@bongos/core 1.19.804 → 1.19.805

package/tests/api_alias_exceptions.mjs

@@ -0,0 +1,67 @@
+// tests/api_alias_exceptions.mjs — the callers task 1003707 deliberately LEFT on
+// the permanent /api/gds alias, and the reason each one stays.
+//
+// WHY THIS FILE EXISTS. C3e moved every in-repo caller onto the canonical
+// /api/bongos. A handful were held back on purpose, and "on purpose" is the kind
+// of fact that survives exactly one sweep: the next agent greps for the old
+// spelling, sees four stragglers, tidies them, and discovers what they were for
+// when sign-in breaks. Each case below names its reason, so a future move has to
+// argue with the reason rather than with a leftover.
+//
+// The mount itself is asserted by tests/rename_history_restraint.mjs (structure)
+// and tests/api_path_404.mjs (dispatch — the alias is a live mount, so it gets no
+// corrective 404 hint). Only the ONE line that makes the alias permanent is
+// re-asserted here, because these exceptions are worthless without it.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const ALIAS = '/api/gds';
+
+test('the alias is still mounted — everything below depends on it', () => {
+  const { API_PREFIX, LEGACY_API_PREFIXES, ALL_API_PREFIXES } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
+  assert.equal(API_PREFIX, '/api/bongos', 'the canonical prefix is what in-repo callers now ask for');
+  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped Dev Box binaries and live dev boxes call the alias');
+  assert.ok(ALL_API_PREFIXES.includes(ALIAS), 'and the router still mounts it');
+});
+
+test('the OAuth callbacks stay on the alias — they are registered outside this repo', () => {
+  const auth = read('src/bongos/routes/auth.js');
+  // Changing either of these needs a matching edit in the GitHub / Discord app
+  // settings; a repo-only change silently breaks sign-in. Pin the lines that BUILD
+  // the redirect_uri, not a mention of the path — auth.js also names it in an error
+  // message, and matching that would keep this green with both builders rewritten.
+  const webBuilders = auth.split(`\${WEB_REDIRECT_ORIGIN}${ALIAS}/auth/web/callback`).length - 1;
+  assert.equal(webBuilders, 2, 'both GitHub redirect_uri builders stay on the alias (auth.js WEB_REDIRECT_ORIGIN)');
+  assert.ok(auth.includes(`\${DISCORD_REDIRECT_ORIGIN}${ALIAS}/auth/discord/callback`),
+    'Discord OAuth app callback (DISCORD_REDIRECT_URI)');
+  // The instance provisioner registers the same pinned path for every new instance.
+  assert.ok(read('modules/provisioning/provisioning.js').includes(`${ALIAS}/auth/web/callback`),
+    'a provisioned instance registers the pinned callback, not the canonical one');
+});
+
+test('the sign-in START href moved, and that is safe because the cookie is path-scoped to /', () => {
+  const auth = read('src/bongos/routes/auth.js');
+  assert.ok(auth.includes('/api/bongos/auth/web/start'), 'the start link asks for the canonical path');
+  assert.ok(/path: '\/'/.test(auth), 'the session cookie is set at path / — it reaches BOTH prefixes');
+});
+
+test('the uptime poller stays on the alias so production keeps exercising it', () => {
+  // If nothing in production ever calls the alias, its eventual breakage is
+  // discovered by a user rather than by us.
+  assert.ok(read('src/bongos/uptime-poller.js').includes(`${ALIAS}/healthz`),
+    'the poller is the one live caller that proves the alias answers');
+});
+
+test('a pasted API base is stripped whichever spelling it carries', () => {
+  const { normalizeInstanceBase } = require(path.join(ROOT, 'scripts', 'gds', 'login.js'));
+  for (const suffix of ['/api/bongos', '/api/bongos/v1', '/api/gds', '/api/gds/']) {
+    assert.equal(normalizeInstanceBase(`https://example.com${suffix}`), 'https://example.com', suffix);
+  }
+});

package/tests/application_echo.mjs

@@ -274,7 +274,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 let relay = { status: 201, body: { ok: true } };
 const realFetch = globalThis.fetch;
 globalThis.fetch = async (url) => {
-  if (String(url).endsWith('/api/gds/access-requests')) {
+  if (String(url).endsWith('/api/bongos/access-requests')) {
     if (relay === null) throw new Error('connection refused');
     return { status: relay.status, json: async () => relay.body };
   }
@@ -285,7 +285,7 @@ after(() => { globalThis.fetch = realFetch; });
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-app.use('/api/gds', myProjectsRoutes());
+app.use('/api/bongos', myProjectsRoutes());
 
 let server, port;
 before(async () => {
@@ -314,7 +314,7 @@ function call(method, pathname, body) {
     req.end(payload);
   });
 }
-const join = (note) => call('POST', '/api/gds/my-projects/join', { origin: 'https://target.example', note });
+const join = (note) => call('POST', '/api/bongos/my-projects/join', { origin: 'https://target.example', note });
 
 test('the interpreter refuses a predicate it cannot read — parameterised or not', () => {
   assert.throws(() => predicateFor('github_id = $1::bigint AND something = $2', [1, 2]), /unread predicate on \$2/);
@@ -391,7 +391,7 @@ test('a failed echo write never turns a filed application into a reported failur
 test('GET /my-projects reports what was applied to and when — and no status', async () => {
   seed();
   relay = { status: 201, body: { ok: true } };
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.equal(r.status, 200);
   const applied = r.json.applied;
   assert.deepEqual(applied.map((a) => a.client_id), ['proj-open', 'proj-invited'],
@@ -405,7 +405,7 @@ test('GET /my-projects reports what was applied to and when — and no status',
 
 test('a project the applicant now BUILDS on drops out of applied — membership is the approval signal', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined']);
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-joined'),
     'an approval becomes visible by the card flipping to member, never by the echo claiming it');
@@ -421,7 +421,7 @@ test('a project the applicant now BUILDS on drops out of applied — membership
 
 test('an echo older than the window is invisible, not deleted', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-stale'),
     'a declined application must not read as "applied" forever');
   assert.ok(echoes.some((e) => e.client_id === 'proj-stale'), 'and the row is still there — the window is read-time');
@@ -429,7 +429,7 @@ test('an echo older than the window is invisible, not deleted', async () => {
 
 test('the echo read is own-scope: another account’s row is never reachable', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-someone-elses'));
   const echoRead = statements.find((s) => /FROM platform_identity_application_echoes/.test(s.sql));
   assert.match(echoRead.sql, /WHERE e\.github_id = \$1::bigint/, 'keyed on the session, never on anything from the request');
@@ -444,12 +444,12 @@ test('the echo read is own-scope: another account’s row is never reachable', a
 test('leaving a project forgets the application that got you in', async () => {
   seed();
   assert.ok(echo('proj-joined'), 'precondition: the echo from the original application is still on file');
-  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  const left = await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.equal(left.status, 200);
   assert.equal(left.json.left, true);
   assert.equal(echo('proj-joined'), undefined, 'the echo goes with the membership');
 
-  const after = await call('GET', '/api/gds/my-projects');
+  const after = await call('GET', '/api/bongos/my-projects');
   assert.ok(!after.json.building.some((b) => b.client_id === 'proj-joined'));
   assert.ok(!after.json.applied.some((a) => a.client_id === 'proj-joined'),
     'and it does NOT come back as "applied" now that the membership no longer hides it');
@@ -457,7 +457,7 @@ test('leaving a project forgets the application that got you in', async () => {
 
 test('leaving forgets only the leaver’s own echo, for only that project', async () => {
   seed();
-  await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.ok(echo('proj-open'), 'a different project of mine is untouched');
   assert.ok(echoes.some((e) => e.client_id === 'proj-someone-elses'), 'and so is another account’s row');
 });
@@ -465,7 +465,7 @@ test('leaving forgets only the leaver’s own echo, for only that project', asyn
 test('a failed echo cleanup does not fail a leave that already happened', async () => {
   seed();
   echoFails = true;
-  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  const left = await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.equal(left.status, 200, 'the membership is already gone — the echo is a convenience, not the act');
   assert.equal(left.json.left, true);
 });
@@ -473,7 +473,7 @@ test('a failed echo cleanup does not fail a leave that already happened', async
 test('a failed echo read costs the applied list and nothing else', async () => {
   seed();
   echoFails = true;
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.equal(r.status, 200);
   assert.deepEqual(r.json.applied, []);
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined'], 'the memberships listing still lands');

package/tests/artifact_audit.mjs

@@ -171,7 +171,7 @@ await t('a finding is filed to the blocker surface, not only printed', async ()
   const call = async (method, path, body) => { sent.push({ method, path, body }); return { ok: true, status: 201, data: { blocker: { id: 42 } } }; };
   const r = await fileBlocker([{ id: '1003188', status: 'shipped', shipped_at: '2026-08-23', title: 'Go-live', touches: ['package.json'] }], { call });
   assert.equal(r.filed, true);
-  assert.equal(sent[0].path, '/api/gds/blockers');
+  assert.equal(sent[0].path, '/api/bongos/blockers');
   assert.equal(sent[0].body.source, 'artifact-audit');
   assert.match(sent[0].body.body_md, /task 1003188/);
 });

package/tests/auth_page_gate.mjs

@@ -74,7 +74,7 @@ await t('unauthenticated request → 302 to sign-in, next() NOT called', async (
   assert.equal(nexted, false, 'next() must not run for an unauthenticated request');
   assert.ok(res._redirect, 'a redirect must be issued');
   assert.equal(res._redirect.code, 302);
-  assert.equal(res._redirect.loc, '/api/gds/auth/web/start');
+  assert.equal(res._redirect.loc, '/api/bongos/auth/web/start');
 });
 
 await t('authenticated request → next() called, no redirect', async () => {
@@ -95,7 +95,7 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'must not serve the page when the lookup errors');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start',
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
@@ -118,7 +118,7 @@ await t('box-scoped session → 302 to sign-in even though its builder holds the
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'a box session must not be served a gated page shell');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start',
     'the remedy is a different session (/builder-reauth), so sign-in — not deniedTo');
 });
 
@@ -129,7 +129,7 @@ await t('a source the registry does not declare → denied, never treated as uns
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'an unrecognised scope must fail closed, exactly as requireBuilder does');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start');
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start');
 });
 
 await t('cli and web sessions are untouched by the scope check', async () => {

package/tests/auth_web_recovery.mjs

@@ -21,22 +21,22 @@ const req = (cookie) => ({ headers: cookie ? { cookie } : {} });
 
 test('the retry door carries the wizard return and the repo-scope opt-in while their cookies are valid', () => {
   assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew; gds_oauth_repos=1')),
-    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
+    '/api/bongos/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
   assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew')),
-    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
-  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/gds/auth/web/start?repos=1');
+    '/api/bongos/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/bongos/auth/web/start?repos=1');
 });
 
 test('with nothing left to rebuild from, the door is the bare start — never a guess', () => {
-  assert.equal(recoveryStartHref(req('')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/gds/auth/web/start', 'only the literal opt-in counts');
+  assert.equal(recoveryStartHref(req('')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/bongos/auth/web/start', 'only the literal opt-in counts');
 });
 
 test('the door is under the same open-redirect allowlist as the callback', () => {
-  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/bongos/auth/web/start');
 });
 
 test('every OAuth error page and the pending page rebuild their door from the cookies', () => {
@@ -47,8 +47,8 @@ test('every OAuth error page and the pending page rebuild their door from the co
     'GitHub refused · State mismatch · handshake threw — three pages, three doors');
   assert.match(callback, /renderAccessPendingPage\(err\.login, recoveryStartHref\(req\)\)/, 'the auto-walk-in lands where the founder was going');
   assert.match(callback, /const onWayToProject = founderReturn\.startsWith\('\/projects'\);/, 'the founder-shaped NOT_APPROVED note');
-  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/gds\/auth\/web\/start', label: copy\.ctaLabel \};/);
-  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/gds\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
+  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/bongos\/auth\/web\/start', label: copy\.ctaLabel \};/);
+  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/bongos\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
   assert.match(SRC, /function land\(\) \{ window\.location\.href = start; \}/);
 });
 

package/tests/bongos_login.mjs

@@ -16,12 +16,15 @@ const require = createRequire(import.meta.url);
 const { normalizeInstanceBase, pollDecision } = require('../scripts/gds/login.js');
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'gds', 'login.js');
 
-test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/gds', () => {
+test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/bongos', () => {
   assert.equal(normalizeInstanceBase('example.com'), 'https://example.com');
   assert.equal(normalizeInstanceBase('https://example.com/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('https://example.com///'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos/'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos/v1'), 'https://example.com');
+  // the permanent alias is still a legal paste — task 1003707 moved the callers, not the door
   assert.equal(normalizeInstanceBase('https://example.com/api/gds'), 'https://example.com');
-  assert.equal(normalizeInstanceBase('https://example.com/api/gds/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('http://localhost:3000'), 'http://localhost:3000');
 });
 
@@ -58,10 +61,10 @@ test('login on a Device-Flow-disabled instance explains the cause and the cure',
       res.writeHead(code, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(body));
     };
-    if (req.url.endsWith('/api/gds/instance')) {
+    if (req.url.endsWith('/api/bongos/instance')) {
       return send(200, { schema: 'instance-manifest/v1', name: 'Stub', admission: { policy: 'invite-only' } });
     }
-    if (req.url.endsWith('/api/gds/auth/device/start')) {
+    if (req.url.endsWith('/api/bongos/auth/device/start')) {
       // Byte-for-byte what a real instance returned when its App had the box unticked.
       return send(424, { error: { code: 'device_start_failed', message: 'device/code failed (400): {"error":"device_flow_disabled","error_description":"Device Flow must be explicitly enabled for this App"}' } });
     }

package/tests/box_env.mjs

@@ -20,15 +20,15 @@ const box = require('../scripts/gds/box.js');
 
 const { test, summary } = makeRunner();
 
-await test('bakes GDS_BASE as the FULL api base (origin + /api/gds) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
+await test('bakes GDS_BASE as the FULL api base (origin + /api/bongos) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
   const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
 });
 
-await test('strips a trailing slash off the origin before appending /api/gds', () => {
+await test('strips a trailing slash off the origin before appending /api/bongos', () => {
   const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com/' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
-  assert.ok(!env.includes('//api/gds'), 'must not double the slash');
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
+  assert.ok(!env.includes('//api/bongos'), 'must not double the slash');
 });
 
 await test('no named tunnel: box.env carries GDS_BASE and nothing else', () => {
@@ -44,7 +44,7 @@ await test('named tunnel: box.env carries GDS_BASE AND all four tunnel vars', ()
       credential: 'cred456', previewHostname: 'sandbox-alice.example.com',
     },
   });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
   assert.match(env, /^BOX_TUNNEL_TOKEN=tok123$/m);
   assert.match(env, /^BOX_TERMINAL_HOSTNAME=term-alice\.example\.com$/m);
   assert.match(env, /^BOX_TERMINAL_CREDENTIAL=cred456$/m);

package/tests/bug_attachments.mjs

@@ -101,7 +101,7 @@ await t('persistImageFromUrl: content-type says png but bytes are not → sniff_
 await t('persistImageFromUrl: valid PNG → written to disk, returns durable url', async () => {
   const r = await at.persistImageFromUrl('https://cdn.discordapp.com/a.png', { messageId: 'm42', fetchImpl: fakeFetch(PNG), dir: TMP });
   assert.equal(r.ok, true);
-  assert.match(r.url, /^\/api\/gds\/bug-attachments\/bug-m42-[0-9a-f]{16}\.png$/);
+  assert.match(r.url, /^\/api\/bongos\/bug-attachments\/bug-m42-[0-9a-f]{16}\.png$/);
   assert.equal(at.isSafeName(r.file), true);
   const onDisk = await fs.readFile(path.join(TMP, r.file));
   assert.equal(onDisk.length, PNG.length);

package/tests/cli_sessions.mjs

@@ -259,7 +259,7 @@ test('login VERIFIES a stored token before trusting it, and can be forced past',
   // A stored token may be expired or revoked. Reinstating one unchecked would leave the builder
   // "signed in" to a session every later command then fails on.
   assert.match(src, /loadStoredSession\(base\)/);
-  assert.match(src, /\/api\/gds\/me`, \{ headers: \{ Authorization/);
+  assert.match(src, /\/api\/bongos\/me`, \{ headers: \{ Authorization/);
   assert.match(src, /if \(me\.ok && me\.data && me\.data\.builder\)/);
   assert.match(src, /--force/, 'there must be a way to sign in as somebody else');
 });

package/tests/dev_lib.mjs

@@ -211,7 +211,7 @@ t('stop: kills a live pid, reports not-running otherwise', () => {
 await ta('health: up + authConfigured parsed from the two healthz routes', async () => {
   const params = { port: 3006 };
   const deps = { fetchImpl: async (url) => {
-    if (url.endsWith('/api/gds/healthz')) return { status: 200, json: async () => ({ ok: true, auth_configured: true }) };
+    if (url.endsWith('/api/bongos/healthz')) return { status: 200, json: async () => ({ ok: true, auth_configured: true }) };
     if (url.endsWith('/healthz')) return { status: 200 };
     return { status: 404 };
   } };

package/tests/discord_bugs.mjs

@@ -99,7 +99,7 @@ function makeDeps(over = {}) {
       calls.persist.push({ urls, opts });
       if (over.persistThrows) throw new Error('persist boom');
       // default: echo each url back as a stored ref unless overridden
-      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/gds/bug-attachments/bug-x-${i}.png` }));
+      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/bongos/bug-attachments/bug-x-${i}.png` }));
     },
   };
   return { deps, calls };
@@ -282,7 +282,7 @@ await t('recordInboundBug: text + images → persists images + embeds durable li
   assert.equal(calls.persist.length, 1);
   assert.deepEqual(calls.persist[0].urls, ['https://cdn.discordapp.com/a.png']);
   assert.match(calls.create[0].bodyMd, /Attachments \(1\)/);
-  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/bongos\/bug-attachments\//);
 });
 
 await t('recordInboundBug: image-only (empty text) → filed with screenshot title', async () => {

package/tests/discord_inbound.mjs

@@ -71,7 +71,7 @@ function makeDeps(over = {}) {
     persistImages: async (urls, opts) => {
       calls.persist.push({ urls, opts });
       if (over.persistThrows) throw new Error('persist boom');
-      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/gds/bug-attachments/bug-x-${i}.png` }));
+      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/bongos/bug-attachments/bug-x-${i}.png` }));
     },
   };
   return { deps, calls };
@@ -224,7 +224,7 @@ await t('recordInboundIdea: text + images → persists + embeds durable links',
   assert.equal(r.images, 1);
   assert.equal(calls.persist.length, 1);
   assert.match(calls.capture[0].bodyMd, /Attachments \(1\)/);
-  assert.match(calls.capture[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.capture[0].bodyMd, /!\[attachment 1\]\(\/api\/bongos\/bug-attachments\//);
 });
 
 await t('recordInboundIdea: UNLINKED author with image → still re-hosted (guards, not identity)', async () => {

package/tests/explore_visible_states.mjs

@@ -280,6 +280,6 @@ test('the page reads the public feed and asks for JSON', async () => {
   const r = render([]);
   await settle();
   assert.equal(r.requests.length, 1);
-  assert.equal(r.requests[0].url, '/api/gds/projects/featured');
+  assert.equal(r.requests[0].url, '/api/bongos/projects/featured');
   assert.equal(r.requests[0].opts.headers.Accept, 'application/json');
 });

package/tests/government_page_gates.mjs

@@ -98,7 +98,7 @@ const GATE_FLOOR = {
   // ADR 0157: `page.view.government` floor archon→metic.
   requireGovernmentPage: 'metic',
 };
-const SIGN_IN = '/api/gds/auth/web/start';
+const SIGN_IN = '/api/bongos/auth/web/start';
 
 // --- doubles ----------------------------------------------------------------
 function fakeRes() {

package/tests/hall_reference_world.mjs

@@ -241,7 +241,7 @@ const costSummaryFixture = JSON.parse(
 test('the treasury reads the endpoint that already carried the series — no new route', () => {
   // The whole point of the task: the payload had both series all along, and the
   // route's own comment calls daily[] "the treasury chart's cumulative line".
-  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/gds\/public\/cost-summary'/);
+  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/bongos\/public\/cost-summary'/);
   assert.ok(costSummaryFixture.daily.length, 'the payload really carries daily[]');
   assert.ok(costSummaryFixture.daily_credits.length, 'and daily_credits[]');
   assert.ok(Number(costSummaryFixture.total_usd) > 0, 'and the totals the prose states');

package/tests/idea_ideate_full.mjs

@@ -93,7 +93,7 @@ test('it describes NO second write path', () => {
   // ends up sending a different payload than the form does, and the two records
   // drift while both claim to be Full Ideas.
   assert.ok(!/curl/i.test(SKILL), 'no hand-rolled HTTP');
-  assert.ok(!/api\.js POST \/api\/gds\/inbox/.test(SKILL), 'no raw POST for filing an idea');
+  assert.ok(!/api\.js POST \/api\/bongos\/inbox/.test(SKILL), 'no raw POST for filing an idea');
   const grade = [...SKILL.matchAll(/grade\s*=\s*'([a-z]+)'/g)].map((m) => m[1]);
   assert.ok(grade.every((g) => g === 'full'), `only the full grade is named: ${JSON.stringify(grade)}`);
 });

package/tests/idp_federation.mjs

@@ -29,7 +29,7 @@ t('builds the hub /sso/authorize URL with client_id, redirect_uri, state', () =>
   const url = auth.idpAuthorizeUrl('https://cloudbongos.com', 'client-abc', 'st8', 'https://proj.example.com/api/gds/auth/web/callback');
   const u = new URL(url);
   assert.equal(u.origin, 'https://cloudbongos.com');
-  assert.equal(u.pathname, '/api/gds/sso/authorize');
+  assert.equal(u.pathname, '/api/bongos/sso/authorize');
   assert.equal(u.searchParams.get('client_id'), 'client-abc');
   assert.equal(u.searchParams.get('redirect_uri'), 'https://proj.example.com/api/gds/auth/web/callback');
   assert.equal(u.searchParams.get('state'), 'st8');
@@ -37,7 +37,7 @@ t('builds the hub /sso/authorize URL with client_id, redirect_uri, state', () =>
 
 t('trims a trailing slash on the hub origin', () => {
   const url = auth.idpAuthorizeUrl('https://cloudbongos.com/', 'c', 's', 'https://p/cb');
-  assert.equal(new URL(url).pathname, '/api/gds/sso/authorize');
+  assert.equal(new URL(url).pathname, '/api/bongos/sso/authorize');
   assert.ok(!url.includes('com//api'), 'no double slash between origin and path');
 });
 

package/tests/llm-cache.mjs

@@ -88,7 +88,7 @@ await arun('lookup: routes to apiCall on a HIT (right method/path/args)', async
   const r = await c.lookup(KEY, { tokensSavedEst: 12 });
   assert.equal(r.result_stdout, 'X');
   assert.equal(calls[0][0], 'POST');
-  assert.equal(calls[0][1], '/api/gds/llm-cache/lookup');
+  assert.equal(calls[0][1], '/api/bongos/llm-cache/lookup');
   assert.deepEqual(calls[0][2], { cache_key: KEY, tokens_saved_est: 12 });
   assert.deepEqual(calls[0][3], { allowUnauthenticated: true });
 });

package/tests/manage_manifest_shared_read.mjs

@@ -2,7 +2,7 @@
 // manifest per manage entry, EXECUTED (task 1003554).
 //
 // The defect this pins shut: entering /projects?view=manage fetched
-// https://<project>/api/gds/instance twice, identically and cross-origin,
+// https://<project>/api/bongos/instance twice, identically and cross-origin,
 // because the two cards that render a "what it runs right now" line — how the
 // project is reached (brand.project.platformVisibility) and how people join
 // (brand.project.joinability) — each asked the project for themselves. Two
@@ -99,7 +99,7 @@ test('the two cards of one manage entry cost ONE round trip, not two', async ()
 
   // Assert
   assert.equal(ui.requests.length, 1, 'one cross-origin GET served both lines');
-  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/gds/instance');
+  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/bongos/instance');
   assert.equal(ui.requests[0].mode, 'cors', 'the project is somebody else’s origin');
   for (const a of answers) {
     assert.equal(a.ok, true);
@@ -151,7 +151,7 @@ test('switching projects is never served the previous project’s manifest', asy
 
   // Assert
   assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
-  assert.equal(ui.requests[1].url, 'https://two.example.com/api/gds/instance');
+  assert.equal(ui.requests[1].url, 'https://two.example.com/api/bongos/instance');
 });
 
 test('a project that answered-and-refused RESOLVES carrying its status — both lines can say so', async () => {

package/tests/people_directory_clip.mjs

@@ -150,7 +150,7 @@ await test('the page asks for exactly the ceiling, and asks for it ONCE', async
   const h = harness({ count: 3 });
   await tick(); await tick();
   assert.equal(h.requests.length, 1, 'one directory read');
-  assert.match(h.requests[0], /\/api\/gds\/scouting\?limit=/);
+  assert.match(h.requests[0], /\/api\/bongos\/scouting\?limit=/);
   const limit = Number(new URLSearchParams(h.requests[0].split('?')[1]).get('limit'));
   assert.equal(limit, CEILING, `the page must ask for the route ceiling (${CEILING})`);
 });

package/tests/planning_session_skill.mjs

@@ -31,7 +31,7 @@ function test(name, fn) {
 test('the seeding contract documents the self-check convention', () => {
   assert.ok(NORM.includes('verifySeedCriteriaLinks'), 'names the helper function');
   assert.ok(NORM.includes('seed-verify-criteria.js'), 'names the shared helper file');
-  assert.ok(NORM.includes('GET /api/gds/goals/<id>'), 'names the endpoint the self-check fetches');
+  assert.ok(NORM.includes('GET /api/bongos/goals/<id>'), 'names the endpoint the self-check fetches');
 });
 
 test('the self-check is described as failing loudly on any mismatch, zero included', () => {

package/tests/platform_visibility_gate.mjs

@@ -85,7 +85,7 @@ test('gated mode: a stranger meets the door on a page, with the way in on it', a
   assert.equal(nexted, false);
   assert.equal(res.statusCode, 401, 'a refused knock is a 401, not a 200 or a redirect');
   assert.match(res.body, /Sign in/, 'the door carries the way in');
-  assert.match(res.body, /href="\/api\/gds\/auth\/web\/start\?return=%2Fprojects%3Fview%3Dmap"/,
+  assert.match(res.body, /href="\/api\/bongos\/auth\/web\/start\?return=%2Fprojects%3Fview%3Dmap"/,
     'the sign-in start returns the member to the page they knocked on — RELATIVE, which safeReturnTo honours everywhere');
   assert.match(res.body, /Spike Harbor/, 'it names the project');
   assert.match(res.body, /noindex/, 'a members-only project is not indexed');
@@ -172,7 +172,7 @@ test('the exempt list: the door, the manifest, the probes, the downloads — on
     '/api/bongos/v1/public/progress', '/api/gds/instance/anything', '/instance', '/healthzz', '/downloads',
     '/api/other/instance', '/api/bongos/provisioning/instances',
     // the apply door is METHOD-scoped, so the bare path — no verb — is not exempt
-    '/api/gds/access-requests', '/api/gds/access-requests/status',
+    '/api/bongos/access-requests', '/api/bongos/access-requests/status',
   ]) assert.equal(isExempt(p), false, `${p} must be gated`);
 });
 
@@ -184,7 +184,7 @@ test('the apply door: POST <api>/access-requests answers a stranger — and only
   for (const p of [
     '/api/gds/access-requests', '/api/bongos/access-requests', '/api/bongos/v1/access-requests',
     // the router's own tolerances, the same ones the rest of the list is held to
-    '/API/BONGOS/ACCESS-REQUESTS', '/api/gds/access-requests/',
+    '/API/BONGOS/ACCESS-REQUESTS', '/api/bongos/access-requests/',
   ]) assert.equal(isExempt(p, 'POST'), true, `POST ${p} must reach the apply route`);
 
   // The bare GET on that path is the OWNER'S QUEUE (requireBuilder +
@@ -192,15 +192,15 @@ test('the apply door: POST <api>/access-requests answers a stranger — and only
   // in front of it regardless — an exemption that ignored the verb would have
   // silently removed a layer from the queue that lists would-be builders by name.
   for (const m of ['GET', 'HEAD', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', '']) {
-    assert.equal(isExempt('/api/gds/access-requests', m), false, `${m || '(no verb)'} on the queue must stay gated`);
+    assert.equal(isExempt('/api/bongos/access-requests', m), false, `${m || '(no verb)'} on the queue must stay gated`);
   }
   // and the exemption does not spread down the path
-  for (const p of ['/api/gds/access-requests/status', '/api/gds/access-requests/invite', '/api/gds/access-requests/1']) {
+  for (const p of ['/api/bongos/access-requests/status', '/api/bongos/access-requests/invite', '/api/bongos/access-requests/1']) {
     assert.equal(isExempt(p, 'POST'), false, `POST ${p} must stay gated`);
   }
   // a method-BLIND entry is unchanged by the new shape: it still exempts any verb
   assert.equal(isExempt('/healthz', 'POST'), true, 'a bare-RegExp entry ignores the verb');
-  assert.equal(isExempt('/api/gds/instance', 'GET'), true);
+  assert.equal(isExempt('/api/bongos/instance', 'GET'), true);
 });
 
 // task 1003525 — the other half of the apply door. `bongos login` cannot re-poll the
@@ -210,15 +210,15 @@ test('the status poll: GET <api>/access-requests/status answers a stranger — t
   for (const p of [
     '/api/gds/access-requests/status', '/api/bongos/access-requests/status',
     '/api/bongos/v1/access-requests/status',
-    '/API/BONGOS/ACCESS-REQUESTS/STATUS', '/api/gds/access-requests/status/',
+    '/API/BONGOS/ACCESS-REQUESTS/STATUS', '/api/bongos/access-requests/status/',
   ]) assert.equal(isExempt(p, 'GET'), true, `GET ${p} must reach the status route`);
 
   // the two halves do not lend each other their verbs
-  assert.equal(isExempt('/api/gds/access-requests/status', 'POST'), false, 'the status route takes no write');
-  assert.equal(isExempt('/api/gds/access-requests', 'GET'), false, 'the owner queue is still not a status poll');
+  assert.equal(isExempt('/api/bongos/access-requests/status', 'POST'), false, 'the status route takes no write');
+  assert.equal(isExempt('/api/bongos/access-requests', 'GET'), false, 'the owner queue is still not a status poll');
 
   // and neither opens the review surfaces that share the prefix
-  for (const p of ['/api/gds/access-requests/invite', '/api/gds/access-requests/1/approve', '/api/gds/access-requests/1']) {
+  for (const p of ['/api/bongos/access-requests/invite', '/api/bongos/access-requests/1/approve', '/api/bongos/access-requests/1']) {
     for (const m of ['GET', 'POST']) {
       assert.equal(isExempt(p, m), false, `${m} ${p} must stay gated`);
     }
@@ -238,10 +238,10 @@ test('gated mode: an exempt path is never looked up, and a CORS preflight passes
 });
 
 test('the sign-in return is the knocked-on page for GET/HEAD only, relative, and never a foreign host', () => {
-  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap' })), '/api/gds/auth/web/start?return=%2Fbuilders%2Froadmap');
-  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap', method: 'POST' })), '/api/gds/auth/web/start', 'a write has nothing safe to replay');
-  assert.equal(signInHref(fakeReq({ path: '//evil.example/x' })), '/api/gds/auth/web/start', 'a protocol-relative path is dropped');
-  assert.equal(signInHref(fakeReq({ path: '/' })), '/api/gds/auth/web/start', 'the front page needs no return');
+  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap' })), '/api/bongos/auth/web/start?return=%2Fbuilders%2Froadmap');
+  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap', method: 'POST' })), '/api/bongos/auth/web/start', 'a write has nothing safe to replay');
+  assert.equal(signInHref(fakeReq({ path: '//evil.example/x' })), '/api/bongos/auth/web/start', 'a protocol-relative path is dropped');
+  assert.equal(signInHref(fakeReq({ path: '/' })), '/api/bongos/auth/web/start', 'the front page needs no return');
 });
 
 // ── 2. the real booted app, pack = gated ─────────────────────────────────────
@@ -365,7 +365,7 @@ test('booted gated + apply: the status poll answers, and the review surfaces bes
     assert.equal(j.error.code, 'bad_github_login', `GET ${p}: the status route answered, not the member door`);
   }
   // the owner's review surfaces share the prefix and stay behind the door
-  for (const p of ['/api/gds/access-requests', '/api/gds/access-requests/invite']) {
+  for (const p of ['/api/bongos/access-requests', '/api/bongos/access-requests/invite']) {
     const res = await request(p);
     assert.equal(res.status, 401, `GET ${p} stays gated`);
     assert.equal(JSON.parse(res.body).error.code, 'unauthenticated');