@bongos/core 1.19.328 → 1.19.329

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.328",
-  "core_contract": "1.19.328",
-  "source_commit": "6897b2516a4a7f0b138ea4fb2c7477ec70dd1383",
+  "core_version": "1.19.329",
+  "core_contract": "1.19.329",
+  "source_commit": "ed313bf56c84b4802561c1a22a7b1f13552d3297",
   "source_ref": "HEAD",
-  "built_at": "2026-08-24T22:47:11.897Z",
+  "built_at": "2026-08-24T23:19:59.592Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 324,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1811,
-  "tree_sha256": "89e32bb1ea6b184d5fa7d3e224f40a10fe95675f1bdded8750985042f9942349",
+  "tree_sha256": "2e52a9d82898b6470557b59fc6ca710346a09b410a7f47f88fc037ad493df397",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4667,12 +4667,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "af956f74c63054468aa30a91c2996ef93e636903e823c30d141fb12214a8127d"
+      "sha256": "454fbe2af15bdbe1cdd60d5eb558c601062ee8efb13b21805f0644e07a125984"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "709ecfd08e6bf78726409f18c5fcf175aa73da3d0e68db9c7faf73cf59f78f6e"
+      "sha256": "40a3c39811c23c665f9710599982e4964d6f58d405c6e2fcf24b96e4aab36820"
     },
     {
       "path": "public-docs/index.html",
@@ -4912,7 +4912,7 @@
     {
       "path": "public-landing/assets/cosmos.css",
       "mode": "0000644",
-      "sha256": "32b7b1c69e01531170143bd55a0a23aebb076e3bce5e8775da55e26307bc5c2d"
+      "sha256": "d39de81b2de333eb82eb5486bf975b56a99d24cf56bc84815fdf4bb96ae9fa0e"
     },
     {
       "path": "public-landing/assets/verro-medallion.png",
@@ -4932,7 +4932,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "df56b665c742287ea4387730fa7f981472a63c6d761b757115c06e5dcdea8c5f"
+      "sha256": "98e234b47865c9f84650d2b1a9408610965ef780492fcc9b70d74adee57ad039"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -6452,7 +6452,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "94d24f1fc6ba8fe13ea3f04ade9e3f18191392911804ef03839e335c1116a3f8"
+      "sha256": "a06153efe33e5d5729c4c6a86e1889441808217fa7fe6c9b07bd6b5ebe86114c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8332,7 +8332,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "d56e9f8ed2a964b59ec5893399a52b1c9536caa3cc1b95967a7711fed2e5fa4a"
+      "sha256": "566428702a778df50caf55d7050adbe18d3005eecf8f63aa6a758437ab2934a7"
     },
     {
       "path": "tests/promote_goal_id.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.328",
+  "version": "1.19.329",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.328",
+      "version": "1.19.329",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.328",
+  "version": "1.19.329",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/assets/cosmos.css

@@ -321,6 +321,12 @@ h1{font-family:var(--font-display);font-weight:700;font-size:clamp(24px,3.4vw,32
 .attach input[type=text]{flex:1;min-width:220px;font-family:var(--font-body);font-size:15px;font-weight:600;color:var(--ink);background:var(--bg-card);border:2px solid var(--ctl-line);border-radius:12px;padding:9px 14px;outline:none;transition:border-color .15s ease, box-shadow .15s ease;}
 .attach input[type=text]::placeholder{color:var(--ink-faint);font-weight:500;}
 .attach input[type=text]:focus{border-color:var(--accent);box-shadow:0 0 0 4px color-mix(in srgb,var(--accent) 13%,transparent);}
+/* the bring-your-own-domain fold (owner decision 2, 2026-08-24): the wizard's
+   address-step disclosure, closed by default and after the card's doors — a
+   domain the founder can't buy here must not be the card's loudest control */
+.attachFold{margin-top:12px;}
+.attachFold summary{cursor:pointer;width:fit-content;font-size:13px;font-weight:700;color:var(--ink-faint);}
+.attachFold summary:hover,.attachFold[open] summary{color:var(--ink-soft);}
 .projMsg{font-size:13.5px;font-weight:600;margin-top:10px;min-height:18px;color:var(--ink-soft);line-height:1.5;}
 .projMsg.ok{color:var(--ok);}
 .projMsg.err{color:var(--err);}

package/public-landing/projects.html

@@ -3813,6 +3813,32 @@ h1[tabindex="-1"]:focus{outline:none;}
     return '<span class="none">No address yet</span> — sign-in on this project can’t be set up until it has one.';
   }
 
+  /* ── the bring-your-own-domain fold (owner decision 2, 2026-08-24). A live
+     card's loudest control used to be a full-width domain field + filled
+     button — for a domain the founder can't buy here — while the success
+     moment had only "Open site →". The field now sits behind the disclosure
+     the wizard's address step uses (direction §6): closed, after the card's
+     doors, and only where something is or will be answering — live and
+     queued. A snagged or torn-down card has nothing to point a domain at, so
+     it carries no fold (canAttachDomain stays the server's mirror; this is
+     the card's own call). The re-kick door (F19) keeps its shape — open and
+     pre-filled, one button: Try the address again. ── */
+  function attachFold(inst, iid) {
+    if (!canAttachDomain(inst)) return '';
+    if (inst.status !== 'active' && inst.status !== 'requested') return '';
+    /* the strip already says "Wiring the address" — a second attach would only
+       be refused (intent_conflict), so the fold waits for the run to land */
+    if (inst.open_intent && inst.open_intent.action === 'domain-attach') return '';
+    var rekick = inst.status === 'active' && inst.domain && inst.error_note;
+    return '<details class="attachFold"' + (rekick ? ' open' : '') + '>' +
+      '<summary>' + (rekick ? 'Try the address again' : inst.domain ? 'Use a domain I own' : 'Give it an address') + '</summary>' +
+      '<div class="attach">' +
+      '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
+      (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
+      '<button type="button" class="btn small" data-attach="' + iid + '">' +
+      (rekick ? 'Try the address again' : 'Use this domain') + '</button></div></details>';
+  }
+
   function renderCard(inst) {
     /* iid is for MARKUP interpolation only (esc() = HTML escape); the DOM
        lookup goes through liFor(), which CSS-escapes — the two escapes are
@@ -3835,14 +3861,6 @@ h1[tabindex="-1"]:focus{outline:none;}
       (meta.length ? '<div class="projMeta">' + meta.map(function (m) { return '<span>' + m + '</span>'; }).join('') + '</div>' : '');
     var addr = addressRow(inst);
     if (addr) body += '<div class="addr">' + addr + '</div>';
-    if (canAttachDomain(inst)) {
-      var rekick = inst.status === 'active' && inst.domain && inst.error_note;
-      body += '<div class="attach">' +
-        '<input type="text" id="dom-' + iid + '" placeholder="myproject.example.com" autocomplete="off" spellcheck="false" maxlength="253" aria-label="A domain you own, for ' + esc(inst.slug) + '"' +
-        (rekick ? ' value="' + esc(inst.domain) + '"' : '') + '>' +
-        '<button type="button" class="btn small" data-attach="' + iid + '">' +
-        (rekick ? 'Try the address again' : inst.domain ? 'Use your own domain' : 'Give it an address') + '</button></div>';
-    }
     if ((inst.status === 'error' || inst.error_note) && !inst.open_intent) {
       /* once a retry is queued the strip tells the story — the stale error
          paragraph would just contradict it (owner walk, 2026-08-12). Also
@@ -3871,7 +3889,22 @@ h1[tabindex="-1"]:focus{outline:none;}
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-revive="' + iid + '">Bring it back</button>');
     if (canTeardown(inst)) acts.push('<button type="button" class="btn small danger" data-teardown="' + iid + '">Tear it down</button>');
     if (acts.length) body += '<div class="actions" id="act-' + iid + '">' + acts.join('') + '</div>';
+    body += attachFold(inst, iid);
+    /* sig() buckets recency per minute, so a live card re-renders on the
+       heartbeat — that must not snap an open fold shut, eat a half-typed
+       domain or drop the caret. defaultValue tells a founder's typing from
+       the re-kick pre-fill. */
+    var oldFold = li.querySelector('details.attachFold');
+    var oldInput = oldFold ? oldFold.querySelector('input') : null;
+    var keepOpen = !!(oldFold && oldFold.open);
+    var typed = oldInput && oldInput.value !== oldInput.defaultValue ? oldInput.value : '';
+    var hadFocus = !!oldInput && document.activeElement === oldInput;
     li.innerHTML = orbFor(inst) + '<div class="projBody">' + body + '</div>';
+    var fold = li.querySelector('details.attachFold');
+    var input = fold ? fold.querySelector('input') : null;
+    if (fold && keepOpen) fold.open = true;
+    if (input && typed) input.value = typed;
+    if (input && hadFocus) input.focus();
   }
 
   function render(instances) {

package/src/module-api.js

@@ -1083,8 +1083,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.326 with no explicit bump. run 32782353048. (task 1002620)
 //   1.19.328 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.327 with no explicit bump. run 32786284063. (task 1002620)
+//   1.19.329 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.328 with no explicit bump. run 32788827293. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.328'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.329'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -221,3 +221,46 @@ test('the inputs a stranger types into are labelled', () => {
   assert.match(HUB, /id="ghNewName"[^>]*aria-label="New repository name"/);
   assert.match(SCRIPT, /aria-label="A domain you own, for ' \+ esc\(inst\.slug\) \+ '"/);
 });
+
+/* ── the custom-domain field sits behind a fold (owner decision 2, 2026-08-24) ── */
+test('the domain field is a closed disclosure after the card’s doors — never the card’s loudest control', () => {
+  const fold = fn('attachFold');
+  assert.match(fold, /<details class="attachFold"/, 'the wizard’s address-step disclosure shape');
+  assert.match(fold, /Use a domain I own/, 'labelled the way the wizard labels it');
+  assert.match(fold, /inst\.status !== 'active' && inst\.status !== 'requested'\) return ''/, 'live + queued only — snagged and torn-down cards carry no fold');
+  assert.match(fold, /if \(!canAttachDomain\(inst\)\) return ''/, 'the server-mirror gate still comes first');
+  assert.match(fold, /inst\.open_intent\.action === 'domain-attach'\) return ''/, 'no second attach control while one is wiring');
+  assert.doesNotMatch(fold, /Use your own domain/, 'the old filled-button label is gone');
+  const card = fn('renderCard');
+  assert.doesNotMatch(card, /<div class="attach">/, 'renderCard no longer inlines the bare field');
+  const actions = card.indexOf('<div class="actions" id="act-');
+  const foldCall = card.indexOf('body += attachFold(inst, iid);');
+  assert.ok(actions >= 0 && foldCall > actions, 'Open site → Manage → (fold): the fold renders after the actions row');
+  assert.match(COSMOS, /\.attachFold summary\{cursor:pointer;/, 'the summary reads as a control');
+  // the 390px capture: the fold stacks field over button because the row wraps
+  // and the field's minimum (220px) is narrower than a phone card's body; the
+  // fold itself sets no width, so it can never be the thing that overflows
+  assert.match(COSMOS, /\.attach\{display:flex;gap:10px;margin-top:10px;flex-wrap:wrap;\}/, 'the row wraps at phone width');
+  assert.match(COSMOS, /\.attach input\[type=text\]\{flex:1;min-width:220px;/, 'the field fits a 390px card and grows on a laptop');
+  assert.doesNotMatch(COSMOS, /\.attachFold[^{]*\{[^}]*(width|min-width):(?!fit-content)/, 'the fold sets no width of its own');
+  // and in both themes: the summary reads from tokens, never a literal colour
+  assert.doesNotMatch((COSMOS.match(/\.attachFold[^\n]*/g) || []).join('\n'), /#[0-9a-f]{3,8}\b/i, 'the fold paints from --ink-faint / --ink-soft, so dark mode needs no twin');
+});
+
+test('the F19 re-kick door survives the fold: open, pre-filled, one button', () => {
+  const fold = fn('attachFold');
+  assert.match(fold, /var rekick = inst\.status === 'active' && inst\.domain && inst\.error_note;/);
+  assert.match(fold, /\(rekick \? ' open' : ''\)/, 'the fold opens on its own for a stalled address');
+  assert.match(fold, /\(rekick \? ' value="' \+ esc\(inst\.domain\) \+ '"' : ''\)/, 'pre-filled with the address that stalled');
+  assert.match(fold, /rekick \? 'Try the address again' : 'Use this domain'/, 'and the button says what it does');
+  assert.match(fn('canAttachDomain'), /inst\.status === 'active' && inst\.domain && inst\.error_note && !inst\.open_intent\) return true;/, 'the route-side re-kick gate is untouched');
+});
+
+test('a heartbeat re-render keeps an open fold open and a half-typed domain typed', () => {
+  const card = fn('renderCard');
+  assert.match(card, /var keepOpen = !!\(oldFold && oldFold\.open\);/);
+  assert.match(card, /oldInput\.value !== oldInput\.defaultValue \? oldInput\.value : ''/, 'typing is told apart from the re-kick pre-fill');
+  assert.match(card, /document\.activeElement === oldInput/, 'the caret comes back too');
+  const set = card.indexOf('li.innerHTML = orbFor(inst)');
+  assert.ok(card.indexOf('var keepOpen') < set && card.indexOf('if (fold && keepOpen) fold.open = true;') > set, 'read before the swap, restore after it');
+});