@bongos/core 1.19.146 → 1.19.147

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.146",
-  "core_contract": "1.19.146",
-  "source_commit": "1363fd9197780c96da219f2f1f211ccdde0d7eae",
+  "core_version": "1.19.147",
+  "core_contract": "1.19.147",
+  "source_commit": "8d6433f6228308d27151412797ed154124c01460",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T19:30:54.439Z",
+  "built_at": "2026-08-16T13:47:45.087Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 304,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1577,
-  "tree_sha256": "9c0baec37d19b01ae748459e7d1faaf8308002ba71fa1a6a44da74e0b4617b14",
+  "tree_sha256": "98ecc774fccdee0a333941c4a1877532c9a43c2c731208b026618eef108a60d5",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4182,12 +4182,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "92ba433ccabd633bd48e20e6b2d28314ce3c83165e0250ffe943e648bb093571"
+      "sha256": "bd871b2a47195dd579fe80d257c70a3bc8dd59f7ababb8c2c3f6970e17208597"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9b6febaf8e44a6a540f3c248efeaf98c41a04ac649cdf609d1eb3ac5ad0f3e64"
+      "sha256": "bbbfb37b4aca95494916dc16c7b5087cd4b05fcd0d49b45112b6c40a95f32987"
     },
     {
       "path": "public-docs/index.html",
@@ -4427,7 +4427,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "4641a5c0c0222c0948ecdf57db9bb3cd88b5500089bbbbe735597abd4d44d4da"
+      "sha256": "611050e8599be5791e89f9711b76ef6efc5b1e8bd703e2badc6a6418a9ed432b"
     },
     {
       "path": "public-landing/buddha.png",
@@ -4437,12 +4437,12 @@
     {
       "path": "public-landing/index.html",
       "mode": "0000644",
-      "sha256": "1fa06d66fc4c1bbe3849e6fbf402852caea8b7cfc80a4c69ecad26d921d4264d"
+      "sha256": "f011cbcc82b95284f00dae9aa63600ea664f9edc5c7b79c533501c2c0c54495c"
     },
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "deae8db82f897ee77633ffb2b7f5144960d9961ba4cdb9e052346c6cb127b0c9"
+      "sha256": "5edfc22fd5d85453df0d83a531fd085b3d5d079b66c7e3f58dcb9a0261c6b4a6"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5777,7 +5777,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "1ee746f8bc9aef75aaf278c5ca67dc6734ceb214a5febc44d6e27556b42dd70a"
+      "sha256": "58e0f8df5b6dec29092ad054d62f7117f74d51e206680decb0f29065736e88ef"
     },
     {
       "path": "src/module-loader/catalog.js",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.146",
+  "version": "1.19.147",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.146",
+      "version": "1.19.147",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.146",
+  "version": "1.19.147",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -218,6 +218,10 @@ body{font-family:var(--font-body);color:var(--ink);background:var(--page-bg);min
 .top-right{display:flex;align-items:center;gap:clamp(10px,2vw,18px);}
 .who{display:flex;align-items:center;gap:10px;font-size:14px;font-weight:600;color:var(--chrome-ink-dim);min-height:34px;text-shadow:var(--chrome-glow);}
 .who img{width:30px;height:30px;border-radius:50%;border:2px solid rgba(255,255,255,0.85);box-shadow:var(--ava-shadow);}
+/* sign-out rides inside the identity chip, so it exists exactly when a session
+   does — the same glass voice as .btn-space, one size down (task 1002952) */
+.who .signout{font-family:var(--font-display);font-weight:700;font-size:12.5px;color:var(--glass-ink);background:var(--glass-bg);border:1.5px solid var(--glass-border);border-radius:999px;padding:5px 12px;text-decoration:none;text-shadow:var(--chrome-glow);backdrop-filter:blur(4px);}
+.who .signout:hover{border-color:var(--chrome-accent);color:var(--chrome-accent);}
 .btn-space{display:inline-flex;align-items:center;gap:8px;cursor:pointer;font-family:var(--font-display);font-weight:700;font-size:13.5px;color:var(--glass-ink);background:var(--glass-bg);border:1.5px solid var(--glass-border);border-radius:999px;padding:8px 16px;text-decoration:none;text-shadow:var(--chrome-glow);backdrop-filter:blur(4px);}
 .btn-space:hover{border-color:var(--chrome-accent);color:var(--chrome-accent);}
 /* the light/dark switch — same glass voice as .btn-space, icon-only */

package/public-landing/index.html

@@ -483,9 +483,30 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
 
   var API = '/api/bongos';
 
+  /* ── sign out. The logout endpoint is POST + cookie-gated, so a plain-anchor
+     GET navigation would 404 and leave the session live — the exact hall bug
+     task 1002245 fixed; its shell.js doLogout is the contract mirrored here.
+     The POST is also the only place the federated single-logout fan-out fires
+     (ADR 0144). Whether it lands or the network drops, still expire both
+     session cookies in BOTH the host-only and apex-scoped Domain forms (#726 —
+     a Max-Age=0 only matches the cookie whose Domain attribute it names), so
+     this browser at least is signed out, then reload into the signed-out page. ── */
+  function doLogout() {
+    var finish = function () {
+      var apex = location.hostname.split('.').slice(-2).join('.');
+      ['gds_session', 'pms_session'].forEach(function (name) {
+        document.cookie = name + '=; Max-Age=0; path=/';
+        document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
+      });
+      window.location.assign(location.pathname);
+    };
+    fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' }).then(finish, finish);
+  }
+
   /* ── the identity chip. Signed out (401) leaves it empty — the header's own
      doors are the signed-out affordance. Built with createElement/textContent,
-     never innerHTML: the same rule the status UI keeps. ── */
+     never innerHTML: the same rule the status UI keeps. Signed in it carries
+     the one session control the page owes its visitor: Sign out (task 1002952). ── */
   fetch(API + '/me', { credentials: 'same-origin' })
     .then(function (res) { return res.ok ? res.json() : null; })
     .then(function (data) {
@@ -498,6 +519,12 @@ h1.big{font-family:var(--font-display);font-weight:700;font-size:clamp(33px,5.4v
         host.appendChild(img);
       }
       host.appendChild(document.createTextNode(me.github_login));
+      var out = document.createElement('a');
+      out.className = 'signout';
+      out.href = API + '/auth/logout'; /* honest hover target; the click upgrades it to the real POST */
+      out.textContent = 'Sign out';
+      out.addEventListener('click', function (e) { e.preventDefault(); doLogout(); });
+      host.appendChild(out);
     })
     .catch(function () { /* signed out or offline — the chip stays empty */ });
 

package/public-landing/projects.html

@@ -3904,13 +3904,44 @@ h1[tabindex="-1"]:focus{outline:none;}
   function renderWho() {
     var w = $('who');
     if (me) {
+      /* the chip carries the one session control this page owes its visitor:
+         Sign out (task 1002952). The anchor's href is the honest hover target;
+         the delegated click below upgrades it to the real POST. */
       w.innerHTML = (me.avatar_url ? '<img src="' + esc(me.avatar_url) + '" alt="">' : '') +
-        '<span>' + esc(me.github_login || 'signed in') + '</span>';
+        '<span>' + esc(me.github_login || 'signed in') + '</span>' +
+        '<a class="signout" href="' + API + '/auth/logout">Sign out</a>';
     } else {
       w.innerHTML = '';
     }
   }
 
+  /* Sign out. The logout endpoint is POST + cookie-gated, so a plain-anchor GET
+     would 404 and leave the session live — the exact hall bug task 1002245
+     fixed; its shell.js doLogout is the contract mirrored here. The POST is
+     also the only place the federated single-logout fan-out fires (ADR 0144).
+     Whether it lands or the network drops, still expire both session cookies
+     in BOTH the host-only and apex-scoped Domain forms (#726 — a Max-Age=0
+     only matches the cookie whose Domain attribute it names), then reload the
+     bare path: the boot re-runs and paints the signed-out shell. Delegated on
+     the chip because renderWho rewrites its innerHTML. */
+  function doLogout() {
+    var finish = function () {
+      var apex = location.hostname.split('.').slice(-2).join('.');
+      ['gds_session', 'pms_session'].forEach(function (name) {
+        document.cookie = name + '=; Max-Age=0; path=/';
+        document.cookie = name + '=; Max-Age=0; path=/; Domain=.' + apex;
+      });
+      window.location.assign(location.pathname);
+    };
+    fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' }).then(finish, finish);
+  }
+  $('who').addEventListener('click', function (ev) {
+    var a = ev.target.closest && ev.target.closest('a.signout');
+    if (!a) return;
+    ev.preventDefault();
+    doLogout();
+  });
+
   function load() {
     fetch(API + '/provisioning/instances', { credentials: 'same-origin' })
       .then(function (res) {

package/src/module-api.js

@@ -719,8 +719,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.144 with no explicit bump. run 31895007353. (task 1002620)
 //   1.19.146 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.145 with no explicit bump. run 31904091158. (task 1002620)
+//   1.19.147 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.146 with no explicit bump. run 31950807165. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.146'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.147'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');