@bongos/core 1.19.250 → 1.19.251

package/src/module-api.js

@@ -927,8 +927,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.248 with no explicit bump. run 32199293372. (task 1002620)
 //   1.19.250 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.249 with no explicit bump. run 32203357427. (task 1002620)
+//   1.19.251 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.250 with no explicit bump. run 32204008770. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.250'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.251'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/publish_manifest.mjs

@@ -15,7 +15,15 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+// fs/path/ROOT serve the disk-DERIVED guards at the bottom of this file (task
+// 1003132). They must read the tree rather than a list: an enumerated assertion
+// would miss the next unclassified module exactly as the enumerated allowlist
+// missed the one that prompted them.
+import fs from 'node:fs';
+import path from 'node:path';
+import url from 'node:url';
 
+const ROOT = path.resolve(path.dirname(url.fileURLToPath(import.meta.url)), '..');
 const require = createRequire(import.meta.url);
 const m = require('../scripts/gds/publish-manifest.js');
 const {
@@ -179,6 +187,80 @@ t('every PROTECTED_GLOB is either topology-excluded or publishable (the methodol
     assert.ok(isPublishable(g), `protected surface "${g}" is neither denied nor publishable — re-decide the carve-out`);
   }
 });
+// ── the publish question, asked of the tree itself (task 1003132) ───────────────────
+//
+// THE GAP THESE CLOSE. modules/copy-desk/ was designed, built, tested against a real
+// Postgres, graded, merged and very nearly RELEASED while publishing nothing. Not one
+// of the 429 unit tests, 20+ fitness checks, or the adversarial grader asks the publish
+// question, and the assertions above enumerate representative paths — so a brand-new
+// module key appears in no list and is simply invisible.
+//
+// The failure is worse than "the feature does not ship", because it is ASYMMETRIC: the
+// module's hall page ships anyway (modules/hall-ui/ is one allowlisted subtree), so a
+// release delivers a nav tab and a page whose every API call 404s.
+//
+// Both guards DERIVE from disk. A list here would rot the same way the allowlist did.
+//
+// Modules deliberately not published, on the record. An entry here is a decision
+// someone made, not a gap someone forgot — and every entry needs the task or idea that
+// records the decision, so this can never become a quiet parking lot.
+const KNOWN_UNPUBLISHED_MODULES = new Map([
+  // Same gap as copy-desk, found by the guard below the moment it was written. LATENT
+  // rather than live only because agents is default:false — the day a released instance
+  // enables it, the loader MODULE_NOT_FOUNDs, which is exactly what the provisioning
+  // (task 2135) and platform-identity (task 1002235) allowlist entries exist to prevent.
+  // Left for goal 1000038 rather than fixed here: deciding what the published core
+  // contains for the agents module is that goal's call, not a drive-by from a copy-desk
+  // task. Filed as idea 1000797 with the one-line fix.
+  ['agents', 'idea 1000797'],
+]);
+
+t('every module on disk is either publishable or deliberately unpublished (a new module cannot be silently invisible)', () => {
+  const modulesDir = path.join(ROOT, 'modules');
+  const keys = fs.readdirSync(modulesDir, { withFileTypes: true })
+    .filter((d) => d.isDirectory() && fs.existsSync(path.join(modulesDir, d.name, 'module.json')))
+    .map((d) => d.name);
+  assert.ok(keys.length > 5, `sanity: only ${keys.length} modules found on disk — the scan is broken, not the tree`);
+
+  const unclassified = keys.filter((k) => {
+    const manifest = `modules/${k}/module.json`;
+    return !isPublishable(manifest) && !matchesDeny(manifest) && !KNOWN_UNPUBLISHED_MODULES.has(k);
+  });
+  assert.deepEqual(unclassified, [],
+    'these modules are in neither the allowlist nor a deny list, so they publish NOTHING. Add each to PUBLISH_ALLOWLIST, deny it on the record, or register it in KNOWN_UNPUBLISHED_MODULES with the task that decided it.');
+});
+
+t('every KNOWN_UNPUBLISHED_MODULES entry names a real module and a real decision', () => {
+  // Two ways this exception list rots: an entry outlives the module (and silently
+  // exempts nothing), or an entry outlives the fix (and silently exempts something
+  // already fixed). Both make the guard above weaker than it looks.
+  for (const [key, ref] of KNOWN_UNPUBLISHED_MODULES) {
+    assert.ok(fs.existsSync(path.join(ROOT, 'modules', key, 'module.json')),
+      `KNOWN_UNPUBLISHED_MODULES names "${key}", which is not a module on disk — drop the entry`);
+    assert.ok(/\b(task|idea)\s+\d+/.test(ref),
+      `KNOWN_UNPUBLISHED_MODULES["${key}"] must cite the task or idea that decided it, got "${ref}"`);
+    assert.equal(isPublishable(`modules/${key}/module.json`), false,
+      `"${key}" is now publishable — delete its KNOWN_UNPUBLISHED_MODULES entry so the guard covers it again`);
+  }
+});
+
+t('a hall page named for a module ships only if that module ships (never a tab whose API 404s)', () => {
+  const hallDir = path.join(ROOT, 'modules/hall-ui/public');
+  const modulesDir = path.join(ROOT, 'modules');
+  if (!fs.existsSync(hallDir)) return;
+  const orphans = [];
+  for (const f of fs.readdirSync(hallDir)) {
+    if (!f.endsWith('.html')) continue;
+    const key = f.replace(/\.html$/, '');
+    // Only pages that NAME a module are paired — the hall's own pages (work, goals,
+    // settings…) have no module and are not the subject of this rule.
+    if (!fs.existsSync(path.join(modulesDir, key, 'module.json'))) continue;
+    if (!isPublishable(`modules/${key}/module.json`)) orphans.push(f);
+  }
+  assert.deepEqual(orphans, [],
+    'these hall pages would ship to instances whose backing module does not — a nav tab and a page whose every call 404s. Publish the module, or stop publishing the page.');
+});
+
 t('the topology subset of the protected surfaces is never publishable', () => {
   for (const g of PROTECTED_TOPOLOGY_EXCLUDE) {
     assert.equal(isPublishable(g), false, `topology surface "${g}" must not publish`);