@bongos/core 1.19.1042 → 1.19.1043

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1042",
-  "core_contract": "1.19.1042",
-  "source_commit": "68fcf8801f79c033844ed6c7de0b57b77f8b52ec",
+  "core_version": "1.19.1043",
+  "core_contract": "1.19.1043",
+  "source_commit": "a7f87df67be821c4552587a83313fdd13e3a3c17",
   "source_ref": "HEAD",
-  "built_at": "2026-09-26T16:20:22.905Z",
+  "built_at": "2026-09-26T17:20:34.417Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 543,
     "agent_docs_stubbed": 26,
-    "functional_verbatim": 2510,
+    "functional_verbatim": 2513,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3080,
-  "tree_sha256": "70323d5a72fe1d0b5c1ae1b9393f123a887ddae1d21aff5439c0f7e8df62c04c",
+  "file_count": 3083,
+  "tree_sha256": "a9b86c4c4e0acc27d6554d3d5ea4240bae592dde6b1edd0a2f070d422194ca1b",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -352,12 +352,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "d02c80b3d62e51912d2cdfe40a0f29b147e16d9116de21295b9cdd41d6299c21"
+      "sha256": "7073eca28ea1e8ebab33e072c688c2b0e6cf82671849c8e7684a576796efc901"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "0a55c10c41e8a330786b81ef4c464e3c16e7ea6e70b1ede78f717f3712494489"
+      "sha256": "48b9d83d0ee81e63d5a94be73a0cb505fac99fd9f049a45d0f28e15e112602b1"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -367,17 +367,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "404e87e59973c58544d82f6dce4ead9f1b02cd6109f01756580978d779a63e58"
+      "sha256": "0cd41f959d6b8b2e7be0f317fc1cfe0ef83d35f48338810d5d0bc73307226c74"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "2d76cbc036ad86a693fdddac0819f8e5eb216d52876d7f33a13d92babb888579"
+      "sha256": "8c14cf27d91d8c9ae4c6e75b94cecc403daad87f37b8a04bc03f76b8bf11c3a4"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "362298bdafdce0ca4fa39df53a7342a956d81937e866560c845d6a2f48b216e3"
+      "sha256": "e380741ea83429e405e684d629044c067ff2e2d308fb8ef2a4a94c3c37c7c120"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2207,12 +2207,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "d2aeebede22152ef41670dbc7812c9aad7bf8f4de723df01ee7468f29f30b1b3"
+      "sha256": "06c5bea02e1e479aac06addd9a9fb71c9da889030cf4687d1bb89ba2d8c68038"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "f07c060e2e53d38d134f3a9a7bf08571e900a4ef86e0ab0b6d10c12688d0eccb"
+      "sha256": "d94e6449c03eac000296fe13ebd81c066333ffc04b7d325e9b30c2ab569fd200"
     },
     {
       "path": "docs/architecture.md",
@@ -2237,12 +2237,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "79e348fe16700e809ed5196d388500ac828cbbdccd042f75cc054b562c87babe"
+      "sha256": "a6536844e71c39df8416385a4ee9acc26c30acf9c1d38da59dd31693978c1f91"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "ff83e1aa1ac4640807d8fcdbfe40e369388d6e757ad8d61bdad7ee2bf4276748"
+      "sha256": "2ed62b3b00838e6bc9d52575548dcc4b8a37a152de82130a65fdc046572e6e0d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2762,7 +2762,7 @@
     {
       "path": "docs/file-map.md",
       "mode": "0000644",
-      "sha256": "4df88b38341924e9a048fa0e967f31463cae6c1bf6eb89403cae01dd7e55735c"
+      "sha256": "35db6278668334aee92e4ecbd53a97ee7959a5c87f790c36cbdb28cfe68f439a"
     },
     {
       "path": "docs/handoff-template.md",
@@ -2772,12 +2772,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "57f027bda2bd21a702ad97e4113c19a2c5e29f4fa20609f471a7368666f808f1"
+      "sha256": "21d0dd30bb815e977954716bff215839a0877f32f1e95dcd183635e5a0246964"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "2d354cb1b436f21c6dc7c1b4aed26d8aa0bc071db30dd9545c3301a5486e903d"
+      "sha256": "f76d23b2492d65418d6ee9284b7220795d211e7d7cf7968e870e3b4e09f9d1be"
     },
     {
       "path": "docs/onboarding/browser-terminal-guide.md",
@@ -5532,7 +5532,7 @@
     {
       "path": "modules/hall-ui/public/style.css",
       "mode": "0000644",
-      "sha256": "2e10853746866fdaf23f34cbcf6831dd860e956a5dce9a472aae5b8565b1bb30"
+      "sha256": "ef373d4adfb24bd0742a69245e31e2a2f916cf824dab89fd59d754cfdf70add8"
     },
     {
       "path": "modules/hall-ui/public/task-detail.js",
@@ -5547,17 +5547,17 @@
     {
       "path": "modules/hall-ui/public/task.css",
       "mode": "0000644",
-      "sha256": "1f2d0ed8f8c8497468e1102dd2d90b0e63f15bd89158e5935f50de1016c355e4"
+      "sha256": "b1671e5e5789f36ac787e854e48e9b2c2bf4ef1abef7a9816f044241d6ba0c06"
     },
     {
       "path": "modules/hall-ui/public/task.html",
       "mode": "0000644",
-      "sha256": "7d318844d9615faeb58253d9347cdaadec2d7b21f9e20a8018cac57ffeb21498"
+      "sha256": "0d5255b9148412b9ce33c9e1acc594537120e3ca874f93f6186931bceeb52993"
     },
     {
       "path": "modules/hall-ui/public/task.js",
       "mode": "0000644",
-      "sha256": "c9db90921b9c348c76ade8cb4348de8c989718bcb246702d110c2625232da4d0"
+      "sha256": "2b393fed95b8cbd8546447b34a218adc53e9bd3682ef6bb5ea724702dac9ea8b"
     },
     {
       "path": "modules/hall-ui/public/task.states.json",
@@ -5672,7 +5672,7 @@
     {
       "path": "modules/hall-ui/records/record-family.md",
       "mode": "0000644",
-      "sha256": "c9747d6082111037b90d8a1b396fa58cfd69a9e19cbdb21145ce8b13e2ea0a61"
+      "sha256": "d4ad4e3200e54ed418619cfe18e17da6b1cc91ca68f6e358ededbc85923bcd24"
     },
     {
       "path": "modules/hall-ui/records/reference-room.md",
@@ -6487,7 +6487,12 @@
     {
       "path": "modules/npm-release/module.json",
       "mode": "0000644",
-      "sha256": "aa8289ee59e7d526263aed9500a54a9f8abbdc57220059a710170578c89d3704"
+      "sha256": "7d8d1da0d972aecd0095338ff9318778d01cef6a36d3eec2cacc665949b43061"
+    },
+    {
+      "path": "modules/npm-release/public/task-widget.js",
+      "mode": "0000644",
+      "sha256": "595ec73c075cae55b6a0d88a7586d19f43e821942bda3994e69aa8ee1b5583d1"
     },
     {
       "path": "modules/npm-release/public/work.css",
@@ -6499,6 +6504,11 @@
       "mode": "0000644",
       "sha256": "c60a8c66e18a5f89965529c360da7f68ebfd3fcee22774c2f8040b0303de9de1"
     },
+    {
+      "path": "modules/npm-release/routes/task-where.js",
+      "mode": "0000644",
+      "sha256": "73eabf312c639861177d3b19b491e2b689f8ef2c0ccbc4ea917ab06fbf82f560"
+    },
     {
       "path": "modules/npm-release/routes/work.js",
       "mode": "0000644",
@@ -6507,7 +6517,7 @@
     {
       "path": "modules/npm-release/work.js",
       "mode": "0000644",
-      "sha256": "38880bd293716ed4ed09f2b0fd0ae28f799f68bfe6e3c87fff5632d0c198cc47"
+      "sha256": "6efc698a25cf0546fecc73401a0a5d9819ffbdf60143d77fae49858e4a5d0acc"
     },
     {
       "path": "modules/onboarding/CLAUDE.md",
@@ -8492,12 +8502,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "e5b55489faef1e1f8e1e349805dc7378b5cc0a5881b165923442cd04a8460adf"
+      "sha256": "f422ee23bd52d7f90f4bc43727d8f25dda5369ee018a9ebe8d61c8adb12a0e1f"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a75564f99aa85a3fd04477d5c3d8535336b2f44deabb175cbd222f0feb54317e"
+      "sha256": "c696fd88b366bf880bbf8358a1502f26dedb4229aee867a6d73e944897529762"
     },
     {
       "path": "public-docs/index.html",
@@ -8517,7 +8527,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "f0fd38e5a8d21dcfbf4726795a6061be536e7bb2bcffad95ccc8c22820c9229a"
+      "sha256": "f1a8435bcf9e0329846f00f25418d6fa671fb943c34521f4420b85074d15cdf6"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9022,7 +9032,7 @@
     {
       "path": "scripts/gds/exec-path-guard.js",
       "mode": "0000644",
-      "sha256": "254c0ff06409c015e2a821ddc59a2e9ad438a4107c2dca8cff2403e99b8417bc"
+      "sha256": "8ed7c35c0d6be3c8a11ee990b487114d7e422caeb70c67240b5060a0087cfdc4"
     },
     {
       "path": "scripts/gds/feedback-latest.js",
@@ -9672,7 +9682,7 @@
     {
       "path": "scripts/gds/seam-wiring-guard.js",
       "mode": "0000644",
-      "sha256": "aac0658178792add8327f7fbd3675500059a315091fa35e78ce85d324b65550c"
+      "sha256": "f046bc41f5dbd2d75046497080f65d3821ff8d1db79d052489c21151eef7e821"
     },
     {
       "path": "scripts/gds/search-ingest-db.js",
@@ -10172,7 +10182,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "48607e2724aceb0a9e116748713dbef945585bacfa962785eb58bfa37349255c"
+      "sha256": "5c2c480bea8acc9d74d17a27d60312ae8ef9dc2cb7bd18a776ea3bab8ca49ecc"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -10557,7 +10567,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "07c27ccd5efedab72b0cf324c4a3a1488e70b2f965161b4d4aa13aef0921d230"
+      "sha256": "980e049cdebb321e8212ac978e615be26c5948800e95ecdfdf70e9632efb54c7"
     },
     {
       "path": "src/bongos/software-update.js",
@@ -10587,7 +10597,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ce3d04ab0eae7e7ceb06ad2f9cc1a881d91d244ba6fd2ce1bd12d5a8fe00e3c7"
+      "sha256": "28057a8787770e36c9992cac05d5bdc4166b1442da16448cac9c335bf3784637"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10597,7 +10607,7 @@
     {
       "path": "src/module-loader/loader.js",
       "mode": "0000644",
-      "sha256": "e888dbdf466ac906a7a29859c9851a105a963a52142bdbd998e8202e5b822670"
+      "sha256": "d9db082af675b6e53ccfde76d14873ef22fffd774a44476544cf1b55b1eef8eb"
     },
     {
       "path": "src/module-loader/manifest-schema.js",
@@ -12692,7 +12702,7 @@
     {
       "path": "tests/hall_record_world.mjs",
       "mode": "0000644",
-      "sha256": "51250849d3a47eefe549ebe8eaec0c37f2efd92a4b6314a276e3f526f2ef40a1"
+      "sha256": "a9de1b1f1728d81d5ade4ebd2f4e7d3c3d1d9dc1940d70dbd5d898906861ca9d"
     },
     {
       "path": "tests/hall_records.mjs",
@@ -13452,7 +13462,7 @@
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",
-      "sha256": "41fac167f1c2e1377e692193f752c370081cedc5e3497b228a6f5e4117139ac1"
+      "sha256": "cd5f6ed5880c9cce22e7a6f5c7ed018e9ebd0d3cb7e329dfeeaa9af9805cbf2d"
     },
     {
       "path": "tests/module_manifest.mjs",
@@ -13544,6 +13554,11 @@
       "mode": "0000644",
       "sha256": "a6ace0029ba02051b4f8cda015f825b990c62b19754e43ce45c66e03dac35d01"
     },
+    {
+      "path": "tests/npm_release_where.mjs",
+      "mode": "0000644",
+      "sha256": "95e826751d5ae490187a17bd6e343a3598333ce512078f7a72ffcb8de69e6314"
+    },
     {
       "path": "tests/npm_release_work.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 441 operations across 68 resource groups
+- 442 operations across 68 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -745,6 +745,8 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
+      getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
       getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -744,6 +744,8 @@ function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
+      getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
       getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -1160,6 +1160,8 @@ export interface BongosClient {
     postMyProjectsJoin(args: RequestArgs & { body: PostMyProjectsJoinRequest }): Promise<PostMyProjectsJoinResponse>;
   };
   "npmRelease": {
+    /** GET /npm-release/task/{id} — rank: any-builder */
+    getNpmReleaseTaskId(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /npm-release/work — rank: archon */
     getNpmReleaseWork(args?: RequestArgs): Promise<ApiResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -741,6 +741,8 @@ export function createClient(opts = {}) {
       postMyProjectsJoin: (args) => request("POST", "/my-projects/join", { hasBody: true }, args),
     },
     "npmRelease": {
+      // GET /npm-release/task/{id} — rank: any-builder — GET /npm-release/task/:id
+      getNpmReleaseTaskId: (args) => request("GET", "/npm-release/task/{id}", { hasBody: false }, args),
       // GET /npm-release/work — rank: archon — GET /npm-release/work
       getNpmReleaseWork: (args) => request("GET", "/npm-release/work", { hasBody: false }, args),
     },

package/docs/api/openapi.json

@@ -13322,6 +13322,51 @@
         ]
       }
     },
+    "/npm-release/task/{id}": {
+      "get": {
+        "operationId": "get_npm_release_task_id",
+        "tags": [
+          "npm-release"
+        ],
+        "summary": "GET /npm-release/task/:id",
+        "description": "**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/npm-release/routes/task-where.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/npm-release/work": {
       "get": {
         "operationId": "get_npm_release_work",
@@ -27995,7 +28040,7 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 441,
+  "x-endpoint-count": 442,
   "x-schema-count": 482,
   "x-undocumented-bodies": 9,
   "x-response-schemas": 330,

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 441 endpoints across 75 route files.
+> **Generated from the live route files** — the route file is authoritative. 442 endpoints across 76 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -521,10 +521,11 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/my-projects/invites/:clientId/decline` | `any-builder` | — | decline an invite (delete the pending row) for the caller's OWN account. |
 | POST | `/api/bongos/my-projects/join` | `any-builder` | `origin`, `note` | request to join a project. |
 
-## `npm-release` (1)
+## `npm-release` (2)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/npm-release/task/:id` | `any-builder` | — |  |
 | GET | `/api/bongos/npm-release/work` | `archon` | — | Query: days (ledger window, default 14, max 60), before + limit (history paging). |
 
 ## `override-requests` (2)