@bongos/core 1.19.136 → 1.19.138

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.136",
-  "core_contract": "1.19.136",
-  "source_commit": "e8baa6b4bb7636ec78d0d37a48fafb861e716dad",
+  "core_version": "1.19.138",
+  "core_contract": "1.19.138",
+  "source_commit": "c881ff7b166e960c529748049090f53ad17276c8",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T14:17:27.560Z",
+  "built_at": "2026-08-15T14:53:14.334Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "c4c465a8bb9c113e17dd02666d74907f5d4057d06743e14d73bcc57ff7482290",
+  "tree_sha256": "09b573285811157440bc46ef823f8ae2adf4735d9a0d559e656a7a68793a0bdf",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -3882,7 +3882,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "eddf451d5ee5085563af258b5c605c445776c9e226587341f9b4b8b405492240"
+      "sha256": "903a3324337f8c1f123f81ca176550df0afbdeeea1f18254d41489dc3c4fed5d"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4147,7 +4147,7 @@
     {
       "path": "modules/status-ui/public/explore.html",
       "mode": "0000644",
-      "sha256": "3406def09eaca3f13eaf4dd19bf5e23c12de75d0929a575a1d742f7db430f765"
+      "sha256": "23348448b4b0912ecf6b4cd8bfc34737117e901c0efcb2d4c42c6bc8bf80e05d"
     },
     {
       "path": "modules/status-ui/public/explore.js",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "8f0f435bc22d3f90b635703d6255ab5707be608c2263b7d62d2a22f84b239401"
+      "sha256": "b3bd34c7f961631c76f810499e202ecf7ff7b28beb3933da63fd89be5b684e6b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "f67d85ba93fc5babadfce8e44653c771fc0ac07471c0f5ffdcb0b13b0fab244c"
+      "sha256": "470274822238a12b1ad33021c5c9fc233f69beefdb30730fc7208257e01a11ef"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "ac866c928701c41ac7f055f8807590a3db71eb2538502a54a6fca9ac1d79868d"
+      "sha256": "060cfd1249c09576e634c7c84c8470207cf55b93cb0719cc89821c8c59aa2a17"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "096a5ae6bd847f8cfff0cb8e12ebeae0c99f3116f0420babdaea9e683a2b9fd3"
+      "sha256": "b5bbd063bab04b41b5fa8769f2c8de1e0919c28be09bcdf45345ff9440558205"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6367,7 +6367,7 @@
     {
       "path": "tests/design_tokens_sync.mjs",
       "mode": "0000644",
-      "sha256": "6d1a9dfba7e6ef7606c68abc9df3fb6e479f1a2939b83ad342f907b338f17f2c"
+      "sha256": "9dcbd0bc8f34f98ec0b0ff63a629780928c9d60199f3d961733e03ab6a7bb4fa"
     },
     {
       "path": "tests/dev_lib.mjs",
@@ -7352,7 +7352,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "7f2fe0290fc0a429b54ca53d449453e9009a57e40bb8003b2718beef33be2309"
+      "sha256": "d0907a08d6b932d25df7b143e82c94d64a15eab66a7bd1df86ba85b1729661b7"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/modules/provisioning/routes/provisioning.js

@@ -91,11 +91,22 @@ function esc(s) {
   ));
 }
 
-// Cloud Bongos brand styling for the standalone onboarding pages — sunrise palette +
-// Baloo 2 / Quicksand (brand/cloud-bongos/tokens.json). Light + dark aware; no external
+// Accent pair resolved from the instance's own branding — the pack is the palette
+// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
+// a branding validation error still paints the current family, never a stale one.
+const ACCENT = (() => {
+  try {
+    const c = api.branding().theme?.ui?.colors || {};
+    return { sun: c.accent || '#ce4806', sun600: c.accentDeep || '#9e3406' };
+  } catch { return { sun: '#ce4806', sun600: '#9e3406' }; }
+})();
+
+// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
+// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
+// under the instance's own config/branding.json). Light + dark aware; no external
 // dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
 const PAGE_STYLE = `
-:root{color-scheme:light dark;--sun:#f97316;--sun600:#ea580c;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
+:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
 @media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
 *{box-sizing:border-box}html,body{height:100%}
 body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}

package/modules/status-ui/public/explore.html

@@ -8,8 +8,8 @@
     /* Self-contained so the showcase renders correctly whether or not the host
        injects theme tokens. Warm Cloud Bongos defaults; overridable by the pack. */
     :root {
-      --bg: #fff7ed; --card: #ffffff; --ink: #2a1f17; --ink-soft: #6b5d52;
-      --rule: #fed7aa; --accent: #ea580c;
+      --bg: #f9d9a8; --card: #fffaf2; --ink: #2b170e; --ink-soft: #6d4a33;
+      --rule: #e8a463; --accent: #ce4806;
     }
     * { box-sizing: border-box; }
     body {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.136",
+  "version": "1.19.138",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.136",
+      "version": "1.19.138",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.136",
+  "version": "1.19.138",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -2668,7 +2668,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
       }
       var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled (your personal account), because the build watches that exact address; a repo created under a different owner (an organization, say) is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
         '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
     }
 

package/src/module-api.js

@@ -699,8 +699,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.134 with no explicit bump. run 31863235867. (task 1002620)
 //   1.19.136 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.135 with no explicit bump. run 31889474899. (task 1002620)
+//   1.19.137 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.136 with no explicit bump. run 31890033301. (task 1002620)
+//   1.19.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.137 with no explicit bump. run 31891128524. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.136'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.138'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/design_tokens_sync.mjs

@@ -77,3 +77,71 @@ test('the claude-design adapter falls back to the pack accent, never a brand lit
       `hardcoded colour ${hex} in the claude-design adapter — resolve it from the tokens instead`);
   }
 });
+
+// ---- page-local palettes stay aligned with the pack (task 1002810) ---------
+//
+// The same drift class one layer up: a page (or served-HTML route) declaring its
+// own colour values silently keeps whatever palette it was born with when the
+// pack moves. tests/hall_audit.mjs §8 already bans hall pages from declaring
+// pack vars at all; these cover the two survivors outside the hall — the
+// status-ui explore page and the provisioning onboarding pages.
+
+const RETIRED_ACCENT_FAMILY = ['ea580c', 'c2410c', 'f97316', 'fff7ed', 'fed7aa'];
+
+function walk(dir, exts, out = []) {
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (e.name === 'node_modules' || e.name.startsWith('.')) continue;
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) walk(p, exts, out);
+    else if (exts.includes(path.extname(e.name))) out.push(p);
+  }
+  return out;
+}
+
+test('the retired pre-1002749 accent family appears nowhere in served UI code', () => {
+  const offenders = [];
+  for (const root of ['modules', 'src']) {
+    for (const f of walk(path.join(REPO_ROOT, root), ['.html', '.css', '.js'])) {
+      const text = fs.readFileSync(f, 'utf8').toLowerCase();
+      for (const hex of RETIRED_ACCENT_FAMILY) {
+        if (text.includes(`#${hex}`)) offenders.push(`${path.relative(REPO_ROOT, f)}: #${hex}`);
+      }
+    }
+  }
+  assert.deepEqual(offenders, [],
+    'a page carrying a retired accent hex is a private palette fork — align it with the pack (task 1002810)');
+});
+
+test('the explore page mirrors the pack, var for var', () => {
+  const html = fs.readFileSync(path.join(REPO_ROOT, 'modules/status-ui/public/explore.html'), 'utf8');
+  const root = html.match(/:root\s*\{([\s\S]*?)\}/);
+  assert.ok(root, 'explore.html declares a light :root block');
+  const colors = pack.theme.ui.colors;
+  const MIRROR = {
+    '--bg': colors.bg, '--card': colors.bgCard, '--ink': colors.ink,
+    '--ink-soft': colors.inkSoft, '--rule': colors.rule, '--accent': colors.accent,
+  };
+  for (const [cssVar, packVal] of Object.entries(MIRROR)) {
+    const m = root[1].match(new RegExp(`${cssVar}\\s*:\\s*(#[0-9a-fA-F]{6})`));
+    assert.ok(m, `explore.html defines ${cssVar}`);
+    assert.equal(m[1].toLowerCase(), String(packVal).toLowerCase(),
+      `explore.html ${cssVar} must equal the pack value — the injected themeMarkup paints exactly this, ` +
+      'so a divergent fallback renders a different page wherever injection is absent');
+  }
+});
+
+test('the provisioning onboarding pages resolve their accent pair from branding', () => {
+  const source = fs.readFileSync(
+    path.join(REPO_ROOT, 'modules/provisioning/routes/provisioning.js'), 'utf8');
+  assert.match(source, /--sun:\$\{/, '--sun interpolates a resolved value, never a literal');
+  assert.match(source, /--sun600:\$\{/, '--sun600 interpolates a resolved value, never a literal');
+  const block = source.match(/const ACCENT =[\s\S]*?\}\)\(\);/);
+  assert.ok(block, 'one resolved ACCENT pair (the FALLBACK_ACCENT idiom from the claude-design adapter)');
+  assert.match(block[0], /branding\(\)/, 'the pair resolves from the instance branding');
+  const allowed = new Set([pack.theme.ui.colors.accent, pack.theme.ui.colors.accentDeep]
+    .map((h) => String(h).toLowerCase()));
+  for (const hex of block[0].match(/#[0-9a-fA-F]{6}\b/g) || []) {
+    assert.ok(allowed.has(hex.toLowerCase()),
+      `ACCENT fallback ${hex} must be the pack accent/accentDeep, not a palette of its own`);
+  }
+});

package/tests/public_landing_projects.mjs

@@ -117,6 +117,21 @@ test('the empty state points a new owner at the wizard view — never at a hall'
   assert.doesNotMatch(body, /Enter the Hall/i);
 });
 
+test('the manual-repo step states placement and visibility — the owner never has to ask', async () => {
+  // QA walk F7 (task 1002702 → 1002721, owner firsthand): the "Create the empty
+  // GitHub repo" step never said WHERE the repo lands, and the owner had to ask
+  // "is there somewhere specific I should set it up?" mid-walk. The step must
+  // say the repo belongs at the exact prefilled owner/name (changing GitHub's
+  // Owner dropdown strands the build watching the wrong address) and must state
+  // the visibility choice up front, before GitHub's own radio is the first
+  // mention.
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /Owner box/, 'the step must name GitHub’s Owner box and say to leave it as prefilled');
+  assert.match(body, /exact address|exactly[^<]*repoLabel|land at exactly/,
+    'the step must say the build watches the exact owner/name');
+  assert.match(body, /public or private/i, 'visibility must be stated in our copy, not first seen on GitHub');
+});
+
 test('teardown copy states what the runner actually does, per hosting shape (F17)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   // the DECIDED policy: shared shapes keep the database; a dedicated machine