         // Same rollup-derived data as the sliver, so the same rule: hide and the
         // recruiting opt-out must beat any cache (ADR 0171 D5). This route
         // predates that posture and was the only rollup read still missing it.
         res.set('Cache-Control', 'no-store');
-        res.json({ builders });
+        res.json({ builders, name_only: nameOnly });
       } catch (err) {
         log.error(`GET /scouting failed: ${err && err.message}`);
         res.fail('scouting_failed', { status: 500, message: 'internal error' });

package/modules/platform-identity/scouting-name-only.js

@@ -0,0 +1,47 @@
+// modules/platform-identity/scouting-name-only.js — the recruiting directory's
+// NAME-ONLY tier: builders who hid their cross-project record but are still open
+// to recruiting (ADR 0334, task 1002291 / R15; privacy spec D2, whose recruiter
+// column lists a hidden builder "name-only (if not opted out)").
+//
+// WHAT IT RETURNS. For each such account: its GitHub login, display name and
+// avatar — what that builder's own public profile page already shows — and
+// nothing else. No id, no count, no date, no craft: every one of those is
+// derived from the record the builder hid. The projection is written out key by
+// key, so a column added to the statement later cannot ride into a response.
+//
+// WHO IS IN IT is scoutingNameOnlySql (account-visibility.js): publicly visible
+// AND hidden AND reachable. Two things it deliberately does NOT do:
+//   - consult the activity rollup. Listing only hidden builders who have built
+//     something would make presence here say so, and that is rollup-derived.
+//   - order by anything but the login. The ranked tier's order IS the record, so
+//     a hidden row ordered by it would leak its rank by position.
+//
+// WHO MAY READ IT is the directory's door (routes/scouting.js, ADR 0210). Not
+// authority in either direction (ADR 0016).
+//
+// Its own file because platform-identity.js sits at the 1,500-line ratchet.
+// Proof: tests/scouting_owner_access_and_reach.mjs §2b; the one-reader pin is in
+// tests/effective_visibility_predicate.mjs.
+'use strict';
+
+const { scoutingNameOnlySql } = require('./account-visibility');
+
+// listScoutingNameOnly({ limit, pool }) — the name-only tier, alphabetical by
+// login, bounded by the same `limit` the ranked tier takes.
+async function listScoutingNameOnly({ limit, pool }) {
+  const { rows } = await pool.query(
+    `SELECT github_login, display_name, avatar_url
+       FROM platform_identity_accounts
+      WHERE ${scoutingNameOnlySql()}
+      ORDER BY lower(github_login), github_login
+      LIMIT $1`,
+    [limit],
+  );
+  return rows.map((r) => ({
+    github_login: r.github_login ?? null,
+    display_name: r.display_name ?? null,
+    avatar_url: r.avatar_url ?? null,
+  }));
+}
+
+module.exports = { listScoutingNameOnly };

package/modules/public-landing/public/projects-floor.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Example World a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
+  "_": "The all-null floor card (task 1003301) on the hub's own catalog (task 1003345): the same page, the same stub, the catalog aliased to featured-hub.json — the landing's three plus Tidewater, a null row nobody owns. Demo, the landing catalog's floor row, is owned by the signed-in stub, and an owned orb's plain click opens its manage view, never its card. Since task 1003352 it also carries the card BACKDROP state: featured-hub gives Example World a card_backdrop, so the owner's plate can be seen standing in front of the project's own picture. Tidewater's null relationship is also the ONLY fixture row the signed-in stub neither owns nor builds on, which is exactly what the Apply button needs (R10, task 1002286) — card-floor is its one rendered state. Rendered by name: node modules/ui-design/kit/render.js --states public-landing/projects-floor.states.json",
   "page": "/projects",
   "surface": "public-landing",
   "modes": [
@@ -55,7 +55,14 @@
         "visible": [
           "#cardOpen",
           "#cardRuns",
-          "#cardListed"
+          "#cardListed",
+          "#cardApply"
+        ],
+        "text": [
+          [
+            "#cardApply",
+            "Apply to join"
+          ]
         ]
       }
     },

package/modules/public-landing/public/projects.html

@@ -1649,6 +1649,7 @@ summary{min-height:24px;padding:3px 0;}
   }
   var catalog = [];
   var mineOrigins = {};   /* normalized host → 'owner' | 'builder' */
+  var appliedOrigins = {}; /* normalized host → true; GET /my-projects' applied echo (R10, task 1002286) */
   var ownedInstances = []; /* the viewer's OWN provisioning rows (never torn_down) */
   var ownedByHost = {};    /* lower(domain) → instance row — the dedupe join */
   /* What the platform's own entry is FOR SEARCH. It is deliberately not pushed
@@ -2166,6 +2167,63 @@ summary{min-height:24px;padding:3px 0;}
       : '';
   }
 
+  /* ══ APPLY TO JOIN (R10, task 1002286) ═══════════════════════════════
+     The card's own door onto the join relay platform-identity already runs
+     (POST /my-projects/join, R08 task 1002284): one click, on the origin the
+     card already has — no URL to type, unlike the separate join-by-URL field
+     task 1003774 is adding to View · Your projects. Hidden for the platform's
+     own card, a member (the “yours”/“you build here” chip already says so) and
+     a signed-out visitor (there is no session to file the request under).
+     Applied is read from the hub's own echo (GET /my-projects' `applied`,
+     loadMemberships) and updated the moment a request lands — the echo
+     carries no status (ADR 0201 D1.3), so Applied IS pending here; there is
+     nothing truer to say until membership itself appears. ══ */
+  function cardApplyHtml(p, rel) {
+    if (p.isSelf || isMember(rel) || !me) return '';
+    return appliedOrigins[hostOf(p.origin)]
+      ? '<button type="button" class="btn ghost" id="cardApply" disabled>Applied</button>'
+      : '<button type="button" class="btn ghost" id="cardApply">Apply to join</button>';
+  }
+  /* The relay's own outcome (my-projects.js RELAY_SENTENCE) is shown verbatim
+     — this page invents no wording of its own for a door it did not build.
+     Only `status === 'requested'` moves the button to Applied; every other
+     2xx (already_member, invite_only, open_enrollment, members_only,
+     not_published) is the door's answer, not a click that went through. */
+  function submitApply(btn, p) {
+    btn.disabled = true;
+    btn.textContent = 'Applying…';
+    var msg = $('cardApplyMsg');
+    fetch(API + '/my-projects/join', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ origin: p.origin }),
+    }).then(function (res) {
+      if (res.status === 401) {
+        btn.textContent = 'Apply to join'; btn.disabled = false;
+        if (msg) { msg.className = 'projMsg err'; msg.innerHTML = signInAgain(); }
+        return;
+      }
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok && data && data.status === 'requested') {
+          appliedOrigins[hostOf(p.origin)] = true;
+          btn.textContent = 'Applied';
+          if (msg) { msg.className = 'projMsg ok'; msg.textContent = data.message || 'Requested.'; }
+          return;
+        }
+        btn.textContent = 'Apply to join';
+        btn.disabled = false;
+        var e = apiError(data, res.status);
+        if (msg) {
+          msg.className = 'projMsg' + (res.ok ? '' : ' err');
+          msg.textContent = (res.ok && data && data.message) || e.message || 'Could not reach that project — try again in a moment.';
+        }
+      });
+    }).catch(function () {
+      btn.textContent = 'Apply to join';
+      btn.disabled = false;
+      if (msg) { msg.className = 'projMsg err'; msg.textContent = 'Couldn’t reach the platform — check your connection and try again.'; }
+    });
+  }
+
   function openCard(p, rel, returnTo) {
     var href = p.isSelf ? '/' : safeHttpUrl(p.origin);
     /* the art: catalog text an Archon typed, scheme-checked server-side and
@@ -2195,13 +2253,16 @@ summary{min-height:24px;padding:3px 0;}
        is member-gated AND address-gated: a member's entry, only where the hall
        is somewhere other than the site the first door already opens. */
     var hall = isMember(rel) ? hallUrlOf(p) : '';
+    var applyBtn = cardApplyHtml(p, rel);
     $('cardActions').innerHTML = (href
       ? '<a class="cardOpen" id="cardOpen" href="' + esc(href) + '"' +
         (p.isSelf ? '' : ' target="_blank" rel="noopener"') + '>' +
         (p.isSelf ? 'Home →' : 'Open site →') + '</a>'
       : '') + (hall
       ? '<a class="cardHall" id="cardHall" href="' + esc(hall) + '" target="_blank" rel="noopener">' + HALL_GLYPH + 'Builders\' hall</a>'
-      : '');
+      : '') + applyBtn + (applyBtn ? '<p class="projMsg" id="cardApplyMsg"></p>' : '');
+    var applyEl = $('cardApply');
+    if (applyEl && !applyEl.disabled) applyEl.addEventListener('click', function () { submitApply(applyEl, p); });
     closeMenus();
     cardReturn = returnTo || null;
     $('cardScrim').hidden = false;
@@ -2446,16 +2507,20 @@ summary{min-height:24px;padding:3px 0;}
   /* "Mine" is a MEMBERSHIP, not the catalog's advisory owner column: the
      authority is platform_identity_project_memberships, whose role is
      owner|builder|visitor, and GET /my-projects already returns the
-     { owned, building } split. 401 (signed out) is not an error here. */
+     { owned, building, applied } split — `applied` is the statusless echo
+     (ADR 0201 D1.3) the card's Apply button reads back (R10, task 1002286).
+     401 (signed out) is not an error here. */
   function loadMemberships() {
     return fetch(API + '/my-projects', { credentials: 'same-origin' })
-      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [] }; })
+      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [], applied: [] }; })
       .then(function (d) {
         mineOrigins = {};
+        appliedOrigins = {};
         (d.owned || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'owner'; });
         (d.building || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'builder'; });
+        (d.applied || []).forEach(function (m) { if (m.origin) appliedOrigins[hostOf(m.origin)] = true; });
       })
-      .catch(function () { mineOrigins = {}; });
+      .catch(function () { mineOrigins = {}; appliedOrigins = {}; });
   }
 
   /* The owner-scoped half of the sky (task 1002744). The public catalog

package/modules/ui-design/styles/expedition/mock.html

@@ -39,9 +39,7 @@ body {
   --gutter: clamp(16px, 4vw, 26px);
   --band: clamp(40px, 7vh, 72px);
   margin: 0;
-  background: var(--bg);
-  background-image: radial-gradient(var(--dots) .9px, transparent 1px);
-  background-size: var(--dot-pitch) var(--dot-pitch);
+  background-color: var(--bg);
   color: var(--ink);
   font-family: var(--font-body);
   font-size: 16px;
@@ -101,6 +99,21 @@ body {
   }
 }
 
+/* the halftone screen, fixed under the content. Not body's own background-image on purpose:
+   the branding pack's `backdrop` emits a `body{background:...}` rule after the page's own
+   stylesheet (serve-internal.js themeMarkup()), and that shorthand resets background-image
+   to none on any served page. A texture on body silently does not exist; a texture on a
+   layer does (the same pattern as the blueprint look's grid, task 1003633). */
+body::before {
+  content: "";
+  position: fixed;
+  inset: 0;
+  z-index: -1;
+  pointer-events: none;
+  background-image: radial-gradient(var(--dots) .9px, transparent 1px);
+  background-size: var(--dot-pitch) var(--dot-pitch);
+}
+
 *, *::before, *::after { box-sizing: border-box; }
 a { color: inherit; }
 :focus-visible { outline: 2px solid var(--focus); outline-offset: 3px; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1016",
+  "version": "1.19.1017",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1016",
+      "version": "1.19.1017",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1016",
+  "version": "1.19.1017",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1016'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1017'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/account_privacy_flags.mjs

@@ -416,7 +416,10 @@ test('the recruiting surface really is exactly two reads, and each one joins REA
   assert.match(route, /'\/scouting\/:handle'/, 'and the pre-accept sliver');
 
   const av = readFileSync(join(ROOT, 'modules/platform-identity/account-visibility.js'), 'utf8');
-  for (const composed of ['scoutingListableSql', 'recruiterSliverVisibleSql']) {
+  // The directory reads TWO tiers since task 1002291 — ranked, and the hidden
+  // builders it lists by name — and the opt-out must empty both, or "removes you
+  // from the People directory" is false for a builder who also hid their record.
+  for (const composed of ['scoutingListableSql', 'scoutingNameOnlySql', 'recruiterSliverVisibleSql']) {
     const body = av.slice(av.indexOf(`function ${composed}(`));
     assert.match(body.slice(0, body.indexOf('\n}')), /recruiterReachSql\(alias\)/,
       `${composed} stopped composing the reach axis — opting out would no longer empty that surface`);