@bongos/core 1.25.19 → 1.25.21

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 730 endpoints across 124 route files.
+> **Generated from the live route files** — the route file is authoritative. 736 endpoints across 125 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -346,7 +346,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/founding/skip` | `any-builder` | — | Skip genesis: the owner opens the full hall from any stage, no sitting, no gate. |
 | POST | `/api/bongos/founding/stages/:stage/close` | `any-builder` | — | task 1005121: one call. |
 | POST | `/api/bongos/founding/start` | `any-builder` | — |  |
-| GET | `/api/bongos/founding/work` | `any-builder` | — | The read path for every door and for AI sessions planning a goal or task. |
+| GET | `/api/bongos/founding/work` | `any-builder` | — |  |
 | GET | `/api/bongos/founding/work/:stage` | `any-builder` | — |  |
 | PUT | `/api/bongos/founding/work/:stage/answers/:question` | `any-builder` | `state`, `text`, `origin`, `if_empty` |  |
 | DELETE | `/api/bongos/founding/work/:stage/answers/:question` | `any-builder` | — | Un-answer: back to empty, which is not the same as skipped. |
@@ -357,7 +357,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PUT | `/api/bongos/founding/work/:stage/link` | `any-builder` | `url` |  |
 | PUT | `/api/bongos/founding/work/:stage/page` | `any-builder` | `page` |  |
 
-## `front-door-guide` (7)
+## `front-door-guide` (8)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -367,6 +367,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/front-door-guide/conversations/:id/messages` | `public` | `token`, `text`, `website`, `starting_point` | one visitor message, one guide reply. |
 | POST | `/api/bongos/front-door-guide/conversations/:id/plan` | `public` | `token`, `website` | the visitor has no account yet. |
 | GET | `/api/bongos/front-door-guide/mine` | `any-builder` | — | my newest chat and plan (the creation wizard's pre-fill reads it). |
+| GET | `/api/bongos/front-door-guide/mine/handoff.md` | `any-builder` | — | my plan as the hand-off file (task 1005274), offered as a download on the creation page. |
 | GET | `/api/bongos/front-door-guide/status` | `public` | — | the landing asks before it offers the chat. |
 
 ## `github` (8)
@@ -869,7 +870,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: where to invite a builder into a project, asked by a `project.curate` holder OR the project's OWN OWNER (task 100… |
 | POST | `/api/bongos/projects/invite-guild` | `metic+archon` | `client_id`, `guild` | own-or-metic in effect, the SAME gate as POST /projects/invite above and for the same reasons (a non-inviter gets that route's unchanged … |
 
-## `provisioning` (48)
+## `provisioning` (53)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -883,7 +884,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/provisioning/github-app/status` | `public` | — | GET /provisioning/github-app/status?state=<> — the PUBLIC progress read (task 1004548; the checklist since task 1004649). |
 | GET | `/api/bongos/provisioning/health` | `public` | — | GET /provisioning/health — liveness + the core version this module mounted against. |
 | GET | `/api/bongos/provisioning/instances` | `any-builder` | — | GET /provisioning/instances — the caller's own instances + each open intent. |
-| POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `no_address`, `tier`, `onboard_mode`, `type`, `description`, `detail`, `modules`, `terms_acknowledged`, `demo`, `ship_mode`, `genesis`, `test` | POST /provisioning/instances — request a new instance. |
+| POST | `/api/bongos/provisioning/instances` | `any-builder` | `slug`, `target_ref`, `hosting_shape`, `domain`, `no_address`, `tier`, `onboard_mode`, `type`, `description`, `detail`, `modules`, `terms_acknowledged`, `demo`, `ship_mode`, `genesis`, `test`, `from_guide` | POST /provisioning/instances — request a new instance. |
 | GET | `/api/bongos/provisioning/instances/:id` | `any-builder` | — | GET /provisioning/instances/:id — read one instance (the manage page's read). |
 | GET | `/api/bongos/provisioning/instances/:id/core-upgrade` | `archon` | — | GET the same path — step ONE of the two-step (ADR 0293 D4): what a move would do. |
 | POST | `/api/bongos/provisioning/instances/:id/core-upgrade` | `archon` | — | POST /provisioning/instances/:id/core-upgrade — move the core pin. |
@@ -898,6 +899,9 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account`, `org` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | POST | `/api/bongos/provisioning/instances/:id/github-app/pick-up` | `any-builder` | — | POST /provisioning/instances/:id/github-app/pick-up — "Pick up where it stopped" and "Check again" (task 1004652). |
+| GET | `/api/bongos/provisioning/instances/:id/grants` | `any-builder` | — | GET /provisioning/instances/:id/grants — the project's live grants. |
+| POST | `/api/bongos/provisioning/instances/:id/grants` | `any-builder` | `github_login` | POST /provisioning/instances/:id/grants { github_login } — give a person access. |
+| DELETE | `/api/bongos/provisioning/instances/:id/grants/:grantId` | `any-builder` | — | DELETE /provisioning/instances/:id/grants/:grantId — take access back. |
 | GET | `/api/bongos/provisioning/instances/:id/invite-suggestions` | `any-builder` | — | ── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the … |
 | PUT | `/api/bongos/provisioning/instances/:id/logo` | `any-builder` | `image_b64`, `content_type` | PUT …/logo — rank: any authenticated builder (own resource; archon may change any). |
 | DELETE | `/api/bongos/provisioning/instances/:id/logo` | `any-builder` | validated | DELETE …/logo — rank: any authenticated builder (own resource; archon may change any). |
@@ -905,6 +909,8 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | PATCH | `/api/bongos/provisioning/instances/:id/look` | `any-builder` | `look`, `night_tint`, `accent` | PATCH — rank: any authenticated builder (own resource; archon may change any). |
 | GET | `/api/bongos/provisioning/instances/:id/render` | `any-builder` | — | GET /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER ONLY, like the POST (task 1004353). |
 | POST | `/api/bongos/provisioning/instances/:id/render` | `any-builder` | `key`, `owner_id`, `mode`, `service_id`, `web_plan`, `db_plan`, `region`, `runtime`, `build_command`, `start_command`, `database` | POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER ONLY: the key is the owner's and so is the account i… |
+| POST | `/api/bongos/provisioning/instances/:id/render/promote` | `any-builder` | `key`, `commit_id`, `expect_live_commit` | POST /provisioning/instances/:id/render/promote — rank: any authenticated builder, and OWNER ONLY: the key and the live app are the owner… |
+| POST | `/api/bongos/provisioning/instances/:id/render/promote/look` | `any-builder` | `key` | POST /provisioning/instances/:id/render/promote/look — rank: any authenticated builder, and OWNER ONLY. |
 | POST | `/api/bongos/provisioning/instances/:id/render/sandbox` | `any-builder` | `key` | POST /provisioning/instances/:id/render/sandbox — rank: any authenticated builder, and OWNER ONLY, like every Render route. |
 | POST | `/api/bongos/provisioning/instances/:id/repo-private` | `any-builder` | validated | POST /provisioning/instances/:id/repo-private — rank: any authenticated builder, and OWNER ONLY: no archon override, because the runner f… |
 | POST | `/api/bongos/provisioning/instances/:id/restart` | `any-builder` | — | POST /provisioning/instances/:id/restart — restart an ACTIVE project the heartbeat cannot reach (task 1003238). |