@bongos/core 1.23.9 → 1.23.11

package/modules/ui-design/kit/fixtures/community-leaderboard.json

@@ -0,0 +1,28 @@
+{
+  "_": "GET /community/leaderboard for the kit stub (task 1003363): one ranked list per window, already in the route's order (credits, ships, karma, handle). The stub filters by discipline and numbers `place`. Names are invented; the long one tests the row's wrap.",
+  "boards": {
+    "all": [
+      { "handle": "priya-nair", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "credits": 18420, "tasks_shipped": 212, "karma": 64, "disciplines": ["engineer", "ui"] },
+      { "handle": "tomas-ek", "github_login": "tomasek", "display_name": "Tomas Ek", "avatar_url": "/__kit/avatar.svg", "credits": 9310, "tasks_shipped": 131, "karma": 40, "disciplines": ["engineer"] },
+      { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 6125, "tasks_shipped": 77, "karma": 52, "disciplines": ["artist"] },
+      { "handle": "lin-wei", "github_login": "linwei", "display_name": "Lin Wei", "avatar_url": null, "credits": 2480, "tasks_shipped": 31, "karma": 18, "disciplines": ["ideator", "engineer"] },
+      { "handle": "maximiliana-van-der-berghe-lindqvist", "github_login": "mvdbl", "display_name": "Maximiliana van der Berghe-Lindqvist", "avatar_url": "/__kit/avatar.svg", "credits": 940, "tasks_shipped": 12, "karma": 7, "disciplines": ["ui"] },
+      { "handle": "jo-park", "github_login": "jopark", "display_name": null, "avatar_url": "/__kit/avatar.svg", "credits": 310, "tasks_shipped": 1, "karma": 0, "disciplines": ["ideator"] }
+    ],
+    "365d": [
+      { "handle": "priya-nair", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "credits": 12200, "tasks_shipped": 150, "karma": 41, "disciplines": ["engineer", "ui"] },
+      { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 6125, "tasks_shipped": 77, "karma": 52, "disciplines": ["artist"] },
+      { "handle": "tomas-ek", "github_login": "tomasek", "display_name": "Tomas Ek", "avatar_url": "/__kit/avatar.svg", "credits": 4020, "tasks_shipped": 58, "karma": 22, "disciplines": ["engineer"] },
+      { "handle": "lin-wei", "github_login": "linwei", "display_name": "Lin Wei", "avatar_url": null, "credits": 2480, "tasks_shipped": 31, "karma": 18, "disciplines": ["ideator", "engineer"] }
+    ],
+    "30d": [
+      { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 1340, "tasks_shipped": 19, "karma": 9, "disciplines": ["artist"] },
+      { "handle": "priya-nair", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "credits": 880, "tasks_shipped": 11, "karma": 4, "disciplines": ["engineer", "ui"] },
+      { "handle": "jo-park", "github_login": "jopark", "display_name": null, "avatar_url": "/__kit/avatar.svg", "credits": 310, "tasks_shipped": 1, "karma": 0, "disciplines": ["ideator"] }
+    ],
+    "7d": [
+      { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "credits": 420, "tasks_shipped": 6, "karma": 3, "disciplines": ["artist"] },
+      { "handle": "tomas-ek", "github_login": "tomasek", "display_name": "Tomas Ek", "avatar_url": "/__kit/avatar.svg", "credits": -15, "tasks_shipped": 0, "karma": 1, "disciplines": ["engineer"] }
+    ]
+  }
+}

package/modules/ui-design/kit/fixtures/community-search.json

@@ -0,0 +1,10 @@
+{
+  "_": "GET /community/search for the kit stub (task 1003363): the public, existence-visible builders the stub matches by name or handle. Sam Rivera hides their numbers, so `disciplines` is null: found by name, dropped by any craft filter (builder-search.js).",
+  "directory": [
+    { "handle": "priya-nair", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "disciplines": ["engineer", "ui"] },
+    { "handle": "priyanka-shah", "github_login": "pshah", "display_name": "Priyanka Shah", "avatar_url": "/__kit/avatar.svg", "disciplines": ["artist"] },
+    { "handle": "tomas-ek", "github_login": "tomasek", "display_name": "Tomas Ek", "avatar_url": "/__kit/avatar.svg", "disciplines": ["engineer"] },
+    { "handle": "ada-okafor", "github_login": "adaokafor", "display_name": "Ada Okafor", "avatar_url": "/__kit/avatar.svg", "disciplines": ["artist"] },
+    { "handle": "sam-rivera", "github_login": "samrivera", "display_name": "Sam Rivera", "avatar_url": "/__kit/avatar.svg", "disciplines": null }
+  ]
+}

package/modules/ui-design/kit/fixtures/connections-nosuggest.json

@@ -0,0 +1,12 @@
+{
+  "_": "The connections graph with nothing to suggest (task 1004256): one connection, nothing pending, no builder you may know. Opened by the Community menu's item (/connections#connSuggest), the panel says so rather than vanishing.",
+  "connections": [
+    { "id": "41", "connected_at": "2026-09-30T10:00:00Z", "handle": "mira", "display_name": "Mira Okafor", "avatar_url": "/__kit/avatar.svg" }
+  ],
+  "incoming": [],
+  "outgoing": [],
+  "suggestions": [],
+  "directory": [
+    { "handle": "nadia", "display_name": "Nadia Haddad", "avatar_url": "/__kit/avatar.svg" }
+  ]
+}

package/modules/ui-design/kit/fixtures/scouting-recruiter.json

@@ -0,0 +1,11 @@
+{
+  "_": "GET /scouting for a viewer the recruiting door admits — a project owner (task 1003363). `builders` is the ranked tier, which the community page never draws (the leaderboard already shows those numbers to everyone); `name_only` is ADR 0334's hidden-but-open-to-recruiters tier, login, name and avatar only, alphabetical by login as listScoutingNameOnly sends it.",
+  "builders": [
+    { "github_id": "9001", "github_login": "priyanair", "display_name": "Priya Nair", "avatar_url": "/__kit/avatar.svg", "project_count": 3, "total_credits": 18420, "total_tasks_shipped": 212, "total_karma": 64, "last_active": "2026-10-20T10:00:00Z", "disciplines": ["engineer", "ui"] }
+  ],
+  "name_only": [
+    { "github_login": "kemi-a", "display_name": "Kemi Adeyemi", "avatar_url": "/__kit/avatar.svg" },
+    { "github_login": "samrivera", "display_name": "Sam Rivera", "avatar_url": "/__kit/avatar.svg" },
+    { "github_login": "yuki-t", "display_name": null, "avatar_url": null }
+  ]
+}

package/modules/ui-design/kit/fixtures/scouting.json

@@ -0,0 +1,4 @@
+{
+  "_": "GET /scouting for a signed-in viewer the recruiting door does not admit (task 1003363): most builders own no project, so the default answer is the unchanged permission refusal (403). scouting-recruiter.json is an admitted reader's answer.",
+  "refused": true
+}

package/modules/ui-design/kit/serve.js

@@ -684,6 +684,58 @@ function connRemove(res, id) {
   return refuse(res, 404, 'connection_not_found', 'connection_not_found');
 }
 
+// The community page (task 1003363): the two public reads and the recruiter door, the
+// routes' answers mirrored (modules/platform-identity/routes/community-leaderboard.js,
+// community-search.js, scouting.js). The board fixture holds one ranked list per window;
+// the stub filters it by discipline and numbers `place` the way listLeaderboard does. The
+// search matches a name or handle, case-folded, and a craft filter drops every row whose
+// disciplines are null (a hidden account: findable by name, never by craft). GET /scouting
+// answers 401 signed out, and signed in whatever its fixture says: `scouting.json` is the
+// unchanged permission refusal (most viewers own no project), `scouting-recruiter.json` an
+// admitted reader's { builders, name_only }. A fixture's "stub_status" answers that status.
+// The caps are copied (a kit module may not import one).
+const STUB_COMMUNITY_WINDOWS = ['7d', '30d', '365d', 'all'];
+const STUB_COMMUNITY_DISCIPLINE_MAX = 32;
+const STUB_SEARCH_MIN = 2;
+const STUB_SEARCH_MAX = 100;
+function stubStatus(res, f) {
+  if (!f || !f.stub_status) return false;
+  json(res, f.stub_status, { error: { code: 'stub_failure', message: `stub_status ${f.stub_status}` } });
+  return true;
+}
+function communityBoard(res, u, origin) {
+  const f = heldFixture('community-leaderboard');
+  if (stubStatus(res, f)) return;
+  const window = u.searchParams.get('window') || 'all';
+  if (!STUB_COMMUNITY_WINDOWS.includes(window)) return refuse(res, 400, 'bad_window', `window must be one of: ${STUB_COMMUNITY_WINDOWS.join(', ')}`);
+  const disc = (u.searchParams.get('discipline') || '').trim();
+  if (disc.length > STUB_COMMUNITY_DISCIPLINE_MAX) return refuse(res, 400, 'discipline_too_long', 'discipline must be at most 32 characters');
+  const rows = ((f.boards || {})[window] || []).filter((r) => !disc || (r.disciplines || []).includes(disc));
+  const results = rows.map((r, i) => ({ place: i + 1, ...withAvatar(r, origin) }));
+  return json(res, 200, { window, since: window === 'all' ? null : stamp('$now-1d'), discipline: disc || null, count: results.length, results, page: { limit: 25, offset: 0 } });
+}
+function communitySearch(res, u, origin) {
+  const f = heldFixture('community-search');
+  if (stubStatus(res, f)) return;
+  const q = (u.searchParams.get('q') || '').trim();
+  if (!q) return refuse(res, 400, 'bad_request', 'q (a non-empty search string) is required');
+  if (q.length < STUB_SEARCH_MIN) return refuse(res, 400, 'query_too_short', 'q must be at least 2 characters');
+  if (q.length > STUB_SEARCH_MAX) return refuse(res, 400, 'query_too_long', 'q must be at most 100 characters');
+  const disc = (u.searchParams.get('discipline') || '').trim();
+  const needle = q.toLowerCase();
+  const results = (f.directory || [])
+    .filter((r) => [r.handle, r.display_name].some((s) => String(s || '').toLowerCase().includes(needle)))
+    .filter((r) => !disc || (Array.isArray(r.disciplines) && r.disciplines.includes(disc)))
+    .map((r) => withAvatar(r, origin));
+  return json(res, 200, { query: q, discipline: disc || null, count: results.length, results, page: { limit: 20, offset: 0 } });
+}
+function scoutingRead(res, origin) {
+  const f = heldFixture('scouting');
+  if (stubStatus(res, f)) return;
+  if (f.refused) return refuse(res, 403, 'forbidden', 'requires permission project.curate');
+  return json(res, 200, { builders: (f.builders || []).map((r) => withAvatar(r, origin)), name_only: (f.name_only || []).map((r) => withAvatar(r, origin)) });
+}
+
 const server = http.createServer((req, res) => {
   const u = new URL(req.url, 'http://x');
   const p = u.pathname;
@@ -712,6 +764,9 @@ const server = http.createServer((req, res) => {
     if (guild && guild[2] === '/engagements' && req.method === 'POST') return AUTH ? readBody(req, (body) => guildEngagementPost(res, guild[1], body)) : json(res, 401, UNAUTH);
     if (rest === '/me/guilds' && req.method === 'GET') return AUTH ? myGuilds(res) : json(res, 401, UNAUTH);
     if (rest === '/me/guild-requests' && req.method === 'GET') return AUTH ? myGuildRequests(res) : json(res, 401, UNAUTH);
+    if (rest === '/community/leaderboard' && req.method === 'GET') return communityBoard(res, u, origin);
+    if (rest === '/community/search' && req.method === 'GET') return communitySearch(res, u, origin);
+    if (rest === '/scouting' && req.method === 'GET') return AUTH ? scoutingRead(res, origin) : json(res, 401, UNAUTH);
     if (rest === '/connections' && req.method === 'GET') return AUTH ? connRead(res, 'list', origin) : json(res, 401, UNAUTH);
     if (rest === '/connections/requests' && req.method === 'GET') return AUTH ? connRead(res, 'requests', origin) : json(res, 401, UNAUTH);
     if (rest === '/connections/suggestions' && req.method === 'GET') return AUTH ? connRead(res, 'suggestions', origin) : json(res, 401, UNAUTH);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.9",
+  "version": "1.23.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.9",
+      "version": "1.23.11",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.9",
+  "version": "1.23.11",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10441,5 +10441,17 @@
       "id": "1004897",
       "text": "The record of this session's work on goal 1000110 is written down for the next person who picks it up."
     }
+  ],
+  "1.23.10": [
+    {
+      "id": "1003363",
+      "text": "cloudbongos.com now has a Community menu: a leaderboard of builders across every project (by week, month, year or all time, and by craft), a search for builders by name, and, for project owners, a list of builders who keep the"
+    }
+  ],
+  "1.23.11": [
+    {
+      "id": "1004256",
+      "text": "Signed-in builders now find 'Builders you may know' in the Community menu; it opens their suggestions on the Connections page, which says so plainly when there's no one to suggest yet."
+    }
   ]
 }

package/src/bongos/serve-internal.js

@@ -1005,8 +1005,10 @@ function mountInternalSurfaces(app) {
   // /people itself (owner call, 2026-09-25 — ADR 0337 D5): cross-project
   // discovery belongs to the hub, and /roster is the hall's directory. Both URLs
   // survive as redirects to /roster so a bookmark lands somewhere instead of a
-  // 404. 302, not 301: /roster is interim until the hub community page (task
-  // 1003363) ships, and a browser caches a 301 past any re-point. No page gate:
+  // 404. They stay on /roster now the hub's community pages exist (task 1003363):
+  // each hall is its own instance and only the hub serves /community, so a child
+  // hall has nowhere else to send them. 302, not 301, so a re-point is never
+  // stuck in a browser cache. No page gate:
   // the redirect discloses nothing, and /roster is deliberately public.
   // GET /scouting's own gate (platform-identity) is untouched by this.
   const RETIRED_DIRECTORY_RE = /^\/builders\/(?:people|scouting)(?:\.html)?\/?$/;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.9'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.11'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/src/platform-server.js

@@ -337,6 +337,17 @@ function buildPlatformApp() {
     if (!html) return next();
     res.type('html').send(html);
   });
+  // THE COMMUNITY PAGES (task 1003363, ADR 0217 D1, ADR 0337 D1/D3): who is building
+  // across every project — the leaderboard, the builder search (the same for every
+  // viewer) and the recruiter list GET /scouting's own door admits. One file serves all
+  // three; its script shows the one the path names. Hub-only for the /account reason:
+  // every read it makes is a platform-identity route.
+  app.get(['/community', '/community/find', '/community/recruiters'], (req, res, next) => {
+    if (!isApexHost(req) || !isModuleEnabled('platform-identity')) return next();
+    const html = landingPage('community.html');
+    if (!html) return next();
+    res.type('html').send(html);
+  });
   // THE GUILD PAGE (task 1002301, R25; ADR 0336 D4/D6): /g/<slug>, the namespace
   // D6 reserved. Hub-only for the /account reason — every read it makes is a
   // platform-identity route. ONE shell for every slug: the page reads the public

package/tests/hub_account_page.mjs

@@ -135,6 +135,9 @@ test('the bands say what the hub’s say and lead into /projects; Account is the
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProjects')), [
     ['Sky', '/projects?view=map'], ['Table', '/projects?view=map&sub=table'],
     ['Your projects', '/projects?view=mine'], ['New project', '/projects?view=new'],
+    // the Community menu's three sub-pages, folded into the band under 480px (task 1003363)
+    ['Leaderboard', '/community'], ['Find a builder', '/community/find'], ['Open to recruiters', '/community/recruiters'],
+    ['Builders you may know', '/connections#connSuggest'],
   ], 'this page has no views of its own, so every item names /projects in full');
   assert.deepEqual(bandLinks(bandOf(PAGE, 'menuProfile')), [
     ['My projects', '/projects?view=mine'], ['Invitations', '/invitations'], ['Connections', '/connections'], ['Account', '/account'], ['Sign out', '/api/bongos/auth/logout'],
@@ -211,6 +214,8 @@ function boot(answer) {
   // The bar: the two triggers, and each band with its links in markup order. An
   // item's cell is its <li>; only #mineCell carries an id, so only it can hide.
   const trigs = [...els.values()].filter((e) => /\btrig\b/.test(e.attrs.class || ''));
+  // the signed-in-only "Builders you may know" cells (task 1004256), by class: a band and its phone fold
+  const knowCells = [...PAGE.matchAll(/<li class="bandCell(?: bandFold)? knowCell" hidden>/g)].map(() => ({ hidden: true }));
   const bands = [...PAGE.matchAll(/<div class="menuBand" id="(\w+)"[\s\S]*?\n<\/div>/g)].map((m) => {
     const band = els.get(m[1]);
     band.items = [...m[0].matchAll(/<li class="bandCell"(?: id="(\w+)")?><a class="([^"]+)" href="([^"]+)"([^>]*)>([^<]+)<\/a>/g)].map((a) => ({
@@ -241,7 +246,7 @@ function boot(answer) {
   });
   const calls = [];
   const dom = {
-    els, radios, calls, focused: null, assigned: null,
+    els, radios, calls, knowCells, focused: null, assigned: null,
     active: () => document.activeElement,
     // a click bubbles: the target's own listeners, its band's, then the document's
     click(target, detail = 1) {
@@ -272,6 +277,7 @@ function boot(answer) {
     },
     querySelectorAll(sel) {
       if (sel === '#profileForm [data-link]') return links;
+      if (sel === '.knowCell') return knowCells;
       if (sel === '.trig') return trigs;
       if (sel === '.menuBand') return bands;
       const names = [...sel.matchAll(/input\[name="(\w+)"\]/g)].map((m) => m[1]);
@@ -309,6 +315,7 @@ test('signed out: a 401 opens the door and shows nothing else', async () => {
   assert.equal(dom.els.get('who').hidden, true, 'no chip without a session');
   assert.equal(dom.els.get('signinTop').hidden, false, 'the sign-in door takes its slot');
   assert.equal(dom.els.get('mineCell').hidden, true, 'and the Projects band offers no Your projects');
+  assert.deepEqual(dom.knowCells.map((c) => c.hidden), [true, true], 'nor Builders you may know, in the Community band or its fold');
 });
 
 test('signed in: every control is painted from the server’s answer', async () => {
@@ -678,6 +685,7 @@ test('the chip is the hub’s identity read: GET /me fills the trigger and the p
     assert.equal(dom.els.get(id).hidden, false);
   }
   assert.equal(dom.els.get('mineCell').hidden, false);
+  assert.deepEqual(dom.knowCells.map((c) => c.hidden), [false, false]);
 });
 
 test('an account with no avatar gets a chip with no picture rather than a broken one', async () => {