@bongos/core 1.21.56 → 1.21.57

package/modules/public-landing/public/guild.states.json

@@ -0,0 +1,38 @@
+{
+  "_": "The guild page's states for modules/ui-design/kit/render.js (task 1002301, R25; ADR 0336 D4, ADR 0337 D4.4). One shell serves every /g/<slug>; the stub answers three guilds from fixtures/guilds.json. Signed out: forge-crew is the public page (four listed members, the rounded record), and night-shift — unlisted — is the same 'no guild here' an unknown slug gets, with sign-in. Signed in as the fixture builder: forge-crew is the members' view (everyone, six, with the prompt to be listed because they are a member who is not on its public page; the pair for that switch waits until the prompt is answered), night-shift is their unlisted guild (no public page, no published record), open-hands is a public guild they are not in (the public view, not counted yet), and an unknown slug is 'no guild here' without the sign-in. Dark only, like every apex page (ADR 0204).",
+  "page": "/guild",
+  "surface": "public-landing",
+  "modes": ["dark"],
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me$", "/api/(gds|bongos)/guilds/[a-z0-9-]+(/members)?$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me", "/api/(gds|bongos)/guilds/", "\\b401\\b", "\\b404\\b", "Unauthorized", "Not Found"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "out-public": { "url": "/g/forge-crew", "auth": false, "actions": [["wait", 400]],
+      "expect": { "visible": ["#guildBody", "#gName", "#gRoster", "#gFigs", "#signinTop"], "hidden": ["#gYou", "#missing", "#loading", "#who"],
+        "text": [["#gName", "Forge Crew"], ["#gKicker", "Guild"], ["#gMeta", "4 members · since Sep 2026"], ["#tShipped", "100+"], ["#tCredits", "2,000+"], ["#tKarma", "50+"], ["#tProjects", "under 10"], ["#gRecordNote", "Counted on 1 Oct 2026. Projects are the public projects its listed members build on."]],
+        "count": [["#gRoster li", 4]] } },
+    "out-unlisted": { "url": "/g/night-shift", "auth": false, "actions": [["wait", 400]],
+      "expect": { "visible": ["#missing", "#missingSignin"], "hidden": ["#guildBody", "#loading"],
+        "text": [["#missingWhy", "There is no public guild at this address. If it is an unlisted guild you belong to, sign in to see it."]] } },
+    "in-member": { "url": "/g/forge-crew", "auth": true, "actions": [["wait", 500]],
+      "expect": { "visible": ["#guildBody", "#gYou", "#showAsk", "#countWhat", "#who"], "hidden": ["#shownBand", "#shownUnlisted", "#missing", "#signinTop"],
+        "text": [["#gKicker", "Guild · public"], ["#gMeta", "6 members · 4 on the public page · since Sep 2026"], ["#gYouSide", "You’re a member of this guild. Only you see this, and only you can change it."]],
+        "checked": "input[name=shown][value=off]",
+        "count": [["#gRoster li", 6]] } },
+    "in-unlisted-owner": { "url": "/g/night-shift", "auth": true, "actions": [["wait", 500]],
+      "expect": { "visible": ["#guildBody", "#gYou", "#shownUnlisted"], "hidden": ["#showAsk", "#shownBand", "#gFigs", "#gDesc"],
+        "text": [["#gKicker", "Guild · unlisted"], ["#shownUnlisted", "This guild is unlisted, so it has no public page. If you make it public, you’ll be listed on it as its owner, and each member will be asked before they are."], ["#gMeta", "3 members"], ["#gRecordNote", "This guild is unlisted, so its record isn’t published anywhere."], ["#countWhat", "Your numbers are left out of this guild’s totals, from its next weekly count."]],
+        "checked": "input[name=counted][value=off]" } },
+    "in-not-member": { "url": "/g/open-hands", "auth": true, "actions": [["wait", 500]],
+      "expect": { "visible": ["#guildBody", "#gRoster"], "hidden": ["#gYou", "#missing"],
+        "text": [["#gKicker", "Guild"], ["#gMeta", "2 members · since Oct 2026"], ["#tShipped", "—"], ["#gRecordNote", "Not counted yet. A guild’s record is counted once a week."]],
+        "count": [["#gRoster li", 2]] } },
+    "in-missing": { "url": "/g/no-such-guild", "auth": true, "actions": [["wait", 500]],
+      "expect": { "visible": ["#missing"], "hidden": ["#guildBody", "#missingSignin"],
+        "text": [["#missingWhy", "There is no guild at this address that you can see. A guild that is unlisted is shown only to its members."]] } },
+    "in-profile-band": { "url": "/g/forge-crew", "auth": true, "actions": [["wait", 500], ["click", "#who"], ["wait", 300]],
+      "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"]] } }
+  },
+  "reducedMotion": { "url": "/g/forge-crew", "auth": true, "actions": [["wait", 400]] }
+}

package/modules/ui-design/kit/fixtures/guilds.json

@@ -0,0 +1,73 @@
+{
+  "forge-crew": {
+    "public": {
+      "guild": {
+        "slug": "forge-crew",
+        "name": "Forge Crew",
+        "description": "Builders who like the unglamorous parts: migrations, test harnesses, the deploy path. We pick up the work nobody else claims.",
+        "created_at": "2026-09-12T10:20:00.000Z"
+      },
+      "members": [
+        { "handle": "mara-quinn", "display_name": "Mara Quinn", "avatar_url": "/__kit/avatar.svg", "membership_kind": "owner" },
+        { "handle": "ines-duarte", "display_name": "Ines Duarte", "avatar_url": null, "membership_kind": "member" },
+        { "handle": "kip", "display_name": "Kip", "avatar_url": "/__kit/avatar.svg", "membership_kind": "member" },
+        { "handle": "theo-park", "display_name": "Theo Park", "avatar_url": "/__kit/avatar.svg", "membership_kind": "member" }
+      ],
+      "size": 4,
+      "totals": { "credits": 2000, "works_shipped": 100, "karma": 50, "projects": 0, "as_of": "2026-10-01T03:00:00.000Z" }
+    },
+    "members": {
+      "guild": {
+        "slug": "forge-crew",
+        "name": "Forge Crew",
+        "description": "Builders who like the unglamorous parts: migrations, test harnesses, the deploy path. We pick up the work nobody else claims.",
+        "visibility": "public"
+      },
+      "you": { "membership_kind": "member", "shown_publicly": false, "counted_in_totals": true },
+      "members": [
+        { "handle": "mara-quinn", "display_name": "Mara Quinn", "avatar_url": "/__kit/avatar.svg", "membership_kind": "owner" },
+        { "handle": "builder", "display_name": "A Builder", "avatar_url": "/__kit/avatar.svg", "membership_kind": "member" },
+        { "handle": "ines-duarte", "display_name": "Ines Duarte", "avatar_url": null, "membership_kind": "member" },
+        { "handle": "kip", "display_name": "Kip", "avatar_url": "/__kit/avatar.svg", "membership_kind": "member" },
+        { "handle": "sol-reyes", "display_name": "Sol Reyes", "avatar_url": null, "membership_kind": "member" },
+        { "handle": "theo-park", "display_name": "Theo Park", "avatar_url": "/__kit/avatar.svg", "membership_kind": "member" }
+      ],
+      "count": 6
+    }
+  },
+  "night-shift": {
+    "public": null,
+    "members": {
+      "guild": {
+        "slug": "night-shift",
+        "name": "Night Shift",
+        "description": "",
+        "visibility": "unlisted"
+      },
+      "you": { "membership_kind": "owner", "shown_publicly": false, "counted_in_totals": false },
+      "members": [
+        { "handle": "builder", "display_name": "A Builder", "avatar_url": "/__kit/avatar.svg", "membership_kind": "owner" },
+        { "handle": "ines-duarte", "display_name": "Ines Duarte", "avatar_url": null, "membership_kind": "member" },
+        { "handle": "sol-reyes", "display_name": "Sol Reyes", "avatar_url": null, "membership_kind": "member" }
+      ],
+      "count": 3
+    }
+  },
+  "open-hands": {
+    "public": {
+      "guild": {
+        "slug": "open-hands",
+        "name": "Open Hands",
+        "description": "A newer guild for first-time builders. Ask anything.",
+        "created_at": "2026-10-03T16:05:00.000Z"
+      },
+      "members": [
+        { "handle": "ada-ng", "display_name": "Ada Ng", "avatar_url": "/__kit/avatar.svg", "membership_kind": "owner" },
+        { "handle": "ruth-okafor", "display_name": "Ruth Okafor", "avatar_url": null, "membership_kind": "member" }
+      ],
+      "size": 2,
+      "totals": null
+    },
+    "members": null
+  }
+}

package/modules/ui-design/kit/serve.js

@@ -436,6 +436,44 @@ function handlePatch(res, body) {
   return json(res, 200, { handle: h, previous_handle: previous || null });
 }
 
+// The hub's guild page (task 1002301): GET /guilds/:slug (public), GET /guilds/:slug/members
+// and PATCH /guilds/:slug/membership (own-scope), answered from ONE set of guilds held for the
+// run (guilds.json, or the file a states file's stub.fixtures names), keyed by slug, each with
+// the public read's body (null = the 404 an unlisted or unknown guild answers) and the
+// signed-in builder's members read (null = not a member: the same 404). The PATCH mirrors the
+// route's schema — the two booleans, at least one — so a save the page re-reads comes back saved.
+let GUILDS = null;
+function guildsHeld() {
+  if (!GUILDS) {
+    const name = 'guilds';
+    GUILDS = JSON.parse(fs.readFileSync(path.join(FIXTURES, (ALIAS[name] || name) + '.json'), 'utf8'));
+  }
+  return GUILDS;
+}
+// a root-relative avatar is this stub's own (/__kit/avatar.svg), absolutised as me() does
+function withAvatars(body, origin) {
+  if (!body || !Array.isArray(body.members)) return body;
+  return { ...body, members: body.members.map((m) => (typeof m.avatar_url === 'string' && m.avatar_url.startsWith('/') ? { ...m, avatar_url: origin + m.avatar_url } : m)) };
+}
+const PAGE_ALIAS = { g: 'guild' };
+const GUILD_NOT_FOUND ={ error: { code: 'guild_not_found', message: 'guild_not_found' } };
+function guildRead(res, slug, half, origin) {
+  const g = guildsHeld()[String(slug).toLowerCase()];
+  const body = g && g[half];
+  return body ? json(res, 200, withAvatars(body, origin)) : json(res, 404, GUILD_NOT_FOUND);
+}
+function guildMembershipPatch(res, slug, body) {
+  const keys = Object.keys(body);
+  const bad = keys.find((k) => !['shown_publicly', 'counted_in_totals'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  for (const k of keys) if (typeof body[k] !== 'boolean') return refuse(res, 400, 'validation_failed', `${k} must be a boolean`);
+  if (!keys.length) return refuse(res, 400, 'nothing_to_update', 'send shown_publicly and/or counted_in_totals');
+  const g = guildsHeld()[String(slug).toLowerCase()];
+  if (!g || !g.members) return json(res, 404, GUILD_NOT_FOUND);
+  Object.assign(g.members.you, body);
+  return json(res, 200, { shown_publicly: g.members.you.shown_publicly, counted_in_totals: g.members.you.counted_in_totals });
+}
+
 const server = http.createServer((req, res) => {
   const u = new URL(req.url, 'http://x');
   const p = u.pathname;
@@ -453,6 +491,10 @@ const server = http.createServer((req, res) => {
     if (rest === '/me/cross-project' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => crossProjectPatch(res, body)) : json(res, 401, UNAUTH);
     if (rest === '/me/profile' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => profilePatch(res, body)) : json(res, 401, UNAUTH);
     if (rest === '/me/handle' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => handlePatch(res, body)) : json(res, 401, UNAUTH);
+    const guild = rest.match(/^\/guilds\/([^/]+)(\/members|\/membership)?$/);
+    if (guild && !guild[2] && req.method === 'GET') return guildRead(res, guild[1], 'public', origin);
+    if (guild && guild[2] === '/members' && req.method === 'GET') return AUTH ? guildRead(res, guild[1], 'members', origin) : json(res, 401, UNAUTH);
+    if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
     // the planet-physics questions' pre-create check (task 1004418): nothing stops here —
     // the kit carries no screen. Of the soft-limit table it mirrors only the three hide
@@ -550,7 +592,10 @@ const server = http.createServer((req, res) => {
   // TASK_DETAIL_PAGE_RE / IDEA_DETAIL_PAGE_RE routes). Without this the states
   // for those pages could only be rendered at a URL production never serves, and
   // a page script that reads its id out of location.pathname would see none.
-  const name = under2 === '' ? 'index' : (fs.existsSync(path.join(DIR, under2 + '.html')) ? under2 : under2.replace(/\/[^/]+$/, ''));
+  // A namespace word may name its page differently: the hub serves /g/<slug> from
+  // guild.html (platform-server.js's /g/:slug route, task 1002301).
+  const base = under2 === '' ? 'index' : (fs.existsSync(path.join(DIR, under2 + '.html')) ? under2 : under2.replace(/\/[^/]+$/, ''));
+  const name = PAGE_ALIAS[base] && fs.existsSync(path.join(DIR, PAGE_ALIAS[base] + '.html')) ? PAGE_ALIAS[base] : base;
   if (!name.includes('/') && fs.existsSync(path.join(DIR, name + '.html'))) {
     try { res.writeHead(200, { 'content-type': MIME['.html'], 'cache-control': 'no-store' }); return res.end(page(name + '.html').html); }
     catch (e) { res.writeHead(500, { 'content-type': 'text/plain' }); return res.end('render failed: ' + e.stack); }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.56",
+  "version": "1.21.57",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.56",
+      "version": "1.21.57",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.56",
+  "version": "1.21.57",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9108,5 +9108,11 @@
       "id": "1004581",
       "text": "The street no longer shows the small grey line of words above the buildings. The owner wants the city to read at a glance from its look alone, and the line was also wrong in light mode. It is gone in light and dark and on phon"
     }
+  ],
+  "1.21.57": [
+    {
+      "id": "1002301",
+      "text": "Guilds now have their own page on cloudbongos.com — who is in it and what it has shipped together — and members can choose whether they appear on it and count toward its totals."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.56'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.57'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -305,6 +305,19 @@ function buildPlatformApp() {
     if (!html) return next();
     res.type('html').send(html);
   });
+  // THE GUILD PAGE (task 1002301, R25; ADR 0336 D4/D6): /g/<slug>, the namespace
+  // D6 reserved. Hub-only for the /account reason — every read it makes is a
+  // platform-identity route. ONE shell for every slug: the page reads the public
+  // guild and, signed in, the members' own-scope read, so whether a guild exists
+  // (and whether an unlisted one is yours) is answered by those routes and never
+  // by this one. A segment that cannot be a slug falls through to the 404 tail.
+  app.get('/g/:slug', (req, res, next) => {
+    if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
+    if (!/^[A-Za-z0-9-]{2,39}$/.test(req.params.slug)) return next();
+    const html = landingPage('guild.html');
+    if (!html) return next();
+    res.type('html').send(html);
+  });
   // Assets fall through to the 404 tail when no module claims the apex root — the
   // handler is not mounted at all rather than pointed at a missing directory.
   const landingAssets = landingDir() && express.static(landingDir(), { index: false, fallthrough: true });