@bongos/core 1.19.803 → 1.19.805

package/src/bongos/routes/live.js

@@ -105,7 +105,7 @@ function streamLive(req, res, deps = {}) {
 function buildLiveRouter() {
   const router = express.Router();
 
-  // GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall.
+  // GET /api/bongos/live — SSE stream of Bongos state-change nudges for the hall.
   // rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense
   // in depth; the payload leaks nothing). Mirrors the room's #983 signed-in
   // gate. EventSource carries the gds_session cookie on this same-origin GET, so

package/src/bongos/routes/me.js

@@ -157,7 +157,7 @@ module.exports = function buildMeRouter() {
   // V3.R24 (#244): the `builder` payload now carries `karma` (migration 040
   // added the column + karma_log table). The field is surfaced by
   // db.getBuilderById() — no shape change here, just documenting that the
-  // /api/gds/me response is the canonical place clients read karma from.
+  // /api/bongos/me response is the canonical place clients read karma from.
   //
   // rank: any-builder — own identity + own contributions; preserved per CRITICAL §4.
   router.get('/me', auth.requireBuilder, async (req, res) => {
@@ -621,7 +621,7 @@ module.exports = function buildMeRouter() {
   // The five per-builder PREFERENCE routes — /me/skill-prefs, /me/sound-prefs,
   // /me/event-sound-prefs, /me/wandering, /me/render (GET + PATCH each) — moved to
   // modules/builder-settings/routes/settings.js (BV1.R80 / ADR 0093 §1). They keep
-  // their exact /me/* paths (the loader mounts that router on this same /api/gds
+  // their exact /me/* paths (the loader mounts that router on this same /api/bongos
   // router, before the public catch-all), so the API is byte-identical. The GET
   // /me aggregator above stays here as a thin facade resolving the
   // `builder-settings` port for its wandering/render/needs slices (02-module-map §2).

package/src/bongos/routes/modules.js

@@ -148,7 +148,7 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, key, enabled, note: 'Live on this box now. Persisting past the next deploy needs config/modules.json committed.' });
     }));
 
-  // POST /api/gds/modules/:key/submit — ADR 0107 §1 upstreaming submission.
+  // POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission.
   //
   // task 1770. Body: { signed_by?: "Name <email>" }. Re-runs the §4
   // AGPL/publish pre-check + requires a DCO-style sign-off against THIS box's
@@ -213,7 +213,7 @@ module.exports = function buildModulesRouter() {
       res.status(201).json({ ok: true, submission });
     }));
 
-  // GET /api/gds/modules/submissions?status=&module_key= — the upstreaming
+  // GET /api/bongos/modules/submissions?status=&module_key= — the upstreaming
   // review queue (task 1771 reads this). Metadata only — no file contents (a
   // future GET .../:id can add a with-files fetch if the review UI needs it).
   //

package/src/bongos/routes/public.js

@@ -115,7 +115,7 @@ module.exports = function buildPublicRouter() {
   // CORS for the public surface (ADR 0029 / #566): the off-box status page reads
   // these cross-origin. Read-only, no-auth, no-secret routes, so a static '*' is
   // safe; scoped to '/public' so it can't leak onto the authenticated routes on
-  // the same /api/gds base. No Vary:Origin — the ACAO never varies by origin.
+  // the same /api/bongos base. No Vary:Origin — the ACAO never varies by origin.
   // Shared middleware: corsPublicGet (_helpers.js) — byte-identical to analytics.js.
   router.use('/public', corsPublicGet('/public'));
 

package/src/bongos/routes/security.js

@@ -74,7 +74,7 @@ async function readFullAdr() {
 module.exports = function buildSecurityRouter() {
   const router = express.Router();
 
-  // GET /api/gds/security/adr
+  // GET /api/bongos/security/adr
   //
   // Metic+ only. Returns the full security ADR as { adr_md, source,
   // fetched_at } when the file is provisioned; otherwise 404 with a
@@ -125,7 +125,7 @@ module.exports = function buildSecurityRouter() {
   // now `permission_forbidden`, not `rank_forbidden`.
   // -----------------------------------------------------------------------
 
-  // GET /api/gds/security/docs — list doc METADATA (no content).
+  // GET /api/bongos/security/docs — list doc METADATA (no content).
   //
   // rank: archon — index of exploit-detail engagement reports. Gate:
   // requirePermission('security.report.adjudicate') — BV1.R104.
@@ -144,7 +144,7 @@ module.exports = function buildSecurityRouter() {
     }
   );
 
-  // GET /api/gds/security/docs/:slug — one doc WITH content, or 404.
+  // GET /api/bongos/security/docs/:slug — one doc WITH content, or 404.
   //
   // rank: archon — reads the full exploit-detail report body. Gate:
   // requirePermission('security.report.adjudicate') — BV1.R104.
@@ -177,7 +177,7 @@ module.exports = function buildSecurityRouter() {
     }
   );
 
-  // POST /api/gds/security/docs — upsert a doc by slug. The director uploads
+  // POST /api/bongos/security/docs — upsert a doc by slug. The director uploads
   // each dated engagement report here after deploy.
   //
   // Body: { slug, title, content_md }. content_md uses a large explicit cap

package/src/bongos/routes.js

@@ -108,7 +108,7 @@ function buildGdsRouter() {
   });
 
   // Audit middleware (V3.R35 #256) — attaches a res 'finish' hook so every
-  // authenticated POST/PATCH/PUT/DELETE under /api/gds is recorded in
+  // authenticated POST/PATCH/PUT/DELETE under /api/bongos is recorded in
   // audit_log AFTER the response is sent. It cannot fail the request: throws
   // are caught, DB errors are swallowed, and it never mutates req/res in a
   // way downstream handlers can see. Mounted BEFORE the feature routers so

package/src/bongos/serve-internal.js

@@ -2,7 +2,7 @@
 //
 // Mounts every non-game surface the platform serves onto an Express app:
 //   * /healthz + /version          — liveness + deployed-build info
-//   * /api/gds/*                    — the GDS API (buildGdsRouter)
+//   * /api/bongos/*                    — the GDS API (buildGdsRouter)
 //   * /downloads/devbox/*           — Dev Box installer redirect surface (#904)
 //   * generic module web-surface   — each enabled module's contributes.webSurfaces
 //     hosts                          served on its Host prefix by ONE generic static
@@ -179,7 +179,7 @@ function jsonForScript(value) {
 // the pack wins. Applied to the boot-time stamped HTML maps (the pack is a
 // boot-time singleton, computed once). Off-box surfaces that can't be
 // server-injected (the GitHub-Pages status page) read the same projection from
-// GET /api/gds/public/branding. Pure + exported for the unit test.
+// GET /api/bongos/public/branding. Pure + exported for the unit test.
 function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModules()) {
   // window.__MODULES__ — the enabled feature-module set (R54 task 1193, ADR 0062
   // §4), injected the same way as __BRANDING__ so hall/status scripts can hide
@@ -456,7 +456,7 @@ function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled:
 // builders.<apex> gets the builder surface (served by the hall-ui MODULE's web
 // surface, BV1.R85 — its DEDICATED block below); the apex host gets the game
 // (server.js) or — on a game-less instance — a plain 404 (platform-server.js). All
-// share the same process + the same /api/gds/* surface (mounted host-agnostically
+// share the same process + the same /api/bongos/* surface (mounted host-agnostically
 // below). The prefix checks are apex-agnostic (any domain), so no brand string lives
 // here. isStatusHost + isBuildersHost stay the literal "status."/"builders."
 // predicates the entrypoints (server.js/platform-server.js) use to keep their apex
@@ -830,7 +830,7 @@ function mountInternalSurfaces(app) {
   // clean path so the address bar never shows ".../builders". PAGE paths only —
   // the slug is [a-z0-9-]+ with no dot, so asset URLs the pages emit
   // (/builders/style.css, /builders/*.js, /builders/diagrams/*.png) and the API
-  // (/api/gds/builders/*) never match and pass through to the shim below.
+  // (/api/bongos/builders/*) never match and pass through to the shim below.
   const BUILDERS_CANONICAL_RE = /^\/builders(?:\/([a-z0-9-]+))?\/?$/i;
   app.use((req, res, next) => {
     if (!isBuildersHost(req)) return next();
@@ -1056,8 +1056,8 @@ function mountInternalSurfaces(app) {
   // read from BUILDERS_DIR. The module key is NOT named — the path is the
   // hall-ui module's public dir, resolved once here.
   //
-  // Auth is handled client-side: the page calls /api/gds/me; on 401 it redirects
-  // the browser to /api/gds/auth/web/start, which (per src/bongos/routes/auth.js)
+  // Auth is handled client-side: the page calls /api/bongos/me; on 401 it redirects
+  // the browser to /api/bongos/auth/web/start, which (per src/bongos/routes/auth.js)
   // loops back to /builders with a gds_session cookie set.
   const BUILDERS_DIR = path.join(ROOT, 'modules', 'hall-ui', 'public');
   const buildersStatic = express.static(BUILDERS_DIR, {

package/src/branding.js

@@ -206,7 +206,7 @@ function userAgent() {
 }
 
 // The CLIENT-SAFE projection of the resolved pack — the subset the browser is
-// allowed to see, served by GET /api/gds/public/branding and consumed by the
+// allowed to see, served by GET /api/bongos/public/branding and consumed by the
 // hall + status front-ends. Deliberately a small allow-list, NOT the whole pack:
 // origins, repo binding, db name, and env prefix are server-only and must never
 // reach the client. R56 (task 1195) seeded it with the configurable currency

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.803'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.805'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-seams.js

@@ -188,7 +188,7 @@ function listEvents() {
 //
 // Canonical extension points (the names core consumes):
 //   • 'profile.fields'  — server-side: each contributor is `async (ctx) => ({…slice})`;
-//                         the slices merge into the GET /api/gds/me payload.
+//                         the slices merge into the GET /api/bongos/me payload.
 //                         (The client settings-panel seam is its browser twin,
 //                          window.OTB.contributeSettingsPanel in dom-utils.js.)
 
@@ -240,7 +240,7 @@ async function collectContributions(point, ctx) {
 // a module's contribution can't clobber a core field). Mutates + returns `base`,
 // and reports any collided keys so the caller can surface them — that signals a
 // move task took over a core key without first removing the core copy. Used by
-// GET /api/gds/me to fold 'profile.fields' slices into the profile payload.
+// GET /api/bongos/me to fold 'profile.fields' slices into the profile payload.
 function mergeContributions(base, slices) {
   const collisions = [];
   for (const slice of slices || []) {

package/src/platform-server.js

@@ -7,7 +7,7 @@
 // WHAT IT SERVES — the entire internal surface, via the shared mount that
 // server.js also uses (so the two entrypoints never drift, ADR 0052):
 //   * /healthz + /version
-//   * /api/gds/*                 — the full GDS API (buildGdsRouter)
+//   * /api/bongos/*                 — the full GDS API (buildGdsRouter)
 //   * the status dashboard host  — modules/status-ui/public/ (the status-ui module's
 //                                  web surface, BV1.R84 — served by the loader seam)
 //   * the builders' hall host    — modules/hall-ui/public/ (the hall-ui module's
@@ -269,7 +269,7 @@ function buildPlatformApp() {
     });
   }
 
-  // Non-game tail. Anything that did not resolve to /api/gds, the status host,
+  // Non-game tail. Anything that did not resolve to /api/bongos, the status host,
   // or the builders' hall lands here. There is NO game to fall through to, so:
   //   * an API-shaped path gets a self-describing JSON 404 (never HTML), the
   //     same contract server.js gives so a mis-prefixed CLI call is legible;

package/tests/api_alias_exceptions.mjs

@@ -0,0 +1,67 @@
+// tests/api_alias_exceptions.mjs — the callers task 1003707 deliberately LEFT on
+// the permanent /api/gds alias, and the reason each one stays.
+//
+// WHY THIS FILE EXISTS. C3e moved every in-repo caller onto the canonical
+// /api/bongos. A handful were held back on purpose, and "on purpose" is the kind
+// of fact that survives exactly one sweep: the next agent greps for the old
+// spelling, sees four stragglers, tidies them, and discovers what they were for
+// when sign-in breaks. Each case below names its reason, so a future move has to
+// argue with the reason rather than with a leftover.
+//
+// The mount itself is asserted by tests/rename_history_restraint.mjs (structure)
+// and tests/api_path_404.mjs (dispatch — the alias is a live mount, so it gets no
+// corrective 404 hint). Only the ONE line that makes the alias permanent is
+// re-asserted here, because these exceptions are worthless without it.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const ALIAS = '/api/gds';
+
+test('the alias is still mounted — everything below depends on it', () => {
+  const { API_PREFIX, LEGACY_API_PREFIXES, ALL_API_PREFIXES } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
+  assert.equal(API_PREFIX, '/api/bongos', 'the canonical prefix is what in-repo callers now ask for');
+  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped Dev Box binaries and live dev boxes call the alias');
+  assert.ok(ALL_API_PREFIXES.includes(ALIAS), 'and the router still mounts it');
+});
+
+test('the OAuth callbacks stay on the alias — they are registered outside this repo', () => {
+  const auth = read('src/bongos/routes/auth.js');
+  // Changing either of these needs a matching edit in the GitHub / Discord app
+  // settings; a repo-only change silently breaks sign-in. Pin the lines that BUILD
+  // the redirect_uri, not a mention of the path — auth.js also names it in an error
+  // message, and matching that would keep this green with both builders rewritten.
+  const webBuilders = auth.split(`\${WEB_REDIRECT_ORIGIN}${ALIAS}/auth/web/callback`).length - 1;
+  assert.equal(webBuilders, 2, 'both GitHub redirect_uri builders stay on the alias (auth.js WEB_REDIRECT_ORIGIN)');
+  assert.ok(auth.includes(`\${DISCORD_REDIRECT_ORIGIN}${ALIAS}/auth/discord/callback`),
+    'Discord OAuth app callback (DISCORD_REDIRECT_URI)');
+  // The instance provisioner registers the same pinned path for every new instance.
+  assert.ok(read('modules/provisioning/provisioning.js').includes(`${ALIAS}/auth/web/callback`),
+    'a provisioned instance registers the pinned callback, not the canonical one');
+});
+
+test('the sign-in START href moved, and that is safe because the cookie is path-scoped to /', () => {
+  const auth = read('src/bongos/routes/auth.js');
+  assert.ok(auth.includes('/api/bongos/auth/web/start'), 'the start link asks for the canonical path');
+  assert.ok(/path: '\/'/.test(auth), 'the session cookie is set at path / — it reaches BOTH prefixes');
+});
+
+test('the uptime poller stays on the alias so production keeps exercising it', () => {
+  // If nothing in production ever calls the alias, its eventual breakage is
+  // discovered by a user rather than by us.
+  assert.ok(read('src/bongos/uptime-poller.js').includes(`${ALIAS}/healthz`),
+    'the poller is the one live caller that proves the alias answers');
+});
+
+test('a pasted API base is stripped whichever spelling it carries', () => {
+  const { normalizeInstanceBase } = require(path.join(ROOT, 'scripts', 'gds', 'login.js'));
+  for (const suffix of ['/api/bongos', '/api/bongos/v1', '/api/gds', '/api/gds/']) {
+    assert.equal(normalizeInstanceBase(`https://example.com${suffix}`), 'https://example.com', suffix);
+  }
+});

package/tests/application_echo.mjs

@@ -274,7 +274,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 let relay = { status: 201, body: { ok: true } };
 const realFetch = globalThis.fetch;
 globalThis.fetch = async (url) => {
-  if (String(url).endsWith('/api/gds/access-requests')) {
+  if (String(url).endsWith('/api/bongos/access-requests')) {
     if (relay === null) throw new Error('connection refused');
     return { status: relay.status, json: async () => relay.body };
   }
@@ -285,7 +285,7 @@ after(() => { globalThis.fetch = realFetch; });
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-app.use('/api/gds', myProjectsRoutes());
+app.use('/api/bongos', myProjectsRoutes());
 
 let server, port;
 before(async () => {
@@ -314,7 +314,7 @@ function call(method, pathname, body) {
     req.end(payload);
   });
 }
-const join = (note) => call('POST', '/api/gds/my-projects/join', { origin: 'https://target.example', note });
+const join = (note) => call('POST', '/api/bongos/my-projects/join', { origin: 'https://target.example', note });
 
 test('the interpreter refuses a predicate it cannot read — parameterised or not', () => {
   assert.throws(() => predicateFor('github_id = $1::bigint AND something = $2', [1, 2]), /unread predicate on \$2/);
@@ -391,7 +391,7 @@ test('a failed echo write never turns a filed application into a reported failur
 test('GET /my-projects reports what was applied to and when — and no status', async () => {
   seed();
   relay = { status: 201, body: { ok: true } };
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.equal(r.status, 200);
   const applied = r.json.applied;
   assert.deepEqual(applied.map((a) => a.client_id), ['proj-open', 'proj-invited'],
@@ -405,7 +405,7 @@ test('GET /my-projects reports what was applied to and when — and no status',
 
 test('a project the applicant now BUILDS on drops out of applied — membership is the approval signal', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined']);
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-joined'),
     'an approval becomes visible by the card flipping to member, never by the echo claiming it');
@@ -421,7 +421,7 @@ test('a project the applicant now BUILDS on drops out of applied — membership
 
 test('an echo older than the window is invisible, not deleted', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-stale'),
     'a declined application must not read as "applied" forever');
   assert.ok(echoes.some((e) => e.client_id === 'proj-stale'), 'and the row is still there — the window is read-time');
@@ -429,7 +429,7 @@ test('an echo older than the window is invisible, not deleted', async () => {
 
 test('the echo read is own-scope: another account’s row is never reachable', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-someone-elses'));
   const echoRead = statements.find((s) => /FROM platform_identity_application_echoes/.test(s.sql));
   assert.match(echoRead.sql, /WHERE e\.github_id = \$1::bigint/, 'keyed on the session, never on anything from the request');
@@ -444,12 +444,12 @@ test('the echo read is own-scope: another account’s row is never reachable', a
 test('leaving a project forgets the application that got you in', async () => {
   seed();
   assert.ok(echo('proj-joined'), 'precondition: the echo from the original application is still on file');
-  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  const left = await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.equal(left.status, 200);
   assert.equal(left.json.left, true);
   assert.equal(echo('proj-joined'), undefined, 'the echo goes with the membership');
 
-  const after = await call('GET', '/api/gds/my-projects');
+  const after = await call('GET', '/api/bongos/my-projects');
   assert.ok(!after.json.building.some((b) => b.client_id === 'proj-joined'));
   assert.ok(!after.json.applied.some((a) => a.client_id === 'proj-joined'),
     'and it does NOT come back as "applied" now that the membership no longer hides it');
@@ -457,7 +457,7 @@ test('leaving a project forgets the application that got you in', async () => {
 
 test('leaving forgets only the leaver’s own echo, for only that project', async () => {
   seed();
-  await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.ok(echo('proj-open'), 'a different project of mine is untouched');
   assert.ok(echoes.some((e) => e.client_id === 'proj-someone-elses'), 'and so is another account’s row');
 });
@@ -465,7 +465,7 @@ test('leaving forgets only the leaver’s own echo, for only that project', asyn
 test('a failed echo cleanup does not fail a leave that already happened', async () => {
   seed();
   echoFails = true;
-  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  const left = await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.equal(left.status, 200, 'the membership is already gone — the echo is a convenience, not the act');
   assert.equal(left.json.left, true);
 });
@@ -473,7 +473,7 @@ test('a failed echo cleanup does not fail a leave that already happened', async
 test('a failed echo read costs the applied list and nothing else', async () => {
   seed();
   echoFails = true;
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.equal(r.status, 200);
   assert.deepEqual(r.json.applied, []);
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined'], 'the memberships listing still lands');

package/tests/artifact_audit.mjs

@@ -171,7 +171,7 @@ await t('a finding is filed to the blocker surface, not only printed', async ()
   const call = async (method, path, body) => { sent.push({ method, path, body }); return { ok: true, status: 201, data: { blocker: { id: 42 } } }; };
   const r = await fileBlocker([{ id: '1003188', status: 'shipped', shipped_at: '2026-08-23', title: 'Go-live', touches: ['package.json'] }], { call });
   assert.equal(r.filed, true);
-  assert.equal(sent[0].path, '/api/gds/blockers');
+  assert.equal(sent[0].path, '/api/bongos/blockers');
   assert.equal(sent[0].body.source, 'artifact-audit');
   assert.match(sent[0].body.body_md, /task 1003188/);
 });

package/tests/auth_page_gate.mjs

@@ -74,7 +74,7 @@ await t('unauthenticated request → 302 to sign-in, next() NOT called', async (
   assert.equal(nexted, false, 'next() must not run for an unauthenticated request');
   assert.ok(res._redirect, 'a redirect must be issued');
   assert.equal(res._redirect.code, 302);
-  assert.equal(res._redirect.loc, '/api/gds/auth/web/start');
+  assert.equal(res._redirect.loc, '/api/bongos/auth/web/start');
 });
 
 await t('authenticated request → next() called, no redirect', async () => {
@@ -95,7 +95,7 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'must not serve the page when the lookup errors');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start',
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
@@ -118,7 +118,7 @@ await t('box-scoped session → 302 to sign-in even though its builder holds the
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'a box session must not be served a gated page shell');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start',
     'the remedy is a different session (/builder-reauth), so sign-in — not deniedTo');
 });
 
@@ -129,7 +129,7 @@ await t('a source the registry does not declare → denied, never treated as uns
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'an unrecognised scope must fail closed, exactly as requireBuilder does');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start');
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start');
 });
 
 await t('cli and web sessions are untouched by the scope check', async () => {

package/tests/auth_web_recovery.mjs

@@ -21,22 +21,22 @@ const req = (cookie) => ({ headers: cookie ? { cookie } : {} });
 
 test('the retry door carries the wizard return and the repo-scope opt-in while their cookies are valid', () => {
   assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew; gds_oauth_repos=1')),
-    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
+    '/api/bongos/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
   assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew')),
-    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
-  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/gds/auth/web/start?repos=1');
+    '/api/bongos/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/bongos/auth/web/start?repos=1');
 });
 
 test('with nothing left to rebuild from, the door is the bare start — never a guess', () => {
-  assert.equal(recoveryStartHref(req('')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/gds/auth/web/start', 'only the literal opt-in counts');
+  assert.equal(recoveryStartHref(req('')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/bongos/auth/web/start', 'only the literal opt-in counts');
 });
 
 test('the door is under the same open-redirect allowlist as the callback', () => {
-  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/bongos/auth/web/start');
 });
 
 test('every OAuth error page and the pending page rebuild their door from the cookies', () => {
@@ -47,8 +47,8 @@ test('every OAuth error page and the pending page rebuild their door from the co
     'GitHub refused · State mismatch · handshake threw — three pages, three doors');
   assert.match(callback, /renderAccessPendingPage\(err\.login, recoveryStartHref\(req\)\)/, 'the auto-walk-in lands where the founder was going');
   assert.match(callback, /const onWayToProject = founderReturn\.startsWith\('\/projects'\);/, 'the founder-shaped NOT_APPROVED note');
-  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/gds\/auth\/web\/start', label: copy\.ctaLabel \};/);
-  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/gds\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
+  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/bongos\/auth\/web\/start', label: copy\.ctaLabel \};/);
+  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/bongos\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
   assert.match(SRC, /function land\(\) \{ window\.location\.href = start; \}/);
 });
 

package/tests/bongos_login.mjs

@@ -16,12 +16,15 @@ const require = createRequire(import.meta.url);
 const { normalizeInstanceBase, pollDecision } = require('../scripts/gds/login.js');
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'gds', 'login.js');
 
-test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/gds', () => {
+test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/bongos', () => {
   assert.equal(normalizeInstanceBase('example.com'), 'https://example.com');
   assert.equal(normalizeInstanceBase('https://example.com/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('https://example.com///'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos/'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos/v1'), 'https://example.com');
+  // the permanent alias is still a legal paste — task 1003707 moved the callers, not the door
   assert.equal(normalizeInstanceBase('https://example.com/api/gds'), 'https://example.com');
-  assert.equal(normalizeInstanceBase('https://example.com/api/gds/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('http://localhost:3000'), 'http://localhost:3000');
 });
 
@@ -58,10 +61,10 @@ test('login on a Device-Flow-disabled instance explains the cause and the cure',
       res.writeHead(code, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(body));
     };
-    if (req.url.endsWith('/api/gds/instance')) {
+    if (req.url.endsWith('/api/bongos/instance')) {
       return send(200, { schema: 'instance-manifest/v1', name: 'Stub', admission: { policy: 'invite-only' } });
     }
-    if (req.url.endsWith('/api/gds/auth/device/start')) {
+    if (req.url.endsWith('/api/bongos/auth/device/start')) {
       // Byte-for-byte what a real instance returned when its App had the box unticked.
       return send(424, { error: { code: 'device_start_failed', message: 'device/code failed (400): {"error":"device_flow_disabled","error_description":"Device Flow must be explicitly enabled for this App"}' } });
     }

package/tests/box_env.mjs

@@ -20,15 +20,15 @@ const box = require('../scripts/gds/box.js');
 
 const { test, summary } = makeRunner();
 
-await test('bakes GDS_BASE as the FULL api base (origin + /api/gds) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
+await test('bakes GDS_BASE as the FULL api base (origin + /api/bongos) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
   const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
 });
 
-await test('strips a trailing slash off the origin before appending /api/gds', () => {
+await test('strips a trailing slash off the origin before appending /api/bongos', () => {
   const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com/' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
-  assert.ok(!env.includes('//api/gds'), 'must not double the slash');
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
+  assert.ok(!env.includes('//api/bongos'), 'must not double the slash');
 });
 
 await test('no named tunnel: box.env carries GDS_BASE and nothing else', () => {
@@ -44,7 +44,7 @@ await test('named tunnel: box.env carries GDS_BASE AND all four tunnel vars', ()
       credential: 'cred456', previewHostname: 'sandbox-alice.example.com',
     },
   });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
   assert.match(env, /^BOX_TUNNEL_TOKEN=tok123$/m);
   assert.match(env, /^BOX_TERMINAL_HOSTNAME=term-alice\.example\.com$/m);
   assert.match(env, /^BOX_TERMINAL_CREDENTIAL=cred456$/m);

package/tests/bug_attachments.mjs

@@ -101,7 +101,7 @@ await t('persistImageFromUrl: content-type says png but bytes are not → sniff_
 await t('persistImageFromUrl: valid PNG → written to disk, returns durable url', async () => {
   const r = await at.persistImageFromUrl('https://cdn.discordapp.com/a.png', { messageId: 'm42', fetchImpl: fakeFetch(PNG), dir: TMP });
   assert.equal(r.ok, true);
-  assert.match(r.url, /^\/api\/gds\/bug-attachments\/bug-m42-[0-9a-f]{16}\.png$/);
+  assert.match(r.url, /^\/api\/bongos\/bug-attachments\/bug-m42-[0-9a-f]{16}\.png$/);
   assert.equal(at.isSafeName(r.file), true);
   const onDisk = await fs.readFile(path.join(TMP, r.file));
   assert.equal(onDisk.length, PNG.length);

package/tests/cli_sessions.mjs

@@ -259,7 +259,7 @@ test('login VERIFIES a stored token before trusting it, and can be forced past',
   // A stored token may be expired or revoked. Reinstating one unchecked would leave the builder
   // "signed in" to a session every later command then fails on.
   assert.match(src, /loadStoredSession\(base\)/);
-  assert.match(src, /\/api\/gds\/me`, \{ headers: \{ Authorization/);
+  assert.match(src, /\/api\/bongos\/me`, \{ headers: \{ Authorization/);
   assert.match(src, /if \(me\.ok && me\.data && me\.data\.builder\)/);
   assert.match(src, /--force/, 'there must be a way to sign in as somebody else');
 });

package/tests/dev_lib.mjs

@@ -211,7 +211,7 @@ t('stop: kills a live pid, reports not-running otherwise', () => {
 await ta('health: up + authConfigured parsed from the two healthz routes', async () => {
   const params = { port: 3006 };
   const deps = { fetchImpl: async (url) => {
-    if (url.endsWith('/api/gds/healthz')) return { status: 200, json: async () => ({ ok: true, auth_configured: true }) };
+    if (url.endsWith('/api/bongos/healthz')) return { status: 200, json: async () => ({ ok: true, auth_configured: true }) };
     if (url.endsWith('/healthz')) return { status: 200 };
     return { status: 404 };
   } };

package/tests/discord_bugs.mjs

@@ -99,7 +99,7 @@ function makeDeps(over = {}) {
       calls.persist.push({ urls, opts });
       if (over.persistThrows) throw new Error('persist boom');
       // default: echo each url back as a stored ref unless overridden
-      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/gds/bug-attachments/bug-x-${i}.png` }));
+      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/bongos/bug-attachments/bug-x-${i}.png` }));
     },
   };
   return { deps, calls };
@@ -282,7 +282,7 @@ await t('recordInboundBug: text + images → persists images + embeds durable li
   assert.equal(calls.persist.length, 1);
   assert.deepEqual(calls.persist[0].urls, ['https://cdn.discordapp.com/a.png']);
   assert.match(calls.create[0].bodyMd, /Attachments \(1\)/);
-  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/bongos\/bug-attachments\//);
 });
 
 await t('recordInboundBug: image-only (empty text) → filed with screenshot title', async () => {

package/tests/discord_inbound.mjs

@@ -71,7 +71,7 @@ function makeDeps(over = {}) {
     persistImages: async (urls, opts) => {
       calls.persist.push({ urls, opts });
       if (over.persistThrows) throw new Error('persist boom');
-      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/gds/bug-attachments/bug-x-${i}.png` }));
+      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/bongos/bug-attachments/bug-x-${i}.png` }));
     },
   };
   return { deps, calls };
@@ -224,7 +224,7 @@ await t('recordInboundIdea: text + images → persists + embeds durable links',
   assert.equal(r.images, 1);
   assert.equal(calls.persist.length, 1);
   assert.match(calls.capture[0].bodyMd, /Attachments \(1\)/);
-  assert.match(calls.capture[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.capture[0].bodyMd, /!\[attachment 1\]\(\/api\/bongos\/bug-attachments\//);
 });
 
 await t('recordInboundIdea: UNLINKED author with image → still re-hosted (guards, not identity)', async () => {

package/tests/explore_visible_states.mjs

@@ -280,6 +280,6 @@ test('the page reads the public feed and asks for JSON', async () => {
   const r = render([]);
   await settle();
   assert.equal(r.requests.length, 1);
-  assert.equal(r.requests[0].url, '/api/gds/projects/featured');
+  assert.equal(r.requests[0].url, '/api/bongos/projects/featured');
   assert.equal(r.requests[0].opts.headers.Accept, 'application/json');
 });