@bongos/core 1.21.66 → 1.21.67

package/tests/hub_invitations_page.mjs

@@ -0,0 +1,414 @@
+// tests/hub_invitations_page.mjs — the hub's /invitations page (task 1004276; the
+// owner's calls of 2026-09-25, ADR 0337 D5).
+//
+// What asks a builder IN — a project's own invite, a guild's invite, a guild's
+// engagement with a project, a request to join a guild they own — and applying to a
+// project by its address left /projects?view=mine for a page of their own. The
+// cards' behaviour moved with them and stays pinned where it was:
+// tests/hub_engagement_cards.mjs and tests/hub_guild_cards.mjs now read this page.
+// What THIS file pins is the page around them:
+//   • the markup: the hub's bar with Invitations as the one current place, the
+//     signed-out door, the four lists in their order, the empty line, the join field
+//     whose button reads "Apply to join" (the owner's word for the join action)
+//   • the page RUN in a vm: signed out it shows the door and reads nothing; signed in
+//     it reads every list once; the join field applies (a bare host as https, the
+//     note trimmed), says the relay's answer, clears on "requested", and an expired
+//     session offers a way back to THIS page, built from elements
+//   • the route: served on the hub's apex, stamped; never on a child, the builders
+//     host or the status host
+//   • the kit: a states file for the filled page, one for the empty page, a probes file
+//
+// DB-free. Run:  node --test tests/hub_invitations_page.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const PAGE = fs.readFileSync(path.join(LANDING, 'invitations.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = PAGE.split('<script>').pop().split('</script>')[0];
+const STYLE = PAGE.split('<style>')[1].split('</style>')[0].replace(/\/\*[\s\S]*?\*\//g, ''); // minus comments, which name what they rule out
+const MAIN = PAGE.split('<main class="acct" id="invt">')[1].split('</main>')[0];
+
+// ── 1. the markup ────────────────────────────────────────────────────────────
+
+test('the page wears the hub’s bar, with Invitations as the one current place; dark only, no page :root, not indexed', () => {
+  assert.match(PAGE, /<html lang="en" data-mode="dark">/);
+  assert.match(PAGE, /<meta name="robots" content="noindex">/);
+  assert.match(PAGE, /<link rel="stylesheet" href="\/assets\/cosmos\.css">/, 'the rows and cards are cosmos.css’s own rules');
+  assert.match(PAGE, /<script src="\/assets\/hub-bar\.js"><\/script>/, 'the bar runs on the shared asset');
+  assert.doesNotMatch(STYLE, /:root/, 'the pack’s injected theme owns the tokens');
+  assert.deepEqual(PAGE.match(/<a [^>]*aria-current="page"[^>]*>[^<]+/g), ['<a class="bandT" href="/invitations" aria-current="page">Invitations']);
+  assert.match(PAGE, /<a class="skip vh" href="#invt">Skip to content<\/a>/);
+  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?return=\/invitations&amp;repos=1">Sign in<\/a>/);
+  // the footer is the account page's, platform sentence and all: the one apex-only region
+  assert.equal((PAGE.match(/<!--apex-only:start-->/g) || []).length, 1);
+  assert.ok(PAGE.indexOf('<!--apex-only:start-->') > PAGE.indexOf('<footer class="foot">'), 'and it is the footer’s');
+});
+
+test('the body: a door, a loading line, the four lists in order under one heading, the empty line, and the join field', () => {
+  assert.match(MAIN, /<h1>invitations<\/h1>/);
+  assert.match(MAIN, /<section class="aDoor" id="door" hidden aria-labelledby="door-h">[\s\S]*?href="\/api\/bongos\/auth\/web\/start\?return=\/invitations&amp;repos=1"/, 'signed out, the door returns here');
+  assert.match(MAIN, /<p class="loading" id="loading">/);
+  const section = (MAIN.match(/<section id="mineInvites" aria-labelledby="mineInvitesH">[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(section, 'the invitations section ships as markup, never hidden on its own: it is the page');
+  assert.match(section, /<p class="mineEmpty" id="invitesNone" hidden>[^<]+<\/p>/, 'one empty line, down until the reads have answered');
+  const order = ['invitesList', 'guildInviteList', 'engageList', 'guildRequestList'].map((id) => section.indexOf(`<ul class="mineRows" id="${id}"></ul>`));
+  assert.ok(order.every((i) => i > 0), 'each list is real markup the script only fills');
+  assert.deepEqual([...order].sort((a, b) => a - b), order);
+  assert.match(MAIN, /<div class="mineExtra" id="invtBody" hidden>/, 'nothing but the door shows until who is signed in is known');
+  assert.match(MAIN, /<button id="joinBtn" type="button" class="btn small">Apply to join<\/button>/, '"Apply to join", the map card’s word');
+  assert.match(MAIN, /<textarea id="joinNote" class="mineJoinNote" rows="2" maxlength="400"/, 'the applicant note (task 1002330) stays optional and capped');
+  assert.match(MAIN, /its owner sees your application in their own queue/);
+  assert.doesNotMatch(PAGE, /[Rr]equest to join/, 'the join action reads "apply" everywhere');
+});
+
+test('the script builds no markup from strings and never calls the retired accept flip (ADR 0335, 0353)', () => {
+  assert.doesNotMatch(SCRIPT, /innerHTML|insertAdjacentHTML|outerHTML|document\.write/);
+  assert.doesNotMatch(SCRIPT, /invites\/[^'"]*\/accept/);
+  assert.match(SCRIPT, /API \+ '\/my-projects\/invites\/' \+ encodeURIComponent\(inv\.client_id\) \+ '\/decline'/, 'decline only clears the hub’s own row');
+  assert.match(SCRIPT, /open\.textContent = 'Open project →';/, 'an invite is a way INTO the project');
+  assert.doesNotMatch(SCRIPT, /appliedOrigins|mineOrigins|buildingList/, 'no state of /projects came along');
+});
+
+// ── 2. the page, run ─────────────────────────────────────────────────────────
+
+function el(tag) {
+  const n = { tag, children: [], _text: '', className: '', hidden: false, disabled: false, value: '', attrs: {}, _on: {}, parent: null };
+  Object.defineProperty(n, 'textContent', {
+    get() { return n._text + n.children.map((c) => c.textContent).join(''); },
+    set(v) { n._text = String(v); n.children = []; },
+  });
+  n.appendChild = (c) => { c.parent = n; n.children.push(c); return c; };
+  n.remove = () => { if (n.parent) n.parent.children = n.parent.children.filter((c) => c !== n); };
+  n.setAttribute = (k, v) => { n.attrs[k] = String(v); };
+  n.getAttribute = (k) => (k in n.attrs ? n.attrs[k] : null);
+  n.removeAttribute = (k) => { delete n.attrs[k]; };
+  Object.defineProperty(n, 'firstChild', { get() { return n.children[0] || null; } });
+  n.removeChild = (c) => { n.children = n.children.filter((x) => x !== c); return c; };
+  n.querySelectorAll = (sel) => {
+    const m = /^\[(\w[\w-]*)="([^"]*)"\]$/.exec(sel);
+    const out = [];
+    const walk = (x) => { for (const c of x.children) { if (m && c.attrs && c.attrs[m[1]] === m[2]) out.push(c); walk(c); } };
+    walk(n);
+    return out;
+  };
+  n.addEventListener = (t, f) => { (n._on[t] ||= []).push(f); };
+  n.focus = () => { n.focused = true; };
+  n.querySelector = (sel) => {
+    const cls = sel.replace(/^\./, '');
+    const walk = (x) => { for (const c of x.children) { if (String(c.className).split(' ').includes(cls)) return c; const d = walk(c); if (d) return d; } return null; };
+    return walk(n);
+  };
+  return n;
+}
+const settle = async () => { for (let i = 0; i < 40; i++) await Promise.resolve(); };
+const EMPTY = (url) => {
+  if (url.endsWith('/my-projects/invites')) return { ok: true, status: 200, body: { invites: [] } };
+  if (url.endsWith('/me/guild-engagements')) return { ok: true, status: 200, body: { engagements: [] } };
+  if (url.endsWith('/me/guild-requests')) return { ok: true, status: 200, body: { incoming: [], owner_incoming: [] } };
+  return null;
+};
+
+async function boot({ me, answers = [], reads = {}, host = 'cloudbongos.com' } = {}) {
+  const ids = new Map();
+  for (const id of [...PAGE.matchAll(/ id="([^"]+)"/g)].map((m) => m[1])) {
+    const n = el('x');
+    const tag = PAGE.match(new RegExp(`<(\\w+)[^>]* id="${id}"[^>]*>`));
+    n.hidden = !!(tag && / hidden[ >]/.test(tag[0]));
+    ids.set(id, n);
+  }
+  const requests = [];
+  const queued = answers.slice();
+  const fetch = (url, init = {}) => {
+    requests.push({ url, method: init.method || 'GET', body: init.body ? JSON.parse(init.body) : undefined, credentials: init.credentials });
+    const a = EMPTY(url) || reads[url.replace(/^\/api\/bongos/, '')] || queued.shift() || { ok: true, status: 200, body: {} };
+    if (a.reject) return Promise.reject(new Error('offline'));
+    return Promise.resolve({ ok: a.ok, status: a.status, json: () => (a.body === undefined ? Promise.reject(new SyntaxError('no body')) : Promise.resolve(a.body)) });
+  };
+  const document = { activeElement: null, getElementById: (id) => ids.get(id) || null, createElement: el, createTextNode: (t) => ({ tag: '#text', textContent: String(t), children: [] }) };
+  const window = { location: { host }, HubBar: { paint: () => {}, ready: Promise.resolve(me || null) } };
+  const sandbox = { window, document, fetch, console, Promise, JSON, String, Object, Array, URL, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(SCRIPT, sandbox, { filename: 'invitations.html' });
+  await settle();
+  const click = async (b) => { for (const f of b._on.click || []) f({}); await settle(); };
+  const fire = async (n, type, ev = {}) => {
+    if (type === 'focus') document.activeElement = n;
+    if (type === 'blur') document.activeElement = null;
+    const e = { preventDefault() { e.prevented = true; }, ...ev };
+    for (const f of n._on[type] || []) f(e);
+    await settle();
+    return e;
+  };
+  return { ids, requests, click, fire, document, $: (id) => ids.get(id) };
+}
+
+test('signed out: the door, nothing read, no lists', async () => {
+  const ui = await boot({ me: null });
+  assert.equal(ui.$('door').hidden, false);
+  assert.equal(ui.$('invtBody').hidden, true);
+  assert.equal(ui.$('loading').hidden, true);
+  assert.deepEqual(ui.requests, [], 'GET /me is the bar’s; this page asks nothing of a stranger');
+});
+
+test('signed in: the lists show, every one is read once on the cookie session, and with nothing in them the page says so', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' } });
+  assert.equal(ui.$('door').hidden, true);
+  assert.equal(ui.$('invtBody').hidden, false);
+  assert.equal(ui.$('loading').hidden, true);
+  assert.deepEqual(ui.requests.map((r) => `${r.method} ${r.url}`).sort(),
+    ['GET /api/bongos/me/guild-engagements', 'GET /api/bongos/me/guild-requests', 'GET /api/bongos/my-projects/invites']);
+  for (const r of ui.requests) assert.equal(r.credentials, 'same-origin');
+  assert.equal(ui.$('invitesNone').hidden, false, 'every read answered, nothing waiting: one line says so');
+});
+
+test('the join field applies: a bare host as https, the note trimmed, the receipt in the relay’s words, and the fields cleared', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' }, answers: [{ ok: true, status: 200, body: { ok: true, status: 'requested', message: 'Applied. The project’s owner admits new builders; once approved, sign in to enter.' } }] });
+  ui.$('joinOrigin').value = 'grove.cloudbongos.com';
+  ui.$('joinNote').value = '  Happy to start on the docs.  ';
+  const done = ui.click(ui.$('joinBtn'));
+  assert.equal(ui.$('joinStatus').textContent, 'Applying…');
+  await done;
+  const post = ui.requests.find((r) => r.method === 'POST');
+  assert.equal(post.url, '/api/bongos/my-projects/join');
+  assert.equal(post.credentials, 'same-origin');
+  assert.deepEqual(post.body, { origin: 'https://grove.cloudbongos.com', note: 'Happy to start on the docs.' }, 'no guild: the field applies as yourself, alone');
+  assert.equal(ui.$('joinStatus').className, 'projMsg ok');
+  assert.equal(ui.$('joinStatus').textContent, 'Applied. The project’s owner admits new builders; once approved, sign in to enter.');
+  assert.equal(ui.$('joinOrigin').value, '');
+  assert.equal(ui.$('joinNote').value, '');
+  assert.equal(ui.$('joinBtn').disabled, false);
+});
+
+test('the join field: an empty address is a question; a door’s answer is said as its own; an expired session links back HERE; a dead network is said', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' }, answers: [
+    { ok: true, status: 200, body: { ok: true, status: 'invite_only', message: 'This project is invite-only — it doesn’t take requests.' } },
+    { ok: false, status: 401, body: null },
+    { reject: true },
+  ] });
+  await ui.click(ui.$('joinBtn'));
+  assert.equal(ui.$('joinStatus').className, 'projMsg err');
+  assert.equal(ui.$('joinStatus').textContent, 'Pick a project or enter its address.');
+  assert.equal(ui.requests.filter((r) => r.method === 'POST').length, 0);
+
+  ui.$('joinOrigin').value = 'https://grove.cloudbongos.com';
+  await ui.click(ui.$('joinBtn'));
+  assert.equal(ui.$('joinStatus').className, 'projMsg', 'the door’s answer, not an error');
+  assert.match(ui.$('joinStatus').textContent, /invite-only/);
+  assert.equal(ui.$('joinOrigin').value, 'https://grove.cloudbongos.com', 'nothing filed, so nothing cleared');
+
+  await ui.click(ui.$('joinBtn'));
+  const msg = ui.$('joinStatus');
+  assert.equal(msg.className, 'projMsg err');
+  assert.equal(msg.textContent, 'Your session expired — sign in again.');
+  assert.equal(msg.children.find((c) => c.tag === 'a').href, '/api/bongos/auth/web/start?return=/invitations&repos=1');
+
+  await ui.click(ui.$('joinBtn'));
+  assert.equal(msg.textContent, 'Couldn’t reach the platform — check your connection and try again.');
+});
+
+// The project picker (owner ask, 2026-10-06: typing an address is tedious). The
+// map feed and the viewer's memberships, read once on the first focus.
+const FEED = { ok: true, status: 200, body: { projects: [
+  { name: 'Cloud Bongos', origin: 'https://cloudbongos.com', state: 'public', orb: 'planet' },       // the hub itself
+  { name: 'Example World', origin: 'https://example.com', state: 'public', orb: 'planet' },          // builds here
+  { name: 'Demo', origin: 'https://demo.cloudbongos.com', state: 'public', orb: 'planet' },
+  { name: 'The Grove', origin: 'https://grove.cloudbongos.com', state: 'public', orb: 'planet' },
+  { name: 'Tidepool', origin: 'https://tidepool.cloudbongos.com', state: 'public', orb: 'planet' },   // applied
+  { name: null, origin: null, state: 'stealth', orb: 'black-hole' },                                   // anonymous
+] } };
+const MINE = { ok: true, status: 200, body: { owned: [], building: [{ origin: 'https://example.com' }], applied: [{ origin: 'https://tidepool.cloudbongos.com' }] } };
+const optionsOf = (ui) => ui.$('joinList').children.filter((c) => c.attrs.role === 'option');
+
+test('the picker: nothing is read until the field is focused, then the map and the memberships once', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': FEED, '/my-projects': MINE } });
+  const before = ui.requests.length;
+  assert.equal(ui.requests.some((r) => /projects\/featured|\/my-projects$/.test(r.url)), false, 'a visitor who never opens the field never pays for the map');
+  await ui.fire(ui.$('joinOrigin'), 'focus');
+  await ui.fire(ui.$('joinOrigin'), 'input');
+  const reads = ui.requests.slice(before).map((r) => `${r.method} ${r.url}`).sort();
+  assert.deepEqual(reads, ['GET /api/bongos/my-projects', 'GET /api/bongos/projects/featured'], 'each read once, however often the field is used');
+  for (const r of ui.requests.slice(before)) assert.equal(r.credentials, 'same-origin');
+});
+
+test('the picker lists the map minus the hub, an anonymous row and your own projects; one you applied to is Applied and unpickable', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': FEED, '/my-projects': MINE } });
+  await ui.fire(ui.$('joinOrigin'), 'focus');
+  assert.equal(ui.$('joinList').hidden, false);
+  assert.equal(ui.$('joinOrigin').attrs['aria-expanded'], 'true');
+  const opts = optionsOf(ui);
+  assert.deepEqual(opts.map((o) => o.children[0].textContent), ['Demo', 'The Grove', 'Tidepool']);
+  assert.deepEqual(opts.map((o) => o.children[1].textContent), ['demo.cloudbongos.com', 'grove.cloudbongos.com', 'tidepool.cloudbongos.com']);
+  assert.equal(opts[2].attrs['aria-disabled'], 'true');
+  assert.equal(opts[2].children[2].textContent, 'Applied');
+  for (const f of opts[2]._on.mousedown) f({ preventDefault() {} });
+  assert.equal(ui.$('joinOrigin').value, '', 'an Applied row cannot be picked again');
+});
+
+test('the picker narrows by name or address, and the keyboard picks: arrows skip an Applied row, Enter fills the address, Escape closes', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': FEED, '/my-projects': MINE } });
+  const input = ui.$('joinOrigin');
+  await ui.fire(input, 'focus');
+  input.value = 'GROVE';
+  await ui.fire(input, 'input');
+  assert.deepEqual(optionsOf(ui).map((o) => o.children[0].textContent), ['The Grove'], 'a name matches regardless of case');
+  input.value = 'https://demo.cloud';
+  await ui.fire(input, 'input');
+  assert.deepEqual(optionsOf(ui).map((o) => o.children[0].textContent), ['Demo'], 'so does an address, scheme and all');
+  input.value = 'nothing like it';
+  await ui.fire(input, 'input');
+  assert.equal(optionsOf(ui).length, 0);
+  assert.match(ui.$('joinList').textContent, /No project on the map matches\. You can still paste its address\./);
+
+  input.value = '';
+  await ui.fire(input, 'input');
+  await ui.fire(input, 'keydown', { key: 'ArrowUp' });
+  assert.equal(input.attrs['aria-activedescendant'], 'joinOpt1', 'ArrowUp from nothing lands on the last PICKABLE row, past Applied');
+  await ui.fire(input, 'keydown', { key: 'ArrowDown' });
+  assert.equal(input.attrs['aria-activedescendant'], 'joinOpt0', 'and wraps, skipping Applied again');
+  const enter = await ui.fire(input, 'keydown', { key: 'Enter' });
+  assert.ok(enter.prevented);
+  assert.equal(input.value, 'https://demo.cloudbongos.com');
+  assert.equal(ui.$('joinList').hidden, true);
+  assert.equal(input.attrs['aria-expanded'], 'false');
+  assert.equal(ui.requests.some((r) => r.method === 'POST'), false, 'Enter on an option picks it; it does not apply');
+
+  await ui.fire(input, 'keydown', { key: 'ArrowDown' });
+  assert.equal(ui.$('joinList').hidden, false, 'ArrowDown reopens a closed list');
+  await ui.fire(input, 'keydown', { key: 'Escape' });
+  assert.equal(ui.$('joinList').hidden, true);
+});
+
+test('the picker: a full name typed and never picked applies to that project; a failed map read leaves a plain address field', async () => {
+  const ok = { ok: true, status: 200, body: { ok: true, status: 'requested', message: 'Applied.' } };
+  const ui = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': FEED, '/my-projects': MINE }, answers: [ok] });
+  const input = ui.$('joinOrigin');
+  await ui.fire(input, 'focus');
+  input.value = 'the grove';
+  await ui.click(ui.$('joinBtn'));
+  assert.deepEqual(ui.requests.find((r) => r.method === 'POST').body, { origin: 'https://grove.cloudbongos.com' });
+  await ui.fire(input, 'focus');
+  assert.equal(optionsOf(ui).find((o) => o.children[0].textContent === 'The Grove').attrs['aria-disabled'], 'true', 'just applied: the list says so at once');
+
+  const down = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': { ok: false, status: 503, body: {} } }, answers: [ok] });
+  await down.fire(down.$('joinOrigin'), 'focus');
+  assert.equal(down.$('joinList').hidden, true, 'no map, no list: the field is the address field it always was');
+  down.$('joinOrigin').value = 'grove.cloudbongos.com';
+  await down.click(down.$('joinBtn'));
+  assert.deepEqual(down.requests.find((r) => r.method === 'POST').body, { origin: 'https://grove.cloudbongos.com' });
+});
+
+// The relay exists twice: here, and in projects.html for the map card's Apply to join,
+// which also keeps the map's Applied echo. A page cannot import a page's script, so
+// the copies are held to ONE wire shape instead: both are run and must send the same
+// request and read a 401 the same way. A change to one that the other misses fails here.
+test('the join relay here and the map card’s copy in projects.html send the same request and read a 401 the same way', async () => {
+  const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+  const relayOf = (src) => {
+    const at = src.indexOf('function postJoinRequest(');
+    assert.ok(at > 0, 'postJoinRequest is findable');
+    return src.slice(at, src.indexOf('\n  }', at) + 4);
+  };
+  const run = async (src, answer, args) => {
+    const sent = [];
+    const sandbox = {
+      API: '/api/bongos', JSON, Promise, String,
+      appliedOrigins: {}, hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/\/.*$/, '').toLowerCase(),
+      jsonOrEmpty: (res) => res.json().catch(() => ({})),
+      fetch: (url, init) => { sent.push({ url, ...init, body: JSON.parse(init.body) }); return Promise.resolve({ ok: answer.status < 300, status: answer.status, json: () => Promise.resolve(answer.body) }); },
+    };
+    vm.createContext(sandbox);
+    vm.runInContext(relayOf(src), sandbox);
+    const out = await sandbox.postJoinRequest(...args);
+    // each copy builds its objects in its own vm realm; compare what they SAY, not their prototypes
+    return JSON.parse(JSON.stringify({ sent, out }));
+  };
+  const cases = [
+    [{ status: 200, body: { status: 'requested', message: 'Applied.' } }, ['https://grove.example.com', 'hello', null]],
+    [{ status: 200, body: { status: 'requested' } }, ['https://grove.example.com', null, 'forge-crew']],
+    [{ status: 401, body: null }, ['https://grove.example.com', null, null]],
+    [{ status: 409, body: { error: { code: 'guild_engagement_gone' } } }, ['https://grove.example.com', 'n', 'forge-crew']],
+  ];
+  for (const [answer, args] of cases) {
+    const here = await run(SCRIPT, answer, args);
+    const map = await run(HUB, answer, args);
+    assert.deepEqual(here.sent, map.sent, `the same request for ${JSON.stringify(args)}`);
+    assert.deepEqual(here.out, map.out, `the same reading of a ${answer.status}`);
+  }
+});
+
+test('the picker is a labelled combobox over a listbox, its options built from elements', () => {
+  assert.match(MAIN, /<label class="vh" for="joinOrigin">Project name or address<\/label>/);
+  assert.match(MAIN, /<input id="joinOrigin" type="text" inputmode="url" [^>]*role="combobox" aria-autocomplete="list" aria-expanded="false" aria-controls="joinList">/);
+  assert.match(MAIN, /<ul id="joinList" class="joinList" role="listbox" aria-label="Projects on the map" hidden><\/ul>/);
+  assert.match(SCRIPT, /li\.addEventListener\('mousedown', function \(ev\) \{ ev\.preventDefault\(\); choose\(p\); \}\);/, 'mousedown, so the pick lands before the blur closes the list');
+});
+
+// ── 3. the route ─────────────────────────────────────────────────────────────
+
+const { buildPlatformApp } = require('../src/platform-server.js');
+const modules = require('../src/modules.js');
+let server;
+let port;
+before(async () => {
+  server = http.createServer(buildPlatformApp());
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => {
+  modules.setModuleOverrides({});
+  await new Promise((resolve) => server.close(resolve));
+});
+function get(pathname, host) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname, headers: { Host: host } }, (res) => {
+      let body = '';
+      res.on('data', (c) => (body += c));
+      res.on('end', () => resolve({ status: res.statusCode, body }));
+    }).on('error', reject);
+  });
+}
+
+test('GET /invitations: served on the hub’s apex, stamped; never on a child, the builders host or the status host', async () => {
+  modules.setModuleOverrides({ 'platform-identity': false });
+  const child = await get('/invitations', 'game.test.local');
+  assert.equal(child.status, 404, 'a child instance has none of the routes this page reads, so no page');
+  modules.setModuleOverrides({ 'platform-identity': true });
+  const hub = await get('/invitations', 'game.test.local');
+  assert.equal(hub.status, 200);
+  assert.match(hub.body, /— Invitations<\/title>/);
+  assert.match(hub.body, /window\.__BRANDING__=/);
+  assert.doesNotMatch(hub.body, /\{\{[a-zA-Z]+\}\}/);
+  assert.match(hub.body, /\/assets\/hub-bar\.js\?v=[0-9a-f]{8}/, 'the shared bar asset is content-stamped');
+  for (const host of ['builders.test.local', 'status.test.local']) {
+    const other = await get('/invitations', host);
+    assert.doesNotMatch(other.body, /— Invitations<\/title>/, `${host} must not serve /invitations`);
+  }
+});
+
+// ── 4. the kit ───────────────────────────────────────────────────────────────
+
+test('the kit renders the filled page, the empty page and the door, and probes the join field', () => {
+  const read = (f) => JSON.parse(fs.readFileSync(path.join(LANDING, f), 'utf8'));
+  const states = read('invitations.states.json');
+  assert.equal(states.page, '/invitations');
+  assert.deepEqual(states.modes, ['dark']);
+  for (const s of ['out', 'in', 'in-join-applied', 'in-profile']) assert.ok(states.states[s], `kit state ${s}`);
+  const empty = read('invitations-empty.states.json');
+  assert.ok(empty.states['in-empty'] && empty.stub.fixtures['my-projects__invites'] === 'my-projects-invites-empty');
+  for (const f of Object.values(empty.stub.fixtures)) {
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', f + '.json')), `fixture ${f}`);
+  }
+  const probes = read('invitations.probes.json').probes.map((p) => p.name);
+  assert.ok(probes.some((n) => /signed out/.test(n)) && probes.some((n) => /applied for as https/.test(n)));
+  const hubStates = read('projects.states.json').states;
+  assert.ok(!Object.keys(hubStates).some((k) => /^in-mine-(engage|guild)/.test(k)), 'the cards’ states moved with the cards');
+});

package/tests/join_relay_outcome.mjs

@@ -17,7 +17,7 @@ test('a filed request (2xx) is "requested"', () => {
   for (const s of [200, 201]) {
     const o = joinRelayOutcome(s, { ok: true });
     assert.equal(o.status, 'requested');
-    assert.match(o.message, /Requested access/);
+    assert.match(o.message, /^Applied\./, 'the receipt reads "applied", the word on every Apply to join button (task 1004276)');
   }
 });
 

package/tests/landing_legal_pages.mjs

@@ -171,7 +171,8 @@ for (const p of PAGES) {
       '<div class="menuBand" id="menuProjects" data-menu="projects" hidden>',
       '<div class="menuBand" id="menuProfile" data-menu="profile" hidden>',
       '<div class="bandIn bandProfile">',
-      '<!--apex-only:start--><li class="bandCell"><a class="bandT" href="/account">Account</a></li><!--apex-only:end-->',
+      // Invitations and Account are one apex-only region: both pages exist only on the hub (task 1004276)
+      '<!--apex-only:start--><li class="bandCell"><a class="bandT" href="/invitations">Invitations</a></li><li class="bandCell"><a class="bandT" href="/account">Account</a></li><!--apex-only:end-->',
       '<li class="bandCell"><a class="bandT signout" href="/api/bongos/auth/logout">Sign out</a></li>',
     ]) {
       assert.ok(HUB.includes(piece), `projects.html no longer carries: ${piece}`);
@@ -192,13 +193,13 @@ for (const p of PAGES) {
       ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
     ], 'this page has no views of its own, so every item names /projects in full');
     assert.deepEqual(bandLinks(bandOf(html, 'menuProfile')), [
-      ['My projects', '/projects?view=mine'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
+      ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
     ]);
     assert.doesNotMatch(chrome(html), /aria-current/, 'no band item is this page');
     const child = stripApexOnly(html, false);
     assert.deepEqual(bandLinks(bandOf(child, 'menuProfile')), [
       ['My projects', '/projects?view=mine'], ['Sign out', '/api/bongos/auth/logout'],
-    ], 'a child instance has no account page, so it loses the item whole');
+    ], 'a child instance has no account or invitations page, so it loses both items whole');
   });
 
   test(`${p.file}: the bar is not restyled, and its script is the shared asset`, () => {
@@ -211,7 +212,7 @@ for (const p of PAGES) {
   });
 }
 
-test('the three doors and the account page carry one bar: identical but for the sign-in return and the current place', () => {
+test('the three doors, the account page and the invitations page carry one bar: identical but for the sign-in return and the current place', () => {
   const norm = (html, route) => chrome(html)
     .replace(`return=${route}&amp;`, 'return=ROUTE&amp;')
     .replace(/href="#\w+">Skip to content/, 'href="#MAIN">Skip to content')
@@ -221,7 +222,8 @@ test('the three doors and the account page carry one bar: identical but for the
   const doors = PAGES.map((p) => norm(read(p.file), p.route));
   assert.equal(doors[1], doors[0], 'terms.html and privacy.html');
   assert.equal(doors[2], doors[0], 'contact.html and privacy.html');
-  assert.equal(norm(ACCOUNT, '/account'), doors[0], 'account.html and the doors: one bar, so a change to it is a change to all four');
+  assert.equal(norm(ACCOUNT, '/account'), doors[0], 'account.html and the doors: one bar, so a change to it is a change to all five');
+  assert.equal(norm(read('invitations.html'), '/invitations'), doors[0], 'invitations.html too (task 1004276)');
 });
 
 test('cosmos.css still carries the bar and the bands the doors lean on', () => {
@@ -343,7 +345,7 @@ for (const p of PAGES) {
       assert.equal(dom.els.get('who').getAttribute('aria-label'), 'Account, octocat');
       for (const id of ['whoImg', 'bandWhoImg']) assert.equal(dom.els.get(id).src, 'https://avatars.example/u/1');
       assert.equal(dom.els.get('mineCell').hidden, false);
-      assert.deepEqual(dom.band('menuProfile').items.map((i) => i.text), hub ? ['My projects', 'Account', 'Sign out'] : ['My projects', 'Sign out']);
+      assert.deepEqual(dom.band('menuProfile').items.map((i) => i.text), hub ? ['My projects', 'Invitations', 'Account', 'Sign out'] : ['My projects', 'Sign out']);
     });
   }
 

package/tests/landing_page.mjs

@@ -35,6 +35,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
+import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
@@ -566,15 +567,16 @@ test('the Projects band deep-links the hub\'s views; About and Docs are footer l
   assert.doesNotMatch(body.split('<main')[0], /aria-current/, 'the landing is none of those views');
   // the profile band: the person, My projects, Account, Sign out as the honest anchor.
   // Account fills the slot that waited for a settings page (task 1004259) and is
-  // apex-only, because /account is served only where platform-identity runs.
+  // apex-only, because /account is served only where platform-identity runs; so is
+  // Invitations, in the same region, for /invitations (task 1004276).
   assert.match(body, /<div class="menuBand" id="menuProfile" data-menu="profile" hidden>/);
   assert.match(body, /<p class="bandWho" id="bandWho"><\/p>/);
   assert.match(body, /<a class="bandT" href="\/projects\?view=mine">My projects<\/a>/);
-  assert.match(body, /<!--apex-only:start--><li class="bandCell"><a class="bandT" href="\/account">Account<\/a><\/li><!--apex-only:end-->/);
+  assert.match(body, /<!--apex-only:start--><li class="bandCell"><a class="bandT" href="\/invitations">Invitations<\/a><\/li><li class="bandCell"><a class="bandT" href="\/account">Account<\/a><\/li><!--apex-only:end-->/);
   assert.doesNotMatch(body, /class="bandSlot"/, 'the slot is filled, not kept beside its item');
   assert.match(body, /<a class="bandT signout" href="\/api\/bongos\/auth\/logout">Sign out<\/a>/);
   // a crawler reads every destination without scripting on
-  for (const copy of ['Sky', 'Table', 'Your projects', 'New project', 'About', 'Docs', 'My projects', 'Account', 'Sign out']) {
+  for (const copy of ['Sky', 'Table', 'Your projects', 'New project', 'About', 'Docs', 'My projects', 'Invitations', 'Account', 'Sign out']) {
     assert.ok(body.includes('>' + copy + '<'), `"${copy}" is only reachable with scripting on`);
   }
   // the menu container is .menuBand: .band is this page's own content sections
@@ -614,3 +616,123 @@ test('the retired gate assets (world/assets/clouds|creatures|plates) are gone
   // the chrome landing's own plates (task 1003298) live at assets/world/ and are untouched by this cleanup
   assert.ok(fs.existsSync(path.join(LANDING, 'assets', 'world', 'r2-bongos-chrome-b.jpg')), 'the chrome plate at assets/world/ is untouched (task 1003649 converts it separately)');
 });
+
+// ── the CLI download (task 1004257) ─────────────────────────────────────────
+// A door that only exists where a release does: /downloads/bongos/* mounts only when the
+// instance has config/bongos-cli.json, and cloudbongos.com had none when this shipped, so a
+// baked link would have been a door to a 404. The block is markup, hidden, and the release
+// feed is what opens it. The platform pick is RUN below in a vm, not read.
+
+const CLOSE = HTML.replace(/\r\n/g, '\n').split('<section class="band close">')[1].split('</section>')[0];
+const CODE_LF = CODE.replace(/\r\n/g, '\n');
+const CLI_JS = CODE_LF.slice(CODE_LF.indexOf('var CLI_NAMES'), CODE_LF.indexOf('box.hidden = false;\n  });') + 'box.hidden = false;\n  });'.length);
+
+test('the CLI block is markup in the closing band, hidden, with a door that has no target until the feed names one', () => {
+  assert.match(CLOSE, /<div class="cli" data-cli hidden>/, 'baked hidden: no release, no door');
+  const get = CLOSE.match(/<a class="door door--solo" data-cli-get([^>]*)>/);
+  assert.ok(get, 'the download door is a door');
+  assert.doesNotMatch(get[1], /href=/, 'no baked href: the page cannot know the release or the platform');
+  assert.match(get[1], /aria-describedby="cliFor"/, 'the door is described by the platform and version it picked');
+  assert.match(CLOSE, /<p class="label" id="cliFor" data-cli-for><\/p>/);
+  assert.match(CLOSE, /<p class="cliAlso" data-cli-also><\/p>/);
+  assert.ok(CLOSE.indexOf('data-cli') > CLOSE.indexOf('class="doorbar"'), 'it sits under the two doors, never beside them');
+  assert.doesNotMatch(HTML.split('<section class="hero">')[1].split('</section>')[0], /data-cli/, 'the hero keeps its two doors');
+  // [hidden] loses to any display rule on the element, so the container must carry none
+  assert.doesNotMatch(PAGE_CSS, /\n\.cli\{[^}]*display/, '.cli sets no display, or [hidden] stops hiding it');
+  assert.match(PAGE_CSS, /\.cliAlso a\{display:inline-block;min-height:24px;/, 'the platform links clear the 24px floor');
+});
+
+test('the CLI feed is the apex release redirect, and every link stays on this origin', () => {
+  assert.ok(CODE.includes("json('/downloads/bongos/latest.json')"), 'the page reads the release feed');
+  assert.match(CLI_JS, /get\.href = '\/downloads\/bongos\/' \+ pick;/);
+  assert.match(CLI_JS, /a\.href = '\/downloads\/bongos\/' \+ k;/);
+  assert.doesNotMatch(CLI_JS, /\.url\b/, 'never the release asset URL: the redirect is how a release bump stays one config file');
+  assert.doesNotMatch(CLI_JS, /innerHTML/);
+});
+
+// run the region in a vm over a DOM stub: the release feed in, the block's state out
+function cliRun({ feed, nav }) {
+  const el = (tag) => ({
+    tag, href: null, hidden: false, textContent: '', children: [], removed: false,
+    appendChild(c) { this.children.push(c); return c; },
+    remove() { this.removed = true; },
+  });
+  const get = el('a');
+  const forEl = el('p');
+  const also = el('p');
+  const box = el('div');
+  box.hidden = true;
+  box.querySelector = (s) => ({ '[data-cli-get]': get, '[data-cli-for]': forEl, '[data-cli-also]': also })[s];
+  let pending;
+  const sandbox = {
+    navigator: nav,
+    document: {
+      querySelector: (s) => (s === '[data-cli]' ? box : null),
+      createElement: el,
+      createTextNode: (t) => ({ tag: '#text', textContent: t }),
+    },
+    json: (url) => { assert.equal(url, '/downloads/bongos/latest.json'); pending = Promise.resolve(feed); return pending; },
+  };
+  vm.runInNewContext(CLI_JS + '\nthis.cliTarget = cliTarget;', sandbox);
+  return pending.then(() => ({ box, get, forEl, also, cliTarget: sandbox.cliTarget }));
+}
+const RELEASE = JSON.parse(fs.readFileSync(path.join(ROOT, 'modules', 'ui-design', 'kit', 'fixtures', 'bongos-cli-latest-sample.json'), 'utf8'));
+const MAC = { userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.6668.89 Safari/537.36', platform: 'MacIntel', maxTouchPoints: 0 };
+const IPHONE = { userAgent: 'Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1', platform: 'iPhone', maxTouchPoints: 5 };
+
+test('with a release, a Mac gets the Apple-silicon door and every other platform beside it', async () => {
+  const r = await cliRun({ feed: RELEASE, nav: MAC });
+  assert.equal(r.box.hidden, false);
+  assert.equal(r.get.removed, false);
+  assert.equal(r.get.href, '/downloads/bongos/mac-arm64');
+  assert.equal(r.forEl.textContent, 'macOS, Apple silicon · v0.4.2');
+  assert.equal(r.also.children[0].textContent, 'Also for');
+  assert.deepEqual(r.also.children.slice(1).map((a) => [a.href, a.textContent]), [
+    ['/downloads/bongos/mac-x64', 'macOS, Intel'],
+    ['/downloads/bongos/linux-x64', 'Linux, x64'],
+    ['/downloads/bongos/linux-arm64', 'Linux, ARM64'],
+    ['/downloads/bongos/win-x64', 'Windows'],
+  ]);
+});
+
+test('a phone gets no guess: no door, the whole list', async () => {
+  const r = await cliRun({ feed: RELEASE, nav: IPHONE });
+  assert.equal(r.box.hidden, false);
+  assert.equal(r.get.removed, true, 'a CLI cannot run on the device that is looking');
+  assert.equal(r.forEl.textContent, 'Download the CLI · v0.4.2');
+  assert.equal(r.also.children[0].textContent, 'For');
+  assert.equal(r.also.children.length, 6);
+});
+
+test('no release (the feed 404s, or answers nothing usable) leaves the block hidden', async () => {
+  for (const feed of [null, {}, { version: '1.0.0' }, { version: '1.0.0', assets: {} }, { assets: 'x' }]) {
+    const r = await cliRun({ feed, nav: MAC });
+    assert.equal(r.box.hidden, true, JSON.stringify(feed));
+    assert.equal(r.get.href, null);
+  }
+});
+
+test('a target key that is not a plain slug never becomes a link; a malformed version is dropped', async () => {
+  const feed = { version: '1.0.0<b>', assets: { '../../etc': {}, 'javascript:x': {}, 'Mac-ARM64': {}, 'linux-x64': {} } };
+  const r = await cliRun({ feed, nav: MAC });
+  assert.equal(r.get.removed, true, 'no Mac build in this release, so no door for a Mac');
+  assert.equal(r.forEl.textContent, 'Download the CLI');
+  assert.deepEqual(r.also.children.slice(1).map((a) => a.href), ['/downloads/bongos/linux-x64']);
+});
+
+test('the platform pick', async () => {
+  const { cliTarget } = await cliRun({ feed: null, nav: MAC });
+  const all = ['mac-arm64', 'mac-x64', 'linux-x64', 'linux-arm64', 'win-x64'];
+  const ua = (s, extra) => Object.assign({ userAgent: s, platform: '', maxTouchPoints: 0 }, extra);
+  assert.equal(cliTarget(MAC, all), 'mac-arm64', 'a Mac: Apple silicon, since a user agent cannot say');
+  assert.equal(cliTarget(MAC, ['mac-x64', 'linux-x64']), 'mac-x64', 'a release with only the Intel build still serves a Mac');
+  assert.equal(cliTarget(ua('Mozilla/5.0 (Windows NT 10.0; Win64; x64)', { platform: 'Win32' }), all), 'win-x64');
+  assert.equal(cliTarget(ua('Mozilla/5.0 (X11; Linux x86_64)', { platform: 'Linux x86_64' }), all), 'linux-x64');
+  assert.equal(cliTarget(ua('Mozilla/5.0 (X11; Linux aarch64)', { platform: 'Linux aarch64' }), all), 'linux-arm64');
+  assert.equal(cliTarget(ua('Mozilla/5.0 (X11; CrOS x86_64 14541.0.0)'), all), 'linux-x64', 'ChromeOS runs the Linux build');
+  assert.equal(cliTarget(ua('x', { userAgentData: { platform: 'macOS', mobile: false } }), all), 'mac-arm64', 'client hints are read first');
+  assert.equal(cliTarget(ua('Mozilla/5.0 (Linux; Android 14; Pixel 8) Mobile', { platform: 'Linux armv8l' }), all), null, 'Android says Linux and is not');
+  assert.equal(cliTarget(IPHONE, all), null);
+  assert.equal(cliTarget(Object.assign({}, MAC, { maxTouchPoints: 5 }), all), null, 'an iPad reports a Mac; touch gives it away');
+  assert.equal(cliTarget(ua('Mozilla/5.0 (Windows NT 10.0; Win64; x64)'), ['mac-arm64']), null, 'nothing built for this platform: no guess');
+});