@bongos/core 1.19.804 → 1.19.806

package/tests/auth_page_gate.mjs

@@ -74,7 +74,7 @@ await t('unauthenticated request → 302 to sign-in, next() NOT called', async (
   assert.equal(nexted, false, 'next() must not run for an unauthenticated request');
   assert.ok(res._redirect, 'a redirect must be issued');
   assert.equal(res._redirect.code, 302);
-  assert.equal(res._redirect.loc, '/api/gds/auth/web/start');
+  assert.equal(res._redirect.loc, '/api/bongos/auth/web/start');
 });
 
 await t('authenticated request → next() called, no redirect', async () => {
@@ -95,7 +95,7 @@ await t('session lookup error → fails CLOSED (redirect, next() NOT called)', a
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'must not serve the page when the lookup errors');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start',
     'must redirect to sign-in on a lookup error (fail closed)');
 });
 
@@ -118,7 +118,7 @@ await t('box-scoped session → 302 to sign-in even though its builder holds the
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'a box session must not be served a gated page shell');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start',
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start',
     'the remedy is a different session (/builder-reauth), so sign-in — not deniedTo');
 });
 
@@ -129,7 +129,7 @@ await t('a source the registry does not declare → denied, never treated as uns
   let nexted = false;
   await auth.requireBuilderPage(req, res, () => { nexted = true; });
   assert.equal(nexted, false, 'an unrecognised scope must fail closed, exactly as requireBuilder does');
-  assert.ok(res._redirect && res._redirect.loc === '/api/gds/auth/web/start');
+  assert.ok(res._redirect && res._redirect.loc === '/api/bongos/auth/web/start');
 });
 
 await t('cli and web sessions are untouched by the scope check', async () => {

package/tests/auth_web_recovery.mjs

@@ -21,22 +21,22 @@ const req = (cookie) => ({ headers: cookie ? { cookie } : {} });
 
 test('the retry door carries the wizard return and the repo-scope opt-in while their cookies are valid', () => {
   assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew; gds_oauth_repos=1')),
-    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
+    '/api/bongos/auth/web/start?return=%2Fprojects%3Fview%3Dnew&repos=1');
   assert.equal(recoveryStartHref(req('gds_return=%2Fprojects%3Fview%3Dnew')),
-    '/api/gds/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
-  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/gds/auth/web/start?repos=1');
+    '/api/bongos/auth/web/start?return=%2Fprojects%3Fview%3Dnew', 'a hall sign-in never asks for repos');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=1')), '/api/bongos/auth/web/start?repos=1');
 });
 
 test('with nothing left to rebuild from, the door is the bare start — never a guess', () => {
-  assert.equal(recoveryStartHref(req('')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/gds/auth/web/start', 'only the literal opt-in counts');
+  assert.equal(recoveryStartHref(req('')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_session=abc')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_oauth_repos=0')), '/api/bongos/auth/web/start', 'only the literal opt-in counts');
 });
 
 test('the door is under the same open-redirect allowlist as the callback', () => {
-  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/gds/auth/web/start');
-  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/gds/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=https%3A%2F%2Fevil.example%2Fx')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=%2F%2Fevil.example')), '/api/bongos/auth/web/start');
+  assert.equal(recoveryStartHref(req('gds_return=javascript%3Aalert(1)')), '/api/bongos/auth/web/start');
 });
 
 test('every OAuth error page and the pending page rebuild their door from the cookies', () => {
@@ -47,8 +47,8 @@ test('every OAuth error page and the pending page rebuild their door from the co
     'GitHub refused · State mismatch · handshake threw — three pages, three doors');
   assert.match(callback, /renderAccessPendingPage\(err\.login, recoveryStartHref\(req\)\)/, 'the auto-walk-in lands where the founder was going');
   assert.match(callback, /const onWayToProject = founderReturn\.startsWith\('\/projects'\);/, 'the founder-shaped NOT_APPROVED note');
-  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/gds\/auth\/web\/start', label: copy\.ctaLabel \};/);
-  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/gds\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
+  assert.match(SRC, /const cta = opts\.cta \|\| \{ href: opts\.startHref \|\| '\/api\/bongos\/auth\/web\/start', label: copy\.ctaLabel \};/);
+  assert.match(SRC, /data-start="\$\{escapeHtml\(startHref \|\| '\/api\/bongos\/auth\/web\/start'\)\}"/, 'the pending page reads its start from a data attribute, never string-built into script');
   assert.match(SRC, /function land\(\) \{ window\.location\.href = start; \}/);
 });
 

package/tests/bongos_login.mjs

@@ -16,12 +16,15 @@ const require = createRequire(import.meta.url);
 const { normalizeInstanceBase, pollDecision } = require('../scripts/gds/login.js');
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'gds', 'login.js');
 
-test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/gds', () => {
+test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/bongos', () => {
   assert.equal(normalizeInstanceBase('example.com'), 'https://example.com');
   assert.equal(normalizeInstanceBase('https://example.com/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('https://example.com///'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos/'), 'https://example.com');
+  assert.equal(normalizeInstanceBase('https://example.com/api/bongos/v1'), 'https://example.com');
+  // the permanent alias is still a legal paste — task 1003707 moved the callers, not the door
   assert.equal(normalizeInstanceBase('https://example.com/api/gds'), 'https://example.com');
-  assert.equal(normalizeInstanceBase('https://example.com/api/gds/'), 'https://example.com');
   assert.equal(normalizeInstanceBase('http://localhost:3000'), 'http://localhost:3000');
 });
 
@@ -58,10 +61,10 @@ test('login on a Device-Flow-disabled instance explains the cause and the cure',
       res.writeHead(code, { 'Content-Type': 'application/json' });
       res.end(JSON.stringify(body));
     };
-    if (req.url.endsWith('/api/gds/instance')) {
+    if (req.url.endsWith('/api/bongos/instance')) {
       return send(200, { schema: 'instance-manifest/v1', name: 'Stub', admission: { policy: 'invite-only' } });
     }
-    if (req.url.endsWith('/api/gds/auth/device/start')) {
+    if (req.url.endsWith('/api/bongos/auth/device/start')) {
       // Byte-for-byte what a real instance returned when its App had the box unticked.
       return send(424, { error: { code: 'device_start_failed', message: 'device/code failed (400): {"error":"device_flow_disabled","error_description":"Device Flow must be explicitly enabled for this App"}' } });
     }

package/tests/box_env.mjs

@@ -20,15 +20,15 @@ const box = require('../scripts/gds/box.js');
 
 const { test, summary } = makeRunner();
 
-await test('bakes GDS_BASE as the FULL api base (origin + /api/gds) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
+await test('bakes GDS_BASE as the FULL api base (origin + /api/bongos) — matches box-report-*.sh, not box-heartbeat.sh\'s bare-origin BASE', () => {
   const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
 });
 
-await test('strips a trailing slash off the origin before appending /api/gds', () => {
+await test('strips a trailing slash off the origin before appending /api/bongos', () => {
   const env = box.buildBoxEnv({ apiOrigin: 'https://cloudbongos.com/' });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
-  assert.ok(!env.includes('//api/gds'), 'must not double the slash');
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
+  assert.ok(!env.includes('//api/bongos'), 'must not double the slash');
 });
 
 await test('no named tunnel: box.env carries GDS_BASE and nothing else', () => {
@@ -44,7 +44,7 @@ await test('named tunnel: box.env carries GDS_BASE AND all four tunnel vars', ()
       credential: 'cred456', previewHostname: 'sandbox-alice.example.com',
     },
   });
-  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/gds$/m);
+  assert.match(env, /^GDS_BASE=https:\/\/cloudbongos\.com\/api\/bongos$/m);
   assert.match(env, /^BOX_TUNNEL_TOKEN=tok123$/m);
   assert.match(env, /^BOX_TERMINAL_HOSTNAME=term-alice\.example\.com$/m);
   assert.match(env, /^BOX_TERMINAL_CREDENTIAL=cred456$/m);

package/tests/bug_attachments.mjs

@@ -101,7 +101,7 @@ await t('persistImageFromUrl: content-type says png but bytes are not → sniff_
 await t('persistImageFromUrl: valid PNG → written to disk, returns durable url', async () => {
   const r = await at.persistImageFromUrl('https://cdn.discordapp.com/a.png', { messageId: 'm42', fetchImpl: fakeFetch(PNG), dir: TMP });
   assert.equal(r.ok, true);
-  assert.match(r.url, /^\/api\/gds\/bug-attachments\/bug-m42-[0-9a-f]{16}\.png$/);
+  assert.match(r.url, /^\/api\/bongos\/bug-attachments\/bug-m42-[0-9a-f]{16}\.png$/);
   assert.equal(at.isSafeName(r.file), true);
   const onDisk = await fs.readFile(path.join(TMP, r.file));
   assert.equal(onDisk.length, PNG.length);

package/tests/cli_sessions.mjs

@@ -259,7 +259,7 @@ test('login VERIFIES a stored token before trusting it, and can be forced past',
   // A stored token may be expired or revoked. Reinstating one unchecked would leave the builder
   // "signed in" to a session every later command then fails on.
   assert.match(src, /loadStoredSession\(base\)/);
-  assert.match(src, /\/api\/gds\/me`, \{ headers: \{ Authorization/);
+  assert.match(src, /\/api\/bongos\/me`, \{ headers: \{ Authorization/);
   assert.match(src, /if \(me\.ok && me\.data && me\.data\.builder\)/);
   assert.match(src, /--force/, 'there must be a way to sign in as somebody else');
 });

package/tests/dev_lib.mjs

@@ -211,7 +211,7 @@ t('stop: kills a live pid, reports not-running otherwise', () => {
 await ta('health: up + authConfigured parsed from the two healthz routes', async () => {
   const params = { port: 3006 };
   const deps = { fetchImpl: async (url) => {
-    if (url.endsWith('/api/gds/healthz')) return { status: 200, json: async () => ({ ok: true, auth_configured: true }) };
+    if (url.endsWith('/api/bongos/healthz')) return { status: 200, json: async () => ({ ok: true, auth_configured: true }) };
     if (url.endsWith('/healthz')) return { status: 200 };
     return { status: 404 };
   } };

package/tests/discord_bugs.mjs

@@ -99,7 +99,7 @@ function makeDeps(over = {}) {
       calls.persist.push({ urls, opts });
       if (over.persistThrows) throw new Error('persist boom');
       // default: echo each url back as a stored ref unless overridden
-      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/gds/bug-attachments/bug-x-${i}.png` }));
+      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/bongos/bug-attachments/bug-x-${i}.png` }));
     },
   };
   return { deps, calls };
@@ -282,7 +282,7 @@ await t('recordInboundBug: text + images → persists images + embeds durable li
   assert.equal(calls.persist.length, 1);
   assert.deepEqual(calls.persist[0].urls, ['https://cdn.discordapp.com/a.png']);
   assert.match(calls.create[0].bodyMd, /Attachments \(1\)/);
-  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.create[0].bodyMd, /!\[attachment 1\]\(\/api\/bongos\/bug-attachments\//);
 });
 
 await t('recordInboundBug: image-only (empty text) → filed with screenshot title', async () => {

package/tests/discord_inbound.mjs

@@ -71,7 +71,7 @@ function makeDeps(over = {}) {
     persistImages: async (urls, opts) => {
       calls.persist.push({ urls, opts });
       if (over.persistThrows) throw new Error('persist boom');
-      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/gds/bug-attachments/bug-x-${i}.png` }));
+      return over.stored ?? urls.map((u, i) => ({ file: `bug-x-${i}.png`, url: `/api/bongos/bug-attachments/bug-x-${i}.png` }));
     },
   };
   return { deps, calls };
@@ -224,7 +224,7 @@ await t('recordInboundIdea: text + images → persists + embeds durable links',
   assert.equal(r.images, 1);
   assert.equal(calls.persist.length, 1);
   assert.match(calls.capture[0].bodyMd, /Attachments \(1\)/);
-  assert.match(calls.capture[0].bodyMd, /!\[attachment 1\]\(\/api\/gds\/bug-attachments\//);
+  assert.match(calls.capture[0].bodyMd, /!\[attachment 1\]\(\/api\/bongos\/bug-attachments\//);
 });
 
 await t('recordInboundIdea: UNLINKED author with image → still re-hosted (guards, not identity)', async () => {

package/tests/explore_visible_states.mjs

@@ -280,6 +280,6 @@ test('the page reads the public feed and asks for JSON', async () => {
   const r = render([]);
   await settle();
   assert.equal(r.requests.length, 1);
-  assert.equal(r.requests[0].url, '/api/gds/projects/featured');
+  assert.equal(r.requests[0].url, '/api/bongos/projects/featured');
   assert.equal(r.requests[0].opts.headers.Accept, 'application/json');
 });

package/tests/goal_invite_consent.mjs

@@ -0,0 +1,307 @@
+// tests/goal_invite_consent.mjs — the goals page INVITES; it does not force-add
+// behind the word "Invited." (task 1002886, goal 1000095).
+//
+// WHY THIS FILE EXISTS. The '+ Invite' control posted to POST /goals/:id/members
+// — the immediate force-add — and then toasted 'Invited.' The person was already
+// in the goal and had never been asked. Meanwhile ADR 0112's consented flow
+// (POST /goals/:id/invitations -> a pending row -> the invitee accepts) had its
+// RECEIVING half fully wired in goal-inbox.js and no sender anywhere in the hall,
+// so nothing in the product ever created an invitation.
+//
+// Nothing in tests/ touched the invite box before this file — which is how a
+// control could claim one thing and do the opposite for as long as it did. The
+// lesson generalises past this button: assert the REQUEST a control issues and
+// the SENTENCE it then shows, because those two drifting apart is invisible to
+// any test that only checks the control renders.
+//
+// It runs the REAL goals-render.js (plus the real goals-lib, task-lib and kit)
+// in a vm against a stub DOM and a recording postJSON, and drives renderDetail —
+// the actual entry point, not the private renderer — so what is asserted is the
+// call the page really makes.
+//
+// Run:  node tests/goal_invite_consent.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const P = 'modules/hall-ui/public/';
+const RENDER_JS = read(`${P}goals-render.js`);
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+const SELF = 7001;          // the viewer: the goal's creator, so canManage is true
+const MEMBER_ID = 7002;     // already in the goal
+const PENDING_ID = 7003;    // holds a pending invitation the goal sent
+const FREE_ID = 7004;       // neither — the only genuinely invitable builder
+
+function makeEl(id) {
+  const el = {
+    id,
+    innerHTML: '', textContent: '', value: '', className: '',
+    hidden: false, disabled: false, checked: false,
+    options: [], style: {}, dataset: {},
+    children: [],
+    classList: { add() {}, remove() {}, toggle() {}, contains: () => false },
+    appendChild(c) { el.children.push(c); return c; },
+    setAttribute() {}, removeAttribute() {}, focus() {}, scrollIntoView() {},
+    _on: new Map(),
+    addEventListener(ev, fn) {
+      if (!el._on.has(ev)) el._on.set(ev, []);
+      el._on.get(ev).push(fn);
+    },
+    fire(ev, arg) {
+      for (const fn of el._on.get(ev) || []) fn(arg || { preventDefault() {} });
+    },
+    querySelector() { return null; },
+    querySelectorAll() { return []; },
+  };
+  return el;
+}
+
+function harness({ pendingRequests = [] } = {}) {
+  const els = new Map();
+  // The box is re-rendered by replacing innerHTML, and the stub DOM does not
+  // parse HTML — so the controls the page writes into #goal-invite are modelled
+  // by their ids, which is exactly how the page reaches them ($('#id')).
+  // Ids the invite box writes INTO itself. Listed rather than inferred because
+  // the stub does not parse HTML — this is the seam where it has to imitate the
+  // one thing real innerHTML does that matters here: destroy what was there.
+  const INVITE_CHILD_IDS = [
+    'goal-invite-open', 'goal-invite-form', 'goal-invite-builder', 'goal-invite-note',
+    'goal-invite-cancel', 'goal-direct-open', 'goal-direct-form', 'goal-direct-builder',
+    'goal-direct-kind', 'goal-direct-cancel',
+  ];
+  const getEl = (id) => {
+    const key = String(id).replace(/^#/, '');
+    if (!els.has(key)) {
+      const el = makeEl(key);
+      if (key === 'goal-invite') {
+        // THE BUG THIS MODELS IS REAL: renderInviteBox rebuilds the box on every
+        // call, and a stub that kept the old nodes alive would keep their click
+        // handlers too — so a single click would re-enter the renderer once per
+        // previous render. That is a defect in the STUB, not the page, but only
+        // because the page really does replace these nodes. Keep them in step.
+        let html = '';
+        Object.defineProperty(el, 'innerHTML', {
+          get: () => html,
+          set: (v) => { html = String(v); for (const cid of INVITE_CHILD_IDS) els.delete(cid); },
+        });
+      }
+      els.set(key, el);
+    }
+    return els.get(key);
+  };
+  const documentObj = {
+    documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
+    body: makeEl('body'),
+    getElementById: getEl,
+    querySelector: (sel) => getEl(sel),
+    querySelectorAll: () => [],
+    createElement: () => makeEl(),
+    addEventListener() {},
+  };
+
+  const posts = [];
+  const toasts = [];
+  const state = {
+    current: 1,
+    view: 'detail',
+    details: new Map(),
+    directory: [
+      { id: MEMBER_ID, display_name: 'Ada Member', github_login: 'ada' },
+      { id: PENDING_ID, display_name: 'Ben Pending', github_login: 'ben' },
+      { id: FREE_ID, display_name: 'Cleo Free', github_login: 'cleo' },
+    ],
+    pendingRequests,
+    myPendingRequest: null,
+    inviteOpen: false,
+    addDirectOpen: false,
+    // The rest of the page state renderDetail walks through on its way to the
+    // invite box. Shapes copied from goals-page.js's initial state — the
+    // renderers read several of these unguarded, so a partial stub throws
+    // before execution ever reaches what is under test here.
+    workSort: { todo: { by: null, dir: 'desc' }, done: { by: null, dir: 'desc' } },
+    work: { todo: [], done: [] },
+    workLoaded: false,
+    claimsByTask: new Map(),
+    conflictPairs: null,
+    conflictSource: null,
+    rollups: new Map(),
+    activity: new Map(),
+  };
+
+  const windowObj = {
+    location: { assign() {}, href: '/goals' },
+    localStorage: { getItem: () => null, setItem() {}, removeItem() {} },
+    scrollTo() {}, addEventListener() {},
+    matchMedia: () => ({ matches: false, addEventListener() {}, addListener() {} }),
+    OTB: {
+      escapeHtml: (s) => String(s == null ? '' : s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;'),
+      $: (sel) => documentObj.querySelector(sel),
+      fmtNum: (n) => String(n ?? ''),
+      fmtInt: (n) => String(n ?? ''),
+      fmtDate: (d) => String(d ?? '').slice(0, 10),
+      toast: (m) => toasts.push(String(m)),
+      rankLabel: (r) => String(r ?? ''),
+      categoryChip: () => '',
+      num: (n) => Number(n) || 0,
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams, encodeURIComponent, Date, Math, JSON, Set, Map,
+    fetch: () => Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  for (const f of ['hall-kit.js', 'task-lib.js', 'goals-lib.js', 'goals-render.js']) {
+    vm.runInContext(read(P + f), sandbox, { filename: f });
+  }
+
+  const goal = {
+    id: 1, version_id: 'BONGOS-V2', status: 'open', visibility: 'public',
+    created_by: SELF, title: 'A goal', scope_modules: [], accepting_requests: true,
+  };
+  const members = [{ builder_id: MEMBER_ID, display_name: 'Ada Member', membership_kind: 'member' }];
+  const detail = { goal, members, criteria: [], satisfied: [], tasks: [] };
+  state.details.set('1', detail);
+
+  const api = sandbox.window.OTBGoalsRender({
+    API: '/api/bongos',
+    curLabel: () => 'Credits',
+    // URL-aware, because the renderers walk several feeds on the way to the
+    // invite box and a one-shape-fits-all reply feeds the wrong array into the
+    // wrong pager.
+    getJSON: async (url) => {
+      if (/\/goals\/\d+\/requests$/.test(url)) return { requests: pendingRequests };
+      if (/\/goals\/inbox$/.test(url)) return { myPendingRequests: [] };
+      if (/\/builders\/directory/.test(url)) return { builders: state.directory };
+      if (/\/tasks/.test(url)) return { tasks: [] };
+      if (/\/claims/.test(url)) return { claims: [] };
+      return {};
+    },
+    patchJSON: async () => ({}),
+    postJSON: async (url, body) => { posts.push({ url, body }); return { ok: true }; },
+    sameId: (a, b) => String(a ?? '') === String(b ?? ''),
+    selfId: () => SELF,
+    state,
+    get workTabs() { return { activate() {} }; },
+  });
+
+  return { api, state, posts, toasts, getEl, els };
+}
+
+// Open the invite box the way a user does: render the detail, then click
+// "+ Invite". Returns the harness with the form on screen.
+async function openInviteForm(h) {
+  h.api.renderDetail(1);
+  await tick();
+  h.getEl('goal-invite-open').fire('click');
+  await tick(); await tick();
+  return h;
+}
+
+// ---------------------------------------------------------------------------
+
+await test('the source no longer names the force-add as an "invite"', () => {
+  assert.ok(!/async function inviteMember\b/.test(RENDER_JS),
+    'inviteMember() was the force-add wearing the word invite — it is split in two');
+  assert.match(RENDER_JS, /async function sendInvitation\(/, 'the consented sender exists');
+  assert.match(RENDER_JS, /async function addMemberDirectly\(/, 'the force-add is named for what it does');
+  assert.ok(!/toast\('Invited\.'\)/.test(RENDER_JS), "the 'Invited.' toast on a force-add is gone");
+});
+
+await test('the invite form posts to /invitations and never claims they joined', async () => {
+  const h = await openInviteForm(harness());
+  h.getEl('goal-invite-builder').value = String(FREE_ID);
+  h.getEl('goal-invite-note').value = '  we could use your eye on this  ';
+  h.getEl('goal-invite-form').fire('submit');
+  await tick(); await tick();
+
+  assert.equal(h.posts.length, 1, 'exactly one write');
+  const { url, body } = h.posts[0];
+  assert.match(url, /\/goals\/1\/invitations$/, 'the CONSENTED endpoint, not /members');
+  assert.ok(!/\/members$/.test(url), 'the force-add endpoint is not what Invite calls');
+  assert.equal(body.builder_id, FREE_ID);
+  assert.equal(body.note, 'we could use your eye on this', 'the note is sent, trimmed');
+  assert.ok(!('membership_kind' in body),
+    'the invitations route carries no membership_kind — sending one would be a choice dropped in silence');
+
+  const said = h.toasts.join(' ');
+  assert.match(said, /accept/i, 'the toast turns on their acceptance');
+  assert.ok(!/^Invited\.$/.test(h.toasts[0]), 'the old lie is not relocated');
+  assert.ok(!/\b(added|joined|is now a member)\b/i.test(said),
+    `nobody joined anything yet — got: ${JSON.stringify(h.toasts)}`);
+});
+
+await test('an empty note is omitted rather than sent as an empty string', async () => {
+  const h = await openInviteForm(harness());
+  h.getEl('goal-invite-builder').value = String(FREE_ID);
+  h.getEl('goal-invite-note').value = '   ';
+  h.getEl('goal-invite-form').fire('submit');
+  await tick(); await tick();
+  assert.ok(!('note' in h.posts[0].body), 'a blank note is absent, not ""');
+});
+
+await test('the invite form offers no membership-kind picker', async () => {
+  const h = await openInviteForm(harness());
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(!/id="goal-invite-kind"/.test(html),
+    'the picker cannot be honoured by an invitation — goal_membership_requests has no such column');
+  assert.match(html, /join as a member/i, 'and the form says what they will join as instead');
+});
+
+await test('the dropdown excludes members AND anyone already pending', async () => {
+  const h = await openInviteForm(harness({
+    pendingRequests: [{ id: 55, kind: 'invite', builder_id: PENDING_ID, display_name: 'Ben Pending' }],
+  }));
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(html.includes(`value="${FREE_ID}"`), 'the invitable builder is offered');
+  assert.ok(!html.includes(`value="${MEMBER_ID}"`), 'a member would 409 already_a_member');
+  // The one that matters: a pending invitation is INVISIBLE in the member list,
+  // so without this filter the user picks an ordinary-looking name and is handed
+  // an error they had no way to predict.
+  assert.ok(!html.includes(`value="${PENDING_ID}"`), 'a pending invitee would 409 invite_pending');
+});
+
+await test('a pending JOIN-REQUEST is excluded too, not just an invitation', async () => {
+  const h = await openInviteForm(harness({
+    pendingRequests: [{ id: 56, kind: 'request', builder_id: PENDING_ID }],
+  }));
+  const html = h.getEl('goal-invite').innerHTML;
+  assert.ok(!html.includes(`value="${PENDING_ID}"`),
+    'the server refuses on EITHER kind, so the filter may not look only at invites');
+});
+
+await test('the force-add survives, one click away, and says nobody was asked', async () => {
+  const h = await openInviteForm(harness());
+  const collapsed = h.getEl('goal-invite').innerHTML;
+  assert.match(collapsed, /without asking/i, 'the path is discoverable, not removed');
+  assert.ok(!/id="goal-direct-form"/.test(collapsed), 'but it is not the default control');
+
+  h.getEl('goal-direct-open').fire('click');
+  await tick();
+  const open = h.getEl('goal-invite').innerHTML;
+  assert.match(open, /id="goal-direct-kind"/, 'the membership kind IS honoured on this path, so it is offered here');
+
+  h.getEl('goal-direct-builder').value = String(FREE_ID);
+  h.getEl('goal-direct-kind').value = 'lead';
+  h.getEl('goal-direct-form').fire('submit');
+  await tick(); await tick();
+
+  assert.equal(h.posts.length, 1);
+  assert.match(h.posts[0].url, /\/goals\/1\/members$/, 'the force-add endpoint');
+  assert.equal(h.posts[0].body.membership_kind, 'lead', 'and the chosen kind travels');
+  const said = h.toasts.join(' ');
+  assert.match(said, /without being asked/i, 'the consequence is stated, not hidden behind "Invited."');
+});
+
+summary();

package/tests/government_page_gates.mjs

@@ -98,7 +98,7 @@ const GATE_FLOOR = {
   // ADR 0157: `page.view.government` floor archon→metic.
   requireGovernmentPage: 'metic',
 };
-const SIGN_IN = '/api/gds/auth/web/start';
+const SIGN_IN = '/api/bongos/auth/web/start';
 
 // --- doubles ----------------------------------------------------------------
 function fakeRes() {

package/tests/hall_reference_world.mjs

@@ -241,7 +241,7 @@ const costSummaryFixture = JSON.parse(
 test('the treasury reads the endpoint that already carried the series — no new route', () => {
   // The whole point of the task: the payload had both series all along, and the
   // route's own comment calls daily[] "the treasury chart's cumulative line".
-  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/gds\/public\/cost-summary'/);
+  assert.match(drachmaeJs, /TREASURY_URL = '\/api\/bongos\/public\/cost-summary'/);
   assert.ok(costSummaryFixture.daily.length, 'the payload really carries daily[]');
   assert.ok(costSummaryFixture.daily_credits.length, 'and daily_credits[]');
   assert.ok(Number(costSummaryFixture.total_usd) > 0, 'and the totals the prose states');

package/tests/idea_ideate_full.mjs

@@ -93,7 +93,7 @@ test('it describes NO second write path', () => {
   // ends up sending a different payload than the form does, and the two records
   // drift while both claim to be Full Ideas.
   assert.ok(!/curl/i.test(SKILL), 'no hand-rolled HTTP');
-  assert.ok(!/api\.js POST \/api\/gds\/inbox/.test(SKILL), 'no raw POST for filing an idea');
+  assert.ok(!/api\.js POST \/api\/bongos\/inbox/.test(SKILL), 'no raw POST for filing an idea');
   const grade = [...SKILL.matchAll(/grade\s*=\s*'([a-z]+)'/g)].map((m) => m[1]);
   assert.ok(grade.every((g) => g === 'full'), `only the full grade is named: ${JSON.stringify(grade)}`);
 });

package/tests/idp_federation.mjs

@@ -29,7 +29,7 @@ t('builds the hub /sso/authorize URL with client_id, redirect_uri, state', () =>
   const url = auth.idpAuthorizeUrl('https://cloudbongos.com', 'client-abc', 'st8', 'https://proj.example.com/api/gds/auth/web/callback');
   const u = new URL(url);
   assert.equal(u.origin, 'https://cloudbongos.com');
-  assert.equal(u.pathname, '/api/gds/sso/authorize');
+  assert.equal(u.pathname, '/api/bongos/sso/authorize');
   assert.equal(u.searchParams.get('client_id'), 'client-abc');
   assert.equal(u.searchParams.get('redirect_uri'), 'https://proj.example.com/api/gds/auth/web/callback');
   assert.equal(u.searchParams.get('state'), 'st8');
@@ -37,7 +37,7 @@ t('builds the hub /sso/authorize URL with client_id, redirect_uri, state', () =>
 
 t('trims a trailing slash on the hub origin', () => {
   const url = auth.idpAuthorizeUrl('https://cloudbongos.com/', 'c', 's', 'https://p/cb');
-  assert.equal(new URL(url).pathname, '/api/gds/sso/authorize');
+  assert.equal(new URL(url).pathname, '/api/bongos/sso/authorize');
   assert.ok(!url.includes('com//api'), 'no double slash between origin and path');
 });
 

package/tests/llm-cache.mjs

@@ -88,7 +88,7 @@ await arun('lookup: routes to apiCall on a HIT (right method/path/args)', async
   const r = await c.lookup(KEY, { tokensSavedEst: 12 });
   assert.equal(r.result_stdout, 'X');
   assert.equal(calls[0][0], 'POST');
-  assert.equal(calls[0][1], '/api/gds/llm-cache/lookup');
+  assert.equal(calls[0][1], '/api/bongos/llm-cache/lookup');
   assert.deepEqual(calls[0][2], { cache_key: KEY, tokens_saved_est: 12 });
   assert.deepEqual(calls[0][3], { allowUnauthenticated: true });
 });

package/tests/manage_manifest_shared_read.mjs

@@ -2,7 +2,7 @@
 // manifest per manage entry, EXECUTED (task 1003554).
 //
 // The defect this pins shut: entering /projects?view=manage fetched
-// https://<project>/api/gds/instance twice, identically and cross-origin,
+// https://<project>/api/bongos/instance twice, identically and cross-origin,
 // because the two cards that render a "what it runs right now" line — how the
 // project is reached (brand.project.platformVisibility) and how people join
 // (brand.project.joinability) — each asked the project for themselves. Two
@@ -99,7 +99,7 @@ test('the two cards of one manage entry cost ONE round trip, not two', async ()
 
   // Assert
   assert.equal(ui.requests.length, 1, 'one cross-origin GET served both lines');
-  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/gds/instance');
+  assert.equal(ui.requests[0].url, 'https://demo.example.com/api/bongos/instance');
   assert.equal(ui.requests[0].mode, 'cors', 'the project is somebody else’s origin');
   for (const a of answers) {
     assert.equal(a.ok, true);
@@ -151,7 +151,7 @@ test('switching projects is never served the previous project’s manifest', asy
 
   // Assert
   assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
-  assert.equal(ui.requests[1].url, 'https://two.example.com/api/gds/instance');
+  assert.equal(ui.requests[1].url, 'https://two.example.com/api/bongos/instance');
 });
 
 test('a project that answered-and-refused RESOLVES carrying its status — both lines can say so', async () => {

package/tests/people_directory_clip.mjs

@@ -150,7 +150,7 @@ await test('the page asks for exactly the ceiling, and asks for it ONCE', async
   const h = harness({ count: 3 });
   await tick(); await tick();
   assert.equal(h.requests.length, 1, 'one directory read');
-  assert.match(h.requests[0], /\/api\/gds\/scouting\?limit=/);
+  assert.match(h.requests[0], /\/api\/bongos\/scouting\?limit=/);
   const limit = Number(new URLSearchParams(h.requests[0].split('?')[1]).get('limit'));
   assert.equal(limit, CEILING, `the page must ask for the route ceiling (${CEILING})`);
 });

package/tests/planning_session_skill.mjs

@@ -31,7 +31,7 @@ function test(name, fn) {
 test('the seeding contract documents the self-check convention', () => {
   assert.ok(NORM.includes('verifySeedCriteriaLinks'), 'names the helper function');
   assert.ok(NORM.includes('seed-verify-criteria.js'), 'names the shared helper file');
-  assert.ok(NORM.includes('GET /api/gds/goals/<id>'), 'names the endpoint the self-check fetches');
+  assert.ok(NORM.includes('GET /api/bongos/goals/<id>'), 'names the endpoint the self-check fetches');
 });
 
 test('the self-check is described as failing loudly on any mismatch, zero included', () => {