@bongos/core 1.19.804 → 1.19.805

package/tests/profile_route.mjs

@@ -198,7 +198,7 @@ function buildApp() {
   const app = express();
   app.use(express.json());
   app.use(attachFail); // res.fail() ahead of the routers, exactly as the real app does
-  app.use('/api/gds', buildBuildersRouter());
+  app.use('/api/bongos', buildBuildersRouter());
   return app;
 }
 
@@ -227,7 +227,7 @@ function get(port, path, headers) {
 const { server, port } = await listen(buildApp());
 
 await t('known id → 200 with the public field subset', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   assert.ok(r.json && r.json.builder, 'response has a builder object');
   for (const k of PUBLIC_KEYS) {
@@ -242,7 +242,7 @@ await t('known id → 200 with the public field subset', async () => {
 });
 
 await t('known id → NO private column leaks on the builder object', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   for (const k of PRIVATE_KEYS) {
     assert.ok(!(k in r.json.builder), `private field "${k}" must NOT be present on the builder`);
@@ -250,7 +250,7 @@ await t('known id → NO private column leaks on the builder object', async () =
 });
 
 await t('known id → no secret sentinel leaks ANYWHERE in the response body', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   for (const secret of [SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
     assert.ok(!r.text.includes(secret), `response body must not contain the secret "${secret}"`);
@@ -258,13 +258,13 @@ await t('known id → no secret sentinel leaks ANYWHERE in the response body', a
 });
 
 await t('unknown id → 404 builder_not_found', async () => {
-  const r = await get(port, '/api/gds/builders/99999/profile');
+  const r = await get(port, '/api/bongos/builders/99999/profile');
   assert.equal(r.status, 404);
   assert.equal(r.json && r.json.error && r.json.error.code, 'builder_not_found');
 });
 
 await t('non-numeric id → 400 bad_builder_id', async () => {
-  const r = await get(port, '/api/gds/builders/not-a-number/profile');
+  const r = await get(port, '/api/bongos/builders/not-a-number/profile');
   assert.equal(r.status, 400);
   assert.equal(r.json && r.json.error && r.json.error.code, 'bad_builder_id');
 });
@@ -275,7 +275,7 @@ await t('non-numeric id → 400 bad_builder_id', async () => {
 // hub posture for the tests below.
 
 await t('hub port ABSENT → no cross_project key + the cacheable posture stays', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   assert.ok(!('cross_project' in r.json), 'cross_project must be absent on a non-hub instance');
   assert.equal(r.headers['cache-control'], 'public, max-age=60');
@@ -292,7 +292,7 @@ seams.registerProvider('platform-identity.hub', {
 });
 
 await t('hub port present → cross_project carries exactly the whitelist shape', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   const cp = r.json.cross_project;
   assert.ok(cp, 'cross_project attached when the port resolves');
@@ -302,7 +302,7 @@ await t('hub port present → cross_project carries exactly the whitelist shape'
 });
 
 await t('hub port present → module-internal sentinels leak NOWHERE in the response', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   for (const secret of [SECRET_CLIENT_ID, SECRET_PROJECT_NAME, SECRET_EMAIL, SECRET_USER, SECRET_REASON]) {
     assert.ok(!r.text.includes(secret), `response body must not contain "${secret}"`);
@@ -311,13 +311,13 @@ await t('hub port present → module-internal sentinels leak NOWHERE in the resp
 });
 
 await t('hub port present → hide must beat the cache: Cache-Control is no-store', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.headers['cache-control'], 'no-store');
 });
 
 await t('hub port returns null (hidden/provisional/none) → cross_project: null, still no-store', async () => {
   hubExtras = null;
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   assert.ok('cross_project' in r.json, 'the key is present on the hub');
   assert.equal(r.json.cross_project, null, 'null — no partial numbers, indistinguishable from no-account');
@@ -472,7 +472,7 @@ const buildScoutingRoutes = require('../modules/platform-identity/routes/scoutin
 hubPublicRead = (githubId) => pi.getPublicProfileExtras(githubId, { pool: engine });
 
 await t('R06.1 a two-project builder\'s COMBINED record shows to another account', async () => {
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.status, 200);
   const cp = r.json.cross_project;
   assert.ok(cp, 'the record is served');
@@ -500,7 +500,7 @@ await t('R06.1 a name needs the map AND the Public door — every other shape is
   try {
     for (const [label, catalog] of Object.entries(unnamed)) {
       other.catalog = catalog;
-      const r = await get(port, '/api/gds/builders/95/profile');
+      const r = await get(port, '/api/bongos/builders/95/profile');
       const cp = r.json.cross_project;
       assert.deepEqual(cp.projects.map((p) => p.name), [pub.name], `${label}: only the Public project is named`);
       assert.equal(cp.more_projects, 1, `${label}: counted`);
@@ -509,7 +509,7 @@ await t('R06.1 a name needs the map AND the Public door — every other shape is
     // The positive control: the same row IS named once Public and on the map, so the
     // refusals above are the door, not a fixture nothing could ever name.
     other.catalog = { ...original, visibility: 'public' };
-    const r = await get(port, '/api/gds/builders/95/profile');
+    const r = await get(port, '/api/bongos/builders/95/profile');
     assert.deepEqual(r.json.cross_project.projects.map((p) => p.name), [pub.name, SECRET_PROJECT_NAME]);
   } finally {
     other.catalog = original;
@@ -517,8 +517,8 @@ await t('R06.1 a name needs the map AND the Public door — every other shape is
 });
 
 await t('R06.1 the record is viewer-INDEPENDENT — another account sees the same body', async () => {
-  const anon = await get(port, '/api/gds/builders/95/profile');
-  const other = await get(port, '/api/gds/builders/95/profile', { Cookie: 'gds_session=some-other-builder' });
+  const anon = await get(port, '/api/bongos/builders/95/profile');
+  const other = await get(port, '/api/bongos/builders/95/profile', { Cookie: 'gds_session=some-other-builder' });
   assert.equal(other.status, 200);
   assert.equal(other.text, anon.text, 'one response shape for every reader (ADR 0171 D4)');
 });
@@ -564,7 +564,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
   try {
     // (a) a module-internal key on the object itself.
     hubPublicRead = async () => ({ ...(await rollup()), client_id: SECRET_CLIENT_ID });
-    let r = await get(port, '/api/gds/builders/95/profile');
+    let r = await get(port, '/api/bongos/builders/95/profile');
     assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
       /cross_project keys are exactly the contract/, 'an extra top-level key must turn the guard red');
 
@@ -573,7 +573,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
       const cp = await rollup();
       return { ...cp, projects: cp.projects.map((p) => ({ ...p, is_public: true })) };
     };
-    r = await get(port, '/api/gds/builders/95/profile');
+    r = await get(port, '/api/bongos/builders/95/profile');
     assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
       /project rows carry only the whitelisted keys/, 'an extra project-row key must turn the guard red');
 
@@ -583,7 +583,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
       const cp = await rollup();
       return { ...cp, projects: [{ ...cp.projects[0], name: SECRET_PROJECT_NAME }] };
     };
-    r = await get(port, '/api/gds/builders/95/profile');
+    r = await get(port, '/api/bongos/builders/95/profile');
     assert.deepEqual(Object.keys(r.json.cross_project).sort(), [...CP_PUBLIC_KEYS].sort(),
       'the planted leak is shape-legal — only the sentinel scan can catch it');
     assert.throws(() => assertCrossProjectContract(r.json.cross_project, r.text),
@@ -594,7 +594,7 @@ await t('R06.4 NEGATIVE CONTROL: the leak guard goes red when a private field is
 });
 
 await t('R06.2 hide_stats removes the record on the IMMEDIATE next load', async () => {
-  const before = await get(port, '/api/gds/builders/95/profile');
+  const before = await get(port, '/api/bongos/builders/95/profile');
   assert.ok(before.json.cross_project, 'public before the flip');
   assert.equal(before.headers['cache-control'], 'no-store');
 
@@ -604,7 +604,7 @@ await t('R06.2 hide_stats removes the record on the IMMEDIATE next load', async
   assert.equal(row.hide_stats, true, 'the write path set the flag');
 
   // No sleep, no second server, no cache warm-up: the very next load.
-  const after = await get(port, '/api/gds/builders/95/profile');
+  const after = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(after.status, 200);
   assert.equal(after.json.cross_project, null, 'gone on the next load');
   assert.equal(after.headers['cache-control'], 'no-store', 'hide must beat the cache (ADR 0171 D5)');
@@ -616,7 +616,7 @@ await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden tota
   // Set the flag here too, so this proof stands on its own rather than on
   // whatever R06.2 left behind.
   await pi.setAccountHideStats({ githubId: HUB_GITHUB_ID, githubLogin: 'jaxri', hide: true }, { pool: engine });
-  const r = await get(port, '/api/gds/builders/95/profile');
+  const r = await get(port, '/api/bongos/builders/95/profile');
   assert.equal(r.json.cross_project, null);
   for (const key of ['totals', 'works_shipped', 'more_projects', 'last_active', 'rank_held']) {
     assert.ok(!r.text.includes(key), `nothing derived from the rollup may survive — found "${key}"`);
@@ -632,12 +632,12 @@ await t('R06.5 no PARTIAL numbers survive the hide (a count beside a hidden tota
 
 const scoutApp = express();
 scoutApp.use(attachFail);
-scoutApp.use('/api/gds', buildScoutingRoutes());
+scoutApp.use('/api/bongos', buildScoutingRoutes());
 const scout = await listen(scoutApp);
 
 await t('R06.3 GET /scouting drops the hidden, the provisional AND the private builder', async () => {
   engine.calls.length = 0;
-  const r = await get(scout.port, '/api/gds/scouting');
+  const r = await get(scout.port, '/api/bongos/scouting');
   assert.equal(r.status, 200);
   const logins = r.json.builders.map((b) => b.github_login);
   assert.deepEqual(logins, ['r06-visible'],
@@ -662,7 +662,7 @@ await t('R06.3 the /people page reads /scouting and nothing else', async () => {
   // assembled is the page's business.
   const args = [...sourceOf('modules/hall-ui/public/people.js').matchAll(/\bfetch\(\s*([^,)]+)/g)].map((m) => m[1].trim());
   assert.equal(args.length, 1, '/people has exactly one data source');
-  assert.match(args[0], /^'\/api\/gds\/scouting\?limit='/,
+  assert.match(args[0], /^'\/api\/bongos\/scouting\?limit='/,
     'and it is the scouting rollup — nothing may re-enter through a second endpoint');
 });
 

package/tests/projects_hub.mjs

@@ -1426,7 +1426,7 @@ test('what the project RUNS comes only from its own manifest, and every answer i
   const runs = fnHub('loadVisRuns');
   const manifest = fnHub('ensureManifest');
   assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
-  assert.match(manifest, /'https:\/\/' \+ domain \+ '\/api\/gds\/instance'/,
+  assert.match(manifest, /'https:\/\/' \+ domain \+ '\/api\/bongos\/instance'/,
     'the same public GET /instance the platform’s runner reads after a restart');
   assert.doesNotMatch(runs, /fetch\(/, 'the card fires no GET of its own — one manifest read serves the pair (task 1003554)');
   assert.match(runs, /m\.brand && m\.brand\.project/);
@@ -1600,7 +1600,7 @@ test('the join door is read on entry + tab return, like every other settings sec
   // door yet, and a line that could only ever say "your project doesn’t report
   // this" is worse than no line. The read-back lands with the enforcement.
   const load = fnHub('loadDoor');
-  assert.doesNotMatch(load, /api\/gds\/instance/, 'this section asks the project’s manifest nothing');
+  assert.doesNotMatch(load, /api\/bongos\/instance/, 'this section asks the project’s manifest nothing');
 });
 
 test('the joinability choices are the platform’s vocabulary, each in plain words, and the pick is a real radio group', () => {

package/tests/provision.mjs

@@ -220,7 +220,7 @@ t('webEnvBody: an instance is never pinned to the neutral pack, so it serves its
   // into every instance's web.env — a leftover from the shared-checkout co-tenant model. Under
   // ADR 0108 each instance has its own checkout and its own config/branding.json, and
   // src/branding.js's ENV_OVERRIDES cover domains/auth.idp/landing but NEVER identity.productName.
-  // So the pin made every hosted instance answer GET /api/gds/instance with the PLATFORM's name:
+  // So the pin made every hosted instance answer GET /api/bongos/instance with the PLATFORM's name:
   // hermeslines-marketing, mercury and demo all said "Cloud Bongos" while their own packs on disk
   // said otherwise, and `bongos login <instance>` greeted newcomers with the wrong project.
   const b = P.webEnvBody({ ...coTenant, domain: 'mercury.example.com' });
@@ -262,7 +262,7 @@ t('identityVerdict: a live instance serving the PLATFORM name is caught, not shr
 
 t('identityCmd: probes the manifest over loopback, like healthzCmd', () => {
   const N = require('../scripts/gds/provision-net.js');
-  assert.match(N.identityCmd({ port: 3011 }), /127\.0\.0\.1:3011\/api\/gds\/instance/);
+  assert.match(N.identityCmd({ port: 3011 }), /127\.0\.0\.1:3011\/api\/bongos\/instance/);
 });
 
 t('webEnvBody: a domain writes the single-host origin overrides so the hall loads (task 1972)', () => {

package/tests/provision_settings_apply.mjs

@@ -151,7 +151,7 @@ t('null (unknown) when the manifest carries no project block — a core that pre
   assert.equal(P.settingsConsumed(JSON.stringify({ brand: { project: 'nope' } }), GATED), null);
 });
 t('instanceManifestCmd asks the instance on loopback, like healthzCmd', () => {
-  assert.equal(P.instanceManifestCmd({ port: 3010 }), 'curl -sS --max-time 5 http://127.0.0.1:3010/api/gds/instance');
+  assert.equal(P.instanceManifestCmd({ port: 3010 }), 'curl -sS --max-time 5 http://127.0.0.1:3010/api/bongos/instance');
 });
 
 // ── the handler ──────────────────────────────────────────────────────────────
@@ -166,7 +166,7 @@ function recorder({ apply = false, envBody = LIVE_ENV, readFails = false, health
     cmds.push(cmd);
     if (/\bcat /.test(cmd)) return readFails ? { ok: true, stdout: '', softFailed: true } : { ok: true, stdout: envBody };
     if (/healthz/.test(cmd)) return healthzFails ? { ok: true, stdout: '', softFailed: true } : { ok: true, stdout: '{"ok":true}' };
-    if (/api\/gds\/instance/.test(cmd)) return { ok: true, stdout: manifestOut };
+    if (/api\/bongos\/instance/.test(cmd)) return { ok: true, stdout: manifestOut };
     if (/systemctl restart/.test(cmd) && restartThrows && apply) throw new Error(`Command failed: ${cmd}`);
     return { ok: true, stdout: '' };
   };
@@ -218,7 +218,7 @@ await ta('--apply, active standalone: read web.env → patch ONLY the settings l
   assert.ok(idx(/systemctl restart spike/) >= 0, 'RESTART (not reload) so the process re-reads its env');
   assert.ok(idx(/cat /) < idx(/restart spike/), 'read before restart');
   assert.ok(idx(/restart spike/) < idx(/healthz/), 'healthz after the restart');
-  assert.ok(idx(/healthz/) < idx(/api\/gds\/instance/), 'the read-back only after it answers');
+  assert.ok(idx(/healthz/) < idx(/api\/bongos\/instance/), 'the read-back only after it answers');
   assert.ok(!cmds.some((c) => /systemctl (stop|disable)|caddy|box-dns/.test(c)), 'no teardown / DNS / caddy legs — settings only');
 });
 
@@ -355,7 +355,7 @@ await ta('--apply: a restart that never answers /healthz is a VERDICT after the
   assert.deepEqual(probes, [{ id: 18, up: false }]);
   assert.match(events[0].detail, /not answering \/healthz yet/);
   assert.equal(cmds.filter((c) => /healthz/.test(c)).length, MANIFEST_VERIFY_TRIES, 'the same patience as the manifest probe (F23) — a slow boot is not slandered');
-  assert.ok(!cmds.some((c) => /api\/gds\/instance/.test(c)), 'no manifest probe when it never answered');
+  assert.ok(!cmds.some((c) => /api\/bongos\/instance/.test(c)), 'no manifest probe when it never answered');
 });
 
 await ta('--apply: a domainless instance that answers records up=true immediately (provisionInstance step-7 rule)', async () => {

package/tests/sandbox_stage.mjs

@@ -242,9 +242,9 @@ function boxDeps(markerFile, overrides = {}) {
       return '';
     },
     // task 1002607: emulate a real PREVIEW — 200 on the health URL, 404 on the
-    // /api/gds/healthz discriminator (the game-only entry mounts no /api/gds).
+    // /api/bongos/healthz discriminator (the game-only entry mounts no /api/bongos).
     // A flat always-200 mock would now read as "the MAIN server answered".
-    fetchImpl: async (url) => ({ status: String(url).includes('/api/gds/healthz') ? 404 : 200 }),
+    fetchImpl: async (url) => ({ status: String(url).includes('/api/bongos/healthz') ? 404 : 200 }),
     markerPath: markerFile,
     cwd: tmp,
     pollMs: 1,
@@ -541,7 +541,7 @@ await ta('1002607 waitHealthy: 404 at the health URL is NOT healthy (was: anythi
 
 await ta('1002607 waitHealthy: a 200 answered by the MAIN server (api healthz 200) is an impostor, not a healthy preview', async () => {
   // The full server binds the same 127.0.0.1:3000 — root answers 200, and so does
-  // /api/gds/healthz. The game-only preview (ADR 0052) would 404 the latter.
+  // /api/bongos/healthz. The game-only preview (ADR 0052) would 404 the latter.
   const r = await sbx.waitHealthy({ fetchImpl: async () => ({ status: 200 }), timeoutMs: 1000, pollMs: 1 });
   assert.equal(r.ok, false, 'a dead preview must not report healthy off the main server');
   assert.match(r.reason, /MAIN server/);
@@ -550,7 +550,7 @@ await ta('1002607 waitHealthy: a 200 answered by the MAIN server (api healthz 20
 
 await ta('1002607 waitHealthy: a real preview (root 200, api healthz 404) is healthy', async () => {
   const r = await sbx.waitHealthy({
-    fetchImpl: async (url) => ({ status: String(url).includes('/api/gds/healthz') ? 404 : 200 }),
+    fetchImpl: async (url) => ({ status: String(url).includes('/api/bongos/healthz') ? 404 : 200 }),
     timeoutMs: 1000, pollMs: 1,
   });
   assert.equal(r.ok, true);
@@ -559,7 +559,7 @@ await ta('1002607 waitHealthy: a real preview (root 200, api healthz 404) is hea
 await ta('1002607 waitHealthy: a discriminator probe that ERRORS counts as "not the main server" (preview healthy)', async () => {
   const r = await sbx.waitHealthy({
     fetchImpl: async (url) => {
-      if (String(url).includes('/api/gds/healthz')) throw new Error('ECONNREFUSED on a path the preview never mounts');
+      if (String(url).includes('/api/bongos/healthz')) throw new Error('ECONNREFUSED on a path the preview never mounts');
       return { status: 200 };
     },
     timeoutMs: 1000, pollMs: 1,
@@ -568,8 +568,8 @@ await ta('1002607 waitHealthy: a discriminator probe that ERRORS counts as "not
 });
 
 t('1002607 apiHealthzProbeUrl: same origin as the health URL, api path; null on garbage', () => {
-  assert.equal(sbx.apiHealthzProbeUrl('http://127.0.0.1:3000/'), 'http://127.0.0.1:3000/api/gds/healthz');
-  assert.equal(sbx.apiHealthzProbeUrl('http://127.0.0.1:3100/healthz'), 'http://127.0.0.1:3100/api/gds/healthz');
+  assert.equal(sbx.apiHealthzProbeUrl('http://127.0.0.1:3000/'), 'http://127.0.0.1:3000/api/bongos/healthz');
+  assert.equal(sbx.apiHealthzProbeUrl('http://127.0.0.1:3100/healthz'), 'http://127.0.0.1:3100/api/bongos/healthz');
   assert.equal(sbx.apiHealthzProbeUrl('not a url'), null);
 });
 
@@ -599,7 +599,7 @@ function localDeps(markerFile, overrides = {}) {
     },
     execFileSync: (cmd, args, opts) => (cmd === 'git' ? execFileSync(cmd, args, opts) : ''),
     // task 1002607: preview-shaped mock — health 200, API-healthz discriminator 404.
-    fetchImpl: async (url) => ({ status: String(url).includes('/api/gds/healthz') ? 404 : 200 }),
+    fetchImpl: async (url) => ({ status: String(url).includes('/api/bongos/healthz') ? 404 : 200 }),
     markerPath: markerFile,
     cwd: tmp,
     pollMs: 1,

package/tests/scouting_owner_access_and_reach.mjs

@@ -364,7 +364,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 
 const app = express();
 app.use(attachFail);
-app.use('/api/gds', buildScoutingRoutes());
+app.use('/api/bongos', buildScoutingRoutes());
 const server = app.listen(0, '127.0.0.1');
 await new Promise((r) => server.once('listening', r));
 const port = server.address().port;
@@ -381,7 +381,7 @@ function getScouting(caller, query = '') {
   currentCaller = caller;
   calls = [];
   return new Promise((resolve, reject) => {
-    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: `/api/gds/scouting${query}` }, (res) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'GET', path: `/api/bongos/scouting${query}` }, (res) => {
       const chunks = [];
       res.on('data', (c) => chunks.push(c));
       res.on('end', () => resolve({ status: res.statusCode, text: Buffer.concat(chunks).toString('utf8') }));
@@ -606,7 +606,7 @@ await t('CALIBRATION: the interpreter refuses what it cannot model, rather than
 
 await t('/people is the SAME endpoint, so "absent from /people" is true by construction', async () => {
   const page = fs.readFileSync(path.join(repo, 'modules/hall-ui/public/people.js'), 'utf8');
-  assert.match(page, /fetch\('\/api\/gds\/scouting/,
+  assert.match(page, /fetch\('\/api\/bongos\/scouting/,
     'the hall directory reads GET /scouting; if it ever grows its own query, this proof stops covering it');
   const source = fs.readFileSync(path.join(repo, 'modules/platform-identity/platform-identity.js'), 'utf8');
   assert.match(source, /scoutingListableSql\('pa'\)/,