@bongos/core 1.19.804 → 1.19.806

package/src/bongos/db.js

@@ -737,7 +737,7 @@ async function revokeSession(token) {
 
 // revokeSessionById — V3.R38 / #259. Kill ONE session by primary key. Returns
 // the number of rows revoked (0 if id didn't exist or was already revoked, 1
-// otherwise). Used by POST /api/gds/auth/revoke (Archon-only).
+// otherwise). Used by POST /api/bongos/auth/revoke (Archon-only).
 
 async function revokeSessionById(sessionId) {
   const { rowCount } = await pool.query(
@@ -751,7 +751,7 @@ async function revokeSessionById(sessionId) {
 
 // revokeAllSessionsForBuilder — V3.R38 / #259. Kill EVERY non-revoked session
 // for a single builder. Returns the count of sessions revoked. Used by:
-//   * POST /api/gds/auth/revoke-all (Archon-only direct call)
+//   * POST /api/bongos/auth/revoke-all (Archon-only direct call)
 //   * setBuilderRank when newRank < oldRank (rank-change-near-instant per C7)
 
 async function revokeAllSessionsForBuilder(builderId) {

package/src/bongos/llm-cache.js

@@ -151,7 +151,7 @@ async function lookup(cacheKey, { tokensSavedEst = 0 } = {}) {
   // must never take down the thing it accelerates.
   if (_apiCall) {
     try {
-      const r = await _apiCall('POST', '/api/gds/llm-cache/lookup',
+      const r = await _apiCall('POST', '/api/bongos/llm-cache/lookup',
         { cache_key: cacheKey, tokens_saved_est: est }, { allowUnauthenticated: true });
       if (r && r.ok && r.data && r.data.hit) return r.data.result || null;
     } catch (_) { /* network/auth error → miss */ }
@@ -185,7 +185,7 @@ async function store(spec, { resultStdout, resultCostUsd = 0 } = {}) {
   // cost server-side; best-effort: any error → no-store (never throws).
   if (_apiCall) {
     try {
-      const r = await _apiCall('POST', '/api/gds/llm-cache/store',
+      const r = await _apiCall('POST', '/api/bongos/llm-cache/store',
         { spec, result_stdout: resultStdout, result_cost_usd: Number(resultCostUsd) || 0 },
         { allowUnauthenticated: true });
       return !!(r && r.ok && r.data && r.data.stored);

package/src/bongos/metrics.js

@@ -14,7 +14,7 @@
 //   - process/runtime: uptime, RSS, heap, CPU (counter), event-loop lag, build_info
 //   - HTTP (from httpMiddleware): gds_http_requests_total{method,route,status} +
 //     gds_http_request_duration_seconds histogram — route normalized to a
-//     low-cardinality template so /api/gds/tasks/1380 and /…/1381 share a series.
+//     low-cardinality template so /api/bongos/tasks/1380 and /…/1381 share a series.
 //     Gives error-rate + 4xx/5xx per route. 401/403 also bump gds_auth_failures_total.
 //   - DB gauges (collected at scrape, read-only — never instruments the gate-floor
 //     ship pipeline): tasks-by-status, claims (all-time + active), builders-by-rank,

package/src/bongos/middleware/audit.js

@@ -1,13 +1,13 @@
 // src/bongos/middleware/audit.js — append-only audit log for authenticated writes
 // (V3.R35 / #256).
 //
-// Wire-up: mounted INSIDE the /api/gds sub-router by routes.js, AFTER the JSON
+// Wire-up: mounted INSIDE the /api/bongos sub-router by routes.js, AFTER the JSON
 // body parser and AFTER each route's auth middleware has run (the middleware
 // fires on res 'finish', so by then auth either populated req.builder or sent
 // a 401 — both cases are handled below).
 //
 // What it captures:
-//   - Every authenticated POST/PATCH/PUT/DELETE that the /api/gds router
+//   - Every authenticated POST/PATCH/PUT/DELETE that the /api/bongos router
 //     served. Reads (GET) are explicitly skipped — they're high-volume and
 //     low-signal for forensics.
 //   - The redacted request body, the response status the client actually saw,
@@ -161,7 +161,7 @@ function clientIp(req) {
 // (e.g. 404 from the router), fall back to req.path.
 function routePattern(req) {
   if (req.route && req.route.path) {
-    // baseUrl carries '/api/gds' plus any sub-router prefix; combining them
+    // baseUrl carries '/api/bongos' plus any sub-router prefix; combining them
     // yields the full pattern. trim trailing slash for tidiness.
     const base = (req.baseUrl || '').replace(/\/+$/, '');
     const tail = req.route.path === '/' ? '' : req.route.path;

package/src/bongos/middleware/rate-limit.js

@@ -1,7 +1,7 @@
 // src/bongos/middleware/rate-limit.js — V3.R34 (#255).
 //
 // Five sliding-window in-memory limiters. The first two are the GLOBAL pair and
-// protect write methods on /api/gds/* only — read methods (GET, HEAD, OPTIONS)
+// protect write methods on /api/bongos/* only — read methods (GET, HEAD, OPTIONS)
 // bypass them entirely; #3, #4 and #5 are mounted per-surface to close exactly that
 // gap where an unauthenticated READ is itself the abuse.
 //

package/src/bongos/platform-visibility-gate.js

@@ -127,7 +127,7 @@ function isGated() { return mode() === GATED; }
 
 // Express routes case-insensitively and tolerates one trailing slash, so the
 // exempt test must see the path the way the router will — otherwise a probe
-// spelled `/HEALTHZ` or `/api/gds/instance/` is refused while the router would
+// spelled `/HEALTHZ` or `/api/bongos/instance/` is refused while the router would
 // have served it. Mismatches still fail CLOSED; this only keeps the list honest.
 function normalizePath(p) {
   let s = String(p || '').toLowerCase();
@@ -160,7 +160,7 @@ function productName() {
 // subdomain, a dev port, or plain http would otherwise be dropped at the default
 // page. Only a GET/HEAD path is safe to come back to; anything else returns to '/'.
 function signInHref(req) {
-  const base = '/api/gds/auth/web/start';
+  const base = '/api/bongos/auth/web/start';
   const back = (req.method === 'GET' || req.method === 'HEAD') ? relativeReturn(req.originalUrl) : null;
   return back ? `${base}?return=${encodeURIComponent(back)}` : base;
 }

package/src/bongos/routes/_helpers.js

@@ -409,7 +409,7 @@ function hardenRouterStack(router, seen = new Set()) {
 // Read-only, no-auth, no-secret routes, so a static '*' is safe; the caller
 // mounts it scoped to a `/public…` prefix (passed as `scope` for documentation
 // + signature parity) so it can't leak onto the authenticated routes on the same
-// /api/gds base. Behavior is BYTE-IDENTICAL to the two copy-pasted blocks it
+// /api/bongos base. Behavior is BYTE-IDENTICAL to the two copy-pasted blocks it
 // replaces (routes/analytics.js + routes/public.js): sets
 // Access-Control-Allow-Origin:*, and answers an OPTIONS preflight with
 // Allow-Methods 'GET, OPTIONS' + Allow-Headers 'Content-Type' and a 204.

package/src/bongos/routes/audit-log.js

@@ -14,7 +14,7 @@ const VALID_METHODS = new Set(['POST', 'PATCH', 'PUT', 'DELETE']);
 module.exports = function buildAuditLogRouter() {
   const router = express.Router();
 
-  // GET /api/gds/audit-log?limit=&offset=&builder_id=&method=
+  // GET /api/bongos/audit-log?limit=&offset=&builder_id=&method=
   //
   // Paginated, newest-first. Clamps:
   //   limit  → 1..500, default 100

package/src/bongos/routes/auth.js

@@ -92,7 +92,7 @@ function renderAuthErrorPage(heading, detail, opts = {}) {
     catch { return AUTH_ERROR_FALLBACK; }
   })();
   const subtitle = opts.subtitle || copy.subtitle;
-  const cta = opts.cta || { href: opts.startHref || '/api/gds/auth/web/start', label: copy.ctaLabel };
+  const cta = opts.cta || { href: opts.startHref || '/api/bongos/auth/web/start', label: copy.ctaLabel };
   const note = opts.note || "If this keeps happening, the GitHub OAuth app's authorized callback URL may be misconfigured. See docs/recipes/ops-gotchas.md (GitHub OAuth section).";
   // The instance name in the tab title comes from the branding pack, never a
   // hardcoded host brand — a non-OTB instance sees its own name (ADR 0062 §3).
@@ -165,7 +165,7 @@ function renderAccessPendingPage(login, startHref) {
 </header>
 <main>
   <section class="scroll">
-    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/gds/auth/web/start')}">
+    <div class="landing" id="pending" data-login="${safeLogin}" data-start="${escapeHtml(startHref || '/api/bongos/auth/web/start')}">
       <p>We're checking your access now. You'll be signed in automatically as soon as it clears — no need to refresh.</p>
       <p class="landing__note" id="pending-note">Checking…</p>
     </div>
@@ -178,7 +178,7 @@ function renderAccessPendingPage(login, startHref) {
   var login = el ? el.getAttribute('data-login') : '';
   /* server-built from the still-valid handshake cookies (task 1003234): the
      fresh sign-in keeps the wizard return + repo scope a founder started with */
-  var start = (el && el.getAttribute('data-start')) || '/api/gds/auth/web/start';
+  var start = (el && el.getAttribute('data-start')) || '/api/bongos/auth/web/start';
   var EVERY_MS = 3000;
   var GIVE_UP_MS = 5 * 60 * 1000;
   var started = Date.now();
@@ -190,7 +190,7 @@ function renderAccessPendingPage(login, startHref) {
       note.textContent = 'Still waiting on approval. You can leave this page open, or try signing in again later.';
       return;
     }
-    fetch('/api/gds/auth/web/admission-status?login=' + encodeURIComponent(login), { credentials: 'omit' })
+    fetch('/api/bongos/auth/web/admission-status?login=' + encodeURIComponent(login), { credentials: 'omit' })
       .then(function (r) { return r.ok ? r.json() : null; })
       .then(function (j) {
         if (j && j.admitted) { land(); return; }
@@ -350,7 +350,7 @@ function recoveryStartHref(req) {
   if (returnTo) params.set('return', returnTo);
   if (parseCookie(req, REPOS_COOKIE) === '1') params.set('repos', '1');
   const q = params.toString();
-  return '/api/gds/auth/web/start' + (q ? '?' + q : '');
+  return '/api/bongos/auth/web/start' + (q ? '?' + q : '');
 }
 
 // The canonical sign-in origin, read from the instance branding pack (oauthOrigin,

package/src/bongos/routes/backup.js

@@ -153,7 +153,7 @@ module.exports = function buildBackupRouter() {
 
       res.status(202).json({
         ok: true,
-        message: 'Backup started — poll GET /api/gds/backup/status to see the new dump land (usually < 30 s).',
+        message: 'Backup started — poll GET /api/bongos/backup/status to see the new dump land (usually < 30 s).',
         started_at: startedAt,
       });
     }));

package/src/bongos/routes/builders.js

@@ -456,7 +456,7 @@ module.exports = function buildBuildersRouter() {
   // Public read (no auth). Spec says the hall renders other builders'
   // checklists read-only — a builder's onboarding progress is roster-visible
   // signal, same posture as rank or drachmae shown on the leaderboard. The
-  // builder's own row is also surfaced inside /api/gds/me; this endpoint is
+  // builder's own row is also surfaced inside /api/bongos/me; this endpoint is
   // what the hall hits for the CURRENT viewer AND for any other builder
   // whose card is rendered.
   //

package/src/bongos/routes/instance.js

@@ -1,4 +1,4 @@
-// src/bongos/routes/instance.js — GET /api/gds/instance (V4.R82, task 1249, ADR 0062 / Cloud Bongos C8).
+// src/bongos/routes/instance.js — GET /api/bongos/instance (V4.R82, task 1249, ADR 0062 / Cloud Bongos C8).
 //
 // The instance manifest: one public, pre-auth, read-only descriptor that a CLI
 // (`bongos login <url>`) fetches to configure ITSELF — the conda

package/src/bongos/routes/live.js

@@ -105,7 +105,7 @@ function streamLive(req, res, deps = {}) {
 function buildLiveRouter() {
   const router = express.Router();
 
-  // GET /api/gds/live — SSE stream of Bongos state-change nudges for the hall.
+  // GET /api/bongos/live — SSE stream of Bongos state-change nudges for the hall.
   // rank: any-builder — requireBuilder gates anonymous/abuse traffic (defense
   // in depth; the payload leaks nothing). Mirrors the room's #983 signed-in
   // gate. EventSource carries the gds_session cookie on this same-origin GET, so

package/src/bongos/routes/me.js

@@ -157,7 +157,7 @@ module.exports = function buildMeRouter() {
   // V3.R24 (#244): the `builder` payload now carries `karma` (migration 040
   // added the column + karma_log table). The field is surfaced by
   // db.getBuilderById() — no shape change here, just documenting that the
-  // /api/gds/me response is the canonical place clients read karma from.
+  // /api/bongos/me response is the canonical place clients read karma from.
   //
   // rank: any-builder — own identity + own contributions; preserved per CRITICAL §4.
   router.get('/me', auth.requireBuilder, async (req, res) => {
@@ -621,7 +621,7 @@ module.exports = function buildMeRouter() {
   // The five per-builder PREFERENCE routes — /me/skill-prefs, /me/sound-prefs,
   // /me/event-sound-prefs, /me/wandering, /me/render (GET + PATCH each) — moved to
   // modules/builder-settings/routes/settings.js (BV1.R80 / ADR 0093 §1). They keep
-  // their exact /me/* paths (the loader mounts that router on this same /api/gds
+  // their exact /me/* paths (the loader mounts that router on this same /api/bongos
   // router, before the public catch-all), so the API is byte-identical. The GET
   // /me aggregator above stays here as a thin facade resolving the
   // `builder-settings` port for its wandering/render/needs slices (02-module-map §2).

package/src/bongos/routes/modules.js

@@ -148,7 +148,7 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, key, enabled, note: 'Live on this box now. Persisting past the next deploy needs config/modules.json committed.' });
     }));
 
-  // POST /api/gds/modules/:key/submit — ADR 0107 §1 upstreaming submission.
+  // POST /api/bongos/modules/:key/submit — ADR 0107 §1 upstreaming submission.
   //
   // task 1770. Body: { signed_by?: "Name <email>" }. Re-runs the §4
   // AGPL/publish pre-check + requires a DCO-style sign-off against THIS box's
@@ -213,7 +213,7 @@ module.exports = function buildModulesRouter() {
       res.status(201).json({ ok: true, submission });
     }));
 
-  // GET /api/gds/modules/submissions?status=&module_key= — the upstreaming
+  // GET /api/bongos/modules/submissions?status=&module_key= — the upstreaming
   // review queue (task 1771 reads this). Metadata only — no file contents (a
   // future GET .../:id can add a with-files fetch if the review UI needs it).
   //

package/src/bongos/routes/public.js

@@ -115,7 +115,7 @@ module.exports = function buildPublicRouter() {
   // CORS for the public surface (ADR 0029 / #566): the off-box status page reads
   // these cross-origin. Read-only, no-auth, no-secret routes, so a static '*' is
   // safe; scoped to '/public' so it can't leak onto the authenticated routes on
-  // the same /api/gds base. No Vary:Origin — the ACAO never varies by origin.
+  // the same /api/bongos base. No Vary:Origin — the ACAO never varies by origin.
   // Shared middleware: corsPublicGet (_helpers.js) — byte-identical to analytics.js.
   router.use('/public', corsPublicGet('/public'));
 

package/src/bongos/routes/security.js

@@ -74,7 +74,7 @@ async function readFullAdr() {
 module.exports = function buildSecurityRouter() {
   const router = express.Router();
 
-  // GET /api/gds/security/adr
+  // GET /api/bongos/security/adr
   //
   // Metic+ only. Returns the full security ADR as { adr_md, source,
   // fetched_at } when the file is provisioned; otherwise 404 with a
@@ -125,7 +125,7 @@ module.exports = function buildSecurityRouter() {
   // now `permission_forbidden`, not `rank_forbidden`.
   // -----------------------------------------------------------------------
 
-  // GET /api/gds/security/docs — list doc METADATA (no content).
+  // GET /api/bongos/security/docs — list doc METADATA (no content).
   //
   // rank: archon — index of exploit-detail engagement reports. Gate:
   // requirePermission('security.report.adjudicate') — BV1.R104.
@@ -144,7 +144,7 @@ module.exports = function buildSecurityRouter() {
     }
   );
 
-  // GET /api/gds/security/docs/:slug — one doc WITH content, or 404.
+  // GET /api/bongos/security/docs/:slug — one doc WITH content, or 404.
   //
   // rank: archon — reads the full exploit-detail report body. Gate:
   // requirePermission('security.report.adjudicate') — BV1.R104.
@@ -177,7 +177,7 @@ module.exports = function buildSecurityRouter() {
     }
   );
 
-  // POST /api/gds/security/docs — upsert a doc by slug. The director uploads
+  // POST /api/bongos/security/docs — upsert a doc by slug. The director uploads
   // each dated engagement report here after deploy.
   //
   // Body: { slug, title, content_md }. content_md uses a large explicit cap

package/src/bongos/routes.js

@@ -108,7 +108,7 @@ function buildGdsRouter() {
   });
 
   // Audit middleware (V3.R35 #256) — attaches a res 'finish' hook so every
-  // authenticated POST/PATCH/PUT/DELETE under /api/gds is recorded in
+  // authenticated POST/PATCH/PUT/DELETE under /api/bongos is recorded in
   // audit_log AFTER the response is sent. It cannot fail the request: throws
   // are caught, DB errors are swallowed, and it never mutates req/res in a
   // way downstream handlers can see. Mounted BEFORE the feature routers so

package/src/bongos/serve-internal.js

@@ -2,7 +2,7 @@
 //
 // Mounts every non-game surface the platform serves onto an Express app:
 //   * /healthz + /version          — liveness + deployed-build info
-//   * /api/gds/*                    — the GDS API (buildGdsRouter)
+//   * /api/bongos/*                    — the GDS API (buildGdsRouter)
 //   * /downloads/devbox/*           — Dev Box installer redirect surface (#904)
 //   * generic module web-surface   — each enabled module's contributes.webSurfaces
 //     hosts                          served on its Host prefix by ONE generic static
@@ -179,7 +179,7 @@ function jsonForScript(value) {
 // the pack wins. Applied to the boot-time stamped HTML maps (the pack is a
 // boot-time singleton, computed once). Off-box surfaces that can't be
 // server-injected (the GitHub-Pages status page) read the same projection from
-// GET /api/gds/public/branding. Pure + exported for the unit test.
+// GET /api/bongos/public/branding. Pure + exported for the unit test.
 function injectBrandingGlobal(html, brand = clientBranding(), mods = clientModules()) {
   // window.__MODULES__ — the enabled feature-module set (R54 task 1193, ADR 0062
   // §4), injected the same way as __BRANDING__ so hall/status scripts can hide
@@ -456,7 +456,7 @@ function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled:
 // builders.<apex> gets the builder surface (served by the hall-ui MODULE's web
 // surface, BV1.R85 — its DEDICATED block below); the apex host gets the game
 // (server.js) or — on a game-less instance — a plain 404 (platform-server.js). All
-// share the same process + the same /api/gds/* surface (mounted host-agnostically
+// share the same process + the same /api/bongos/* surface (mounted host-agnostically
 // below). The prefix checks are apex-agnostic (any domain), so no brand string lives
 // here. isStatusHost + isBuildersHost stay the literal "status."/"builders."
 // predicates the entrypoints (server.js/platform-server.js) use to keep their apex
@@ -830,7 +830,7 @@ function mountInternalSurfaces(app) {
   // clean path so the address bar never shows ".../builders". PAGE paths only —
   // the slug is [a-z0-9-]+ with no dot, so asset URLs the pages emit
   // (/builders/style.css, /builders/*.js, /builders/diagrams/*.png) and the API
-  // (/api/gds/builders/*) never match and pass through to the shim below.
+  // (/api/bongos/builders/*) never match and pass through to the shim below.
   const BUILDERS_CANONICAL_RE = /^\/builders(?:\/([a-z0-9-]+))?\/?$/i;
   app.use((req, res, next) => {
     if (!isBuildersHost(req)) return next();
@@ -1056,8 +1056,8 @@ function mountInternalSurfaces(app) {
   // read from BUILDERS_DIR. The module key is NOT named — the path is the
   // hall-ui module's public dir, resolved once here.
   //
-  // Auth is handled client-side: the page calls /api/gds/me; on 401 it redirects
-  // the browser to /api/gds/auth/web/start, which (per src/bongos/routes/auth.js)
+  // Auth is handled client-side: the page calls /api/bongos/me; on 401 it redirects
+  // the browser to /api/bongos/auth/web/start, which (per src/bongos/routes/auth.js)
   // loops back to /builders with a gds_session cookie set.
   const BUILDERS_DIR = path.join(ROOT, 'modules', 'hall-ui', 'public');
   const buildersStatic = express.static(BUILDERS_DIR, {

package/src/branding.js

@@ -206,7 +206,7 @@ function userAgent() {
 }
 
 // The CLIENT-SAFE projection of the resolved pack — the subset the browser is
-// allowed to see, served by GET /api/gds/public/branding and consumed by the
+// allowed to see, served by GET /api/bongos/public/branding and consumed by the
 // hall + status front-ends. Deliberately a small allow-list, NOT the whole pack:
 // origins, repo binding, db name, and env prefix are server-only and must never
 // reach the client. R56 (task 1195) seeded it with the configurable currency

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.804'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.806'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/module-seams.js

@@ -188,7 +188,7 @@ function listEvents() {
 //
 // Canonical extension points (the names core consumes):
 //   • 'profile.fields'  — server-side: each contributor is `async (ctx) => ({…slice})`;
-//                         the slices merge into the GET /api/gds/me payload.
+//                         the slices merge into the GET /api/bongos/me payload.
 //                         (The client settings-panel seam is its browser twin,
 //                          window.OTB.contributeSettingsPanel in dom-utils.js.)
 
@@ -240,7 +240,7 @@ async function collectContributions(point, ctx) {
 // a module's contribution can't clobber a core field). Mutates + returns `base`,
 // and reports any collided keys so the caller can surface them — that signals a
 // move task took over a core key without first removing the core copy. Used by
-// GET /api/gds/me to fold 'profile.fields' slices into the profile payload.
+// GET /api/bongos/me to fold 'profile.fields' slices into the profile payload.
 function mergeContributions(base, slices) {
   const collisions = [];
   for (const slice of slices || []) {

package/src/platform-server.js

@@ -7,7 +7,7 @@
 // WHAT IT SERVES — the entire internal surface, via the shared mount that
 // server.js also uses (so the two entrypoints never drift, ADR 0052):
 //   * /healthz + /version
-//   * /api/gds/*                 — the full GDS API (buildGdsRouter)
+//   * /api/bongos/*                 — the full GDS API (buildGdsRouter)
 //   * the status dashboard host  — modules/status-ui/public/ (the status-ui module's
 //                                  web surface, BV1.R84 — served by the loader seam)
 //   * the builders' hall host    — modules/hall-ui/public/ (the hall-ui module's
@@ -269,7 +269,7 @@ function buildPlatformApp() {
     });
   }
 
-  // Non-game tail. Anything that did not resolve to /api/gds, the status host,
+  // Non-game tail. Anything that did not resolve to /api/bongos, the status host,
   // or the builders' hall lands here. There is NO game to fall through to, so:
   //   * an API-shaped path gets a self-describing JSON 404 (never HTML), the
   //     same contract server.js gives so a mis-prefixed CLI call is legible;

package/tests/api_alias_exceptions.mjs

@@ -0,0 +1,67 @@
+// tests/api_alias_exceptions.mjs — the callers task 1003707 deliberately LEFT on
+// the permanent /api/gds alias, and the reason each one stays.
+//
+// WHY THIS FILE EXISTS. C3e moved every in-repo caller onto the canonical
+// /api/bongos. A handful were held back on purpose, and "on purpose" is the kind
+// of fact that survives exactly one sweep: the next agent greps for the old
+// spelling, sees four stragglers, tidies them, and discovers what they were for
+// when sign-in breaks. Each case below names its reason, so a future move has to
+// argue with the reason rather than with a leftover.
+//
+// The mount itself is asserted by tests/rename_history_restraint.mjs (structure)
+// and tests/api_path_404.mjs (dispatch — the alias is a live mount, so it gets no
+// corrective 404 hint). Only the ONE line that makes the alias permanent is
+// re-asserted here, because these exceptions are worthless without it.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const ALIAS = '/api/gds';
+
+test('the alias is still mounted — everything below depends on it', () => {
+  const { API_PREFIX, LEGACY_API_PREFIXES, ALL_API_PREFIXES } = require(path.join(ROOT, 'src', 'bongos', 'api-prefix.js'));
+  assert.equal(API_PREFIX, '/api/bongos', 'the canonical prefix is what in-repo callers now ask for');
+  assert.ok(LEGACY_API_PREFIXES.includes(ALIAS), 'shipped Dev Box binaries and live dev boxes call the alias');
+  assert.ok(ALL_API_PREFIXES.includes(ALIAS), 'and the router still mounts it');
+});
+
+test('the OAuth callbacks stay on the alias — they are registered outside this repo', () => {
+  const auth = read('src/bongos/routes/auth.js');
+  // Changing either of these needs a matching edit in the GitHub / Discord app
+  // settings; a repo-only change silently breaks sign-in. Pin the lines that BUILD
+  // the redirect_uri, not a mention of the path — auth.js also names it in an error
+  // message, and matching that would keep this green with both builders rewritten.
+  const webBuilders = auth.split(`\${WEB_REDIRECT_ORIGIN}${ALIAS}/auth/web/callback`).length - 1;
+  assert.equal(webBuilders, 2, 'both GitHub redirect_uri builders stay on the alias (auth.js WEB_REDIRECT_ORIGIN)');
+  assert.ok(auth.includes(`\${DISCORD_REDIRECT_ORIGIN}${ALIAS}/auth/discord/callback`),
+    'Discord OAuth app callback (DISCORD_REDIRECT_URI)');
+  // The instance provisioner registers the same pinned path for every new instance.
+  assert.ok(read('modules/provisioning/provisioning.js').includes(`${ALIAS}/auth/web/callback`),
+    'a provisioned instance registers the pinned callback, not the canonical one');
+});
+
+test('the sign-in START href moved, and that is safe because the cookie is path-scoped to /', () => {
+  const auth = read('src/bongos/routes/auth.js');
+  assert.ok(auth.includes('/api/bongos/auth/web/start'), 'the start link asks for the canonical path');
+  assert.ok(/path: '\/'/.test(auth), 'the session cookie is set at path / — it reaches BOTH prefixes');
+});
+
+test('the uptime poller stays on the alias so production keeps exercising it', () => {
+  // If nothing in production ever calls the alias, its eventual breakage is
+  // discovered by a user rather than by us.
+  assert.ok(read('src/bongos/uptime-poller.js').includes(`${ALIAS}/healthz`),
+    'the poller is the one live caller that proves the alias answers');
+});
+
+test('a pasted API base is stripped whichever spelling it carries', () => {
+  const { normalizeInstanceBase } = require(path.join(ROOT, 'scripts', 'gds', 'login.js'));
+  for (const suffix of ['/api/bongos', '/api/bongos/v1', '/api/gds', '/api/gds/']) {
+    assert.equal(normalizeInstanceBase(`https://example.com${suffix}`), 'https://example.com', suffix);
+  }
+});

package/tests/application_echo.mjs

@@ -274,7 +274,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 let relay = { status: 201, body: { ok: true } };
 const realFetch = globalThis.fetch;
 globalThis.fetch = async (url) => {
-  if (String(url).endsWith('/api/gds/access-requests')) {
+  if (String(url).endsWith('/api/bongos/access-requests')) {
     if (relay === null) throw new Error('connection refused');
     return { status: relay.status, json: async () => relay.body };
   }
@@ -285,7 +285,7 @@ after(() => { globalThis.fetch = realFetch; });
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-app.use('/api/gds', myProjectsRoutes());
+app.use('/api/bongos', myProjectsRoutes());
 
 let server, port;
 before(async () => {
@@ -314,7 +314,7 @@ function call(method, pathname, body) {
     req.end(payload);
   });
 }
-const join = (note) => call('POST', '/api/gds/my-projects/join', { origin: 'https://target.example', note });
+const join = (note) => call('POST', '/api/bongos/my-projects/join', { origin: 'https://target.example', note });
 
 test('the interpreter refuses a predicate it cannot read — parameterised or not', () => {
   assert.throws(() => predicateFor('github_id = $1::bigint AND something = $2', [1, 2]), /unread predicate on \$2/);
@@ -391,7 +391,7 @@ test('a failed echo write never turns a filed application into a reported failur
 test('GET /my-projects reports what was applied to and when — and no status', async () => {
   seed();
   relay = { status: 201, body: { ok: true } };
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.equal(r.status, 200);
   const applied = r.json.applied;
   assert.deepEqual(applied.map((a) => a.client_id), ['proj-open', 'proj-invited'],
@@ -405,7 +405,7 @@ test('GET /my-projects reports what was applied to and when — and no status',
 
 test('a project the applicant now BUILDS on drops out of applied — membership is the approval signal', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined']);
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-joined'),
     'an approval becomes visible by the card flipping to member, never by the echo claiming it');
@@ -421,7 +421,7 @@ test('a project the applicant now BUILDS on drops out of applied — membership
 
 test('an echo older than the window is invisible, not deleted', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-stale'),
     'a declined application must not read as "applied" forever');
   assert.ok(echoes.some((e) => e.client_id === 'proj-stale'), 'and the row is still there — the window is read-time');
@@ -429,7 +429,7 @@ test('an echo older than the window is invisible, not deleted', async () => {
 
 test('the echo read is own-scope: another account’s row is never reachable', async () => {
   seed();
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.ok(!r.json.applied.some((a) => a.client_id === 'proj-someone-elses'));
   const echoRead = statements.find((s) => /FROM platform_identity_application_echoes/.test(s.sql));
   assert.match(echoRead.sql, /WHERE e\.github_id = \$1::bigint/, 'keyed on the session, never on anything from the request');
@@ -444,12 +444,12 @@ test('the echo read is own-scope: another account’s row is never reachable', a
 test('leaving a project forgets the application that got you in', async () => {
   seed();
   assert.ok(echo('proj-joined'), 'precondition: the echo from the original application is still on file');
-  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  const left = await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.equal(left.status, 200);
   assert.equal(left.json.left, true);
   assert.equal(echo('proj-joined'), undefined, 'the echo goes with the membership');
 
-  const after = await call('GET', '/api/gds/my-projects');
+  const after = await call('GET', '/api/bongos/my-projects');
   assert.ok(!after.json.building.some((b) => b.client_id === 'proj-joined'));
   assert.ok(!after.json.applied.some((a) => a.client_id === 'proj-joined'),
     'and it does NOT come back as "applied" now that the membership no longer hides it');
@@ -457,7 +457,7 @@ test('leaving a project forgets the application that got you in', async () => {
 
 test('leaving forgets only the leaver’s own echo, for only that project', async () => {
   seed();
-  await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.ok(echo('proj-open'), 'a different project of mine is untouched');
   assert.ok(echoes.some((e) => e.client_id === 'proj-someone-elses'), 'and so is another account’s row');
 });
@@ -465,7 +465,7 @@ test('leaving forgets only the leaver’s own echo, for only that project', asyn
 test('a failed echo cleanup does not fail a leave that already happened', async () => {
   seed();
   echoFails = true;
-  const left = await call('POST', '/api/gds/my-projects/proj-joined/leave');
+  const left = await call('POST', '/api/bongos/my-projects/proj-joined/leave');
   assert.equal(left.status, 200, 'the membership is already gone — the echo is a convenience, not the act');
   assert.equal(left.json.left, true);
 });
@@ -473,7 +473,7 @@ test('a failed echo cleanup does not fail a leave that already happened', async
 test('a failed echo read costs the applied list and nothing else', async () => {
   seed();
   echoFails = true;
-  const r = await call('GET', '/api/gds/my-projects');
+  const r = await call('GET', '/api/bongos/my-projects');
   assert.equal(r.status, 200);
   assert.deepEqual(r.json.applied, []);
   assert.deepEqual(r.json.building.map((b) => b.client_id), ['proj-joined'], 'the memberships listing still lands');

package/tests/artifact_audit.mjs

@@ -171,7 +171,7 @@ await t('a finding is filed to the blocker surface, not only printed', async ()
   const call = async (method, path, body) => { sent.push({ method, path, body }); return { ok: true, status: 201, data: { blocker: { id: 42 } } }; };
   const r = await fileBlocker([{ id: '1003188', status: 'shipped', shipped_at: '2026-08-23', title: 'Go-live', touches: ['package.json'] }], { call });
   assert.equal(r.filed, true);
-  assert.equal(sent[0].path, '/api/gds/blockers');
+  assert.equal(sent[0].path, '/api/bongos/blockers');
   assert.equal(sent[0].body.source, 'artifact-audit');
   assert.match(sent[0].body.body_md, /task 1003188/);
 });