@bongos/core 1.21.82 → 1.21.83

package/modules/platform-identity/invite-notices.js

@@ -18,31 +18,96 @@
 //
 // Both writers touch ONLY a `pending` row, so a notice can never create, downgrade or
 // remove a real membership (a member is left as-is; the row is not theirs to change).
-// A login with no hub account is a no-op: there is nobody on the hub to notify, and
-// the project's own row still admits them when they sign in there.
+//
+// A login with no hub account is PARKED by login (task 1004646, migration 031): a
+// platform account is only born when someone signs in to a project THROUGH the hub,
+// so the usual invitee — new to the platform — has none, and dropping the notice
+// meant they never saw it, even after signing in to the hub. The invitations read
+// lists a parked notice for whoever signs in with that login (listParkedInvites).
 //
 // Its own file because platform-identity.js is at the size ratchet; it reuses that
 // file's account lookup and pending-row writers rather than restating them.
 'use strict';
 
+const api = require('../../src/module-api');
 const pi = require('./platform-identity');
 
-// The project noticed an invite for `githubLogin` → a `pending` hub row, if the login
-// has a hub account and no membership in this project yet. Returns { noted } for the
+const loginKey = (githubLogin) => String(githubLogin || '').trim().replace(/^@/, '').toLowerCase();
+
+// The project noticed an invite for `githubLogin` → a `pending` hub row if the login
+// has a hub account, else a parked notice under the login. Returns { noted } for the
 // route's own logging; the route never tells the caller which case happened (see it).
-async function noteProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+async function noteProjectInvite({ clientId, githubLogin }, { pool = api.pool } = {}) {
   const account = await pi.getAccountByLogin(githubLogin, { pool });
-  if (!account) return { noted: false };
+  if (!account) {
+    const login = loginKey(githubLogin);
+    if (!login) return { noted: false };
+    await pool.query(
+      `INSERT INTO platform_identity_parked_invite_notices (client_id, login_lower)
+       VALUES ($1, $2)
+       ON CONFLICT (client_id, login_lower) DO UPDATE SET noted_at = now()`,
+      [clientId, login],
+    );
+    return { noted: true, parked: true };
+  }
   const out = await pi.inviteToProject({ clientId, githubId: account.github_id }, { pool });
   return { noted: !!out.invited };
 }
 
-// The project rescinded the invite for `githubLogin` → drop the `pending` hub row.
+// The project rescinded the invite for `githubLogin` → drop the `pending` hub row and
+// any parked notice under the login (an account made since the notice keeps both
+// reachable, so both go).
 async function clearProjectInvite({ clientId, githubLogin }, { pool } = {}) {
+  const parked = await removeParkedInvite({ clientId, githubLogin }, { pool });
   const account = await pi.getAccountByLogin(githubLogin, { pool });
-  if (!account) return { cleared: false };
+  if (!account) return { cleared: parked.removed };
   const out = await pi.removePendingInvite({ clientId, githubId: account.github_id }, { pool });
-  return { cleared: out.removed };
+  return { cleared: out.removed || parked.removed };
+}
+
+// The parked notices for one signed-in login, in the shape listPendingInvitesForAccount
+// returns, minus any past the invite's 30 days (ADR 0356) and any project the reader
+// already holds a real membership in — signing in there accepted it.
+async function listParkedInvites({ githubLogin, githubId }, { pool = api.pool } = {}) {
+  const login = loginKey(githubLogin);
+  if (!login) return [];
+  const { rows } = await pool.query(
+    `SELECT n.client_id, n.noted_at AS invited_at,
+            c.name AS project_name, c.origin AS project_origin
+       FROM platform_identity_parked_invite_notices n
+       LEFT JOIN platform_identity_sso_clients c ON c.client_id = n.client_id
+      WHERE n.login_lower = $1
+        AND n.noted_at > now() - make_interval(days => $2)
+        AND NOT EXISTS (
+          SELECT 1 FROM platform_identity_project_memberships m
+           WHERE m.client_id = n.client_id AND m.github_id = $3 AND m.membership_kind <> 'pending')
+      ORDER BY n.noted_at DESC`,
+    [login, api.inviteExpiry.INVITE_EXPIRY_DAYS, String(githubId || '')],
+  );
+  return rows;
+}
+
+// The invitee declined, or the project rescinded: drop the parked notice for the login.
+async function removeParkedInvite({ clientId, githubLogin }, { pool = api.pool } = {}) {
+  const login = loginKey(githubLogin);
+  if (!login) return { removed: false };
+  const { rowCount } = await pool.query(
+    `DELETE FROM platform_identity_parked_invite_notices WHERE client_id = $1 AND login_lower = $2`,
+    [clientId, login],
+  );
+  return { removed: rowCount > 0 };
+}
+
+// Everything waiting on one signed-in builder: their pending rows plus the notices
+// parked under their login, one per project (a pending row wins — it is the same
+// invite, written once the account existed).
+async function listInvitesForBuilder({ githubId, githubLogin }, { pool = api.pool } = {}) {
+  const [pending, parked] = await Promise.all([
+    pi.listPendingInvitesForAccount(githubId, { pool }),
+    listParkedInvites({ githubLogin, githubId }, { pool }),
+  ]);
+  const seen = new Set(pending.map((r) => r.client_id));
+  return pending.concat(parked.filter((r) => !seen.has(r.client_id)));
 }
 
 // The project's own invite box for `githubLogin`: its hall's watch page, with the login
@@ -58,4 +123,7 @@ function hallInviteUrl(origin, githubLogin) {
   return `${u.origin}/builders/watch${login ? `?invite=${encodeURIComponent(login)}` : ''}`;
 }
 
-module.exports = { noteProjectInvite, clearProjectInvite, hallInviteUrl };
+module.exports = {
+  noteProjectInvite, clearProjectInvite, hallInviteUrl,
+  removeParkedInvite, listInvitesForBuilder,
+};

package/modules/platform-identity/migrations/platform_identity_031_parked_invite_notices.sql

@@ -0,0 +1,45 @@
+-- platform_identity_031_parked_invite_notices.sql — a project's invite notice for a
+-- GitHub login the hub has no account for yet, kept until that person signs in
+-- (task 1004646; ADR 0353 amended).
+--
+-- WHY. POST /sso/invites/notify resolves the invited login to a platform account and,
+-- before this table, dropped the notice when there was none. A platform account is
+-- only created when someone signs in to a PROJECT through the hub — signing in to the
+-- hub itself creates none — so the usual invitee (new to the platform) never saw the
+-- invite on /invitations, even after signing in. Now the notice is PARKED here by
+-- login, and the invitations read lists it for whoever signs in with that login.
+--
+-- THE SHAPE CARRIES THE RULES:
+--   * THE KEY IS (client_id, login_lower), so a re-invite cannot pile up rows: the
+--     writer's upsert restarts noted_at in place.
+--   * NO STATUS COLUMN (ADR 0201 D1.3, ADR 0353). A notice admits nobody: the
+--     project's own access_requests row does, and signing in there accepts it. A
+--     parked notice is hidden at read time once the reader holds a non-pending
+--     membership in that project.
+--   * THE 30-DAY WINDOW IS READ-TIME (ADR 0356, the doorway's INVITE_EXPIRY_DAYS),
+--     exactly as for a pending membership row. Nothing sweeps the rows.
+--   * KEYED BY LOGIN, like the project's own invited access_requests row, which is
+--     what admits the same person — so the notice can claim no more than the invite.
+--
+-- NOTHING HERE IS AUTHORITY (ADR 0016 / ADR 0141).
+--
+-- Additive + platform_identity_-namespaced (ADR 0083 §5). CREATE only, so the
+-- previous release still runs against this schema. Idempotent.
+
+BEGIN;
+
+CREATE TABLE IF NOT EXISTS platform_identity_parked_invite_notices (
+  client_id   text NOT NULL,
+  login_lower text NOT NULL,
+  noted_at    timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (client_id, login_lower)
+);
+
+-- The reader's side: every notice for one login.
+CREATE INDEX IF NOT EXISTS platform_identity_parked_invite_notices_login
+  ON platform_identity_parked_invite_notices (login_lower);
+
+COMMENT ON TABLE platform_identity_parked_invite_notices IS
+  'A project''s invite notice for a GitHub login with no hub account yet (task 1004646). Listed on /invitations for whoever signs in with that login; a notice only, never a way in (ADR 0353). The 30-day window is applied when read (ADR 0356).';
+
+COMMIT;

package/modules/platform-identity/routes/my-projects.js

@@ -29,6 +29,7 @@ const projectStats = require('../project-stats');
 const applicationEcho = require('../application-echo');
 const guilds = require('../guilds');
 const guildEngagements = require('../guild-engagements');
+const inviteNotices = require('../invite-notices');
 const hubKeys = require('../hub-keys');
 const { isAccountActive } = require('../account-visibility');
 const { projectPublishability } = require('../publish-gate');
@@ -302,10 +303,12 @@ module.exports = function myProjectsRoutes() {
     }
   });
 
-  // rank: any-builder — the caller's OWN pending invitations (ADR 0141 §5).
+  // rank: any-builder — the caller's OWN pending invitations (ADR 0141 §5), plus the
+  // notices parked under their login before they had a hub account (task 1004646).
   router.get('/my-projects/invites', requireBuilder, async (req, res) => {
     try {
-      const invites = await pi.listPendingInvitesForAccount(req.builder.github_id, { pool });
+      const invites = await inviteNotices.listInvitesForBuilder(
+        { githubId: req.builder.github_id, githubLogin: req.builder.github_login }, { pool });
       res.json({ invites: invites.map((i) => ({ client_id: i.client_id, name: i.project_name || i.project_origin || i.client_id, origin: i.project_origin || null, invited_at: i.invited_at })) });
     } catch (err) {
       console.error('[platform-identity] GET /my-projects/invites', err);
@@ -324,7 +327,8 @@ module.exports = function myProjectsRoutes() {
     if (!clientId) return res.fail('bad_client_id', 400);
     try {
       const out = await pi.removePendingInvite({ clientId, githubId: req.builder.github_id }, { pool });
-      if (!out.removed) return res.fail('no_pending_invite', 404);
+      const parked = await inviteNotices.removeParkedInvite({ clientId, githubLogin: req.builder.github_login }, { pool });
+      if (!out.removed && !parked.removed) return res.fail('no_pending_invite', 404);
       res.json({ ok: true, accepted: false });
     } catch (err) {
       console.error('[platform-identity] decline invite', err);

package/modules/public-landing/public/account.html

@@ -624,6 +624,7 @@
   });
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/assets/cosmos.css

@@ -628,6 +628,14 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .signinDoor:hover{background:var(--ink);color:var(--bg);}
 /* a long GitHub login truncates instead of pushing Sign out off the screen */
 .who>span{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:14ch;}
+/* what is waiting on you (task 1004646, assets/invite-badge.js): a count on the chip and on
+   the band's Invitations item — the accent fill with --accent-on ink, the .btn pairing */
+.invBadge{display:inline-flex;align-items:center;justify-content:center;min-width:20px;height:20px;padding:0 6px;
+  border-radius:var(--radius-pill);background:var(--accent);color:var(--accent-on);
+  font-family:var(--font-body);font-size:12px;font-weight:700;line-height:1;letter-spacing:0;vertical-align:middle;}
+.who>.invBadge{max-width:none;overflow:visible;}
+.bandT .invBadge{margin-left:10px;}
+.invWaiting{margin:6px 0 4px;font-size:15.5px;font-weight:600;}
 /* keyboard focus on the two search pills is VISIBLE — the input's own outline
    is off by design, so the pill carries the ring */
 .search:focus-within{box-shadow:0 0 0 3px color-mix(in srgb,var(--accent) 40%,transparent);}

package/modules/public-landing/public/assets/invite-badge.js

@@ -0,0 +1,91 @@
+/* assets/invite-badge.js — WHAT IS WAITING ON YOU, said where you already look
+   (task 1004646; the owner's report of 2026-10-08 that invitations "aren't obvious").
+
+   /invitations lists what asks you in, but the only way there was the profile band,
+   with nothing saying anything was waiting. This counts what is waiting — a project's
+   invite (GET /my-projects/invites) and a guild's invite or a join request to a guild
+   you own (GET /me/guild-requests) — and, when it is more than none, paints:
+     - a count on the identity chip (#who) and on the profile band's Invitations item;
+     - on /projects?view=mine, a line "You have N invitations waiting →" under the
+       view's heading.
+   A guild's engagement with a project is left out: it asks nothing of you.
+
+   Hub only, with no flag of its own: the Invitations item sits inside the apex-only
+   region, which a child instance strips, so there this file finds no item and reads
+   nothing. Signed out, both reads 401 and nothing is painted. A failed read counts
+   as none — a badge is a convenience, never the record.
+
+   Built from nodes only. window.InviteBadge.refresh() re-reads, for a page
+   that has just answered one (the invitations page's Decline and Accept). */
+(function () {
+  'use strict';
+  var API = '/api/bongos';
+  function $(id) { return document.getElementById(id); }
+  function item() { var m = $('menuProfile'); return m && m.querySelector('a[href="/invitations"]'); }
+
+  function readCount(path, pick) {
+    return fetch(API + path, { credentials: 'same-origin', headers: { Accept: 'application/json' } })
+      .then(function (res) { return res.ok ? res.json() : null; })
+      .then(function (d) { return d ? pick(d) : 0; })
+      .catch(function () { return 0; });
+  }
+  function len(x) { return Array.isArray(x) ? x.length : 0; }
+
+  function badge(host, n, label) {
+    if (!host) return;
+    var b = host.querySelector('.invBadge');
+    if (!n) { if (b) b.remove(); return; }
+    if (!b) {
+      b = document.createElement('b');
+      b.className = 'invBadge';
+      var shown = document.createElement('span');
+      shown.setAttribute('aria-hidden', 'true');
+      var said = document.createElement('span');
+      said.className = 'vh';
+      b.appendChild(shown);
+      b.appendChild(said);
+      // before the chip's chevron; at the end of a band item
+      host.insertBefore(b, host.querySelector('svg.cv'));
+    }
+    b.firstChild.textContent = n > 99 ? '99+' : String(n);
+    b.lastChild.textContent = ', ' + label;
+  }
+
+  // at the top of the mine view, under its heading and lede — the list of projects
+  // below it can be long, and the Invitations pointer sits at its foot
+  function mineLine(n, label) {
+    var view = $('view-mine');
+    var hero = view && view.querySelector('.hero');
+    if (!hero) return;
+    var p = $('mineInvitesWaiting');
+    if (!n) { if (p) p.remove(); return; }
+    if (!p) {
+      p = document.createElement('p');
+      p.id = 'mineInvitesWaiting';
+      p.className = 'invWaiting';
+      var a = document.createElement('a');
+      a.href = '/invitations';
+      p.appendChild(a);
+      hero.appendChild(p);
+    }
+    p.firstChild.textContent = 'You have ' + label + ' waiting →';
+  }
+
+  function paint(n) {
+    var label = n + (n === 1 ? ' invitation' : ' invitations');
+    badge($('who'), n, label + ' waiting');
+    badge(item(), n, label + ' waiting');
+    mineLine(n, label);
+  }
+
+  function refresh() {
+    if (!item()) return Promise.resolve(0);
+    return Promise.all([
+      readCount('/my-projects/invites', function (d) { return len(d.invites); }),
+      readCount('/me/guild-requests', function (d) { return len(d.incoming) + len(d.owner_incoming); }),
+    ]).then(function (c) { var n = c[0] + c[1]; paint(n); return n; });
+  }
+
+  window.InviteBadge = { refresh: refresh, paint: paint };
+  refresh();
+})();

package/modules/public-landing/public/contact.html

@@ -120,6 +120,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact" aria-current="page">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/guild.html

@@ -629,6 +629,7 @@
   load();
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/invitations.html

@@ -232,11 +232,13 @@
      button on failure. `onRemoved` carries whatever else the caller needs after
      the row is gone (the empty-line flip). The busy/idle label swap the /projects
      copy carries is for its Leave button, which never moved here. */
+  /* the bar's waiting count (assets/invite-badge.js, task 1004646) follows an answer here */
+  function recount() { if (typeof window !== 'undefined' && window.InviteBadge) window.InviteBadge.refresh(); }
   function postThenRemoveRow(url, row, btn, onRemoved) {
     btn.disabled = true;
     fetch(url, { method: 'POST', credentials: 'same-origin' })
       .then(function (r) { return r.ok ? r.json() : Promise.reject(); })
-      .then(function () { row.remove(); if (onRemoved) onRemoved(); })
+      .then(function () { row.remove(); if (onRemoved) onRemoved(); recount(); })
       .catch(function () { btn.disabled = false; });
   }
 
@@ -481,7 +483,7 @@
     msg.className = 'projMsg';
     msg.textContent = '';
     guildPost('/guild-requests/' + encodeURIComponent(id) + '/decline').then(function (res) {
-      if (res.ok) { row.remove(); paintInvitesSection(); return; }
+      if (res.ok) { row.remove(); paintInvitesSection(); recount(); return; }
       btns.forEach(function (b) { b.disabled = false; });
       if (res.status === 401) { sessionExpired(msg); return; }
       msg.className = 'projMsg err';
@@ -582,6 +584,7 @@
           radios.forEach(function (r) { r.disabled = true; });
           page.hidden = false;
           msg.className = 'projMsg ok';
+          recount();
           msg.textContent = 'You’ve joined ' + name + (on ? ', and your numbers count toward its totals.' : ', and your numbers are left out of its totals.');
           return;
         }
@@ -660,6 +663,7 @@
           hint.hidden = true;
           msg.className = 'projMsg ok';
           msg.textContent = who + ' is in ' + (r.guild.name || r.guild.slug) + ' now.';
+          recount();
           return;
         }
         accept.textContent = 'Accept';
@@ -961,6 +965,7 @@
   });
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/privacy.html

@@ -129,6 +129,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy" aria-current="page">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/projects.html

@@ -11142,6 +11142,8 @@ summary{min-height:24px;padding:3px 0;}
     .then(function (data) {
       me = data.builder || data.me || data;
       renderWho();
+      /* renderWho rebuilds the chip, so the waiting count is painted again on it (task 1004646) */
+      if (window.InviteBadge) window.InviteBadge.refresh();
       paintShellIdentity();
       wizard.onAuth();
       $('gate').hidden = true;
@@ -11174,6 +11176,7 @@ summary{min-height:24px;padding:3px 0;}
     .then(loadSelfShipped, loadSelfShipped);
 })();
 </script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/modules/public-landing/public/terms.html

@@ -134,6 +134,7 @@
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on Cloud&nbsp;Bongos. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/privacy">Privacy</a><a href="/terms" aria-current="page">Terms</a><a href="/contact">Contact</a><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a></nav></footer>
 <script src="/assets/hub-bar.js"></script>
+<script src="/assets/invite-badge.js"></script>
 <!-- the Artist review button: signed-in builders only (task 1004499) -->
 <script src="/assets/artist-review.js" data-hall="{{buildersOrigin}}"></script>
 </body>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.82",
+  "version": "1.21.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.82",
+      "version": "1.21.83",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.82",
+  "version": "1.21.83",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9318,5 +9318,11 @@
       "id": "1004481",
       "text": "Custom ranks can now be deleted from the Government page, so trying a recommended rank set is no longer a permanent choice. A rank someone still holds can't be deleted, and the page says who holds it. The four built-in ranks c"
     }
+  ],
+  "1.21.83": [
+    {
+      "id": "1004646",
+      "text": "Project invites now reach people on cloudbongos.com. Before, an invite sent by GitHub username was silently lost if the person had never signed in to a project through cloudbongos.com, which is almost every new invitee, so the"
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.82'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.83'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');