@bongos/core 1.19.534 → 1.19.536

package/docs/api/openapi.json

@@ -181,6 +181,10 @@
       "name": "profiles",
       "description": "Endpoints under `/api/bongos/profiles`."
     },
+    {
+      "name": "project-settings",
+      "description": "Endpoints under `/api/bongos/project-settings`."
+    },
     {
       "name": "projects",
       "description": "Endpoints under `/api/bongos/projects`."
@@ -10939,6 +10943,99 @@
         "security": []
       }
     },
+    "/project-settings": {
+      "get": {
+        "operationId": "get_project_settings",
+        "tags": [
+          "project-settings"
+        ],
+        "summary": "GET /project-settings",
+        "description": "GET /project-settings — all five rows in ONE read. rank: project.settings.manage (metic+, government_010), the SAME floor as the page it serves (requireGovernmentPage). The first cut gated this any-builder on the reasoning that it is \"the project's own published terms\" — but the payload also carries reward-policy internals (marginPct, usdPeg, mode), a raw rejected project_settings value, and internal file/migration paths, and a xenos who cannot even load the page could still curl those. Matching the read floor to the page's (task 1003280 grade, hacker lens) closes that asymmetry; the two WRITES already gate on this same atom, so the whole surface is now one floor. One read, not five: the page draws five rows, so it asks for five rows. Fetching per-row would put the hall's own settings page in the shape goal 1000072's criterion names (hall-ui/CLAUDE.md, \"a card asks the server for the rows it draws\").\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/project-settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProjectSettingsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/project-settings/rot-days": {
+      "patch": {
+        "operationId": "patch_project_settings_rot_days",
+        "tags": [
+          "project-settings"
+        ],
+        "summary": "PATCH /project-settings/rot-days",
+        "description": "PATCH /project-settings/rot-days — body { days }. The one number this page writes. rank: project.settings.manage (metic+, government_010). Validated HERE against the resolver's own parser rather than a re-typed range, so the page and the reader of the value can never disagree about what is acceptable — the second copy of \"1..365\" would be the drift this file exists to prevent. rank: project.settings.manage (metic+, granted by government_010). THE ATOM IS A STRING LITERAL, not a named constant, and that is load-bearing: the route-rank auditor (src/bongos/route-rank-check.js) reads this file statically and pulls the atom out of `requirePermission(...)` with a QUOTED-STRING match. A `requirePermission(SETTINGS_ATOM)` therefore resolves to an EMPTY gate — rank 'unknown' — which is a hard ADR 0016 build failure, and the generated OpenAPI would have carried no `x-permissions` either. This route was written with a constant first and fitness.js caught it; that is why every gated route in the tree spells its atom inline. (Wrapping the middleware list across lines is fine — the sibling PATCH /work-categories/:id does exactly that and still classifies metic+archon.)\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/project-settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchProjectSettingsRotDaysRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PatchProjectSettingsRotDaysResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/projects": {
       "get": {
         "operationId": "get_projects",
@@ -16012,6 +16109,54 @@
           }
         ]
       }
+    },
+    "/work-categories/{id}": {
+      "patch": {
+        "operationId": "patch_work_categories_id",
+        "tags": [
+          "work-categories"
+        ],
+        "summary": "PATCH /work-categories/:id",
+        "description": "PATCH /work-categories/:id — body { label?, sort_order?, active? }: rename a category, move it in the order, or stop offering it. The set has been list+add only since core_226 even though the table carries both columns, so a project could grow its vocabulary and never tidy it (task 1003280). rank: project.settings.manage (metic+, government_010) — the SHAPE of the set, one tier up from POST's goal.create, because reordering and deactivating affect what every future author is offered rather than adding one label to the tail. The slug is deliberately NOT patchable: it is the stable key goal prose and the /goal-create prompt refer to. Deactivating never deletes — goals already carrying a retired category keep a resolvable label.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/lifecycle/routes/goals.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
     }
   },
   "components": {
@@ -17176,6 +17321,15 @@
           "cross_project"
         ]
       },
+      "GetProjectSettingsResponse": {
+        "type": "object",
+        "properties": {
+          "rows": {}
+        },
+        "required": [
+          "rows"
+        ]
+      },
       "GetProjectsFeaturedResponse": {
         "type": "object",
         "properties": {
@@ -18208,6 +18362,35 @@
           "known_sounds"
         ]
       },
+      "PatchProjectSettingsRotDaysRequest": {
+        "type": "object",
+        "properties": {
+          "days": {
+            "type": "number"
+          }
+        },
+        "required": [
+          "days"
+        ],
+        "additionalProperties": false
+      },
+      "PatchProjectSettingsRotDaysResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "rot_days": {},
+          "source": {},
+          "describe": {}
+        },
+        "required": [
+          "ok",
+          "rot_days",
+          "source",
+          "describe"
+        ]
+      },
       "PatchProjectsIdFeaturedRequest": {
         "type": "object",
         "properties": {
@@ -22201,9 +22384,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 352,
-  "x-schema-count": 387,
+  "x-endpoint-count": 355,
+  "x-schema-count": 390,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 263,
+  "x-response-schemas": 265,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 352 endpoints across 57 route files.
+> **Generated from the live route files** — the route file is authoritative. 355 endpoints across 58 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -442,6 +442,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 |---|---|---|---|---|
 | GET | `/api/bongos/profiles/:handle` | `public` | — | a handle-addressed public profile. |
 
+## `project-settings` (2)
+
+| Method | Path | Rank | Body | Description |
+|---|---|---|---|---|
+| GET | `/api/bongos/project-settings` | `metic+archon` | — | GET /project-settings — all five rows in ONE read. |
+| PATCH | `/api/bongos/project-settings/rot-days` | `metic+archon` | `days` | PATCH /project-settings/rot-days — body { days }. |
+
 ## `projects` (5)
 
 | Method | Path | Rank | Body | Description |
@@ -622,12 +629,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/versions/close-suggestions` | `public` | — | Close-flow gate suggestions for every version still 'building'. |
 | GET | `/api/bongos/versions/progress` | `public` | — | read-only progress aggregate; mirrors /public/progress. |
 
-## `work-categories` (2)
+## `work-categories` (3)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
 | GET | `/api/bongos/work-categories` | `any-builder` | — | ---- the ADVISORY human category (task 1003275, criterion legibility-categories) ---- A category ORIENTS a person and steers Claude; it a… |
 | POST | `/api/bongos/work-categories` | `metic+archon` | — | POST /work-categories — the endpoint the "Claude could not place this goal" prompt writes into. |
+| PATCH | `/api/bongos/work-categories/:id` | `metic+archon` | — | PATCH /work-categories/:id — body { label?, sort_order?, active? }: rename a category, move it in the order, or stop offering it. |
 
 ---