@bongos/core 1.19.354 → 1.19.355

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.354",
-  "core_contract": "1.19.354",
-  "source_commit": "b3914da0290b60c5eb6ce4f3c7c32b6f9ae07e1f",
+  "core_version": "1.19.355",
+  "core_contract": "1.19.355",
+  "source_commit": "a7ad49c28f305814b88df556ae4c1d18ceca1a01",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T13:13:49.790Z",
+  "built_at": "2026-08-25T13:24:07.447Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "4765f579b8f7f2e758fb27b63db2088b1dab283f54ada499fcaff84c0c86d920",
+  "tree_sha256": "abdcd03b753d6da9681bddd073feee645787426d01b5d8ecd460cba64d4a6b73",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0e7087b6c93131c62fbe40e9b626df9e4a4ec2719b1de4fc48e428d00a3a7e7b"
+      "sha256": "2e354a8f810ac30ec70aab86c458d275f4d598788d8dbbfb1fc2a91a9f035ff1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9ef59eab6d6debaa99f34c64cc37bf26ccd2db1dcf08fa89682eb02590da29ca"
+      "sha256": "7dc6f776203244cb6e6b909f1a32c93948d04dc243bfd714d281bf1b8ee8fcdb"
     },
     {
       "path": "public-docs/index.html",
@@ -6617,7 +6617,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "bf37dbda6a10fe8b21f6df01e8bdd62aea3f539523464b37666ffd535ceb7e00"
+      "sha256": "025676342224c2944fa2361965c12d9e6cf812fd17541c737a32fab7544c2709"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "534d2a2ac4a67829ae4589161a0900ee08b1312d512ef18fb4a136419b465f0d"
+      "sha256": "43ca06d2e5757257056bcaac608518df57c750d552ad667ec751a6ca28a0c00a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8147,7 +8147,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "2efddbab276f2ef38dbcf09ef6b76d4c1ff58f68c8b11a8803c7a27b605b385f"
+      "sha256": "7457d53dee7cce5770c17ec908c0f051e72092d2fa1cf5a9a1198fbdac64145a"
     },
     {
       "path": "tests/lib_sh_resolution.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.354",
+  "version": "1.19.355",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.354",
+      "version": "1.19.355",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.354",
+  "version": "1.19.355",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/serve-internal.js

@@ -169,7 +169,8 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
   const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
-  return String(html == null ? '' : html)
+  const hall = hallOrigin || origin || '';
+  return dropEmptyHrefLinks(String(html == null ? '' : html), { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
     .split('{{Currency}}').join(esc(Cur))
@@ -178,10 +179,23 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
     .split('{{publicOrigin}}').join(esc(origin || ''))
     // a pack that names no hall of its own resolves to its OWN apex — never to
     // whichever instance authored the file
-    .split('{{buildersOrigin}}').join(esc(hallOrigin || origin || ''))
+    .split('{{buildersOrigin}}').join(esc(hall))
     .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''))
     .split('{{instanceBase}}').join(esc(instanceBase || ''));
 }
+// A link whose href is a BARE origin token that resolves empty is dropped whole,
+// server-side (task 1003242; the branding contract): a pack that names no domains
+// would otherwise stamp `href=""` — a dead hall pill on every page carrying one,
+// and only index.html scrubs those client-side. Exact-token hrefs only: a token
+// inside a longer URL still stamps (an empty prefix leaves a relative path).
+function dropEmptyHrefLinks(html, values) {
+  let out = html;
+  for (const [token, value] of Object.entries(values)) {
+    if (value) continue;
+    out = out.replace(new RegExp(`<a\\b[^>]*\\bhref="\\{\\{${token}\\}\\}"[^>]*>[\\s\\S]*?<\\/a>`, 'g'), '');
+  }
+  return out;
+}
 // Every token lands in HTML — as element text, or inside a double-quoted
 // attribute (href/content). Escaping is defence in depth, not a live fix: the
 // only source is config/branding.json, which is committed, code-reviewed and

package/src/module-api.js

@@ -1138,8 +1138,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.352 with no explicit bump. run 32851392269. (task 1002620)
 //   1.19.354 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.353 with no explicit bump. run 32852045058. (task 1002620)
+//   1.19.355 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.354 with no explicit bump. run 32853063015. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.354'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.355'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/landing_page.mjs

@@ -142,6 +142,24 @@ test('an unstamped link is removed, not left dangling', () => {
   assert.ok(out.length > 0);
 });
 
+test('a pack with NO domains drops the hall pill server-side rather than stamping href="" (task 1003242)', () => {
+  // the hub has no client scrubber, so an empty token must never reach it as a dead link
+  const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
+  assert.match(HUB, /data-link-hall href="\{\{buildersOrigin\}\}"/, 'the hub pill is token-stamped');
+  const none = applyBrandTokens(HUB, BRAND, '', '');
+  assert.doesNotMatch(none, /href=""/, 'no empty href survives the stamp');
+  assert.doesNotMatch(none, /data-link-hall/, 'the pill element is omitted whole, not left dead');
+  assert.doesNotMatch(none, /\{\{[a-zA-Z]+\}\}/, 'every other token still stamps');
+  const apexOnly = applyBrandTokens(HUB, BRAND, 'https://spike-harbor.example', '');
+  assert.match(apexOnly, /data-link-hall href="https:\/\/spike-harbor\.example"/, 'an apex alone keeps the pill, pointed at the apex');
+  const both = applyBrandTokens(HUB, BRAND, 'https://spike-harbor.example', 'https://builders.spike-harbor.example');
+  assert.match(both, /data-link-hall href="https:\/\/builders\.spike-harbor\.example"/);
+  // the landing page too — its client-side scrubber is no longer the only guard
+  assert.doesNotMatch(applyBrandTokens(HTML, BRAND, '', ''), /<a\b[^>]*href=""/);
+  // a token INSIDE a longer href is a relative path once stamped empty, not a dead link — left alone
+  assert.equal(applyBrandTokens('<a href="{{publicOrigin}}/docs">Docs</a>', BRAND, '', ''), '<a href="/docs">Docs</a>');
+});
+
 // ── the branding cascade + portability ─────────────────────────────────────
 
 test('the page declares no :root — a page-local one defeats re-branding (C1)', () => {