@bongos/core 1.24.5 → 1.24.7

package/docs/api/openapi.json

@@ -2173,6 +2173,27 @@
         "security": []
       }
     },
+    "/auth/link/github/start": {
+      "get": {
+        "operationId": "get_auth_link_github_start",
+        "tags": [
+          "auth"
+        ],
+        "summary": "GET /auth/link/github/start",
+        "description": "an OAuth entry point that gates itself: with no live session it sends the person to /account, so only a signed-in person ever links (ADR 0396).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth-link.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/logout": {
       "post": {
         "operationId": "post_auth_logout",
@@ -2364,6 +2385,27 @@
         "security": []
       }
     },
+    "/auth/web/callback/link": {
+      "get": {
+        "operationId": "get_auth_web_callback_link",
+        "tags": [
+          "auth"
+        ],
+        "summary": "GET /auth/web/callback/link",
+        "description": "the OAuth callback for linking; the state cookie + code are the bearer, and the live session cookie names the person (no session: /account).\n\n**Rank:** `public` — No authentication — any caller.",
+        "x-rank": "public",
+        "x-source": "src/bongos/routes/auth-link.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          }
+        },
+        "security": []
+      }
+    },
     "/auth/web/handoff": {
       "get": {
         "operationId": "get_auth_web_handoff",
@@ -4162,7 +4204,7 @@
           "claims"
         ],
         "summary": "POST /claims/batch",
-        "description": "Atomic multi-claim. Body: { task_ids: [n,n,n], worktree_name?: string }. All-or-nothing: if any single task fails (already claimed, not ready, or touches conflict with another active claim OR another task in the batch), the whole transaction rolls back and we return 409 with a structured failures[] enumerating every problem found in one pass. rank: any-builder — atomic multi-claim; same Xenos row-level filter applies. V3.R13 (task 237): same newcomer gate as POST /claims — a fresh builder can't sneak around the \"one claim at a time\" rule by batching.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "Atomic multi-claim. Body: { task_ids: [n,n,n], worktree_name?: string }. All-or-nothing: if any single task fails (already claimed, not ready, or touches conflict with another active claim OR another task in the batch), the whole transaction rolls back and we return 409 with a structured failures[] enumerating every problem found in one pass. rank: any-builder — atomic multi-claim; same Xenos row-level filter applies. V3.R13 (task 237): same newcomer gate as POST /claims — a fresh builder can't sneak around the \"one claim at a time\" rule by batching. task 1005005: and the same gateOneActiveClaimPerSession as POST /claims, in the same order, so a session already holding a claim in this tree cannot batch more work into it. It reads the SESSION's existing active claims (the batch's own rows do not exist yet), keyed on the body's worktree_name — the caller's tree, which a batch also uses as its row-name prefix. A bind_session:false batch (the hall) has no session and passes, as on /claims.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/lifecycle/routes/claims.js",
         "requestBody": {
@@ -15999,7 +16041,7 @@
           "me"
         ],
         "summary": "GET /me/sign-in-methods",
-        "description": "the ways the caller's OWN account signs in (task 1004992, ADR 0393): GitHub, Google, or both, with the address each provider vouched for. Keyed on the authenticated github_id (the person key); the provider's user id never crosses. A system:* principal has no platform account: [].\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "the ways the caller's OWN account signs in (task 1004992, ADR 0393): GitHub, Google, or both, with the address each provider vouched for. Keyed on the authenticated github_id (the person key); the provider's user id never crosses. A system:* principal has no platform account: []. Each method carries `unlink_refused` (null, 'last_way_in' or 'born_with') so the page can say why a Remove is missing (task 1004995).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "modules/platform-identity/routes/profile.js",
         "responses": {
@@ -16030,6 +16072,58 @@
         ]
       }
     },
+    "/me/sign-in-methods/{provider}": {
+      "delete": {
+        "operationId": "delete_me_sign_in_methods_provider",
+        "tags": [
+          "me"
+        ],
+        "summary": "DELETE /me/sign-in-methods/:provider",
+        "description": "remove one way in from the caller's OWN account (task 1004995), keyed on the authenticated person key. Never the last way in, and never GitHub from an account born with it (its key is its GitHub id). Adding a way in is a sign-in, so it lives with the sign-in routes, not here.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/platform-identity/routes/profile.js",
+        "parameters": [
+          {
+            "name": "provider",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `provider`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeleteMeSignInMethodsProviderResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me/skill-prefs": {
       "get": {
         "operationId": "get_me_skill_prefs",
@@ -19839,7 +19933,7 @@
           "project-settings"
         ],
         "summary": "PATCH /project-settings/tweak-autopickup",
-        "description": "PATCH /project-settings/tweak-autopickup — body { mode?: 'off' | 'on', cap?: n }. rank: project.settings.manage (metic+, government_010), the same atom as the other writes on this page. Each field is validated by the resolver's own parser, and both are checked before either is written, so a half-valid body writes nothing.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "description": "PATCH /project-settings/tweak-autopickup — body { mode?: 'off' | 'on', cap?: n, rank_caps?: { <rank>: n | null } }. rank: project.settings.manage (metic+, government_010), the same atom as the other writes on this page. Each field is validated by the resolver's own parser, and all are checked before any is written, so a half-valid body writes nothing. rank_caps (task 1005003) is a PARTIAL update: a rank named with a number gets that cap, a rank named with null loses its own cap (and follows the project cap again), and a rank not named is left as it was. A rank must be on the live ladder; each number goes through parseAutopickupCap, the project cap's parser.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
         "x-rank": "metic+archon",
         "x-source": "modules/lifecycle/routes/project-settings.js",
         "x-permissions": [
@@ -29998,6 +30092,17 @@
           "views"
         ]
       },
+      "DeleteMeSignInMethodsProviderResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok"
+        ]
+      },
       "DeleteMemoryFileResponse": {
         "type": "object",
         "properties": {
@@ -33274,6 +33379,9 @@
           },
           "cap": {
             "type": "number"
+          },
+          "rank_caps": {
+            "type": "object"
           }
         },
         "additionalProperties": false
@@ -40436,9 +40544,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 636,
-  "x-schema-count": 686,
+  "x-endpoint-count": 639,
+  "x-schema-count": 687,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 441,
+  "x-response-schemas": 442,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 636 endpoints across 105 route files.
+> **Generated from the live route files** — the route file is authoritative. 639 endpoints across 106 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -78,7 +78,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 |---|---|---|---|---|
 | GET | `/api/bongos/audit-log` | `metic+archon` | — | GET /api/bongos/audit-log?limit=&offset=&builder_id=&method= Paginated, newest-first. |
 
-## `auth` (19)
+## `auth` (21)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -94,11 +94,13 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/discord/unlink` | `any-builder` | — | unlink your OWN Discord. |
 | GET | `/api/bongos/auth/google/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
 | GET | `/api/bongos/auth/google/start` | `public` | — | entry into the Google OAuth handshake; identity establishment only. |
+| GET | `/api/bongos/auth/link/github/start` | `public` | — | an OAuth entry point that gates itself: with no live session it sends the person to /account, so only a signed-in person ever links (ADR … |
 | POST | `/api/bongos/auth/logout` | `any-builder` | — | own session, no rank gate (a Xenos can log themselves out). |
 | POST | `/api/bongos/auth/revoke` | `archon` | `session_id` | POST /auth/revoke — V3.R38 / task 259. |
 | POST | `/api/bongos/auth/revoke-all` | `archon` | `builder_id` | POST /auth/revoke-all — V3.R38 / task 259. |
 | GET | `/api/bongos/auth/web/admission-status` | `public` | — | GET /auth/web/admission-status?login=X — the probe renderAccessPendingPage polls (task 1002097). |
 | GET | `/api/bongos/auth/web/callback` | `public` | — | OAuth callback; the state cookie + code are the bearer. |
+| GET | `/api/bongos/auth/web/callback/link` | `public` | — | the OAuth callback for linking; the state cookie + code are the bearer, and the live session cookie names the person (no session: <redacted> |
 | GET | `/api/bongos/auth/web/handoff` | `public` | — | GET /auth/web/handoff?code=&return= — the far side of the one-time session handoff (task 1004357). |
 | GET | `/api/bongos/auth/web/start` | `public` | — | /auth/web — browser flow (used by the /builders page). |
 
@@ -525,7 +527,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/market-watch/ask` | `any-builder` | — | every member reads their own card; nobody else's (isMember in gate()). |
 | POST | `/api/bongos/market-watch/ask/answer` | `any-builder` | `week_of`, `picks`, `names`, `nothing`, `builder_id` | a member answers for themselves only (isMember in gate()). |
 
-## `me` (54)
+## `me` (55)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -576,6 +578,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/me/sessions/revoke` | `any-builder` | `session_id` | POST /api/bongos/me/sessions/revoke — kill ONE of the caller's own sessions. |
 | POST | `/api/bongos/me/sessions/revoke-all` | `any-builder` | validated | POST /api/bongos/me/sessions/revoke-all — sign out everywhere. |
 | GET | `/api/bongos/me/sign-in-methods` | `any-builder` | — | the ways the caller's OWN account signs in (task 1004992, ADR 0393): GitHub, Google, or both, with the address each provider vouched for. |
+| DELETE | `/api/bongos/me/sign-in-methods/:provider` | `any-builder` | — | remove one way in from the caller's OWN account (task 1004995), keyed on the authenticated person key. |
 | GET | `/api/bongos/me/skill-prefs` | `any-builder` | — | Per-builder skill model preferences (V3.R85 / task 304, migration 037). |
 | PATCH | `/api/bongos/me/skill-prefs` | `any-builder` | _undocumented_ | PATCH a partial set of skill overrides. |
 | GET | `/api/bongos/me/sound-prefs` | `any-builder` | — | Per-builder per-sound on/off preferences (V3.R91 / task 786, migration 075). |
@@ -723,7 +726,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PATCH | `/api/bongos/project-settings/ship-mode` | `metic+archon` | `mode` | PATCH /project-settings/ship-mode — body { mode: 'auto' \| 'manual' }. |
 | PATCH | `/api/bongos/project-settings/spend-cap` | `metic+archon` | `usd` | PATCH /project-settings/spend-cap — body { usd: number \| null } (task 1004712, ADR 0379). |
 | GET | `/api/bongos/project-settings/tweak-autopickup` | `any-builder` | — |  |
-| PATCH | `/api/bongos/project-settings/tweak-autopickup` | `metic+archon` | `mode`, `cap` | PATCH /project-settings/tweak-autopickup — body { mode?: 'off' \| 'on', cap?: n }. |
+| PATCH | `/api/bongos/project-settings/tweak-autopickup` | `metic+archon` | `mode`, `cap`, `rank_caps` | PATCH /project-settings/tweak-autopickup — body { mode?: 'off' \| 'on', cap?: n, rank_caps?: { <rank>: n \| null } }. |
 
 ## `projects` (8)