@bongos/core 1.17.3 → 1.18.3

package/public-landing/index.html

@@ -45,20 +45,17 @@ body{
 .stage{
   position:relative;z-index:1;min-height:100vh;
   display:flex;flex-direction:column;align-items:center;justify-content:center;
-  text-align:center;padding:48px 24px 110px;gap:8px;
+  text-align:center;padding:48px 24px 64px;gap:8px;
 }
 /* a soft white glow behind the mascot so a white- or transparent-bg PNG blends */
 .hero-mascot{
   position:relative;width:min(540px,86vw);margin-bottom:6px;
-  /* cap by height on short viewports so the hall CTA + sign-in hint always clear
-     the fixed footer (task 2094); on tall desktops the width cap wins, unchanged */
-  max-height:50vh;display:flex;justify-content:center;
 }
 .hero-mascot::before{
   content:"";position:absolute;inset:-6% -10%;z-index:-1;border-radius:50%;
   background:radial-gradient(ellipse at center, rgba(255,255,255,0.95) 0%, rgba(255,255,255,0.7) 45%, rgba(255,255,255,0) 72%);
 }
-.hero-mascot img{display:block;width:100%;height:auto;max-height:50vh;object-fit:contain;}
+.hero-mascot img{display:block;width:100%;height:auto;}
 /* fallback shown if buddha.png is not present yet */
 .mascot-fallback{
   width:min(540px,86vw);aspect-ratio:1.6/1;border-radius:28px;
@@ -80,27 +77,9 @@ body{
   border:none;border-radius:999px;padding:15px 32px;text-decoration:none;
   display:inline-flex;align-items:center;gap:9px;
   background:var(--accent);color:#fff;box-shadow:0 12px 28px -10px var(--accent);
-  transition:transform .12s ease, box-shadow .12s ease, background .12s ease;
+  transition:transform .12s ease, box-shadow .12s ease;
 }
 .btn:hover{transform:translateY(-1px);box-shadow:0 16px 34px -10px var(--accent);}
-.btn.ghost{background:rgba(255,255,255,0.75);color:var(--ink);box-shadow:0 6px 18px -8px rgba(42,31,23,0.25);}
-.btn.ghost:hover{box-shadow:0 10px 24px -8px rgba(42,31,23,0.3);}
-/* signed-out: the create door is visible but resting — it hints, and clicking it
-   starts the GitHub sign-in (returning straight into /create). */
-.btn.resting{background:#eeddc8;color:#a08a74;box-shadow:none;}
-.btn.resting:hover{background:#ecd6ba;transform:none;box-shadow:none;}
-.cta-row{display:flex;gap:14px;flex-wrap:wrap;justify-content:center;}
-.signin-hint{font-size:13.5px;font-weight:600;color:var(--ink-soft);margin-top:14px;min-height:19px;}
-.signin-hint a{color:var(--accent-deep);text-decoration:none;font-weight:700;}
-.signin-hint a:hover{text-decoration:underline;}
-.who{
-  position:fixed;top:16px;right:20px;z-index:2;display:flex;align-items:center;gap:9px;
-  font-size:14px;font-weight:600;color:var(--ink-soft);min-height:30px;
-}
-.who img{width:28px;height:28px;border-radius:50%;border:2px solid #fff;box-shadow:0 2px 8px rgba(42,31,23,0.14);}
-.who a{color:var(--accent-deep);text-decoration:none;font-weight:700;}
-.who a:hover{text-decoration:underline;}
-.who .who-act{padding-left:10px;margin-left:2px;border-left:1px solid rgba(42,31,23,0.18);}
 .foot{
   position:fixed;bottom:18px;left:0;right:0;z-index:1;text-align:center;
   color:var(--ink-soft);font-size:13px;opacity:0.8;
@@ -119,68 +98,24 @@ body{
   </div>
   <div class="wordmark" data-brand-product>cloud bongos</div>
   <p class="tagline" data-brand-tagline>Building software is laying down a beat.</p>
-  <div class="cta-row">
-    <a class="btn" id="hallBtn" data-link-hall href="https://builders.cloudbongos.com">Enter the Hall →</a>
-  </div>
-  <p class="signin-hint" id="signinHint" aria-live="polite"></p>
+  <a class="btn" data-link-hall href="https://builders.cloudbongos.com">Enter the Hall →</a>
 </main>
-<div class="who" id="who" aria-live="polite"></div>
 
 <div class="foot">A non-profit, capture-resistant commons. Built by agents, on Cloud Bongos.</div>
 
 <script>
 /* Brand-pack fill (R57). The server injects window.__BRANDING__ synchronously
-   ahead of this script (src/bongos/serve-internal.js); the baked markup above is
+   ahead of this script (src/gds/serve-internal.js); the baked markup above is
    the no-JS / standalone fallback. A differently-branded game-less instance
    overrides the product name, tagline, and Hall link from its own config. */
 (function () {
   var b = (typeof window !== 'undefined' && window.__BRANDING__) || null;
-  if (b) {
-    var id = b.identity || {}, copy = b.copy || {}, dom = b.domains || {};
-    var set = function (sel, val){ if(!val) return; document.querySelectorAll(sel).forEach(function(n){ n.textContent = val; }); };
-    if (id.productName) set('[data-brand-product]', id.productName.toLowerCase());
-    if (copy.tagline) set('[data-brand-tagline]', copy.tagline);
-    if (dom.buildersOrigin) document.querySelectorAll('[data-link-hall]').forEach(function(n){ n.setAttribute('href', dom.buildersOrigin); });
-  }
-
-  /* Membership-aware hall access (goal 35, task 2094). This is a PROJECT's own
-     landing page. Signed in as an admitted builder here → "Enter the Hall".
-     Otherwise → "Request access" (this project's own hall shows the request-
-     access card), with a quiet "already a builder? sign in" for returning
-     builders. Sign-in is itself gated to approved builders (auth.js), so a
-     newcomer who tries it is routed to request access anyway. The identity +
-     action live top-right. Degrades to the request-access visual when the API
-     is unreachable (static preview / standalone viewing). */
-  var hallHref = (b && b.domains && b.domains.buildersOrigin) || 'https://builders.cloudbongos.com';
-  var signInHref = '/api/bongos/auth/web/start?return=' + encodeURIComponent('/');
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
-  var hallBtn = document.getElementById('hallBtn');
-  var signinHint = document.getElementById('signinHint');
-  var who = document.getElementById('who');
-
-  function showSignedOut() {
-    if (hallBtn) { hallBtn.textContent = 'Request access'; hallBtn.setAttribute('href', hallHref); }
-    if (signinHint) signinHint.innerHTML = 'Already a builder here? <a href="' + signInHref + '">Sign in with GitHub</a>.';
-    if (who) who.innerHTML = '<a href="' + signInHref + '">Sign in with GitHub</a>';
-  }
-  function showMember(me) {
-    if (hallBtn) { hallBtn.textContent = 'Enter the Hall →'; hallBtn.setAttribute('href', hallHref); }
-    if (signinHint) signinHint.textContent = '';
-    if (who) who.innerHTML =
-      (me.avatar_url ? '<img src="' + esc(me.avatar_url) + '" alt="">' : '') +
-      '<span>' + esc(me.github_login || 'signed in') + '</span>' +
-      '<a class="who-act" href="' + hallHref + '">Enter hall →</a>';
-  }
-
-  showSignedOut();   // default until /me resolves (and the no-JS request-access intent)
-  fetch('/api/bongos/me', { credentials: 'same-origin' })
-    .then(function (res) { if (!res.ok) throw new Error(String(res.status)); return res.json(); })
-    .then(function (data) { showMember(data.builder || data.me || data); })
-    .catch(function () { /* signed out / not a member / unreachable: request-access visual stands */ });
+  if (!b) return;
+  var id = b.identity || {}, copy = b.copy || {}, dom = b.domains || {};
+  function set(sel, val){ if(!val) return; document.querySelectorAll(sel).forEach(function(n){ n.textContent = val; }); }
+  if (id.productName) set('[data-brand-product]', id.productName.toLowerCase());
+  if (copy.tagline) set('[data-brand-tagline]', copy.tagline);
+  if (dom.buildersOrigin) document.querySelectorAll('[data-link-hall]').forEach(function(n){ n.setAttribute('href', dom.buildersOrigin); });
 })();
 </script>
 </body>

package/scripts/gds/cli-lib.js

@@ -27,10 +27,16 @@ const SESSION_READ_PATHS = [
   ...ic.configReadPaths('gds-session.json'),
   ...ic.configReadPaths('pms-session.json'),
 ];
-// Default to live production. Override with <PREFIX>_API_BASE for local dev:
+// The last-resort default API base — THIS instance's own publicOrigin from the
+// branding pack (task 1002201). One source of truth in instance-config so no CLI
+// script hard-codes another instance's URL; pre-ADR-0139 the literal
+// 'https://amazonprimea.com' was baked in at four sites here, so an unconfigured
+// consumer targeted the founder's (game-only) box. Override with <PREFIX>_API_BASE
+// for local dev / staging:
 //   CLOUDBONGOS_API_BASE=http://localhost:3000 node scripts/gds/start.js
 // Resolves the configured prefix first, then legacy GDS_/OTB_/PMS_API_BASE.
-const API_BASE = ic.resolveEnv('API_BASE') || 'https://amazonprimea.com';
+const DEFAULT_API_BASE = ic.defaultApiBase();
+const API_BASE = ic.resolveEnv('API_BASE') || DEFAULT_API_BASE;
 
 async function readSessionFile(p) {
   try {
@@ -102,7 +108,7 @@ function readSessionToken() {
   if (!j || !j.token) return null;
   return {
     token: j.token,
-    apiBase: ic.resolveEnv('API_BASE') || j.api_base || 'https://amazonprimea.com',
+    apiBase: ic.resolveEnv('API_BASE') || j.api_base || DEFAULT_API_BASE,
   };
 }
 
@@ -278,7 +284,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
   // (local dev / staging override), then the logged-in instance, then prod. OTB
   // sessions already store api_base='https://amazonprimea.com', so this is a no-op
   // for the OTB instance and only bites once someone logs in to a different one.
-  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || 'https://amazonprimea.com';
+  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || DEFAULT_API_BASE;
   const headers = {
     'Content-Type': 'application/json',
     'User-Agent': 'amazonprimea-gds-cli/1.0',
@@ -349,7 +355,7 @@ async function cliClient(opts = {}) {
       printInstanceMismatchAndExit(mm);
     }
   }
-  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || 'https://amazonprimea.com';
+  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || DEFAULT_API_BASE;
   const token = (session && session.token) || null;
   const key = `${base}|${token || ''}|${allowUnauthenticated}|${allowBoxScope}`;
   if (_clientCache.has(key)) return _clientCache.get(key);

package/scripts/gds/lint-migrations.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+'use strict';
+// scripts/gds/lint-migrations.js — core-migration FORWARD-SAFETY guard (task 1002223 / audit H10,
+// finding F6).
+//
+// `bongos upgrade` auto-rollback reverts the CODE pin but DELIBERATELY NOT the database
+// (upgrade.js: "the DB is deliberately NOT rolled back … core migrations are additive + forward-
+// safe"). That safety rested on a convention nothing checked. A core migration is FORWARD-SAFE when
+// the PREVIOUS code version still runs against the post-migration schema — so a code-only rollback
+// never strands old code on a schema it can't read. This lints core migrations for operations that
+// BREAK that property and fails unless the migration explicitly acknowledges the exception with a
+//   -- forward-unsafe: <reason>
+// pragma (a deliberate, documented decision — e.g. a historical migration, or one paired with a
+// two-step deploy).
+//
+// SAFE (never flagged): CREATE TABLE/INDEX/…, ADD COLUMN, INSERT/UPDATE, and DROP-then-CREATE of an
+// INDEX / TRIGGER / VIEW / FUNCTION / POLICY (the recreate-in-place idempotency pattern) — none of
+// these remove state the old code depends on.
+// UNSAFE (flagged): DROP TABLE, DROP COLUMN, RENAME COLUMN, ALTER TABLE … RENAME TO, ALTER COLUMN …
+// TYPE, SET NOT NULL — each removes / renames / retypes existing state old code reads.
+//
+// Usage:
+//   node scripts/gds/lint-migrations.js                 # STRICT: exit 1 on any unacknowledged unsafe migration
+//   node scripts/gds/lint-migrations.js --warn          # report only, always exit 0 (migrate.sh uses this)
+//   node scripts/gds/lint-migrations.js --dir <path>    # scan a specific migrations dir (default: <repo>/migrations)
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// The acknowledgement pragma. Lives in a SQL comment; matched on the raw file text.
+const ACK_RE = /^\s*--\s*forward-unsafe\s*:\s*(.+)$/im;
+
+// Genuinely forward-unsafe statement shapes. Ordered; a file matching ANY is unsafe.
+const UNSAFE = [
+  ['drop-table', /\bdrop\s+table\b/i],
+  ['drop-column', /\bdrop\s+column\b/i],
+  ['rename-column', /\brename\s+column\b/i],
+  ['rename-table', /\balter\s+table\s+[^\s;]+\s+rename\s+to\b/i],
+  ['alter-column-type', /\balter\s+column\b[^;]*\btype\b/i],
+  ['set-not-null', /\bset\s+not\s+null\b/i],
+];
+
+// Strip block + line comments so a pattern that appears only in prose/comments never counts as an
+// operation. (The ACK pragma is detected separately, on the raw text, since it IS a comment.)
+function stripSqlComments(sql) {
+  return String(sql).replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');
+}
+
+// Classify one migration's SQL: { unsafe: [names], acknowledged: bool, ackReason }.
+function scanMigrationSql(sql) {
+  const code = stripSqlComments(sql);
+  const unsafe = [];
+  for (const [name, re] of UNSAFE) if (re.test(code)) unsafe.push(name);
+  const ack = String(sql).match(ACK_RE);
+  return { unsafe, acknowledged: !!ack, ackReason: ack ? ack[1].trim() : null };
+}
+
+// Scan a migrations directory. Returns { violations, acknowledged } — each entry { file, unsafe, ackReason }.
+// `violations` = unsafe WITHOUT the pragma (fail-closed); `acknowledged` = unsafe WITH it (documented).
+function scanMigrationsDir(dir, fsImpl = fs) {
+  let files;
+  try { files = fsImpl.readdirSync(dir).filter((f) => f.endsWith('.sql')); }
+  catch { return { violations: [], acknowledged: [], scanned: 0 }; }
+  const violations = [];
+  const acknowledged = [];
+  for (const f of files.sort()) {
+    const r = scanMigrationSql(fsImpl.readFileSync(path.join(dir, f), 'utf8'));
+    if (r.unsafe.length === 0) continue;
+    (r.acknowledged ? acknowledged : violations).push({ file: f, unsafe: r.unsafe, ackReason: r.ackReason });
+  }
+  return { violations, acknowledged, scanned: files.length };
+}
+
+function arg(name, fallback = null) {
+  const i = process.argv.indexOf(name);
+  return i >= 0 && i + 1 < process.argv.length ? process.argv[i + 1] : fallback;
+}
+
+function main() {
+  const warnOnly = process.argv.includes('--warn');
+  const dir = path.resolve(arg('--dir', path.join(REPO_ROOT, 'migrations')));
+  const { violations, acknowledged, scanned } = scanMigrationsDir(dir);
+
+  for (const a of acknowledged) {
+    console.error(`[migrations] forward-unsafe (acknowledged): ${a.file} [${a.unsafe.join(', ')}] — ${a.ackReason}`);
+  }
+  if (violations.length === 0) {
+    console.error(`[migrations] forward-safety: OK — ${scanned} core migration(s) scanned, ${acknowledged.length} acknowledged exception(s), 0 unacknowledged.`);
+    return 0;
+  }
+  console.error(`[migrations] forward-safety: ${warnOnly ? 'WARNING' : 'FAILED'} — ${violations.length} core migration(s) contain a forward-UNSAFE operation with no acknowledgement:`);
+  for (const v of violations) console.error(`   ${v.file} [${v.unsafe.join(', ')}]`);
+  console.error('   A code-only `bongos upgrade` rollback does NOT revert the DB, so old code would run on this schema.');
+  console.error('   If intentional, add a top-of-file SQL comment:  -- forward-unsafe: <why it is safe here / the two-step plan>');
+  return warnOnly ? 0 : 1;
+}
+
+module.exports = { scanMigrationSql, scanMigrationsDir, stripSqlComments, UNSAFE, ACK_RE };
+
+if (require.main === module) process.exit(main());

package/scripts/gds/login.js

@@ -80,12 +80,26 @@ function prompt(q) {
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
-// Run the GitHub device flow against `base`. Returns one of:
+// Run the device flow and return one of:
 //   { state: 'ok', token, builder } | { state: 'not_approved' } | { state: 'expired' }
-async function runDeviceFlow(base, { log }) {
-  const start = await fetchJson(`${base}/api/gds/auth/device/start`, { method: 'POST' });
-  if (start.status === 503 || (start.data && start.data.error === 'auth_not_configured')) {
-    throw new Error('that instance has no GitHub sign-in configured yet — ask its Archon to set it up.');
+//
+// Two modes (ADR 0141 §1). Direct: run GitHub device flow against the instance's
+// own app. Federated (idp = { origin, client_id } from the instance manifest): run
+// the device flow against the HUB, then exchange the hub-signed assertion at the
+// instance's /auth/device/exchange — a hosted instance has no GitHub app of its own.
+// The instance's OWN admission gate runs at poll (direct) or exchange (federated),
+// so the stranger path is identical for both.
+async function runDeviceFlow(base, { log, idp = null }) {
+  const startUrl = idp ? `${idp.origin}/api/gds/sso/device/start` : `${base}/api/gds/auth/device/start`;
+  const start = await fetchJson(startUrl, {
+    method: 'POST',
+    // Federated: the hub resolves + binds the client from the USER-TYPED origin
+    // (`base`), never a client_id we supply — so this CLI can only ever mint an
+    // assertion scoped to the instance the user actually typed (ADR 0141 §1).
+    ...(idp ? { body: JSON.stringify({ origin: base }) } : {}),
+  });
+  if (start.status === 503 || (start.data && (start.data.error === 'auth_not_configured' || (start.data.error && start.data.error.code === 'idp_signing_unconfigured')))) {
+    throw new Error('that instance has no sign-in configured yet — ask its Archon to set it up.');
   }
   if (!start.ok || !start.data || !start.data.device_code) {
     throw new Error(`could not start sign-in (HTTP ${start.status}).`);
@@ -103,15 +117,29 @@ async function runDeviceFlow(base, { log }) {
   openBrowser(verification_uri);
   log('  Waiting for you to approve in the browser…');
 
+  const pollUrl = idp ? `${idp.origin}/api/gds/sso/device/poll` : `${base}/api/gds/auth/device/poll`;
   const deadline = Date.now() + expires * 1000;
   while (Date.now() < deadline) {
     await sleep(interval * 1000);
-    const poll = await fetchJson(`${base}/api/gds/auth/device/poll`, {
+    const poll = await fetchJson(pollUrl, {
       method: 'POST',
+      // The hub uses the client BOUND to device_code at start; the CLI names no
+      // audience at poll either (ADR 0141 §1).
       body: JSON.stringify({ device_code }),
     });
     const st = poll.data && poll.data.state;
-    if (st === 'ok') return { state: 'ok', token: poll.data.token, builder: poll.data.builder };
+    if (st === 'ok') {
+      if (!idp) return { state: 'ok', token: poll.data.token, builder: poll.data.builder };
+      // Federated: exchange the hub assertion at the instance for a real session.
+      const ex = await fetchJson(`${base}/api/gds/auth/device/exchange`, {
+        method: 'POST',
+        body: JSON.stringify({ assertion: poll.data.assertion }),
+      });
+      const exState = ex.data && ex.data.state;
+      if (exState === 'not_approved' || (ex.status === 403 && exState !== 'pending')) return { state: 'not_approved' };
+      if (!ex.ok || !ex.data || !ex.data.token) throw new Error(`sign-in exchange failed (HTTP ${ex.status}).`);
+      return { state: 'ok', token: ex.data.token, builder: ex.data.builder };
+    }
     if (st === 'not_approved' || (poll.status === 403 && st !== 'pending')) return { state: 'not_approved' };
     if (st === 'denied') throw new Error('sign-in was denied in the browser.');
     if (st === 'expired') return { state: 'expired' };
@@ -146,10 +174,14 @@ async function main() {
   }
   const instanceName = man.data.name || base;
   const admission = (man.data.admission && man.data.admission.policy) || 'invite-only';
-  log(`  Signing in to ${instanceName}${admission === 'invite-only' ? ' (invite-only)' : ''}`);
+  // Federation (ADR 0141 §1): a hosted instance advertises auth.idp = { origin,
+  // client_id } — sign-in then runs through the Cloud Bongos hub, not a local
+  // GitHub app. null → the direct-GitHub path, unchanged.
+  const idp = (man.data.auth && man.data.auth.idp) || null;
+  log(`  Signing in to ${instanceName}${admission === 'invite-only' ? ' (invite-only)' : ''}${idp ? ' — via Cloud Bongos platform sign-in' : ''}`);
 
   // 2. Device flow.
-  let flow = await runDeviceFlow(base, { log });
+  let flow = await runDeviceFlow(base, { log, idp });
 
   // 3. Stranger path: not admitted → file the request, poll until an Archon 👍s,
   //    then finish sign-in with a fresh device flow (the first code is spent).
@@ -193,7 +225,7 @@ async function main() {
       }
       process.stdout.write('.');
     }
-    flow = await runDeviceFlow(base, { log });
+    flow = await runDeviceFlow(base, { log, idp });
   }
 
   if (flow.state !== 'ok') {

package/scripts/gds/mirror-redact.js

@@ -185,6 +185,11 @@ function deriveInstanceLiterals(branding = {}, extra = {}) {
   add(tokens, company.name);
   { const label = registrableLabel(company.site); if (label) add(tokens, label); }
 
+  // `extra` also carries a caller-supplied FIXED FLOOR: the package-core neutral-floor gate
+  // (task 1002217 / audit H4) injects prior-instance tokens/owners here so published DOCS de-brand
+  // against them and the fail-closed gate fires EVEN WITH NO branding.json. Those floor literals
+  // live with the CALLER (package-core), never hardcoded in this file — so this redactor's self-leak
+  // invariant (tests/mirror_redact.mjs) keeps holding while the floor is still enforced.
   for (const t of extra.tokens || []) add(tokens, t);
   for (const o of extra.owners || []) add(owners, o);