@bongos/core 1.19.124 → 1.19.125

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.124",
-  "core_contract": "1.19.124",
-  "source_commit": "1b39368056a8f66b989d44a29bf23106497e1f61",
+  "core_version": "1.19.125",
+  "core_contract": "1.19.125",
+  "source_commit": "669cdd43ff95a6612999a3456ff5b68cdf8ccfd0",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T21:52:54.130Z",
+  "built_at": "2026-08-14T23:11:49.244Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1569,
-  "tree_sha256": "582a4f5e59904421feb7b95deaa1e4c386cf327462d0746b3b27e7160ea67abc",
+  "tree_sha256": "5310661ece545602d2be2b0c77f859959a02816dded3aeb8c6da211aaef421e9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4167,12 +4167,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b596ffed4e442327f612e616590c1dc64e53c8b1a0ccca011b29678569f272eb"
+      "sha256": "9d8c84867fb0a2470c1597ff6932dd8099f69ecbdaeddf1a8a2761d7e7e14cbd"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ea424af2d952a539697392ddb1467606d5b48417f4093d9ee91eba3a818bfc87"
+      "sha256": "d9d1ace99af356b2d7c958b93d94d14bb144eafdf8c75a0b7dd42ca50727a5a1"
     },
     {
       "path": "public-docs/index.html",
@@ -4412,7 +4412,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "bd0b17f7a21120a9e754c88206bd718fdda1fce568df15441272af0b9004c7cb"
+      "sha256": "368015cca5170dffd39e3fae55c8feca512df12fbb0e8f4daf3758e2aa5cf5f4"
     },
     {
       "path": "public-landing/buddha.png",
@@ -5757,7 +5757,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "64773898c77a0786d85960b90c05b25c5148c3992561284c91d011d703745e22"
+      "sha256": "7319962aeeada78ddc037f8b3eb24c6ecf42e1edd295ee4edb6cd4e0b3247e66"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6267,7 +6267,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "257acb76f7b7e8bb925b005e8a7bad96d712f0a216201aacee11762a2a2ff328"
+      "sha256": "3a727fd6bf78aa8e61643fea0a9418cd67f97dee8ffc3f620673d715da2fcc38"
     },
     {
       "path": "tests/cost.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.124",
+  "version": "1.19.125",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.124",
+      "version": "1.19.125",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.124",
+  "version": "1.19.125",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -207,8 +207,6 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .lede{font-size:15.5px;color:var(--ink-soft);font-weight:500;line-height:1.55;margin-bottom:24px;max-width:62ch;}
 .lede a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
 .lede a:hover{text-decoration:underline;}
-:root[data-mode="dark"] .lede a{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .lede a{color:var(--sun-lit);}}
 
 /* ── buttons ── */
 .btn{display:inline-flex;align-items:center;justify-content:center;gap:9px;cursor:pointer;font-family:var(--font-display);font-weight:700;font-size:15px;color:#fff;background:var(--accent);border:none;border-radius:999px;padding:11px 22px;text-decoration:none;box-shadow:0 10px 22px -8px color-mix(in srgb,var(--accent) 70%,transparent);transition:transform .15s ease, box-shadow .15s ease, background .15s ease;}
@@ -217,15 +215,11 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .btn:disabled{background:color-mix(in srgb,var(--ink) 12%,var(--bg-deep));color:color-mix(in srgb,var(--ink) 40%,var(--bg-deep));box-shadow:none;cursor:not-allowed;transform:none;}
 .btn.ghost{background:transparent;color:var(--ink-soft);box-shadow:none;border:2px solid var(--line);}
 .btn.ghost:hover{border-color:var(--accent);color:var(--accent-deep);}
-:root[data-mode="dark"] .btn.ghost:hover{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .btn.ghost:hover{color:var(--sun-lit);}}
 .btn.small{font-size:13.5px;padding:8px 16px;}
 .btn.danger{background:transparent;color:var(--err);box-shadow:none;border:2px solid color-mix(in srgb,var(--err) 35%,transparent);}
 .btn.danger:hover{background:var(--err-soft);border-color:var(--err);}
 .btn .gh{width:17px;height:17px;fill:currentColor;}
 .linklike{background:none;border:none;cursor:pointer;font-family:var(--font-body);font-weight:700;font-size:13.5px;color:var(--accent-deep);text-decoration:underline;padding:6px 4px;}
-:root[data-mode="dark"] .linklike{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .linklike{color:var(--sun-lit);}}
 
 /* ── chips: the one status vocabulary (direction §4). Recency rides inside
    (.rec) — "live" always says when it was last verified. ── */
@@ -233,8 +227,6 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .chip .cdot{width:7px;height:7px;border-radius:50%;background:var(--ink-faint);flex:0 0 auto;}
 .chip .rec{font-weight:600;opacity:0.72;font-size:11.5px;}
 .chip.busy{background:var(--accent-soft);color:var(--accent-deep);}
-:root[data-mode="dark"] .chip.busy{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .chip.busy{color:var(--sun-lit);}}
 .chip.busy .cdot{background:var(--accent);animation:chipPulse 1.4s ease-in-out infinite;}
 .chip.live{background:var(--ok-soft);color:var(--ok);}
 .chip.live .cdot{background:var(--ok);}
@@ -272,17 +264,11 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .projName{font-family:var(--font-display);font-weight:700;font-size:19px;letter-spacing:-0.3px;}
 .projMeta{font-size:13px;font-weight:600;color:var(--ink-faint);margin-top:6px;display:flex;gap:14px;flex-wrap:wrap;}
 .projMeta code{font-family:var(--font-mono);font-size:12.5px;background:var(--bg-deep);border-radius:6px;padding:1px 6px;color:var(--accent-deep);}
-:root[data-mode="dark"] .projMeta code{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .projMeta code{color:var(--sun-lit);}}
 .addr{margin-top:12px;font-size:14.5px;font-weight:600;color:var(--ink-soft);}
 .addr a{color:var(--accent-deep);font-weight:700;text-decoration:none;font-family:var(--font-mono);font-size:13.5px;}
-:root[data-mode="dark"] .addr a{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .addr a{color:var(--sun-lit);}}
 .addr a:hover{text-decoration:underline;}
 .addr .none{color:var(--ink-faint);font-style:italic;}
 .addr code{font-family:var(--font-mono);font-size:13px;background:var(--bg-deep);border-radius:6px;padding:1px 7px;color:var(--accent-deep);}
-:root[data-mode="dark"] .addr code{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .addr code{color:var(--sun-lit);}}
 .attach{display:flex;gap:10px;margin-top:10px;flex-wrap:wrap;}
 .attach input[type=text]{flex:1;min-width:220px;font-family:var(--font-body);font-size:15px;font-weight:600;color:var(--ink);background:var(--bg-card);border:2px solid var(--line);border-radius:12px;padding:9px 14px;outline:none;transition:border-color .15s ease, box-shadow .15s ease;}
 .attach input[type=text]::placeholder{color:var(--ink-faint);font-weight:500;}
@@ -291,8 +277,6 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}
 .projMsg a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
-:root[data-mode="dark"] .projMsg a{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .projMsg a{color:var(--sun-lit);}}
 .projMsg a:hover{text-decoration:underline;}
 .projMsg details{margin-top:8px;}
 .projMsg summary{cursor:pointer;font-size:12.5px;font-weight:700;color:var(--ink-faint);}
@@ -305,8 +289,6 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
    the browser's default blue, the one colour in the page that is not ours */
 .finePrint a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
 .finePrint a:hover{text-decoration:underline;}
-:root[data-mode="dark"] .finePrint a{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .finePrint a{color:var(--sun-lit);}}
 
 /* ── progress strips: one visual, per-flow vocabularies (direction §4).
    Default = the sea-blue "working" look; .isLive = verified-landed green;
@@ -525,8 +507,6 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
                               0 0 0 2px color-mix(in srgb,var(--accent) 55%,transparent);}
 .worldOrb[data-rel="builder"] .badge{background:var(--accent-soft);color:var(--accent-deep);
   border:1px solid color-mix(in srgb,var(--accent) 45%,transparent);}
-:root[data-mode="dark"] .worldOrb[data-rel="builder"] .badge{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .worldOrb[data-rel="builder"] .badge{color:var(--sun-lit);}}
 .worldOrb .chip{transform:scale(.88);white-space:nowrap;}
 
 /* what the only-mine filter shows when you are connected to nothing. Not a
@@ -570,8 +550,6 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   border:1px solid var(--line);color:var(--ink-faint);white-space:nowrap;}
 .tbl .pill{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
   border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);}
-:root[data-mode="dark"] .tbl .pill{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .tbl .pill{color:var(--sun-lit);}}
 .tbl td.right{text-align:right;}
 /* Nothing in an action or status cell may wrap: "Manage →" breaking after the
    space and the chip's recency dropping to a second line both read as a broken
@@ -627,8 +605,6 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
 .projCard .cardTag{font-size:14px;color:var(--ink-faint);font-weight:600;line-height:1.5;margin-bottom:14px;}
 .projCard .cardRel{display:inline-block;font-family:var(--font-mono);font-size:11px;padding:3px 10px;
   border-radius:999px;background:var(--accent-soft);color:var(--accent-deep);margin-bottom:18px;}
-:root[data-mode="dark"] .projCard .cardRel{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .projCard .cardRel{color:var(--sun-lit);}}
 /* the facts strip (task 1002778): a label/value grid, centered as a block but
    read left-aligned. A hidden pair leaves no gap — the grid row collapses. */
 .projCard .cardMeta{display:grid;grid-template-columns:auto auto;justify-content:center;
@@ -679,8 +655,6 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
   font-size:14px;color:var(--ink-faint);position:relative;z-index:1;}
 .steps li.done .snum{border-color:var(--accent);background:var(--accent);color:#fff;}
 .steps li.now .snum{border-color:var(--accent);color:var(--accent-deep);}
-:root[data-mode="dark"] .steps li.now .snum{color:var(--sun-lit);}
-@media (prefers-color-scheme: dark){:root:not([data-mode="light"]) .steps li.now .snum{color:var(--sun-lit);}}
 .steps .slbl{font-size:12.5px;font-weight:700;color:var(--ink-faint);}
 .steps li.now .slbl,.steps li.done .slbl{color:var(--ink-soft);}
 .createSplit{display:grid;grid-template-columns:1fr 300px;gap:var(--pad-md);align-items:center;}

package/src/module-api.js

@@ -675,8 +675,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.122 with no explicit bump. run 31842559470. (task 1002620)
 //   1.19.124 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.123 with no explicit bump. run 31844281033. (task 1002620)
+//   1.19.125 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.124 with no explicit bump. run 31849445746. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.124'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.125'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -143,14 +143,14 @@ const PAIRS = [
   ['.btn label on its fill',            '#ffffff',              'var(--accent)',        4.5],
   ['.btn.ghost:hover label',            'var(--accent-deep)',   CARD,                   4.5],
   ['.btn.danger label',                 'var(--err)',           CARD,                   4.5],
-  // Inline links: cosmos.css recolors its own to --sun-lit in dark (:179-262), but
-  // the ?view=new wizard styles (absorbed from create.html, task 1002763) carry
-  // eleven --accent-deep consumers and zero dark rules of their own, so there the
-  // token itself must carry dark.
+  // Inline links, code chips, pills, the now-step number: every accent-colored
+  // text consumer paints --accent-deep in BOTH modes (task 1002750 deleted the
+  // dark --sun-lit recolors — they pinned the locked space palette over the
+  // branding pack, so a re-themed instance got Cloud Bongos orange links).
+  // The dark blocks derive --accent-deep from the pack-settable --accent.
   ['inline link on a card',             'var(--accent-deep)',   CARD,                   4.5],
   ['inline link on the page ground',    'var(--accent-deep)',   'var(--bg)',            4.5],
   ['code chip on --bg-deep',            'var(--accent-deep)',   'var(--bg-deep)',       4.5],
-  ['cosmos.css dark link (--sun-lit)',  'var(--sun-lit)',       CARD,                   4.5, 'dark'],
   // body copy
   ['--ink body copy',                   'var(--ink)',           CARD,                   4.5],
   ['--ink-soft secondary copy',         'var(--ink-soft)',      CARD,                   4.5],
@@ -162,9 +162,9 @@ const PAIRS = [
   ['.chip.live label',                  'var(--ok)',            'var(--ok-soft)',       4.5],
   ['.chip.maybe label',                 'var(--warn)',          'var(--warn-soft)',     4.5],
   ['.chip.down/.bad label',             'var(--err)',           'var(--err-soft)',      4.5],
-  // .chip.busy recolors in dark (cosmos.css:194-195) — assert what each mode paints
-  ['.chip.busy label',                  'var(--accent-deep)',   'var(--accent-soft)',   4.5, 'light'],
-  ['.chip.busy label',                  'var(--sun-lit)',       'var(--accent-soft)',   4.5, 'dark'],
+  // .chip.busy + the .tbl .pill / .cardRel / builder-badge family: accent-deep
+  // ink on the accent-soft tint, both modes
+  ['.chip.busy label',                  'var(--accent-deep)',   'var(--accent-soft)',   4.5],
   // lifecycle strip: 12px/700
   ['.strip .slbl idle',                 'var(--ink-faint)',     CARD,                   4.5],
   ['.strip .slbl now/done',             'color-mix(in srgb,var(--sea) 40%,var(--ink))',       CARD, 4.5],
@@ -212,6 +212,48 @@ for (const mode of ['light', 'dark']) {
   });
 }
 
+// The gate's LOCKED sky palette — deliberately absent from COLOR_VARS, so a
+// branding pack can never re-theme these. Dark GROUNDS are allowed (dark mode IS
+// the gate's space, by design); text painted with one shows Cloud Bongos orange
+// on every re-themed instance, beside its own brand color (task 1002750; same
+// class as the --chrome-accent leak in 1002749).
+const LOCKED = ['sun-lit', 'gold', 'gold-soft', 'nebula', 'space-deep', 'space-mid', 'space-high'];
+const LOCKED_REF = new RegExp(`var\\(\\s*--(?:${LOCKED.join('|')})\\s*[,)]`);
+
+test('no rule paints text with the locked space palette', () => {
+  // The 2026-08-13 state: thirteen dark-mode pairs pinning links/chips/pills to
+  // --sun-lit. Property-anchored (background-color:/border-color: fills with
+  // their own fixed ink are fine) and value-wide, so color-mix()/fallback/padded
+  // spellings are caught too. Comments are stripped first — quoting the old rule
+  // in prose must not fail the build.
+  const stripped = src.replace(/\/\*[\s\S]*?\*\//g, '');
+  const leaks = [];
+  for (const m of stripped.matchAll(/(?:^|[;{\s])(color|fill|stroke)\s*:\s*([^;}]*)/g)) {
+    if (LOCKED_REF.test(m[2])) leaks.push(`${m[1]}:${m[2].trim()}`);
+  }
+  assert.deepEqual(leaks, [], `space-palette tokens used as text color:\n  ${leaks.join('\n  ')}\n`);
+});
+
+test('dark blocks never re-point a token at the locked space palette', () => {
+  // The seam the literal guard can't see: a dark block re-pointing a token the
+  // text consumers use (--accent-deep:var(--sun-lit)) paints every link orange
+  // while no color: declaration names a locked token — and at (0,2,0) no pack
+  // can ever win it back. Dark grounds that want the space look use literals.
+  // (The typeCard's 40%-gold-soft heading mix is fine: a per-TYPE tint in the
+  // light tier, where the pack still owns every brand token.)
+  for (const [where, block] of [
+    [':root[data-mode="dark"]', darkExplicit],
+    ['the prefers-color-scheme twin', darkMedia],
+  ]) {
+    for (const [name, value] of Object.entries(block)) {
+      assert.ok(
+        !LOCKED_REF.test(value),
+        `${where}: ${name}:${value} references a locked space-palette token`
+      );
+    }
+  }
+});
+
 test('the two dark blocks stay in lockstep', () => {
   // cosmos.css carries dark twice — an explicit data-mode hook and a
   // prefers-color-scheme twin. A change to one and not the other is the