@bongos/core 1.19.576 → 1.19.578

package/scripts/gds/build-cli-package.js

@@ -0,0 +1,517 @@
+#!/usr/bin/env node
+// scripts/gds/build-cli-package.js — generate the public, client-only `@cloudbongos/cli`
+// npm package from this repo (task 1003679, goal 1000054).
+//
+// WHY THIS EXISTS
+// The core ships as `@bongos/core`, which is PRIVATE. That makes the front door unusable for
+// anyone without a credential: a newcomer cannot install anything, so "take on a task" has no
+// terminal path at all and the web hall is the only way in. This script cuts the CLI *surface*
+// out of the core and emits a small, public, server-free package, so `npx @cloudbongos/cli
+// login <instance>` works from a bare laptop.
+//
+// WHAT IT IS NOT
+// It does NOT publish the core. No server, no routes, no auth middleware, no pool/db, no
+// provisioning. Publishing the core would bypass the ADR 0099 redaction pipeline; this package
+// carries a file list narrow enough to actually audit, and REDACTION_PATTERNS below fails the
+// build if instance identity leaks into it.
+//
+// WHY THE FILE LIST IS DECLARED, NOT COMPUTED
+// A static require-closure is unusable here. `src/module-api.js` is the published module doorway
+// (ADR 0083) and by design *names* every kernel capability, so any static walk that reaches a
+// module file appears to reach the whole server — even though the getters are lazy and never
+// resolve. The honest instrument is behaviour: FILES is declared, and tests/cli_package.mjs packs
+// the tarball, installs it into an empty directory with no repo present, and RUNS every verb.
+// If a real code path needs a file that isn't here, that test fails with MODULE_NOT_FOUND.
+//
+// Usage:
+//   node scripts/gds/build-cli-package.js [--out dist/cloudbongos-cli] [--version 0.1.0] [--quiet]
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.join(__dirname, '..', '..');
+
+// The package's OWN version — deliberately independent of the core's. The core moves many times
+// a day (CI auto-patch, ADR 0161); the CLI's public contract should not.
+const PACKAGE_VERSION = '0.1.0';
+const PACKAGE_NAME = '@cloudbongos/cli';
+
+// ── What the package carries ────────────────────────────────────────────────────────────────
+// Every entry is repo-relative and copied verbatim. Grouped by why it's here, because the
+// grouping is the audit: anything that doesn't fit a group below does not belong in a public
+// client package.
+const FILES = [
+  // The shared CLI plumbing every verb goes through: session file, HTTP, error shapes.
+  'scripts/gds/cli-lib.js',
+  'scripts/gds/api.js',
+
+  // Account + sign-in. login.js is the whole point — GitHub device flow, no paste, no credential.
+  'scripts/gds/login.js',
+  'scripts/gds/reauth.js',
+  'scripts/gds/setup.js',
+  'scripts/gds/onboarding-config.js', // lazy dep of setup.js
+  'scripts/gds/install-git-hooks.js', // lazy dep of setup.js
+  'scripts/gds/preflight.js',
+
+  // Read the board and move your own work along.
+  'scripts/gds/start.js',
+  'scripts/gds/context-pack.js', // start.js renders through this
+  'scripts/gds/status.js',
+  'scripts/gds/task.js',
+  'scripts/gds/recall.js',
+  'scripts/gds/cost.js',
+  'scripts/gds/release.js',
+
+  // Get onto a real environment without installing one: the cloud dev box.
+  'scripts/gds/shell.js',
+  'scripts/gds/code.js',
+  'scripts/gds/box-connect-lib.js',
+
+  // Module files the above touch. Each imports nothing from the kernel at load time.
+  'modules/lifecycle/task-classifier.js',
+  'modules/lifecycle/task-visuals.js',
+  'modules/economy/reward-policy.js',
+
+  // The only core files in the package: config/branding readers and one constant table.
+  // src/module-api.js is here because task-classifier.js reads branding through the doorway
+  // (ADR 0083 forbids a module importing src/branding directly). Its `branding` getter resolves
+  // against src/branding.js, which ships; the other getters point at server files that do not,
+  // and no client path touches them — the smoke test is what proves that.
+  'src/branding.js',
+  'src/instance-config.js',
+  'src/module-seams.js',
+  'src/module-api.js',
+  'src/bongos/api-prefix.js',
+
+  // The generated typed API client (ADR 0118), which cli-lib.js reaches by a dynamic
+  // `import()` of this exact path. Vendored as a single file rather than depended on: it is
+  // published as `@bongos/client`, which is PRIVATE, so a public package that declared it as a
+  // dependency would be uninstallable for everyone. index.mjs is self-contained and imports
+  // nothing; the sibling package.json is deliberately NOT shipped (it carries
+  // publishConfig.access=restricted and a nested manifest only confuses packing).
+  'clients/bongos-client/index.mjs',
+
+  // Neutral branding defaults, so the CLI has sane strings with no instance checkout present.
+  'config/branding.neutral.json',
+];
+
+// Paths that must NEVER appear in the generated tree, whatever FILES says. A belt-and-braces
+// assertion against a future edit quietly widening the package back into the server.
+const FORBIDDEN_PREFIXES = [
+  'src/bongos/routes/',
+  'src/server',
+  'migrations/',
+  'infra/',
+  'public/',
+  'modules/hall-ui/',
+  '.github/',
+  'devbox-app/',
+];
+const FORBIDDEN_BASENAMES = [
+  'pool.js', 'auth.js', 'db.js', 'server.js', 'serve-internal.js',
+  'logger.js', 'project-door.js', 'project-settings.js',
+];
+// src/bongos/ is the kernel. Exactly one file from it is allowed, and it imports nothing.
+const ALLOWED_SRC_BONGOS = new Set(['src/bongos/api-prefix.js']);
+
+// ── The verbs the package advertises ────────────────────────────────────────────────────────
+// `script` is resolved inside the package. Keep in lockstep with FILES.
+const VERBS = {
+  login:   { script: 'login.js',   group: 'account', summary: 'Sign in to an instance  (bongos login <url> — browser click, no paste)' },
+  reauth:  { script: 'reauth.js',  group: 'account', summary: 'Refresh your session' },
+  setup:   { script: 'setup.js',   group: 'account', summary: 'Finish builder setup on this instance (disciplines, consent)' },
+  box:     { script: 'api.js', prefixArgs: ['POST', '/api/gds/box/ensure'], group: 'account', summary: 'Turn on / wake your cloud dev box' },
+  shell:   { script: 'shell.js',   group: 'account', summary: 'Open a terminal on your dev box' },
+  code:    { script: 'code.js',    group: 'account', summary: 'Open VS Code on your dev box over Remote-SSH' },
+
+  start:   { script: 'start.js',   group: 'work', summary: 'List tasks you can claim right now' },
+  status:  { script: 'status.js',  group: 'work', summary: 'Version / criterion progress  (bongos status C8)', selfHelp: true },
+  task:    { script: 'task.js',    group: 'work', summary: 'Create or show a task', selfHelp: true },
+  recall:  { script: 'recall.js',  group: 'work', summary: 'Search the docs + project knowledge  (bongos recall "x")' },
+  cost:    { script: 'cost.js',    group: 'work', summary: 'Log a cost entry' },
+  release: { script: 'release.js', group: 'work', summary: 'Cancel a claim — task returns to ready' },
+
+  api:     { script: 'api.js',     group: 'work', summary: 'Call any instance endpoint  (bongos api GET /api/gds/me)' },
+};
+
+// Verbs that exist in the full core CLI and are deliberately absent here. The dispatcher prints
+// the reason and the actual next step, because a newcomer hitting a bare "unknown command" learns
+// nothing — that silence is the exact failure this whole task is fixing.
+const CHECKOUT_ONLY = {
+  claim:   'Claiming a task writes code, so it needs a real checkout and a worktree.',
+  ship:    'Shipping grades, merges and deploys from a real checkout.',
+  dev:     'Runs an instance locally — needs the instance repo.',
+  serve:   'Runs an instance on a host — needs the instance repo.',
+  module:  'Scaffolds a module into an instance repo.',
+  upgrade: 'Moves an instance to a new core version.',
+  onboard: 'Provisions new infrastructure — owner tooling, not in the public CLI.',
+  doctor:  'Checks a local checkout toolchain.',
+  exec:    'Runs a core script from inside the core package.',
+  'package-core': 'Packages the core — owner tooling.',
+};
+
+// ── Redaction gate ──────────────────────────────────────────────────────────────────────────
+// Generic shapes only. Instance-specific needles are discovered at build time from the host's
+// own config (below) so the core itself carries no instance identity — the ADR 0062 §7 split.
+const REDACTION_PATTERNS = [
+  { name: 'non-loopback IPv4', re: /\b(?!127\.|0\.0\.0\.0|255\.)(?:\d{1,3}\.){3}\d{1,3}\b/g },
+  { name: 'github token', re: /\bgh[pousr]_[A-Za-z0-9]{16,}/g },
+  { name: 'github fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g },
+  { name: 'npm token', re: /\bnpm_[A-Za-z0-9]{30,}/g },
+  { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g },
+  { name: 'aws access key', re: /\bAKIA[0-9A-Z]{16}\b/g },
+];
+
+// Version strings (1.19.576) and dotted identifiers look like IPv4 to a loose regex; a real
+// address has four all-numeric octets each <= 255 and is not a semver.
+//
+// The documentation ranges (RFC 5737) and link-local are exempt: they can never name real
+// infrastructure, so they are the CORRECT thing to write in an example. Nothing else is
+// exempt — private ranges included, because an internal address still leaks topology and
+// deserves a human look before it goes public.
+const DOC_IPV4 = [/^192\.0\.2\./, /^198\.51\.100\./, /^203\.0\.113\./, /^169\.254\./];
+
+function isRealIPv4(s) {
+  const parts = s.split('.');
+  if (parts.length !== 4) return false;
+  if (!parts.every((p) => /^\d{1,3}$/.test(p) && Number(p) <= 255)) return false;
+  return !DOC_IPV4.some((re) => re.test(s));
+}
+
+// The project's own public identity. `cloudbongos.com` is the flagship instance and the CLI's
+// documented default — the way `registry.npmjs.org` is baked into npm — so it is published on
+// purpose and must not trip the gate. Anything NOT on this list that comes out of an instance's
+// branding is treated as private identity and blocks the build.
+const PUBLIC_BY_DESIGN = new Set(['cloudbongos.com']);
+
+// Instance identity to refuse: the host's own domains and owner login, read from the instance's
+// committed branding if this checkout has one. Absent (a neutral core), the gate still runs the
+// generic patterns above.
+function instanceNeedles() {
+  const needles = new Set();
+  const add = (v) => {
+    if (typeof v !== 'string') return;
+    const s = v.trim().toLowerCase();
+    if (s.length > 3 && !PUBLIC_BY_DESIGN.has(s)) needles.add(s);
+  };
+  try {
+    const b = JSON.parse(fs.readFileSync(path.join(REPO_ROOT, 'config', 'branding.json'), 'utf8'));
+    for (const v of Object.values(b.domains || {})) add(String(v).replace(/^https?:\/\//, '').replace(/\/.*$/, ''));
+    add(b.identity && b.identity.ownerLogin);
+    add(b.repo && b.repo.owner);
+  } catch (_) { /* neutral core: no instance branding, nothing to redact */ }
+  for (const extra of String(process.env.CLI_PACKAGE_FORBIDDEN || '').split(',')) add(extra);
+  return [...needles];
+}
+
+function scanRedaction(outDir, files) {
+  const needles = instanceNeedles();
+  const hits = [];
+  for (const rel of files) {
+    const abs = path.join(outDir, rel);
+    let text;
+    try { text = fs.readFileSync(abs, 'utf8'); } catch { continue; }
+    for (const { name, re } of REDACTION_PATTERNS) {
+      for (const m of text.matchAll(re)) {
+        if (name === 'non-loopback IPv4' && !isRealIPv4(m[0])) continue;
+        const line = text.slice(0, m.index).split('\n').length;
+        hits.push(`${rel}:${line}  ${name}: ${m[0]}`);
+      }
+    }
+    const lower = text.toLowerCase();
+    for (const n of needles) {
+      let i = lower.indexOf(n);
+      while (i !== -1) {
+        hits.push(`${rel}:${text.slice(0, i).split('\n').length}  instance identity: ${n}`);
+        i = lower.indexOf(n, i + n.length);
+      }
+    }
+  }
+  return hits;
+}
+
+// ── Generated files ─────────────────────────────────────────────────────────────────────────
+
+function dispatcherSource() {
+  const verbs = JSON.stringify(VERBS, null, 2).replace(/\n/g, '\n');
+  const checkout = JSON.stringify(CHECKOUT_ONLY, null, 2).replace(/\n/g, '\n');
+  return `#!/usr/bin/env node
+// bin/bongos.js — the public Cloud Bongos CLI.
+//
+// GENERATED by scripts/gds/build-cli-package.js in the Cloud Bongos core. Do not edit by hand:
+// edit the generator and rebuild.
+//
+// A thin dispatcher over the client scripts in this package. It spawns each with process.execPath
+// and forwards argv + the exit code; no auth or API logic lives here (that is cli-lib.js).
+
+'use strict';
+
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+
+const PKG_ROOT = path.join(__dirname, '..');
+const SCRIPTS_DIR = path.join(PKG_ROOT, 'scripts', 'gds');
+const VERSION = require('../package.json').version;
+
+const VERBS = ${verbs};
+
+const CHECKOUT_ONLY = ${checkout};
+
+const GROUPS = [['account', 'Account & environment'], ['work', 'Work']];
+
+function helpText() {
+  const lines = ['bongos — the Cloud Bongos CLI', '', 'Usage:  bongos <command> [args]'];
+  lines.push('', 'First time here?');
+  lines.push('  bongos login https://your-instance.com    sign in with a browser click');
+  lines.push('  bongos start                              see what you can pick up');
+  for (const [key, label] of GROUPS) {
+    lines.push('', label + ':');
+    for (const [verb, def] of Object.entries(VERBS)) {
+      if (def.group !== key) continue;
+      lines.push('  ' + verb.padEnd(10) + ' ' + def.summary);
+    }
+  }
+  lines.push('', '  help        Show this help', '  version     Show the bongos version');
+  lines.push('');
+  lines.push('Writing code (claim, ship) happens in a checkout. \`bongos shell\` opens one');
+  lines.push('on a cloud dev box with nothing to install locally.');
+  return lines.join('\\n');
+}
+
+function verbHelpText(verb, def) {
+  return [
+    'bongos ' + verb + ' — ' + def.summary,
+    '',
+    'Forwards to scripts/gds/' + def.script + '; extra arguments are passed through.',
+    'Run \`bongos help\` to see every command.',
+  ].join('\\n');
+}
+
+// Returns the exit code (does not call process.exit, so it stays testable).
+function main(argv) {
+  const args = argv.slice(2);
+  const verb = args[0];
+
+  if (!verb || verb === 'help' || verb === '--help' || verb === '-h') {
+    process.stdout.write(helpText() + '\\n');
+    return 0;
+  }
+  if (verb === 'version' || verb === '--version' || verb === '-v') {
+    process.stdout.write('bongos ' + VERSION + '\\n');
+    return 0;
+  }
+
+  if (CHECKOUT_ONLY[verb]) {
+    process.stderr.write(
+      'bongos: "' + verb + '" is not in the public CLI.\\n  ' + CHECKOUT_ONLY[verb] + '\\n\\n' +
+      'To get a checkout without installing anything locally:\\n' +
+      '  bongos shell            open a terminal on your cloud dev box\\n' +
+      '  bongos code             open VS Code on it over Remote-SSH\\n\\n' +
+      'The full CLI (including ' + verb + ') is already installed inside that box.\\n'
+    );
+    return 2;
+  }
+
+  const def = VERBS[verb];
+  if (!def) {
+    process.stderr.write('bongos: unknown command "' + verb + '"\\n\\n' + helpText() + '\\n');
+    return 2;
+  }
+
+  if (!def.selfHelp && args.slice(1).some((a) => a === '--help' || a === '-h')) {
+    process.stdout.write(verbHelpText(verb, def) + '\\n');
+    return 0;
+  }
+
+  const target = path.join(SCRIPTS_DIR, def.script);
+  const spawnArgs = [target, ...(def.prefixArgs || []), ...args.slice(1)];
+  const res = spawnSync(process.execPath, spawnArgs, { stdio: 'inherit' });
+  if (res.error) {
+    process.stderr.write('bongos: could not run ' + def.script + ': ' + res.error.message + '\\n');
+    return 1;
+  }
+  return res.status == null ? 1 : res.status;
+}
+
+if (require.main === module) process.exit(main(process.argv));
+module.exports = { main, helpText, VERBS, CHECKOUT_ONLY };
+`;
+}
+
+function packageJsonSource(version) {
+  // DERIVED from the manifest, never hand-listed. A hand-written `files` array silently drops
+  // whatever it forgets: the first build of this package copied clients/bongos-client/index.mjs
+  // correctly and then `npm pack` left it out, so the tarball installed and died on first use.
+  const roots = [...new Set(FILES.map((f) => f.split('/')[0] + '/'))].sort();
+  return JSON.stringify({
+    name: PACKAGE_NAME,
+    version,
+    description: 'The Cloud Bongos CLI — sign in to an instance, see what you can build, and get onto a dev box. Client only: no server.',
+    bin: { bongos: 'bin/bongos.js' },
+    files: ['bin/', ...roots, 'README.md'],
+    engines: { node: '>=20' },
+    dependencies: { undici: '^6.19.8' },
+    keywords: ['cloud-bongos', 'cli', 'ai-agents', 'build-platform'],
+    license: 'AGPL-3.0-or-later',
+    // No `repository` field on purpose. The core repo is private today, so a repository URL
+    // would 404 for every user of a public package AND put the owner's login in it for nothing.
+    // Point it at the redacted public mirror once that lands (ADR 0099).
+    homepage: 'https://cloudbongos.com',
+    bugs: { url: 'https://cloudbongos.com/builders' },
+    publishConfig: { access: 'public' },
+  }, null, 2) + '\n';
+}
+
+function readmeSource(version) {
+  return `# ${PACKAGE_NAME}
+
+The [Cloud Bongos](https://cloudbongos.com) CLI. Sign in to an instance, see what you can pick
+up, and get onto a dev box — from a terminal, with nothing installed.
+
+## Start here
+
+\`\`\`sh
+npx ${PACKAGE_NAME} login https://your-instance.com
+npx ${PACKAGE_NAME} start
+\`\`\`
+
+\`login\` opens your browser, you click once, and the session is written to
+\`~/.config/cloudbongos/\`. There is no token to copy and no password to set. If the instance
+gates admission, \`login\` files your access request and the owner approves it.
+
+Install it properly once you're past the first run:
+
+\`\`\`sh
+npm install -g ${PACKAGE_NAME}
+bongos start
+\`\`\`
+
+## Commands
+
+Run \`bongos help\` for the current list. In short: \`login\`, \`reauth\`, \`setup\`, \`box\`,
+\`shell\`, \`code\` for your account and environment; \`start\`, \`status\`, \`task\`, \`recall\`,
+\`cost\`, \`release\`, \`api\` for the work.
+
+\`bongos api\` is the escape hatch — it calls any endpoint on the instance as you, so anything
+the web hall can do is reachable from the terminal:
+
+\`\`\`sh
+bongos api GET /api/gds/me
+\`\`\`
+
+## Writing code
+
+\`claim\` and \`ship\` need a real checkout, so they aren't in this package. The shortest path to
+one is a cloud dev box, which needs nothing on your machine:
+
+\`\`\`sh
+bongos box       # turn it on
+bongos shell     # a terminal on it, full CLI already installed
+bongos code      # or VS Code over Remote-SSH
+\`\`\`
+
+## What this package is
+
+The client surface of the Cloud Bongos core, and nothing else — no server, no routes, no
+database, no provisioning. It is generated from the core by
+\`scripts/gds/build-cli-package.js\` and verified by installing the packed tarball into an empty
+directory and running every command.
+
+Version ${version} · AGPL-3.0-or-later
+`;
+}
+
+// ── Build ───────────────────────────────────────────────────────────────────────────────────
+
+function build(opts = {}) {
+  const outDir = path.resolve(REPO_ROOT, opts.out || 'dist/cloudbongos-cli');
+  const version = opts.version || PACKAGE_VERSION;
+  const log = opts.quiet ? () => {} : (m) => process.stdout.write(m + '\n');
+
+  // Refuse a file list that contradicts the package's whole premise, before copying anything.
+  const violations = [];
+  for (const rel of FILES) {
+    if (rel.startsWith('src/bongos/') && !ALLOWED_SRC_BONGOS.has(rel)) {
+      violations.push(`${rel} — src/bongos/ is the kernel; only ${[...ALLOWED_SRC_BONGOS].join(', ')} may ship`);
+    }
+    if (FORBIDDEN_PREFIXES.some((p) => rel.startsWith(p))) violations.push(`${rel} — forbidden path prefix`);
+    if (FORBIDDEN_BASENAMES.includes(path.basename(rel)) && !ALLOWED_SRC_BONGOS.has(rel)) {
+      violations.push(`${rel} — forbidden filename (server surface)`);
+    }
+    if (!fs.existsSync(path.join(REPO_ROOT, rel))) violations.push(`${rel} — missing from the repo`);
+  }
+  if (violations.length) {
+    const err = new Error('cli package manifest rejected:\n  ' + violations.join('\n  '));
+    err.violations = violations;
+    throw err;
+  }
+
+  // Dynamic `import()` of a relative path is invisible to any require()-based reasoning, and
+  // that is not hypothetical: cli-lib.js reaches the generated API client that way, and the
+  // first build shipped without it. Every relative import target in a shipped file must itself
+  // be shipped, or the package installs fine and dies on first use.
+  const unshipped = [];
+  for (const rel of FILES) {
+    if (!/\.(js|mjs|cjs)$/.test(rel)) continue;
+    const text = fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8');
+    for (const m of text.matchAll(/\bimport\(\s*['"](\.[^'"]+)['"]\s*\)/g)) {
+      const target = path.relative(REPO_ROOT, path.resolve(path.dirname(path.join(REPO_ROOT, rel)), m[1]));
+      if (!FILES.includes(target)) unshipped.push(`${rel} dynamically imports ${target}, which the manifest does not ship`);
+    }
+  }
+  if (unshipped.length) {
+    const err = new Error('cli package manifest incomplete:\n  ' + unshipped.join('\n  '));
+    err.violations = unshipped;
+    throw err;
+  }
+
+  fs.rmSync(outDir, { recursive: true, force: true });
+  fs.mkdirSync(outDir, { recursive: true });
+
+  for (const rel of FILES) {
+    const dest = path.join(outDir, rel);
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.copyFileSync(path.join(REPO_ROOT, rel), dest);
+  }
+
+  fs.mkdirSync(path.join(outDir, 'bin'), { recursive: true });
+  fs.writeFileSync(path.join(outDir, 'bin', 'bongos.js'), dispatcherSource(), { mode: 0o755 });
+  fs.writeFileSync(path.join(outDir, 'package.json'), packageJsonSource(version));
+  fs.writeFileSync(path.join(outDir, 'README.md'), readmeSource(version));
+
+  const generated = [...FILES, 'bin/bongos.js', 'package.json', 'README.md'];
+  const leaks = scanRedaction(outDir, generated);
+  if (leaks.length) {
+    const err = new Error(
+      'cli package redaction gate FAILED — refusing to emit:\n  ' + leaks.join('\n  ') +
+      '\n\nThis package is PUBLIC. Build it from the neutral core, not from an instance checkout' +
+      '\n(an instance\'s config/branding.json names its own domains and owner).'
+    );
+    err.leaks = leaks;
+    throw err;
+  }
+
+  const bytes = generated.reduce((n, rel) => {
+    try { return n + fs.statSync(path.join(outDir, rel)).size; } catch { return n; }
+  }, 0);
+
+  log(`${PACKAGE_NAME}@${version} → ${path.relative(REPO_ROOT, outDir)}`);
+  log(`  ${generated.length} files · ${(bytes / 1024).toFixed(0)} KB · ${Object.keys(VERBS).length} verbs · 1 dependency (undici)`);
+  log(`  redaction gate: clean (${instanceNeedles().length} instance needles checked)`);
+  return { outDir, version, files: generated, verbs: Object.keys(VERBS) };
+}
+
+module.exports = { build, FILES, VERBS, CHECKOUT_ONLY, FORBIDDEN_PREFIXES, FORBIDDEN_BASENAMES, ALLOWED_SRC_BONGOS, PACKAGE_NAME, PACKAGE_VERSION, scanRedaction, instanceNeedles };
+
+if (require.main === module) {
+  const argv = process.argv.slice(2);
+  const flag = (name) => { const i = argv.indexOf(name); return i === -1 ? null : argv[i + 1]; };
+  try {
+    build({ out: flag('--out'), version: flag('--version'), quiet: argv.includes('--quiet') });
+  } catch (err) {
+    process.stderr.write(String(err.message) + '\n');
+    process.exit(1);
+  }
+}

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.576'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.578'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');