@bongos/core 1.25.21 → 1.25.22

package/docs/api/openapi.json

@@ -8125,6 +8125,77 @@
         ]
       }
     },
+    "/founding/facts": {
+      "get": {
+        "operationId": "get_founding_facts",
+        "tags": [
+          "founding"
+        ],
+        "summary": "GET /founding/facts",
+        "description": "The project's own facts and the legalize stage's options (task 1005129, ../project-facts.js): any builder reads them; the facts are the owner's to change, like every genesis write.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/onboarding/routes/genesis-work.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "put": {
+        "operationId": "put_founding_facts",
+        "tags": [
+          "founding"
+        ],
+        "summary": "PUT /founding/facts",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/onboarding/routes/genesis-work.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutFoundingFactsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/founding/genesis": {
       "get": {
         "operationId": "get_founding_genesis",
@@ -8156,6 +8227,37 @@
         ]
       }
     },
+    "/founding/legalize/options": {
+      "get": {
+        "operationId": "get_founding_legalize_options",
+        "tags": [
+          "founding"
+        ],
+        "summary": "GET /founding/legalize/options",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/onboarding/routes/genesis-work.js",
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/founding/plan": {
       "post": {
         "operationId": "post_founding_plan",
@@ -9454,6 +9556,55 @@
         ]
       }
     },
+    "/github/repos/upload": {
+      "post": {
+        "operationId": "post_github_repos_upload",
+        "tags": [
+          "github"
+        ],
+        "summary": "POST /github/repos/upload",
+        "description": "create a project's repository FROM A FOLDER the person uploaded (task 1005282): papers, artwork or scaffolding, for someone with no repository. The whole upload is checked first (folder-upload.js: sizes, refused types, path safety), and a refusal comes back with each file's plain reason BEFORE the repo exists. Then the private repo is made exactly as POST /github/repos makes it, and the files go in as one commit on main, pushed with the caller's OWN token. The files are never read for meaning and never sent to an AI service. If the push fails after the repo was made, the same builder may retry into THAT repo (`into`), and no other.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGithubReposUploadRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostGithubReposUploadResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/goal-task-relevance/pending": {
       "get": {
         "operationId": "get_goal_task_relevance_pending",
@@ -39980,6 +40131,38 @@
           "repo"
         ]
       },
+      "PostGithubReposUploadRequest": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "maxLength": 100
+          },
+          "org": {
+            "type": "string",
+            "maxLength": 39
+          },
+          "into": {
+            "type": "string",
+            "maxLength": 140
+          },
+          "files": {
+            "type": "array"
+          }
+        },
+        "additionalProperties": false
+      },
+      "PostGithubReposUploadResponse": {
+        "type": "object",
+        "properties": {
+          "repo": {},
+          "uploaded": {}
+        },
+        "required": [
+          "repo",
+          "uploaded"
+        ]
+      },
       "PostGoalTaskRelevanceIdDecideRequest": {
         "type": "object",
         "properties": {
@@ -45550,6 +45733,18 @@
         },
         "additionalProperties": false
       },
+      "PutFoundingFactsRequest": {
+        "type": "object",
+        "properties": {
+          "facts": {
+            "type": "object"
+          }
+        },
+        "required": [
+          "facts"
+        ],
+        "additionalProperties": false
+      },
       "PutFoundingWorkStageAnswersQuestionRequest": {
         "type": "object",
         "properties": {
@@ -45995,9 +46190,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 736,
-  "x-schema-count": 764,
+  "x-endpoint-count": 740,
+  "x-schema-count": 767,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 475,
+  "x-response-schemas": 476,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 736 endpoints across 125 route files.
+> **Generated from the live route files** — the route file is authoritative. 740 endpoints across 125 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -333,7 +333,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/first-read/maps/:id/reject` | `metic+archon` | — | .create — the owner's no. |
 | GET | `/api/bongos/first-read/prompt` | `any-builder` | — | the prompt and the shape are instructions, not project data. |
 
-## `founding` (19)
+## `founding` (22)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -341,7 +341,10 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/founding/builders` | `any-builder` | — | The founding mark (task 1004424): who joined while the project was founding, in join order, with the stage each joined at. |
 | GET | `/api/bongos/founding/context` | `any-builder` | — |  |
 | PUT | `/api/bongos/founding/enabled` | `any-builder` | `enabled` | The Test features panel's genesis switch (task 1005036): a test project only, the owner's call. |
+| GET | `/api/bongos/founding/facts` | `any-builder` | — | The project's own facts and the legalize stage's options (task 1005129, ../project-facts.js): any builder reads them; the facts are the o… |
+| PUT | `/api/bongos/founding/facts` | `any-builder` | `facts` |  |
 | GET | `/api/bongos/founding/genesis` | `any-builder` | — | A project born through the startup flow enters genesis on its first founding read (founding-birth.js, task 1004506) — here and on GET /me… |
+| GET | `/api/bongos/founding/legalize/options` | `any-builder` | — |  |
 | POST | `/api/bongos/founding/plan` | `any-builder` | `days`, `passes`, `advisors`, `government`, `expected_builders`, `existing` | The plan's ranges and vocabularies are genesis-home.js parsePlan's (one source); this schema only names the fields so an unknown one is r… |
 | POST | `/api/bongos/founding/skip` | `any-builder` | — | Skip genesis: the owner opens the full hall from any stage, no sitting, no gate. |
 | POST | `/api/bongos/founding/stages/:stage/close` | `any-builder` | — | task 1005121: one call. |
@@ -370,7 +373,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/front-door-guide/mine/handoff.md` | `any-builder` | — | my plan as the hand-off file (task 1005274), offered as a download on the creation page. |
 | GET | `/api/bongos/front-door-guide/status` | `public` | — | the landing asks before it offers the chat. |
 
-## `github` (8)
+## `github` (9)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -382,6 +385,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/github/repo/visibility` | `any-builder` | `repo`, `visibility` | flips one of the caller's repos PUBLIC, with their own credential. |
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
 | POST | `/api/bongos/github/repos` | `any-builder` | `name`, `org` | creates a repo in the caller's OWN account, or (task 1004651) under an organisation they name in `org`. |
+| POST | `/api/bongos/github/repos/upload` | `any-builder` | `name`, `org`, `into`, `files` | create a project's repository FROM A FOLDER the person uploaded (task 1005282): papers, artwork or scaffolding, for someone with no repos… |
 
 ## `goal-task-relevance` (2)