@bongos/core 1.19.725 → 1.19.727

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (229) hide show
  1. package/.bongos-core.json +179 -494
  2. package/.devcontainer/Dockerfile +1 -1
  3. package/.devcontainer/devcontainer.json +2 -2
  4. package/.devcontainer/healthcheck.sh +1 -1
  5. package/.devcontainer/init-firewall.sh +1 -1
  6. package/.devcontainer/post-create.sh +2 -2
  7. package/.env.local.example +1 -1
  8. package/Dockerfile +1 -1
  9. package/docs/copy-inventory.md +1 -1
  10. package/docs/copy-registry.json +9 -9
  11. package/docs/module-api-changelog.md +4 -0
  12. package/docs/recipes/devbox-app-release.md +4 -4
  13. package/modules/dev-box/app/scripts/dmgbuild-settings.py +5 -5
  14. package/modules/dev-box/app/scripts/gen-brand.js +1 -1
  15. package/modules/dev-box/app/src/brand.js +1 -1
  16. package/modules/dev-box/app/test/unit.mjs +16 -16
  17. package/modules/dev-box/box-access.js +1 -1
  18. package/modules/dev-box/routes/box.js +1 -1
  19. package/modules/discord/discord-approvals.js +1 -1
  20. package/modules/grading/grader-model.js +1 -1
  21. package/modules/grading/grader-prompt.js +1 -1
  22. package/modules/grading/grader-workers/quality.js +1 -1
  23. package/modules/hall-ui/module.json +1 -1
  24. package/modules/hall-ui/public/brand-apply.js +1 -1
  25. package/modules/hall-ui/public/shell.js +1 -1
  26. package/modules/hall-ui/public/work.js +1 -1
  27. package/modules/lifecycle/conflict-resolve.js +1 -1
  28. package/modules/lifecycle/db-analytics.js +1 -1
  29. package/modules/lifecycle/routes/analytics.js +1 -1
  30. package/modules/onboarding/approval-broadcast.js +1 -1
  31. package/modules/onboarding/onboarding.js +1 -1
  32. package/modules/provisioning/tests/liveness.mjs +1 -1
  33. package/modules/public-landing/public/index.html +1 -1
  34. package/modules/public-landing/public/projects-floor.states.json +2 -2
  35. package/modules/public-landing/public/projects.probes.json +4 -4
  36. package/modules/public-landing/public/projects.states.json +2 -2
  37. package/modules/status-ui/module.json +1 -1
  38. package/modules/status-ui/public/status.js +4 -4
  39. package/modules/status-ui/public/style.css +1 -1
  40. package/modules/ui-design/kit/fixtures/cost-summary.json +1 -1
  41. package/modules/ui-design/kit/fixtures/featured-hub.json +1 -1
  42. package/modules/ui-design/kit/fixtures/featured.json +1 -1
  43. package/modules/ui-design/kit/fixtures/leaderboard.json +1 -1
  44. package/modules/ui-design/kit/fixtures/my-projects.json +1 -1
  45. package/modules/ui-design/kit/fixtures/progress.json +1 -1
  46. package/modules/ui-design/kit/fixtures/recent-shipped.json +1 -1
  47. package/package-lock.json +2 -2
  48. package/package.json +1 -1
  49. package/scripts/cron/style_guide_audit.sh +1 -1
  50. package/scripts/discord/lib.js +1 -1
  51. package/scripts/discord/post.js +1 -1
  52. package/scripts/gds/audit-authorship.sh +1 -1
  53. package/scripts/gds/audit-replay.sh +29 -2
  54. package/scripts/gds/audit-ships.js +1 -1
  55. package/scripts/gds/backfill-sessions.js +2 -2
  56. package/scripts/gds/cf-tunnel.js +4 -4
  57. package/scripts/gds/claude-materialize.js +2 -2
  58. package/scripts/gds/cli-lib.js +6 -6
  59. package/scripts/gds/cutover-codemod.js +1 -1
  60. package/scripts/gds/dev-lib.js +2 -2
  61. package/scripts/gds/diagnose-achievements.js +2 -2
  62. package/scripts/gds/fitness-checks-identity.js +6 -4
  63. package/scripts/gds/gate-review.js +14 -6
  64. package/scripts/gds/gen-diagrams.js +1 -1
  65. package/scripts/gds/leak-scan-allowlist.js +293 -0
  66. package/scripts/gds/learning-capture.js +1 -1
  67. package/scripts/gds/linkify-refs.js +2 -2
  68. package/scripts/gds/local-preview-lib.js +1 -1
  69. package/scripts/gds/mirror-lineage-check.js +1 -1
  70. package/scripts/gds/mirror-redact.js +17 -2
  71. package/scripts/gds/newcomer-floor.templates.json +1 -1
  72. package/scripts/gds/package-core.js +18 -1
  73. package/scripts/gds/paste-token.js +1 -1
  74. package/scripts/gds/provision-units.js +2 -2
  75. package/scripts/gds/publish-manifest.js +15 -0
  76. package/scripts/gds/repo-metrics.js +1 -1
  77. package/scripts/gds/sandbox-stage.js +1 -1
  78. package/scripts/gds/seed-bongos-coreB-tranche1-tasks.js +1 -1
  79. package/scripts/gds/seed-bongos-coreB-tranche2-tasks.js +1 -1
  80. package/scripts/gds/seed-bongos-goal-hierarchy-tasks.js +1 -1
  81. package/scripts/gds/seed-bongos-tasks.js +2 -2
  82. package/scripts/gds/seed-gds-v4-tasks.js +1 -1
  83. package/scripts/gds/seed-medusa-tasks.js +10 -10
  84. package/scripts/gds/seed-module-upstreaming.js +1 -1
  85. package/scripts/gds/seed-productization-tasks.js +6 -6
  86. package/scripts/gds/seed-provisioning-tasks.js +2 -2
  87. package/scripts/gds/seed-staging.sh +19 -6
  88. package/scripts/gds/ship-deploy-target.js +1 -1
  89. package/scripts/gds/ship-flow.js +1 -1
  90. package/scripts/gds/smoke-gds.js +1 -1
  91. package/scripts/status-probe.mjs +2 -2
  92. package/src/bongos/auth-discord.js +2 -2
  93. package/src/bongos/live-channel.js +1 -1
  94. package/src/bongos/permission-path-check.js +80 -3
  95. package/src/bongos/pool.js +1 -1
  96. package/src/bongos/routes/auth.js +11 -11
  97. package/src/bongos/routes/security.js +1 -1
  98. package/src/bongos/routes.js +1 -1
  99. package/src/branding.js +1 -1
  100. package/src/devbox-downloads.js +1 -1
  101. package/src/instance-config.js +2 -2
  102. package/src/module-api.js +1 -1
  103. package/src/module-loader/provenance.js +2 -2
  104. package/tests/art_stage.mjs +2 -2
  105. package/tests/auth_anthropic_identity.mjs +1 -1
  106. package/tests/auth_duplicate_cookie.mjs +1 -1
  107. package/tests/auth_error_brand.mjs +1 -1
  108. package/tests/auth_inactive_builder.mjs +1 -1
  109. package/tests/backup_cli.mjs +4 -4
  110. package/tests/bongos_box_connect.mjs +2 -2
  111. package/tests/bongos_downloads.mjs +2 -2
  112. package/tests/bongos_login.mjs +5 -5
  113. package/tests/box_connect_e2e.mjs +2 -2
  114. package/tests/box_dns_repoint.mjs +10 -10
  115. package/tests/box_host_keys.mjs +1 -1
  116. package/tests/box_onboard.mjs +9 -9
  117. package/tests/box_scope_session.mjs +1 -1
  118. package/tests/box_terminal_ssrf.mjs +7 -7
  119. package/tests/boxes.mjs +9 -9
  120. package/tests/branding.mjs +2 -2
  121. package/tests/bump_version.mjs +2 -2
  122. package/tests/cf_tunnel.mjs +40 -40
  123. package/tests/cli_token_reissue.mjs +7 -7
  124. package/tests/cloud_bongos_pack.mjs +1 -1
  125. package/tests/currency_label.mjs +8 -8
  126. package/tests/dev_lib.mjs +4 -4
  127. package/tests/devbox_dmg_backdrop.mjs +1 -1
  128. package/tests/devbox_downloads.mjs +2 -2
  129. package/tests/devbox_icons.mjs +1 -1
  130. package/tests/discord_approvals.mjs +1 -1
  131. package/tests/discord_oauth.mjs +2 -2
  132. package/tests/executed_closure.mjs +6 -1
  133. package/tests/first_admin_bootstrap.mjs +1 -1
  134. package/tests/gate_approvals.mjs +5 -5
  135. package/tests/government_protected_surfaces.mjs +137 -0
  136. package/tests/grade_aggregates_unavailable.mjs +1 -1
  137. package/tests/hook_user_agents.mjs +2 -2
  138. package/tests/init.mjs +6 -6
  139. package/tests/instance_config.mjs +1 -1
  140. package/tests/instance_manifest.mjs +5 -5
  141. package/tests/instance_mismatch_guard.mjs +13 -13
  142. package/tests/leak_scan_allowlist.mjs +94 -0
  143. package/tests/migrate_root_resolution.mjs +4 -4
  144. package/tests/mirror_redact.mjs +28 -4
  145. package/tests/module_catalog.mjs +5 -5
  146. package/tests/module_submissions.mjs +3 -3
  147. package/tests/package_core.mjs +1 -1
  148. package/tests/parallel-load.mjs +6 -6
  149. package/tests/projects_hub.mjs +2 -2
  150. package/tests/provision.mjs +50 -50
  151. package/tests/provisioning_github_app_routes.mjs +1 -1
  152. package/tests/provisioning_onboard_mode.mjs +2 -2
  153. package/tests/publish_reconciler.mjs +4 -4
  154. package/tests/sandbox_stage.mjs +1 -1
  155. package/tests/scrubber_corpus.mjs +3 -3
  156. package/tests/search_isolation.mjs +1 -1
  157. package/tests/session_records.mjs +1 -1
  158. package/tests/ship_card.mjs +6 -6
  159. package/tests/ship_ci_deploy.mjs +1 -1
  160. package/tests/single_host_hall.mjs +9 -9
  161. package/tests/smoke_preflight.mjs +1 -1
  162. package/tests/smoke_target.mjs +1 -1
  163. package/tests/status-probe.mjs +1 -1
  164. package/tests/status_mirror_sync.mjs +1 -1
  165. package/docs/adr/0004-amazonprimea-name-and-trademark-acceptance.md +0 -45
  166. package/docs/design/mocks/_schemes.css +0 -604
  167. package/docs/design/mocks/component-sheet.html +0 -428
  168. package/docs/design/mocks/hall/_tokens.css +0 -370
  169. package/docs/design/mocks/hall/board/v1.html +0 -846
  170. package/docs/design/mocks/hall/board/v2.html +0 -858
  171. package/docs/design/mocks/hall/board/v3.html +0 -884
  172. package/docs/design/mocks/hall/goals/v1.html +0 -1212
  173. package/docs/design/mocks/hall/goals/v2.html +0 -1192
  174. package/docs/design/mocks/hall/goals/v3.html +0 -1205
  175. package/docs/design/mocks/hall/hall-sheet.html +0 -244
  176. package/docs/design/mocks/hall/reading/v1.html +0 -1125
  177. package/docs/design/mocks/hall/reading/v2.html +0 -1177
  178. package/docs/design/mocks/hall/reading/v3.html +0 -1150
  179. package/docs/design/mocks/hall/settings/v1.html +0 -1238
  180. package/docs/design/mocks/hall/settings/v2.html +0 -1235
  181. package/docs/design/mocks/hall/settings/v3.html +0 -1299
  182. package/docs/design/mocks/hall/task/v1.html +0 -633
  183. package/docs/design/mocks/hall/task/v2.html +0 -646
  184. package/docs/design/mocks/hall/task/v3.html +0 -647
  185. package/docs/design/mocks/hub/assets/r3-space-deepfield-half.jpg +0 -0
  186. package/docs/design/mocks/hub/assets/r3-space-deepfield-half.jpg.json +0 -13
  187. package/docs/design/mocks/hub/assets/r3-space-dust-half.jpg +0 -0
  188. package/docs/design/mocks/hub/assets/r3-space-dust-half.jpg.json +0 -13
  189. package/docs/design/mocks/hub/assets/r3-space-nebula-half.jpg +0 -0
  190. package/docs/design/mocks/hub/assets/r3-space-nebula-half.jpg.json +0 -13
  191. package/docs/design/mocks/hub/assets/r3-space-starfield-half.jpg +0 -0
  192. package/docs/design/mocks/hub/assets/r3-space-starfield-half.jpg.json +0 -13
  193. package/docs/design/mocks/hub/hub-sheet.html +0 -192
  194. package/docs/design/mocks/hub/mine.html +0 -465
  195. package/docs/design/mocks/hub/picker.html +0 -421
  196. package/docs/design/mocks/hub/planets.html +0 -356
  197. package/docs/design/mocks/hub/v1.html +0 -1209
  198. package/docs/design/mocks/hub/v2.html +0 -1257
  199. package/docs/design/mocks/hub/v3.html +0 -1496
  200. package/docs/design/mocks/hub/wizard.html +0 -421
  201. package/docs/design/mocks/landing/landing-sheet.html +0 -131
  202. package/docs/design/mocks/landing/v1.html +0 -956
  203. package/docs/design/mocks/landing/v2.html +0 -708
  204. package/docs/design/mocks/landing/v3.html +0 -911
  205. package/docs/design/mocks/landing-page-mock.html +0 -687
  206. package/docs/design/mocks/landing-palettes.html +0 -103
  207. package/docs/design/mocks/projects-hub-mock.html +0 -991
  208. package/docs/design/mocks/projects-hub-variants.html +0 -146
  209. package/docs/design/mocks/projects-page-mock.html +0 -167
  210. package/docs/design/mocks/world/blue-hud/_tokens.css +0 -246
  211. package/docs/design/mocks/world/blue-hud/hall.html +0 -595
  212. package/docs/design/mocks/world/blue-hud/landing.html +0 -424
  213. package/docs/design/mocks/world/blue-hud/status.html +0 -410
  214. package/docs/design/mocks/world/chrome-blobs/_tokens.css +0 -479
  215. package/docs/design/mocks/world/chrome-blobs/hall.html +0 -553
  216. package/docs/design/mocks/world/chrome-blobs/landing-b.html +0 -581
  217. package/docs/design/mocks/world/chrome-blobs/landing.html +0 -328
  218. package/docs/design/mocks/world/chrome-blobs/status.html +0 -416
  219. package/docs/design/mocks/world/natgeo-editorial/_tokens.css +0 -377
  220. package/docs/design/mocks/world/natgeo-editorial/hall.html +0 -649
  221. package/docs/design/mocks/world/natgeo-editorial/landing-b.html +0 -743
  222. package/docs/design/mocks/world/natgeo-editorial/landing.html +0 -475
  223. package/docs/design/mocks/world/natgeo-editorial/status.html +0 -437
  224. package/docs/design/mocks/world/organic-cards/_tokens.css +0 -462
  225. package/docs/design/mocks/world/organic-cards/hall.html +0 -625
  226. package/docs/design/mocks/world/organic-cards/landing-b.html +0 -736
  227. package/docs/design/mocks/world/organic-cards/landing.html +0 -420
  228. package/docs/design/mocks/world/organic-cards/status.html +0 -458
  229. package/docs/design/mocks/world/world-sheet.html +0 -156
package/docs/design/mocks/landing-palettes.html DELETED
@@ -1,103 +0,0 @@
1
- <!DOCTYPE html>
2
- <html lang="en">
3
- <head>
4
- <meta charset="utf-8">
5
- <meta name="viewport" content="width=device-width, initial-scale=1">
6
- <title>Palette + hero options — cloudbongos.com/ (task 1002747)</title>
7
- <link rel="preconnect" href="https://fonts.googleapis.com">
8
- <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
9
- <link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@500;600;700&family=Quicksand:wght@400;500;600;700&family=Fira+Code:wght@400;500&display=swap">
10
- <style>
11
- :root{--ink:#12131c;--soft:#5d6070;--faint:#8b8fa3;--line:#dcdfe8;--bg:#f4f5f9;--card:#fff;}
12
- @media(prefers-color-scheme:dark){:root{--ink:#f2f3f8;--soft:#a8adc0;--faint:#767b90;--line:#2b2f3d;--bg:#0d0f16;--card:#161a24;}}
13
- *{box-sizing:border-box;margin:0;padding:0;}
14
- body{background:var(--bg);color:var(--ink);font-family:"Quicksand",system-ui,sans-serif;
15
- padding:clamp(20px,4vw,46px);-webkit-font-smoothing:antialiased;}
16
- h1{font-family:"Baloo 2",sans-serif;font-weight:700;font-size:clamp(24px,3.4vw,34px);letter-spacing:-.7px;margin-bottom:8px;}
17
- .sub{font-size:15px;font-weight:500;color:var(--soft);max-width:74ch;line-height:1.6;margin-bottom:10px;}
18
- .sub b{color:var(--ink);}
19
- .warn{border-left:3px solid #dc2626;background:color-mix(in srgb,#dc2626 8%,transparent);
20
- border-radius:0 10px 10px 0;padding:12px 16px;font-size:14px;font-weight:600;line-height:1.6;
21
- color:var(--ink);max-width:82ch;margin:16px 0 26px;}
22
- .warn code{font-family:"Fira Code",monospace;font-size:12.5px;}
23
- .bar{display:flex;gap:10px;align-items:center;flex-wrap:wrap;margin-bottom:24px;}
24
- .bar button{cursor:pointer;font-family:"Quicksand",sans-serif;font-weight:700;font-size:13.5px;
25
- padding:8px 16px;border-radius:999px;border:2px solid var(--line);background:var(--card);color:var(--ink);}
26
- .bar button[aria-pressed="true"]{border-color:var(--ink);background:var(--ink);color:var(--card);}
27
- .bar span{font-family:"Fira Code",monospace;font-size:11px;color:var(--faint);letter-spacing:.5px;text-transform:uppercase;}
28
- .grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(430px,1fr));gap:clamp(16px,2.4vw,26px);}
29
- .cell{background:var(--card);border:1.5px solid var(--line);border-radius:18px;overflow:hidden;}
30
- .cellHead{display:flex;align-items:center;gap:10px;padding:12px 16px;border-bottom:1.5px solid var(--line);}
31
- .dot{width:16px;height:16px;border-radius:50%;flex:0 0 auto;box-shadow:0 0 0 1.5px rgba(128,128,128,.28) inset;}
32
- .nm{font-family:"Baloo 2",sans-serif;font-weight:700;font-size:16px;letter-spacing:-.2px;}
33
- .tag{font-size:12px;font-weight:600;color:var(--faint);margin-left:auto;font-family:"Fira Code",monospace;}
34
- .frame{position:relative;width:100%;aspect-ratio:16/10;overflow:hidden;background:var(--bg);}
35
- .frame iframe{position:absolute;top:0;left:0;width:1280px;height:800px;border:0;
36
- transform:scale(.336);transform-origin:top left;}
37
- .note{padding:11px 16px;font-size:13px;font-weight:500;color:var(--soft);line-height:1.55;border-top:1.5px solid var(--line);}
38
- .note b{color:var(--ink);font-weight:700;}
39
- a.open{display:inline-block;margin-top:6px;font-size:12.5px;font-weight:700;color:inherit;}
40
- </style>
41
- </head>
42
- <body>
43
-
44
- <h1>Seven palettes, two heroes</h1>
45
- <p class="sub">The same landing page, re-themed. Each palette is exactly what a branding pack does — it
46
- overrides the <b>cosmos.css</b> contract tier. On a real instance only one exists, injected by
47
- <b>themeMarkup()</b>. Click any tile's <b>open full</b> to walk it at full size with the switcher.</p>
48
-
49
- <div class="warn">
50
- <b>Found while checking these:</b> the palette shipping <b>today</b> fails WCAG AA. White on
51
- <code>--accent #f97316</code> is <b>2.80:1</b> where 4.5 is required, and <code>--accent-deep #ea580c</code>
52
- as link text on a card is <b>3.56:1</b>. That affects every primary button and link on <code>/create</code>
53
- and <code>/projects</code> right now — not just this page. All six candidates below were checked with a
54
- contrast calculator across twelve pairs each and pass cleanly in both modes.
55
- </div>
56
-
57
- <div class="bar">
58
- <span>hero</span>
59
- <button data-m="bongos" aria-pressed="true">bongos</button>
60
- <button data-m="buddha" aria-pressed="false">buddha</button>
61
- <span style="margin-left:14px">mode</span>
62
- <button data-md="light" aria-pressed="true">light</button>
63
- <button data-md="dark" aria-pressed="false">dark</button>
64
- </div>
65
-
66
- <div class="grid" id="grid"></div>
67
-
68
- <script>
69
- var SCHEMES=[
70
- {k:'', n:'shipped today', d:'#f97316', note:'The current tokens. <b>Fails contrast</b> on buttons and links — see above.'},
71
- {k:'adobe-clay', n:'adobe clay', d:'#b8492c', note:'Fired terracotta, sand, a whisper of sage. The only warm option with a real <b>second hue</b>, so the dark band has somewhere to go. <b>Risk:</b> too much beige reads as tired.'},
72
- {k:'ember-marigold', n:'ember marigold',d:'#ce4806', note:'Today’s sunrise with the milk taken out — a genuinely pigmented backdrop so cards lift off it. <b>Risk:</b> one hue plays every part.'},
73
- {k:'letterpress', n:'letterpress', d:'#C22A12', note:'Warm paper, near-black type, one vermilion struck on the downbeat. Most trustworthy. <b>Risk:</b> austerity fights the rounded type.'},
74
- {k:'deep-water', n:'deep water', d:'#0d7f97', note:'Promotes the unused <code>--sea</code> token to the lead. Calm and coherent. <b>Risk:</b> reads as generic cloud-vendor SaaS.'},
75
- {k:'sapwood', n:'sapwood', d:'#3d7a33', note:'Oat paper and pigment greens, dodging both eco-brand and terminal-green. <b>Risk:</b> green says gardening, not build platform.'},
76
- {k:'plumfield', n:'plumfield', d:'#932bcf', note:'Leans hardest into the space metaphor; best dark mode of the set. <b>Risk:</b> violet+magenta is the uniform of crypto — bad for a capture-resistance pitch.'}
77
- ];
78
- var mascot='bongos', mode='light';
79
- function render(){
80
- document.getElementById('grid').innerHTML = SCHEMES.map(function(s){
81
- var src='landing-page-mock.html?rail=0&mascot='+mascot+'&mode='+mode+'&scheme='+encodeURIComponent(s.k);
82
- return '<div class="cell">'+
83
- '<div class="cellHead"><span class="dot" style="background:'+s.d+'"></span>'+
84
- '<span class="nm">'+s.n+'</span><span class="tag">'+(s.k||'current')+'</span></div>'+
85
- '<div class="frame"><iframe loading="lazy" src="'+src+'" title="'+s.n+'"></iframe></div>'+
86
- '<div class="note">'+s.note+'<br><a class="open" href="'+src.replace('rail=0','rail=1')+'" target="_blank">open full →</a></div>'+
87
- '</div>';
88
- }).join('');
89
- }
90
- document.querySelectorAll('[data-m]').forEach(function(b){
91
- b.onclick=function(){ mascot=b.dataset.m;
92
- document.querySelectorAll('[data-m]').forEach(function(x){x.setAttribute('aria-pressed',String(x===b));});
93
- render(); };
94
- });
95
- document.querySelectorAll('[data-md]').forEach(function(b){
96
- b.onclick=function(){ mode=b.dataset.md;
97
- document.querySelectorAll('[data-md]').forEach(function(x){x.setAttribute('aria-pressed',String(x===b));});
98
- render(); };
99
- });
100
- render();
101
- </script>
102
- </body>
103
- </html>