@bongos/core 1.19.411 → 1.19.413

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.411",
-  "core_contract": "1.19.411",
-  "source_commit": "82d0745903a411db2837e92a8f8fac0a25024fbd",
+  "core_version": "1.19.413",
+  "core_contract": "1.19.413",
+  "source_commit": "d76d3df7df9710c0f465ea480821e07f3618ba8a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-28T22:50:38.276Z",
+  "built_at": "2026-08-29T15:10:10.945Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 354,
     "agent_docs_stubbed": 23,
-    "functional_verbatim": 1667,
+    "functional_verbatim": 1669,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2044,
-  "tree_sha256": "60b3e50594b84fae8251421e6d1632b4597d941a99cba38344c43aeb3e4e3fb1",
+  "file_count": 2046,
+  "tree_sha256": "4e0995ef98f294d4511dc8574ae57a362cecd105b934a2a4f5831c3c1527fb0b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -372,7 +372,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "dd6fa5d218cefbb27478836ce57a46eb3ca2b2d1639dbf7349240af75af5e65d"
+      "sha256": "84fce1d4d0fba5b586f1a965a7b4b6818ad7d27e7bbce68818e9def0db85724b"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1527,12 +1527,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "10be85740e8432f8a1979fc356981f3542aa622f4d001de508e7c7f1c129b832"
+      "sha256": "dc283ca75e6aa5b2dcede50879f7c7f7beb151ae953282c917621b4dd6d6b2e1"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "cf98b9af848cd0afc56d713ff39e37840b63d4e1548aa184838514e5eec02a64"
+      "sha256": "4ae66f6126c2148d61f4bdbdcc7d06ca8966f2747f34e4b243f348545ce4e3aa"
     },
     {
       "path": "docs/architecture.md",
@@ -1557,12 +1557,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "9190ff246dbc8abad78c67e603417e0dc46016f32f45406ba5cdc7904d863658"
+      "sha256": "0935ecff01e0e750f9120947b227663f61510661c411cf96c99415c96fb99275"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "9b85ab135b2fc5078dc5ec3d633d84a7700bfd45a6717844ee3475d3602a2282"
+      "sha256": "13447cec279cbe55c95346a67eeaacf9a349e472988cd40023015b042f9047cf"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -1867,7 +1867,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2da385cc79958922b0714f47a7f2c58535cd0e9db516924a6bb61f8ce01e1142"
+      "sha256": "ad1eb5201b24398e4609ff25d687069da2ba6f312dac48e1b287712cde0c8fe6"
     },
     {
       "path": "docs/modules-contract.md",
@@ -4102,12 +4102,12 @@
     {
       "path": "modules/hall-ui/public/settings.html",
       "mode": "0000644",
-      "sha256": "ae68a26d5d37ac75968ac11335b7062a448798cb3af0e0a4f81963f3382f204d"
+      "sha256": "852ce177610c5bc49145333b157700d8c3566565d106dcf26c476d32b7105609"
     },
     {
       "path": "modules/hall-ui/public/settings.js",
       "mode": "0000644",
-      "sha256": "2b69d258218e92b9fe2922496632e43d4bdb81f641f09469f5f6df85494a9fca"
+      "sha256": "5e4e3a6ab492d6b6fae46ad5dbd896213825bfc79f8f3928836af609953a5fb0"
     },
     {
       "path": "modules/hall-ui/public/shell.js",
@@ -4769,6 +4769,11 @@
       "mode": "0000644",
       "sha256": "18e3641beba26d8a515616ba9bdb1bcc83151e620d6e038243d7d67850da3be8"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_012_account_privacy.sql",
+      "mode": "0000644",
+      "sha256": "cb1d96a64d952e2f4e043e805264ab813505571e1cb93d1afde337987f00b482"
+    },
     {
       "path": "modules/platform-identity/migrations/platform_identity_012_project_template.sql",
       "mode": "0000644",
@@ -4787,7 +4792,7 @@
     {
       "path": "modules/platform-identity/platform-identity.js",
       "mode": "0000644",
-      "sha256": "ca7996877566727335979bf55fc6157ae130be9c54cdbf0210d3b906a3ac5f53"
+      "sha256": "b3a8ecce278904a12caa0fbebbcabd3cd122aab6753e026b1b5719547497302d"
     },
     {
       "path": "modules/platform-identity/pollers/code-sweep.js",
@@ -4807,7 +4812,7 @@
     {
       "path": "modules/platform-identity/routes/profile.js",
       "mode": "0000644",
-      "sha256": "2e158331e7cae0535ae81d63b6b7e8d471330c0f3d732f7e3092e45ad8255916"
+      "sha256": "209763cf313bb58f7237cda9c84f3cb5ed35db8f95d66b55dfa3f15e5da1ecdf"
     },
     {
       "path": "modules/platform-identity/routes/projects.js",
@@ -5367,12 +5372,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e1ac444053590084d84aa27194b817d8e7f649ef172b63a2b0d6a4a5b51b83d0"
+      "sha256": "b4a7232c717443506a820d17ca00363221141d7494259f9f6b1a676a474c32ee"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "bfea05054d8eb816a33710f43d4b078238ef470615c5768645ee0d30aa547a0c"
+      "sha256": "7c01dfae62c1038f19d70b09c7007f41abf4c18e17db201f2cd20011d65f938c"
     },
     {
       "path": "public-docs/index.html",
@@ -7387,7 +7392,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "06547b5cc63cc9ed1f50e49738d437beb1ffa8bf2ca81e396a4a0a795864a7f1"
+      "sha256": "bf76bacb85922bac8e5c23a51a50535143cd7c6e2fbebad35cabd21913f43881"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7439,6 +7444,11 @@
       "mode": "0000644",
       "sha256": "4d8435e7f8b949715ee40843beddc1868105edd9c67b269cfa8f510a192e9212"
     },
+    {
+      "path": "tests/account_privacy_flags.mjs",
+      "mode": "0000644",
+      "sha256": "274e07580eb23b111fb26e097a85f618cf33b0467a9a2a325cfbdd910a33fab1"
+    },
     {
       "path": "tests/achievements_reconcile.mjs",
       "mode": "0000644",
@@ -9382,7 +9392,7 @@
     {
       "path": "tests/profile_route.mjs",
       "mode": "0000644",
-      "sha256": "3b3045a6143d67c963516ed5703b5dabb9b8945a392118721e6a0a56258f1732"
+      "sha256": "5af720ee7c18d4b47630fbbed7cb08901acfbf773960699e312496b8196c9fdc"
     },
     {
       "path": "tests/profile_ui_cross_project.mjs",

package/clients/bongos-client/index.d.ts

@@ -64,7 +64,7 @@ export interface GetInboxTemplateResponse { template: unknown }
 export interface GetLeaderboardResponse { leaderboard: unknown; page: unknown }
 export interface GetLearningsResponse { learnings: unknown }
 export interface GetMeAchievementsResponse { unlocked: unknown }
-export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; handle: unknown; display_name: unknown; bio: unknown; links: unknown; cross_project: unknown }
+export interface GetMeCrossProjectResponse { hide_stats: boolean; profile_state: unknown; handle: unknown; display_name: unknown; bio: unknown; links: unknown; cross_project: unknown; account_visibility: unknown; recruiter_discoverable: unknown; recruiter_discoverable_effective: unknown }
 export interface GetMeDisplayNameResponse { display_name: unknown; max_length: unknown }
 export interface GetMeEventSoundPrefsResponse { prefs: unknown; effective: unknown; effective_wav: unknown; events: unknown }
 export interface GetMeRecentShipsResponse { ships: unknown }
@@ -147,8 +147,8 @@ export interface PatchInboxIdBodyRequest { body_md: string }
 export interface PatchInboxIdBodyResponse { ok: boolean; idea: unknown; delta: unknown; unchanged: unknown }
 export interface PatchInboxIdRequest { status?: "open" | "promoted" | "discarded" | "merged"; kind?: string; promoted_to_task_id?: number; reviewed_at?: unknown; merged_into_idea_id?: number; triage_note?: string }
 export interface PatchInboxIdResponse { idea: unknown }
-export interface PatchMeCrossProjectRequest { hide_stats: boolean }
-export interface PatchMeCrossProjectResponse { hide_stats: boolean }
+export interface PatchMeCrossProjectRequest { hide_stats?: boolean; account_visibility?: string; recruiter_discoverable?: boolean }
+export interface PatchMeCrossProjectResponse { hide_stats: boolean; account_visibility: unknown; recruiter_discoverable: unknown; recruiter_discoverable_effective: unknown }
 export interface PatchMeDisciplinesRequest { preferred_disciplines: string[] }
 export interface PatchMeDisciplinesResponse { builder: unknown; onboarding: unknown }
 export interface PatchMeDisplayNameResponse { display_name: unknown; max_length: unknown }
@@ -784,7 +784,7 @@ export interface BongosClient {
     /** GET /me/cross-project — rank: any-builder */
     getMeCrossProject(args?: RequestArgs): Promise<GetMeCrossProjectResponse>;
     /** PATCH /me/cross-project — rank: any-builder */
-    patchMeCrossProject(args: RequestArgs & { body: PatchMeCrossProjectRequest }): Promise<PatchMeCrossProjectResponse>;
+    patchMeCrossProject(args?: RequestArgs & { body?: PatchMeCrossProjectRequest }): Promise<PatchMeCrossProjectResponse>;
     /** PATCH /me/disciplines — rank: any-builder */
     patchMeDisciplines(args: RequestArgs & { body: PatchMeDisciplinesRequest }): Promise<PatchMeDisciplinesResponse>;
     /** GET /me/display-name — rank: any-builder */

package/docs/api/openapi.json

@@ -7959,7 +7959,7 @@
           "me"
         ],
         "summary": "GET /me/cross-project",
-        "description": "the caller's OWN cross-project record + hide flag (own data).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "the caller's OWN cross-project record + privacy flags (own data).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/platform-identity/routes/profile.js",
         "responses": {
@@ -7995,11 +7995,11 @@
           "me"
         ],
         "summary": "PATCH /me/cross-project",
-        "description": "flip the caller's OWN hide flag (C2's self-serve opt-out; own data, keyed on the authenticated github_id).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "flip the caller's OWN privacy flags (C2's self-serve opt-out plus the task-1002966 pair; own data, keyed on the authenticated github_id — a builder can never name another account here). Every field is optional and at least one is required, so a client sends only what changed; recruiter_discoverable accepts an explicit null (reset to \"follow visibility\"), which is why it is checked with `in` rather than truthiness.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/platform-identity/routes/profile.js",
         "requestBody": {
-          "required": true,
+          "required": false,
           "content": {
             "application/json": {
               "schema": {
@@ -15648,7 +15648,10 @@
           "display_name": {},
           "bio": {},
           "links": {},
-          "cross_project": {}
+          "cross_project": {},
+          "account_visibility": {},
+          "recruiter_discoverable": {},
+          "recruiter_discoverable_effective": {}
         },
         "required": [
           "hide_stats",
@@ -15657,7 +15660,10 @@
           "display_name",
           "bio",
           "links",
-          "cross_project"
+          "cross_project",
+          "account_visibility",
+          "recruiter_discoverable",
+          "recruiter_discoverable_effective"
         ]
       },
       "GetMeDisplayNameResponse": {
@@ -16754,11 +16760,14 @@
         "properties": {
           "hide_stats": {
             "type": "boolean"
+          },
+          "account_visibility": {
+            "type": "string"
+          },
+          "recruiter_discoverable": {
+            "type": "boolean"
           }
         },
-        "required": [
-          "hide_stats"
-        ],
         "additionalProperties": false
       },
       "PatchMeCrossProjectResponse": {
@@ -16766,10 +16775,16 @@
         "properties": {
           "hide_stats": {
             "type": "boolean"
-          }
+          },
+          "account_visibility": {},
+          "recruiter_discoverable": {},
+          "recruiter_discoverable_effective": {}
         },
         "required": [
-          "hide_stats"
+          "hide_stats",
+          "account_visibility",
+          "recruiter_discoverable",
+          "recruiter_discoverable_effective"
         ]
       },
       "PatchMeDisciplinesRequest": {

package/docs/api-reference.md

@@ -340,8 +340,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/me` | `any-builder` | — | PMS-V2 task 188: response now also carries `unlocked` (server-joined achievement metadata) + `locked_with_progress` (server-computed huma… |
 | GET | `/api/bongos/me/achievements` | `any-builder` | — | The builder's unlocked achievements (joined to achievement metadata). |
 | POST | `/api/bongos/me/anthropic-link` | `any-builder` | `anthropic_email`, `anthropic_user_id` | V3.R10 (task 235), criterion C3 — link the authed builder's Anthropic account. |
-| GET | `/api/bongos/me/cross-project` | `any-builder` | — | the caller's OWN cross-project record + hide flag (own data). |
-| PATCH | `/api/bongos/me/cross-project` | `any-builder` | `hide_stats` | flip the caller's OWN hide flag (C2's self-serve opt-out; own data, keyed on the authenticated github_id). |
+| GET | `/api/bongos/me/cross-project` | `any-builder` | — | the caller's OWN cross-project record + privacy flags (own data). |
+| PATCH | `/api/bongos/me/cross-project` | `any-builder` | `hide_stats`, `account_visibility`, `recruiter_discoverable` | flip the caller's OWN privacy flags (C2's self-serve opt-out plus the task-1002966 pair; own data, keyed on the authenticated github_id —… |
 | PATCH | `/api/bongos/me/disciplines` | `any-builder` | `preferred_disciplines` | Self-service edit of the authenticated builder's preferred disciplines (migrations 027 + 086 / V3.R80). |
 | GET | `/api/bongos/me/display-name` | `any-builder` | — | Per-builder DISPLAY NAME (task 1669). |
 | PATCH | `/api/bongos/me/display-name` | `any-builder` | _undocumented_ | PATCH the display name. |