@bongos/core 1.19.562 → 1.19.564

package/docs/api/openapi.json

@@ -11785,6 +11785,58 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/invite-suggestions": {
+      "get": {
+        "operationId": "get_provisioning_instances_id_invite_suggestions",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "GET /provisioning/instances/:id/invite-suggestions",
+        "description": "── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the engine's `invites.seeking` into NAMES. ADR 0239 §6 left `invites.suggested` empty on purpose: ranking builders is a directory read the pure engine may not run. This is the resolution, and ADR 0251 is why it looks like this. rank: any authenticated builder, own resource — `instanceAccessDenied`, the same gate and the same 404 as the manage read above. That is deliberate and not a new authorization idea: REACHING this route IS the ownership answer (ADR 0249 §4), so the surface never re-derives \"is this theirs\" and can never become a weaker second copy of a server rule (ADR 0016). It also 404s rather than 403s, so it leaks no more instance existence than the read beside it. `seeking: null` COSTS NOTHING AND ASKS NOBODY. A solo owner is suggested nobody on purpose (ADR 0239 §6), which is a different statement from an empty list nobody filled — so that answer returns its own reason and never touches the directory at all.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/provisioning.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetProvisioningInstancesIdInviteSuggestionsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/restart": {
       "post": {
         "operationId": "post_provisioning_instances_id_restart",
@@ -17447,6 +17499,20 @@
           "coreVersion"
         ]
       },
+      "GetProvisioningInstancesIdInviteSuggestionsResponse": {
+        "type": "object",
+        "properties": {
+          "suggested": {},
+          "seeking": {},
+          "reason": {},
+          "unavailable": {}
+        },
+        "required": [
+          "suggested",
+          "seeking",
+          "reason"
+        ]
+      },
       "GetProvisioningInstancesIdResponse": {
         "type": "object",
         "properties": {
@@ -22439,9 +22505,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 356,
-  "x-schema-count": 390,
+  "x-endpoint-count": 357,
+  "x-schema-count": 391,
   "x-undocumented-bodies": 9,
-  "x-response-schemas": 264,
+  "x-response-schemas": 265,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 356 endpoints across 58 route files.
+> **Generated from the live route files** — the route file is authoritative. 357 endpoints across 58 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -459,7 +459,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/projects/featured` | `public` | — | the public map of projects; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: invite a builder into a project (ADR 0141 §5, task #1002115), called by a `project.curate` holder OR the project'… |
 
-## `provisioning` (21)
+## `provisioning` (22)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -475,6 +475,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | POST | `/api/bongos/provisioning/instances/:id/domain` | `any-builder` | `domain` | POST /provisioning/instances/:id/domain — give the caller's OWN instance its address (task 1002692, gap 5: no path existed to add a domai… |
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
+| GET | `/api/bongos/provisioning/instances/:id/invite-suggestions` | `any-builder` | — | ── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the … |
 | POST | `/api/bongos/provisioning/instances/:id/restart` | `any-builder` | — | POST /provisioning/instances/:id/restart — restart an ACTIVE project the heartbeat cannot reach (task 1003238). |
 | GET | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | — | GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). |
 | PATCH | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | validated | PATCH /provisioning/instances/:id/settings — change a project's settings. |