@bongos/core 1.19.61 → 1.19.62

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.61",
-  "core_contract": "1.19.61",
-  "source_commit": "073b10995781fbdfae0a9da943fa8755002e51bf",
+  "core_version": "1.19.62",
+  "core_contract": "1.19.62",
+  "source_commit": "81537ad6976770dfa5d0e9ff4aae44c6cc00be9f",
   "source_ref": "HEAD",
-  "built_at": "2026-08-12T00:24:52.611Z",
+  "built_at": "2026-08-12T01:12:59.066Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 291,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1532,
-  "tree_sha256": "c4d2ff9c96e88bf23e2c2c1acf1593d174589a1b9beeb7b3b12d61c65bb84113",
+  "tree_sha256": "d7adb6b51e99575f2dbed8932206114b763bc19d3d4b880f41b091710892920b",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4037,12 +4037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9b320dfef27bca09c1ab23bb85c04b499724208dad01a608763f18b9c4e1d1b4"
+      "sha256": "66f2a964b8eb493c69abb582b5f9be8dec20d49f31919abf3b55b8c11ffee2ed"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d1720c6790a6aa61a091335cf8873dac1e75dfbb1250c7d484395c95fd8825c6"
+      "sha256": "c49444a432fa927ad7487c52180f23cda72e18055cfbfbf22565d4cdca2825de"
     },
     {
       "path": "public-docs/index.html",
@@ -5497,7 +5497,7 @@
     {
       "path": "src/bongos/module-scope-map.js",
       "mode": "0000644",
-      "sha256": "f39bb8e6269b64ce57e1a16d5369ccdbd384618172f742494c4aaa3c04392cba"
+      "sha256": "a5c939de500ba39d12f09e053e3b9079510716cb4af18cad0e13482952b02904"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -5662,7 +5662,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0126fe1e9af95f3daee985c7a9859e19b5937e023d6a54927b6c5dd7055a83ec"
+      "sha256": "f2df366234508aa746d344fd4c28b3e09f4354c3510f585283518a0fde03b89c"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -6927,7 +6927,7 @@
     {
       "path": "tests/module-scope-map.mjs",
       "mode": "0000644",
-      "sha256": "d97a0b97d4aa9d5609d830f9d0b0b20c29377b6d6232c1c69e75612dfc608928"
+      "sha256": "a1059f1995ba2b98436df0c4965a87b20e7553b6b72e80bb724c0b861e347ecf"
     },
     {
       "path": "tests/module_api.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.61",
+  "version": "1.19.62",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.61",
+      "version": "1.19.62",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.61",
+  "version": "1.19.62",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/bongos/module-scope-map.js

@@ -192,6 +192,13 @@ const MODULE_GLOBS = {
   // (moduleWebSurfaces → serve-internal). Its public read endpoints stay SHARED
   // core in routes/public.js (the hall + the off-box mirror consume them too).
   'status-ui': ['modules/status-ui/'],
+  // The instance's public landing surface (index/world/gate/create), served by
+  // platform-server.js from the repo-root public-landing/ dir — not yet a carved
+  // module, so the glob lists where the code lives TODAY (the auto-tighten
+  // contract above). Its own key, not provisioning's: the front door is broader
+  // than instance hosting, and the web-surface precedent (hall-ui/status-ui) is
+  // one key per surface (task 1002690, goal 1000059).
+  'public-landing': ['public-landing/'],
   // --- feature modules ---
   // BV1.R49: game graduated to modules/game/ — src/rooms/, src/world/, src/seats.js,
   // src/db.js, migrations/game/, and public/ all moved there. src/preview-server.js
@@ -200,6 +207,15 @@ const MODULE_GLOBS = {
     'modules/game/', 'src/preview-server.js',
   ],
   'art-pipeline': ['modules/art-pipeline/'],
+  // --- instance provisioning: the web-tier REQUEST + STATE surface (module home)
+  //     plus the control-plane runner CLI — a command travels with its domain (the
+  //     lifecycle/dev-box precedent). Covers the projects-surface work (goal
+  //     1000059); previously NO key resolved these paths, so no goal could wall
+  //     them (task 1002690). ---
+  provisioning: [
+    'modules/provisioning/',
+    'scripts/gds/provision.js',
+  ],
   discord: [
     // The bot, broadcast, link/role seams, channels, and bug-attachments graduated
     // into modules/discord/ (BV1.R47); the outbound webhook lib + post CLI stay

package/src/module-api.js

@@ -549,8 +549,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.59 with no explicit bump. run 31548021746. (task 1002620)
 //   1.19.61 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.60 with no explicit bump. run 31550061440. (task 1002620)
+//   1.19.62 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.61 with no explicit bump. run 31552833331. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.61'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.62'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/module-scope-map.mjs

@@ -86,3 +86,16 @@ test('the exported roster is frozen (immutable scope wall)', () => {
   assert.ok(Object.isFrozen(scope.scopeForModule('kernel')));
   assert.ok(Object.isFrozen(scope.scopeForModule('kernel').globs));
 });
+
+test('provisioning + public-landing joined the roster (task 1002690) — territory resolvable, non-protected', () => {
+  // Before this, modules/provisioning/ and public-landing/ were covered by NO
+  // key, so no goal could wall the projects-surface work (goal 1000059).
+  for (const k of ['provisioning', 'public-landing']) {
+    assert.ok(scope.isModuleKey(k), `roster missing module "${k}"`);
+    assert.equal(scope.isProtectedModule(k), false, `"${k}" must derive non-protected (no PROTECTED_GLOBS overlap)`);
+  }
+  const prov = scope.globsForModules(['provisioning']);
+  assert.ok(prov.includes('modules/provisioning/'), 'provisioning owns its module directory');
+  assert.ok(prov.includes('scripts/gds/provision.js'), 'the control-plane runner travels with its domain');
+  assert.ok(scope.globsForModules(['public-landing']).includes('public-landing/'), 'public-landing owns its surface directory');
+});