@bongos/core 1.17.0

package/tests/claude_materialize.mjs

@@ -0,0 +1,148 @@
+// tests/claude_materialize.mjs
+//
+// ADR 0108 §3 (configurable-root W3 / task 1883) — materialize the .claude/ surface into an instance
+// and rewrite `node scripts/gds/<x>.js` invocations to the `bongos` bin. Pins:
+//   1. bongosify — dedicated verb where one exists (bongos ship), else `bongos exec scripts/gds/<x>.js`;
+//      $CLAUDE_PROJECT_DIR/quotes stripped; args preserved; .claude/hooks/ refs left instance-local;
+//      idempotent.
+//   2. scriptToVerb — excludes prefixArgs verbs so api.js never mis-maps to `bongos box`.
+//   3. transformSettings — rewrites only the scripts/gds hook commands, keeps .claude/hooks/ ones.
+//   4. materializeClaude — copies + transforms skills into a target dir (no leftover node scripts/gds),
+//      writes settings.json, copies hooks; and NO-OPS when the target IS the core root (self-copy guard).
+//
+// Run:  node tests/claude_materialize.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, readdirSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const m = require('../scripts/gds/claude-materialize.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---- bongosify -------------------------------------------------------------
+t('bongosify: a script WITH a dedicated verb → bongos <verb> (args preserved)', () => {
+  assert.equal(m.bongosify('run `node scripts/gds/ship.js 1885 --force`'), 'run `bongos ship 1885 --force`');
+  assert.equal(m.bongosify('node scripts/gds/start.js --json'), 'bongos start --json');
+});
+
+t('bongosify: a script WITHOUT a dedicated verb → bongos exec (args preserved)', () => {
+  assert.equal(m.bongosify('node scripts/gds/api.js GET /api/gds/me'), 'bongos exec scripts/gds/api.js GET /api/gds/me');
+  assert.equal(m.bongosify('node scripts/gds/capture.js "x"'), 'bongos exec scripts/gds/capture.js "x"');
+});
+
+t('bongosify: $CLAUDE_PROJECT_DIR + surrounding quotes are stripped', () => {
+  assert.equal(m.bongosify('node "$CLAUDE_PROJECT_DIR/scripts/gds/session-cost.js"'), 'bongos exec scripts/gds/session-cost.js');
+});
+
+t('bongosify: a .claude/hooks/ reference is LEFT untouched (instance-local after materialize)', () => {
+  const cmd = 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/session-start.js"';
+  assert.equal(m.bongosify(cmd), cmd);
+});
+
+t('bongosify: idempotent + no-op on text with no invocation', () => {
+  assert.equal(m.bongosify('just prose, no commands'), 'just prose, no commands');
+  const once = m.bongosify('node scripts/gds/ship.js');
+  assert.equal(m.bongosify(once), once, 'running it again changes nothing');
+});
+
+// ---- scriptToVerb ----------------------------------------------------------
+t('scriptToVerb: dedicated verbs map; prefixArgs verbs (box/upgrade) are excluded', () => {
+  const map = m.scriptToVerb();
+  assert.equal(map['ship.js'], 'ship');
+  assert.equal(map['start.js'], 'start');
+  assert.equal(map['module.js'], 'module');
+  assert.equal(map['api.js'], undefined, 'api.js is only reachable via box (prefixArgs) → not a bare verb');
+});
+
+// ---- transformSettings -----------------------------------------------------
+t('transformSettings: rewrites scripts/gds hook commands, keeps .claude/hooks/ ones', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-set-'));
+  const settings = {
+    hooks: {
+      Stop: [{ hooks: [
+        { type: 'command', command: 'node "$CLAUDE_PROJECT_DIR/scripts/gds/session-cost.js"' },
+        { type: 'command', command: 'node "$CLAUDE_PROJECT_DIR/.claude/hooks/stop-sound.js"' },
+      ] }],
+    },
+  };
+  const p = join(dir, 'settings.json');
+  writeFileSync(p, JSON.stringify(settings, null, 2));
+  const out = JSON.parse(m.transformSettings(p));
+  const cmds = out.hooks.Stop[0].hooks.map((h) => h.command);
+  assert.deepEqual(cmds, [
+    'bongos exec scripts/gds/session-cost.js',
+    'node "$CLAUDE_PROJECT_DIR/.claude/hooks/stop-sound.js"',
+  ]);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+// ---- materializeClaude -----------------------------------------------------
+t('materializeClaude: copies + rewrites skills into a fresh instance dir (no leftover node scripts/gds)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'w3-inst-'));
+  const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: dir, dryRun: false });
+  assert.equal(res.skipped, false);
+  assert.ok(res.skills > 0, 'at least one skill materialized');
+  assert.ok(existsSync(join(dir, '.claude', 'skills')), '.claude/skills created in the instance');
+  // NO materialized skill may still say `node scripts/gds` — the transform must be total.
+  const leftovers = [];
+  const walk = (d) => {
+    for (const name of readdirSync(d, { withFileTypes: true })) {
+      const p = join(d, name.name);
+      if (name.isDirectory()) walk(p);
+      else if (p.endsWith('.md') && readFileSync(p, 'utf8').includes('node scripts/gds')) leftovers.push(p);
+    }
+  };
+  walk(join(dir, '.claude', 'skills'));
+  assert.deepEqual(leftovers, [], 'every skill invocation was rewritten to bongos');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('materializeClaude: SELF-COPY guard — target === core root is a no-op (byte-identical for the live instance)', () => {
+  const res = m.materializeClaude({ coreRoot: ROOT, instanceDir: ROOT, dryRun: false });
+  assert.equal(res.skipped, true, 'materializing onto the core root must skip');
+  assert.equal(res.skills, 0);
+});
+
+// ---- copyTreeTransformed overwrite flag (adopt layering, ADR 0121 / task 2042) --
+t('copyTreeTransformed: overwrite:false LEAVES a pre-existing dest file (reports it in skipped[])', () => {
+  const src = mkdtempSync(join(tmpdir(), 'w3-src-'));
+  const dest = mkdtempSync(join(tmpdir(), 'w3-dst-'));
+  writeFileSync(join(src, 'a.md'), 'node scripts/gds/ship.js 1');
+  writeFileSync(join(src, 'b.md'), 'node scripts/gds/start.js');
+  const ownerB = 'OWNER CONTENT — do not clobber';
+  writeFileSync(join(dest, 'b.md'), ownerB);         // b.md pre-exists at the destination
+  const res = m.copyTreeTransformed(src, dest, { overwrite: false });
+  assert.equal(res.files, 1, 'only the absent file was written');
+  assert.deepEqual(res.skipped, ['b.md']);
+  assert.equal(readFileSync(join(dest, 'a.md'), 'utf8'), 'bongos ship 1', 'absent file materialized + rewritten');
+  assert.equal(readFileSync(join(dest, 'b.md'), 'utf8'), ownerB, 'pre-existing file left byte-untouched');
+  rmSync(src, { recursive: true, force: true });
+  rmSync(dest, { recursive: true, force: true });
+});
+
+t('copyTreeTransformed: overwrite defaults true → greenfield still clobbers (regression)', () => {
+  const src = mkdtempSync(join(tmpdir(), 'w3-src-'));
+  const dest = mkdtempSync(join(tmpdir(), 'w3-dst-'));
+  writeFileSync(join(src, 'a.md'), 'node scripts/gds/start.js');
+  writeFileSync(join(dest, 'a.md'), 'OLD');
+  const res = m.copyTreeTransformed(src, dest);       // default overwrite:true
+  assert.equal(res.files, 1);
+  assert.deepEqual(res.skipped, []);
+  assert.equal(readFileSync(join(dest, 'a.md'), 'utf8'), 'bongos start', 'greenfield overwrites as before');
+  rmSync(src, { recursive: true, force: true });
+  rmSync(dest, { recursive: true, force: true });
+});
+
+console.log(`\nclaude_materialize: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/cli_box_scope.mjs

@@ -0,0 +1,52 @@
+// tests/cli_box_scope.mjs
+//
+// task 1050 (C): cli-lib detects a dev-box bootstrap-scoped 403 and turns it into
+// a guided re-auth (open the hall, re-issue, paste) instead of the raw
+// `failed to load profile: { error: 'box_scope' }` dump that was the #1027
+// nightmare's first wall. isBoxScope is the pure detector behind that — it must
+// fire ONLY on a genuine 403 box_scope, never on other 403s or other statuses
+// (a false positive would wrongly send a normally-authed builder to re-auth).
+//
+// Run:  node tests/cli_box_scope.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const lib = require('../scripts/gds/cli-lib.js');
+const { isBoxScope } = lib;
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}\n     ${err.message}`); }
+}
+
+test('isBoxScope: true ONLY for 403 + error "box_scope"', () => {
+  assert.equal(isBoxScope({ status: 403, data: { error: 'box_scope' } }), true);
+});
+
+test('isBoxScope: false for a different 403 (e.g. not_your_task) — must not hijack', () => {
+  assert.equal(isBoxScope({ status: 403, data: { error: 'not_your_task' } }), false);
+  assert.equal(isBoxScope({ status: 403, data: { error: 'forbidden' } }), false);
+});
+
+test('isBoxScope: false for box_scope error on the WRONG status', () => {
+  assert.equal(isBoxScope({ status: 401, data: { error: 'box_scope' } }), false);
+  assert.equal(isBoxScope({ status: 200, data: { error: 'box_scope' } }), false);
+});
+
+test('isBoxScope: false on a normal success', () => {
+  assert.equal(isBoxScope({ status: 200, data: { ok: true } }), false);
+});
+
+test('isBoxScope: false on missing/empty data (no crash)', () => {
+  assert.equal(isBoxScope({ status: 403, data: null }), false);
+  assert.equal(isBoxScope({ status: 403 }), false);
+  assert.equal(isBoxScope(null), false);
+  assert.equal(isBoxScope(undefined), false);
+});
+
+console.log('');
+console.log(`cli_box_scope: ${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/cli_lib_formatters.mjs

@@ -0,0 +1,87 @@
+// tests/cli_lib_formatters.mjs
+//
+// Unit test for the PURE display formatters exported from scripts/gds/cli-lib.js
+// (task 1491). These are the helpers the /builder-* CLI uses to render task rows:
+//   - fmtMinutes(m)   → human duration ("45m", "1h30m", "2h"; null → "—")
+//   - fmtUsd(n)       → "$X.XX" (null → "—")
+//   - fmtTouches(arr) → comma-joined, truncated to "a, b, c +N" past 3 entries
+//   - fmtEstimate(t)  → calibrated-vs-raw estimate display
+// All four are deterministic with no DB, network, filesystem, or live server, so
+// they unit-test standalone. Run: node tests/cli_lib_formatters.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const cli = require('../scripts/gds/cli-lib.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+test('fmtMinutes: sub-hour values stay in minutes', () => {
+  assert.equal(cli.fmtMinutes(0), '0m');
+  assert.equal(cli.fmtMinutes(45), '45m');
+  assert.equal(cli.fmtMinutes(59), '59m');
+});
+
+test('fmtMinutes: 60+ becomes hours, with remainder only when nonzero', () => {
+  assert.equal(cli.fmtMinutes(60), '1h');        // exact hour collapses
+  assert.equal(cli.fmtMinutes(90), '1h30m');     // hour + remainder
+  assert.equal(cli.fmtMinutes(120), '2h');       // exact multiple
+  assert.equal(cli.fmtMinutes(125), '2h5m');
+});
+
+test('fmtMinutes: null/undefined render the em-dash placeholder (edge)', () => {
+  assert.equal(cli.fmtMinutes(null), '—');
+  assert.equal(cli.fmtMinutes(undefined), '—');
+});
+
+test('fmtUsd: two-decimal dollar string', () => {
+  assert.equal(cli.fmtUsd(3), '$3.00');
+  assert.equal(cli.fmtUsd(0.5), '$0.50');
+  assert.equal(cli.fmtUsd(1.239), '$1.24');      // rounds via toFixed
+});
+
+test('fmtUsd: null renders the em-dash placeholder (edge)', () => {
+  assert.equal(cli.fmtUsd(null), '—');
+});
+
+test('fmtTouches: short lists join in full', () => {
+  assert.equal(cli.fmtTouches(['a']), 'a');
+  assert.equal(cli.fmtTouches(['a', 'b', 'c']), 'a, b, c');
+});
+
+test('fmtTouches: lists over 3 truncate to "first three +N"', () => {
+  assert.equal(cli.fmtTouches(['a', 'b', 'c', 'd']), 'a, b, c +1');
+  assert.equal(cli.fmtTouches(['a', 'b', 'c', 'd', 'e']), 'a, b, c +2');
+});
+
+test('fmtTouches: empty / missing render the em-dash placeholder (edge)', () => {
+  assert.equal(cli.fmtTouches([]), '—');
+  assert.equal(cli.fmtTouches(null), '—');
+  assert.equal(cli.fmtTouches(undefined), '—');
+});
+
+test('fmtEstimate: no calibration falls back to raw minutes', () => {
+  assert.equal(cli.fmtEstimate({ est_minutes: 90, est_minutes_calibrated: null }), '1h30m');
+  // raw also null → fmtMinutes(null) → em-dash (edge)
+  assert.equal(cli.fmtEstimate({ est_minutes: null, est_minutes_calibrated: null }), '—');
+});
+
+test('fmtEstimate: collapses to one number when raw==cal or within 20%', () => {
+  assert.equal(cli.fmtEstimate({ est_minutes: 60, est_minutes_calibrated: 60 }), '1h');
+  // 60 vs 65 → 8.3% gap < 20% → collapse to calibrated
+  assert.equal(cli.fmtEstimate({ est_minutes: 60, est_minutes_calibrated: 65 }), '1h5m');
+});
+
+test('fmtEstimate: shows both when calibrated differs from raw by >=20%', () => {
+  // 90 raw vs 5 cal → huge gap → "~5m (raw 1h30m)"
+  assert.equal(cli.fmtEstimate({ est_minutes: 90, est_minutes_calibrated: 5 }), '~5m (raw 1h30m)');
+});
+
+console.log(`\ncli-lib formatters (task 1491) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/cli_token_reissue.mjs

@@ -0,0 +1,147 @@
+// tests/cli_token_reissue.mjs — V3.R91 / #401.
+//
+// Verifies two slices of the portal CLI-bearer re-issue feature:
+//
+//   1. paste-token.js merge logic preserves existing session fields when
+//      writing a new bearer (the gemini_api_key invariant — registered via
+//      /builder-setup, must survive every subsequent token rotation).
+//
+//   2. The portal endpoint POST /api/gds/auth/cli-token/issue is wired
+//      correctly in src/bongos/routes/auth.js — it requires a cookie session
+//      (bearer-only requests must be rejected so a leaked bearer cannot mint
+//      replacements for itself), and it persists with source='cli'.
+//
+// These are static / pure-JS checks. The runtime contract (a real cookie
+// auth call into a live server) is exercised by smoke tests, not here, to
+// keep this file fast and dep-free.
+//
+// Run:  node tests/cli_token_reissue.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---------------------------------------------------------------------------
+// 1. paste-token.js merge invariant — exercised via the pure object spread
+//    that the script uses. We don't shell out to the script itself because
+//    that would require a live API to satisfy the verify step; instead we
+//    re-create the merge identically here.
+// ---------------------------------------------------------------------------
+
+console.log('paste-token.js merge invariants:');
+
+function mergeSession(existing, freshMe, freshToken, apiBase) {
+  // MUST match the implementation in scripts/gds/paste-token.js (function main,
+  // step 3). If the script changes, this test will diverge — that's the point.
+  return {
+    ...existing,
+    token: freshToken,
+    builder: freshMe.builder,
+    api_base: apiBase,
+  };
+}
+
+t('preserves gemini_api_key across token rotation', () => {
+  const existing = {
+    token: 'old-token',
+    builder: { id: '1', github_login: 'a' },
+    api_base: 'https://amazonprimea.com',
+    gemini_api_key: 'AIzaSy_TEST_KEY',
+  };
+  const merged = mergeSession(existing, { builder: { id: '1', github_login: 'a', rank: 'archon' } }, 'new-token-1234', 'https://amazonprimea.com');
+  assert.equal(merged.gemini_api_key, 'AIzaSy_TEST_KEY');
+  assert.equal(merged.token, 'new-token-1234');
+  assert.equal(merged.builder.rank, 'archon', 'fresh builder rank must overwrite stale rank');
+});
+
+t('writes token even when existing has no gemini_api_key', () => {
+  const existing = {
+    token: 'old',
+    builder: { id: '1', github_login: 'a' },
+    api_base: 'https://amazonprimea.com',
+  };
+  const merged = mergeSession(existing, { builder: { id: '1', github_login: 'a' } }, 'fresh', 'https://amazonprimea.com');
+  assert.equal(merged.token, 'fresh');
+  assert.equal(merged.gemini_api_key, undefined);
+});
+
+t('handles a completely empty existing session (first-time paste)', () => {
+  const merged = mergeSession({}, { builder: { id: '7', github_login: 'newbie' } }, 'first-token', 'https://amazonprimea.com');
+  assert.equal(merged.token, 'first-token');
+  assert.equal(merged.builder.id, '7');
+});
+
+t('forward-compatible: an unknown field (future-proofing) survives the merge', () => {
+  // Future per-builder configurable allocation (idea_inbox #30) might add new
+  // session fields. Document that this script does not drop them.
+  const existing = {
+    token: 'old',
+    builder: { id: '1' },
+    api_base: 'https://amazonprimea.com',
+    gemini_api_key: 'k',
+    model_preference: 'opus-only', // hypothetical future field
+  };
+  const merged = mergeSession(existing, { builder: { id: '1' } }, 'new', 'https://amazonprimea.com');
+  assert.equal(merged.model_preference, 'opus-only');
+});
+
+// ---------------------------------------------------------------------------
+// 2. Endpoint wiring static check. Confirms the route exists with the right
+//    security shape. A network/integration test belongs in smoke; this file
+//    exists to catch refactor regressions cheaply.
+// ---------------------------------------------------------------------------
+
+console.log('\nendpoint wiring (src/bongos/routes/auth.js):');
+
+const routeSrc = fs.readFileSync(path.resolve('src/bongos/routes/auth.js'), 'utf8');
+
+t('POST /auth/cli-token/issue is defined', () => {
+  assert.ok(routeSrc.includes("'/auth/cli-token/issue'"),
+    'route path literal missing');
+  assert.ok(/router\.post\([^,]+,\s*auth\.requireBuilder\b/.test(
+    routeSrc.split("'/auth/cli-token/issue'")[1] || ''
+  ), 'route is not wrapped in auth.requireBuilder');
+});
+
+// Sub-string the route handler block so subsequent regex checks are scoped.
+const issueBlock = (() => {
+  const start = routeSrc.indexOf("'/auth/cli-token/issue'");
+  if (start === -1) return '';
+  // crude but enough: take ~3000 chars from the route literal forward.
+  return routeSrc.slice(start, start + 3000);
+})();
+
+t("the issue handler reads SESSION_COOKIE (not just Authorization)", () => {
+  assert.ok(issueBlock.includes('parseCookie(req, SESSION_COOKIE)'),
+    'handler must use parseCookie(req, SESSION_COOKIE)');
+});
+
+t('the issue handler rejects bearer-only callers with cookie_required', () => {
+  assert.ok(issueBlock.includes("cookie_required"),
+    "error code 'cookie_required' missing");
+  assert.ok(/status\(403\)/.test(issueBlock),
+    'must respond with 403 when cookie is missing');
+});
+
+t("mints a session with source='cli' (CHECK constraint compliant)", () => {
+  assert.ok(/source:\s*['"]cli['"]/.test(issueBlock),
+    "createSession call must pass source: 'cli' (the CHECK enum is 'cli' | 'web')");
+});
+
+t('returns a paste_command field the portal can show verbatim', () => {
+  assert.ok(issueBlock.includes('paste_command'),
+    'response should include paste_command for one-click UX');
+});
+
+// ---------------------------------------------------------------------------
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/client_bundle_route.mjs

@@ -0,0 +1,47 @@
+// tests/client_bundle_route.mjs
+//
+// The generated typed client is served to classic <script> web pages at
+// /lib/bongos-client.js (task 1996 / R09). This guards that serve-internal
+// actually serves the COMMITTED browser-global build there — with the right
+// MIME + the BongosClient global — so the hall/status pages can consume the same
+// client the CLI uses. serve-internal is DB-free (the pg pool connects lazily),
+// so we mount it on a throwaway express app and hit the route over loopback.
+//
+// Run:  node tests/client_bundle_route.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+async function withServer(fn) {
+  const express = require('express');
+  const { mountInternalSurfaces } = require('../src/bongos/serve-internal.js');
+  const app = express();
+  mountInternalSurfaces(app);
+  const server = await new Promise((resolve) => {
+    const s = app.listen(0, () => resolve(s));
+  });
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}`);
+  } finally {
+    await new Promise((r) => server.close(r));
+  }
+}
+
+test('/lib/bongos-client.js serves the committed browser-global build', async () => {
+  await withServer(async (base) => {
+    const res = await fetch(base + '/lib/bongos-client.js');
+    assert.equal(res.status, 200);
+    assert.match(res.headers.get('content-type') || '', /javascript/);
+    const body = await res.text();
+    const onDisk = fs.readFileSync(path.join(ROOT, 'clients/bongos-client/bongos-client.global.js'), 'utf8');
+    assert.equal(body, onDisk, 'served bytes must equal the committed bundle (single source of truth)');
+    assert.match(body, /global\.BongosClient =/, 'bundle exposes window.BongosClient');
+  });
+});

package/tests/cloud_bongos_pack.mjs

@@ -0,0 +1,85 @@
+// tests/cloud_bongos_pack.mjs — the Cloud Bongos vanilla brand pack (R74 / task 1216,
+// ADR 0064). "Verified on the standalone boot", executable: a vanilla instance (no
+// config/branding.json → the neutral starter ALONE) resolves to the Cloud Bongos
+// identity, and the served-HTML theme injection paints the sunrise look. This is
+// the customer-0 pack Cloud Bongos itself runs on.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import brandingMod from '../src/branding.js';
+import serveInternal from '../src/bongos/serve-internal.js';
+
+const { loadBranding, clientBranding } = brandingMod;
+const { themeMarkup, injectBrandingGlobal } = serveInternal;
+
+// A standalone/vanilla boot has NO instance config — point the loader at a
+// nonexistent instance path so it resolves the neutral starter alone (the
+// fail-to-vanilla path), exactly as a fresh `node src/platform-server.js` would.
+function vanilla() {
+  return loadBranding({ instancePath: '/no/such/instance/branding.json', env: {} });
+}
+
+test('R74: a vanilla boot resolves to the Cloud Bongos identity', () => {
+  const b = vanilla();
+  assert.equal(b.identity.productName, 'Cloud Bongos');
+  assert.equal(b.identity.worldName, 'Cloud Bongos');
+  assert.equal(b.currency.label, 'credits'); // not "drachmae"
+  assert.equal(b.envPrefix, 'CLOUDBONGOS');
+});
+
+test('R74: the vanilla pack carries the Cloud Bongos LOOK (sunrise palette, Baloo 2/Quicksand, bongo favicon)', () => {
+  const c = clientBranding(vanilla());
+  assert.equal(c.theme.colors.accent, '#f97316', 'sunrise orange accent');
+  assert.equal(c.theme.colors.bg, '#fff7ed', 'warm sunrise base');
+  assert.match(c.theme.fonts.display, /Baloo 2/);
+  assert.match(c.theme.fonts.body, /Quicksand/);
+  assert.ok(c.theme.fonts.links.some((l) => /Baloo\+2/.test(l) && /Quicksand/.test(l) && /Fira\+Code/.test(l)), 'loads Baloo 2 + Quicksand + Fira Code');
+  assert.match(c.theme.favicon, /circle/, 'bongo-pair favicon (circles), not the Greek Α');
+  assert.doesNotMatch(c.theme.favicon, /font-family='serif'>Α/);
+  assert.match(c.theme.backdrop, /linear-gradient\(180deg/, 'sunrise backdrop gradient');
+  assert.equal(c.copy.tagline, 'Building software is laying down a beat.');
+  assert.equal(c.rankLabels.archon, 'Owner', 'plain rank labels, not "Archon"');
+});
+
+test('R74: serving the hall on a vanilla boot injects the Cloud Bongos sunrise theme', () => {
+  const c = clientBranding(vanilla());
+  const html = '<head><link rel="stylesheet" href="/builders/style.css"><title>x</title></head><body></body>';
+  const out = injectBrandingGlobal(html, c);
+  // palette override + sunrise body backdrop + bongo favicon + the type links
+  assert.match(out, /:root\{[^}]*--accent:#f97316;/);
+  assert.match(out, /body\{background:linear-gradient\(180deg/);
+  assert.match(out, /<link rel="icon" href="data:image\/svg\+xml[^"]*circle/);
+  assert.match(out, /fonts\.googleapis\.com\/css2\?family=Baloo\+2/);
+  // and it lands AFTER the stylesheet so the Cloud Bongos look wins
+  assert.ok(out.indexOf('/builders/style.css') < out.indexOf('--accent:#f97316'));
+});
+
+test('R74: themeMarkup paints the backdrop only when the pack supplies one', () => {
+  // OTB-shaped pack (no backdrop) → no body{background} rule.
+  const otb = themeMarkup({ colors: { bg: '#ece0c2' }, fonts: { links: [] }, favicon: '', backdrop: '' });
+  assert.doesNotMatch(otb, /body\{background/);
+  // Cloud Bongos pack → backdrop present.
+  assert.match(themeMarkup(clientBranding(vanilla()).theme), /body\{background:linear-gradient/);
+});
+
+test('customer-0: GDS_BRANDING_FILE selects the cloudbongos.com instance pack (task 1374)', () => {
+  // The live dogfood instance runs from the SAME checkout as OTB; the env knob
+  // points this process at its own pack (deltas over neutral) instead of OTB's
+  // config/branding.json. Proves the brand-switch + the cloudbongos pack content.
+  const b = loadBranding({ env: { GDS_BRANDING_FILE: 'config/branding.cloudbongos.json' } });
+  assert.equal(b.identity.productName, 'Cloud Bongos'); // from neutral
+  assert.equal(b.currency.label, 'credits');            // from neutral, not "drachmae"
+  assert.equal(b.llmProjectName, 'Cloud Bongos');       // grader/onboarding identity
+  assert.equal(b.domains.publicOrigin, 'https://cloudbongos.com');
+  assert.equal(b.domains.buildersOrigin, 'https://builders.cloudbongos.com');
+  assert.equal(b.domains.statusOrigin, 'https://status.cloudbongos.com');
+  assert.equal(b.domains.cookieDomain, '.cloudbongos.com');
+  assert.equal(b.db.database, 'cloudbongos');
+  assert.equal(b.firstAdmin, 'lars589');
+});
+
+test('customer-0: no GDS_BRANDING_FILE still resolves OTB (default unchanged)', () => {
+  // The OTB process (server.js) sets no GDS_BRANDING_FILE → config/branding.json.
+  const b = loadBranding({ env: {} });
+  assert.equal(b.identity.worldName, 'Amazonprimea');
+  assert.equal(b.currency.label, 'drachmae');
+});