@bongos/core 1.19.136 → 1.19.137

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.136",
-  "core_contract": "1.19.136",
-  "source_commit": "e8baa6b4bb7636ec78d0d37a48fafb861e716dad",
+  "core_version": "1.19.137",
+  "core_contract": "1.19.137",
+  "source_commit": "9fa1fb193ed67e42c77580783b8d46b43dfc04cd",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T14:17:27.560Z",
+  "built_at": "2026-08-15T14:29:50.076Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "c4c465a8bb9c113e17dd02666d74907f5d4057d06743e14d73bcc57ff7482290",
+  "tree_sha256": "106a541f9d1c75255cd4bf29b2cb87f60cb07a6f413f81d3a27f0b7887eaa200",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3882,7 +3882,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "eddf451d5ee5085563af258b5c605c445776c9e226587341f9b4b8b405492240"
+      "sha256": "903a3324337f8c1f123f81ca176550df0afbdeeea1f18254d41489dc3c4fed5d"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4147,7 +4147,7 @@
     {
       "path": "modules/status-ui/public/explore.html",
       "mode": "0000644",
-      "sha256": "3406def09eaca3f13eaf4dd19bf5e23c12de75d0929a575a1d742f7db430f765"
+      "sha256": "23348448b4b0912ecf6b4cd8bfc34737117e901c0efcb2d4c42c6bc8bf80e05d"
     },
     {
       "path": "modules/status-ui/public/explore.js",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8f0f435bc22d3f90b635703d6255ab5707be608c2263b7d62d2a22f84b239401"
+      "sha256": "82ff1180ef9d22a39f2ea3af15eecd26e9598c7c98d85b501030ab8c67566e7e"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f67d85ba93fc5babadfce8e44653c771fc0ac07471c0f5ffdcb0b13b0fab244c"
+      "sha256": "a60b9403891192d3338e76f313135db3bec75a8205920c839b6bdb5a95b40661"
     },
     {
       "path": "public-docs/index.html",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "096a5ae6bd847f8cfff0cb8e12ebeae0c99f3116f0420babdaea9e683a2b9fd3"
+      "sha256": "d4b3ac997a8dbf4acfdda32a4b62622908fdc87fcef6dbbfa563d49b76be34ce"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6367,7 +6367,7 @@
     {
       "path": "tests/design_tokens_sync.mjs",
       "mode": "0000644",
-      "sha256": "6d1a9dfba7e6ef7606c68abc9df3fb6e479f1a2939b83ad342f907b338f17f2c"
+      "sha256": "9dcbd0bc8f34f98ec0b0ff63a629780928c9d60199f3d961733e03ab6a7bb4fa"
     },
     {
       "path": "tests/dev_lib.mjs",

package/modules/provisioning/routes/provisioning.js

@@ -91,11 +91,22 @@ function esc(s) {
   ));
 }
 
-// Cloud Bongos brand styling for the standalone onboarding pages — sunrise palette +
-// Baloo 2 / Quicksand (brand/cloud-bongos/tokens.json). Light + dark aware; no external
+// Accent pair resolved from the instance's own branding — the pack is the palette
+// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
+// a branding validation error still paints the current family, never a stale one.
+const ACCENT = (() => {
+  try {
+    const c = api.branding().theme?.ui?.colors || {};
+    return { sun: c.accent || '#ce4806', sun600: c.accentDeep || '#9e3406' };
+  } catch { return { sun: '#ce4806', sun600: '#9e3406' }; }
+})();
+
+// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
+// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
+// under the instance's own config/branding.json). Light + dark aware; no external
 // dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
 const PAGE_STYLE = `
-:root{color-scheme:light dark;--sun:#f97316;--sun600:#ea580c;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
+:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
 @media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
 *{box-sizing:border-box}html,body{height:100%}
 body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}

package/modules/status-ui/public/explore.html

@@ -8,8 +8,8 @@
     /* Self-contained so the showcase renders correctly whether or not the host
        injects theme tokens. Warm Cloud Bongos defaults; overridable by the pack. */
     :root {
-      --bg: #fff7ed; --card: #ffffff; --ink: #2a1f17; --ink-soft: #6b5d52;
-      --rule: #fed7aa; --accent: #ea580c;
+      --bg: #f9d9a8; --card: #fffaf2; --ink: #2b170e; --ink-soft: #6d4a33;
+      --rule: #e8a463; --accent: #ce4806;
     }
     * { box-sizing: border-box; }
     body {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.136",
+  "version": "1.19.137",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.136",
+      "version": "1.19.137",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.136",
+  "version": "1.19.137",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -699,8 +699,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.134 with no explicit bump. run 31863235867. (task 1002620)
 //   1.19.136 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.135 with no explicit bump. run 31889474899. (task 1002620)
+//   1.19.137 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.136 with no explicit bump. run 31890033301. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.136'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.137'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/design_tokens_sync.mjs

@@ -77,3 +77,71 @@ test('the claude-design adapter falls back to the pack accent, never a brand lit
       `hardcoded colour ${hex} in the claude-design adapter — resolve it from the tokens instead`);
   }
 });
+
+// ---- page-local palettes stay aligned with the pack (task 1002810) ---------
+//
+// The same drift class one layer up: a page (or served-HTML route) declaring its
+// own colour values silently keeps whatever palette it was born with when the
+// pack moves. tests/hall_audit.mjs §8 already bans hall pages from declaring
+// pack vars at all; these cover the two survivors outside the hall — the
+// status-ui explore page and the provisioning onboarding pages.
+
+const RETIRED_ACCENT_FAMILY = ['ea580c', 'c2410c', 'f97316', 'fff7ed', 'fed7aa'];
+
+function walk(dir, exts, out = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if (exts.includes(path.extname(e.name))) out.push(p);
+  }
+  return out;
+}
+
+test('the retired pre-1002749 accent family appears nowhere in served UI code', () => {
+  const offenders = [];
+  for (const root of ['modules', 'src']) {
+    for (const f of walk(path.join(REPO_ROOT, root), ['.html', '.css', '.js'])) {
+      const text = fs.readFileSync(f, 'utf8').toLowerCase();
+      for (const hex of RETIRED_ACCENT_FAMILY) {
+        if (text.includes(`#${hex}`)) offenders.push(`${path.relative(REPO_ROOT, f)}: #${hex}`);
+      }
+    }
+  }
+  assert.deepEqual(offenders, [],
+    'a page carrying a retired accent hex is a private palette fork — align it with the pack (task 1002810)');
+});
+
+test('the explore page mirrors the pack, var for var', () => {
+  const html = fs.readFileSync(path.join(REPO_ROOT, 'modules/status-ui/public/explore.html'), 'utf8');
+  const root = html.match(/:root\s*\{([\s\S]*?)\}/);
+  assert.ok(root, 'explore.html declares a light :root block');
+  const colors = pack.theme.ui.colors;
+  const MIRROR = {
+    '--bg': colors.bg, '--card': colors.bgCard, '--ink': colors.ink,
+    '--ink-soft': colors.inkSoft, '--rule': colors.rule, '--accent': colors.accent,
+  };
+  for (const [cssVar, packVal] of Object.entries(MIRROR)) {
+    const m = root[1].match(new RegExp(`${cssVar}\\s*:\\s*(#[0-9a-fA-F]{6})`));
+    assert.ok(m, `explore.html defines ${cssVar}`);
+    assert.equal(m[1].toLowerCase(), String(packVal).toLowerCase(),
+      `explore.html ${cssVar} must equal the pack value — the injected themeMarkup paints exactly this, ` +
+      'so a divergent fallback renders a different page wherever injection is absent');
+  }
+});
+
+test('the provisioning onboarding pages resolve their accent pair from branding', () => {
+  const source = fs.readFileSync(
+    path.join(REPO_ROOT, 'modules/provisioning/routes/provisioning.js'), 'utf8');
+  assert.match(source, /--sun:\$\{/, '--sun interpolates a resolved value, never a literal');
+  assert.match(source, /--sun600:\$\{/, '--sun600 interpolates a resolved value, never a literal');
+  const block = source.match(/const ACCENT =[\s\S]*?\}\)\(\);/);
+  assert.ok(block, 'one resolved ACCENT pair (the FALLBACK_ACCENT idiom from the claude-design adapter)');
+  assert.match(block[0], /branding\(\)/, 'the pair resolves from the instance branding');
+  const allowed = new Set([pack.theme.ui.colors.accent, pack.theme.ui.colors.accentDeep]
+    .map((h) => String(h).toLowerCase()));
+  for (const hex of block[0].match(/#[0-9a-fA-F]{6}\b/g) || []) {
+    assert.ok(allowed.has(hex.toLowerCase()),
+      `ACCENT fallback ${hex} must be the pack accent/accentDeep, not a palette of its own`);
+  }
+});