@bongos/core 1.21.57 → 1.21.59

package/modules/public-landing/public/projects.html

@@ -963,6 +963,11 @@ summary{min-height:24px;padding:3px 0;}
           <section id="mineInvites" hidden aria-labelledby="mineInvitesH">
             <h2 id="mineInvitesH">Invitations</h2>
             <ul class="mineRows" id="invitesList"></ul>
+            <!-- a guild you are in, engaging a project (task 1002303, R27; ADR 0365):
+                 "G is applying to P" and "P invited G", from GET /me/guild-engagements.
+                 Each card's Apply is the ordinary join request with `guild` added, so
+                 you apply as yourself, never as the guild. -->
+            <ul class="mineRows" id="engageList"></ul>
           </section>
 
           <section aria-labelledby="mineBuildingH">
@@ -1281,6 +1286,17 @@ summary{min-height:24px;padding:3px 0;}
           <ul class="suggList" id="mInviteSugg"></ul>
           <ul class="inviteList" id="mInviteList"></ul>
           <div class="projMsg" id="mInviteMsg" role="status" aria-live="polite"></div>
+          <!-- invite a guild (task 1002303, R27; ADR 0365 D3): POST /projects/invite-guild
+               { client_id, guild } records that the project invited the guild and
+               answers one hall hand-off link per member on the guild's public page,
+               drawn as the same lines as a single invite above. -->
+          <p class="finePrint">Or invite a guild, by its name or its /g/ address. Each member gets their own invite, and only the members shown on the guild’s public page are listed.</p>
+          <div class="attach">
+            <label class="vh" for="mInviteGuild">Guild name or address</label>
+            <input type="text" id="mInviteGuild" placeholder="Guild name or /g/ address" autocomplete="off" autocapitalize="off" spellcheck="false" maxlength="200">
+            <button type="button" class="btn small ghost" data-invite-guild="mInvite">Invite the guild</button>
+          </div>
+          <div class="projMsg" id="mInviteGuildMsg" role="status" aria-live="polite"></div>
         </div>
       </div>
 
@@ -3616,10 +3632,9 @@ summary{min-height:24px;padding:3px 0;}
      hub has no accept route at all. Decline still works; it only clears the
      hub's own pending row. */
   function renderInvitesList(invites) {
-    var section = $('mineInvites');
     var ul = $('invitesList');
     ul.textContent = '';
-    if (!invites || !invites.length) { section.hidden = true; return; }
+    if (!invites || !invites.length) { paintInvitesSection(); return; }
     invites.forEach(function (inv) {
       var row = mineRow(inv);
       var hint = mineEl('p', 'mineRow__hint');
@@ -3643,21 +3658,151 @@ summary{min-height:24px;padding:3px 0;}
       decline.addEventListener('click', function () {
         postThenRemoveRow(
           API + '/my-projects/invites/' + encodeURIComponent(inv.client_id) + '/decline', row, decline, null,
-          function () { if (!ul.children.length) section.hidden = true; }
+          paintInvitesSection
         );
       });
       actions.appendChild(decline);
       row.appendChild(actions);
       ul.appendChild(row);
     });
-    section.hidden = false;
+    paintInvitesSection();
+  }
+
+  /* the Invitations section holds two lists — the projects' own invites and the
+     guild cards below — and shows while either has a row */
+  function paintInvitesSection() {
+    $('mineInvites').hidden = !$('invitesList').children.length && !$('engageList').children.length;
   }
 
   function loadInvites() {
-    return fetch(API + '/my-projects/invites', { credentials: 'same-origin' })
-      .then(function (res) { return res.ok ? res.json() : { invites: [] }; })
-      .then(function (d) { renderInvitesList(d.invites || []); })
-      .catch(function () { $('mineInvites').hidden = true; });
+    return Promise.all([
+      fetch(API + '/my-projects/invites', { credentials: 'same-origin' })
+        .then(function (res) { return res.ok ? res.json() : { invites: [] }; })
+        .then(function (d) { renderInvitesList(d.invites || []); })
+        .catch(function () { renderInvitesList([]); }),
+      loadEngagements()
+    ]);
+  }
+
+  /* ── a guild you are in, engaging a project (task 1002303, R27; ADR 0365) ──
+     GET /me/guild-engagements names what the guilds you are in have going: "G is
+     applying to P" (the guild's owner put it forward) and "P invited G" (the
+     project invited the guild; its hall sends each member on the guild's public
+     page their own invite, and the rest of the guild hears it here). The read only
+     names a project that is on the map and public, and leaves out one you already
+     build on, are invited to, or have applied to. Each card's Apply is the SAME
+     relay as everything else in this view — postJoinRequest — with `guild` added:
+     you apply as yourself, never as the guild, with your own note if you like. A
+     guild that no longer holds for you (you left it, or its 30 days ran out) is a
+     409 and nothing is relayed; the card then offers the plain application.
+     textContent / createElement only. Proof: tests/hub_engagement_cards.mjs */
+  var ENGAGE_GONE = 'That guild application has ended — you can still apply on your own.';
+  function engageLine(e) {
+    var g = e.guild.name || e.guild.slug;
+    var p = (e.project && e.project.name) || hostOf(e.project.origin);
+    return e.kind === 'invited' ? p + ' invited ' + g : g + ' is applying to ' + p + ' — apply with them?';
+  }
+  function sessionExpired(el) {
+    el.className = 'projMsg err';
+    el.textContent = 'Your session expired — ';
+    var a = document.createElement('a');
+    a.href = API + '/auth/web/start?return=/projects%3Fview%3Dmine&repos=1';
+    a.textContent = 'sign in again';
+    el.appendChild(a);
+    el.appendChild(document.createTextNode('.'));
+  }
+  function engageRow(e) {
+    var origin = e.project.origin;
+    var slug = e.guild.slug;
+    var row = mineRow({ name: engageLine(e), origin: origin });
+    row.className = 'mineRow engageRow';
+    var main = row.querySelector('.mineRow__main');
+    var hint = mineEl('p', 'mineRow__hint');
+    hint.textContent = 'You apply as yourself — add a note for the owner if you like.';
+    main.appendChild(hint);
+    var note = document.createElement('textarea');
+    note.className = 'mineJoinNote';
+    note.rows = 2;
+    note.maxLength = 400;
+    note.placeholder = 'A note for the owner (optional) — what you’d like to work on, who you are.';
+    note.setAttribute('aria-label', 'A note for the owner (optional)');
+    note.hidden = true;
+    main.appendChild(note);
+    var msg = mineEl('p', 'projMsg');
+    msg.setAttribute('role', 'status');
+    msg.setAttribute('aria-live', 'polite');
+    main.appendChild(msg);
+    var actions = mineEl('div', 'mineRow__actions');
+    var noteBtn = document.createElement('button');
+    noteBtn.type = 'button';
+    noteBtn.className = 'linklike';
+    noteBtn.textContent = 'Add a note';
+    noteBtn.addEventListener('click', function () { note.hidden = false; noteBtn.hidden = true; note.focus(); });
+    var apply = document.createElement('button');
+    apply.type = 'button';
+    apply.className = 'btn small';
+    apply.textContent = 'Apply';
+    /* with the guild until the server says it no longer holds, then on your own */
+    var withGuild = true;
+    function idle() { apply.disabled = false; apply.textContent = withGuild ? 'Apply' : 'Apply on my own'; }
+    apply.addEventListener('click', function () {
+      apply.disabled = true;
+      apply.textContent = 'Applying…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      postJoinRequest(origin, (note.value || '').trim() || null, withGuild ? slug : null).then(function (res) {
+        if (res.unauthenticated) { idle(); sessionExpired(msg); return; }
+        if (res.ok && res.data && res.data.status === 'requested') {
+          /* no longer pressable, so no longer the accent (the One Warm Thing rule) */
+          apply.className = 'btn small ghost';
+          apply.textContent = 'Applied';
+          hint.hidden = true;
+          note.hidden = true;
+          noteBtn.hidden = true;
+          msg.className = 'projMsg ok';
+          msg.textContent = res.data.message || 'Requested.';
+          return;
+        }
+        var err = apiError(res.data, res.status);
+        if (res.status === 409 && err.code === 'guild_engagement_gone') {
+          withGuild = false;
+          idle();
+          msg.textContent = ENGAGE_GONE;
+          return;
+        }
+        idle();
+        /* the relay's own answer (invite_only, already_member …) in its own words */
+        msg.className = 'projMsg' + (res.ok ? '' : ' err');
+        msg.textContent = (res.ok && res.data && res.data.message) || err.message || 'Could not reach that project — try again in a moment.';
+      }).catch(function () {
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t reach the platform — check your connection and try again.';
+      });
+    });
+    actions.appendChild(noteBtn);
+    actions.appendChild(apply);
+    row.appendChild(actions);
+    return row;
+  }
+  /* a row this page cannot act on (an unknown kind, no guild to name, no address
+     to apply to) is dropped rather than drawn as a card whose button fails */
+  function renderEngagements(rows) {
+    var ul = $('engageList');
+    ul.textContent = '';
+    (rows || []).forEach(function (e) {
+      if (!e || (e.kind !== 'apply' && e.kind !== 'invited')) return;
+      if (!e.guild || typeof e.guild.slug !== 'string' || !e.guild.slug) return;
+      if (!e.project || !safeHttpUrl(e.project.origin)) return;
+      ul.appendChild(engageRow(e));
+    });
+    paintInvitesSection();
+  }
+  function loadEngagements() {
+    return fetch(API + '/me/guild-engagements', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : { engagements: [] }; })
+      .then(function (d) { renderEngagements(d.engagements || []); })
+      .catch(function () { renderEngagements([]); });
   }
 
   /* the one relay both the map's per-card Apply (submitApply) and the
@@ -3665,11 +3810,17 @@ summary{min-height:24px;padding:3px 0;}
      the 'requested' echo update kept in ONE place (task 1003774). Keys the
      echo off the server's OWN resolved origin where the response carries one:
      it need not match what the visitor typed byte-for-byte (a trailing
-     slash, a different case) to be the same project the map's catalog names. */
-  function postJoinRequest(origin, note) {
+     slash, a different case) to be the same project the map's catalog names.
+     `guild` (a slug, optional) is a guild card's: the application is still the
+     caller's own, and the hub records which guild they came with (task 1002303,
+     R27; ADR 0365 D1/D2). */
+  function postJoinRequest(origin, note, guild) {
+    var body = { origin: origin };
+    if (note) body.note = note;
+    if (guild) body.guild = guild;
     return fetch(API + '/my-projects/join', {
       method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(note ? { origin: origin, note: note } : { origin: origin }),
+      body: JSON.stringify(body),
     }).then(function (res) {
       if (res.status === 401) return { unauthenticated: true };
       return jsonOrEmpty(res).then(function (data) {
@@ -10296,11 +10447,17 @@ summary{min-height:24px;padding:3px 0;}
      here, because the project notifies the hub (POST /sso/invites/notify).
 
      WHAT IT PUBLISHES OF AN INVITEE is the login the inviter typed and nothing else.
+
+     A GUILD (task 1002303, R27; ADR 0365 D3), on the project's own page only: the
+     inviter names a public guild and POST /projects/invite-guild { client_id, guild }
+     answers one hand-off link per member on the guild's PUBLIC page — the people the
+     inviter could see, and their handle and display name, which that page already
+     shows. They become the same lines, each finished on the hall like any other.
      Proof: ../../../tests/project_invite_ui.mjs ══ */
 
   var INVITE_MOUNTS = {
     wizInvite: { who: 'wizInviteWho', list: 'wizInviteList', msg: 'wizInviteMsg', after: 'doneStepsHead', why: 'wizInviteWhy', sugg: 'wizInviteSugg' },
-    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', after: null, why: 'mInviteWhy', sugg: 'mInviteSugg' }
+    mInvite: { who: 'mInviteWho', list: 'mInviteList', msg: 'mInviteMsg', after: null, why: 'mInviteWhy', sugg: 'mInviteSugg', guild: 'mInviteGuild', guildMsg: 'mInviteGuildMsg' }
   };
   var inviteSlug = {};   /* mount id → the slug it invites to; '' means no step at all */
   var inviteRows = {};   /* mount id → the invites filed on THIS project this session */
@@ -10320,6 +10477,7 @@ summary{min-height:24px;padding:3px 0;}
       inviteRows[id] = [];
       inviteSugg[id] = null;
       inviteSay(id, '', '');
+      inviteSay(id, '', '', false, 'guildMsg');
     }
     var box = $(id);
     if (box) box.hidden = !next;
@@ -10389,14 +10547,15 @@ summary{min-height:24px;padding:3px 0;}
   }
 
   /* One line per name handed to the hall this session: the login the inviter
-     typed, and the link that finishes its invite there. The line says the invite is
+     typed (or, for a guild's member, the display name its public page shows), and
+     the link that finishes its invite there. The line says the invite is
      NOT sent yet, because it is not — the hall's Invite button is what sends it. */
   function renderInviteRows(id) {
     var m = INVITE_MOUNTS[id];
     var list = m && $(m.list);
     if (!list) return;
     list.innerHTML = (inviteRows[id] || []).map(function (r) {
-      return '<li><b>' + esc(r.login) + '</b><small>not sent yet — finish it on your project’s hall.</small>'
+      return '<li><b>' + esc(r.name || r.login) + '</b><small>not sent yet — finish it on your project’s hall.</small>'
         + '<a class="btn small" href="' + esc(r.url) + '" target="_blank" rel="noopener">Send the invite →</a></li>';
     }).join('');
     /* the two lists are one answer: a name that just became a pending row is no
@@ -10404,9 +10563,10 @@ summary{min-height:24px;padding:3px 0;}
     renderInviteSugg(id);
   }
 
-  function inviteSay(id, text, cls, isHtml) {
+  /* `key` names the line: the mount's message (the default) or the guild row's */
+  function inviteSay(id, text, cls, isHtml, key) {
     var m = INVITE_MOUNTS[id];
-    var el = m && $(m.msg);
+    var el = m && m[key || 'msg'] ? $(m[key || 'msg']) : null;
     if (!el) return;
     el.className = 'projMsg' + (cls ? ' ' + cls : '');
     if (isHtml) el.innerHTML = text; else el.textContent = text;
@@ -10461,6 +10621,73 @@ summary{min-height:24px;padding:3px 0;}
     });
   }
 
+  /* inviteGuildSlug(raw) — a guild named the ways a person pastes one: its name in
+     the address ("forge-crew"), "/g/forge-crew", or the guild page's whole address.
+     PURE. Anything else is sent as typed, and the route answers for it. */
+  function inviteGuildSlug(raw) {
+    var s = String(raw == null ? '' : raw).replace(/^\s+|\s+$/g, '');
+    var m = /(?:^|\/)g\/([^\/?#\s]+)\/?(?:[?#].*)?$/i.exec(s);
+    if (m) {
+      s = m[1];
+      try { s = decodeURIComponent(s); } catch (e) { /* sent as typed */ }
+    }
+    return s.toLowerCase();
+  }
+
+  /* doInviteGuild(id) — one public guild, one request: a pending line per member on
+     its public page, each finished on the hall like a single invite. The route
+     records that the project invited the guild and sends nothing, and nor does
+     this. Only a mount that names a guild field has this control. */
+  function doInviteGuild(id) {
+    var m = INVITE_MOUNTS[id];
+    var slug = inviteSlug[id] || '';
+    if (!m || !m.guild || !slug || inviteBusy[id]) return;
+    var field = $(m.guild);
+    var guild = inviteGuildSlug(field && field.value);
+    if (!guild) {
+      inviteSay(id, 'Type the guild’s name or its /g/ address.', 'err', false, 'guildMsg');
+      if (field && field.focus) field.focus();
+      return;
+    }
+    inviteBusy[id] = true;
+    inviteSay(id, 'Finding the guild’s members…', '', false, 'guildMsg');
+    fetch(API + '/projects/invite-guild', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ client_id: slug, guild: guild })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        inviteBusy[id] = false;
+        if (res.status === 401) { inviteSay(id, signInAgain(), 'err', true, 'guildMsg'); return; }
+        var g = res.ok && data && data.guild;
+        if (g) {
+          /* a member already on a line (the same guild twice) is not drawn again */
+          var listed = 0;
+          (data.invites || []).forEach(function (r) {
+            var url = r ? safeHttpUrl(r.invite_url) : '';
+            if (!url || !r.handle) return;
+            listed++;
+            if ((inviteRows[id] || []).some(function (x) { return x.url === url; })) return;
+            inviteRows[id] = (inviteRows[id] || []).concat([{ login: String(r.handle), name: r.display_name ? String(r.display_name) : '', url: url }]);
+          });
+          renderInviteRows(id);
+          if (field) field.value = '';
+          var name = g.name || guild;
+          inviteSay(id, listed
+            ? name + ': ' + listed + (listed === 1 ? ' member' : ' members') + ' to invite. Send each invite from your project’s hall — every line above opens it with their name filled in.'
+            : 'Nobody is listed on ' + name + '’s public page yet, so there is no one to invite from here.', listed ? 'ok' : '', false, 'guildMsg');
+          return;
+        }
+        var e = apiError(data, res.status);
+        /* an unknown guild and an unlisted one are one answer on the server */
+        if (res.status === 404 && e.code === 'guild_not_found') { inviteSay(id, 'No public guild at that name.', 'err', false, 'guildMsg'); return; }
+        inviteSay(id, inviteRefusal(e.code, res.status, e.message), 'err', false, 'guildMsg');
+      });
+    }).catch(function () {
+      inviteBusy[id] = false;
+      inviteSay(id, 'Couldn’t reach the platform — check your connection and try again.', 'err', false, 'guildMsg');
+    });
+  }
+
   /* skipInvite(id) — the step steps aside having sent NOTHING. Focus moves on
      rather than being stranded inside the box that just went away. */
   function skipInvite(id) {
@@ -10479,6 +10706,7 @@ summary{min-height:24px;padding:3px 0;}
     var box = $(id);
     if (box) {
       box.addEventListener('click', function (ev) {
+        if (ev.target.closest && ev.target.closest('[data-invite-guild]')) { doInviteGuild(id); return; }
         var t = ev.target.closest && ev.target.closest('[data-invite-send],[data-invite-skip],[data-invite-pick]');
         if (!t) return;
         /* a picked suggestion fills the field and takes the SAME path as a typed
@@ -10501,6 +10729,14 @@ summary{min-height:24px;padding:3px 0;}
         doInvite(id);
       });
     }
+    var guildField = INVITE_MOUNTS[id].guild ? $(INVITE_MOUNTS[id].guild) : null;
+    if (guildField) {
+      guildField.addEventListener('keydown', function (ev) {
+        if (ev.key !== 'Enter') return;
+        ev.preventDefault();
+        doInviteGuild(id);
+      });
+    }
   });
 
   /* ── boot: who am I → my instances ────────────────────────────────────── */

package/modules/public-landing/public/projects.probes.json

@@ -175,6 +175,31 @@
       "expect": {"visible":["#panel-fork",".doorPill","#wizDemo","#wizStart"]} },
     { "name": "the wizard driver at 390: the review rows stack and the walk still reaches Create", "auth": true, "width": 390, "url": "/projects?view=new",
       "steps": [["wait",600],["click","#termsAck"],["wait",100],["click","#wizStart"],["wait",400],["fill","#newName","Mercury"],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-what button[type=submit]"],["wait",400],["select","#physCountry","US"],["wait",100],["click","[data-phys=\"builder_geography\"][data-val=\"global\"]"],["click","[data-phys=\"minors_on_board\"][data-val=\"false\"]"],["click","[data-phys=\"entity\"][data-val=\"intent-solo\"]"],["click","#physNext"],["wait",700],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#reviewRows .setRow[data-row=\"address\"] [data-row-chg]"],["wait",200],["click","#reviewGo"],["wait",500]],
-      "expect": {"visible":["#panel-look","#wizLook","#doCreate"],"hidden":["#panel-review"],"text":[["#look-h","Give it a look."]]} }
+      "expect": {"visible":["#panel-look","#wizLook","#doCreate"],"hidden":["#panel-review"],"text":[["#look-h","Give it a look."]]} },
+    { "name": "guild cards (task 1002303, R27): the mine view lists what your guilds have going, each card with its own Apply", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": { "visible": ["#mineInvites", "#engageList"], "count": [["#engageList .engageRow", 2], ["#engageList .engageRow .mineJoinNote:not([hidden])", 0]],
+        "text": [["#engageList .engageRow:nth-child(1) .mineRow__name", "Forge Crew is applying to Tidepool — apply with them?"], ["#engageList .engageRow:nth-child(2) .mineRow__name", "Lantern Works invited Forge Crew"]] } },
+    { "name": "guild cards: Add a note opens the card's own note; Apply sends it with the guild (the stub refuses a guild with no engagement) and the card says it went through", "continue": true,
+      "steps": [["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","Happy to take the migrations."],["click","#engageList .engageRow:first-child .btn"],["wait",400]],
+      "expect": { "hidden": ["#engageList .engageRow:first-child .mineJoinNote"], "hasClass": [["#engageList .engageRow:first-child .projMsg", "ok"]],
+        "text": [["#engageList .engageRow:first-child .btn", "Applied"], ["#engageList .engageRow:first-child .projMsg", "Requested access. The project’s owner admits new builders; once approved, sign in to enter."]] } },
+    { "name": "guild cards: the invited card applies on its own, with no note", "continue": true,
+      "steps": [["click","#engageList .engageRow:nth-child(2) .btn"],["wait",400]],
+      "expect": { "text": [["#engageList .engageRow:nth-child(2) .btn", "Applied"]], "hasClass": [["#engageList .engageRow:nth-child(2) .projMsg", "ok"]] } },
+    { "name": "invite a guild (task 1002303, R27): a /g/ address gives one pending line per member on its public page, each a link to the hall", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
+      "steps": [["wait",900],["fill","#mInviteGuild","/g/forge-crew"],["click","#mInvite [data-invite-guild]"],["wait",400]],
+      "expect": { "count": [["#mInviteList li", 4]], "value": [["#mInviteGuild", ""]],
+        "href": [["#mInviteList li:first-child a", "https://mercury.example.test/builders/watch?invite=mara-quinn"]],
+        "text": [["#mInviteGuildMsg", "Forge Crew: 4 members to invite. Send each invite from your project’s hall — every line above opens it with their name filled in."]] } },
+    { "name": "invite a guild: the same guild again draws no second line", "continue": true,
+      "steps": [["fill","#mInviteGuild","forge-crew"],["click","#mInvite [data-invite-guild]"],["wait",400]],
+      "expect": { "count": [["#mInviteList li", 4]] } },
+    { "name": "invite a guild: an unlisted guild is the same one line as an unknown one", "continue": true,
+      "steps": [["fill","#mInviteGuild","night-shift"],["click","#mInvite [data-invite-guild]"],["wait",400]],
+      "expect": { "text": [["#mInviteGuildMsg", "No public guild at that name."]], "hasClass": [["#mInviteGuildMsg", "err"]], "count": [["#mInviteList li", 4]], "value": [["#mInviteGuild", "night-shift"]] } },
+    { "name": "invite a guild: an empty field is a question, not a request; Enter in the field sends too", "continue": true,
+      "steps": [["fill","#mInviteGuild",""],["focus","#mInviteGuild"],["press","Enter"],["wait",150]],
+      "expect": { "text": [["#mInviteGuildMsg", "Type the guild’s name or its /g/ address."]], "activeId": "mInviteGuild" } }
   ]
 }

package/modules/public-landing/public/projects.states.json

@@ -26,6 +26,10 @@
     "in-manage-kind": { "auth": true, "url": "/projects?view=manage&id=101", "expect": {"visible":["#mKind","#mKindPick .modBand","#mKindWhat summary"],"count":[["#mKindPick .modOpt",5],["#mKindPick .modOpt[aria-pressed=\"true\"]",0]],"text":[["#mKindPick .modOpt b","Game"],["#mKindPick .finePrint","This project has never said what kind it is. Saying so puts the word beside its name wherever it is listed; it changes nothing else."]]} },
     "in-manage-invite": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mInvite", "#mInvite h2", "#mInviteWho", "#mInvite [data-invite-send]"] } },
     "in-manage-invite-handoff": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["fill","#mInviteWho","octo-builder"],["click","#mInvite [data-invite-send]"],["wait",400]], "expect": {"visible":["#mInviteList a","#mInviteMsg"],"hidden":[]} },
+    "in-manage-invite-guild": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["fill","#mInviteGuild","https://cloudbongos.com/g/forge-crew"],["click","#mInvite [data-invite-guild]"],["wait",400]], "expect": { "visible": ["#mInviteGuild", "#mInviteList a", "#mInviteGuildMsg"], "count": [["#mInviteList li", 4]], "value": [["#mInviteGuild", ""]], "hasClass": [["#mInviteGuildMsg", "ok"]], "text": [["#mInviteList li:first-child b", "Mara Quinn"], ["#mInviteGuildMsg", "Forge Crew: 4 members to invite. Send each invite from your project’s hall — every line above opens it with their name filled in."]] } },
+    "in-mine-engagements": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["focus","#engageList .engageRow:first-child .btn"],["wait",200]], "expect": { "visible": ["#mineInvites", "#invitesList", "#engageList"], "count": [["#engageList .engageRow", 2], ["#engageList .engageRow .mineJoinNote:not([hidden])", 0]], "text": [["#engageList .engageRow:nth-child(1) .mineRow__name", "Forge Crew is applying to Tidepool — apply with them?"], ["#engageList .engageRow:nth-child(1) .mineRow__host", "tidepool.cloudbongos.com"], ["#engageList .engageRow:nth-child(2) .mineRow__name", "Lantern Works invited Forge Crew"], ["#engageList .engageRow:nth-child(1) .mineRow__hint", "You apply as yourself — add a note for the owner if you like."], ["#engageList .engageRow:nth-child(1) .btn", "Apply"]] } },
+    "in-mine-engagement-note": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["wait",150]], "expect": { "visible": ["#engageList .engageRow:first-child .mineJoinNote"], "hidden": ["#engageList .engageRow:first-child .linklike"], "value": [["#engageList .engageRow:first-child .mineJoinNote", "I like the boring parts too: migrations and the deploy path."]] } },
+    "in-mine-engagement-applied": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["click","#engageList .engageRow:first-child .btn"],["wait",400]], "expect": { "hidden": ["#engageList .engageRow:first-child .mineJoinNote", "#engageList .engageRow:first-child .linklike"], "hasClass": [["#engageList .engageRow:first-child .projMsg", "ok"], ["#engageList .engageRow:first-child .btn", "ghost"]], "text": [["#engageList .engageRow:first-child .btn", "Applied"], ["#engageList .engageRow:first-child .projMsg", "Requested access. The project’s owner admits new builders; once approved, sign in to enter."], ["#engageList .engageRow:nth-child(2) .btn", "Apply"]] } },
     "in-manage-app-live": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStat","#mApp .appVars"],"hidden":[]} },
     "in-manage-app-building": { "auth": true, "url": "/projects?view=manage&id=102", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStages"],"hidden":[]} },
     "in-manage-app-failed": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["focus","#mApp .appRetryBtn"]], "expect": {"visible":["#mAppCard","#mApp p.err","#mApp .appRetryBtn"],"hidden":["#mApp .appRetry"]} },

package/modules/ui-design/kit/fixtures/me__guild-engagements.json

@@ -0,0 +1,7 @@
+{
+  "engagements": [
+    { "guild": { "slug": "forge-crew", "name": "Forge Crew" }, "kind": "apply", "project": { "name": "Tidepool", "origin": "https://tidepool.cloudbongos.com" }, "created_at": "2026-10-03T12:00:00.000Z" },
+    { "guild": { "slug": "forge-crew", "name": "Forge Crew" }, "kind": "invited", "project": { "name": "Lantern Works", "origin": "https://lantern-works.cloudbongos.com" }, "created_at": "2026-10-02T09:30:00.000Z" }
+  ],
+  "count": 2
+}

package/modules/ui-design/kit/serve.js

@@ -111,9 +111,12 @@ const FEEDS = {
 // /founding/genesis and /government/constitution (task 1004423) ship no default file: the
 // genesis home asks for them only in founding mode, so every existing render is unchanged,
 // and the genesis variants point them at their samples.
+// /me/guild-engagements (task 1002303, R27) is the mine view's guild cards: a guild applying
+// to a project, and a project that invited a guild, for the guilds the builder is in.
 const AUTHED = {
   '/my-projects': 'my-projects', '/my-projects/invites': 'my-projects__invites', '/founding/builders': 'founding-builders',
   '/founding/genesis': 'founding-genesis', '/government/constitution': 'government-constitution',
+  '/me/guild-engagements': 'me__guild-engagements',
 };
 const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' } };
 
@@ -474,6 +477,47 @@ function guildMembershipPatch(res, slug, body) {
   return json(res, 200, { shown_publicly: g.members.you.shown_publicly, counted_in_totals: g.members.you.counted_in_totals });
 }
 
+// Guild engagements (task 1002303, R27; ADR 0365). The stub mirrors the routes' refusals so
+// a probe cannot pass on a body or a caller the server would refuse:
+//   POST /guilds/:slug/engagements { origin }  the owner files "this guild is applying to P":
+//     a non-member's 404, a member's owner-only 403, and ONE 404 for a project that is
+//     unknown or not (on the map AND public) — here, a featured-feed row whose orb is a planet;
+//   POST /projects/invite-guild { client_id, guild }  one hall hand-off link per member on the
+//     guild's PUBLIC roster; an unknown or unlisted guild is one 404;
+//   POST /my-projects/join's optional `guild` must name a held guild the builder is in with a
+//     held engagement (me__guild-engagements.json) for that project, else 409 and nothing relayed.
+const UNKNOWN_PROJECT = { error: { code: 'unknown_project', message: 'unknown_project' } };
+const sameOrigin = (a, b) => String(a || '').trim().toLowerCase().replace(/\/+$/, '') === String(b || '').trim().toLowerCase().replace(/\/+$/, '');
+function heldFixture(name) {
+  return JSON.parse(fs.readFileSync(path.join(FIXTURES, (ALIAS[name] || name) + '.json'), 'utf8'));
+}
+function guildEngagementPost(res, slug, body) {
+  const g = guildsHeld()[String(slug).toLowerCase()];
+  if (!g || !g.members) return json(res, 404, GUILD_NOT_FOUND);
+  if (g.members.you.membership_kind !== 'owner') return refuse(res, 403, 'guild_owner_only', 'only the guild owner can do that');
+  const bad = Object.keys(body).find((k) => k !== 'origin');
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (typeof body.origin !== 'string' || !body.origin || body.origin.length > 300) return refuse(res, 400, 'validation_failed', 'origin must be a string');
+  const p = (heldFixture('featured').projects || []).find((x) => x.orb === 'planet' && sameOrigin(x.origin, body.origin));
+  if (!p) return json(res, 404, UNKNOWN_PROJECT);
+  return json(res, 200, { engagement: { guild: { slug: g.members.guild.slug, name: g.members.guild.name }, kind: 'apply', project: { name: p.name, origin: p.origin }, created_at: new Date().toISOString() } });
+}
+function guildInvitePost(res, body) {
+  const bad = Object.keys(body).find((k) => !['client_id', 'guild'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (typeof body.client_id !== 'string' || !body.client_id) return refuse(res, 400, 'validation_failed', 'client_id must be a string');
+  if (typeof body.guild !== 'string' || !body.guild || body.guild.length > 39) return refuse(res, 400, 'validation_failed', 'guild must be a string of at most 39 characters');
+  const g = guildsHeld()[body.guild.toLowerCase()];
+  if (!g || !g.public) return json(res, 404, GUILD_NOT_FOUND);
+  const invites = (g.public.members || []).map((m) => ({ handle: m.handle, display_name: m.display_name || null, invite_url: 'https://mercury.example.test/builders/watch?invite=' + encodeURIComponent(m.handle) }));
+  return json(res, 200, { invited: false, guild: { slug: g.public.guild.slug, name: g.public.guild.name }, invites, count: invites.length });
+}
+function guildEngagementLive(slug, origin) {
+  const g = typeof slug === 'string' && guildsHeld()[slug.toLowerCase()];
+  if (!g || !g.members) return false;
+  return (heldFixture('me__guild-engagements').engagements || []).some((e) => e.guild && e.guild.slug === slug.toLowerCase() && e.project && sameOrigin(e.project.origin, origin));
+}
+
 const server = http.createServer((req, res) => {
   const u = new URL(req.url, 'http://x');
   const p = u.pathname;
@@ -491,10 +535,11 @@ const server = http.createServer((req, res) => {
     if (rest === '/me/cross-project' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => crossProjectPatch(res, body)) : json(res, 401, UNAUTH);
     if (rest === '/me/profile' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => profilePatch(res, body)) : json(res, 401, UNAUTH);
     if (rest === '/me/handle' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => handlePatch(res, body)) : json(res, 401, UNAUTH);
-    const guild = rest.match(/^\/guilds\/([^/]+)(\/members|\/membership)?$/);
+    const guild = rest.match(/^\/guilds\/([^/]+)(\/members|\/membership|\/engagements)?$/);
     if (guild && !guild[2] && req.method === 'GET') return guildRead(res, guild[1], 'public', origin);
     if (guild && guild[2] === '/members' && req.method === 'GET') return AUTH ? guildRead(res, guild[1], 'members', origin) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
+    if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
     // the planet-physics questions' pre-create check (task 1004418): nothing stops here —
     // the kit carries no screen. Of the soft-limit table it mirrors only the three hide
@@ -533,10 +578,13 @@ const server = http.createServer((req, res) => {
     // decline receipts a real render or probe of the my-projects block drives,
     // so those buttons are not stuck picturing only their failure branch.
     if (rest === '/my-projects/join' && req.method === 'POST') {
-      return AUTH ? readBody(req, (body) => json(res, 200, {
-        ok: true, status: 'requested', project: { name: body.origin || 'a project', origin: body.origin || null },
-        message: 'Requested access. The project’s owner admits new builders; once approved, sign in to enter.',
-      })) : json(res, 401, UNAUTH);
+      return AUTH ? readBody(req, (body) => {
+        if (body.guild !== undefined && !guildEngagementLive(body.guild, body.origin)) return refuse(res, 409, 'guild_engagement_gone', 'that guild engagement has ended');
+        return json(res, 200, {
+          ok: true, status: 'requested', project: { name: body.origin || 'a project', origin: body.origin || null },
+          message: 'Requested access. The project’s owner admits new builders; once approved, sign in to enter.',
+        });
+      }) : json(res, 401, UNAUTH);
     }
     if (/^\/my-projects\/[^/]+\/leave$/.test(rest) && req.method === 'POST') return AUTH ? json(res, 200, { ok: true, left: true }) : json(res, 401, UNAUTH);
     if (/^\/my-projects\/invites\/[^/]+\/decline$/.test(rest) && req.method === 'POST') return AUTH ? json(res, 200, { ok: true, accepted: false }) : json(res, 401, UNAUTH);
@@ -549,6 +597,7 @@ const server = http.createServer((req, res) => {
         invite_url: 'https://mercury.example.test/builders/watch?invite=' + encodeURIComponent(body.github_login || ''),
       })) : json(res, 401, UNAUTH);
     }
+    if (rest === '/projects/invite-guild' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildInvitePost(res, body)) : json(res, 401, UNAUTH);
     // the manage flows (task 1003345): every door on a row and on the manage page only ASKS
     // (ADR 0111) — the stub answers each ask with the route's receipt so the probes can drive
     // attach / restart / teardown / revive / join end to end; nothing changes in the fixture

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.57",
+  "version": "1.21.59",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.57",
+      "version": "1.21.59",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.57",
+  "version": "1.21.59",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9114,5 +9114,17 @@
       "id": "1002301",
       "text": "Guilds now have their own page on cloudbongos.com — who is in it and what it has shipped together — and members can choose whether they appear on it and count toward its totals."
     }
+  ],
+  "1.21.58": [
+    {
+      "id": "1002303",
+      "text": "Guilds can now put themselves forward for a project, and a project can invite a whole guild — but every member still applies or accepts as themselves, so nobody joins a project without their own say."
+    }
+  ],
+  "1.21.59": [
+    {
+      "id": "1004552",
+      "text": "The Goals and Tasks pages now open on the version the project owner has starred on the Roadmap. With no star, they show every version as before."
+    }
   ]
 }

package/scripts/gds/run-unit-tests.js

@@ -183,6 +183,11 @@ const INTEGRATION = new Set([
   // proves the one-owner partial index, the expiry CTE drained before its insert,
   // the cascade on dissolve and the two-statement transfer.
   'guilds_db',
+  // task 1002303 (R27): guild engagements against real SQL — the FK that cascades
+  // a dissolved guild's engagements and the one that SETs NULL on the echo, the
+  // upsert restarting the 30-day window in place, and the joined_at rule. The
+  // DB-free sibling (guild_engagement) pins the routes and statement shapes.
+  'guild_engagement_db',
   // task 1002302 (R26): a guild's weekly rounded totals against real SQL. Who is
   // counted (three predicates and a FILTERed k count) and the upsert's week guard,
   // re-evaluated against a racing writer's committed row, are planner facts; the

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.57'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.59'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');