@bongos/core 1.19.143 → 1.19.144

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.143",
-  "core_contract": "1.19.143",
-  "source_commit": "31df926208597154ce684504f0aa15d6b1dde113",
+  "core_version": "1.19.144",
+  "core_contract": "1.19.144",
+  "source_commit": "36beb6c51bf7da7c8677cd6cf29d3b3739b1fc86",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T15:52:12.410Z",
+  "built_at": "2026-08-15T16:06:10.087Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1575,
-  "tree_sha256": "a9a3320aae0cbec4eb5ec01e7b50675d69a50814017d7f4658efa4e52493deb4",
+  "tree_sha256": "5c594013e8ee432b685ee793f28efedacd67b463904cda4eb9942dd7dd6b62d3",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "5f68e2c2d9e7f46d2884dce06d8bc7a5ed71f7716800c1815d550e43bd896176"
+      "sha256": "a315183a94657af4ee558bc70eb2860782fa07576b9c55d0a028295f4287e2fc"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "51affa4342af5f89f0cfda20e74bb4120338ef58c2d0309c706a7dbdb25c4d8f"
+      "sha256": "385cb6e8816fd2bfefa4a04d5a8bc4a9dac9e4d540903d9f736883b8d8abbc5c"
     },
     {
       "path": "public-docs/index.html",
@@ -4422,7 +4422,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "06ed45b09cb35cc8b2e20816416c45a07dd6ca47f418ac9c239ab8c949796f8b"
+      "sha256": "4641a5c0c0222c0948ecdf57db9bb3cd88b5500089bbbbe735597abd4d44d4da"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "aa37e8e5b14f169f593a55eb71a0c21117c818a07d34d23a35c45219c646a5dd"
+      "sha256": "deae8db82f897ee77633ffb2b7f5144960d9961ba4cdb9e052346c6cb127b0c9"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "7ac4130655324a65c52dfd04a7b57c72371904149e8a126a16d341f82d3d1625"
+      "sha256": "8b8d833fa63b772e134faf867ad771f33293f81d8af3dd695221489217dd7c89"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6277,7 +6277,7 @@
     {
       "path": "tests/cosmos_token_contrast.mjs",
       "mode": "0000644",
-      "sha256": "6343c10b95c8ed1da86ae32367882a9970f19266bccedb26b3e15b73c5bdd37a"
+      "sha256": "dfb0f0b083a118c2bf8f424232f1e36e96f48aa962921649c487c93d5ce4eda2"
     },
     {
       "path": "tests/cost.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.143",
+  "version": "1.19.144",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.143",
+      "version": "1.19.144",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.143",
+  "version": "1.19.144",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -171,6 +171,18 @@
      navy pack accent falls under 4.5:1 on --bg-deep. Chrome keeps --accent-deep;
      only rules that paint a link inside prose take this. */
   --link-ink:var(--accent-deep);
+  /* CONTROL BOUNDARIES ONLY (task 1002824) — the edge that tells you a text
+     field IS a field. --line is a CARD hairline and measures 1.16:1 light /
+     1.09:1 dark, so a resting input drawn with it was invisible until focus
+     (its fill is 1.02:1 on the card too, so the border is the ONLY boundary
+     there is); WCAG 1.4.11 asks 3:1. --line itself must not move — it also
+     draws .review, .humanSteps>li, .kv, .ghlist, the unselected .tpill and the
+     .choice cards, and darkening it globally would restyle every card in both
+     modes. Ink-derived on purpose, never accent-derived: a boundary that
+     changed hue with a re-theme would read as a state. 55% clears 3:1 with
+     headroom in the binding (light) mode — 3.75:1 on --card, 3.82:1 on the
+     input's own --bg-card fill; dark lands at 5.41/5.35. */
+  --ctl-line:color-mix(in srgb, var(--ink) 55%, var(--bg-card));
   --neutral-soft:color-mix(in srgb, var(--ink) 8%, var(--bg-card));
   /* ink-derived so the shadow is a WARM brown on the marigold ground instead of
      the cold navy it used to cast. The dark blocks override it with a plain black
@@ -296,7 +308,7 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .addr .none{color:var(--ink-faint);font-style:italic;}
 .addr code{font-family:var(--font-mono);font-size:13px;background:var(--bg-deep);border-radius:6px;padding:1px 7px;color:var(--accent-deep);}
 .attach{display:flex;gap:10px;margin-top:10px;flex-wrap:wrap;}
-.attach input[type=text]{flex:1;min-width:220px;font-family:var(--font-body);font-size:15px;font-weight:600;color:var(--ink);background:var(--bg-card);border:2px solid var(--line);border-radius:12px;padding:9px 14px;outline:none;transition:border-color .15s ease, box-shadow .15s ease;}
+.attach input[type=text]{flex:1;min-width:220px;font-family:var(--font-body);font-size:15px;font-weight:600;color:var(--ink);background:var(--bg-card);border:2px solid var(--ctl-line);border-radius:12px;padding:9px 14px;outline:none;transition:border-color .15s ease, box-shadow .15s ease;}
 .attach input[type=text]::placeholder{color:var(--ink-faint);font-weight:500;}
 .attach input[type=text]:focus{border-color:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 13%,transparent);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
@@ -660,7 +672,7 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    the chip outcomes; it never relabels them — "Live" holds both `live` and
    `live?` because neither is known-down, and each card still says which. ── */
 .mineBar{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin-bottom:20px;}
-.mineBar .search{background:var(--bg-card);border-color:var(--line);}
+.mineBar .search{background:var(--bg-card);border-color:var(--ctl-line);}
 .mineBar .search input{color:var(--ink);}
 .mineBar .search input::placeholder{color:var(--ink-faint);}
 .mineBar .search svg{stroke:var(--ink-faint);}

package/public-landing/projects.html

@@ -80,7 +80,7 @@ h1[tabindex="-1"]:focus{outline:none;}
 .wizField small{font-weight:500;color:var(--ink-faint);}
 #view-new input[type=text]{
   width:100%;font-family:var(--font-body);font-size:17px;font-weight:600;color:var(--ink);
-  background:var(--bg-card);border:2px solid var(--line);border-radius:14px;padding:13px 16px;outline:none;
+  background:var(--bg-card);border:2px solid var(--ctl-line);border-radius:14px;padding:13px 16px;outline:none;
   transition:border-color .15s ease, box-shadow .15s ease;
 }
 /* no fade toward the card — a 70% mix washed placeholders to 2.89:1 (task 1002749) */

package/src/module-api.js

@@ -713,8 +713,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.141 with no explicit bump. run 31893298770. (task 1002620)
 //   1.19.143 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.142 with no explicit bump. run 31893905320. (task 1002620)
+//   1.19.144 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.143 with no explicit bump. run 31894547582. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.143'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.144'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cosmos_token_contrast.mjs

@@ -19,6 +19,17 @@ const CSS = path.join(
 );
 const src = fs.readFileSync(CSS, 'utf8');
 
+// The two sheets that actually ship, comment-stripped. Several static guards
+// below read these instead of resolved colors, so they are declared here beside
+// `src` rather than beside their first consumer — as source-order constants they
+// were only reachable because node:test defers a test body past module
+// evaluation, which is a thin thing to rest on.
+const cssSrc = src.replace(/\/\*[\s\S]*?\*\//g, '');
+const pageSrc = fs
+  .readFileSync(path.join(path.dirname(CSS), '..', 'projects.html'), 'utf8')
+  .replace(/<!--[\s\S]*?-->/g, '')
+  .replace(/\/\*[\s\S]*?\*\//g, '');
+
 // ── parse ────────────────────────────────────────────────────────────────────
 const declarations = (body) => {
   const out = {};
@@ -236,6 +247,23 @@ const PAIRS = [
   ['typeCard heading · business',       'color-mix(in srgb,var(--terracotta) 40%,var(--ink))', 'color-mix(in srgb,var(--terracotta) 9%,var(--bg-card))', 4.5],
   ['typeCard heading · non-profit',     'color-mix(in srgb,var(--gold-soft) 40%,var(--ink))',  'color-mix(in srgb,var(--gold-soft) 9%,var(--bg-card))',  4.5],
   ['typeCard heading · not-sure',       'color-mix(in srgb,var(--rule-soft) 40%,var(--ink))',  'color-mix(in srgb,var(--rule-soft) 9%,var(--bg-card))',  4.5],
+  // --ctl-line (task 1002824): the ONLY rows in this file that measure a border
+  // token as a FOREGROUND. WCAG 1.4.11 asks 3:1 of the boundary that IDENTIFIES
+  // a control, and a text field has nothing else to identify it — its --bg-card
+  // fill is 1.02:1 on the card it sits in, so the border IS the boundary. Both
+  // adjacent colors are measured: the --card outside and the fill inside.
+  //
+  // --line stays exactly where it is and is deliberately NOT held to this bar.
+  // It is a CARD hairline (1.16:1 light / 1.09:1 dark) drawing .review,
+  // .humanSteps>li, .kv, .ghlist, the unselected .tpill and the .choice cards.
+  // Two washed-down variants of it are likewise EXEMPT because they are
+  // DECORATIVE, not identifying: .humanSteps>li.slocked (55% line mix, ~1.06:1 —
+  // task 1002751) says "locked" through its number chip and muted text, and
+  // .proj.gone (the same mix — task 1002823) says "torn down" through its
+  // ghosted orb, its chip and a line of copy. Neither border carries state on
+  // its own, so raising them would buy nothing and restyle every card.
+  ['--ctl-line boundary on the card',   'var(--ctl-line)',      'var(--card)',          3.0],
+  ['--ctl-line boundary vs input fill', 'var(--ctl-line)',      CARD,                   3.0],
   ['?view=new input ::placeholder',     'var(--ink-faint)',     CARD,                   4.5],
   ['?view=new .ghlist .hint on deep',   'var(--ink-faint)',     'var(--bg-deep)',       4.5],
   ['--chrome-accent wordmark',          'var(--chrome-accent)', 'var(--page-bg)',       4.5],
@@ -360,6 +388,25 @@ test('no text link is left painting --accent-deep', () => {
   assert.deepEqual(strays, [], `\n  ${strays.join('\n  ')}\n`);
 });
 
+test('no text-entry control draws its boundary with --line', () => {
+  // The companion to the --ctl-line PAIRS rows: the token only helps the rules
+  // that take it, and these live in two sheets (cosmos.css owns .attach and
+  // .mineBar .search, projects.html owns the wizard's own #view-new fields), so
+  // fixing one sheet leaves the other invisible. Text-entry selectors only —
+  // --line is still correct for every card, list and pill it draws, which is the
+  // whole reason this became a second token instead of a change to --line.
+  const strays = [];
+  for (const [where, text] of [['cosmos.css', cssSrc], ['projects.html', pageSrc]]) {
+    for (const m of text.matchAll(/([^{}@]+)\{([^{}]*)\}/g)) {
+      if (!/\b(?:input|textarea|select)\b|\.search\b/.test(m[1])) continue;
+      if (/border(?:-color|-\w+)?\s*:[^;]*var\(\s*--line\s*\)/.test(m[2])) {
+        strays.push(`${where}: ${m[1].trim().slice(0, 70)}`);
+      }
+    }
+  }
+  assert.deepEqual(strays, [], `\n  ${strays.join('\n  ')}\n`);
+});
+
 // The gate's LOCKED sky palette — deliberately absent from COLOR_VARS, so a
 // branding pack can never re-theme these. Dark GROUNDS are allowed (dark mode IS
 // the gate's space, by design); text painted with one shows Cloud Bongos orange
@@ -411,11 +458,6 @@ test('dark blocks never re-point a token at the locked space palette', () => {
 // Known limits, accepted: @keyframes bodies, animation-fill-mode resting
 // values, and JS-set inline opacity are out of static reach — never make an
 // animation or script the resting presenter of text or a state mark.
-const pageSrc = fs
-  .readFileSync(path.join(path.dirname(CSS), '..', 'projects.html'), 'utf8')
-  .replace(/<!--[\s\S]*?-->/g, '')
-  .replace(/\/\*[\s\S]*?\*\//g, '');
-const cssSrc = src.replace(/\/\*[\s\S]*?\*\//g, '');
 const dimsBelowFull = (body) => {
   const m = body.match(/opacity\s*:\s*([\d.]+%?)/);
   if (!m) return false;