@bongos/core 1.21.62 → 1.21.63

package/modules/platform-identity/guilds.js

@@ -647,6 +647,37 @@ async function listGuildRequests({ guildId, ownerGithubId }, { pool = defaultPoo
   return { incoming, outgoing };
 }
 
+// The join requests waiting on the caller as an OWNER, across every guild they
+// own, in ONE statement (task 1004583): the hub's Invitations reads this rather
+// than one queue per owned guild. listGuildRequests' request leg keyed on the
+// caller instead of one guild — a requester floors on consent alone, the owner
+// test re-asserted per row — and its seen_at stamp. Each row names its guild.
+async function listOwnedRequests({ githubId }, { pool = defaultPool } = {}) {
+  const { rows } = await pool.query(
+    `SELECT r.id::text AS id, r.created_at, r.seen_at, g.slug, g.name, ${PERSON_COLUMNS}
+       FROM platform_identity_guild_requests r
+       JOIN platform_identity_guilds g ON g.id = r.guild_id
+       JOIN platform_identity_accounts pa ON pa.github_id = r.github_id
+      WHERE r.kind = 'request' AND r.status = 'pending'
+        AND r.created_at > now() - make_interval(days => $2::int)
+        AND ${ownerExistsSql('r.guild_id', '$1')}
+        AND ${accountActiveSql('pa')}
+      ORDER BY r.created_at DESC, r.id DESC
+      LIMIT $3`,
+    [githubId, REQUEST_EXPIRY_DAYS, LIST_MAX],
+  );
+  const unseen = rows.filter((r) => !r.seen_at).map((r) => r.id);
+  if (unseen.length) {
+    await pool.query(
+      `UPDATE platform_identity_guild_requests r SET seen_at = now()
+        WHERE r.id = ANY($1::bigint[]) AND r.kind = 'request' AND r.seen_at IS NULL
+          AND ${ownerExistsSql('r.guild_id', '$2')}`,
+      [unseen, githubId],
+    );
+  }
+  return rows.map(({ slug, name, ...r }) => ({ ...r, guild: { slug, name } }));
+}
+
 // ---------------------------------------------------------------------------
 // The public read (D4)
 // ---------------------------------------------------------------------------
@@ -707,5 +738,6 @@ module.exports = {
   cancelRequest,
   listMyRequests,
   listGuildRequests,
+  listOwnedRequests,
   getPublicGuild,
 };

package/modules/platform-identity/routes/guilds.js

@@ -12,6 +12,7 @@
 //   POST   /guilds                         create {slug, name, description?, visibility}
 //   GET    /me/guilds                      my guilds, with my own two switches
 //   GET    /me/guild-requests              invites to me (the card) + requests I sent
+//                                           + requests to the guilds I own (owner_incoming)
 //   GET    /guilds/:slug/members           the members' roster (members only; 404 else)
 //   PATCH  /guilds/:slug/membership        my switches {shown_publicly?, counted_in_totals?}
 //   DELETE /guilds/:slug/membership        leave (the owner transfers first, or is last and dissolves)
@@ -154,13 +155,19 @@ module.exports = function guildRoutes() {
   }));
 
   // rank: any-builder — MY queue: invites addressed to me, each carrying the
-  // card (the guild's current visibility, which an accept must echo back), and
-  // the join requests I sent. Stamps seen_at on the invites.
+  // card (the guild's current visibility, which an accept must echo back), the
+  // join requests I sent, and the join requests waiting on me as the owner of a
+  // guild, each naming its guild (task 1004583 — one read for the hub, never one
+  // per owned guild). Stamps seen_at on the invites and on those requests.
   router.get('/me/guild-requests', requireBuilder, handle('GET /me/guild-requests', 'guild_requests_read_failed', async (req, res) => {
     const me = await actingAccount(req.builder);
     if (me.fail) return res.fail(...me.fail);
     const { incoming, outgoing } = await guilds.listMyRequests({ githubId: me.githubId }, { pool });
-    res.json({ incoming, outgoing, incoming_count: incoming.length, outgoing_count: outgoing.length });
+    const ownerIncoming = await guilds.listOwnedRequests({ githubId: me.githubId }, { pool });
+    res.json({
+      incoming, outgoing, owner_incoming: ownerIncoming,
+      incoming_count: incoming.length, outgoing_count: outgoing.length, owner_incoming_count: ownerIncoming.length,
+    });
   }));
 
   // rank: any-builder — the members' roster, for members only (the own-scope

package/modules/public-landing/public/assets/cosmos.css

@@ -1325,13 +1325,39 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .mineJoinRow input::placeholder{color:var(--ink-faint);}
 .mineJoinNote{display:block;width:100%;box-sizing:border-box;margin-top:10px;min-height:64px;padding:12px 16px;font:inherit;font-size:14px;line-height:1.5;color:var(--ink);background:var(--bg-card);border:1px solid var(--ctl-line);border-radius:14px;resize:vertical;}
 .mineJoinNote::placeholder{color:var(--ink-faint);}
-/* the guild cards (task 1002303, R27): a second list under the invitations, one
-   hairline between the two when both have rows; each card's note waits behind
+/* the guild cards (task 1002303, R27): more lists under the invitations, one
+   hairline between any two that have rows; each card's note waits behind
    "Add a note", and its status line takes no room until it has something to say */
-.mineRows:not(:empty)+.mineRows .mineRow:first-child{border-top:1px solid var(--rule-soft);}
+.mineRows:not(:empty)~.mineRows .mineRow:first-child{border-top:1px solid var(--rule-soft);}
 .engageRow .mineJoinNote{max-width:62ch;}
 .engageRow .projMsg{margin-top:6px;min-height:0;}
 .engageRow .projMsg:empty{margin:0;}
+/* a guild's invite to you and a join request to your guild (task 1004583). The
+   invite carries the guild page's counted pair (guild.html's .aOpt voice, set
+   tighter for a row) with the D4.4 notice under it, said before accept. */
+.guildRow .projMsg{margin-top:6px;min-height:0;}
+.guildRow .projMsg:empty{margin:0;}
+/* the invite's buttons sit at its foot, after the notice they answer */
+.guildRow--invite .mineRow__actions{align-self:flex-end;}
+.guildRow__desc{margin:4px 0 0;font-size:14px;line-height:1.5;color:var(--ink-soft);max-width:62ch;}
+.guildCount{display:grid;gap:8px;margin-top:12px;max-width:66ch;}
+.guildCount__label{font-family:var(--label-face);font-size:var(--label-size);letter-spacing:var(--label-space);text-transform:uppercase;color:var(--ink-faint);}
+.guildCount__opts{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,1fr));border-top:1px solid var(--rule);border-bottom:1px solid var(--rule);}
+.guildCount__opt{position:relative;display:block;margin:0;padding:12px 16px 14px;border-left:1px solid var(--rule-soft);cursor:pointer;}
+.guildCount__opt:first-child{border-left:0;padding-left:0;}
+.guildCount__opt input{position:absolute;width:1px;height:1px;margin:0;overflow:hidden;clip-path:inset(50%);}
+.guildCount__opt>span{display:block;font-size:13px;line-height:1.45;color:var(--ink-faint);}
+.guildCount__opt b{display:flex;align-items:center;gap:10px;margin-bottom:4px;font-family:var(--font-body);font-weight:500;font-size:14.5px;color:var(--ink);}
+.guildCount__opt b::before{content:"";width:7px;height:7px;border-radius:50%;border:1px solid var(--rule);background:var(--bg);flex:none;}
+.guildCount__opt:has(input:checked) b::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+.guildCount__opt:focus-within{outline:2px solid var(--accent);outline-offset:3px;}
+.guildCount__opt:has(input:disabled){cursor:default;}
+.guildCount__what{margin:0;font-size:13px;line-height:1.5;color:var(--ink-soft);max-width:70ch;}
+@media (max-width:480px){
+  .guildCount__opts{grid-template-columns:1fr;}
+  .guildCount__opt{padding:10px 0 12px;border-left:0;border-top:1px solid var(--rule-soft);}
+  .guildCount__opt:first-child{border-top:0;}
+}
 
 /* ── the ledger row: planet · name and chip · the facts · the rail · the
    doors. The planet and the doors are fixed widths; the three middle tracks

package/modules/public-landing/public/projects.html

@@ -963,11 +963,18 @@ summary{min-height:24px;padding:3px 0;}
           <section id="mineInvites" hidden aria-labelledby="mineInvitesH">
             <h2 id="mineInvitesH">Invitations</h2>
             <ul class="mineRows" id="invitesList"></ul>
+            <!-- a guild inviting you (task 1004583; ADR 0336 D4 §3, ADR 0337 D4.4):
+                 each card says, BEFORE you accept, that your numbers count toward the
+                 guild's rounded totals, and offers the switch right there. -->
+            <ul class="mineRows" id="guildInviteList"></ul>
             <!-- a guild you are in, engaging a project (task 1002303, R27; ADR 0365):
                  "G is applying to P" and "P invited G", from GET /me/guild-engagements.
                  Each card's Apply is the ordinary join request with `guild` added, so
                  you apply as yourself, never as the guild. -->
             <ul class="mineRows" id="engageList"></ul>
+            <!-- someone asking to join a guild you own (task 1004583): Accept / Decline.
+                 Their own counted switch rode their request, so this card has none. -->
+            <ul class="mineRows" id="guildRequestList"></ul>
           </section>
 
           <section aria-labelledby="mineBuildingH">
@@ -3689,10 +3696,12 @@ summary{min-height:24px;padding:3px 0;}
     paintInvitesSection();
   }
 
-  /* the Invitations section holds two lists — the projects' own invites and the
-     guild cards below — and shows while either has a row */
+  /* the Invitations section holds four lists — the projects' own invites, a
+     guild's invites to you, your guilds' engagements, and the join requests to a
+     guild you own — and shows while any of them has a row */
+  var INVITE_LISTS = ['invitesList', 'guildInviteList', 'engageList', 'guildRequestList'];
   function paintInvitesSection() {
-    $('mineInvites').hidden = !$('invitesList').children.length && !$('engageList').children.length;
+    $('mineInvites').hidden = !INVITE_LISTS.some(function (id) { return $(id).children.length; });
   }
 
   function loadInvites() {
@@ -3701,7 +3710,8 @@ summary{min-height:24px;padding:3px 0;}
         .then(function (res) { return res.ok ? res.json() : { invites: [] }; })
         .then(function (d) { renderInvitesList(d.invites || []); })
         .catch(function () { renderInvitesList([]); }),
-      loadEngagements()
+      loadEngagements(),
+      loadGuildQueue()
     ]);
   }
 
@@ -3826,6 +3836,286 @@ summary{min-height:24px;padding:3px 0;}
       .catch(function () { renderEngagements([]); });
   }
 
+  /* ── a guild inviting you, and a join request to a guild you own (task 1004583;
+     ADR 0336 D3/D4 §3, ADR 0337 D4.4) ──
+     GET /me/guild-requests names the invites addressed to you, each carrying its
+     card: the guild's name, description and CURRENT visibility. Accept echoes back
+     the visibility this card showed — the consent is to what the card said, so a
+     guild that changed since is a 409 and the card re-draws for a fresh decision —
+     and the counted_in_totals choice made on the card. The D4.4 notice is said for
+     the choice as it stands, BEFORE accept, in guild.html's own words (the test
+     holds the two pages to one sentence). The guilds you OWN answer their join
+     requests here too, from the same read's owner_incoming — one request for
+     every guild you own, never one per guild. The requester's own switch rode
+     their request, so the owner's card has none. A decline is silent on both sides (204, the other side is never
+     told). textContent / createElement only. Proof: tests/hub_guild_cards.mjs */
+  var GUILD_COUNTED_ON = 'Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. ' +
+    'They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. ' +
+    'Leave them out of any guild you’d rather not share them with.';
+  var GUILD_COUNTED_OFF = 'Your numbers are left out of this guild’s totals, from its next weekly count.';
+  var GUILD_SHOWN = {
+    public: 'It’s public: joining lists your name and picture on its page while your account is public. You can turn that off there.',
+    unlisted: 'It’s unlisted: it has no public page, so joining lists you nowhere.'
+  };
+  var GUILD_OFFLINE = 'Couldn’t reach the platform — check your connection and try again.';
+  /* a POST on the cookie session; a 204 (decline) has no body to read */
+  function guildPost(path, body) {
+    var init = { method: 'POST', credentials: 'same-origin' };
+    if (body) { init.headers = { 'Content-Type': 'application/json' }; init.body = JSON.stringify(body); }
+    return fetch(API + path, init).then(function (res) {
+      return (res.status === 204 ? Promise.resolve({}) : jsonOrEmpty(res)).then(function (data) {
+        return { ok: res.ok, status: res.status, data: data };
+      });
+    });
+  }
+  function guildButton(label, cls) {
+    var b = document.createElement('button');
+    b.type = 'button';
+    b.className = cls;
+    b.textContent = label;
+    return b;
+  }
+  /* the row's status line, quiet until it has something to say */
+  function guildMsg(main) {
+    var msg = mineEl('p', 'projMsg');
+    msg.setAttribute('role', 'status');
+    msg.setAttribute('aria-live', 'polite');
+    main.appendChild(msg);
+    return msg;
+  }
+  /* Decline: silent to the other side. The row goes; a failure keeps it and says so. */
+  function guildDecline(row, id, btns, msg) {
+    btns.forEach(function (b) { b.disabled = true; });
+    msg.className = 'projMsg';
+    msg.textContent = '';
+    guildPost('/guild-requests/' + encodeURIComponent(id) + '/decline').then(function (res) {
+      if (res.ok) { row.remove(); paintInvitesSection(); return; }
+      btns.forEach(function (b) { b.disabled = false; });
+      if (res.status === 401) { sessionExpired(msg); return; }
+      msg.className = 'projMsg err';
+      msg.textContent = res.status === 404 ? 'That has already been answered, or it ran out.' : 'Couldn’t decline just now — try again in a moment.';
+    }).catch(function () {
+      btns.forEach(function (b) { b.disabled = false; });
+      msg.className = 'projMsg err';
+      msg.textContent = GUILD_OFFLINE;
+    });
+  }
+
+  function guildInviteRow(inv) {
+    var name = inv.name || inv.slug;
+    var vis = inv.visibility;
+    var row = mineRow({ name: 'You’re invited to join ' + name });
+    row.className = 'mineRow guildRow guildRow--invite';
+    var main = row.querySelector('.mineRow__main');
+    if (inv.description) {
+      var desc = mineEl('p', 'guildRow__desc');
+      desc.textContent = inv.description;
+      main.appendChild(desc);
+    }
+    var shown = mineEl('p', 'mineRow__hint');
+    main.appendChild(shown);
+    /* the counted switch — the guild page's pair, in its words, defaulting on as
+       the membership does; the notice under it is said for the choice as it stands */
+    var band = mineEl('div', 'guildCount');
+    var label = mineEl('span', 'guildCount__label');
+    label.id = 'guildCount-' + inv.id;
+    label.textContent = 'In this guild’s totals';
+    band.appendChild(label);
+    var group = mineEl('div', 'guildCount__opts');
+    group.setAttribute('role', 'radiogroup');
+    group.setAttribute('aria-labelledby', label.id);
+    var radios = [['on', 'Count my numbers', 'They add to this guild’s totals.'], ['off', 'Leave them out', 'The totals add up everyone else.']].map(function (o) {
+      var opt = mineEl('label', 'guildCount__opt');
+      var input = document.createElement('input');
+      input.type = 'radio';
+      input.name = 'guildCounted-' + inv.id;
+      input.value = o[0];
+      input.checked = o[0] === 'on';
+      var text = mineEl('span');
+      var b = mineEl('b');
+      b.textContent = o[1];
+      text.appendChild(b);
+      text.appendChild(document.createTextNode(o[2]));
+      opt.appendChild(input);
+      opt.appendChild(text);
+      group.appendChild(opt);
+      return input;
+    });
+    band.appendChild(group);
+    var what = mineEl('p', 'guildCount__what');
+    band.appendChild(what);
+    main.appendChild(band);
+    var msg = guildMsg(main);
+    function counted() { return !radios[1].checked; }
+    function paintWhat() { what.textContent = counted() ? GUILD_COUNTED_ON : GUILD_COUNTED_OFF; }
+    radios.forEach(function (r) { r.addEventListener('change', paintWhat); });
+    paintWhat();
+
+    var actions = mineEl('div', 'mineRow__actions');
+    var page = document.createElement('a');
+    page.className = 'linklike';
+    page.href = '/g/' + encodeURIComponent(inv.slug);
+    page.textContent = 'See its page';
+    function paintShown() { shown.textContent = GUILD_SHOWN[vis]; page.hidden = vis !== 'public'; }
+    paintShown();
+    var accept = guildButton('Accept', 'btn small');
+    var decline = guildButton('Decline', 'btn small ghost');
+    function idle() {
+      accept.disabled = false;
+      decline.disabled = false;
+      accept.textContent = 'Accept';
+    }
+    /* an invite that is gone (withdrawn, run out, answered elsewhere) cannot be
+       answered again: say so and leave nothing pressable */
+    function ended() {
+      accept.hidden = true;
+      decline.hidden = true;
+      radios.forEach(function (r) { r.disabled = true; });
+      msg.className = 'projMsg';
+      msg.textContent = 'That invite has ended — it was withdrawn, or it ran out.';
+    }
+    accept.addEventListener('click', function () {
+      var on = counted();
+      accept.disabled = true;
+      decline.disabled = true;
+      accept.textContent = 'Joining…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      guildPost('/guild-requests/' + encodeURIComponent(inv.id) + '/accept', { visibility: vis, counted_in_totals: on }).then(function (res) {
+        if (res.ok) {
+          /* no longer pressable, so no longer the accent (the One Warm Thing rule) */
+          accept.className = 'btn small ghost';
+          accept.textContent = 'Joined';
+          decline.hidden = true;
+          radios.forEach(function (r) { r.disabled = true; });
+          page.hidden = false;
+          msg.className = 'projMsg ok';
+          msg.textContent = 'You’ve joined ' + name + (on ? ', and your numbers count toward its totals.' : ', and your numbers are left out of its totals.');
+          return;
+        }
+        if (res.status === 401) { idle(); sessionExpired(msg); return; }
+        var err = apiError(res.data, res.status);
+        if (res.status === 409 && err.code === 'guild_visibility_changed' && err.details && GUILD_SHOWN[err.details.visibility]) {
+          vis = err.details.visibility;
+          paintShown();
+          idle();
+          msg.className = 'projMsg err';
+          msg.textContent = 'This guild changed since the card was drawn: it’s ' + vis + ' now. Read it again, then accept.';
+          return;
+        }
+        if (res.status === 404) { ended(); return; }
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t accept just now — try again in a moment.';
+      }).catch(function () {
+        idle();
+        msg.className = 'projMsg err';
+        msg.textContent = GUILD_OFFLINE;
+      });
+    });
+    decline.addEventListener('click', function () { guildDecline(row, inv.id, [accept, decline], msg); });
+    actions.appendChild(page);
+    actions.appendChild(accept);
+    actions.appendChild(decline);
+    row.appendChild(actions);
+    return row;
+  }
+  /* a row id is a bigserial (digits, within the bigint range the route checks);
+     a card with no id, no slug or a visibility this page cannot say is dropped
+     rather than drawn with a button that fails */
+  function guildRowId(r) {
+    return !!r && typeof r.id === 'string' && /^\d{1,19}$/.test(r.id) && (r.id.length < 19 || r.id <= '9223372036854775807');
+  }
+  function renderGuildInvites(rows) {
+    var ul = $('guildInviteList');
+    ul.textContent = '';
+    (rows || []).forEach(function (inv) {
+      if (!guildRowId(inv) || typeof inv.slug !== 'string' || !inv.slug || !GUILD_SHOWN[inv.visibility]) return;
+      ul.appendChild(guildInviteRow(inv));
+    });
+    paintInvitesSection();
+  }
+
+  function guildRequestRow(r) {
+    var who = r.display_name || '@' + r.handle;
+    var row = mineRow({ name: who + ' asked to join ' + (r.guild.name || r.guild.slug) });
+    row.className = 'mineRow guildRow';
+    var main = row.querySelector('.mineRow__main');
+    /* the handle under a display name, never twice */
+    if (r.display_name) {
+      var handle = mineEl('span', 'mineRow__host');
+      handle.textContent = '@' + r.handle;
+      main.appendChild(handle);
+    }
+    var hint = mineEl('p', 'mineRow__hint');
+    hint.textContent = 'Accepting makes them a member. A decline is never told to them.';
+    main.appendChild(hint);
+    var msg = guildMsg(main);
+    var actions = mineEl('div', 'mineRow__actions');
+    var accept = guildButton('Accept', 'btn small');
+    var decline = guildButton('Decline', 'btn small ghost');
+    accept.addEventListener('click', function () {
+      accept.disabled = true;
+      decline.disabled = true;
+      accept.textContent = 'Accepting…';
+      msg.className = 'projMsg';
+      msg.textContent = '';
+      guildPost('/guild-requests/' + encodeURIComponent(r.id) + '/accept').then(function (res) {
+        if (res.ok) {
+          accept.className = 'btn small ghost';
+          accept.textContent = 'Accepted';
+          decline.hidden = true;
+          hint.hidden = true;
+          msg.className = 'projMsg ok';
+          msg.textContent = who + ' is in ' + (r.guild.name || r.guild.slug) + ' now.';
+          return;
+        }
+        accept.textContent = 'Accept';
+        if (res.status === 404) {
+          accept.hidden = true;
+          decline.hidden = true;
+          msg.className = 'projMsg';
+          msg.textContent = 'That request has ended — it was withdrawn, it ran out, or their account is closed.';
+          return;
+        }
+        accept.disabled = false;
+        decline.disabled = false;
+        if (res.status === 401) { sessionExpired(msg); return; }
+        msg.className = 'projMsg err';
+        msg.textContent = 'Couldn’t accept just now — try again in a moment.';
+      }).catch(function () {
+        accept.disabled = false;
+        decline.disabled = false;
+        accept.textContent = 'Accept';
+        msg.className = 'projMsg err';
+        msg.textContent = GUILD_OFFLINE;
+      });
+    });
+    decline.addEventListener('click', function () { guildDecline(row, r.id, [accept, decline], msg); });
+    actions.appendChild(accept);
+    actions.appendChild(decline);
+    row.appendChild(actions);
+    return row;
+  }
+  function renderGuildRequests(rows) {
+    var ul = $('guildRequestList');
+    ul.textContent = '';
+    (rows || []).forEach(function (r) {
+      if (!guildRowId(r) || typeof r.handle !== 'string' || !r.handle) return;
+      if (!r.guild || typeof r.guild.slug !== 'string' || !r.guild.slug) return;
+      ul.appendChild(guildRequestRow(r));
+    });
+    paintInvitesSection();
+  }
+  /* ONE read for both lists: the invites to you, and the requests waiting on you
+     as the owner of a guild; a read that fails is silent, as the other lists' are */
+  function loadGuildQueue() {
+    return fetch(API + '/me/guild-requests', { credentials: 'same-origin' })
+      .then(function (res) { return res.ok ? res.json() : {}; })
+      .then(function (d) { renderGuildInvites(d.incoming || []); renderGuildRequests(d.owner_incoming || []); })
+      .catch(function () { renderGuildInvites([]); renderGuildRequests([]); });
+  }
+
   /* the one relay both the map's per-card Apply (submitApply) and the
      address-typed join field drive — POST /my-projects/join, the 401 case and
      the 'requested' echo update kept in ONE place (task 1003774). Keys the

package/modules/public-landing/public/projects.probes.json

@@ -187,6 +187,24 @@
     { "name": "guild cards: the invited card applies on its own, with no note", "continue": true,
       "steps": [["click","#engageList .engageRow:nth-child(2) .btn"],["wait",400]],
       "expect": { "text": [["#engageList .engageRow:nth-child(2) .btn", "Applied"]], "hasClass": [["#engageList .engageRow:nth-child(2) .projMsg", "ok"]] } },
+    {"name": "guild invite cards (task 1004583): each says what joining shows and, before accept, that your numbers count — with the switch right there, set to count", "auth": true, "width": 1440, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": {"visible": ["#guildInviteList", "#guildInviteList .guildRow:first-child .guildCount"], "count": [["#guildInviteList .guildRow", 2], ["#guildInviteList .guildRow:first-child a.linklike:not([hidden])", 1], ["#guildInviteList .guildRow:nth-child(2) a.linklike:not([hidden])", 0]], "text": [["#guildInviteList .guildRow:first-child .mineRow__name", "You’re invited to join Open Hands"], ["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with."]], "checked": "#guildInviteList .guildRow:first-child input[value=\"on\"]"} },
+    {"name": "guild invite: Leave them out says what that means before anything is sent", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"],["wait",150]],
+      "expect": {"checked": "#guildInviteList .guildRow:first-child input[value=\"off\"]", "text": [["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers are left out of this guild’s totals, from its next weekly count."]]} },
+    {"name": "guild invite: Accept sends the card's visibility and the switch (the stub refuses an accept without the card's visibility) and the card says where your numbers went", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:first-child .btn"],["wait",400]],
+      "expect": {"hasClass": [["#guildInviteList .guildRow:first-child .projMsg", "ok"], ["#guildInviteList .guildRow:first-child .btn", "ghost"]], "text": [["#guildInviteList .guildRow:first-child .btn", "Joined"], ["#guildInviteList .guildRow:first-child .projMsg", "You’ve joined Open Hands, and your numbers are left out of its totals."]]} },
+    {"name": "guild invite: Decline drops the card, silently", "continue": true,
+      "steps": [["click","#guildInviteList .guildRow:nth-child(2) .btn.ghost"],["wait",400]],
+      "expect": {"count": [["#guildInviteList .guildRow", 1]]} },
+    {"name": "join request (task 1004583): the owner of Night Shift accepts one and declines the other, from the hub", "continue": true,
+      "steps": [["click","#guildRequestList .guildRow:first-child .btn"],["wait",400],["click","#guildRequestList .guildRow:nth-child(2) .btn.ghost"],["wait",400]],
+      "expect": {"count": [["#guildRequestList .guildRow", 1]], "hasClass": [["#guildRequestList .guildRow:first-child .projMsg", "ok"]], "text": [["#guildRequestList .guildRow:first-child .btn", "Accepted"], ["#guildRequestList .guildRow:first-child .projMsg", "Tomás Ek is in Night Shift now."]]} },
+    {"name": "guild cards at 320: the switch stacks and nothing scrolls sideways", "auth": true, "width": 320, "url": "/projects?view=mine",
+      "steps": [["wait",900]],
+      "expect": {"noOverflow": true, "visible": ["#guildInviteList .guildRow:first-child .guildCount"]} },
     { "name": "invite a guild (task 1002303, R27): a /g/ address gives one pending line per member on its public page, each a link to the hall", "auth": true, "width": 1440, "url": "/projects?view=manage&id=101",
       "steps": [["wait",900],["fill","#mInviteGuild","/g/forge-crew"],["click","#mInvite [data-invite-guild]"],["wait",400]],
       "expect": { "count": [["#mInviteList li", 4]], "value": [["#mInviteGuild", ""]],

package/modules/public-landing/public/projects.states.json

@@ -30,6 +30,9 @@
     "in-mine-engagements": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["focus","#engageList .engageRow:first-child .btn"],["wait",200]], "expect": { "visible": ["#mineInvites", "#invitesList", "#engageList"], "count": [["#engageList .engageRow", 2], ["#engageList .engageRow .mineJoinNote:not([hidden])", 0]], "text": [["#engageList .engageRow:nth-child(1) .mineRow__name", "Forge Crew is applying to Tidepool — apply with them?"], ["#engageList .engageRow:nth-child(1) .mineRow__host", "tidepool.cloudbongos.com"], ["#engageList .engageRow:nth-child(2) .mineRow__name", "Lantern Works invited Forge Crew"], ["#engageList .engageRow:nth-child(1) .mineRow__hint", "You apply as yourself — add a note for the owner if you like."], ["#engageList .engageRow:nth-child(1) .btn", "Apply"]] } },
     "in-mine-engagement-note": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["wait",150]], "expect": { "visible": ["#engageList .engageRow:first-child .mineJoinNote"], "hidden": ["#engageList .engageRow:first-child .linklike"], "value": [["#engageList .engageRow:first-child .mineJoinNote", "I like the boring parts too: migrations and the deploy path."]] } },
     "in-mine-engagement-applied": { "auth": true, "url": "/projects?view=mine", "actions": [["wait",900],["click","#engageList .engageRow:first-child .linklike"],["fill","#engageList .engageRow:first-child .mineJoinNote","I like the boring parts too: migrations and the deploy path."],["click","#engageList .engageRow:first-child .btn"],["wait",400]], "expect": { "hidden": ["#engageList .engageRow:first-child .mineJoinNote", "#engageList .engageRow:first-child .linklike"], "hasClass": [["#engageList .engageRow:first-child .projMsg", "ok"], ["#engageList .engageRow:first-child .btn", "ghost"]], "text": [["#engageList .engageRow:first-child .btn", "Applied"], ["#engageList .engageRow:first-child .projMsg", "Requested access. The project’s owner admits new builders; once approved, sign in to enter."], ["#engageList .engageRow:nth-child(2) .btn", "Apply"]] } },
+    "in-mine-guild-cards": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["focus", "#guildInviteList .guildRow:first-child .btn"], ["wait", 200]], "expect": {"visible": ["#mineInvites", "#guildInviteList", "#guildRequestList", "#guildInviteList .guildRow:first-child .guildCount"], "count": [["#guildInviteList .guildRow", 2], ["#guildRequestList .guildRow", 2], ["#guildInviteList .guildRow .guildCount", 2], ["#guildRequestList .guildRow .guildCount", 0]], "text": [["#guildInviteList .guildRow:nth-child(1) .mineRow__name", "You’re invited to join Open Hands"], ["#guildInviteList .guildRow:nth-child(2) .mineRow__name", "You’re invited to join Quiet Room"], ["#guildInviteList .guildRow:nth-child(1) .guildCount__what", "Your numbers count toward this guild’s rounded totals — even while your record is hidden or your account is private. They are never shown on their own: only inside totals rounded down to a band (10+, 20+, 50+ …) and counted once a week. Leave them out of any guild you’d rather not share them with."], ["#guildRequestList .guildRow:nth-child(1) .mineRow__name", "Tomás Ek asked to join Night Shift"], ["#guildRequestList .guildRow:nth-child(2) .mineRow__name", "@kai-lowe asked to join Night Shift"]], "checked": "#guildInviteList .guildRow:first-child input[value=\"on\"]"}},
+    "in-mine-guild-count-off": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["click", "#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"], ["wait", 150]], "expect": {"checked": "#guildInviteList .guildRow:first-child input[value=\"off\"]", "text": [["#guildInviteList .guildRow:first-child .guildCount__what", "Your numbers are left out of this guild’s totals, from its next weekly count."], ["#guildInviteList .guildRow:first-child .btn", "Accept"]]}},
+    "in-mine-guild-joined": {"auth": true, "url": "/projects?view=mine", "actions": [["wait", 900], ["click", "#guildInviteList .guildRow:first-child .guildCount__opt:nth-child(2)"], ["click", "#guildInviteList .guildRow:first-child .btn"], ["wait", 400]], "expect": {"hidden": ["#guildInviteList .guildRow:first-child .btn.ghost + .btn"], "hasClass": [["#guildInviteList .guildRow:first-child .projMsg", "ok"], ["#guildInviteList .guildRow:first-child .btn", "ghost"]], "text": [["#guildInviteList .guildRow:first-child .btn", "Joined"], ["#guildInviteList .guildRow:first-child .projMsg", "You’ve joined Open Hands, and your numbers are left out of its totals."]]}},
     "in-manage-app-live": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStat","#mApp .appVars"],"hidden":[]} },
     "in-manage-app-building": { "auth": true, "url": "/projects?view=manage&id=102", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStages"],"hidden":[]} },
     "in-manage-app-failed": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["focus","#mApp .appRetryBtn"]], "expect": {"visible":["#mAppCard","#mApp p.err","#mApp .appRetryBtn"],"hidden":["#mApp .appRetry"]} },

package/modules/ui-design/kit/fixtures/guilds.json

@@ -51,6 +51,13 @@
         { "handle": "sol-reyes", "display_name": "Sol Reyes", "avatar_url": null, "membership_kind": "member" }
       ],
       "count": 3
+    },
+    "requests": {
+      "incoming": [
+        { "id": "601", "created_at": "2026-10-04T19:20:00.000Z", "seen_at": null, "handle": "tomas-ek", "display_name": "Tomás Ek", "avatar_url": null },
+        { "id": "602", "created_at": "2026-10-02T11:05:00.000Z", "seen_at": null, "handle": "kai-lowe", "display_name": null, "avatar_url": null }
+      ],
+      "outgoing": []
     }
   },
   "open-hands": {

package/modules/ui-design/kit/fixtures/me__guild-requests.json

@@ -0,0 +1,9 @@
+{
+  "incoming": [
+    { "id": "501", "created_at": "2026-10-04T15:10:00.000Z", "seen_at": null, "slug": "open-hands", "name": "Open Hands", "description": "A newer guild for first-time builders. Ask anything.", "visibility": "public" },
+    { "id": "502", "created_at": "2026-10-03T08:45:00.000Z", "seen_at": "2026-10-03T09:00:00.000Z", "slug": "quiet-room", "name": "Quiet Room", "description": "", "visibility": "unlisted" }
+  ],
+  "outgoing": [],
+  "incoming_count": 2,
+  "outgoing_count": 0
+}

package/modules/ui-design/kit/serve.js

@@ -512,6 +512,44 @@ function guildInvitePost(res, body) {
   const invites = (g.public.members || []).map((m) => ({ handle: m.handle, display_name: m.display_name || null, invite_url: 'https://mercury.example.test/builders/watch?invite=' + encodeURIComponent(m.handle) }));
   return json(res, 200, { invited: false, guild: { slug: g.public.guild.slug, name: g.public.guild.name }, invites, count: invites.length });
 }
+// The guild cards in the mine view's invitations (task 1004583): GET /me/guild-requests is
+// the invites to the builder (me__guild-requests.json, each card with the guild's CURRENT
+// visibility) plus `owner_incoming`, the join requests to every held guild they own (its
+// `requests` in guilds.json), each naming its guild — one read, as the route answers it. The
+// stub mirrors the routes' refusals: an invitee's accept must echo the card's visibility (400
+// without one, 409 with the guild's current one when it differs), only `visibility` and
+// `counted_in_totals` are taken, a row the caller may not answer is one 404, and a decline is
+// a SILENT 204. Nothing is written: a reload draws the same cards, as the join relay's
+// 'requested' does.
+function ownedRequests() {
+  return Object.values(guildsHeld()).filter((g) => g.members && g.members.you.membership_kind === 'owner')
+    .flatMap((g) => ((g.requests && g.requests.incoming) || []).map((r) => ({ ...r, guild: { slug: g.members.guild.slug, name: g.members.guild.name } })));
+}
+function myGuildRequests(res) {
+  const q = heldFixture('me__guild-requests');
+  const owner = ownedRequests();
+  return json(res, 200, { ...q, owner_incoming: owner, owner_incoming_count: owner.length });
+}
+function guildRequestAnswer(res, id, verb, body) {
+  const notFound = () => refuse(res, 404, 'guild_request_not_found', 'guild_request_not_found');
+  if (!/^\d{1,19}$/.test(id)) return notFound();
+  const bad = Object.keys(body).find((k) => !['visibility', 'counted_in_totals'].includes(k));
+  if (bad) return refuse(res, 400, 'validation_failed', `unknown field: ${bad}`);
+  if (body.visibility !== undefined && !['public', 'unlisted'].includes(body.visibility)) return refuse(res, 400, 'validation_failed', 'visibility must be public or unlisted');
+  if (body.counted_in_totals !== undefined && typeof body.counted_in_totals !== 'boolean') return refuse(res, 400, 'validation_failed', 'counted_in_totals must be a boolean');
+  const invite = (heldFixture('me__guild-requests').incoming || []).find((r) => r.id === id);
+  const request = Object.values(guildsHeld()).some((g) => g.members && g.members.you.membership_kind === 'owner'
+    && ((g.requests && g.requests.incoming) || []).some((r) => r.id === id));
+  if (!invite && !request) return notFound();
+  if (verb === 'decline') { res.writeHead(204, { 'cache-control': 'no-store' }); return res.end(); }
+  if (invite) {
+    if (!body.visibility) return refuse(res, 400, 'guild_card_visibility_required', 'send the visibility your invite card showed');
+    const held = guildsHeld()[invite.slug];
+    const now = (held && held.members && held.members.guild.visibility) || invite.visibility;
+    if (body.visibility !== now) return json(res, 409, { error: { code: 'guild_visibility_changed', message: 'guild_visibility_changed', details: { visibility: now } } });
+  }
+  return json(res, 200, { status: 'accepted' });
+}
 function guildEngagementLive(slug, origin) {
   const g = typeof slug === 'string' && guildsHeld()[slug.toLowerCase()];
   if (!g || !g.members) return false;
@@ -540,6 +578,9 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/members' && req.method === 'GET') return AUTH ? guildRead(res, guild[1], 'members', origin) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/membership' && req.method === 'PATCH') return AUTH ? readBody(req, (body) => guildMembershipPatch(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
+    if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
+    const answer = rest.match(/^\/guild-requests\/([^/]+)\/(accept|decline)$/);
+    if (answer && req.method === 'POST') return AUTH ? readBody(req, (body) => guildRequestAnswer(res, answer[1], answer[2], body)) : json(res, 401, UNAUTH);
     if (rest === '/provisioning/instances' && req.method === 'GET') return AUTH ? instances(res, null, false) : json(res, 401, UNAUTH);
     // the planet-physics questions' pre-create check (task 1004418): nothing stops here —
     // the kit carries no screen. Of the soft-limit table it mirrors only the three hide

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.62",
+  "version": "1.21.63",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.62",
+      "version": "1.21.63",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.62",
+  "version": "1.21.63",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9148,5 +9148,11 @@
       "id": "1004584",
       "text": "Shipping finished tasks now works for projects that install Bongos as a package, so their work lands instead of getting stuck halfway."
     }
+  ],
+  "1.21.63": [
+    {
+      "id": "1004583",
+      "text": "Builders can now accept or decline a guild invite from their projects page, choosing first whether their numbers count toward the guild's totals, and guild owners can answer join requests there too."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.62'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.63'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');