@bongos/core 1.19.776 → 1.19.777

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.776",
-  "core_contract": "1.19.776",
-  "source_commit": "c0b7c8b7cbf3c7bc785585da449da6ea57197c32",
+  "core_version": "1.19.777",
+  "core_contract": "1.19.777",
+  "source_commit": "8c4c3db04491300feb300426c07f7d4bce19f981",
   "source_ref": "HEAD",
-  "built_at": "2026-09-16T18:38:32.418Z",
+  "built_at": "2026-09-16T18:55:13.712Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 486,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2151,
+    "functional_verbatim": 2153,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2662,
-  "tree_sha256": "c7dff0b9c97a50075315c645e421fe4fac5bfa6d21bf5c6cdfaea55e04dccd5c",
+  "file_count": 2664,
+  "tree_sha256": "48b4056d95f14a44152bbeafa4b8208f71b3bbb6890cb8fff14b4b5a70f27b10",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2527,7 +2527,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "7112a78b80e84df9950cdde4bc399b4c82f54138c044c1291b37c884def9f5f0"
+      "sha256": "48accd0cc072b560c546805d257d6ac9695ec17a3702aa7434c17b6eb632f819"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6309,6 +6309,11 @@
       "mode": "0000644",
       "sha256": "aba202502cffe31a031facd7b8e902315b81729d42028d857fa913754f2f0a7b"
     },
+    {
+      "path": "modules/provisioning/migrations/provisioning_017_domain_lookup_index.sql",
+      "mode": "0000644",
+      "sha256": "69fa8f9cdc3c9ec272c318226558254267ae63ef2ffa68ab93a89a3ab5d782a2"
+    },
     {
       "path": "modules/provisioning/module.json",
       "mode": "0000644",
@@ -7627,12 +7632,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "02c6bd2ec2e4afdc61d69e399a42ee98e762d908c69a3b84c9d27e8823b1f6cf"
+      "sha256": "620248e6545e156fd98d84b9dc29bdad59a77be39ba3e761a90d62d385255f4d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "2a771101f553f4e0207b498d8172bcef587e9115fbb3ff301539851f282e99ba"
+      "sha256": "d4ebe23ce76cdf1091ce8ab656a5199df19fb171768a947ff7cad259f9262dfd"
     },
     {
       "path": "public-docs/index.html",
@@ -9492,7 +9497,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "74ef2cad88c2d19fb73139455608b8e200f22f7e835c925910f6e28b3590c2a0"
+      "sha256": "3791abffec940edb90c976525b388d122d16ff5613c1ee1a487d6e9f1ad1a1e0"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -12229,6 +12234,11 @@
       "mode": "0000644",
       "sha256": "62ea8ffc2c21c351289dc7f96cab38fcd5824afba1fed0df7a545cd5df9e396c"
     },
+    {
+      "path": "tests/provisioning_domain_lookup_index.mjs",
+      "mode": "0000644",
+      "sha256": "77110372442881ea3beaa59f25d08128e0dd2b92c49a78779567454ec8298d38"
+    },
     {
       "path": "tests/provisioning_domain_unique.mjs",
       "mode": "0000644",

package/docs/module-api-changelog.md

@@ -2026,5 +2026,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.774 with no explicit bump. run 35133750943. (task 1002620)
   1.19.776 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.775 with no explicit bump. run 35135604764. (task 1002620)
+  1.19.777 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.776 with no explicit bump. run 35137334438. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/migrations/provisioning_017_domain_lookup_index.sql

@@ -0,0 +1,20 @@
+-- provisioning_017_domain_lookup_index.sql — an index every lower(domain) read can
+-- use (task 1003541; grader minor on PR 451, task 1003347).
+--
+-- WHY. Every address read in provisioning.js matches `lower(domain)`, and the only
+-- index on that expression is provisioning_015's UNIQUE one, which is PARTIAL on
+-- status <> 'torn_down' (ADR 0181 D2 keeps a torn-down address for the revive
+-- path). A query that does not also exclude torn-down rows cannot use a partial
+-- index, so planetChoicesForHosts — the provisioning.projectPlanets seam behind
+-- every public /projects/featured read — scanned the whole table. It keeps
+-- torn-down rows on purpose (an offline project still shows its owner's planet),
+-- so the fix is an index, not a narrower query.
+--
+-- Non-unique and non-partial: uniqueness stays provisioning_015's job. Additive,
+-- no row changes. Applied only when the provisioning module is enabled. Safe to re-run.
+
+CREATE INDEX IF NOT EXISTS ix_provisioning_instances_lower_domain
+  ON provisioning_instances (lower(domain));
+
+INSERT INTO schema_migrations (version) VALUES ('provisioning_017_domain_lookup_index')
+  ON CONFLICT (version) DO NOTHING;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.776",
+  "version": "1.19.777",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.776",
+      "version": "1.19.777",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.776",
+  "version": "1.19.777",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.776'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.777'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_domain_lookup_index.mjs

@@ -0,0 +1,85 @@
+// tests/provisioning_domain_lookup_index.mjs
+//
+// The index behind the planet seam's address read (task 1003541).
+//
+// planetChoicesForHosts — the provisioning.projectPlanets port every public
+// /projects/featured read calls — matches lower(domain) and deliberately keeps
+// torn-down rows, because the catalog still lists an offline project and its
+// owner's planet should still draw. provisioning_015's lower(domain) index is
+// PARTIAL on status <> 'torn_down', which such a query cannot use, so the read
+// scanned the whole table. provisioning_017 adds the index it can use.
+//
+// These tests hold the pair together: the migration's expression and the seam's
+// predicate must stay the same expression, and the seam must not "fix" the scan by
+// quietly dropping torn-down rows.
+//
+// DB-free: the seam runs against a fake `db` that records its SQL. Postgres is not
+// asked to EXPLAIN; there is no DB lane in CI (task 1003381).
+//
+// Run:  node tests/provisioning_domain_lookup_index.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const SQL = fs.readFileSync(new URL('../modules/provisioning/migrations/provisioning_017_domain_lookup_index.sql', import.meta.url), 'utf8');
+const CREATE = (SQL.match(/CREATE[\s\S]*?;/) || [''])[0];
+
+console.log('the migration — provisioning_017_domain_lookup_index.sql:');
+
+t('indexes lower(domain), the expression every address read matches', () => {
+  assert.match(CREATE, /CREATE INDEX IF NOT EXISTS ix_provisioning_instances_lower_domain\s+ON provisioning_instances \(lower\(domain\)\)/);
+});
+
+t('is neither UNIQUE nor PARTIAL — uniqueness stays provisioning_015\'s, and a partial index is what the seam could not use', () => {
+  assert.doesNotMatch(CREATE, /UNIQUE/);
+  assert.doesNotMatch(CREATE, /WHERE/);
+});
+
+t('self-registers and is safe to re-run', () => {
+  assert.match(SQL, /INSERT INTO schema_migrations \(version\) VALUES \('provisioning_017_domain_lookup_index'\)\s+ON CONFLICT \(version\) DO NOTHING/);
+});
+
+console.log('\nthe seam — planetChoicesForHosts:');
+
+function recordingDb(rows = []) {
+  const calls = [];
+  return { calls, query: async (sql, params) => { calls.push({ sql, params }); return { rows }; } };
+}
+
+await ta('matches on the same lower(domain) expression the index is built on, with the hosts lowercased', async () => {
+  const db = recordingDb();
+  await provisioning.planetChoicesForHosts(db, ['Mercury.Example.com', 'mercury.example.com', '']);
+  assert.equal(db.calls.length, 1);
+  assert.match(db.calls[0].sql, /lower\(domain\) = ANY\(\$1\)/);
+  assert.deepEqual(db.calls[0].params, [['mercury.example.com']]);
+});
+
+await ta('keeps torn-down rows — an offline project still draws its owner\'s planet', async () => {
+  const db = recordingDb([{ host: 'lantern.example.com', status: 'torn_down', settings: { planet_template: 'blob-tint' }, updated_at: '2026-09-16' }]);
+  const out = await provisioning.planetChoicesForHosts(db, ['lantern.example.com']);
+  assert.doesNotMatch(db.calls[0].sql, /status/, 'no status filter — that would change what the map draws, not just how fast');
+  assert.equal(out['lantern.example.com'].planet_template, 'blob-tint');
+});
+
+await ta('no hosts asks nothing', async () => {
+  const db = recordingDb();
+  assert.deepEqual(await provisioning.planetChoicesForHosts(db, []), {});
+  assert.equal(db.calls.length, 0);
+});
+
+console.log(`\nprovisioning_domain_lookup_index: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);