@bongos/core 1.19.564 → 1.19.566

package/modules/platform-identity/visibility-pull.js

@@ -0,0 +1,201 @@
+// modules/platform-identity/visibility-pull.js — HOW A SELF-HOSTED PROJECT'S JOIN DOOR
+// REACHES THE HUB (BV1.R08, task 1002327; ADR 0252, corrected by ADR 0253).
+//
+// The hub does not receive a pushed report. It READS the instance's already-public
+// manifest — `GET <origin>/api/bongos/instance` → `brand.project.visibility` — and caches
+// the answer. ADR 0252 §2: a self-hosted instance holds no credential and minting one
+// walks into ADR 0144/0145's tripwire, so the channel that does not need a credential
+// is the only one that can be built today. A pull also has no message to replay, adds
+// no required wire field to anyone else's upgrade clock, and authorizes nothing.
+//
+// WHAT THIS FILE OWNS. Three rules, and each is only safe given the others:
+//
+//   • WHAT A MANIFEST IS ALLOWED TO SAY — `visibilityFromManifest`. A three-value closed
+//     enum and nothing else. No name, tagline or art reaches the catalog through this
+//     channel: today no project owner controls a free-text field that reaches the public
+//     feed, and ADR 0252 §7 refuses to spend that property on a visibility report. An
+//     off-vocabulary or absent answer is NO VERDICT — never a default, because defaulting
+//     would let a project that said nothing be read as having said 'public'.
+//
+//   • WHAT A READ MAY CHANGE — `pullDecision`. The tri-state, which is the part that is
+//     easy to get wrong in the direction that empties the map. See below.
+//
+//   • WHICH ROWS MAY BE READ AT ALL — `PULLABLE_SQL`. Rows the control plane has never
+//     claimed. The bridge (ADR 0246) assigns `visibility` for the projects the operator
+//     provisions, and the two writers must never touch the same row; `visibility_source`
+//     is what makes that an invariant the SQL enforces rather than a convention someone
+//     has to remember. The catalog row carries no `hosting_shape` and may not import the
+//     module that does (ADR 0083's one-way rule), so provenance is recorded here instead
+//     of asked for across a seam on every sweep.
+//
+// THE TRI-STATE, AND WHY IT IS THREE STATES AND NOT TWO (ADR 0252 §4). `null` (never
+// read) ≠ `false` (read, and negative). A project does not leave the map because its
+// server was down for one sweep:
+//
+//   never successfully read      → dark matter. ADR 0182 D5's fail-closed default,
+//                                  doing its job, and scoped to rows that have genuinely
+//                                  never answered.
+//   read before, unreachable now → KEEP the last known state and its stamp. Reporting
+//                                  may degrade where enforcement must refuse (ADR 0226);
+//                                  liveness is an overlay, never a lifecycle state
+//                                  (ADR 0199). Implemented by writing NOTHING — the
+//                                  stamp means "last SUCCESSFUL read", so a failed read
+//                                  must not touch it.
+//   read, narrower than before   → applied immediately and unconditionally. A report
+//                                  that REDUCES exposure needs no trust at all: the
+//                                  worst a lying instance achieves is hiding itself.
+//                                  Narrowing is free; widening is what costs.
+//
+// AND THE ONE THING A PULL MAY NEVER MOVE: `status`. Retraction is a hub decision about
+// the hub's own surface. A project taken down that keeps reporting `public` STAYS down —
+// without that, the next sweep silently undoes every takedown and the lever is
+// decorative (ADR 0252 §5.2). The pull moves `visibility`; `status` is not in any
+// statement in this file, which is the cheapest possible proof of it.
+//
+// Proof: ../../tests/visibility_pull.mjs
+'use strict';
+
+const { pool: defaultPool } = require('../../src/module-api');
+const { ORB_BY_STATE } = require('./projects-feed');
+const projectStats = require('./project-stats');
+
+// The manifest route every Cloud Bongos instance already serves, unauthenticated and
+// CORS-open (ADR 0114's discovery surface; `src/bongos/routes/instance.js`). Nothing is
+// added to it by this task — ADR 0252 §2.3: the field already ships in every core, so
+// there is no wire change on anyone else's upgrade schedule. The API router is
+// dual-mounted at `/api/bongos` (canonical) and at the permanent legacy alias ADR 0252
+// happened to write, so either prefix reaches it; the fetch uses the canonical one.
+const MANIFEST_ROUTE = '/api/bongos/instance';
+
+// Rows the PULL may write: the ones the ADR 0246 control-plane bridge has never claimed.
+// `IS DISTINCT FROM` rather than `<> `, deliberately — a NULL source is the unclaimed
+// state and plain inequality would drop exactly those rows on a NULL comparison.
+const PULLABLE_SQL = "visibility_source IS DISTINCT FROM 'control-plane'";
+
+// visibilityFromManifest — the ONLY value this channel carries, or null for NO VERDICT.
+//
+// Reads `brand.project.visibility`: `buildInstanceManifest` projects the branding pack
+// under the key `brand`, and `clientBranding()` puts the join door at `project.visibility`
+// (`src/branding.js`). `branding` is accepted as a second spelling because ADR 0252 §2 and
+// this task's own body both name it that way — costing one `??` here is cheaper than a
+// silent null on a shape nobody re-checked.
+//
+// Third-party input, so it is validated against the enum rather than trusted: an unknown
+// string, a number, an object, a missing key and a missing `project` all yield null. PURE.
+function visibilityFromManifest(body) {
+  const project = body?.brand?.project ?? body?.branding?.project;
+  const v = project?.visibility;
+  if (typeof v !== 'string') return null;
+  const trimmed = v.trim();
+  return Object.prototype.hasOwnProperty.call(ORB_BY_STATE, trimmed) ? trimmed : null;
+}
+
+// pullDecision — what ONE sweep of ONE row should do. The whole tri-state, in one pure
+// function so it is testable without a database or a network.
+//
+// Returns { write: false, reason } or { write: true, visibility }. There is deliberately
+// no third shape: everything that is not a successful, in-vocabulary read leaves the row
+// exactly as it is, including its stamp.
+function pullDecision(row, reported) {
+  if (row?.visibility_source === 'control-plane') {
+    return { write: false, reason: 'control_plane_row' };
+  }
+  if (reported === null || reported === undefined) {
+    // No verdict. Either the instance is unreachable, or it answered something this
+    // channel does not accept. Both are silence, and silence never moves a row: an
+    // unread project stays dark, and a project that answered before keeps what it said.
+    return {
+      write: false,
+      reason: row?.visibility_reported_at ? 'unreachable_keeps_last_state' : 'never_reported',
+    };
+  }
+  if (row?.visibility === reported && row?.visibility_source === 'pull') {
+    // Same answer as last time. Skipping the write keeps `updated_at` still, which
+    // matters more than it looks: the public feed orders on it, so bumping it every
+    // sweep would make a row's position track the sweep clock rather than the project.
+    return { write: false, reason: 'unchanged' };
+  }
+  return { write: true, visibility: reported };
+}
+
+// The pullable rows, oldest reading first so a sweep that is cut short by its budget
+// makes progress on the staleness it exists to fix rather than re-reading fresh rows.
+// NULLS FIRST puts the never-read projects — the ones currently dark — at the head.
+async function pullableProjects({ pool = defaultPool, limit = 200 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT id, origin, visibility, visibility_source, visibility_reported_at
+       FROM platform_identity_projects
+      WHERE ${PULLABLE_SQL}
+      ORDER BY visibility_reported_at ASC NULLS FIRST
+      LIMIT $1`,
+    [limit],
+  );
+  return rows;
+}
+
+// Record one successful read. The WHERE re-asserts PULLABLE_SQL rather than trusting the
+// row the caller read a moment ago: a bridge projection can land between the SELECT and
+// this UPDATE, and the invariant that the two writers never touch the same row has to
+// hold at the write, not merely at the read. `status` is absent, and so is `featured` —
+// this statement can only move the door.
+async function recordVisibilityPull(id, visibility, { pool = defaultPool } = {}) {
+  if (!Object.prototype.hasOwnProperty.call(ORB_BY_STATE, visibility)) {
+    throw new Error(`visibility-pull: refusing to write off-vocabulary value ${JSON.stringify(visibility)}`);
+  }
+  const { rows } = await pool.query(
+    `UPDATE platform_identity_projects
+        SET visibility = $2,
+            visibility_source = 'pull',
+            visibility_reported_at = now(),
+            updated_at = now()
+      WHERE id = $1 AND ${PULLABLE_SQL}
+      RETURNING id, origin, visibility, visibility_reported_at`,
+    [id, visibility],
+  );
+  return rows[0] || null;
+}
+
+// One row, end to end. Never throws: a sweep runs over projects the hub does not control,
+// so one hostile or broken instance must not stop the others being read.
+async function pullOne(row, { pool = defaultPool, fetchVisibility = projectStats.fetchInstanceVisibility } = {}) {
+  let reported = null;
+  try {
+    reported = visibilityFromManifest(await fetchVisibility(row.origin));
+  } catch {
+    reported = null;   // unreachable, refused by the SSRF guard, timed out, or not JSON
+  }
+  const decision = pullDecision(row, reported);
+  if (!decision.write) return { origin: row.origin, written: false, reason: decision.reason };
+  const written = await recordVisibilityPull(row.id, decision.visibility, { pool });
+  return {
+    origin: row.origin,
+    written: !!written,
+    reason: written ? 'updated' : 'claim_lost',
+    visibility: decision.visibility,
+  };
+}
+
+// The sweep. Sequential on purpose: this is a background reconciler with no reader
+// waiting on it, and the fan-out it walks is the same population the public feed already
+// fetches from on every cold load. Doing it serially keeps the hub from becoming a
+// burst source against every listed instance at once — the feed's own concurrency is
+// bounded by a page load; a sweep's would be bounded by nothing.
+async function sweepVisibilityOnce({ pool = defaultPool, limit = 200, fetchVisibility } = {}) {
+  const rows = await pullableProjects({ pool, limit });
+  const results = [];
+  for (const row of rows) {
+    results.push(await pullOne(row, { pool, fetchVisibility }));
+  }
+  return { scanned: rows.length, updated: results.filter((r) => r.written).length, results };
+}
+
+module.exports = {
+  MANIFEST_ROUTE,
+  PULLABLE_SQL,
+  visibilityFromManifest,
+  pullDecision,
+  pullableProjects,
+  recordVisibilityPull,
+  pullOne,
+  sweepVisibilityOnce,
+};

package/modules/public-landing/public/projects.html

@@ -5586,7 +5586,10 @@ summary{min-height:24px;padding:3px 0;}
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
         /* the settings row + the project's own manifest — the same cadence as
-           the GitHub read: entry + tab return, never the in-flight tick */
+           the GitHub read: entry + tab return, never the in-flight tick. The
+           three cards below share ONE read of the row (task 1003582), so
+           dropping the memo here is what keeps each entry a fresh read */
+        if (!keepRepo) forgetSettings();
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
         if (!keepRepo) loadDoor();
@@ -5936,30 +5939,67 @@ summary{min-height:24px;padding:3px 0;}
       .then(function () { if (timer) clearTimeout(timer); });
   }
 
+  /* ── the settings row, read ONCE per manage entry (task 1003582) ─────────
+     Three cards render off the SAME row — how the project is reached
+     (platform_visibility), how people join (joinability), and its door on the
+     map (visibility) — and each used to GET it for itself: three identical
+     round trips on every entry, growing by one with each card added.
+
+     Memoised like ensureModsCatalog()/ensureBundles(), with the one difference
+     that matters: those hold a catalog nothing rewrites, this holds a
+     per-project row every card's Save rewrites. So the memo is keyed on the
+     project AND dropped by forgetSettings() at the top of each entry pass —
+     nothing else may reuse it, or a card would paint a row the owner has since
+     changed. The saves stay separate: each card still PATCHes its own key.
+
+     It RESOLVES with the whole answer, status included, rather than throwing on
+     a refusal — each card keeps writing its own line for a lapsed session vs.
+     an outage. A transport failure still rejects, and every consumer catches it
+     privately, so one card's failure never silences its siblings. */
+  var settingsPromise = null;
+  var settingsFor = null;   /* which project the memo holds — a switch must not reuse it */
+
+  function ensureSettings() {
+    if (settingsPromise && settingsFor === manageId) return settingsPromise;
+    settingsFor = manageId;
+    settingsPromise = fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        return jsonOrEmpty(res).then(function (data) {
+          return { ok: res.ok, status: res.status, data: data || {} };
+        });
+      });
+    return settingsPromise;
+  }
+
+  /* Drop the memo so the next ensureSettings() is a real read. This is also
+     what makes the alert's "Try again" work: a rejected promise left memoised
+     would keep answering with the failure forever. */
+  function forgetSettings() { settingsPromise = null; settingsFor = null; }
+
   function loadVisibility(inst) {
     mVisSettings = null; mVisRunsHtml = ''; mVisPushSeen = false;
     visMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mVisSettings = {
-              value: (data.settings || {}).platform_visibility,
-              options: (data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
-            };
-            renderVis();
-            /* while a push is open the line is the intent's — the manifest is
-               asked the moment it settles (renderVisState), not now */
-            if (!visPushOpen(inst)) loadVisRuns(inst);
-            return;
-          }
-          visMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mVisSettings = {
+            value: (ans.data.settings || {}).platform_visibility,
+            options: (ans.data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
+          };
+          renderVis();
+          /* while a push is open the line is the intent's — the manifest is
+             asked the moment it settles (renderVisState), not now */
+          if (!visPushOpen(inst)) loadVisRuns(inst);
+          return;
+        }
+        visMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        /* the read is shared now, so its rejection reaches all three cards —
+           each one still only speaks for the project it was asked about */
+        if (asked !== manageId) return;
         visMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }
@@ -6313,24 +6353,22 @@ summary{min-height:24px;padding:3px 0;}
     mJoinSettings = null; mJoinRunsHtml = ''; mJoinPushSeen = false;
     joinMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mJoinSettings = {
-              value: (data.settings || {}).joinability,
-              options: (data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
-            };
-            renderJoin();
-            if (!visPushOpen(inst)) loadJoinRuns(inst);
-            return;
-          }
-          joinMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mJoinSettings = {
+            value: (ans.data.settings || {}).joinability,
+            options: (ans.data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
+          };
+          renderJoin();
+          if (!visPushOpen(inst)) loadJoinRuns(inst);
+          return;
+        }
+        joinMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        if (asked !== manageId) return;
         joinMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }
@@ -6539,23 +6577,21 @@ summary{min-height:24px;padding:3px 0;}
     mDoorSettings = null;
     doorMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mDoorSettings = {
-              value: (data.settings || {}).visibility,
-              options: (data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
-            };
-            renderDoor();
-            return;
-          }
-          doorMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mDoorSettings = {
+            value: (ans.data.settings || {}).visibility,
+            options: (ans.data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
+          };
+          renderDoor();
+          return;
+        }
+        doorMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        if (asked !== manageId) return;
         doorMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.564",
+  "version": "1.19.566",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.564",
+      "version": "1.19.566",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.564",
+  "version": "1.19.566",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/middleware/rate-limit.js

@@ -1,8 +1,8 @@
 // src/bongos/middleware/rate-limit.js — V3.R34 (#255).
 //
-// Four sliding-window in-memory limiters. The first two are the GLOBAL pair and
+// Five sliding-window in-memory limiters. The first two are the GLOBAL pair and
 // protect write methods on /api/gds/* only — read methods (GET, HEAD, OPTIONS)
-// bypass them entirely; #3 and #4 are mounted per-surface to close exactly that
+// bypass them entirely; #3, #4 and #5 are mounted per-surface to close exactly that
 // gap where an unauthenticated READ is itself the abuse.
 //
 //   1. Per-IP limiter      — 30 writes / 60s. Anchors on req.ip (which honors
@@ -50,6 +50,26 @@
 //                            the access-pending page polls every 3s (20/min) —
 //                            while capping a scraper at ~2 logins/s.
 //
+//   5. Public-project-feed limiter — 120 reads / 60s per IP on GET /projects/featured
+//                            (task 1002327, ADR 0252 §5.3). That route is
+//                            unauthenticated, CORS-open and, until this limiter,
+//                            unmetered by construction: the two write limiters
+//                            bypass reads, and #3 is mounted only under /public/*,
+//                            which this route is not. It is also the most
+//                            EXPENSIVE public read on the platform — a cold cache
+//                            drives up to 500 catalog rows × 4 outbound fetches to
+//                            other people's servers, so an unmetered caller is not
+//                            just scraping us, they are aiming our fan-out at
+//                            third parties. ADR 0252 opened the catalog to
+//                            auto-appear, which replaced "bounded by who the
+//                            operator provisioned" with "bounded by whoever points
+//                            a domain at us" — this ceiling is the counterweight
+//                            that made that decision safe to take. 120/min clears
+//                            any real consumer (the static orbs site and the apex
+//                            fetch it once per page load, and both honour the
+//                            route's Cache-Control) while capping a
+//                            cache-ignoring scraper at ~2 req/s.
+//
 // Any limiter tripping → 429 with Retry-After (seconds rounded up to the
 // nearest whole second). Audit middleware still fires on a write 429 — the row
 // in audit_log is forensic value for "who tried too hard." (Reads are never
@@ -74,6 +94,8 @@ const PUBLIC_READ_WINDOW_MS = 60 * 1000;
 const PUBLIC_READ_LIMIT     = 120;
 const ACCOUNT_EXISTENCE_WINDOW_MS = 60 * 1000;
 const ACCOUNT_EXISTENCE_LIMIT     = 120;
+const PROJECT_FEED_WINDOW_MS = 60 * 1000;
+const PROJECT_FEED_LIMIT     = 120;
 const SWEEP_MS              = 5 * 60 * 1000;
 
 const ipBuckets         = new Map();
@@ -82,6 +104,8 @@ const publicReadBuckets = new Map();
 // ONE bucket map for limiter #4 — both account-existence probes key into it, so
 // the budget is genuinely shared rather than merely identically configured.
 const accountExistenceBuckets = new Map();
+// Limiter #5's bucket map — the public projects feed (task 1002327, ADR 0252 §5.3).
+const projectFeedBuckets = new Map();
 
 const WRITE_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 // HEAD is metered too: Express runs the GET handler (incl. the DB query) for a
@@ -132,6 +156,10 @@ function sweep() {
     pruneAndCount(arr, now, ACCOUNT_EXISTENCE_WINDOW_MS);
     if (arr.length === 0) accountExistenceBuckets.delete(k);
   }
+  for (const [k, arr] of projectFeedBuckets) {
+    pruneAndCount(arr, now, PROJECT_FEED_WINDOW_MS);
+    if (arr.length === 0) projectFeedBuckets.delete(k);
+  }
 }
 
 // Schedule the sweep. unref() so it doesn't keep the process alive during
@@ -245,10 +273,22 @@ const accountExistenceReadRateLimit = perIpSlidingWindow(accountExistenceBuckets
   scope: 'account-existence',
 });
 
+// publicProjectFeedRateLimit — limiter #5 in the header. ONE instance, mounted on the
+// public projects feed (task 1002327, ADR 0252 §5.3). Exported as an instance rather
+// than a factory for ADR 0209's reason: two call sites that each build their own from
+// matching config get two budgets, which looks identical in review and hands a caller
+// double the rate. A second surface answering "what is on the map" mounts THIS.
+const publicProjectFeedRateLimit = perIpSlidingWindow(projectFeedBuckets, {
+  limit: PROJECT_FEED_LIMIT,
+  windowMs: PROJECT_FEED_WINDOW_MS,
+  scope: 'public-project-feed',
+});
+
 module.exports = {
   rateLimitMiddleware,
   publicReadRateLimitMiddleware,
   accountExistenceReadRateLimit,
+  publicProjectFeedRateLimit,
   // exported for tests + the security-baseline-check script
   PER_IP_WINDOW_MS,
   PER_IP_LIMIT,
@@ -258,4 +298,6 @@ module.exports = {
   PUBLIC_READ_LIMIT,
   ACCOUNT_EXISTENCE_WINDOW_MS,
   ACCOUNT_EXISTENCE_LIMIT,
+  PROJECT_FEED_WINDOW_MS,
+  PROJECT_FEED_LIMIT,
 };

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.564'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.566'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -158,6 +158,17 @@ module.exports = {
   //     ADR 0209). Vendoring a second copy in a module is the failure this
   //     export exists to prevent.
   accountExistenceReadRateLimit: require('./bongos/middleware/rate-limit').accountExistenceReadRateLimit,
+  // publicProjectFeedRateLimit — the per-IP ceiling (120 reads/60s) on the PUBLIC
+  //     projects feed (task 1002327, ADR 0252 §5.3). Same reasoning as its
+  //     neighbour, and the same shape — ONE middleware instance, never a factory,
+  //     so a second surface answering "what is on the map" spends the same budget
+  //     instead of quietly doubling it. It guards the most expensive
+  //     unauthenticated read the platform has: a cold call fans out to as many as
+  //     500 third-party origins, so the ceiling protects other people's servers as
+  //     much as ours. ADR 0252 made this a condition of auto-appear, not a
+  //     follow-up — the straight-through path and its abuse guard ship together
+  //     (ADR 0047).
+  publicProjectFeedRateLimit: require('./bongos/middleware/rate-limit').publicProjectFeedRateLimit,
 
   // --- per-builder secrets at rest (AES-256-GCM box) — a kernel trust
   //     primitive; the full secretBox object is exposed so a module can call