@bongos/core 1.19.117 → 1.19.119

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.117",
-  "core_contract": "1.19.117",
-  "source_commit": "195266c548d657ee6924d36607d548a0e712cbf9",
+  "core_version": "1.19.119",
+  "core_contract": "1.19.119",
+  "source_commit": "1a3ff47e4556fdab934c24fb8e01bbb4bb01d095",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T18:51:25.372Z",
+  "built_at": "2026-08-14T20:02:21.430Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 302,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1238,
+    "functional_verbatim": 1239,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1561,
-  "tree_sha256": "e8cb405106a8092556a788698759b8a579439a080653ec3d5a5db66d16ec8e6b",
+  "file_count": 1562,
+  "tree_sha256": "df9b1ed828fdacdb04089002baf65d5176be91c467884f599031bbd8218cae30",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -387,7 +387,7 @@
     {
       "path": "config/design-tokens.neutral.json",
       "mode": "0000644",
-      "sha256": "16803a2b65d64052f9509b0ff50dbe36aadcc94639d5c6896736b1c9787a022b"
+      "sha256": "ffca38493475ebe55c6ac9513f8b7836162c26d2a532ef0a1cc6a3abc9ffac68"
     },
     {
       "path": "config/design-tokens.schema.json",
@@ -1367,7 +1367,7 @@
     {
       "path": "docs/design-contract.md",
       "mode": "0000644",
-      "sha256": "a86af6a923ed70bb8ea0846266f232f31a5fc9709d286362bcd37104d683342b"
+      "sha256": "8a71b3573c3d9be7e543baa1817d42df81cd546e3cfd544c785533ccaa9da477"
     },
     {
       "path": "docs/design/front-door-and-hub-direction.md",
@@ -4162,12 +4162,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2d570f38602e9cb4ab3417d45f21d61ffb2b9cef5ba9ff9354350a95af8f6190"
+      "sha256": "2a008b4ca09e8abb2613478eb696fb66b63b4dd075cee7bbd6d7fb60a9866513"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b9a96ae403012d889fbae5d2bd481f76fa1bc2221e5e8c8a6bd49e7494759ee9"
+      "sha256": "ce8caad093e4acd61c3de150836996162c8265ed1ceb09a27130bbe58ea10aaf"
     },
     {
       "path": "public-docs/index.html",
@@ -4417,7 +4417,7 @@
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
-      "sha256": "bddfd05afb8b2c93155efff9bfc6812a7e213ed7f4d66a8d4cd2db3c899d0088"
+      "sha256": "1fa06d66fc4c1bbe3849e6fbf402852caea8b7cfc80a4c69ecad26d921d4264d"
     },
     {
       "path": "public-landing/projects.html",
@@ -5742,7 +5742,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1c1a8e95f442958ff1476c19e6b68fd2af5475e365e3d5203656bfb2c63f3fa4"
+      "sha256": "a990b6b2c309018a149e0190b2fcd74a0d6e2b3754cfdd3eabdf505038a19d87"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -5787,7 +5787,7 @@
     {
       "path": "src/ui/adapters/claude-design/index.js",
       "mode": "0000644",
-      "sha256": "04218100d565edf00d822aefa262a001f503bf9f45ae79f4a46a3c2f1756ede5"
+      "sha256": "7489ba1a6612068648359c65d1abeae8faa6de0d16e0cf58d67ce5a1f307e372"
     },
     {
       "path": "src/ui/adapters/figma/index.js",
@@ -6334,6 +6334,11 @@
       "mode": "0000644",
       "sha256": "1abfa6c8bb119d010d2a53f71373508a31a9cc3c28207ca1dbac2138a7eda595"
     },
+    {
+      "path": "tests/design_tokens_sync.mjs",
+      "mode": "0000644",
+      "sha256": "6d1a9dfba7e6ef7606c68abc9df3fb6e479f1a2939b83ad342f907b338f17f2c"
+    },
     {
       "path": "tests/dev_lib.mjs",
       "mode": "0000644",

package/config/design-tokens.neutral.json

@@ -2,19 +2,19 @@
   "_note": "Cloud Bongos neutral design tokens — the baseline every instance resolves over. To override, copy values into config/design-tokens.json (the instance pack). These match config/branding.neutral.json theme.ui so a vanilla instance with no instance pack still renders correctly. See docs/design-contract.md.",
 
   "colors": {
-    "bg":         "#fff7ed",
-    "bgCard":     "#ffffff",
-    "bgDeep":     "#ffedd5",
-    "bgFrame":    "#fde4c8",
-    "ink":        "#2a1f17",
-    "inkSoft":    "#6b5d52",
-    "inkFaint":   "#857567",
-    "rule":       "#fdba74",
-    "ruleSoft":   "#fed7aa",
-    "accent":     "#f97316",
-    "accentDeep": "#ea580c",
-    "sea":        "#38bdf8",
-    "terracotta": "#fb7185"
+    "bg":         "#f9d9a8",
+    "bgCard":     "#fffaf2",
+    "bgDeep":     "#f6d8ae",
+    "bgFrame":    "#f0c489",
+    "ink":        "#2b170e",
+    "inkSoft":    "#6d4a33",
+    "inkFaint":   "#785a41",
+    "rule":       "#e8a463",
+    "ruleSoft":   "#f6d8ae",
+    "accent":     "#ce4806",
+    "accentDeep": "#9e3406",
+    "sea":        "#0f7a96",
+    "terracotta": "#855b3d"
   },
 
   "fonts": {

package/docs/design-contract.md

@@ -30,7 +30,7 @@ The validator merges both files (deep-merge, instance wins) and validates the re
 
 ### 1.3 Relationship to config/branding.json
 
-`config/branding.json` carries *identity* (product name, domains, currency, tracks). Design tokens carry *presentation* (colors, type, spacing). The two files are siblings; neither owns the other. Where both define overlapping values (e.g. `branding.json theme.ui.colors` and `design-tokens.json colors`), **design-tokens.json is authoritative at render time**. The `src/branding.js` resolver will be updated (task 1377) to expose resolved tokens alongside identity — adapters use `branding.resolveDesignTokens()`.
+`config/branding.json` carries *identity* (product name, domains, currency, tracks). Design tokens carry *presentation* (colors, type, spacing). The two files are siblings; neither owns the other. Where both define overlapping values (e.g. `branding.json theme.ui.colors` and `design-tokens.json colors`), **design-tokens.json is authoritative at render time**. The **neutral pair** is the one exception: `config/branding.neutral.json theme.ui` is the authority and `config/design-tokens.neutral.json` mirrors it key-for-key — CI-asserted by `tests/design_tokens_sync.mjs` (task 1002752), so the design round-trip can never again start prototypes from colours the product stopped painting. Instance packs stay free per §1.2. The `src/branding.js` resolver will be updated (task 1377) to expose resolved tokens alongside identity — adapters use `branding.resolveDesignTokens()`.
 
 ### 1.4 Token schema overview
 
@@ -290,6 +290,8 @@ The `--dt-` prefix is reserved for this design system. Adapters must not emit CS
 6. Every `surfaceId` key in `design-sources.json` has a matching directory under `src/ui/` or `assets/ui/` (if any such directory exists — the file may precede the directories for a new instance).
 7. If `src/ui/adapters/` exists, each adapter directory has an `index.js` that exports `id`, `import`, and `export`.
 
+The neutral-pair lockstep (§1.3) is deliberately not a validator check — it lives in `tests/design_tokens_sync.mjs`, so an instance running only `validate-design.js` is not forced to mirror its own pack.
+
 Usage:
 
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.117",
+  "version": "1.19.119",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.117",
+      "version": "1.19.119",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.117",
+  "version": "1.19.119",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/index.html

@@ -79,11 +79,15 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
    The head is SKIN, not a card. It carries its own --skin-* tokens and must
    NEVER inherit --bg-card — that turns it black in dark mode. These are
    component-scoped (on .bongos, not :root) so they cannot collide with the
-   pack's contract tier. */
+   pack's contract tier.
+
+   The ground shadow follows cosmos.css's --shadow-card rule: ink-derived in
+   light (warm brown), plain black in dark — in dark, --ink is near-white and
+   an ink fill would glow, not shade. */
 .bongos{display:block;width:100%;height:auto;overflow:visible;
-  --skin-hi:#fffdf8;--skin-mid:#fff6e9;--skin-lo:#e8d3b6;}
-:root[data-mode="dark"] .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;}
-@media (prefers-color-scheme:dark){:root:not([data-mode="light"]) .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;}}
+  --skin-hi:#fffdf8;--skin-mid:#fff6e9;--skin-lo:#e8d3b6;--drum-shadow:var(--ink);}
+:root[data-mode="dark"] .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;--drum-shadow:#000;}
+@media (prefers-color-scheme:dark){:root:not([data-mode="light"]) .bongos{--skin-hi:#fdf7ea;--skin-mid:#efe1c8;--skin-lo:#c3ae90;--drum-shadow:#000;}}
 .mascot{position:relative;}
 .mascot::before{content:"";position:absolute;inset:-8% -12%;z-index:-1;border-radius:50%;
   background:radial-gradient(ellipse at center,rgba(255,255,255,.95) 0%,rgba(255,255,255,.7) 45%,rgba(255,255,255,0) 72%);}
@@ -274,7 +278,7 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 
         <ellipse class="glow" cx="222" cy="170" rx="215" ry="140" fill="url(#halo)"/>
         <ellipse class="bshadow" cx="220" cy="286" rx="142" ry="14"
-                 fill="var(--ink)" opacity=".22" filter="url(#soft)"/>
+                 fill="var(--drum-shadow)" opacity=".22" filter="url(#soft)"/>
 
         <!-- the joining block, behind both shells -->
         <path d="M 214,196 C 232,188 250,188 264,196 L 258,232 C 244,225 230,225 219,232 Z" fill="var(--accent-deep)"/>

package/src/module-api.js

@@ -661,8 +661,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.115 with no explicit bump. run 31827642395. (task 1002620)
 //   1.19.117 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.116 with no explicit bump. run 31830559253. (task 1002620)
+//   1.19.118 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.117 with no explicit bump. run 31833658900. (task 1002620)
+//   1.19.119 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.118 with no explicit bump. run 31835957309. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.117'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.119'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/ui/adapters/claude-design/index.js

@@ -20,6 +20,18 @@ const os = require('node:os');
 
 const ID = 'claude-design';
 
+// Fallback when a caller-supplied token tree omits colors.accent — resolved from
+// the neutral token file so the adapter never carries a brand literal of its own;
+// the catch value is the neutral pack's accent, kept equal by
+// tests/design_tokens_sync.mjs (task 1002752).
+const FALLBACK_ACCENT = (() => {
+  try {
+    return JSON.parse(fs.readFileSync(
+      path.resolve(__dirname, '..', '..', '..', '..', 'config', 'design-tokens.neutral.json'), 'utf8',
+    )).colors.accent || '#ce4806';
+  } catch { return '#ce4806'; }
+})();
+
 // ── token helpers ─────────────────────────────────────────────────────────────
 
 function camelToKebab(s) {
@@ -159,7 +171,7 @@ label{display:block;font-size:10px;color:#888;text-transform:uppercase;letter-sp
 function spacingHtml(tokens) {
   const scale = tokens.scale || {};
   const colors = tokens.colors || {};
-  const accent = colors.accent || '#f97316';
+  const accent = colors.accent || FALLBACK_ACCENT;
   const rows = Object.entries(scale).map(([k, v]) => `
     <tr>
       <td><code>${k}</code></td>
@@ -182,7 +194,7 @@ code{font-size:12px;}
 
 function radiiHtml(tokens) {
   const radius = tokens.radius || {};
-  const accent = (tokens.colors && tokens.colors.accent) || '#f97316';
+  const accent = (tokens.colors && tokens.colors.accent) || FALLBACK_ACCENT;
   const boxes = Object.entries(radius).map(([k, v]) => `
     <div style="display:inline-block;margin:8px;">
       <div style="width:64px;height:64px;background:${accent};border-radius:${v};"></div>

package/tests/design_tokens_sync.mjs

@@ -0,0 +1,79 @@
+// tests/design_tokens_sync.mjs — config/design-tokens.neutral.json mirrors the
+// branding pack, never a palette of its own (task 1002752).
+//
+// The repo has two files describing the neutral look: config/branding.neutral.json
+// (the RUNTIME pack — themeMarkup() paints every served page with it) and
+// config/design-tokens.neutral.json (the DESIGN-side tokens feeding the Figma /
+// Claude Design round-trip). Nothing tied them together, so the design file kept
+// the pre-1002749 palette — including the exact accents removed for failing WCAG
+// AA — and every prototype started from colours the product no longer paints.
+// Model: the fallback-equals-pack assertions in tests/devbox_dmg_backdrop.mjs.
+//
+// Run:  node tests/design_tokens_sync.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const readJson = (...p) => JSON.parse(fs.readFileSync(path.join(REPO_ROOT, ...p), 'utf8'));
+
+const pack = readJson('config', 'branding.neutral.json');
+const tokens = readJson('config', 'design-tokens.neutral.json');
+
+// Strip comments so rationale prose — which must be free to name a removed
+// colour — never trips a scan of the CODE (the stripCommentsForIdentity
+// contract, as applied in tests/devbox_dmg_backdrop.mjs).
+function codeOnly(text) {
+  return text
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .split(/\r?\n/)
+    .map((line) => line.replace(/(^|[^:"'])\/\/.*$/, '$1'))
+    .join('\n');
+}
+
+test('every design-token colour is the branding pack value — a divergent token is a fork of the brand', () => {
+  const packColors = pack.theme.ui.colors;
+  assert.deepEqual(
+    Object.keys(tokens.colors || {}).sort(), Object.keys(packColors).sort(),
+    'the design file must carry exactly the pack colour keys — a missing or extra key is drift too, ' +
+    'running through the key set instead of the values');
+  for (const [key, val] of Object.entries(tokens.colors)) {
+    assert.equal(String(val).toLowerCase(), String(packColors[key]).toLowerCase(),
+      `design-token "${key}" must equal the pack's value — a drifted token hands every prototype ` +
+      'a palette the product no longer paints');
+  }
+});
+
+test('the fonts the two files share are the same fonts', () => {
+  const packFonts = pack.theme.ui.fonts;
+  for (const [key, val] of Object.entries(tokens.fonts || {})) {
+    if (!(key in packFonts)) continue; // mono is design-side only — the pack declares no mono surface
+    assert.deepEqual(val, packFonts[key],
+      `design-token font "${key}" must equal the pack's — same drift class as the colours`);
+  }
+});
+
+test('the claude-design adapter falls back to the pack accent, never a brand literal of its own', () => {
+  const source = fs.readFileSync(
+    path.join(REPO_ROOT, 'src', 'ui', 'adapters', 'claude-design', 'index.js'), 'utf8');
+  const block = source.match(/const FALLBACK_ACCENT =[\s\S]*?\}\)\(\);/);
+  assert.ok(block, 'the adapter declares one resolved fallback accent instead of inline literals');
+  assert.match(block[0], /design-tokens\.neutral\.json/,
+    'the fallback resolves from the neutral token file, never a bare literal');
+  for (const hex of block[0].match(/#[0-9a-fA-F]{6}\b/g) || []) {
+    assert.equal(hex.toLowerCase(), String(pack.theme.ui.colors.accent).toLowerCase(),
+      'the catch literal must be the pack ACCENT, not merely some pack colour');
+  }
+  // Every colour literal left in the adapter must be the neutral pack's own value
+  // (i.e. a fallback, not a brand). The preview-card chrome is 3-digit grays, so
+  // a 6-digit literal is exactly the brand-value class.
+  const packValues = new Set(Object.values(pack.theme.ui.colors).map((h) => String(h).toLowerCase()));
+  const hexes = codeOnly(source).match(/#[0-9a-fA-F]{6}\b/g) || [];
+  for (const hex of hexes) {
+    assert.ok(packValues.has(hex.toLowerCase()),
+      `hardcoded colour ${hex} in the claude-design adapter — resolve it from the tokens instead`);
+  }
+});