@bongos/core 1.21.68 → 1.21.70

package/scripts/gds/feedback-send.js

@@ -1,40 +1,58 @@
 #!/usr/bin/env node
-// Send feedback about Bongos itself to the Cloud Bongos maintainers (task 1004462).
+// Send feedback about Bongos itself to the Cloud Bongos maintainers (tasks 1004462, 1004591).
 //
 // Usage:
 //   bongos feedback "the claim command hung for two minutes"
 //   bongos feedback --idea "let me filter the task list by goal"
-//   bongos feedback --message-file notes.md
-//   [--json]
+//   bongos feedback --message-file notes.md      (or --message-file - for stdin)
+//   [--wait]   send in the foreground and print the outcome (debugging)
 //
-// Not the /feedback skill, which loads a locally recorded walkthrough into a
-// session. This SENDS: it posts to the builder's OWN project (POST /feedback,
-// src/bongos/routes/feedback.js), which relays it to the hub. A bug lands on the
-// hub as a 'backlog' task in the maintenance goal awaiting a maintainer's nod; an
-// idea lands in the hub's idea inbox. Only the typed text and version stamps
-// travel — never code, a transcript or file contents.
+// Straight to the hub, never through the project: a project with no hub link can
+// still send. The builder's OWN project vouches for who sent it — the CLI asks it
+// for a one-time receipt (src/bongos/routes/feedback.js) and the hub redeems that
+// receipt before filing (modules/platform-identity/instance-feedback.js). So a
+// signed-in builder does nothing extra.
+//
+// Fast and quiet by design (the owner, 2026-10-06): the command prints one line
+// and returns at once; a detached background process does the network. No task
+// number comes back. Only the typed text (secret-scrubbed) and version stamps travel.
 
 'use strict';
 
+const fs = require('node:fs');
 const os = require('node:os');
-const { cliClient, requireSession, argText, hasFlag, errCode, errDetails, cliExit } = require('./cli-lib');
+const path = require('node:path');
+const crypto = require('node:crypto');
+const { spawn } = require('node:child_process');
+const { cliClient, requireSession, loadSessionSync, argText, hasFlag, errCode, cliExit } = require('./cli-lib');
+const ic = require('../../src/instance-config');
 
 const USAGE = [
   'usage:',
   '  bongos feedback "what went wrong"          report a problem with Bongos',
   '  bongos feedback --idea "what you wish for" suggest an improvement',
-  '  bongos feedback --message-file notes.md    send a longer note from a file',
+  '  bongos feedback --message-file notes.md    send a longer note from a file (- for stdin)',
   '',
   'Goes to the Cloud Bongos maintainers. Only the text you type and the Bongos',
   'versions you run are sent — no code, chat or files from your project.',
 ].join('\n');
 
-// The CLI release, as `bongos version` reports it: config/bongos-cli.json where
-// the core checkout carries it (an instance does not — task 1824), else the
-// package version. Read from disk, never required, so a vanilla core still runs.
+const SENT_LINE = 'Sent to the Bongos team.';
+const REPEAT_WINDOW_MS = 6 * 60 * 60 * 1000;
+
+// Plain lines for the refusals the builder can see (everything else happens in
+// the background and is written to the outcome file, never to the terminal).
+const REFUSALS = {
+  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
+  too_long: 'That is too long to send — keep it under 4,000 characters, or split it into two.',
+  local_only: 'This project runs only on your computer, so Cloud Bongos cannot confirm who sent the report. Nothing was sent.',
+  no_scrubber: 'Feedback was not sent: the secret filter that checks every report is missing from this install.',
+};
+
+function stateDir() { return path.join(os.homedir(), '.config', ic.FALLBACK_DIR || 'cloudbongos'); }
+
+// The CLI release, as `bongos version` reports it. Read from disk, never required.
 function cliVersion() {
-  const fs = require('node:fs');
-  const path = require('node:path');
   for (const rel of ['../../config/bongos-cli.json', '../../package.json']) {
     try {
       const f = path.join(__dirname, rel);
@@ -44,17 +62,19 @@ function cliVersion() {
   return null;
 }
 
-// The message: --message / --message-file, else every positional word joined.
-function readMessage(args) {
-  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args);
-  return args.filter((a) => !a.startsWith('--')).join(' ');
+// The message: --message / --message-file (incl. - for stdin), else every
+// positional word joined, else whatever was piped in.
+function readMessage(args, io = {}) {
+  if (args.includes('--message') || args.includes('--message-file')) return argText('--message', args, io).value || '';
+  const words = args.filter((a) => !a.startsWith('--')).join(' ');
+  if (words) return words;
+  const stdinIsPiped = io.stdinIsPiped !== undefined ? io.stdinIsPiped : !process.stdin.isTTY;
+  if (!stdinIsPiped) return '';
+  try { return (io.readStdin || (() => fs.readFileSync(0, 'utf8')))(); } catch { return ''; }
 }
 
 // Every report goes through the transcript-grade secret scrubber before it leaves
-// this machine (task 1004467). An assistant may file unasked when a builder vents,
-// so nobody reviews the text first — the scrubber is the check that does not
-// depend on the assistant's judgment. FAIL CLOSED: no scrubber, nothing is sent.
-// It also strips the builder's environment secrets by value, whatever their shape.
+// this machine (task 1004467). FAIL CLOSED: no scrubber, nothing is sent.
 function scrubReport(message, env = process.env) {
   let scrub;
   try { scrub = require('../../modules/security/secret-scrub.js'); } catch { return null; }
@@ -63,69 +83,122 @@ function scrubReport(message, env = process.env) {
   return { text, removed };
 }
 
-// Plain-language lines for each refusal the route can give.
-const REFUSALS = {
-  message_required: 'Nothing to send — add your feedback after the command, in quotes.',
-  validation_failed: 'That could not be sent as written — keep it under 4,000 characters, or split it into two.',
-  not_hub_connected: 'This project is not connected to Cloud Bongos, so feedback cannot be relayed from here.\n'
-    + 'Report it to the Bongos maintainers on the Bongos core repository instead.',
-  membership_required: 'Cloud Bongos does not yet know you as a member of this project.\n'
-    + 'Sign in to this project once through Cloud Bongos in a browser, then try again.',
-  rate_limited: 'Too much feedback from you or this project in the last hour. Try again later.',
-  feedback_unavailable: 'Cloud Bongos is not taking bug reports right now (no version is being built). Try again later.',
-  hub_unreachable: 'Could not reach Cloud Bongos. Check your connection and try again.',
-};
+// A project the hub cannot reach can never vouch for a report — say so up front
+// rather than send something that is certain to be dropped.
+function isLocalBase(base) {
+  let host;
+  try { host = new URL(base).hostname.toLowerCase(); } catch { return true; }
+  if (require('node:net').isIP(host.replace(/^\[|\]$/g, ''))) return true;
+  return !host.includes('.') || /(^|\.)(localhost|local|internal|test|invalid)$/.test(host);
+}
+
+// Repeat guard: the same report (same first line) inside REPEAT_WINDOW_MS is not
+// sent twice, so an assistant filing on every rant cannot spam the maintainers.
+function repeatKey(message) {
+  const first = String(message).split('\n').map((l) => l.trim().toLowerCase()).find(Boolean) || '';
+  return crypto.createHash('sha256').update(first).digest('hex').slice(0, 16);
+}
+function checkAndRecordRepeat(message, { file = path.join(stateDir(), 'feedback-sent.json'), now = Date.now() } = {}) {
+  let seen = {};
+  try { seen = JSON.parse(fs.readFileSync(file, 'utf8')) || {}; } catch { /* first report */ }
+  for (const [k, t] of Object.entries(seen)) if (!(now - t < REPEAT_WINDOW_MS)) delete seen[k];
+  const key = repeatKey(message);
+  if (Object.prototype.hasOwnProperty.call(seen, key)) return true;
+  seen[key] = now;
+  try {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(seen), { mode: 0o600 });
+  } catch { /* a guard that cannot write still lets the report through */ }
+  return false;
+}
+
+// deliver — the network half: receipt from the project, then the report to the
+// hub. Returns an outcome object; never prints. Runs in the background child.
+async function deliver({ message, kind }, deps = {}) {
+  const api = deps.api || await cliClient();
+  const base = deps.base || ic.resolveApiBase({ session: loadSessionSync() });
+  const doFetch = deps.fetchImpl || fetch;
+  const sha256 = crypto.createHash('sha256').update(message, 'utf8').digest('hex');
+  const r = await api.request('POST', '/feedback/receipt', { body: { sha256, kind } });
+  if (!r.ok) return { ok: false, step: 'receipt', code: errCode(r.data) || `http_${r.status}` };
+  const origin = new URL(base).origin;
+  const hub = String((r.data && r.data.hub) || origin).replace(/\/+$/, '');
+  const res = await doFetch(`${hub}/api/bongos/sso/feedback/direct`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({
+      origin, receipt: r.data.receipt, message, kind,
+      context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` },
+    }),
+    signal: AbortSignal.timeout(15000),
+  });
+  if (res.status === 202) return { ok: true, hub };
+  let body = null;
+  try { body = await res.json(); } catch { /* non-JSON */ }
+  return { ok: false, step: 'hub', code: errCode(body) || `http_${res.status}` };
+}
+
+// The background child: read the queued report, deliver it, record the outcome
+// where a curious builder (or a maintainer helping them) can look.
+async function runDeliverChild(file) {
+  let job;
+  try { job = JSON.parse(fs.readFileSync(file, 'utf8')); } finally { fs.rmSync(path.dirname(file), { recursive: true, force: true }); }
+  let outcome;
+  try { outcome = await deliver(job); } catch (e) { outcome = { ok: false, step: 'network', code: String(e && e.message || e).slice(0, 200) }; }
+  try {
+    fs.writeFileSync(path.join(stateDir(), 'feedback-last.json'), JSON.stringify({ at: new Date().toISOString(), ...outcome }), { mode: 0o600 });
+  } catch { /* nowhere to record — the report itself is what mattered */ }
+  return outcome.ok ? 0 : 1;
+}
+
+// Hand the job to a detached child and return. The job travels in a 0600 temp
+// file, never argv (visible in ps) or env.
+function spawnDelivery(job, { spawnImpl = spawn } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-feedback-'));
+  const file = path.join(dir, 'job.json');
+  fs.writeFileSync(file, JSON.stringify(job), { mode: 0o600 });
+  const child = spawnImpl(process.execPath, [__filename, '--deliver', file], { detached: true, stdio: 'ignore' });
+  if (child && child.unref) child.unref();
+  return file;
+}
 
-async function main(argv = process.argv.slice(2)) {
+async function main(argv = process.argv.slice(2), deps = {}) {
   if (hasFlag('--help', argv) || hasFlag('-h', argv)) { console.log(USAGE); return 0; }
-  const json = hasFlag('--json', argv);
   const kind = hasFlag('--idea', argv) ? 'idea' : 'bug';
-  const message = String(readMessage(argv) || '').trim();
-  if (!message) { console.error(USAGE); return 2; }
+  const message = String(readMessage(argv, deps.io) || '').trim();
+  if (!message) { console.error(REFUSALS.message_required); return 2; }
+  if (message.length > 4000) { console.error(REFUSALS.too_long); return 2; }
 
   const scrubbed = scrubReport(message);
-  if (!scrubbed) {
-    console.error('Feedback was not sent: the secret filter that checks every report is missing from this install.');
-    return 1;
-  }
+  if (!scrubbed) { console.error(REFUSALS.no_scrubber); return 1; }
 
-  await requireSession();
-  const api = await cliClient();
-  const res = await api.request('POST', '/feedback', {
-    body: { message: scrubbed.text, kind, context: { cli_version: cliVersion(), os: `${os.platform()} ${os.release()}` } },
-  });
-  if (scrubbed.removed > 0 && !json) {
-    console.log(`Removed ${scrubbed.removed} secret-looking value(s) from the report before sending.`);
-  }
+  const session = await (deps.requireSession || requireSession)();
+  const base = deps.base || ic.resolveApiBase({ session });
+  if (isLocalBase(base)) { console.error(REFUSALS.local_only); return 1; }
 
-  if (json) { console.log(JSON.stringify(res.data, null, 2)); return res.ok ? 0 : 1; }
-  if (!res.ok) {
-    const code = errCode(res.data);
-    const details = errDetails(res.data) || {};
-    let line = REFUSALS[code] || `Feedback was not sent (${code || `HTTP ${res.status}`}).`;
-    if (code === 'rate_limited' && details.retry_after_seconds) {
-      line += ` (in about ${Math.ceil(details.retry_after_seconds / 60)} min)`;
-    }
-    console.error(line);
-    return 1;
+  const job = { message: scrubbed.text, kind };
+  if ((deps.checkRepeat || checkAndRecordRepeat)(job.message)) {
+    console.log('Already sent — the Bongos team has this one.');
+    return 0;
   }
-  const d = res.data || {};
-  if (d.landed === 'task') {
-    console.log(`Thanks — sent to the Cloud Bongos maintainers as task ${d.task_id}.`);
-    console.log('It waits for a maintainer to approve it before anyone works on it.');
-    if (d.hub_origin) console.log(`${String(d.hub_origin).replace(/\/+$/, '')}/builders#/task/${d.task_id}`);
-  } else {
-    console.log(`Thanks — your idea is in the Cloud Bongos idea inbox (idea ${d.idea_id}) for the maintainers to review.`);
+  if (hasFlag('--wait', argv)) {
+    const outcome = await (deps.deliver || deliver)(job);
+    console.log(outcome.ok ? SENT_LINE : `Not sent (${outcome.step}: ${outcome.code}).`);
+    return outcome.ok ? 0 : 1;
   }
+  (deps.spawnDelivery || spawnDelivery)(job);
+  console.log(SENT_LINE);
   return 0;
 }
 
 if (require.main === module) {
+  const argv = process.argv.slice(2);
+  const run = argv[0] === '--deliver' ? runDeliverChild(argv[1]) : main(argv);
   // cliExit, never process.exit, after a request (task 1002734 — the Windows abort).
-  main().then((code) => cliExit(code), (err) => {
+  run.then((code) => cliExit(code), (err) => {
     console.error(`Feedback was not sent: ${err && err.message ? err.message : err}`);
     cliExit(1);
   });
 }
 
-module.exports = { main, readMessage, REFUSALS, scrubReport };
+module.exports = { main, deliver, readMessage, REFUSALS, scrubReport, isLocalBase, repeatKey, checkAndRecordRepeat, SENT_LINE };

package/src/bongos/platform-visibility-gate.js

@@ -110,6 +110,9 @@ const EXEMPT = [
   /^\/downloads\//,
   { re: new RegExp(`^${API}/access-requests$`), methods: ['POST'] },
   { re: new RegExp(`^${API}/access-requests/status$`), methods: ['GET'] },
+  // The hub redeeming a `bongos feedback` receipt (task 1004591): it has no
+  // session here, and a members-only project must still vouch for its builders.
+  { re: new RegExp(`^${API}/feedback/receipt/[a-z0-9_-]+$`), methods: ['GET'] },
 ];
 
 // The policy, read through the memoized pack. A pack that cannot be read at all

package/src/bongos/routes/feedback.js

@@ -1,110 +1,124 @@
 'use strict';
 
-// src/bongos/routes/feedback.js — POST /api/bongos/feedback (task 1004462).
+// src/bongos/routes/feedback.js — the project's half of `bongos feedback`: a
+// one-time RECEIPT that proves who sent a report (tasks 1004462, 1004591).
 //
-// `bongos feedback "…"` lands here, on the builder's OWN project, with the session
-// they already hold. This route stamps who sent it and which core this project
-// runs, then relays it to the hub's POST /sso/feedback over the hub-federation
-// client credential (ADR 0141) — the channel the activity rollup already uses. So
-// a builder never signs in to cloudbongos.com to report something about Bongos.
+// The report itself goes straight from the builder's CLI to the Cloud Bongos hub,
+// never through this project — so a project with no hub link (self-hosted, or a
+// hosted one provisioned before federation) can still send. What the hub cannot
+// know on its own is WHO sent it. This project can: the builder holds a session
+// here. So the CLI first asks for a receipt naming the signed-in builder and a
+// hash of the text; the hub then calls this project's public receipt URL and
+// files the report only if the project vouches for both. Nothing for the builder
+// to do beyond the session they already have.
 //
-// Only the text the builder typed and version stamps travel. No code, transcript,
-// task or file content from this project is attached.
+// Two routes:
+//   POST /feedback/receipt      — signed-in builder; records { who, sha256, kind }.
+//   GET  /feedback/receipt/:id  — public, single-use; the hub redeems it once.
 //
-// In the CORE, not a module, for the reason core-update.js gives: the hub link is
-// kernel (src/bongos/auth-config.js), and every hosted project must have this door
-// whatever modules it runs. A project with no hub link (self-hosted, or the hub
-// itself) answers 409 not_hub_connected — told, not silently dropped.
+// Receipts live in memory for RECEIPT_TTL_MS: the CLI redeems within seconds, and
+// a restart in between only loses that one report. In the CORE, not a module, for
+// the reason core-update.js gives: every project must have this door.
 
+const crypto = require('node:crypto');
 const express = require('express');
 const { asyncHandler, validateOrRespond } = require('./_helpers');
 const auth = require('../auth');
-const { loadIdpConfig } = require('../auth-config');
-const { userAgent } = require('../../branding');
+const ic = require('../../instance-config');
 
-const MESSAGE_MAX = 4000;
-const HUB_TIMEOUT_MS = 15000;
+const RECEIPT_TTL_MS = 10 * 60 * 1000;
+const RECEIPTS_MAX = 1000;
 
-function safeIdpConfig() {
-  try { return loadIdpConfig(); } catch { return null; }
+// Where reports go: the Bongos maintainers' hub. <PREFIX>_FEEDBACK_HUB overrides
+// it (a test hub, a fork with its own maintainers). A project that IS the hub
+// answers null — the CLI then sends to the project it already talks to.
+const DEFAULT_FEEDBACK_HUB = 'https://cloudbongos.com';
+
+function feedbackHub({ env, isHub } = {}) {
+  const override = ic.resolveEnv('FEEDBACK_HUB', env ? { env } : undefined);
+  if (override) return String(override).replace(/\/+$/, '');
+  let hub = isHub;
+  if (hub === undefined) {
+    try { hub = require('../../modules').isModuleEnabled('platform-identity'); } catch { hub = false; }
+  }
+  return hub ? null : DEFAULT_FEEDBACK_HUB;
 }
 
 function runningCore() {
   try { return require('../../module-api').CORE_VERSION || null; } catch { return null; }
 }
 
-// Hub refusals the builder can act on are passed through by code; anything else
-// is one generic failure, so the hub's internals never leak through this door.
-const PASS_THROUGH = new Set(['membership_required', 'rate_limited', 'feedback_unavailable', 'validation_failed']);
-
-async function relayToHub({ idp, builder, message, kind, context, fetchImpl = fetch }) {
-  const res = await fetchImpl(`${idp.origin.replace(/\/+$/, '')}/api/bongos/sso/feedback`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
-    body: JSON.stringify({
-      client_id: idp.clientId,
-      client_secret: idp.clientSecret,
-      github_id: builder.github_id,
-      message,
-      kind,
-      context,
-    }),
-    signal: AbortSignal.timeout(HUB_TIMEOUT_MS),
-  });
-  let body = null;
-  try { body = await res.json(); } catch { /* non-JSON answer */ }
-  return { status: res.status, body };
+// makeReceiptStore — issue/redeem with expiry, single use, and a size cap so an
+// abusive signed-in caller cannot grow the map without bound. A full store
+// refuses the NEW receipt (issue → null) rather than evicting a live one, so one
+// noisy builder can never drop another builder's pending report.
+function makeReceiptStore({ now = Date.now, ttlMs = RECEIPT_TTL_MS, max = RECEIPTS_MAX } = {}) {
+  const rows = new Map(); // id -> { ...receipt, exp }
+  function prune() {
+    const t = now();
+    for (const [id, r] of rows) if (r.exp <= t) rows.delete(id);
+  }
+  return {
+    issue(receipt) {
+      prune();
+      if (rows.size >= max) return null;
+      const id = crypto.randomBytes(18).toString('base64url');
+      rows.set(id, { ...receipt, exp: now() + ttlMs });
+      return id;
+    },
+    redeem(id) {
+      const r = rows.get(id);
+      rows.delete(id);
+      if (!r || r.exp <= now()) return null;
+      const { exp: _exp, ...receipt } = r;
+      return receipt;
+    },
+    _rows: rows,
+  };
 }
 
-function buildFeedbackRouter({ idpConfig = safeIdpConfig, fetchImpl = fetch } = {}) {
+function buildFeedbackRouter({ store = makeReceiptStore(), hub = feedbackHub } = {}) {
   const router = express.Router();
 
-  // rank: any signed-in builder — reporting a problem with Bongos grants nothing
-  // here, and the hub files every report at 'backlog' behind a Metic+ nod.
+  // rank: any signed-in builder — a receipt only says "this builder sent this
+  // text"; it grants nothing here, and the hub files every report behind a nod.
   router.post(
-    '/feedback',
+    '/feedback/receipt',
     auth.requireBuilder,
-    asyncHandler('POST /feedback', async (req, res) => {
+    asyncHandler('POST /feedback/receipt', async (req, res) => {
       if (validateOrRespond(req, res, {
-        message: { required: true, type: 'string', maxLength: MESSAGE_MAX },
+        sha256: { required: true, type: 'string', maxLength: 64 },
         kind: { type: 'string', enum: ['bug', 'idea'] },
-        context: {},
       })) return;
-      const b = req.body || {};
-      const message = b.message.trim();
-      if (!message) return res.fail('message_required', 400);
-      const kind = b.kind || 'bug';
-
-      const idp = idpConfig();
-      if (!idp) return res.fail('not_hub_connected', 409);
-
-      const ctx = b.context && typeof b.context === 'object' ? b.context : {};
-      const context = {
+      const b = req.body;
+      if (!/^[a-f0-9]{64}$/.test(b.sha256)) return res.fail('validation_failed', 400, [{ field: 'sha256', reason: 'not_a_sha256' }]);
+      const receipt = store.issue({
+        github_id: String(req.builder.github_id),
+        github_login: req.builder.github_login || null,
+        sha256: b.sha256,
+        kind: b.kind || 'bug',
         core_version: runningCore(),
-        cli_version: typeof ctx.cli_version === 'string' ? ctx.cli_version.slice(0, 40) : null,
-        os: typeof ctx.os === 'string' ? ctx.os.slice(0, 40) : null,
-      };
-
-      let hub;
-      try {
-        hub = await relayToHub({ idp, builder: req.builder, message, kind, context, fetchImpl });
-      } catch {
-        return res.fail('hub_unreachable', 502);
-      }
-      if (hub.status === 201 && hub.body && hub.body.ok) {
-        const { ok: _ok, ...landing } = hub.body;
-        return res.status(201).json({ ok: true, hub_origin: idp.origin, ...landing });
-      }
-      const err = hub.body && hub.body.error && typeof hub.body.error === 'object' ? hub.body.error : null;
-      if (err && PASS_THROUGH.has(err.code)) {
-        const retry = err.details && err.details.retry_after_seconds;
-        return res.fail(err.code, hub.status, retry ? { retry_after_seconds: retry } : undefined);
-      }
-      return res.fail('hub_refused', 502, { hub_status: hub.status });
-    }, { errorCode: 'feedback_failed', message: false }),
+      });
+      if (!receipt) return res.fail('rate_limited', 429, { retry_after_seconds: Math.ceil(RECEIPT_TTL_MS / 1000) });
+      res.status(201).json({ ok: true, receipt, hub: hub() });
+    }, { errorCode: 'feedback_receipt_failed', message: false }),
   );
 
+  // rank: public — the hub redeems a receipt with no session of its own. The id
+  // is 144 random bits, known only to the CLI that asked for it and the hub it
+  // sent it to, and it works once.
+  router.get('/feedback/receipt/:id', (req, res) => {
+    const id = String(req.params.id || '');
+    const receipt = /^[A-Za-z0-9_-]{16,64}$/.test(id) ? store.redeem(id) : null;
+    res.set('Cache-Control', 'no-store');
+    if (!receipt) return res.fail('receipt_unknown', 404);
+    res.json({ ok: true, ...receipt });
+  });
+
   return router;
 }
 
 module.exports = buildFeedbackRouter;
+module.exports.makeReceiptStore = makeReceiptStore;
+module.exports.feedbackHub = feedbackHub;
+module.exports.DEFAULT_FEEDBACK_HUB = DEFAULT_FEEDBACK_HUB;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.68'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.70'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/card_apply_ui.mjs

@@ -246,7 +246,6 @@ test('loadMemberships reads GET /my-projects\' applied echo into appliedOrigins,
     API: '/api/bongos',
     mineOrigins: {},
     appliedOrigins: {},
-    renderBuildingList: () => {},
     hostOf: (o) => String(o || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase(),
     fetch: () => Promise.resolve({
       ok: true,