@bongos/core 1.21.57 → 1.21.58

package/tests/hub_guild_page.mjs

@@ -3,10 +3,12 @@
 //
 // A guild spans projects, so its page is the hub's. One shell serves every slug;
 // the page asks the public read (GET /guilds/:slug) and, for someone signed in,
-// the members' own-scope read (GET /guilds/:slug/members), and writes one thing:
-// the member's own two switches (PATCH /guilds/:slug/membership). These pin:
+// the members' own-scope read (GET /guilds/:slug/members), and writes two things:
+// the member's own two switches (PATCH /guilds/:slug/membership) and, for the
+// owner only, the guild applying to a project (POST /guilds/:slug/engagements,
+// task 1002303, R27). These pin:
 //   1. the page as a file: portable, dark only, noindex, no page :root, no
-//      innerHTML, no GitHub id or login read, and only the three guild routes;
+//      innerHTML, no GitHub id or login read, and only the four guild routes;
 //   2. its slug rule is the module's (a boundary-forced copy);
 //   3. the bar is the hub's — the account page's chrome, with no current place
 //      and the sign-in doors pointed back at the guild by the script;
@@ -15,7 +17,9 @@
 //      10"), "no guild here" as ONE answer for an unknown slug, an unlisted guild
 //      and a malformed path, the members' view, the prompt after a guild goes
 //      public (asked, never assumed; "not now" remembered per guild), the
-//      counted switch and its notice, and each save sending only what moved;
+//      counted switch and its notice, each save sending only what moved, and
+//      the owner's "apply to a project" (shown to the owner alone, one honest
+//      line for a project that is not public on the map);
 //   5. the route: /g/<slug> on the hub's apex only, never on a child or the
 //      builders/status hosts, and a segment that cannot be a slug falls through.
 // What the public roster may hold is the server's, and tests/privacy_matrix.mjs
@@ -67,7 +71,7 @@ test('portable and dark only: stamped title, noindex, balanced sentinels, no :ro
 test('the script builds no markup from strings, never reads a GitHub id or login, and the regions ship hidden', () => {
   assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML/, 'live DOM is textContent / createElement only');
   assert.doesNotMatch(SCRIPT, /github_(id|login)/, 'a roster shows handle, display name, avatar and kind — never a GitHub id or login (ADR 0336 D4)');
-  for (const id of ['guildBody', 'missing', 'missingSignin', 'gYou', 'showAsk', 'shownUnlisted', 'gRosterEmpty']) {
+  for (const id of ['guildBody', 'missing', 'missingSignin', 'gYou', 'showAsk', 'shownUnlisted', 'gRosterEmpty', 'gApply']) {
     assert.match(PAGE, new RegExp(`id="${id}"[^>]*\\bhidden\\b`), `#${id} ships hidden`);
   }
   for (const [name, values] of [['shown', ['on', 'off']], ['counted', ['on', 'off']]]) {
@@ -76,15 +80,16 @@ test('the script builds no markup from strings, never reads a GitHub id or login
   for (const id of ['askYes', 'askNo', 'youSave', 'gRoster', 'tShipped', 'tCredits', 'tKarma', 'tProjects']) assert.match(PAGE, new RegExp(`id="${id}"`));
 });
 
-test('the page calls only the three guild routes; the bar’s two calls stay in the shared asset', () => {
+test('the page calls only the four guild routes; the bar’s two calls stay in the shared asset', () => {
   const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST|DELETE)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
-  assert.deepEqual([...new Set(calls)].sort(), ['GET /guilds/', 'PATCH /guilds/'].sort(), 'every call is built on /guilds/<slug>');
+  assert.deepEqual([...new Set(calls)].sort(), ['GET /guilds/', 'PATCH /guilds/', 'POST /guilds/'].sort(), 'every call is built on /guilds/<slug>');
   assert.deepEqual([...SCRIPT.matchAll(/request\('[A-Z]+', '\/guilds\/' \+ slug( \+ '[^']*')?/g)].map((m) => m[0]).sort(), [
     "request('GET', '/guilds/' + slug",
     "request('GET', '/guilds/' + slug",
     "request('GET', '/guilds/' + slug + '/members'",
     "request('GET', '/guilds/' + slug + '/members'",
     "request('PATCH', '/guilds/' + slug + '/membership'",
+    "request('POST', '/guilds/' + slug + '/engagements'",
   ].sort());
   assert.match(PAGE, /<script src="\/assets\/hub-bar\.js"><\/script>\n<script>\n\(function \(\) \{/, 'hub-bar.js runs first, so window.HubBar exists when the page script asks for it');
   assert.doesNotMatch(SCRIPT, /function (openBand|closeMenus|openMenu)\b|\/auth\/logout/, 'no second copy of the bands or sign out in the page');
@@ -488,6 +493,88 @@ test('an unlisted guild, to its members: no public page, so no pair, no prompt,
     'a visibility change flips only the owner’s own flag');
 });
 
+// ── 4b. apply to a project, as this guild (task 1002303, R27; ADR 0365 D2) ──
+// The owner files the guild's application; it applies for nobody, so each member
+// (the owner included) applies as themselves from their invitations. A project
+// that is unknown, off the map or not public is ONE 404 on the server, and one
+// line here that never says a private project exists.
+
+function ownerAnswer(engage) {
+  const members = (m, p, body) => memberAnswer({ you: { membership_kind: 'owner' } })(m, p, body);
+  return (m, p, body) => (p === '/guilds/forge-crew/engagements' && m === 'POST' ? engage(body) : members(m, p, body));
+}
+const ENGAGED = (origin) => ({
+  status: 200,
+  data: { engagement: { guild: { slug: 'forge-crew', name: 'Forge Crew' }, kind: 'apply', project: { name: 'Tidepool', origin }, created_at: '2026-10-05T09:00:00.000Z' } },
+});
+const sendApply = (dom, value) => {
+  dom.el('applyOrigin').value = value;
+  for (const f of dom.el('applyForm')._on.submit || []) f({ preventDefault() {} });
+};
+
+test('apply to a project: shown to the guild’s owner alone — never to a member, a stranger or someone signed out', async () => {
+  const owner = boot({ me: ME, answer: ownerAnswer(() => NOT_FOUND) });
+  await settle();
+  assert.equal(owner.el('gApply').hidden, false, 'the owner files for the guild');
+
+  const member = boot({ me: ME, answer: memberAnswer({}) });
+  await settle();
+  assert.equal(member.el('gApply').hidden, true, 'a member applies from their own invitations, not here');
+
+  const stranger = boot({ me: ME, answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  assert.equal(stranger.el('gApply').hidden, true);
+
+  const out = boot({ answer: (m, p) => (p === '/guilds/forge-crew' ? { status: 200, data: PUBLIC() } : NOT_FOUND) });
+  await settle();
+  assert.equal(out.el('gApply').hidden, true);
+});
+
+test('apply to a project: sends exactly { origin } (a bare host taken as https://), and says it applied for nobody, the owner included', async () => {
+  const sent = [];
+  const dom = boot({ me: ME, answer: ownerAnswer((body) => { sent.push(body); return ENGAGED(body.origin); }) });
+  await settle();
+
+  sendApply(dom, '   ');
+  assert.equal(sent.length, 0, 'an empty field is a question, not a request');
+  assert.equal(dom.text('applyMsg'), 'Enter the project’s address.');
+  assert.equal(dom.el('applyMsg').className, 'projMsg err');
+
+  sendApply(dom, ' tidepool.example.com ');
+  await settle();
+  assert.deepEqual(sent, [{ origin: 'https://tidepool.example.com' }], 'the one field the route reads, and nothing else');
+  assert.deepEqual(dom.calls.filter((c) => c.method === 'POST').map((c) => c.path), ['/guilds/forge-crew/engagements']);
+  assert.equal(dom.text('applyMsg'), 'Done. Forge Crew’s members will see Tidepool in their invitations, and each one applies as themselves. That includes you — this didn’t apply for you.');
+  assert.equal(dom.el('applyMsg').className, 'projMsg ok');
+  assert.equal(dom.el('applyOrigin').value, '', 'the field clears for the next one');
+  assert.equal(dom.el('applySend').disabled, false);
+  assert.equal(dom.calls.filter((c) => c.path === '/my-projects/join').length, 0, 'filing never applies on anyone’s behalf');
+});
+
+test('apply to a project: a project that is not public on the map is ONE honest line; other refusals in the server’s words', async () => {
+  let answer = { status: 404, data: { error: { code: 'unknown_project', message: 'unknown_project' } } };
+  const dom = boot({ me: ME, answer: ownerAnswer(() => answer) });
+  await settle();
+
+  sendApply(dom, 'https://stealth.example.com');
+  await settle();
+  assert.equal(dom.text('applyMsg'), 'No public project on the map at that address.', 'unknown, private and stealth read the same');
+  assert.doesNotMatch(dom.text('applyMsg'), /private|stealth|exists/i);
+  assert.equal(dom.el('applyMsg').className, 'projMsg err');
+  assert.equal(dom.el('applyOrigin').value, 'https://stealth.example.com', 'a refusal keeps what was typed');
+
+  answer = { status: 403, data: { error: { code: 'guild_owner_only', message: 'only the guild owner can do that' } } };
+  sendApply(dom, 'https://tidepool.example.com');
+  await settle();
+  assert.equal(dom.text('applyMsg'), 'Only the guild owner can do that.');
+
+  answer = { status: 401, data: null };
+  sendApply(dom, 'https://tidepool.example.com');
+  await settle();
+  assert.equal(dom.text('applyMsg'), 'Your session expired — sign in again to send this.');
+  assert.equal(dom.el('who').hidden, true, 'the chip is repainted signed out');
+});
+
 // ── 5. the route ─────────────────────────────────────────────────────────────
 
 const { buildPlatformApp } = require('../src/platform-server.js');

package/tests/privacy_matrix.mjs

@@ -160,14 +160,19 @@ function identitySentinels(acct) {
 //   members    GET /guilds/:slug/members    a fellow Member — the own-scope roster: 'listed' |
 //                'absent'. Joining is consent to be seen BY THE GUILD (D4 §1), so a private
 //                member is listed here and nowhere public; a provisional account is never
+//   invite     POST /projects/invite-guild  a project's Inviter (task 1002303; ADR 0365 D3) — one
+//                hall link per member of a PUBLIC guild's public roster: 'listed' | 'absent'.
+//                It reads accounts across projects, so it may hand the inviter exactly the
+//                people the guild page already shows them — shown_publicly AND existence;
+//                hide_stats never hides membership, and private or provisional is never listed
 const MATRIX = {
-  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent' },
-  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed' },
-  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed' },
-  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed' },
-  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed' },
-  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed' },
-  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed' },
+  PROV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'n/a', guild: 'absent', members: 'absent', invite: 'absent' },
+  PUB: { profile: 'full', search: 'listed', board: 'listed', directory: 'full', sliver: 'full', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  SHY: { profile: 'identity', search: 'name-only', board: 'absent', directory: 'name-only', sliver: 'name-only', self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
+  PRIV: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 404, self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVD: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'full', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  PRIVDH: { profile: 404, search: 'absent', board: 'absent', directory: 'absent', sliver: 'name-only', self: 'own', guild: 'absent', members: 'listed', invite: 'absent' },
+  OPTOUT: { profile: 'full', search: 'listed', board: 'listed', directory: 'absent', sliver: 404, self: 'own', guild: 'listed', members: 'listed', invite: 'listed' },
 };
 
 // ===========================================================================
@@ -271,10 +276,40 @@ function guildRosterFilter(sql, params) {
   return (m) => m.guild_id === String(params[0]) && (!shownOnly || m.shown_publicly) && byAccount(ACCOUNTS.find((a) => a.github_id === m.github_id));
 }
 
+// THE PROJECT a guild is invited to (task 1002303): one active client, whose
+// origin the hall links point at.
+const MX_CLIENT = { client_id: 'mx-proj', secret_hash: '', name: 'MX Project', redirect_uris: [], origin: 'https://mx-proj.example', owner_github_id: null, status: 'active' };
+
 const pool = {
   query: async (text, params = []) => {
     const sql = String(text).replace(/\s+/g, ' ').trim();
 
+    // POST /projects/invite-guild's reads (task 1002303). The client the gate resolves.
+    if (/FROM platform_identity_sso_clients WHERE client_id = \$1$/.test(sql)) {
+      const rows = params[0] === MX_CLIENT.client_id ? [{ ...MX_CLIENT }] : [];
+      return { rows, rowCount: rows.length };
+    }
+    // ... the guild, by slug — its WHERE is read, not assumed: PUBLIC only.
+    if (/^SELECT id, slug, name FROM platform_identity_guilds WHERE /.test(sql)) {
+      if (!/WHERE lower\(slug\) = \$1 AND visibility = 'public'$/.test(sql)) throw new Error(`fake pool: the invite-guild lookup moved — ${sql}`);
+      const rows = GUILDS.filter((g) => g.slug === String(params[0]) && g.visibility === 'public').map(({ id, slug, name }) => ({ id, slug, name }));
+      return { rows, rowCount: rows.length };
+    }
+    // ... the `invited` engagement it records (no account in it, so nothing to model here).
+    if (/^INSERT INTO platform_identity_guild_engagements /.test(sql)) return { rows: [], rowCount: 1 };
+    // ... and the PUBLIC roster the hall links go to, read through the same roster
+    // interpreter as the guild page — its projection pinned, since the login it
+    // reads becomes part of each link.
+    if (/^SELECT pa\.handle, pa\.display_name, pa\.github_login FROM platform_identity_guild_members m JOIN platform_identity_accounts pa/.test(sql)) {
+      const keep = guildRosterFilter(sql, params);
+      const rows = GUILD_MEMBERS.filter(keep).map((m) => {
+        const a = ACCOUNTS.find((x) => x.github_id === m.github_id);
+        // github_id and the bio ride along so a projection that spreads the row leaks them
+        return { handle: a.handle, display_name: a.display_name, github_login: a.github_login, github_id: a.github_id, bio: a.bio };
+      });
+      return { rows, rowCount: rows.length };
+    }
+
     // THE GUILD PAGE's reads. The public guild: its WHERE is read, not assumed.
     if (/^SELECT id, slug, name, description, created_at FROM platform_identity_guilds WHERE /.test(sql)) {
       if (!/WHERE lower\(slug\) = \$1 AND visibility = 'public'$/.test(sql)) throw new Error(`fake pool: the public guild read moved — ${sql}`);
@@ -424,6 +459,13 @@ require.cache[moduleApiPath] = {
     },
     requirePermission: () => (req, res, next) => (viewer && viewer.curate ? next() : res.status(403).json({ ok: false, error: 'forbidden' })),
     requireRank: (...allowed) => (req, res, next) => (viewer && allowed.includes(viewer.rank) ? next() : res.fail('rank_forbidden', 403)),
+    // routes/projects.js (POST /projects/invite-guild): its seams are already
+    // registered as far as this file is concerned, and no provisioning module
+    // answers the inviter gate's ownership arm, so the rank door decides.
+    hasProvider: () => true,
+    registerProvider: () => {},
+    resolveOptional: () => null,
+    publicProjectFeedRateLimit: (_req, _res, next) => next(),
   },
 };
 
@@ -471,7 +513,7 @@ const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
 const app = express();
 app.use(express.json());
 app.use(attachFail);
-for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting', 'guilds-public', 'guilds']) {
+for (const file of ['public-profile', 'profile', 'community-search', 'community-leaderboard', 'scouting', 'guilds-public', 'guilds', 'projects']) {
   app.use('/api/bongos', require(`../modules/platform-identity/routes/${file}.js`)());
 }
 const server = app.listen(0, '127.0.0.1');
@@ -503,6 +545,28 @@ function get(who, path_) {
   });
 }
 
+/** A POST through the same recorder, so the sweeps below judge its body too. */
+function post(who, path_, body) {
+  viewer = who;
+  const payload = JSON.stringify(body);
+  const headers = { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) };
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, method: 'POST', path: path_, headers }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const text = Buffer.concat(chunks).toString('utf8');
+        let json = null; try { json = JSON.parse(text); } catch { /* not JSON */ }
+        const out = { who: who ? who.name : 'Anon', whoId: who ? who.github_id : null, path: path_, status: res.statusCode, text, json };
+        SEEN.push(out);
+        resolve(out);
+      });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
 // ===========================================================================
 // 0. The instrument is calibrated before it is trusted
 // ===========================================================================
@@ -639,6 +703,32 @@ test('an unlisted guild’s public read is a 404 to everyone, its own members in
   for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].members === 'listed', `${k} on the unlisted guild’s members’ roster`);
 });
 
+// A project invites a guild (task 1002303; ADR 0365 D3). The INVITER is the
+// viewer here — a holder of the route's rank door (the Recruiter fixture carries
+// it); the cell is who they are handed a link for.
+const INVITE_GUILD_PATH = '/api/bongos/projects/invite-guild';
+const INVITE_KEYS = ['display_name', 'handle', 'invite_url'];
+
+test('a project invites a guild — one hall link per PUBLIC-roster member, listed or absent per the matrix; a non-inviter is refused', async () => {
+  const r = await post(RECRUITER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-guild' });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.invited, false, 'the hub writes no invite (ADR 0353)');
+  const listed = new Set(r.json.invites.map((i) => i.handle));
+  for (const k of KEYS) assert.equal(listed.has(ACCT[k].handle), MATRIX[k].invite === 'listed', `${k} in the invite fan-out: expected ${MATRIX[k].invite}`);
+  assert.equal(r.json.count, r.json.invites.length, 'count is the array’s own length');
+  for (const i of r.json.invites) {
+    assert.deepEqual(Object.keys(i).sort(), INVITE_KEYS, 'a handle, a name and a link — never a GitHub id, a bio or a number');
+    const a = ACCOUNTS.find((x) => x.handle === i.handle);
+    assert.equal(i.invite_url, `${MX_CLIENT.origin}/builders/watch?invite=${encodeURIComponent(a.github_login)}`, 'the project’s own hall, with the login a public profile already shows');
+  }
+  const stranger = await post(STRANGER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-guild' });
+  assert.equal(stranger.status, 403, 'only the project’s inviter is handed the roster');
+  const unlisted = await post(RECRUITER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-unlisted' });
+  const nobody = await post(RECRUITER, INVITE_GUILD_PATH, { client_id: MX_CLIENT.client_id, guild: 'mx-nobody' });
+  assert.equal(unlisted.status, 404);
+  assert.equal(unlisted.text, nobody.text, 'an unlisted guild cannot be invited: the unknown-guild 404, byte for byte');
+});
+
 test('the sliver’s key lists are D3’s, transcribed: handle, name, avatar, disciplines, a recent-activity boolean — or the first three', () => {
   // The cells above compare a response to the MODULE's lists; this pins those
   // lists to the spec, so a sixth key added to the module cannot pass with them.
@@ -716,7 +806,7 @@ function disclosed(r) {
 }
 
 test('the walk covered every surface for every row (so the claims below are about something)', () => {
-  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members']) {
+  for (const p of ['/profiles/', '/me/cross-project', '/community/search', '/community/leaderboard', '/scouting', '/guilds/mx-guild', '/guilds/mx-guild/members', '/projects/invite-guild']) {
     assert.ok(SEEN.some((r) => r.path.includes(p) && r.status === 200), `no 200 from ${p} — the sweep below would be vacuous for it`);
   }
   assert.ok(SEEN.length >= KEYS.length * 6, `only ${SEEN.length} responses recorded`);

package/tests/project_invite_ui.mjs

@@ -29,6 +29,10 @@
 //   • a refusal never costs the project or the step — the box stays, re-tryable
 //   • Skip advances with ZERO calls
 //   • both call sites hand over a slug only for a signed-in owner
+//   • a GUILD can be invited from the project's own page (task 1002303, R27; ADR
+//     0365 D3): exactly { client_id, guild } to /projects/invite-guild, its answer
+//     drawn as the same hand-off lines, one per member on the guild's public page,
+//     an unknown or unlisted guild one plain line, and the wizard has no such door
 //
 // Run:  node --test --test-reporter=tap tests/project_invite_ui.mjs
 
@@ -51,7 +55,8 @@ assert.ok(START > 0, 'the invite region must start at INVITE_MOUNTS');
 assert.ok(END > START, 'the invite region must end before the boot block');
 const REGION = SCRIPT.slice(START, END);
 for (const fn of ['function setInviteSlug(', 'function doInvite(', 'function skipInvite(', 'function inviteRefusal(',
-  'function setInviteSuggestions(', 'function renderInviteSugg(', 'function loadInviteSuggestions(']) {
+  'function setInviteSuggestions(', 'function renderInviteSugg(', 'function loadInviteSuggestions(',
+  'function doInviteGuild(', 'function inviteGuildSlug(']) {
   assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
 }
 
@@ -116,7 +121,7 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
   ['wizInvite', 'wizInviteWho', 'wizInviteList', 'wizInviteMsg', 'wizInviteLater', 'doneStepsHead',
     'wizInviteWhy', 'wizInviteSugg',
     'mInvite', 'mInviteWho', 'mInviteList', 'mInviteMsg',
-    'mInviteWhy', 'mInviteSugg'].forEach($);
+    'mInviteWhy', 'mInviteSugg', 'mInviteGuild', 'mInviteGuildMsg'].forEach($);
 
   const queued = answers.slice();
   const fetch = (url, init = {}) => {
@@ -150,7 +155,7 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
 
   const mounts = {
     wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', why: 'wizInviteWhy', sugg: 'wizInviteSugg' },
-    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', why: 'mInviteWhy', sugg: 'mInviteSugg' },
+    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', why: 'mInviteWhy', sugg: 'mInviteSugg', guild: 'mInviteGuild', guildMsg: 'mInviteGuildMsg' },
   };
   const m = mounts[mount];
   const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
@@ -186,6 +191,22 @@ function boot({ mount = 'wizInvite', answers = [] } = {}) {
     async suggest(payload) { sandbox.setInviteSuggestions(mount, payload); await settle(); },
     async load(instanceId) { sandbox.loadInviteSuggestions(mount, instanceId); await settle(); },
     async pick(login) { pickLogin = login; await press('data-invite-pick'); },
+    // ── the guild half (task 1002303, R27) ───────────────────────────────
+    guildField: () => $('mInviteGuild'),
+    guildMsg: () => $('mInviteGuildMsg'),
+    async inviteGuild(value) {
+      $('mInviteGuild').value = value;
+      const handlers = listeners.get(mount + ':click') || [];
+      assert.equal(handlers.length, 1, 'the guild button rides the mount’s one delegated click handler');
+      handlers[0]({ target: { closest: (sel) => (sel === '[data-invite-guild]' ? {} : null) } });
+      await settle();
+    },
+    async guildEnter() {
+      const handlers = listeners.get('mInviteGuild:keydown') || [];
+      assert.equal(handlers.length, 1, 'the guild field takes Enter');
+      handlers[0]({ key: 'Enter', preventDefault() {} });
+      await settle();
+    },
     async enter() {
       const handlers = listeners.get(m.who + ':keydown') || [];
       assert.equal(handlers.length, 1, 'the field takes Enter');
@@ -708,3 +729,166 @@ test('the suggestion surface is mounted on BOTH the wizard and the project page'
   assert.match(COSMOS, /\.suggList\{/, 'styled in cosmos.css like its sibling list');
   assert.doesNotMatch(HUB.slice(0, HUB.indexOf('</head>') + 1), /suggList/, 'not in the page head');
 });
+
+// ── invite a guild (task 1002303, R27; ADR 0365 D3) ──────────────────────────
+// The project's own page names a public guild; the route records that the project
+// invited it and answers one hall hand-off link per member on the guild's PUBLIC
+// page — the people the inviter could see. Nothing is sent from the hub: each
+// becomes the same pending line a single invite gets, finished on the hall.
+
+const guildAnswer = (members = [['mara-quinn', 'Mara Quinn'], ['kip', null]], name = 'Forge Crew') => ({
+  ok: true, status: 200,
+  body: {
+    invited: false,
+    guild: { slug: 'forge-crew', name },
+    invites: members.map(([handle, display]) => ({ handle, display_name: display, invite_url: 'https://mercury.cloudbongos.test/builders/watch?invite=' + handle })),
+    count: members.length,
+  },
+});
+
+test('inviteGuildSlug reads a guild the ways a person pastes one: its name, /g/<name>, or the page’s whole address', () => {
+  const f = boot().sandbox.inviteGuildSlug;
+  assert.equal(f('forge-crew'), 'forge-crew');
+  assert.equal(f('  Forge-Crew '), 'forge-crew', 'trimmed and lowercased, as the slug rule is');
+  assert.equal(f('/g/forge-crew'), 'forge-crew');
+  assert.equal(f('g/forge-crew/'), 'forge-crew');
+  assert.equal(f('https://cloudbongos.com/g/Forge-Crew/?ref=x#members'), 'forge-crew');
+  assert.equal(f(''), '');
+  assert.equal(f(null), '');
+});
+
+test('a guild invite sends exactly { client_id, guild } to /projects/invite-guild, on the cookie session', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer()] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('https://cloudbongos.com/g/forge-crew');
+
+  assert.equal(ui.requests.length, 1);
+  const req = ui.requests[0];
+  assert.equal(req.url, '/api/bongos/projects/invite-guild');
+  assert.equal(req.method, 'POST');
+  assert.equal(req.credentials, 'same-origin');
+  assert.deepEqual(JSON.parse(req.body), { client_id: 'mercury', guild: 'forge-crew' }, 'the slug the route reads, and nothing else');
+});
+
+test('the answer is one hand-off line per member on the guild’s public page — the same lines a single invite gets', async () => {
+  // a hand-off link that is not http(s) is never drawn, whoever it belongs to
+  const queued = guildAnswer([['mara-quinn', 'Mara Quinn'], ['kip', null]]);
+  queued.body.invites.push({ handle: 'bad', display_name: 'Bad Link', invite_url: 'javascript:alert(1)' });
+  const h = boot({ mount: 'mInvite', answers: [queued] });
+  await h.open('mercury');
+
+  await h.inviteGuild('forge-crew');
+
+  assert.deepEqual(h.rows().map((r) => r.login), ['Mara Quinn', 'kip'], 'the display name the guild page shows, else the handle');
+  assert.deepEqual(h.rows().map((r) => r.url), [
+    'https://mercury.cloudbongos.test/builders/watch?invite=mara-quinn',
+    'https://mercury.cloudbongos.test/builders/watch?invite=kip',
+  ], 'each link is the route’s own invite_url, verbatim');
+  for (const r of h.rows()) assert.match(r.said, /not sent yet/i, 'no line claims an invite the hall has not sent');
+  assert.doesNotMatch(h.sandbox.$('mInviteList').innerHTML, /javascript:/);
+  assert.equal(h.guildMsg().className, 'projMsg ok');
+  assert.equal(h.guildMsg().textContent, 'Forge Crew: 2 members to invite. Send each invite from your project’s hall — every line above opens it with their name filled in.');
+  assert.equal(h.guildField().value, '', 'the field clears for the next one');
+  assert.equal(h.msg().textContent, '', 'the single-invite line is left alone');
+});
+
+test('inviting the same guild twice draws no second line for anyone already on one', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer(), guildAnswer()] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('forge-crew');
+  await ui.inviteGuild('forge-crew');
+
+  assert.deepEqual(ui.rows().map((r) => r.login), ['Mara Quinn', 'kip']);
+});
+
+test('a guild with nobody on its public page says so plainly, and draws nothing', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer([])] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('forge-crew');
+
+  assert.equal(ui.rows().length, 0);
+  assert.equal(ui.guildMsg().className, 'projMsg', 'an answer, not a failure');
+  assert.equal(ui.guildMsg().textContent, 'Nobody is listed on Forge Crew’s public page yet, so there is no one to invite from here.');
+});
+
+test('an unknown guild and an unlisted one are ONE plain line; the other refusals keep the widget’s vocabulary', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [
+    refused(404, 'guild_not_found', 'guild_not_found'),
+    refused(403, 'permission_forbidden', 'requires project.curate'),
+    refused(401, 'unauthenticated'),
+    { reject: true },
+    refused(429, 'rate_limited', 'Too many invitations right now — give it a minute.'),
+  ] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('night-shift');
+  assert.equal(ui.guildMsg().textContent, 'No public guild at that name.');
+  assert.equal(ui.guildMsg().className, 'projMsg err');
+  assert.equal(ui.guildField().value, 'night-shift', 'a refusal keeps what was typed');
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().textContent, /can’t invite/i, 'the 403 said the careful way (ADR 0248)');
+  assert.doesNotMatch(ui.guildMsg().textContent, /project\.curate/);
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().innerHTML, /sign in again/i);
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().textContent, /reach the platform/i);
+
+  await ui.inviteGuild('forge-crew');
+  assert.match(ui.guildMsg().textContent, /Too many invitations right now/);
+  assert.equal(ui.rows().length, 0, 'no refusal draws a line');
+});
+
+test('an empty guild field is a question rather than a request; Enter in the field sends too', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [guildAnswer()] });
+  await ui.open('mercury');
+
+  await ui.inviteGuild('   ');
+  assert.equal(ui.requests.length, 0);
+  assert.equal(ui.guildMsg().textContent, 'Type the guild’s name or its /g/ address.');
+  assert.ok(ui.focused.includes('mInviteGuild'), 'focus goes to the field it asks about');
+
+  ui.guildField().value = 'forge-crew';
+  await ui.guildEnter();
+  assert.equal(ui.requests.length, 1);
+});
+
+test('the guild door is the project page’s alone: the wizard’s step has none, and a closed mount sends nothing', async () => {
+  const wiz = boot({ mount: 'wizInvite' });
+  await wiz.open('mercury');
+  await wiz.inviteGuild('forge-crew');
+  assert.equal(wiz.requests.length, 0, 'the wizard mount names no guild field');
+
+  const closed = boot({ mount: 'mInvite' });
+  await closed.open('');
+  await closed.inviteGuild('forge-crew');
+  assert.equal(closed.requests.length, 0, 'no project, no request');
+});
+
+test('a new project starts the guild line clean too', async () => {
+  const ui = boot({ mount: 'mInvite', answers: [refused(404, 'guild_not_found')] });
+  await ui.open('mercury');
+  await ui.inviteGuild('night-shift');
+  assert.notEqual(ui.guildMsg().textContent, '');
+
+  await ui.open('venus');
+  assert.equal(ui.guildMsg().textContent, '', 'the answer belonged to the project it was asked for');
+});
+
+test('the project’s own page carries the guild door: a field, its button, and the one-line why — as real markup', () => {
+  const sec = (HUB.match(/<div class="card mSec" id="mInvite">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.match(sec, /<div class="attach">\s*<label class="vh" for="mInviteGuild">Guild name or address<\/label>\s*<input type="text" id="mInviteGuild"/, 'the page’s own input+button idiom');
+  assert.match(sec, /data-invite-guild="mInvite"/);
+  assert.match(sec, /Each member gets their own invite, and only the members shown on the guild’s public page are listed\./);
+  assert.match(sec, /<div class="projMsg" id="mInviteGuildMsg" role="status" aria-live="polite"><\/div>/, 'its answer has a line of its own, under the button');
+  assert.ok(sec.indexOf('id="mInviteGuild"') > sec.indexOf('id="mInviteList"'), 'below the pending lines it fills — "every line above"');
+  const panel = (HUB.match(/<section class="panel" id="panel-done"[\s\S]*?<\/section>/) || [''])[0];
+  assert.doesNotMatch(panel, /data-invite-guild/, 'the wizard’s step invites people, not guilds');
+  const states = JSON.parse(fs.readFileSync(path.join(LANDING, 'projects.states.json'), 'utf8')).states;
+  assert.ok(states['in-manage-invite-guild'], 'the guild lines have a kit state');
+});