@bongos/core 1.19.289 → 1.19.291

package/package-lock.json

@@ -1,18 +1,24 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.289",
+  "version": "1.19.291",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.289",
+      "version": "1.19.291",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",
         "pg": "^8.20.0"
       }
     },
+    "node_modules/@pinojs/redact": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/@pinojs/redact/-/redact-0.4.0.tgz",
+      "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
+      "license": "MIT"
+    },
     "node_modules/accepts": {
       "version": "1.3.8",
       "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
@@ -32,6 +38,15 @@
       "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg==",
       "license": "MIT"
     },
+    "node_modules/atomic-sleep": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/atomic-sleep/-/atomic-sleep-1.0.0.tgz",
+      "integrity": "sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
     "node_modules/body-parser": {
       "version": "1.20.5",
       "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.5.tgz",
@@ -539,6 +554,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/on-exit-leak-free": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/on-exit-leak-free/-/on-exit-leak-free-2.1.2.tgz",
+      "integrity": "sha512-0eJJY6hXLGf1udHwfNftBqH+g73EU4B504nZeKpz1sYRKafAghwxEJunB2O7rDZkL4PGfsMVnTXZ2EjibbqcsA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/on-finished": {
       "version": "2.4.1",
       "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
@@ -655,6 +679,43 @@
         "split2": "^4.1.0"
       }
     },
+    "node_modules/pino": {
+      "version": "9.14.0",
+      "resolved": "https://registry.npmjs.org/pino/-/pino-9.14.0.tgz",
+      "integrity": "sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==",
+      "license": "MIT",
+      "dependencies": {
+        "@pinojs/redact": "^0.4.0",
+        "atomic-sleep": "^1.0.0",
+        "on-exit-leak-free": "^2.1.0",
+        "pino-abstract-transport": "^2.0.0",
+        "pino-std-serializers": "^7.0.0",
+        "process-warning": "^5.0.0",
+        "quick-format-unescaped": "^4.0.3",
+        "real-require": "^0.2.0",
+        "safe-stable-stringify": "^2.3.1",
+        "sonic-boom": "^4.0.1",
+        "thread-stream": "^3.0.0"
+      },
+      "bin": {
+        "pino": "bin.js"
+      }
+    },
+    "node_modules/pino-abstract-transport": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/pino-abstract-transport/-/pino-abstract-transport-2.0.0.tgz",
+      "integrity": "sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==",
+      "license": "MIT",
+      "dependencies": {
+        "split2": "^4.0.0"
+      }
+    },
+    "node_modules/pino-std-serializers": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/pino-std-serializers/-/pino-std-serializers-7.1.0.tgz",
+      "integrity": "sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==",
+      "license": "MIT"
+    },
     "node_modules/postgres-array": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/postgres-array/-/postgres-array-2.0.0.tgz",
@@ -694,6 +755,22 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/process-warning": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/process-warning/-/process-warning-5.1.0.tgz",
+      "integrity": "sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/proxy-addr": {
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
@@ -722,6 +799,12 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/quick-format-unescaped": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/quick-format-unescaped/-/quick-format-unescaped-4.0.4.tgz",
+      "integrity": "sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==",
+      "license": "MIT"
+    },
     "node_modules/range-parser": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
@@ -746,6 +829,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/real-require": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/real-require/-/real-require-0.2.0.tgz",
+      "integrity": "sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 12.13.0"
+      }
+    },
     "node_modules/safe-buffer": {
       "version": "5.2.1",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
@@ -766,6 +858,15 @@
       ],
       "license": "MIT"
     },
+    "node_modules/safe-stable-stringify": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/safe-stable-stringify/-/safe-stable-stringify-2.5.0.tgz",
+      "integrity": "sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/safer-buffer": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
@@ -895,6 +996,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/sonic-boom": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/sonic-boom/-/sonic-boom-4.2.1.tgz",
+      "integrity": "sha512-w6AxtubXa2wTXAUsZMMWERrsIRAdrK0Sc+FUytWvYAhBJLyuI4llrMIC1DtlNSdI99EI86KZum2MMq3EAZlF9Q==",
+      "license": "MIT",
+      "dependencies": {
+        "atomic-sleep": "^1.0.0"
+      }
+    },
     "node_modules/split2": {
       "version": "4.2.0",
       "resolved": "https://registry.npmjs.org/split2/-/split2-4.2.0.tgz",
@@ -913,6 +1023,15 @@
         "node": ">= 0.8"
       }
     },
+    "node_modules/thread-stream": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/thread-stream/-/thread-stream-3.2.0.tgz",
+      "integrity": "sha512-zLBvqpwr4Esa0kRjcrzGU6zL25lePWaCLMx0RQFrmteozIfeNdaMLpG5U7PeHzvlFkAWaRKA9/KVW4F60iB+qw==",
+      "license": "MIT",
+      "dependencies": {
+        "real-require": "^0.2.0"
+      }
+    },
     "node_modules/toidentifier": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.289",
+  "version": "1.19.291",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",
@@ -25,7 +25,8 @@
   },
   "dependencies": {
     "express": "^4.21.2",
-    "pg": "^8.20.0"
+    "pg": "^8.20.0",
+    "pino": "^9.14.0"
   },
   "overrides": {
     "undici": "^6.27.0"

package/scripts/gds/package-core.js

@@ -252,10 +252,13 @@ function isNpmStripped(pathRel) {
 // git) and staged in their place. Everything else still ships through the
 // normal isPublishable()/processCoreFile path.
 //
-// Core deps are express + pg (+ an undici pin) — ADR 0108 §Context. discord.js
-// (+ its undici requirement) is an OPTIONAL MODULE dependency, not core; a
-// consumer that enables the discord module installs it itself.
-const CORE_DEP_NAMES = ['express', 'pg'];
+// Core deps are express + pg + pino (+ an undici pin) — ADR 0108 §Context.
+// pino joined the core boot path with the structured logger (task 1003130:
+// platform-server → serve-internal → routes → middleware/audit → logger); a
+// published core without it crashes MODULE_NOT_FOUND at startup (task 1003160).
+// discord.js (+ its undici requirement) is an OPTIONAL MODULE dependency, not
+// core; a consumer that enables the discord module installs it itself.
+const CORE_DEP_NAMES = ['express', 'pg', 'pino'];
 
 // Pure — takes the source package.json's `dependencies`/`overrides` as plain
 // objects so this is unit-testable with no disk I/O. Throws if a required core

package/scripts/gds/triage.js

@@ -151,11 +151,80 @@ async function patchIdea(id, patch) {
   return r.data?.idea;
 }
 
-async function createTask({ versionId, title, description, priority, sourceRef }) {
-  // NOTE: POST /api/gds/tasks doesn't currently accept 'kind' — tasks default
-  // to 'unclassified' and the server-side classifier (B1) runs separately.
-  // The idea's auto-classified kind is therefore informational only at this
-  // step; the task description preserves the body for re-classification.
+// resolveGoalDefault — what goal should a triaged promotion land in? (task
+// 1003071 / R13.)
+//
+// PRECEDENCE IS DELIBERATE:
+//   1. `idea.suggested_goal_id` — the STORED hint. inbox.captureIdea writes it
+//      even when the matrix declined to route, precisely so "/idea-triage
+//      inherits the guess instead of re-deriving it" (core_222, its own comment).
+//      A human or a filing surface already named this goal; a heuristic must not
+//      overrule that.
+//   2. the R07 suggester (GET /goals/suggestions) — only when there is no hint.
+//      Best-scoring candidate, and its score/matched_terms are shown so the
+//      operator can see WHY before accepting.
+// Returns { goalId, label, source } — goalId null when neither yields anything.
+// The caller prints `source` as provenance, because "the suggester guessed this"
+// and "the filing already named this" deserve different trust. Never throws: a
+// suggester outage degrades to "no default", it does not block a triage verdict.
+//
+// `client` is injectable so the precedence can be driven end-to-end in a test
+// rather than pattern-matched in the source. (Task 1003102 shipped a handler
+// whose collaborators were not injectable; its tests read the source, passed,
+// and the route 500'd on every call. Not repeating that.)
+async function resolveGoalDefault(idea, versionId, { client = cliClient } = {}) {
+  // Guarded: a junk stored value must not become goalId NaN and then a goal_id
+  // the server rejects with 400 on every retry.
+  const hint = Number(idea.suggested_goal_id);
+  if (Number.isInteger(hint) && hint > 0) {
+    return { goalId: hint, label: `goal ${hint}`, source: 'hint' };
+  }
+  try {
+    const api = await client();
+    // The GENERATED typed method (regenerated when R07 landed), not the generic
+    // request() escape hatch — so a path or param rename reds the client build.
+    const r = await api.goals.getGoalsSuggestions({
+      query: { version: versionId, title: idea.title || '', body: (idea.body_md || '').slice(0, 2000), limit: 3 },
+    });
+    const top = r.ok && r.data && Array.isArray(r.data.suggestions) ? r.data.suggestions[0] : null;
+    if (!top) return { goalId: null, label: null, source: 'none' };
+    const why = (top.matched_terms || []).join('/');
+    return { goalId: Number(top.id), label: `${top.id} ${trim(top.title, 44)} (score ${top.score}${why ? ' · ' + why : ''})`, source: 'suggester' };
+  } catch (_) {
+    return { goalId: null, label: null, source: 'unavailable' };
+  }
+}
+
+// What the operator's answer to the goal prompt means. Blank ACCEPTS the shown
+// default — declining has to be said ('-' or 'none'), because silently dropping a
+// real default on a bare Enter is how work ends up in the general bucket by
+// accident. Declining is legal: the server then applies the catch-all itself.
+function applyGoalAnswer(defaultGoalId, rawAnswer) {
+  const answer = String(rawAnswer == null ? '' : rawAnswer).trim();
+  if (answer === '') return { goalId: defaultGoalId, warn: null };
+  if (answer === '-' || answer.toLowerCase() === 'none') return { goalId: null, warn: null };
+  const parsed = Number(answer);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    return { goalId: null, warn: "not a goal id — falling back to the version's general bucket" };
+  }
+  return { goalId: parsed, warn: null };
+}
+
+async function createTask({ versionId, title, description, priority, sourceRef, goalId = null }) {
+  // (The old note here said POST /api/gds/tasks does not accept 'kind'. That is
+  // no longer true — routes/tasks.js takes it, and the hall promote path already
+  // sends it. Left un-sent from THIS path deliberately: changing what kind a
+  // triaged promotion lands with is a behaviour change task R13 was not asked to
+  // make, and the server classifier still runs. Corrected rather than deleted so
+  // the next reader does not re-derive it.)
+  //
+  // task 1003071 (R13): goal_id is the point of this task. Omitting it does NOT
+  // leave the task goal-less — db.createTask (modules/lifecycle/db.js) defaults a
+  // goal-less create into the version's catch-all "<version> — general" goal. That
+  // bucket is the actual defect: it carries no done-when criteria, so since ADR
+  // 0183 made criteria close themselves off LINKED tasks, work parked there can
+  // never advance anything, and it does not read as real goal work on the board.
+  // Naming the goal here is what stops a triaged promotion falling into it.
   const body = {
     version_id: versionId,
     title,
@@ -165,6 +234,7 @@ async function createTask({ versionId, title, description, priority, sourceRef }
     source: 'idea_inbox',
     source_ref: sourceRef ?? null,
   };
+  if (goalId != null) body.goal_id = Number(goalId);
   const api = await cliClient();
   const r = await api.tasks.postTasks({ body });
   if (!r.ok) {
@@ -296,7 +366,7 @@ async function main() {
         }
 
         if (ans === 'p' || ans === 'promote') {
-          // Promote: ask for version + priority (defaulted from idea).
+          // Promote: version, priority, title, goal — each defaulted from the idea.
           const defaultVersion = idea.suggested_version || 'PMS-V2';
           const versionAns = (await prompt(rl, `  version [${defaultVersion}]: `)).trim();
           const versionId = versionAns || defaultVersion;
@@ -308,6 +378,23 @@ async function main() {
           const titleAns = (await prompt(rl, `  title [${trim(idea.title, 60)}]: `)).trim();
           const title = titleAns || idea.title;
 
+          // task 1003071 (R13): a triaged promotion NAMES its goal. The default
+          // comes from the stored hint, else the R07 suggester; '-' opts out
+          // explicitly, which falls through to the version's catch-all "general"
+          // bucket — now a choice someone typed rather than the silent default.
+          // The EFFECTIVE title, not idea.title: the suggester matches on title
+          // terms, and the operator may just have retitled this.
+          const gd = await resolveGoalDefault({ ...idea, title }, versionId);
+          if (gd.source === 'suggester') console.log(`  suggested goal: ${gd.label}`);
+          if (gd.source === 'unavailable') console.log('  (goal suggester unreachable — enter a goal id, or "-" to accept the general bucket)');
+          const goalPrompt = gd.goalId != null
+            ? `  goal [${gd.goalId}] ("-" for the version's general bucket): `
+            : '  goal (blank/"-" for the version\'s general bucket): ';
+          const goalAns = (await prompt(rl, goalPrompt)).trim();
+          const picked = applyGoalAnswer(gd.goalId, goalAns);
+          if (picked.warn) console.log(`  ! ${picked.warn}`);
+          const goalId = picked.goalId;
+
           try {
             const task = await createTask({
               versionId,
@@ -315,6 +402,7 @@ async function main() {
               description: idea.body_md || '',
               priority: Number.isFinite(priority) ? priority : null,
               sourceRef: `idea:${idea.id}`,
+              goalId,
             });
             await patchIdea(idea.id, {
               status: 'promoted',
@@ -323,7 +411,7 @@ async function main() {
             });
             summary.promoted++;
             promotedIds.push({ ideaId: idea.id, taskId: task.id });
-            console.log(`  ✓ promoted #${idea.id} → task #${task.id} (${versionId}, P${priority})`);
+            console.log(`  ✓ promoted #${idea.id} → task #${task.id} (${versionId}, P${priority}${goalId != null ? `, goal ${goalId}` : ', → general bucket'})`);
           } catch (err) {
             console.error(`  ! ${err.message}`);
           }
@@ -360,6 +448,9 @@ if (require.main === module) {
 }
 
 module.exports = {
+  resolveGoalDefault,
+  applyGoalAnswer,
+  createTask,
   resolveDevelopmentPath,
   parseDevelopment,
   loadDevelopment,

package/src/module-api.js

@@ -1005,8 +1005,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.287 with no explicit bump. run 32546561232. (task 1002620)
 //   1.19.289 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.288 with no explicit bump. run 32549912116. (task 1002620)
+//   1.19.290 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.289 with no explicit bump. run 32552538814. (task 1002620)
+//   1.19.291 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.290 with no explicit bump. run 32580353000. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.289'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.291'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/cutover_codemod.mjs

@@ -174,7 +174,7 @@ t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
 
 t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
   const { buildPackageJson } = require('../scripts/gds/package-core.js');
-  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
     assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);
   }

package/tests/package_core.mjs

@@ -360,15 +360,15 @@ t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
 });
 
-t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici override', () => {
+t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the undici override', () => {
   const pkg = buildPackageJson({
     version: '1.14.0',
-    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
   assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
-  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0' });
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0' });
   assert.equal(pkg.dependencies.phaser, undefined);
   assert.equal(pkg.dependencies['discord.js'], undefined);
   assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
@@ -400,7 +400,7 @@ t('publishArgs: private (restricted) publish, dry-run unless live (task 2089 / A
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
   assert.equal(pkg.overrides, undefined);
 });
 
@@ -408,8 +408,8 @@ t('buildPackageJson: throws when a required core dep is missing from the source'
   assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
 });
 
-t('CORE_DEP_NAMES is exactly [express, pg]', () => {
-  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg']);
+t('CORE_DEP_NAMES is exactly [express, pg, pino]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino']);
 });
 
 // A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and