@bongos/core 1.19.426 → 1.19.427

package/modules/hall-ui/public/profile-connections.js

@@ -0,0 +1,304 @@
+// modules/hall-ui/public/profile-connections.js — section 6 of the builder
+// profile page: connections, degree labels, and the connect button (R20,
+// task 1002296 / goal 1000045 criterion C6; ADR 0202, ADR 0207).
+//
+// WHAT IT RENDERS, and to whom:
+//   * on YOUR OWN profile — the pending requests in both directions (incoming
+//     ones you Accept or Decline, outgoing ones you Withdraw) and your accepted
+//     connections, each 1st degree by definition, each removable.
+//   * on ANOTHER builder's profile — the viewer-relative degree label, the
+//     mutual connections it was computed from, and the connect affordance.
+//
+// HUB-ONLY, AND IT DEGRADES TO NOTHING. Connections are account-to-account on
+// the platform hub (modules/platform-identity); on an instance without that
+// module every route here is absent, every call 404s, and the section never
+// reveals — the same "reveal only when the data is there" contract the
+// cross-project section already keeps on this page.
+//
+// FOUR THINGS THIS FILE MUST NOT DO. Each is a privacy decision the API made
+// deliberately, and the UI is the last place it can be undone:
+//
+//   1. `degree: null` is OUT OF NETWORK, never "not connected" (ADR 0202
+//      Consequences). Past the fan-out caps or past three hops the API stops
+//      searching and says so honestly; rendering that as the absence of a
+//      relationship states something the query never established.
+//   2. The uncertainty copy beside an out-of-network label is CONSTANT. The
+//      API's `truncated` describes the VIEWER's own expansion; the target's
+//      1-hop truncation is deliberately unreported (ADR 0207 L2) because
+//      reporting it leaks a bit about a third party's degree. Copy that varied
+//      with `truncated` would rebuild that side channel in words.
+//   3. A sent request claims exactly `201 { status: 'pending' }` and nothing
+//      more (ADR 0207 D6) — no id, no timestamp, no "they will be notified",
+//      and no remark when a re-ask inside the 90-day decline cooldown is
+//      silently swallowed (ADR 0207 L1). "Request sent" is the whole claim.
+//   4. `seen_at` never reaches the screen. It was stripped from outgoing rows
+//      so a requester cannot learn when their request was read; rendering it on
+//      the incoming side re-creates that signal the moment a screenshot passes
+//      between the two people.
+//
+// COUNTS ARE ARRAY LENGTHS. Every number here is the length of the list the
+// viewer was actually handed — never a total carried beside a filtered list,
+// which is a leak by subtraction (ADR 0171 D4 / ADR 0202 D4).
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016): a connection grants no rank, no credits
+// and no admission. Nothing rendered here is rollup-derived either, which is
+// why `hide_stats` does not suppress it — hiding your stats hides the numbers
+// beside an edge, not the edge itself (ADR 0202 D4 §3).
+//
+// ADDRESSING. The connections API names a counterparty by HANDLE; this page
+// knows only a builder's github_login. It hands that login to
+// GET /connections/degree/:handle, which resolves the current handle or the
+// single previous-handle rename slot and echoes the CANONICAL handle back —
+// and that echoed handle, never the login, is what every write here sends. A
+// login resolving to neither answers 404 and the section stays hidden, the same
+// fail-closed answer a private or provisional account gets. The handle-addressed
+// hub page (/u/<handle>) will not need this hop at all.
+
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml, $, fmtDate } = window.OTB;
+  const toast = (msg) => window.OTB.toast(msg, { duration: 2600, clear: true });
+
+  // The only degrees that have a name. Anything else — null, or a number the
+  // API never promised — falls through to "out of network" rather than being
+  // invented a label (note 1 above).
+  const DEGREE_SHORT = { 0: 'You', 1: '1st', 2: '2nd', 3: '3rd' };
+  const DEGREE_LINE = {
+    0: 'This is your own profile.',
+    1: 'You are connected.',
+    2: 'You know someone they know.',
+    3: 'Three connections away in your network.',
+  };
+  const OUT_OF_NETWORK = 'Out of network';
+  // CONSTANT by decision — it must read the same whether or not the response
+  // said `truncated` (note 2 above).
+  const OUT_OF_NETWORK_WHY = 'No path to this builder through the connections you can see. '
+    + 'There may be none, or it may run through someone whose account is not visible to you.';
+  // The whole claim a 201 supports, in markup, used by both the first render
+  // and the click that earns it.
+  const SENT_HTML = '<p class="conn-act"><button class="btn-ghost" type="button" disabled>Request sent</button></p>';
+
+  const known = (degree) => Object.prototype.hasOwnProperty.call(DEGREE_SHORT, degree);
+  const arr = (v) => (Array.isArray(v) ? v : []);
+  const plural = (n, word) => `${n} ${word}${n === 1 ? '' : 's'}`;
+
+  // The last render's inputs, so an accept/decline/remove can repaint the
+  // section from the server rather than patching the DOM it just changed.
+  let last = null;
+
+  // ---- shared cells ---------------------------------------------------------
+
+  // One counterparty, rendered from the only three columns the API projects
+  // for one (handle, display_name, avatar_url) — nothing rollup-derived, so
+  // there is nothing here for hide_stats to suppress.
+  function personHtml(row) {
+    const name = escapeHtml(row.display_name || row.handle || 'Builder');
+    const avatar = row.avatar_url
+      ? `<img class="conn-person__avatar" src="${escapeHtml(row.avatar_url)}" alt="">`
+      : '<span class="conn-person__avatar" aria-hidden="true"></span>';
+    const handle = row.handle ? `<span class="conn-person__handle">@${escapeHtml(row.handle)}</span>` : '';
+    return `<span class="conn-person">${avatar}<span class="conn-person__name">${name}</span>${handle}</span>`;
+  }
+
+  function btn(act, id, label) {
+    return `<button class="btn-ghost" type="button" data-act="${escapeHtml(act)}" data-id="${escapeHtml(id)}">${escapeHtml(label)}</button>`;
+  }
+
+  // ---- your own profile -----------------------------------------------------
+
+  // Every row is an accepted connection of yours, so its degree is 1 by
+  // definition — no per-row query, and no chance of a fan-out cap making the
+  // label wrong (ADR 0207 D2: a cap may make an answer less specific, never
+  // wrong). `connected_at` is the edge's own timestamp, not a rollup number.
+  function connectionRow(row) {
+    return `<tr>
+      <td>${personHtml(row)}</td>
+      <td><span class="conn-degree conn-degree--1">1st</span></td>
+      <td class="ledger__date">${row.connected_at ? escapeHtml(fmtDate(row.connected_at)) : '—'}</td>
+      <td>${btn('remove', row.id, 'Remove')}</td>
+    </tr>`;
+  }
+
+  function requestsHtml(incoming, outgoing) {
+    const inbox = incoming.map((r) => `<li class="conn-req">${personHtml(r)}`
+      + (r.note ? `<p class="conn-req__note">${escapeHtml(r.note)}</p>` : '')
+      + `<span class="conn-req__acts">${btn('accept', r.id, 'Accept')}${btn('decline', r.id, 'Decline')}</span></li>`).join('');
+    const outbox = outgoing.map((r) => `<li class="conn-req">${personHtml(r)}`
+      + '<span class="conn-req__state">Request sent</span>'
+      + `<span class="conn-req__acts">${btn('withdraw', r.id, 'Withdraw')}</span></li>`).join('');
+    return (incoming.length ? `<h3 class="conn-sub">${escapeHtml(plural(incoming.length, 'builder'))} asking to connect</h3><ul class="conn-reqs">${inbox}</ul>` : '')
+      + (outgoing.length ? `<h3 class="conn-sub">${escapeHtml(plural(outgoing.length, 'request'))} you have sent</h3><ul class="conn-reqs">${outbox}</ul>` : '');
+  }
+
+  // Your own connections + both request queues. Returns false when the hub
+  // routes are absent or the session is gone, so the caller leaves the section
+  // hidden rather than rendering an empty shell.
+  async function renderOwn(body) {
+    const [list, reqs] = await Promise.all([
+      api.request('GET', `${API}/connections`),
+      api.request('GET', `${API}/connections/requests`),
+    ]);
+    if (!list.ok || !reqs.ok) return false;
+    const connections = arr(list.data && list.data.connections);
+    const incoming = arr(reqs.data && reqs.data.incoming);
+    const outgoing = arr(reqs.data && reqs.data.outgoing);
+    body.innerHTML = requestsHtml(incoming, outgoing)
+      + `<p class="scroll__lede">${escapeHtml(plural(connections.length, 'connection'))}.</p>`
+      + '<div id="conn-ledger"></div>';
+    const mount = $('#conn-ledger');
+    if (mount) {
+      const pager = window.OTBKit.makePager('conn', 'profile.connections.perPage');
+      window.OTBKit.makeLedger({
+        mount,
+        columns: ['Builder', 'Degree', { label: 'Connected', class: 'ledger__date' }, ''],
+        rowHtml: connectionRow,
+        emptyMsg: 'No connections yet.',
+        pager,
+      }).render(connections);
+    }
+    return true;
+  }
+
+  // ---- someone else's profile -----------------------------------------------
+
+  function degreeHtml(degree, mutuals) {
+    const chip = `<span class="conn-degree conn-degree--${known(degree) ? degree : 'out'}">`
+      + `${escapeHtml(known(degree) ? DEGREE_SHORT[degree] : OUT_OF_NETWORK)}</span>`;
+    const line = known(degree) ? DEGREE_LINE[degree] : OUT_OF_NETWORK_WHY;
+    // The count is the length of the names beside it — never a total the
+    // response carried, which would disclose a filtered mutual by subtraction.
+    const mutual = mutuals.length
+      ? `<p class="scroll__lede">${escapeHtml(plural(mutuals.length, 'connection'))} in common: `
+        + `${mutuals.map((m) => escapeHtml(`@${m.handle || 'unknown'}`)).join(', ')}</p>`
+      : '';
+    return `<p class="conn-degree-line">${chip} ${escapeHtml(line)}</p>${mutual}`;
+  }
+
+  // Which pending request, if any, already stands with this handle — read from
+  // the caller's OWN inbox and outbox, the only place the API says anything
+  // about one. An empty outbox is not evidence a request was refused: a re-ask
+  // inside the decline cooldown writes nothing (ADR 0207 L1), so absence means
+  // "nothing is pending" and the UI draws no further conclusion from it.
+  async function pendingWith(handle) {
+    const res = await api.request('GET', `${API}/connections/requests`);
+    if (!res.ok) return null;
+    const same = (r) => r && typeof r.handle === 'string' && r.handle.toLowerCase() === handle.toLowerCase();
+    const incoming = arr(res.data && res.data.incoming).find(same);
+    if (incoming) return { dir: 'incoming', id: incoming.id };
+    const outgoing = arr(res.data && res.data.outgoing).find(same);
+    return outgoing ? { dir: 'outgoing', id: outgoing.id } : null;
+  }
+
+  function actionHtml(degree, handle, pending) {
+    if (degree === 0) return ''; // your own account reached by ?id= — nothing to ask
+    if (degree === 1) return '<p class="conn-act"><span class="conn-state">Connected</span></p>';
+    if (pending && pending.dir === 'incoming') {
+      return '<p class="conn-act"><span class="conn-state">They have asked to connect.</span>'
+        + `${btn('accept', pending.id, 'Accept')}${btn('decline', pending.id, 'Decline')}</p>`;
+    }
+    if (pending && pending.dir === 'outgoing') return SENT_HTML;
+    return `<p class="conn-act"><button class="btn-ghost" type="button" data-act="connect" data-handle="${escapeHtml(handle)}">Connect</button></p>`;
+  }
+
+  // The viewer-relative view. A 404 here is the deliberately indistinguishable
+  // set — unknown handle, provisional account, private stranger — and all of
+  // them mean the same thing to this page: there is nothing to offer, so the
+  // section stays hidden and no connect button is drawn.
+  async function renderOther(body, login) {
+    if (!login) return false;
+    const res = await api.request('GET', `${API}/connections/degree/${encodeURIComponent(login)}`);
+    if (res.status === 403) {
+      // About the VIEWER, not the target: their own account has not been
+      // activated at the hub yet, so they cannot take part at all.
+      body.innerHTML = '<p class="scroll__lede">Sign in to the platform once to activate your profile before connecting.</p>';
+      return true;
+    }
+    if (!res.ok) return false;
+    const data = res.data || {};
+    const handle = typeof data.handle === 'string' ? data.handle : null;
+    if (!handle) return false;
+    const mutuals = arr(data.mutuals);
+    body.innerHTML = degreeHtml(data.degree, mutuals) + actionHtml(data.degree, handle, await pendingWith(handle));
+    return true;
+  }
+
+  // ---- actions --------------------------------------------------------------
+
+  async function connect(handle) {
+    const res = await api.request('POST', `${API}/connections`, { body: { handle } });
+    // 201 { status: 'pending' } is byte-identical for a request that was written
+    // and one swallowed by the cooldown. "Request sent" claims exactly that.
+    if (res.status === 201) return { html: SENT_HTML, message: 'Request sent.' };
+    if (res.status === 409) return { message: 'There is already a request or a connection between you.' };
+    if (res.status === 403) return { message: 'Activate your platform profile before connecting.' };
+    // 404 is absent / provisional / private, indistinguishable on purpose.
+    if (res.status === 404) return { message: 'That builder cannot be connected with right now.' };
+    return { message: 'Could not send the request.' };
+  }
+
+  const ROW_ACTIONS = {
+    accept: { call: (id) => api.request('POST', `${API}/connections/${encodeURIComponent(id)}/accept`), message: 'Connected.' },
+    decline: { call: (id) => api.request('POST', `${API}/connections/${encodeURIComponent(id)}/decline`), message: 'Declined.' },
+    remove: { call: (id) => api.request('DELETE', `${API}/connections/${encodeURIComponent(id)}`), message: 'Connection removed.' },
+    withdraw: { call: (id) => api.request('DELETE', `${API}/connections/${encodeURIComponent(id)}`), message: 'Request withdrawn.' },
+  };
+
+  async function onClick(ev) {
+    const el = ev.target && ev.target.closest ? ev.target.closest('button[data-act]') : null;
+    if (!el) return;
+    const act = el.dataset.act;
+    el.disabled = true;
+    try {
+      if (act === 'connect') {
+        const out = await connect(el.dataset.handle);
+        // Replace only the action line: a 201 tells us nothing about the rest
+        // of the page, so nothing else is restated.
+        if (out.html) { const body = $('#conn-body'); if (body) body.innerHTML = body.innerHTML.replace(/<p class="conn-act">[\s\S]*?<\/p>/, out.html); }
+        toast(out.message);
+        return;
+      }
+      const spec = ROW_ACTIONS[act];
+      if (!spec) return;
+      const res = await spec.call(el.dataset.id);
+      if (!res.ok && res.status !== 204) { toast('That request is no longer available.'); }
+      else toast(spec.message);
+      if (last) await render(last.data, last.selfId);
+    } catch (err) {
+      console.error('[profile-connections] action failed', err);
+      toast('Something went wrong. Try again.');
+    } finally {
+      el.disabled = false;
+    }
+  }
+
+  // ---- entry ----------------------------------------------------------------
+
+  // Called by profile.js once the profile response has landed. Reveals the
+  // section only when the hub answered with something to show; any other
+  // outcome — module absent, signed out, target not addressable — leaves the
+  // markup's `hidden` in place.
+  async function render(data, selfId) {
+    const section = $('#conn-scroll');
+    const body = $('#conn-body');
+    if (!section || !body) return;
+    last = { data, selfId };
+    const builder = (data && data.builder) || {};
+    const isSelf = selfId != null && String(builder.id) === String(selfId);
+    try {
+      const shown = isSelf ? await renderOwn(body) : await renderOther(body, builder.github_login);
+      section.hidden = !shown;
+      if (shown && body.addEventListener && !body.dataset.connWired) {
+        body.dataset.connWired = '1';
+        body.addEventListener('click', onClick);
+      }
+    } catch (err) {
+      console.error('[profile-connections] failed to load', err);
+      section.hidden = true;
+    }
+  }
+
+  window.OTBConnections = { render };
+})();

package/modules/hall-ui/public/profile.html

@@ -107,9 +107,20 @@
           </div>
         </section>
 
+        <!-- Connections — section 6 of the profile-page spec (R20, task
+             1002296; ADR 0202). Hub-only, like the cross-project record:
+             profile-connections.js reveals it only when the hub's connections
+             API answers, so on an instance without platform-identity the
+             routes are absent and the section never renders. -->
+        <section class="scroll" id="conn-scroll" aria-labelledby="conn-h" hidden>
+          <h2 id="conn-h" class="scroll__h">Connections</h2>
+          <div id="conn-body"></div>
+        </section>
+
         <!-- Reserved slots — connections, guilds, and actions (profile-page
              spec sections 6–8) mount here in later phases; keeping the order
-             fixed now means the page is not re-laid-out twice (Decision 5). -->
+             fixed now means the page is not re-laid-out twice (Decision 5).
+             Section 6 landed above (task 1002296); 7 and 8 are still to come. -->
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>
@@ -130,6 +141,10 @@
 <!-- hall-kit (window.OTBKit) — profile.js renders ship-time task visuals through
      its shared thumbnail helper (task 1003109), so it must load first. -->
 <script src="/builders/hall-kit.js?v=2026-08-27-activity"></script>
+<!-- Connections (section 6). Loaded BEFORE profile.js so window.OTBConnections
+     exists by the time renderProfile runs; profile.js guards on it anyway, so a
+     page that omits this script simply has no connections section. -->
+<script src="/builders/profile-connections.js?v=2026-08-29-r20"></script>
 <script src="/builders/profile.js?v=2026-08-27-activity"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -534,6 +534,10 @@
     // The activity log needs a session (private goals + the idea trail), so it
     // keys off whether /me resolved — the same signal the self-detect uses.
     renderActivity(builder.id, selfId != null);
+    // Connections (section 6, task 1002296) — a separate hub-only script that
+    // reveals its own section or leaves it hidden. Optional by design: a page
+    // that does not load it simply has no connections section.
+    if (window.OTBConnections) window.OTBConnections.render(data, selfId);
   }
 
   // Render the friendly "no builder chosen" empty state for a signed-out visitor
@@ -557,6 +561,7 @@
     const worksLede = $('#works-lede'); if (worksLede) worksLede.hidden = true;
     const xp = $('#xp-scroll'); if (xp) xp.hidden = true;
     const act = $('#activity-scroll'); if (act) act.hidden = true;
+    const conn = $('#conn-scroll'); if (conn) conn.hidden = true;
   }
 
   async function fetchProfile(id, selfId) {

package/modules/hall-ui/public/style.css

@@ -1107,6 +1107,44 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
 
 .disc-pref { margin-right: 4px; }
 
+/* ---------- connections (profile section 6, task 1002296) ---------- */
+
+.conn-person { display: inline-flex; align-items: center; gap: 7px; min-width: 0; }
+.conn-person__avatar {
+  width: 22px; height: 22px; border-radius: 50%; flex: none;
+  background: var(--surface-2); border: 1px solid var(--border); object-fit: cover;
+}
+.conn-person__name { font-weight: 500; }
+.conn-person__handle { color: var(--ink-faint); font-size: 12.5px; }
+
+/* The degree chip. `--out` is the null answer — deliberately the quietest of
+   the four, because "out of network" is an absence of knowledge, not a rank. */
+/* nowrap + flex:none — "Out of network" is the longest label and must stay one
+   pill; wrapped, it reads as two chips. */
+.conn-degree {
+  display: inline-block; flex: none; white-space: nowrap;
+  padding: 1px 7px; border-radius: 999px;
+  font-size: 11.5px; font-weight: 600; letter-spacing: 0.02em;
+  border: 1px solid var(--border-strong); background: var(--surface-2); color: var(--ink-soft);
+}
+.conn-degree--1 { background: var(--ok-weak); color: var(--ok); border-color: color-mix(in srgb, var(--ok) 30%, transparent); }
+.conn-degree--2 { background: var(--info-weak); color: var(--info); border-color: color-mix(in srgb, var(--info) 30%, transparent); }
+.conn-degree--3 { background: var(--surface-2); color: var(--ink-soft); }
+.conn-degree--out { background: none; color: var(--ink-faint); border-style: dashed; }
+
+.conn-degree-line { display: flex; align-items: baseline; gap: 8px; flex-wrap: wrap; margin: 0 0 6px; font-size: 13.5px; color: var(--ink-soft); }
+.conn-act { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; margin: 10px 0 0; }
+.conn-state { font-size: 13px; color: var(--ink-faint); }
+.conn-sub { margin: 14px 0 6px; font-size: 12px; text-transform: uppercase; letter-spacing: 0.06em; color: var(--ink-faint); }
+.conn-reqs { list-style: none; margin: 0; padding: 0; display: grid; gap: 6px; }
+.conn-req {
+  display: flex; align-items: center; gap: 10px; flex-wrap: wrap;
+  padding: 8px 10px; border: 1px solid var(--border); border-radius: 8px; background: var(--surface-1);
+}
+.conn-req__note { flex: 1 1 100%; margin: 0; font-size: 13px; color: var(--ink-soft); }
+.conn-req__state { font-size: 13px; color: var(--ink-faint); }
+.conn-req__acts { margin-left: auto; display: flex; gap: 6px; }
+
 @media (max-width: 640px) {
   .profile { grid-template-columns: 48px minmax(0, 1fr); }
   .profile__avatar { width: 48px; height: 48px; }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.426",
+  "version": "1.19.427",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.426",
+      "version": "1.19.427",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.426",
+  "version": "1.19.427",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/hall-preview/server.js

@@ -116,6 +116,9 @@ const FIXTURE_FALLBACKS = [
   // craft and the page window are query string, which fixture matching ignores.
   [/^builders\/\d+\/activity$/, (q) => (q.section === 'goals' ? 'builders__activity-goals' : 'builders__activity-tasks')],
   [/^inbox\/by-builder\/\d+$/, 'inbox__by-builder'],
+  // the profile's connections section (task 1002296) — one degree fixture serves
+  // any handle, since the handle is the address and the label is the payload.
+  [/^connections\/degree\/[^/]+$/, 'connections__degree'],
 ];
 
 function loadFixture(name) {

package/src/module-api.js

@@ -33,7 +33,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.426'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.427'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');