@bongos/core 1.21.56 → 1.21.58

package/tests/privacy_matrix.mjs

@@ -153,14 +153,26 @@ function identitySentinels(acct) {
 //   directory  GET /scouting                Recruiter — 'full' | 'name-only' | 'absent'
 //   sliver     GET /scouting/:handle        Recruiter — 'full' (D3) | 'name-only' (D3, hidden) | 404
 //   self       GET /me/cross-project        Self — 'own' (own numbers, any flags) | 'n/a' (no session exists)
+//   guild      GET /guilds/:slug            Anon · Builder · Recruiter · Self — the guild page's PUBLIC
+//                roster (task 1002301; ADR 0336 D4), viewer-independent: 'listed' | 'absent'.
+//                Every fixture account is a member with shown_publicly ON, so the account
+//                predicates alone decide; hide_stats never hides membership (D4 §2)
+//   members    GET /guilds/:slug/members    a fellow Member — the own-scope roster: 'listed' |
+//                'absent'. Joining is consent to be seen BY THE GUILD (D4 §1), so a private
+//                member is listed here and nowhere public; a provisional account is never
+//   invite     POST /projects/invite-guild  a project's Inviter (task 1002303; ADR 0365 D3) — one
+//                hall link per member of a PUBLIC guild's public roster: 'listed' | 'absent'.
+//                It reads accounts across projects, so it may hand the inviter exactly the
+//                people the guild page already shows them — shown_publicly AND existence;
+//                hide_stats never hides membership, and private or provisional is never listed
 const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own' },
+  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
 };
 
 // ===========================================================================
@@ -243,10 +255,89 @@ function activityScope(sql, params) {
   return String(params[Number(m[1]) - 1]);
 }
 
+// THE GUILDS (task 1002301): one public and one unlisted guild, each with every
+// fixture account as a member and shown_publicly ON — the most permissive guild
+// flag, so the account predicates alone decide each cell. PUB owns both.
+const GUILDS = [
+  { id: '880001', slug: 'mx-guild', name: 'Matrix Guild', description: 'mx-guild-desc', visibility: 'public', created_at: 'T0' },
+  { id: '880002', slug: 'mx-unlisted', name: 'Matrix Unlisted', description: 'mx-unlisted-desc', visibility: 'unlisted', created_at: 'T0' },
+];
+const GUILD_MEMBERS = GUILDS.flatMap((g) => ACCOUNTS.map((a) => ({
+  guild_id: g.id, github_id: a.github_id, membership_kind: a.key === 'PUB' ? 'owner' : 'member', shown_publicly: true, counted_in_totals: true,
+})));
+/** The members-of-a-guild statements: the guild and shown terms consumed here, the rest read as an account filter. */
+function guildRosterFilter(sql, params) {
+  let where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = m\.github_id WHERE (.+?) ORDER BY/, 'guild roster');
+  if (!/\bm\.guild_id = \$1\b/.test(where)) throw new Error(`fake pool: a guild roster with no guild scope — ${where}`);
+  where = where.replace(/\bm\.guild_id = \$1\b/, '');
+  const shownOnly = /\bm\.shown_publicly\b/.test(where);
+  where = where.replace(/\bm\.shown_publicly\b/, '');
+  const byAccount = accountFilter(where, []);
+  return (m) => m.guild_id === String(params[0]) && (!shownOnly || m.shown_publicly) && byAccount(ACCOUNTS.find((a) => a.github_id === m.github_id));
+}
+
+// THE PROJECT a guild is invited to (task 1002303): one active client, whose
+// origin the hall links point at.
+const MX_CLIENT = { client_id: 'mx-proj', secret_hash: '', name: 'MX Project', redirect_uris: [], origin: 'https://mx-proj.example', owner_github_id: null, status: 'active' };
+
 const pool = {
   query: async (text, params = []) => {
     const sql = String(text).replace(/\s+/g, ' ').trim();
 
+    // POST /projects/invite-guild's reads (task 1002303). The client the gate resolves.
+    if (/FROM platform_identity_sso_clients WHERE client_id = \$1$/.test(sql)) {
+      const rows = params[0] === MX_CLIENT.client_id ? [{ ...MX_CLIENT }] : [];
+      return { rows, rowCount: rows.length };
+    }
+    // ... the guild, by slug — its WHERE is read, not assumed: PUBLIC only.
+    if (/^SELECT id, slug, name FROM platform_identity_guilds WHERE /.test(sql)) {
+      if (!/WHERE lower\(slug\) = \$1 AND visibility = 'public'$/.test(sql)) throw new Error(`fake pool: the invite-guild lookup moved — ${sql}`);
+      const rows = GUILDS.filter((g) => g.slug === String(params[0]) && g.visibility === 'public').map(({ id, slug, name }) => ({ id, slug, name }));
+      return { rows, rowCount: rows.length };
+    }
+    // ... the `invited` engagement it records (no account in it, so nothing to model here).
+    if (/^INSERT INTO platform_identity_guild_engagements /.test(sql)) return { rows: [], rowCount: 1 };
+    // ... and the PUBLIC roster the hall links go to, read through the same roster
+    // interpreter as the guild page — its projection pinned, since the login it
+    // reads becomes part of each link.
+    if (/^SELECT pa\.handle, pa\.display_name, pa\.github_login FROM platform_identity_guild_members m JOIN platform_identity_accounts pa/.test(sql)) {
+      const keep = guildRosterFilter(sql, params);
+      const rows = GUILD_MEMBERS.filter(keep).map((m) => {
+        const a = ACCOUNTS.find((x) => x.github_id === m.github_id);
+        // github_id and the bio ride along so a projection that spreads the row leaks them
+        return { handle: a.handle, display_name: a.display_name, github_login: a.github_login, github_id: a.github_id, bio: a.bio };
+      });
+      return { rows, rowCount: rows.length };
+    }
+
+    // THE GUILD PAGE's reads. The public guild: its WHERE is read, not assumed.
+    if (/^SELECT id, slug, name, description, created_at FROM platform_identity_guilds WHERE /.test(sql)) {
+      if (!/WHERE lower\(slug\) = \$1 AND visibility = 'public'$/.test(sql)) throw new Error(`fake pool: the public guild read moved — ${sql}`);
+      const rows = GUILDS.filter((g) => g.slug === String(params[0]) && g.visibility === 'public').map(({ visibility, ...g }) => g);
+      return { rows, rowCount: rows.length };
+    }
+    // ... a member's own row in a guild (the own-scope door).
+    if (/FROM platform_identity_guilds g JOIN platform_identity_guild_members m ON m\.guild_id = g\.id AND m\.github_id = \$2::bigint WHERE lower\(g\.slug\) = \$1$/.test(sql)) {
+      const g = GUILDS.find((x) => x.slug === String(params[0]));
+      const m = g && GUILD_MEMBERS.find((x) => x.guild_id === g.id && x.github_id === String(params[1]));
+      const rows = m ? [{ ...g, ...m, joined_at: 'T2' }] : [];
+      return { rows, rowCount: rows.length };
+    }
+    // ... both rosters: public (shown AND visible) and members' (active).
+    if (/FROM platform_identity_guild_members m JOIN platform_identity_accounts pa/.test(sql)) {
+      // the projection is pinned: a new column here is a new disclosure, and this fails first
+      const cols = (/^SELECT (.+?) FROM /.exec(sql) || [, ''])[1];
+      if (cols !== 'pa.handle, pa.display_name, pa.avatar_url, m.membership_kind') throw new Error(`fake pool: the guild roster selects something new — ${cols}`);
+      const keep = guildRosterFilter(sql, params);
+      const rows = GUILD_MEMBERS.filter(keep).map((m) => {
+        const a = ACCOUNTS.find((x) => x.github_id === m.github_id);
+        return { handle: a.handle, display_name: a.display_name, avatar_url: a.avatar_url, membership_kind: m.membership_kind };
+      });
+      return { rows, rowCount: rows.length };
+    }
+    // ... and the weekly totals: never computed on a read (guild-totals.js); none stored here.
+    if (/FROM platform_identity_guild_totals WHERE guild_id = \$1$/.test(sql)) return { rows: [], rowCount: 0 };
+
     // THE LEADERBOARD's totals: the rollup floor sits on the act CTE's join.
     if (/platform_identity_activity_snapshots/.test(sql)) {
       const where = lift(sql, /JOIN platform_identity_accounts pa ON pa\.github_id = a\.github_id WHERE (.+?) \), per_project AS/, 'leaderboard totals');
@@ -346,6 +437,8 @@ const ANON = null;
 const STRANGER = { name: 'Builder', github_id: '7100001', rank: 'xenos', curate: false };
 const RECRUITER = { name: 'Recruiter', github_id: '7100002', rank: 'archon', curate: true };
 const selfOf = (k) => ({ name: 'Self', github_id: ACCT[k].github_id, rank: 'xenos', curate: false });
+// a fellow guild member: PUB's session, which owns both fixture guilds
+const MEMBER = { name: 'Member', github_id: ACCT.PUB.github_id, rank: 'xenos', curate: false };
 
 const moduleApiPath = require.resolve('../src/module-api.js');
 const helpers = require('../src/bongos/routes/_helpers.js');
@@ -366,6 +459,13 @@ require.cache[moduleApiPath] = {
     },
     requirePermission: () => (req, res, next) => (viewer && viewer.curate ? next() : res.status(403).json({ ok: false, error: 'forbidden' })),
     requireRank: (...allowed) => (req, res, next) => (viewer && allowed.includes(viewer.rank) ? next() : res.fail('rank_forbidden', 403)),
+    // routes/projects.js (POST /projects/invite-guild): its seams are already
+    // registered as far as this file is concerned, and no provisioning module
+    // answers the inviter gate's ownership arm, so the rank door decides.
+    hasProvider: () => true,
+    registerProvider: () => {},
+    resolveOptional: () => null,
+    publicProjectFeedRateLimit: (_req, _res, next) => next(),
   },
 };
 
@@ -413,7 +513,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting']) {
+for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting', 'guilds-public', 'guilds', 'projects']) {
   app.use('/api/bongos', require(`../modules/platform-identity/routes/${file}.js`)());
 }
 const server = app.listen(0, '127.0.0.1');
@@ -445,6 +545,28 @@ function get(who, path_) {
   });
 }
 
+/** A POST through the same recorder, so the sweeps below judge its body too. */
+function post(who, path_, body) {
+  viewer = who;
+  const payload = JSON.stringify(body);
+  const headers = { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) };
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'POST', path: path_, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        const out = { who: who ? who.name : 'Anon', whoId: who ? who.github_id : null, path: path_, status: res.statusCode, text, json };
+        SEEN.push(out);
+        resolve(out);
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
 // ===========================================================================
 // 0. The instrument is calibrated before it is trusted
 // ===========================================================================
@@ -535,6 +657,78 @@ for (const k of KEYS) {
   });
 }
 
+// The guild page's two rosters (task 1002301; ADR 0336 D4). One read per viewer
+// serves every row, so each row's cell is checked against the same bodies.
+const GUILD_PATH = '/api/bongos/guilds/mx-guild';
+const ROSTER_KEYS = ['avatar_url', 'display_name', 'handle', 'membership_kind'];
+const ALL_VIEWERS = () => [ANON, STRANGER, RECRUITER, MEMBER, ...KEYS.map(selfOf)];
+
+test('the guild page’s public roster — the same bytes to Anon, Builder, Recruiter, a Member and every Self; listed or absent per the matrix', async () => {
+  const seen = [];
+  for (const who of ALL_VIEWERS()) seen.push(await get(who, GUILD_PATH));
+  for (const r of seen.slice(1)) {
+    assert.equal(r.status, seen[0].status, `${r.who} got a different status — the public guild read must not vary by viewer (ADR 0336 D4)`);
+    assert.equal(r.text, seen[0].text, `${r.who} got a different body — the public guild read must not vary by viewer (ADR 0336 D4)`);
+  }
+  const [r] = seen;
+  assert.equal(r.status, 200);
+  const listed = new Set(r.json.members.map((m) => m.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].guild === 'listed', `${k} on the public roster: expected ${MATRIX[k].guild}`);
+  assert.equal(r.json.size, r.json.members.length, 'size is the roster’s own length — never a "+N more" (ADR 0336 D4)');
+  for (const m of r.json.members) assert.deepEqual(Object.keys(m).sort(), ROSTER_KEYS, 'handle, name, avatar, kind — never a GitHub id or login');
+});
+
+test('the guild members’ roster — a fellow member sees every active member, private ones included; Anon is refused', async () => {
+  const r = await get(MEMBER, `${GUILD_PATH}/members`);
+  assert.equal(r.status, 200);
+  const listed = new Set(r.json.members.map((m) => m.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].members === 'listed', `${k} on the members’ roster: expected ${MATRIX[k].members}`);
+  assert.equal(r.json.count, r.json.members.length);
+  for (const m of r.json.members) assert.deepEqual(Object.keys(m).sort(), ROSTER_KEYS);
+  assert.deepEqual(Object.keys(r.json.you).sort(), ['counted_in_totals', 'membership_kind', 'shown_publicly'], 'the reader’s own two switches, and nobody else’s');
+  assert.equal((await get(ANON, `${GUILD_PATH}/members`)).status, 401);
+});
+
+test('an unlisted guild’s public read is a 404 to everyone, its own members included, byte-identical to a slug nobody holds; members reach it through the own-scope door', async () => {
+  const none = await get(ANON, '/api/bongos/guilds/mx-nobody');
+  assert.equal(none.status, 404);
+  for (const who of ALL_VIEWERS()) {
+    const r = await get(who, '/api/bongos/guilds/mx-unlisted');
+    assert.equal(r.status, 404, `${r.who}: an unlisted guild has no public existence (ADR 0336 D4)`);
+    assert.equal(r.text.replaceAll('mx-unlisted', 'S'), none.text.replaceAll('mx-nobody', 'S'), `${r.who}: no existence oracle`);
+  }
+  const own = await get(MEMBER, '/api/bongos/guilds/mx-unlisted/members');
+  assert.equal(own.status, 200);
+  const listed = new Set(own.json.members.map((m) => m.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].members === 'listed', `${k} on the unlisted guild’s members’ roster`);
+});
+
+// A project invites a guild (task 1002303; ADR 0365 D3). The INVITER is the
+// viewer here — a holder of the route's rank door (the Recruiter fixture carries
+// it); the cell is who they are handed a link for.
+const INVITE_GUILD_PATH = '/api/bongos/projects/invite-guild';
+const INVITE_KEYS = ['display_name', 'handle', 'invite_url'];
+
+test('a project invites a guild — one hall link per PUBLIC-roster member, listed or absent per the matrix; a non-inviter is refused', async () => {
+  const r = await post(RECRUITER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-guild' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.invited, false, 'the hub writes no invite (ADR 0353)');
+  const listed = new Set(r.json.invites.map((i) => i.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].invite === 'listed', `${k} in the invite fan-out: expected ${MATRIX[k].invite}`);
+  assert.equal(r.json.count, r.json.invites.length, 'count is the array’s own length');
+  for (const i of r.json.invites) {
+    assert.deepEqual(Object.keys(i).sort(), INVITE_KEYS, 'a handle, a name and a link — never a GitHub id, a bio or a number');
+    const a = ACCOUNTS.find((x) => x.handle === i.handle);
+    assert.equal(i.invite_url, `${MX_CLIENT.origin}/builders/watch?invite=${encodeURIComponent(a.github_login)}`, 'the project’s own hall, with the login a public profile already shows');
+  }
+  const stranger = await post(STRANGER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-guild' });
+  assert.equal(stranger.status, 403, 'only the project’s inviter is handed the roster');
+  const unlisted = await post(RECRUITER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-unlisted' });
+  const nobody = await post(RECRUITER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-nobody' });
+  assert.equal(unlisted.status, 404);
+  assert.equal(unlisted.text, nobody.text, 'an unlisted guild cannot be invited: the unknown-guild 404, byte for byte');
+});
+
 test('the sliver’s key lists are D3’s, transcribed: handle, name, avatar, disciplines, a recent-activity boolean — or the first three', () => {
   // The cells above compare a response to the MODULE's lists; this pins those
   // lists to the spec, so a sixth key added to the module cannot pass with them.
@@ -594,6 +788,10 @@ test('the recruiting directory — the recruiter sees the full and name-only tie
 // ===========================================================================
 
 const isOwnRead = (r, a) => r.whoId === a.github_id && r.path === '/api/bongos/me/cross-project';
+// The one place ADR 0336 D4 lets a private member be named: their own guild's
+// members' roster, read by a fellow member — joining is consent to be seen BY THE
+// GUILD, never by the world. A provisional account is not on it (accountActiveSql).
+const isFellowMemberRead = (r) => r.who === 'Member' && /^\/api\/bongos\/guilds\/[^/?]+\/members$/.test(r.path);
 // What a response DISCLOSES: its body minus the fields that only echo the
 // caller's own request back (search's `query` and `discipline`). A discipline
 // the caller typed into the URL is not the server revealing it; the results
@@ -608,7 +806,7 @@ function disclosed(r) {
 }
 
 test('the walk covered every surface for every row (so the claims below are about something)', () => {
-  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting']) {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
     assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
   }
   assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);
@@ -630,21 +828,25 @@ test('hide_stats beats everything: no hidden account’s numbers reach anyone bu
   assert.ok(SEEN.some((r) => r.who === 'Anon' && r.text.includes(String(ROLLUP[ACCT.PUB.github_id].credits))), 'a shown record must reach Anon, or absence above is vacuous');
 });
 
-test('provisional and private (not discoverable) are absent from every cross-project surface, for every viewer but Self', () => {
+test('provisional and private (not discoverable) are absent from every cross-project surface, for every viewer but Self — a private member’s own guild aside', () => {
   for (const k of ['PROV', 'PRIV']) {
     const a = ACCT[k];
-    for (const r of SEEN.filter((x) => !isOwnRead(x, a) && !x.path.endsWith(`/profiles/${a.handle}`) && !x.path.endsWith(`/scouting/${a.handle}`))) {
+    const ownGuild = (x) => k === 'PRIV' && isFellowMemberRead(x);
+    for (const r of SEEN.filter((x) => !isOwnRead(x, a) && !ownGuild(x) && !x.path.endsWith(`/profiles/${a.handle}`) && !x.path.endsWith(`/scouting/${a.handle}`))) {
       for (const s of identitySentinels(a)) assert.ok(!disclosed(r).includes(s), `${k}'s "${s}" reached ${r.who} through GET ${r.path}`);
     }
   }
 });
 
-test('private · discoverable reaches the recruiter’s sliver and nowhere else', () => {
+test('private · discoverable reaches the recruiter’s sliver and, as a member, its own guilds’ members’ rosters — nowhere else', () => {
   for (const k of ['PRIVD', 'PRIVDH']) {
     const a = ACCT[k];
     const leaks = SEEN.filter((r) => !isOwnRead(r, a) && identitySentinels(a).some((s) => disclosed(r).includes(s)));
-    assert.deepEqual(leaks.map((r) => `${r.who} ${r.path}`), [`Recruiter /api/bongos/scouting/${a.handle}`],
-      `${k} may be named only by the sliver, to the recruiter (D3)`);
+    assert.deepEqual([...new Set(leaks.map((r) => `${r.who} ${r.path}`))].sort(), [
+      'Member /api/bongos/guilds/mx-guild/members',
+      'Member /api/bongos/guilds/mx-unlisted/members',
+      `Recruiter /api/bongos/scouting/${a.handle}`,
+    ], `${k} may be named only by the sliver, to the recruiter (D3), and to its fellow guild members (ADR 0336 D4)`);
   }
 });
 

package/tests/project_invite_ui.mjs

@@ -29,6 +29,10 @@
 //   • a refusal never costs the project or the step — the box stays, re-tryable
 //   • Skip advances with ZERO calls
 //   • both call sites hand over a slug only for a signed-in owner
+//   • a GUILD can be invited from the project's own page (task 1002303, R27; ADR
+//     0365 D3): exactly { client_id, guild } to /projects/invite-guild, its answer
+//     drawn as the same hand-off lines, one per member on the guild's public page,
+//     an unknown or unlisted guild one plain line, and the wizard has no such door
 //
 // Run:  node --test --test-reporter=tap tests/project_invite_ui.mjs
 
@@ -51,7 +55,8 @@ assert.ok(START > 0, 'the invite region must start at INVITE_MOUNTS');
 assert.ok(END > START, 'the invite region must end before the boot block');
 const REGION = SCRIPT.slice(START, END);
 for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function skipInvite(', 'function inviteRefusal(',
-  'function setInviteSuggestions(', 'function renderInviteSugg(', 'function loadInviteSuggestions(']) {
+  'function setInviteSuggestions(', 'function renderInviteSugg(', 'function loadInviteSuggestions(',
+  'function doInviteGuild(', 'function inviteGuildSlug(']) {
   assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
 }
 
@@ -116,7 +121,7 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
   ['wizInvite', 'wizInviteWho', 'wizInviteList', 'wizInviteMsg', 'wizInviteLater', 'doneStepsHead',
     'wizInviteWhy', 'wizInviteSugg',
     'mInvite', 'mInviteWho', 'mInviteList', 'mInviteMsg',
-    'mInviteWhy', 'mInviteSugg'].forEach($);
+    'mInviteWhy', 'mInviteSugg', 'mInviteGuild', 'mInviteGuildMsg'].forEach($);
 
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
@@ -150,7 +155,7 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
 
   const mounts = {
     wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', why: 'wizInviteWhy', sugg: 'wizInviteSugg' },
-    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', why: 'mInviteWhy', sugg: 'mInviteSugg' },
+    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', why: 'mInviteWhy', sugg: 'mInviteSugg', guild: 'mInviteGuild', guildMsg: 'mInviteGuildMsg' },
   };
   const m = mounts[mount];
   const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
@@ -186,6 +191,22 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
     async suggest(payload) { sandbox.setInviteSuggestions(mount, payload); await settle(); },
     async load(instanceId) { sandbox.loadInviteSuggestions(mount, instanceId); await settle(); },
     async pick(login) { pickLogin = login; await press('data-invite-pick'); },
+    // ── the guild half (task 1002303, R27) ───────────────────────────────
+    guildField: () => $('mInviteGuild'),
+    guildMsg: () => $('mInviteGuildMsg'),
+    async inviteGuild(value) {
+      $('mInviteGuild').value = value;
+      const handlers = listeners.get(mount + ':click') || [];
+      assert.equal(handlers.length, 1, 'the guild button rides the mount’s one delegated click handler');
+      handlers[0]({ target: { closest: (sel) => (sel === '[data-invite-guild]' ? {} : null) } });
+      await settle();
+    },
+    async guildEnter() {
+      const handlers = listeners.get('mInviteGuild:keydown') || [];
+      assert.equal(handlers.length, 1, 'the guild field takes Enter');
+      handlers[0]({ key: 'Enter', preventDefault() {} });
+      await settle();
+    },
     async enter() {
       const handlers = listeners.get(m.who + ':keydown') || [];
       assert.equal(handlers.length, 1, 'the field takes Enter');
@@ -708,3 +729,166 @@ test('the suggestion surface is mounted on BOTH the wizard and the project page'
   assert.match(COSMOS, /\.suggList\{/, 'styled in cosmos.css like its sibling list');
   assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>') + 1), /suggList/, 'not in the page head');
 });
+
+// ── invite a guild (task 1002303, R27; ADR 0365 D3) ──────────────────────────
+// The project's own page names a public guild; the route records that the project
+// invited it and answers one hall hand-off link per member on the guild's PUBLIC
+// page — the people the inviter could see. Nothing is sent from the hub: each
+// becomes the same pending line a single invite gets, finished on the hall.
+
+const guildAnswer = (members = [['mara-quinn', 'Mara Quinn'], ['kip', null]], name = 'Forge Crew') => ({
+  ok: true, status: 200,
+  body: {
+    invited: false,
+    guild: { slug: 'forge-crew', name },
+    invites: members.map(([handle, display]) => ({ handle, display_name: display, invite_url: 'https://mercury.cloudbongos.test/builders/watch?invite=' + handle })),
+    count: members.length,
+  },
+});
+
+test('inviteGuildSlug reads a guild the ways a person pastes one: its name, /g/<name>, or the page’s whole address', () => {
+  const f = boot().sandbox.inviteGuildSlug;
+  assert.equal(f('forge-crew'), 'forge-crew');
+  assert.equal(f('  Forge-Crew '), 'forge-crew', 'trimmed and lowercased, as the slug rule is');
+  assert.equal(f('/g/forge-crew'), 'forge-crew');
+  assert.equal(f('g/forge-crew/'), 'forge-crew');
+  assert.equal(f('https://cloudbongos.com/g/Forge-Crew/?ref=x#members'), 'forge-crew');
+  assert.equal(f(''), '');
+  assert.equal(f(null), '');
+});
+
+test('a guild invite sends exactly { client_id, guild } to /projects/invite-guild, on the cookie session', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer()] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('https://cloudbongos.com/g/forge-crew');
+
+  assert.equal(ui.requests.length, 1);
+  const req = ui.requests[0];
+  assert.equal(req.url, '/api/bongos/projects/invite-guild');
+  assert.equal(req.method, 'POST');
+  assert.equal(req.credentials, 'same-origin');
+  assert.deepEqual(JSON.parse(req.body), { client_id: 'mercury', guild: 'forge-crew' }, 'the slug the route reads, and nothing else');
+});
+
+test('the answer is one hand-off line per member on the guild’s public page — the same lines a single invite gets', async () => {
+  // a hand-off link that is not http(s) is never drawn, whoever it belongs to
+  const queued = guildAnswer([['mara-quinn', 'Mara Quinn'], ['kip', null]]);
+  queued.body.invites.push({ handle: 'bad', display_name: 'Bad Link', invite_url: 'javascript:alert(1)' });
+  const h = boot({ mount: 'mInvite', answers: [queued] });
+  await h.open('mercury');
+
+  await h.inviteGuild('forge-crew');
+
+  assert.deepEqual(h.rows().map((r) => r.login), ['Mara Quinn', 'kip'], 'the display name the guild page shows, else the handle');
+  assert.deepEqual(h.rows().map((r) => r.url), [
+    'https://mercury.cloudbongos.test/builders/watch?invite=mara-quinn',
+    'https://mercury.cloudbongos.test/builders/watch?invite=kip',
+  ], 'each link is the route’s own invite_url, verbatim');
+  for (const r of h.rows()) assert.match(r.said, /not sent yet/i, 'no line claims an invite the hall has not sent');
+  assert.doesNotMatch(h.sandbox.$('mInviteList').innerHTML, /javascript:/);
+  assert.equal(h.guildMsg().className, 'projMsg ok');
+  assert.equal(h.guildMsg().textContent, 'Forge Crew: 2 members to invite. Send each invite from your project’s hall — every line above opens it with their name filled in.');
+  assert.equal(h.guildField().value, '', 'the field clears for the next one');
+  assert.equal(h.msg().textContent, '', 'the single-invite line is left alone');
+});
+
+test('inviting the same guild twice draws no second line for anyone already on one', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer(), guildAnswer()] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('forge-crew');
+  await ui.inviteGuild('forge-crew');
+
+  assert.deepEqual(ui.rows().map((r) => r.login), ['Mara Quinn', 'kip']);
+});
+
+test('a guild with nobody on its public page says so plainly, and draws nothing', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer([])] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('forge-crew');
+
+  assert.equal(ui.rows().length, 0);
+  assert.equal(ui.guildMsg().className, 'projMsg', 'an answer, not a failure');
+  assert.equal(ui.guildMsg().textContent, 'Nobody is listed on Forge Crew’s public page yet, so there is no one to invite from here.');
+});
+
+test('an unknown guild and an unlisted one are ONE plain line; the other refusals keep the widget’s vocabulary', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [
+    refused(404, 'guild_not_found', 'guild_not_found'),
+    refused(403, 'permission_forbidden', 'requires project.curate'),
+    refused(401, 'unauthenticated'),
+    { reject: true },
+    refused(429, 'rate_limited', 'Too many invitations right now — give it a minute.'),
+  ] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('night-shift');
+  assert.equal(ui.guildMsg().textContent, 'No public guild at that name.');
+  assert.equal(ui.guildMsg().className, 'projMsg err');
+  assert.equal(ui.guildField().value, 'night-shift', 'a refusal keeps what was typed');
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().textContent, /can’t invite/i, 'the 403 said the careful way (ADR 0248)');
+  assert.doesNotMatch(ui.guildMsg().textContent, /project\.curate/);
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().innerHTML, /sign in again/i);
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().textContent, /reach the platform/i);
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().textContent, /Too many invitations right now/);
+  assert.equal(ui.rows().length, 0, 'no refusal draws a line');
+});
+
+test('an empty guild field is a question rather than a request; Enter in the field sends too', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer()] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('   ');
+  assert.equal(ui.requests.length, 0);
+  assert.equal(ui.guildMsg().textContent, 'Type the guild’s name or its /g/ address.');
+  assert.ok(ui.focused.includes('mInviteGuild'), 'focus goes to the field it asks about');
+
+  ui.guildField().value = 'forge-crew';
+  await ui.guildEnter();
+  assert.equal(ui.requests.length, 1);
+});
+
+test('the guild door is the project page’s alone: the wizard’s step has none, and a closed mount sends nothing', async () => {
+  const wiz = boot({ mount: 'wizInvite' });
+  await wiz.open('mercury');
+  await wiz.inviteGuild('forge-crew');
+  assert.equal(wiz.requests.length, 0, 'the wizard mount names no guild field');
+
+  const closed = boot({ mount: 'mInvite' });
+  await closed.open('');
+  await closed.inviteGuild('forge-crew');
+  assert.equal(closed.requests.length, 0, 'no project, no request');
+});
+
+test('a new project starts the guild line clean too', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [refused(404, 'guild_not_found')] });
+  await ui.open('mercury');
+  await ui.inviteGuild('night-shift');
+  assert.notEqual(ui.guildMsg().textContent, '');
+
+  await ui.open('venus');
+  assert.equal(ui.guildMsg().textContent, '', 'the answer belonged to the project it was asked for');
+});
+
+test('the project’s own page carries the guild door: a field, its button, and the one-line why — as real markup', () => {
+  const sec = (HUB.match(/<div class="card mSec" id="mInvite">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.match(sec, /<div class="attach">\s*<label class="vh" for="mInviteGuild">Guild name or address<\/label>\s*<input type="text" id="mInviteGuild"/, 'the page’s own input+button idiom');
+  assert.match(sec, /data-invite-guild="mInvite"/);
+  assert.match(sec, /Each member gets their own invite, and only the members shown on the guild’s public page are listed\./);
+  assert.match(sec, /<div class="projMsg" id="mInviteGuildMsg" role="status" aria-live="polite"><\/div>/, 'its answer has a line of its own, under the button');
+  assert.ok(sec.indexOf('id="mInviteGuild"') > sec.indexOf('id="mInviteList"'), 'below the pending lines it fills — "every line above"');
+  const panel = (HUB.match(/<section class="panel" id="panel-done"[\s\S]*?<\/section>/) || [''])[0];
+  assert.doesNotMatch(panel, /data-invite-guild/, 'the wizard’s step invites people, not guilds');
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
+  assert.ok(states['in-manage-invite-guild'], 'the guild lines have a kit state');
+});

package/tests/render_check.mjs

@@ -24,8 +24,8 @@ test('a shared asset reaches every page in its dir whose HTML names it', () => {
   // sky-data.js is shared by the two doors of one page (task 1004232): /thinking and /goal-map.
   assert.deepEqual(names(['modules/hall-ui/public/sky-data.js']), ['goal-map.states.json', 'thinking.states.json']);
   assert.deepEqual(names(['modules/hall-ui/public/text-fit.js']), ['goals.states.json']);
-  // the account page links the hub's sheet too since task 1004259
-  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'projects.states.json']);
+  // the account page links the hub's sheet too since task 1004259, and the guild page since task 1002301
+  assert.deepEqual(names(['modules/public-landing/public/assets/cosmos.css']), ['account.states.json', 'guild.states.json', 'projects.states.json']);
 });
 
 test('the page a builder changed comes before the pages a shared file reaches, so the render cap never drops it', () => {

package/tests/ui_design_kit.mjs

@@ -34,7 +34,7 @@ test('the platform floors are a pinned list — a floor cannot vanish quietly',
 });
 
 test('the shipped states files validate and sit beside the page they name', () => {
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/projects-dns-pending.states.json', 'modules/public-landing/public/projects-hall-live.states.json','modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/hall-ui/public/ranks.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/projects-empty.states.json', 'modules/public-landing/public/projects-dns-pending.states.json', 'modules/public-landing/public/projects-hall-live.states.json','modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/account-private.states.json', 'modules/public-landing/public/guild.states.json', 'modules/hall-ui/public/ranks.states.json']) {
     const json = readJson(rel);
     const v = lib.validateStatesFile(json);
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
@@ -43,14 +43,14 @@ test('the shipped states files validate and sit beside the page they name', () =
   }
   // the apex is dark only (task 1003336): its states files name the one mode, and
   // render.js reads it as the default so a plain `--page /` never renders light
-  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json']) {
+  for (const rel of ['modules/public-landing/public/projects.states.json', 'modules/public-landing/public/index.states.json', 'modules/public-landing/public/account.states.json', 'modules/public-landing/public/guild.states.json']) {
     assert.deepEqual(readJson(rel).modes, ['dark'], `${rel}: the apex renders dark only`);
     assert.equal(readJson(rel).modeQuery, false, `${rel}: no query walks a second mode`);
   }
 });
 
 test('the shipped probes files validate', () => {
-  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json']) {
+  for (const rel of ['modules/public-landing/public/projects.probes.json', 'modules/public-landing/public/index.probes.json', 'modules/public-landing/public/account.probes.json', 'modules/public-landing/public/guild.probes.json']) {
     const v = lib.validateProbesFile(readJson(rel));
     assert.deepEqual(v.errors, [], `${rel}: ${v.errors.join('; ')}`);
   }