@bongos/core 1.19.947 → 1.19.948

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.947",
-  "core_contract": "1.19.947",
-  "source_commit": "37a9f1c16fc7a96d1a1a5a2a65caf044f3026012",
+  "core_version": "1.19.948",
+  "core_contract": "1.19.948",
+  "source_commit": "7e37e772b13a12d362d065e4717077968a833700",
   "source_ref": "HEAD",
-  "built_at": "2026-09-22T00:19:14.818Z",
+  "built_at": "2026-09-22T00:24:59.637Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 512,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2887,
-  "tree_sha256": "bda269845896de352c55f40f7ce0700fd273326dd76309102c37fd6b9afda131",
+  "tree_sha256": "05aa6d17f1fc467a3da4bc029194d33bba69296024f1359ac1f8622f1278ad50",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -377,7 +377,7 @@
     {
       "path": "clients/bongos-client/package.json",
       "mode": "0000644",
-      "sha256": "d299252221daca415cf982b61fe5e3d9c3707c672a7d47adc052a9ee8166223f"
+      "sha256": "f2a46cacecfdfff5632a6fbc7a9c5a7ac09a5b8d45bc48f579e91db4ff1cd7bd"
     },
     {
       "path": "config/branding.neutral.json",
@@ -2682,7 +2682,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "d9c0cae827a25e58be07c384558b2752a027cd7736ce560af83ee2e2286f8fd8"
+      "sha256": "3f21cd6d53ac515244ae5be6d14bcf36898e487b4638a51bf4611e735c823c9f"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8037,12 +8037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "299be5b7d35c653f16b1789ea0a36c9bfa31d0f67ed7f6aebdff81ba17f379d0"
+      "sha256": "987a8459bed5c80b510ed385e8eadc8109c42abf0deadf9c08b3f83da31eb42d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "875f023498acdbdb7f1c746c2e12390fe77b92fa2ccfadc66204c5271659c4c4"
+      "sha256": "66e973de72ac31b96eca16d6f7fe34dd833d515fb5cf04c32a66bce743518a25"
     },
     {
       "path": "public-docs/index.html",
@@ -8667,7 +8667,7 @@
     {
       "path": "scripts/gds/gen-api-client.js",
       "mode": "0000644",
-      "sha256": "a023a19001d63b671409efe1afeae400dae96ea50debd6e3a49a7d10dffb55b0"
+      "sha256": "00f267a8f3ceb040fa217d85f89b6e464ca6366f74b016c888d297ee900e816f"
     },
     {
       "path": "scripts/gds/gen-api-docs.js",
@@ -10047,7 +10047,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "e710dd0a8764f9b78f20168fa83b3817d190e5436e384055ffab4352ef0095f0"
+      "sha256": "d657538880551de9fb84c31218b01511298d620cb611f78bc4de93ae4acfb978"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10257,7 +10257,7 @@
     {
       "path": "tests/api_client.mjs",
       "mode": "0000644",
-      "sha256": "c1563c043f34e84aa6c0eec722244b24c51dc1254750fe1a27d3664c327bacd1"
+      "sha256": "4f9a52f3f3eb998b87d06cb127fa79e21f7488281911159a159e0d856ea3f04c"
     },
     {
       "path": "tests/api_docs.mjs",

package/clients/bongos-client/package.json

@@ -25,5 +25,6 @@
     "README.md"
   ],
   "license": "AGPL-3.0-or-later",
+  "private": true,
   "sideEffects": false
 }

package/docs/module-api-changelog.md

@@ -2368,5 +2368,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.945 with no explicit bump. run 35669244197. (task 1002620)
   1.19.947 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.946 with no explicit bump. run 35671409094. (task 1002620)
+  1.19.948 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.947 with no explicit bump. run 35671807404. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.947",
+  "version": "1.19.948",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.947",
+      "version": "1.19.948",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.947",
+  "version": "1.19.948",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/gen-api-client.js

@@ -374,14 +374,29 @@ function renderPackageJson(spec) {
     },
     files: ['index.mjs', 'index.cjs', 'index.d.ts', 'bongos-client.global.js', 'README.md'],
     license: 'AGPL-3.0-or-later',
+    // `private: true` is the ENFORCEMENT of the paragraph below (task 1004143). Task
+    // 1003742 removed the publishConfig, which stopped the repo CLAIMING this was a
+    // published package — but nothing stopped it BECOMING one again: `npm publish` in
+    // clients/bongos-client/ succeeded and would have recreated @bongos/client@0.0.2,
+    // the exact package the owner deleted from the registry on 2026-09-09. npm now
+    // refuses with EPRIVATE, so that removal cannot be silently undone by anyone who
+    // runs publish in the wrong directory.
+    //
+    // This is not the publish posture the note below calls fiction. That was declaring
+    // HOW it publishes (access: restricted) for something never published; this
+    // declares that it does not publish, which is the same fact the note states in
+    // prose. It does not affect `main`/`types`/`exports`, so the vendored copy and a
+    // workspace link resolve exactly as before.
+    private: true,
     // NO publishConfig — this client is NOT an npm package (task 1003742).
     //
     // It was published once, 2026-07-07 at 0.0.2, under ADR 0134's private-first plan, and never
     // updated while the API it is generated FROM moved 500+ core versions. It had zero consumers
     // the whole time: nothing across the core or any instance repo ever declared it as a
-    // dependency — every consumer VENDORS a copy instead (modules/dev-box/app/src/vendor/, and
-    // build-cli-package.js into @cloudbongos/cli, which could not depend on it anyway). The owner
-    // removed it from the registry on 2026-09-09.
+    // dependency — every consumer VENDORS a copy instead. That was two places when this was
+    // written; task 1003891 deleted the Dev Box Electron app, so build-cli-package.js vendoring
+    // it into @cloudbongos/cli (which could not depend on it anyway) is now the only one. The
+    // owner removed it from the registry on 2026-09-09.
     //
     // The manifest itself stays: `main`/`types`/`exports` are what make the vendored copy and a
     // workspace link resolve. Declaring a publish posture is the part that was fiction.

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.947'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.948'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/api_client.mjs

@@ -303,3 +303,40 @@ test('--check reads a CRLF working copy as fresh, and a real edit as stale (task
     fs.rmSync(root, { recursive: true, force: true });
   }
 });
+
+// ── the generated manifest must refuse to become an npm package (task 1004143) ──
+//
+// @bongos/client was published once (2026-07-07, 0.0.2), gathered zero consumers —
+// everyone vendors a copy — and the owner deleted it from the registry on
+// 2026-09-09. Task 1003742 removed the publishConfig so the repo stopped CLAIMING
+// it was published, but nothing stopped it BECOMING published again: `npm publish`
+// in clients/bongos-client/ succeeded and would have recreated it.
+//
+// WHY THIS IS ASSERTED ON THE MANIFEST AND NOT BY RUNNING npm. `npm publish
+// --dry-run` is NOT a test of this and passes with `private: true` set: npm's
+// dry-run path returns in lib/commands/publish.js before it ever calls
+// libnpmpublish, and libnpmpublish/lib/publish.js is where the real guard lives —
+// `if (manifest.private) throw EPRIVATE` as its first statement, unconditional and
+// ahead of any network call. So a real publish IS blocked; a dry-run simply never
+// reaches the check. Asserting the field is the honest test at this layer, and it
+// is the part this repo actually controls.
+test('the generated client manifest is private, so it cannot be republished', () => {
+  const pkg = JSON.parse(fs.readFileSync(
+    path.join(ROOT, 'clients', 'bongos-client', 'package.json'), 'utf8'));
+  assert.equal(pkg.private, true,
+    'clients/bongos-client/package.json lost `private: true` — npm publish in that directory '
+    + 'would recreate @bongos/client, the package the owner removed from the registry.');
+  // The manifest still has to RESOLVE: 1003742 kept these on purpose, because the
+  // vendored copy and a workspace link go through them. `private` must not cost that.
+  for (const field of ['main', 'types', 'exports']) {
+    assert.ok(pkg[field], `the manifest lost \`${field}\` — the vendored copy resolves through it`);
+  }
+});
+
+test('the GENERATOR emits it, not just the committed file', () => {
+  // Fixing only the output is a fix that the next regeneration undoes.
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'gen-api-client.js'), 'utf8');
+  assert.match(src, /private:\s*true/,
+    'gen-api-client.js no longer emits `private: true` — the next regeneration would '
+    + 'make clients/bongos-client publishable again.');
+});