@bongos/core 1.19.667 → 1.19.668

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.667",
-  "core_contract": "1.19.667",
-  "source_commit": "fde10b200283c5047be40d5fc05a7489f3d5b73c",
+  "core_version": "1.19.668",
+  "core_contract": "1.19.668",
+  "source_commit": "7ef8e22537f40e46f6f068d2479fbbb853f91ac6",
   "source_ref": "HEAD",
-  "built_at": "2026-09-11T07:58:55.399Z",
+  "built_at": "2026-09-11T15:53:04.954Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 473,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2614,
-  "tree_sha256": "cbb2d92ddbc241d615a5a7b105b021310b739c85b8709fd9479d256ceba573e5",
+  "tree_sha256": "f753736a9456c435a166c5d07d41ab343a26cf1d0ccbd1ddf50fe23325cb3bd3",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2787,7 +2787,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "65505f4ffa0193c1827059d16ce364257fdfdc076f5585544e1d037f2bda40a8"
+      "sha256": "6eba5a3ec525e945d04f4665e23d6b3731df16547f7b51593c589ff2569c682c"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7757,12 +7757,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e6a26c726108246ac30f4250a93e1fd7965dba6bd5dfcd950b849357634ddb02"
+      "sha256": "2b109c02111e9aff72bc2a9b6a1a85805c7544cca1e68399ceaf5f8de8df0f47"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "30fa12bd80546328d075b3d2b251c528c59ec033b486a6084bcca3b3d5c6f703"
+      "sha256": "41264c98f8188d3443d6195d223de91f9eeed86ce21ed880e0b0a138e72669ff"
     },
     {
       "path": "public-docs/index.html",
@@ -9357,7 +9357,7 @@
     {
       "path": "src/bongos/platform-visibility-gate.js",
       "mode": "0000644",
-      "sha256": "eea15ebe44e9450f2d62040c239828008e8953ea5ee465085d5f0e8e63fe6233"
+      "sha256": "b09f1c0bcbb066ae80cbeebad730db8a8665dd077c3f2026c3b3d78298fdd866"
     },
     {
       "path": "src/bongos/pool.js",
@@ -9522,7 +9522,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c0e7feb5829d3c421b86a6a9a6465b05f495e66679c91688a41d0eb23d1c3207"
+      "sha256": "43b74af9de322914ac0f43a8cd4adacc1de90fb874692744450ff18beeaa67e7"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -11867,7 +11867,7 @@
     {
       "path": "tests/platform_visibility_gate.mjs",
       "mode": "0000644",
-      "sha256": "2dc7a56caeababd5bf249e968e4353f8c738aef459947fde15c7c511640c13aa"
+      "sha256": "7a4a3677e25bd55a6ebb64130f724f030f0b57d0ccc07172de3860cbeb4a66d7"
     },
     {
       "path": "tests/post_login_landing.mjs",

package/docs/module-api-changelog.md

@@ -1793,5 +1793,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.665 with no explicit bump. run 34567142386. (task 1002620)
   1.19.667 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.666 with no explicit bump. run 34576878372. (task 1002620)
+  1.19.668 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.667 with no explicit bump. run 34618700494. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.667",
+  "version": "1.19.668",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.667",
+      "version": "1.19.668",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.667",
+  "version": "1.19.668",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/platform-visibility-gate.js

@@ -70,6 +70,18 @@ const API = `(?:${ALL_API_PREFIXES.map(escRe).join('|')})`;
 //   /__prelaunch         the pre-launch gate's own submit, when both gates are on.
 //                        /__stealth is its pre-rename alias (task 1003152) and is
 //                        exempt for as long as the gate still accepts it.
+//   <api>/access-requests  POST ONLY — a stranger's application to a project that is
+//                        BOTH gated and "apply to join" (task 1003624). The owner
+//                        turned that door on deliberately; without this exemption the
+//                        member door answers 401 first and the two settings compose
+//                        into "nobody can apply", which nobody chose. The write is
+//                        public on every other project and carries its own per-IP and
+//                        per-login limits, and it GRANTS nothing — an application is a
+//                        row in a queue the owner still reviews (ADR 0201). The bare
+//                        GET on the same path is the owner's QUEUE (requireBuilder +
+//                        access_request.review), so the exemption is scoped to the
+//                        VERB and the queue keeps the member door ahead of its own
+//                        rank check.
 const EXEMPT = [
   new RegExp(`^${API}/auth(/|$)`),
   new RegExp(`^${API}/instance$`),
@@ -81,6 +93,7 @@ const EXEMPT = [
   /^\/__prelaunch$/,
   /^\/__stealth$/,
   /^\/downloads\//,
+  { re: new RegExp(`^${API}/access-requests$`), methods: ['POST'] },
 ];
 
 // The policy, read through the memoized pack. A pack that cannot be read at all
@@ -106,9 +119,16 @@ function normalizePath(p) {
   return s;
 }
 
-function isExempt(path) {
+// `method` is OPTIONAL, and each entry decides whether it matters: a bare RegExp
+// exempts the path whatever the verb, while a method-scoped entry matches only the
+// verbs it names. A caller that passes no method therefore gets the fail-CLOSED
+// answer for the scoped entries (the static path checks in tests/version_literals.mjs
+// and tests/prelaunch_gate.mjs call it that way) — never an accidental exemption of a
+// sibling route that shares a path with an exempt one.
+function isExempt(path, method) {
   const p = normalizePath(path);
-  return EXEMPT.some((re) => re.test(p));
+  const m = String(method || '').toUpperCase();
+  return EXEMPT.some((e) => (e instanceof RegExp ? e.test(p) : e.re.test(p) && e.methods.includes(m)));
 }
 
 function isApiPath(path) { return /^\/api\//i.test(String(path || '')); }
@@ -233,7 +253,7 @@ function platformVisibilityGate(deps = {}) {
   return function platformVisibility(req, res, next) {
     if (!gated()) return next();
     if (req.method === 'OPTIONS') return next();     // a CORS preflight carries no identity
-    if (isExempt(req.path)) return next();
+    if (isExempt(req.path, req.method)) return next();
     // Async middleware must own its rejection (Express 4 drops the promise) —
     // and it FAILS CLOSED: if the session cannot be resolved, the caller's
     // identity is unknown, and admitting is never an option (auth.js's rule).

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.667'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.668'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/platform_visibility_gate.mjs

@@ -171,9 +171,38 @@ test('the exempt list: the door, the manifest, the probes, the downloads — on
     '/api/bongos/public/progress', '/api/gds/public/leaderboard', '/api/bongos/instances', '/api/gds/authors',
     '/api/bongos/v1/public/progress', '/api/gds/instance/anything', '/instance', '/healthzz', '/downloads',
     '/api/other/instance', '/api/bongos/provisioning/instances',
+    // the apply door is METHOD-scoped, so the bare path — no verb — is not exempt
+    '/api/gds/access-requests', '/api/gds/access-requests/status',
   ]) assert.equal(isExempt(p), false, `${p} must be gated`);
 });
 
+// task 1003624. A project can be BOTH gated and "apply to join"; before this the
+// member door answered 401 ahead of the apply route, so the two settings the owner
+// set composed into "nobody can apply". The exemption is the narrowest thing that
+// fixes it: one path, one verb.
+test('the apply door: POST <api>/access-requests answers a stranger — and only that verb, only that path', () => {
+  for (const p of [
+    '/api/gds/access-requests', '/api/bongos/access-requests', '/api/bongos/v1/access-requests',
+    // the router's own tolerances, the same ones the rest of the list is held to
+    '/API/BONGOS/ACCESS-REQUESTS', '/api/gds/access-requests/',
+  ]) assert.equal(isExempt(p, 'POST'), true, `POST ${p} must reach the apply route`);
+
+  // The bare GET on that path is the OWNER'S QUEUE (requireBuilder +
+  // access_request.review). It has its own rank check, and the member door stays
+  // in front of it regardless — an exemption that ignored the verb would have
+  // silently removed a layer from the queue that lists would-be builders by name.
+  for (const m of ['GET', 'HEAD', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', '']) {
+    assert.equal(isExempt('/api/gds/access-requests', m), false, `${m || '(no verb)'} on the queue must stay gated`);
+  }
+  // and the exemption does not spread down the path
+  for (const p of ['/api/gds/access-requests/status', '/api/gds/access-requests/invite', '/api/gds/access-requests/1']) {
+    assert.equal(isExempt(p, 'POST'), false, `POST ${p} must stay gated`);
+  }
+  // a method-BLIND entry is unchanged by the new shape: it still exempts any verb
+  assert.equal(isExempt('/healthz', 'POST'), true, 'a bare-RegExp entry ignores the verb');
+  assert.equal(isExempt('/api/gds/instance', 'GET'), true);
+});
+
 test('gated mode: an exempt path is never looked up, and a CORS preflight passes', async () => {
   let looked = 0;
   const mw = platformVisibilityGate({ isGated: () => true, resolveSession: async () => { looked += 1; return null; } });
@@ -272,6 +301,29 @@ test('booted gated: the door, the manifest, the probes and the downloads still a
   assert.doesNotMatch(dl.body, /Sign in to continue/);
 });
 
+// task 1003624, end to end on the booted app. The pack at the top of this file is
+// the composition that was broken: platformVisibility 'gated' AND joinability
+// 'apply'. The stranger's application must now reach the apply route; the owner's
+// queue on the same path must not.
+test('booted gated + apply: the application reaches the door it was refused at, and the owner queue does not', async () => {
+  for (const p of ['/api/gds/access-requests', '/api/bongos/access-requests', '/api/bongos/v1/access-requests']) {
+    const res = await request(p, { method: 'POST' });
+    assert.doesNotMatch(res.body, /Sign in to continue/, `POST ${p}: never the HTML door`);
+    // The route is reached, so whatever it answers is ITS answer (a bodiless POST
+    // is refused by the join door or by validation — both ahead of any query).
+    // What must not come back is the member door's own refusal.
+    let j = null;
+    try { j = JSON.parse(res.body); } catch { /* not JSON — asserted below */ }
+    assert.ok(j && j.error, `POST ${p}: the API envelope, from the route`);
+    assert.notEqual(j.error.code, 'unauthenticated', `POST ${p}: the member door must not answer first`);
+
+    // the same path, the owner's verb: still the member door
+    const q = await request(p, { method: 'GET' });
+    assert.equal(q.status, 401, `GET ${p}: the owner queue stays behind the member door`);
+    assert.equal(JSON.parse(q.body).error.code, 'unauthenticated');
+  }
+});
+
 test('booted gated: a bogus session cookie is not a member', async () => {
   // resolves to no session (or fails closed if there is no database here) —
   // either way the stranger stays outside