@bongos/core 1.19.683 → 1.19.684

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.683",
-  "core_contract": "1.19.683",
-  "source_commit": "40eeb484085efb69d5aaa3645233d23854e2bbc1",
+  "core_version": "1.19.684",
+  "core_contract": "1.19.684",
+  "source_commit": "3cf0cdf9f887f9b33631e0bcfb3b7290cd935b06",
   "source_ref": "HEAD",
-  "built_at": "2026-09-12T17:02:13.044Z",
+  "built_at": "2026-09-12T20:55:49.945Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 477,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2626,
-  "tree_sha256": "aa8a467c8dcd7322882229d5b60da130eb5b67e726e38a0dde2b34d2ce6bfa4a",
+  "tree_sha256": "dc96d8a5eb830704ee772fe1cee19ce1c4ec39575c4fafbbfe46012f5a2cd4b9",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2802,7 +2802,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "abe1e67ec7bd2d5d4bf27a2b5d8b4337fc1d4b7374c1edab6c5392016a83fde3"
+      "sha256": "d441eb881efdcff2c6afedfa6d93799fdd64ac323422f12b54bf2c94df2b8d4a"
     },
     {
       "path": "docs/modules-contract.md",
@@ -7782,12 +7782,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "81888175ae0227d30c633c8f51a25936418cfdbf1d36c77bdd7c329d41d0c429"
+      "sha256": "130314108dd59672172778afcb5eedb0b8d605a983329a0d0a878ce9c59fa9c9"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b5cd5f5c6b24980f4b85986be1919f4cb2697c3ba219277d51b1ef07de72343b"
+      "sha256": "d5281482b1e0da7cd0cab8f475fc71345776694e8b457b2f96d241a315902ee4"
     },
     {
       "path": "public-docs/index.html",
@@ -8287,7 +8287,7 @@
     {
       "path": "scripts/gds/gen-api-client.js",
       "mode": "0000644",
-      "sha256": "2d8b35709e19b339bc55c57237f2add36fa6bdeb83a9b036faa902b0c4b8e3f9"
+      "sha256": "a023a19001d63b671409efe1afeae400dae96ea50debd6e3a49a7d10dffb55b0"
     },
     {
       "path": "scripts/gds/gen-api-docs.js",
@@ -9547,7 +9547,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "2adaf10cbc0a2e65aeaa820f95b2b789c8e66c398c5f56299e9d1f52e82b86a1"
+      "sha256": "927d43875de79a0923fc0997262fd7a0106c6f56626a89ed5ede0c6c74945eec"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9667,7 +9667,7 @@
     {
       "path": "tests/api_client.mjs",
       "mode": "0000644",
-      "sha256": "fa360a42fa5d11b225afe1b13622f2a27fe43f2b7d0a47c2fef158bc8a11ecb6"
+      "sha256": "c1563c043f34e84aa6c0eec722244b24c51dc1254750fe1a27d3664c327bacd1"
     },
     {
       "path": "tests/api_docs.mjs",

package/docs/module-api-changelog.md

@@ -1825,5 +1825,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.681 with no explicit bump. run 34704993368. (task 1002620)
   1.19.683 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.682 with no explicit bump. run 34706984747. (task 1002620)
+  1.19.684 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.683 with no explicit bump. run 34718471740. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.683",
+  "version": "1.19.684",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.683",
+      "version": "1.19.684",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.683",
+  "version": "1.19.684",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-api-client.js

@@ -21,6 +21,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { resolveDocsRoot } = require('../../src/instance-config');
+const { sameContent } = require('./gen-freshness'); // eol-insensitive freshness (CRLF checkouts)
 
 // The client is generated FROM the spec and lives beside it as a per-instance
 // artifact: both resolve to the DOCS root — the instance repo when a consumer
@@ -516,7 +517,15 @@ function main() {
   for (const [name, content] of Object.entries(files)) {
     const dest = path.join(OUT_DIR, name);
     const existing = fs.existsSync(dest) ? fs.readFileSync(dest, 'utf8') : null;
-    if (existing !== content) {
+    // Freshness is a question about CONTENT, so compare content (task 1003844 — the
+    // same defect as 1003619). We render with join('\n') = LF, but a core.autocrlf
+    // checkout hands readFileSync back CRLF, so a byte-wise `!==` called the already
+    // -correct client STALE on every Windows clone, forever: regenerating writes LF,
+    // git restores CRLF, gate red again. Comparing via sameContent cures it for every
+    // file here at once, so a seventh generated file can't reintroduce it by missing
+    // an eol pin. A missing file reads as null, which never matches a non-empty
+    // render — still stale, as before.
+    if (!sameContent(existing, content)) {
       stale = true;
       if (!check) { fs.mkdirSync(OUT_DIR, { recursive: true }); fs.writeFileSync(dest, content); }
     }

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.683'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.684'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/api_client.mjs

@@ -11,12 +11,15 @@ import { strict as assert } from 'node:assert';
 import { test } from 'node:test';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { createClient, ApiError, API_VERSION, DEFAULT_BASE_URL } from '../clients/bongos-client/index.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { sameContent } = require(path.join(ROOT, 'scripts', 'gds', 'gen-freshness.js'));
 
 function fakeFetch(recorder, response = { ok: true, status: 200, body: { ok: true } }) {
   return async (url, init) => {
@@ -149,12 +152,21 @@ test('baseUrl:"" is honored (absolute-path passthrough for the hall fetch wrappe
   assert.deepEqual(res, { status: 200, ok: true, data: { x: 1 } });
 });
 
+// The CI-gate twin of `gen-api-client.js --check`, and it carried the SAME defect
+// (task 1003844): a byte-wise assert.equal against a CRLF working copy failed on
+// every Windows checkout, forever — index.d.ts and README.md have no eol pin, so
+// core.autocrlf hands them back CRLF while the generator renders LF. Compare with
+// sameContent for the same reason gen-freshness.js exists; a real content change
+// still fails, which tests/gen_freshness.mjs pins.
 test('committed client is fresh (regenerate with gen-api-client.js if this fails)', () => {
   const gen = require('../scripts/gds/gen-api-client.js');
   const { files } = gen.build();
   for (const [name, content] of Object.entries(files)) {
     const onDisk = fs.readFileSync(path.join(ROOT, 'clients/bongos-client', name), 'utf8');
-    assert.equal(onDisk, content, `clients/bongos-client/${name} is STALE — run node scripts/gds/gen-api-client.js`);
+    assert.ok(
+      sameContent(onDisk, content),
+      `clients/bongos-client/${name} is STALE — run node scripts/gds/gen-api-client.js`,
+    );
   }
 });
 
@@ -245,3 +257,49 @@ test('browser-global build exposes window.BongosClient and shapes requests ident
   assert.equal(rec.init.headers.Authorization, 'Bearer tok');
   assert.equal(rec.init.body, JSON.stringify({ a: 1 }));
 });
+
+// --- the --check gate itself (task 1003844) ---------------------------------
+//
+// The assertions above compare the client this checkout HAS, so they can only ever
+// see the eol convention this checkout happens to use. The bug lived in the other
+// direction: a Windows clone whose committed client is already correct was told it
+// was STALE, forever. So drive the real CLI against a throwaway docs root where we
+// control the line endings, and pin BOTH halves — the eol-only case must pass, and
+// a genuine edit must still fail, which is what stops an over-broad "fix" (the same
+// pairing tests/gen_freshness.mjs makes for the helper).
+function runGen(root, args = []) {
+  return spawnSync(process.execPath, [path.join(ROOT, 'scripts/gds/gen-api-client.js'), ...args], {
+    encoding: 'utf8',
+    env: { ...process.env, BONGOS_INSTANCE_ROOT: root },
+  });
+}
+
+test('--check reads a CRLF working copy as fresh, and a real edit as stale (task 1003844)', () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'gen-api-client-'));
+  try {
+    fs.mkdirSync(path.join(root, 'docs', 'api'), { recursive: true });
+    fs.copyFileSync(path.join(ROOT, 'docs/api/openapi.json'), path.join(root, 'docs/api/openapi.json'));
+
+    const wrote = runGen(root);
+    assert.equal(wrote.status, 0, `generator failed: ${wrote.stderr}`);
+
+    // What a core.autocrlf=true checkout hands back for the two files with no eol
+    // pin. Nothing about the CONTENT changed, so --check must stay quiet.
+    for (const name of ['index.d.ts', 'README.md']) {
+      const f = path.join(root, 'clients/bongos-client', name);
+      fs.writeFileSync(f, fs.readFileSync(f, 'utf8').replace(/\n/g, '\r\n'));
+    }
+    const fresh = runGen(root, ['--check']);
+    assert.equal(fresh.status, 0, `CRLF must not read as STALE — this is the bug: ${fresh.stderr}`);
+    assert.match(fresh.stdout, /is fresh/);
+
+    // ...and the gate is still a gate.
+    const target = path.join(root, 'clients/bongos-client/index.mjs');
+    fs.writeFileSync(target, `${fs.readFileSync(target, 'utf8')}\nexport const SMUGGLED = 1;\n`);
+    const stale = runGen(root, ['--check']);
+    assert.equal(stale.status, 2, 'a real content change must still exit 2');
+    assert.match(stale.stderr, /STALE/);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});