@bongos/core 1.19.381 → 1.19.382

package/modules/lifecycle/lifecycle.js

@@ -20,6 +20,7 @@ const db = require('./db');
 const classifier = require('./task-classifier');
 const helpRequests = require('./help-requests');
 const taskRecommendations = require('./task-recommendations');
+const activity = require('./activity');
 
 module.exports = {
   // --- retired doorway leaks (ADR 0093 §3) ---------------------------------
@@ -58,6 +59,12 @@ module.exports = {
   recentGradesForBuilder: (...a) => db.recentGradesForBuilder(...a),
   countShippedTasksForBuilder: (...a) => db.countShippedTasksForBuilder(...a),
   recentShippedTasksByBuilder: (...a) => db.recentShippedTasksByBuilder(...a),
+  // builders.js (the profile's per-craft activity log, task 1003281): the paged
+  // "what did I do as an engineer / an artist" reads. Separate from the two
+  // above because those answer "how much, in total" and these answer "what,
+  // by craft" — the axis criterion legibility-activity-by-role asks for.
+  activityTasksByBuilder: (...a) => activity.activityTasksByBuilder(...a),
+  activityGoalsByBuilder: (...a) => activity.activityGoalsByBuilder(...a),
   // ADR 0120 part 5: the confirmed tasks a builder owes a rebase on — the same
   // read the part-3 claim gate uses, surfaced to me.js so the CLI + hall can
   // show the owed-rebase warning that gates new claims (reward lands on ship).

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.381",
+  "version": "1.19.382",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.381",
+      "version": "1.19.382",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.381",
+  "version": "1.19.382",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/hall-preview/server.js

@@ -82,6 +82,11 @@ const FIXTURE_FALLBACKS = [
   [/^analytics\/builder\/\d+$/, 'analytics__builder'],
   [/^builders\/\d+\/active-claims$/, 'builders__active-claims'],
   [/^builders\/\d+\/profile$/, 'builders__profile'],
+  // the profile's per-craft activity log (task 1003281). One fixture per SECTION
+  // rather than per id, because the section is what changes the row shape; the
+  // craft and the page window are query string, which fixture matching ignores.
+  [/^builders\/\d+\/activity$/, (q) => (q.section === 'goals' ? 'builders__activity-goals' : 'builders__activity-tasks')],
+  [/^inbox\/by-builder\/\d+$/, 'inbox__by-builder'],
 ];
 
 function loadFixture(name) {
@@ -102,12 +107,17 @@ function emptied(v) {
   return v;
 }
 
-function fixtureFor(apiPath) {
+// A fallback name may be a plain string or a function of the query — the one
+// case that needs it (task 1003281) is the profile activity log, where the ROW
+// SHAPE is chosen by ?section=, not by the path, so one fixture per path would
+// render goal rows into the tasks ledger.
+function fixtureFor(apiPath, query = {}) {
   const exact = loadFixture(apiPath.replace(/\//g, '__'));
   if (exact !== undefined) return exact;
   for (const [re, name] of FIXTURE_FALLBACKS) {
     if (re.test(apiPath)) {
-      const hit = loadFixture(name);
+      const resolved = typeof name === 'function' ? name(query) : name;
+      const hit = resolved && loadFixture(resolved);
       if (hit !== undefined) return hit;
     }
   }
@@ -141,7 +151,7 @@ app.use((req, res, next) => {
   if (req.method !== 'GET') {
     return res.status(501).json({ error: { code: 'preview_readonly', message: 'the preview harness serves fixtures; writes are not wired' } });
   }
-  const fix = fixtureFor(apiPath);
+  const fix = fixtureFor(apiPath, req.query || {});
   if (fix === undefined) {
     console.log(`  no fixture: ${apiPath}  (add scripts/hall-preview/fixtures/${apiPath.replace(/\//g, '__')}.json)`);
     return res.status(404).json({ error: { code: 'no_fixture', message: apiPath } });

package/src/bongos/routes/builders.js

@@ -545,6 +545,73 @@ module.exports = function buildBuildersRouter() {
     }
   });
 
+  // GET /builders/:id/activity — the profile's PER-CRAFT activity log (task
+  // 1003281, goal 1000072, criterion legibility-activity-by-role).
+  //
+  // WHAT IT ADDS OVER /profile. The profile answers "how much has this person
+  // shipped" — one count and the last five works, craft-blind. A person's artist
+  // track record is a different question from their engineer one, so this route
+  // serves ONE section (`tasks` or `goals`) for ONE craft, paged. It EXTENDS the
+  // profile surface rather than forking it: the page is the same page, the
+  // identity band and the achievement shelf are unchanged, and this fills the
+  // ledger below them. The third section of that log — the IDEA TRAIL — is
+  // served by the ideas module's GET /inbox/by-builder/:id, because an idea is
+  // its domain's row, not a lifecycle one.
+  //
+  // ONE SECTION PER CALL, not all three in one payload: each ledger pages
+  // independently, and a single response carrying three page windows would need
+  // three limit/offset pairs on one query string to say anything at all.
+  //
+  // rank: any-builder, NOT owner-only — a track record is a thing other people
+  // read; that is what makes the profile a portfolio rather than a dashboard, and
+  // it is the same posture /profile, /builders/roster and the leaderboard already
+  // take toward the same rows. The per-viewer filtering that DOES matter is the
+  // private-goal wall below, and it is applied to the DATA, not to the caller.
+  //
+  // But, unlike /profile directly above, this read IS gated to a sign-in.
+  // The goals half is viewer-dependent: a private goal's title is exactly what
+  // ADR 0112 says a non-member must not learn, so the read needs to know who is
+  // asking. Serving it publicly would mean either leaking private goals or
+  // silently omitting the viewer's own — both worse than a sign-in. The tasks
+  // half is the same already-public shipped-work data /profile returns.
+  router.get('/builders/:id/activity', auth.requireBuilder, async (req, res) => {
+    const targetId = parseId(req, res, { code: 'bad_builder_id', positiveInt: true });
+    if (targetId === null) return;
+    const section = req.query.section === 'goals' ? 'goals' : 'tasks';
+    // An unknown craft is normalized to "no filter" inside the module read
+    // rather than 400ing here — a stale bookmark should show the whole record,
+    // not an error card in the middle of a profile.
+    const role = typeof req.query.role === 'string' && req.query.role ? req.query.role : null;
+    const limit = Number(req.query.limit);
+    const offset = Number(req.query.offset);
+    try {
+      const b = await db.getBuilderById(targetId);
+      if (!b) return res.fail('builder_not_found', 404);
+      const viewer = req.builder || {};
+      const out = section === 'goals'
+        ? await lc().activityGoalsByBuilder(targetId, {
+          role,
+          viewerId: viewer.id ?? null,
+          viewerIsArchon: viewer.rank === 'archon',
+          limit,
+          offset,
+        })
+        : await lc().activityTasksByBuilder(targetId, { role, limit, offset });
+      // Viewer-dependent (the goals half) and cheap to recompute — never cached.
+      res.set('Cache-Control', 'no-store');
+      res.json({
+        builder_id: targetId,
+        section,
+        role: role || null,
+        rows: out.rows,
+        total: out.total,
+      });
+    } catch (err) {
+      log.error('[gds] GET /builders/:id/activity', err);
+      res.fail('activity_read_failed', { status: 500, message: 'internal error' });
+    }
+  });
+
   // GET /builders/me/pending-rank-change — V3.R28 / #249 ceremony signal #3.
   //
   // Returns the calling builder's most recent rank-change credit_log row, or

package/src/module-api.js

@@ -1202,8 +1202,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.379 with no explicit bump. run 33085516721. (task 1002620)
 //   1.19.381 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.380 with no explicit bump. run 33088290961. (task 1002620)
+//   1.19.382 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.381 with no explicit bump. run 33094545251. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.381'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.382'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');