@bongos/core 1.20.19 → 1.20.21

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.19",
-  "core_contract": "1.20.19",
-  "source_commit": "634240626e5878bfa71f84a126f2a5066315c631",
+  "core_version": "1.20.21",
+  "core_contract": "1.20.21",
+  "source_commit": "21843bf1398d569536fc45f748fae3c195be4ba2",
   "source_ref": "HEAD",
-  "built_at": "2026-09-30T14:16:31.957Z",
+  "built_at": "2026-09-30T15:20:08.598Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 557,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2631,
+    "functional_verbatim": 2638,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3214,
-  "tree_sha256": "1941a2dc44fb870a71c3227166d032c854f48237c2fef4cc958e355f9658f585",
+  "file_count": 3221,
+  "tree_sha256": "07ce496b1770bfc67bcd98bdf44e2bc6a47d1f869682f5fba2db1ded196d0b07",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -327,12 +327,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "e02ae1f840ce2b9ba26906d22a71251f99093c1be99b7585d8d5492de6828247"
+      "sha256": "680d37464fa929b11cd7a02af6aa4fb144bedcde5134c3d81edac167d7b95980"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "d2eddb6398add51948e7facc2b3752a4bc9c2a1c5826cdade034328529389dd2"
+      "sha256": "c6dac0dab2b2d5fb996568cff8ead84e7f6ac9e036c3fab6a47893c79a99f8f4"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -342,17 +342,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "aef980f7c979cf57ce9cba684e370301f0343e3e72a4ce9076875fa0efd4287e"
+      "sha256": "baa7c833c3d18bf8250590fd94c499b3032ba05c6b9aa0af36b4660da295c799"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2fb562be1e4db7d2471f9ed6b7284d8b95071d9a365982c4721ff72febdfba63"
+      "sha256": "e9b2837873e241f20472ebde570b550718365a663282d4a85c255d98a8c8e21c"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "b99063352bcd42be68be647d30b838fdedcb0aef3c39a2b7a7849e9f80208fdd"
+      "sha256": "79240ff449f616e50aca58fc310a3b0670af84dc30d7a93991d84c0d0f4b87d2"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2242,12 +2242,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "73b9c0372c8d6ddf88b0eec04695defbc219a826b8be9da71a24b5a1eb6ff060"
+      "sha256": "36a01165649c2ca2f1e29c592332efe08f3cffcd926a547e8de4121ca05c0469"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "796e47e332b7788981b5118aabfbacdc9b728e22796da301cedce44ac1ab8dc6"
+      "sha256": "37b9cfbb4cce621c7ba60d358a66b618d60f6706b4b1c2dec7215c88451cff1c"
     },
     {
       "path": "docs/architecture.md",
@@ -2777,7 +2777,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "f7fe6c9e2a06b6dfb71087791b38b22ff4ce57f897320ade88e65a131fdb4160"
+      "sha256": "5be7dcf0c4dbcd61706bbaf8fec0edc509d32b721b7be1abae250dcff896f95e"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6864,10 +6864,20 @@
       "mode": "0000644",
       "sha256": "793e96feacef39ec52166dd7372c894a25679c7137c9c3c5e9df38ec323f1c4a"
     },
+    {
+      "path": "modules/platform-identity/guild-map.js",
+      "mode": "0000644",
+      "sha256": "f550b6f42ef3e37c4390a1629d4c5f109285a130d2b5efd4ccbefa57acfe2cf1"
+    },
+    {
+      "path": "modules/platform-identity/guild-totals.js",
+      "mode": "0000644",
+      "sha256": "8e07aed97641d68d826ffea3055d209b8fd9eb172e1d000f17e335f7296cc6d6"
+    },
     {
       "path": "modules/platform-identity/guilds.js",
       "mode": "0000644",
-      "sha256": "5f1189de2d33fe550b4a84b8105ccb0a0b60a08d342fde6c9bfcec30b969d4ff"
+      "sha256": "e048e674b087eae9035da5b3449d8f4029ec329a42333980eb21ac3e6c13a297"
     },
     {
       "path": "modules/platform-identity/hub-device.js",
@@ -7019,10 +7029,15 @@
       "mode": "0000644",
       "sha256": "9f8d582d626dec82b55b96272f9d6d7f6c1488ac28bd9a98ab673404afde0c8e"
     },
+    {
+      "path": "modules/platform-identity/migrations/platform_identity_027_guild_totals.sql",
+      "mode": "0000644",
+      "sha256": "9b263f91ce6df19640ef8ae413f3eb40cc17589924fdf21256da7647b55631c1"
+    },
     {
       "path": "modules/platform-identity/module.json",
       "mode": "0000644",
-      "sha256": "73d471a97dac75af28c561149649176739475dc262b3c42e37800fd73a36fe21"
+      "sha256": "48c9d82d9ec647430a97ba19f403b22e7eba13e16ff553b6bbd08691a8918a7b"
     },
     {
       "path": "modules/platform-identity/origin-containment.js",
@@ -7039,6 +7054,11 @@
       "mode": "0000644",
       "sha256": "b6eea95dbe66a3126fc2c73d93237cf38dd648a803e910eb88fbd5c780ccef62"
     },
+    {
+      "path": "modules/platform-identity/pollers/guild-totals.js",
+      "mode": "0000644",
+      "sha256": "cfd421477fdcee4a8a92ed30fa1bb987e9f8a055862c8564de9a9bfe8eb5e089"
+    },
     {
       "path": "modules/platform-identity/pollers/visibility-pull.js",
       "mode": "0000644",
@@ -7092,7 +7112,7 @@
     {
       "path": "modules/platform-identity/routes/guilds-public.js",
       "mode": "0000644",
-      "sha256": "1a8d2d70d4b9f5e4cfc93bd1f6d83911ab625463866527838d74944162f978de"
+      "sha256": "3217ae9aa5d952b72711a4e723bec3c93b4b5d12975f056bb74e8e9f4ff5e7e3"
     },
     {
       "path": "modules/platform-identity/routes/guilds.js",
@@ -8872,12 +8892,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "01b48ab609eb6e0b51a3420a79cd5e13158e3bf3f996a5bd30dbd1c2927c5b91"
+      "sha256": "7ca4dcc58b8138d0f20002590f565c03952db6a97c8a740c09307c91b24872bf"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "15c8438b1ea0a683e536e21ca2ed353042533ddf893b727c3835d5422595797a"
+      "sha256": "fc858fcc7b0fef1d6850cca8b5d5825250568cb16754f3452dc5a5d8f42545d5"
     },
     {
       "path": "public-docs/index.html",
@@ -8897,7 +8917,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "426ac20e29712617fe5881fdc428ff184ab09e2e0cfc093a99b1f10c192291a3"
+      "sha256": "1739d308859639e1ff64b6716cd4e04f117c094868c1ad8ad1f1fa1272232221"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -10057,7 +10077,7 @@
     {
       "path": "scripts/gds/run-unit-tests.js",
       "mode": "0000644",
-      "sha256": "456b185fcbab4fb486fb15aecf0de260183c9eda9942c12c0123000a8baeaa57"
+      "sha256": "8a7b0e6b5d899bc2706d952d2383ee5b45758810b7f7d5bd5b7ebc2fc547e43e"
     },
     {
       "path": "scripts/gds/runner-drift.js",
@@ -11012,7 +11032,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "f80e044dd532aabc41f3731129d98f63c98c2d60a9a4fc3eecbf713e3a86650e"
+      "sha256": "7e01ad4572ca48ef4dba7c5776246f2e7ba1a251a1bc079f1ae0566b9dc67593"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13059,15 +13079,30 @@
       "mode": "0000644",
       "sha256": "6e834f3cf75dd34ba30795c46bc401098053a56c967da8661128f34db71ff8c3"
     },
+    {
+      "path": "tests/guild_map_db.mjs",
+      "mode": "0000644",
+      "sha256": "cc230b6df32f9f7ab7c81d0cca88af6d0ace233c800a4d29d43cd474d0deefa1"
+    },
     {
       "path": "tests/guild_namespace_reserved.mjs",
       "mode": "0000644",
       "sha256": "8298006ae35010d726bcac8a2d351a5aa932d2ee6d5b53ed7b8a5c095ca5e54f"
     },
+    {
+      "path": "tests/guild_totals.mjs",
+      "mode": "0000644",
+      "sha256": "c488d1231e2d7b9233e7b857cf584c4c6df9c596b34c7e4a74c8d976f38d1ada"
+    },
+    {
+      "path": "tests/guild_totals_db.mjs",
+      "mode": "0000644",
+      "sha256": "095f66255fa4755ff57db9aef07a5334f12a2f1720a71e9523eeb5d28356029a"
+    },
     {
       "path": "tests/guilds_api.mjs",
       "mode": "0000644",
-      "sha256": "9124d0f1e8edfd91b97fc7226a0f4f68638261c5dfa36954bedf6af95d24ec07"
+      "sha256": "ae92262fb5fa1a79b1540538e7b9191ae47d19c3b4ae3572d07d470159f4ef91"
     },
     {
       "path": "tests/guilds_db.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 461 operations across 70 resource groups
+- 462 operations across 70 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -499,6 +499,8 @@ function createClient(opts = {}) {
       postGuildRequestsIdDecline: (args) => request("POST", "/guild-requests/{id}/decline", { hasBody: true }, args),
     },
     "guilds": {
+      // GET /guilds — rank: public — GET /guilds
+      getGuilds: (args) => request("GET", "/guilds", { hasBody: false }, args),
       // POST /guilds — rank: any-builder — POST /guilds
       postGuilds: (args) => request("POST", "/guilds", { hasBody: true }, args),
       // DELETE /guilds/{slug} — rank: any-builder — DELETE /guilds/:slug

package/clients/bongos-client/index.cjs

@@ -498,6 +498,8 @@ function createClient(opts = {}) {
       postGuildRequestsIdDecline: (args) => request("POST", "/guild-requests/{id}/decline", { hasBody: true }, args),
     },
     "guilds": {
+      // GET /guilds — rank: public — GET /guilds
+      getGuilds: (args) => request("GET", "/guilds", { hasBody: false }, args),
       // POST /guilds — rank: any-builder — POST /guilds
       postGuilds: (args) => request("POST", "/guilds", { hasBody: true }, args),
       // DELETE /guilds/{slug} — rank: any-builder — DELETE /guilds/:slug

package/clients/bongos-client/index.d.ts

@@ -72,9 +72,10 @@ export interface GetGovernmentAssignmentsResponse { assignments: unknown }
 export interface GetGovernmentPermissionsResponse { permissions: unknown; principals: unknown }
 export interface GetGovernmentRanksResponse { ranks: unknown }
 export interface GetGradesByBuilderResponse { window_days: unknown; builders: unknown }
+export interface GetGuildsResponse { order: unknown; count: unknown; results: unknown; page: unknown }
 export interface GetGuildsSlugMembersResponse { guild: unknown; you: unknown; members: unknown; count: unknown }
 export interface GetGuildsSlugRequestsResponse { incoming: unknown; outgoing: unknown; incoming_count: unknown; outgoing_count: unknown }
-export interface GetGuildsSlugResponse { guild: unknown; members: unknown; size: unknown }
+export interface GetGuildsSlugResponse { guild: unknown; members: unknown; size: unknown; totals: unknown }
 export interface GetHealthzResponse { ok: boolean; auth_configured: unknown }
 export interface GetHelpRequestsArchiveResponse { asked_of_you: unknown; asked_of_others: unknown; count: unknown; crafts: unknown }
 export interface GetHelpRequestsForMeResponse { help_requests: unknown; count: unknown; crafts: unknown }
@@ -925,6 +926,8 @@ export interface BongosClient {
     postGuildRequestsIdDecline(args?: RequestArgs): Promise<ApiResponse>;
   };
   "guilds": {
+    /** GET /guilds — rank: public */
+    getGuilds(args?: RequestArgs): Promise<GetGuildsResponse>;
     /** POST /guilds — rank: any-builder */
     postGuilds(args: RequestArgs & { body: PostGuildsRequest }): Promise<PostGuildsResponse>;
     /** DELETE /guilds/{slug} — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -495,6 +495,8 @@ export function createClient(opts = {}) {
       postGuildRequestsIdDecline: (args) => request("POST", "/guild-requests/{id}/decline", { hasBody: true }, args),
     },
     "guilds": {
+      // GET /guilds — rank: public — GET /guilds
+      getGuilds: (args) => request("GET", "/guilds", { hasBody: false }, args),
       // POST /guilds — rank: any-builder — POST /guilds
       postGuilds: (args) => request("POST", "/guilds", { hasBody: true }, args),
       // DELETE /guilds/{slug} — rank: any-builder — DELETE /guilds/:slug

package/docs/api/openapi.json

@@ -8590,6 +8590,32 @@
       }
     },
     "/guilds": {
+      "get": {
+        "operationId": "get_guilds",
+        "tags": [
+          "guilds"
+        ],
+        "summary": "GET /guilds",
+        "description": "the guild map (?order=size|shipped, default size; ?limit=&offset=). Viewer-independent: it reads no session. size is the public roster's length; shipped is R26's stored band floor (ADR 0337 D4.4), never an exact sum, null before a guild's first refresh. no-store: a hide or a visibility flip moves size on the very next read (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "modules/platform-identity/routes/guilds-public.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetGuildsResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      },
       "post": {
         "operationId": "post_guilds",
         "tags": [
@@ -8645,7 +8671,7 @@
           "guilds"
         ],
         "summary": "GET /guilds/:slug",
-        "description": "a public guild's page data. The roster is the members who agreed to be shown AND whose own accounts are publicly visible (ADR 0336 D4); size is that roster's length. no-store: a hide or a visibility flip must beat every cache (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
+        "description": "a public guild's page data. The roster is the members who agreed to be shown AND whose own accounts are publicly visible (ADR 0336 D4); size is that roster's length; totals are the weekly band floors (ADR 0337 D4.4), null before the first refresh. no-store: a hide or a visibility flip must beat every cache (ADR 0171 D5).\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "modules/platform-identity/routes/guilds-public.js",
         "parameters": [
@@ -22551,6 +22577,21 @@
           "builders"
         ]
       },
+      "GetGuildsResponse": {
+        "type": "object",
+        "properties": {
+          "order": {},
+          "count": {},
+          "results": {},
+          "page": {}
+        },
+        "required": [
+          "order",
+          "count",
+          "results",
+          "page"
+        ]
+      },
       "GetGuildsSlugMembersResponse": {
         "type": "object",
         "properties": {
@@ -22586,12 +22627,14 @@
         "properties": {
           "guild": {},
           "members": {},
-          "size": {}
+          "size": {},
+          "totals": {}
         },
         "required": [
           "guild",
           "members",
-          "size"
+          "size",
+          "totals"
         ]
       },
       "GetHealthzResponse": {
@@ -29521,9 +29564,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 461,
-  "x-schema-count": 493,
+  "x-endpoint-count": 462,
+  "x-schema-count": 494,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 335,
+  "x-response-schemas": 336,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 461 endpoints across 82 route files.
+> **Generated from the live route files** — the route file is authoritative. 462 endpoints across 82 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -342,10 +342,11 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/guild-requests/:id/accept` | `any-builder` | `visibility`, `counted_in_totals` | accept an invite addressed to ME, or (as the guild's owner) a request to join it. |
 | POST | `/api/bongos/guild-requests/:id/decline` | `any-builder` | — | decline an invite to ME, or (as owner) a request to my guild. |
 
-## `guilds` (12)
+## `guilds` (13)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/guilds` | `public` | — | the guild map (?order=size\|shipped, default size; ?limit=&offset=). |
 | POST | `/api/bongos/guilds` | `any-builder` | `slug`, `name`, `description`, `visibility` | create a guild. |
 | GET | `/api/bongos/guilds/:slug` | `public` | — | a public guild's page data. |
 | PATCH | `/api/bongos/guilds/:slug` | `any-builder` | `name`, `description`, `visibility` | owner: edit name, description or visibility. |

package/docs/module-api-changelog.md

@@ -2695,5 +2695,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.20.17 with no explicit bump. run 36724081934. (task 1002620)
   1.20.19 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.20.18 with no explicit bump. run 36727774141. (task 1002620)
+  1.20.20 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.19 with no explicit bump. run 36732445320. (task 1002620)
+  1.20.21 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.20.20 with no explicit bump. run 36735857856. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/platform-identity/guild-map.js

@@ -0,0 +1,105 @@
+// modules/platform-identity/guild-map.js — the guild map's data: public guilds,
+// ranked (R30, task 1002306; ADR 0336 D8, amended by ADR 0337 D4.4).
+//
+// WHO. `visibility = 'public'` AND a non-empty public roster. An unlisted guild
+// has no public existence (ADR 0336 D4), so it is never listed. Neither is a
+// public guild whose every member is private or unshown: it would be a name on
+// the map with nobody behind it.
+//
+// TWO ORDERINGS, NO STORED SCORE (D8):
+//   * size    — the public roster's length, computed exactly as getPublicGuild
+//               computes it (shown_publicly AND accountVisibleSql, capped at
+//               guilds.LIST_MAX), so the map and the guild page never disagree.
+//               hide_stats hides numbers, never membership (ADR 0336 D4 §2), so a
+//               member who hides their numbers is still in it; a private one never.
+//   * shipped — the guild's STORED works_shipped band floor (guild-totals.js),
+//               never an exact sum (D4.4). A guild not yet refreshed publishes
+//               null and sorts last.
+// Ties break on slug. Every sort key is a field the row publishes (ADR 0255: a
+// public list's order is a covert column otherwise).
+//
+// COST, AND WHY THERE IS NO CACHE. One aggregate per read, over PUBLIC guilds'
+// memberships only (the roster CTE filters on visibility before it groups, so an
+// unlisted guild's members are never counted, let alone scanned for the map) —
+// at the hub's scale a few index scans, bounded per caller by guild-map-read.
+// D8 decides "computed at read time" and names the revisit trigger: a measured
+// p95. It also rules out the cheap cache: any cache must be INVALIDATED by a hide,
+// a privacy flip, a shown_publicly change, a membership change and a visibility
+// change, because a TTL alone keeps publishing a withdrawn member in a guild's
+// size (the ADR 0202 D3 reason). community-leaderboard.js's 30s memo does not
+// transfer: it caches only NUMBERS and re-reads WHO on every request, and here
+// the expensive half IS who — the roster under the privacy predicates. A cache
+// is therefore a write-path change across guilds.js, the privacy setters and
+// consent, taken when the p95 says so, not a TTL bolted on here.
+//
+// NOTHING HERE IS AUTHORITY (ADR 0016 / ADR 0141). Descriptive only.
+//
+// Reaches core only through the doorway (ADR 0083).
+'use strict';
+
+const api = require('../../src/module-api');
+const { accountVisibleSql } = require('./account-visibility');
+const { LIST_MAX } = require('./guilds');
+const { clampOffset, MAX_OFFSET } = require('./builder-search');
+
+const { pool: defaultPool } = api;
+
+const DEFAULT_LIMIT = 25;
+const MAX_LIMIT = 100;
+
+// The orderings, as fixed SQL. A request names a key; it never supplies SQL.
+const ORDERS = {
+  size: 'size DESC, g.slug',
+  shipped: 'shipped DESC NULLS LAST, g.slug',
+};
+const ORDER_KEYS = Object.keys(ORDERS);
+const DEFAULT_ORDER = 'size';
+
+function isOrder(order) {
+  return typeof order === 'string' && Object.prototype.hasOwnProperty.call(ORDERS, order);
+}
+
+function clampLimit(limit) {
+  const n = parseInt(limit, 10);
+  if (!Number.isFinite(n) || n <= 0) return DEFAULT_LIMIT;
+  return Math.min(n, MAX_LIMIT);
+}
+
+// One page of the map. `order` must already be valid (the route 400s first; an
+// invalid one here falls back to the default rather than reaching SQL). Returns
+// { order, results: [{ slug, name, size, shipped }], limit, offset } with the
+// CLAMPED paging, so the route echoes what was actually applied.
+async function listGuildMap({ order = DEFAULT_ORDER, limit, offset } = {}, { pool = defaultPool } = {}) {
+  const key = isOrder(order) ? order : DEFAULT_ORDER;
+  const lim = clampLimit(limit);
+  const off = clampOffset(offset);
+  const { rows } = await pool.query(
+    `WITH roster AS (
+       SELECT m.guild_id, LEAST(count(*), $3)::int AS size
+         FROM platform_identity_guilds pg
+         JOIN platform_identity_guild_members m ON m.guild_id = pg.id
+         JOIN platform_identity_accounts pa ON pa.github_id = m.github_id
+        WHERE pg.visibility = 'public' AND m.shown_publicly AND ${accountVisibleSql('pa')}
+        GROUP BY m.guild_id
+     )
+     SELECT g.slug, g.name, r.size, t.works_shipped AS shipped
+       FROM platform_identity_guilds g
+       JOIN roster r ON r.guild_id = g.id
+       LEFT JOIN platform_identity_guild_totals t ON t.guild_id = g.id
+      WHERE g.visibility = 'public'
+      ORDER BY ${ORDERS[key]}
+      LIMIT $1 OFFSET $2`,
+    [lim, off, LIST_MAX],
+  );
+  return { order: key, results: rows, limit: lim, offset: off };
+}
+
+module.exports = {
+  ORDER_KEYS,
+  DEFAULT_ORDER,
+  DEFAULT_LIMIT,
+  MAX_LIMIT,
+  MAX_OFFSET,
+  isOrder,
+  listGuildMap,
+};