@bongos/core 1.19.373 → 1.19.375

package/docs/api/openapi.json

@@ -309,6 +309,58 @@
         "security": []
       }
     },
+    "/access-requests/invite": {
+      "post": {
+        "operationId": "post_access_requests_invite",
+        "tags": [
+          "access-requests"
+        ],
+        "summary": "POST /access-requests/invite",
+        "description": "POST /access-requests/invite — an Archon admits a GitHub username BEFORE any request exists (task 1003044): the only way in on an invite-only project, where the public POST refuses, and a shortcut on an apply one. It writes the same access_request row the sign-in gate reads (status 'invited' — hasInvitedAccessRequest), so nothing new is consulted at sign-in; a pending request for that login is resolved in place rather than duplicated. Two Archons inviting the same login at once can each insert a row (the unique index covers pending only): harmless — the gate reads \"any invited row\" — and it shows as two lines in the invited history, so no lock is taken. body: { github_login }. 201 with a new row; 200 with the row when a pending request was resolved; 200 already_invited when an invite already stands; 409 already_member when they have an account. rank: archon — the same gate as resolving a request.\n\n**Rank:** `archon` — Archon only (rank and identity management + the escalation keys — the trust boundary).\n\n**Permissions:** `access_request.review` (all required).",
+        "x-rank": "archon",
+        "x-source": "modules/onboarding/routes/access-requests.js",
+        "x-permissions": [
+          "access_request.review"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAccessRequestsInviteRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostAccessRequestsInviteResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/access-requests/status": {
       "get": {
         "operationId": "get_access_requests_status",
@@ -8204,6 +8256,79 @@
         ]
       }
     },
+    "/me/profile-nudge": {
+      "get": {
+        "operationId": "get_me_profile_nudge",
+        "tags": [
+          "me"
+        ],
+        "summary": "GET /me/profile-nudge",
+        "description": "The \"Complete your profile\" nudge dismissal (task 1002802 / P06). The nudge itself is a DISMISSIBLE line item in the hall's needs-attention inbox — the replacement for the profile-setup wizard Decision 2 rejected. These two routes own only the dismissal FLAG; whether anything is actually missing is composed by the caller, which already holds both inputs (preferred_disciplines from GET /me, bio from GET /me/cross-project — bio lives on the platform identity account, and this module must never reach across to that one). rank: any-builder — own profile config; same posture as /me/render.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/builder-settings/routes/settings.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_me_profile_nudge",
+        "tags": [
+          "me"
+        ],
+        "summary": "PATCH /me/profile-nudge",
+        "description": "PATCH the dismissal. Body: { dismissed: <bool> | null } — null clears the override so the nudge can come back (the undismiss path). Sibling behavior keys are preserved by applyPatch.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/builder-settings/routes/settings.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "additionalProperties": true
+              }
+            }
+          },
+          "x-validated": false,
+          "x-body-undocumented": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/recent-ships": {
       "get": {
         "operationId": "get_me_recent_ships",
@@ -16562,6 +16687,36 @@
         },
         "additionalProperties": false
       },
+      "PostAccessRequestsInviteRequest": {
+        "type": "object",
+        "properties": {
+          "github_login": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 60
+          }
+        },
+        "required": [
+          "github_login"
+        ],
+        "additionalProperties": false
+      },
+      "PostAccessRequestsInviteResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "already_invited": {
+            "type": "boolean"
+          },
+          "github_login": {},
+          "request": {}
+        },
+        "required": [
+          "ok"
+        ]
+      },
       "PostAccessRequestsRequest": {
         "type": "object",
         "properties": {
@@ -20079,9 +20234,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 318,
-  "x-schema-count": 353,
-  "x-undocumented-bodies": 8,
-  "x-response-schemas": 237,
+  "x-endpoint-count": 321,
+  "x-schema-count": 355,
+  "x-undocumented-bodies": 9,
+  "x-response-schemas": 238,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,18 +2,19 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 318 endpoints across 52 route files.
+> **Generated from the live route files** — the route file is authoritative. 321 endpoints across 52 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
 
-## `access-requests` (4)
+## `access-requests` (5)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/access-requests` | `archon` | — | GET /access-requests?status=pending — Archon queue. |
 | POST | `/api/bongos/access-requests` | `public` | `github_login`, `display_name`, `note` | POST /access-requests — PUBLIC. |
 | PATCH | `/api/bongos/access-requests/:id` | `archon` | `status` | PATCH /access-requests/:id — Archon resolves a request. |
+| POST | `/api/bongos/access-requests/invite` | `archon` | `github_login` | POST /access-requests/invite — an Archon admits a GitHub username BEFORE any request exists (task 1003044): the only way in on an invite-… |
 | GET | `/api/bongos/access-requests/status` | `public` | — | GET /access-requests/status?github_login=X — PUBLIC. |
 
 ## `achievements` (1)
@@ -327,7 +328,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `me` (25)
+## `me` (27)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -347,6 +348,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/me/model-allocation` | `any-builder` | — |  |
 | PATCH | `/api/bongos/me/model-allocation` | `any-builder` | _undocumented_ | PATCH the model allocation. |
 | PATCH | `/api/bongos/me/profile` | `any-builder` | `display_name`, `bio`, `links` | the caller's OWN profile fields (P02, task 1002798; spec Decision 4): bio, typed links, account display name. |
+| GET | `/api/bongos/me/profile-nudge` | `any-builder` | — | The "Complete your profile" nudge dismissal (task 1002802 / P06). |
+| PATCH | `/api/bongos/me/profile-nudge` | `any-builder` | _undocumented_ | PATCH the dismissal. |
 | GET | `/api/bongos/me/recent-ships` | `any-builder` | — | Tasks this builder has shipped, most recent first. |
 | GET | `/api/bongos/me/render` | `any-builder` | — | Per-builder "render widgets" knob (task 1279, shares the behavior_prefs jsonb / migration 119). |
 | PATCH | `/api/bongos/me/render` | `any-builder` | _undocumented_ | PATCH the render knob. |
@@ -587,5 +590,5 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 
 ---
 
-> 8 write endpoint(s) take a JSON body with no declared validator schema — their fields are not yet machine-documented. Adding a `validateOrRespond` schema (`src/bongos/routes/_helpers.js`) surfaces them here automatically.
+> 9 write endpoint(s) take a JSON body with no declared validator schema — their fields are not yet machine-documented. Adding a `validateOrRespond` schema (`src/bongos/routes/_helpers.js`) surfaces them here automatically.