@bongos/core 1.21.57 → 1.21.58

package/docs/file-map.md

@@ -360,6 +360,9 @@ tests/
 ├── applicant_profile_boundary.mjs ← (task 1002972, goal 1000045 C4, privacy spec D7, ADR 0241): THE D7 BOUNDARY proof for the applicant view a reviewer sees. Whitelists read from the MODULES’ own exports — the private branch against `recruiter-sliver`’s `SLIVER_KEYS`/`SLIVER_KEYS_HIDDEN`, the public branch against the public-page payload’s key list — so a third shape (the “new disclosure class” D7 forbids) reds this file. Pins THE CONSENT SWAP in both directions on the same account: a private builder who never opted into recruiting gets an applicant view and gets `null` from `getRecruiterSliver`, so a refactor routing the port through the recruiter sliver cannot pass quietly. `hide_stats` beats the application in both branches; provisional and terms-never-accepted disclose nothing; planted sentinels asserted absent from the whole body with the avatar-embedded `github_id` pinned as the one honest exception. Plus the federated gate (ADR 0205): no echo → 404 and NO account row read (asserted on the statement log), the witness matched against the AUTHENTICATED client, an out-of-window echo stops working, and `Cache-Control: no-store`. Real router + real HTTP over in-memory tables filtered by each statement’s own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── recruiter_sliver_boundary.mjs ← (task 1002968, goal 1000045 C2/C5, privacy spec D3, ADR 0215): THE PRE-ACCEPT BOUNDARY proof for the D3 recruiter sliver. A WHITELIST over the module's own exported key list (a sixth key fails whether or not this file was told about it), planted improbable sentinels asserted absent from the WHOLE response body with two controls against vacuity, the ceiling assertion (the handle a recruiter is handed 404s at `GET /profiles/:handle`, with a 200 control) and the gate (both recruiting routes admit the same two audiences and refuse byte-identically). Real router + real HTTP over an in-memory table filtered by each statement's own WHERE clause. DB-free `unit` lane, asserted in the file itself.
 ├── privacy_matrix.mjs            ← (task 1002973, goal 1000110, privacy spec D2/D3/D4): THE PRIVACY MATRIX as one table — a fixture account per D2 row (provisional, public shown, public hidden, private, private+discoverable, private+discoverable+hidden, opted out of recruiting) × every viewer (Anon, Builder, Recruiter, Self) × every cross-project surface that exists (`/profiles/:handle`, `/me/cross-project`, `/community/search`, `/community/leaderboard`, `/scouting`, `/scouting/:handle`), asserted against a literal transcription of the spec's cells; then the rules swept across EVERY recorded response (hidden numbers reach nobody but Self, private/provisional are absent, private+discoverable is named only by the sliver), the D3 key lists pinned, and an expired invite refused by the real `hasInvitedAccessRequest`. Real routers + real HTTP over in-memory tables filtered by each statement's own WHERE (boolean structure read, calibrated against the JS twins). The declined-invite row is task 1004444's. DB-free `unit` lane, asserted in the file itself.
+├── guild_engagement.mjs          ← (task 1002303, goal 1000110, ADR 0365): a guild engaging a project through each member's own door, DB-free over the real routes — owner-only filing (the owner check inside the INSERT), one identical 404 for an unknown, inactive or non-public project, the inbox read's naming / joined-at rules and exclusions (no client_id out), invite-guild returning hall hand-off links for the PUBLIC roster only (unlisted == unknown), the join's `guild` resolving or 409ing with nothing relayed, no status anywhere. DB-free `unit` lane.
+├── guild_engagement_db.mjs       ← (task 1002303): the same against real Postgres — migration 030 on 025 + 016, cascade on dissolve, SET NULL on the echo, the upsert restarting the 30-day window, a stale row invisible, a later joiner not seeing an invite. INTEGRATION lane; self-skips without a database.
+├── hub_engagement_cards.mjs      ← (task 1002303, ADR 0365): the guild cards in `/projects?view=mine`'s invitations area, EXECUTED by the vm-slice idiom — "G is applying to P — apply with them?" and "P invited G", Apply sending the join with `guild`, the 409 `guild_engagement_gone` line with Apply on my own, rows missing a slug or an http(s) origin dropped, the section showing while either list has a row. DB-free `unit` lane.
 └── public_task_resolver.mjs      ← (#604): the public `/public/tasks/:id` projection — title/value_summary exposed only for shipped|confirmed; withheld for in-flight so unshipped/security task names can't leak.
 ```
 

package/docs/module-api-changelog.md

@@ -2941,5 +2941,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.55 with no explicit bump. run 37249603605. (task 1002620)
   1.21.57 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.56 with no explicit bump. run 37251840378. (task 1002620)
+  1.21.58 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.57 with no explicit bump. run 37257938390. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-inventory.json

@@ -13,7 +13,7 @@
     "pages": 43,
     "surfaces": 3,
     "with_states": 36,
-    "states": 280
+    "states": 286
   },
   "surfaces": [
     {
@@ -1379,6 +1379,8 @@
         "in-unlisted-owner",
         "in-not-member",
         "in-missing",
+        "in-owner-apply",
+        "in-owner-applied",
         "in-profile-band"
       ]
     },
@@ -1465,6 +1467,10 @@
         "in-manage-kind",
         "in-manage-invite",
         "in-manage-invite-handoff",
+        "in-manage-invite-guild",
+        "in-mine-engagements",
+        "in-mine-engagement-note",
+        "in-mine-engagement-applied",
         "in-manage-app-live",
         "in-manage-app-building",
         "in-manage-app-failed",