@bongos/core 1.19.973 → 1.19.974

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.973",
-  "core_contract": "1.19.973",
-  "source_commit": "8bcf4277c73e7ff41a8f1af4410a2784be3df109",
+  "core_version": "1.19.974",
+  "core_contract": "1.19.974",
+  "source_commit": "151c83a4f327c0240048e59f08fda0f4b64198cf",
   "source_ref": "HEAD",
-  "built_at": "2026-09-23T03:12:31.192Z",
+  "built_at": "2026-09-23T03:57:09.819Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 516,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 2920,
-  "tree_sha256": "40673ab635365235ddebe8e5c8660ca9a834bff7591bf34c9a42008b8b5f0b0a",
+  "tree_sha256": "f41335f4e9458b25d55e6f8ae7c8f8f8a485df8498eeee2a28099aaa2d34753a",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2702,7 +2702,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "901f1a8dfe7a0aea5b6ac94a6b931fe7a7241a79948b02570ae8a872777dd382"
+      "sha256": "af6a1de09fa3b34d172d10a1460a9a374d3772cc05ec955baeb3649e3b9daa8d"
     },
     {
       "path": "docs/modules-contract.md",
@@ -8122,12 +8122,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "d11c17bd857df10fee11791ce0185febbd12f4ef00a3dfb3b4e458e5774dbfd8"
+      "sha256": "3588722998c41a0f2ba1ee5323a69ce1bef192e36e9fd21d379e5328f2be3b25"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "af8108050fe47609107780692cb3baae77f379e91b4033450f5e57402c18f5fb"
+      "sha256": "1058d8080bdd558d152779deb22539ca26db9ae599785d890cc72a8aa4b87b35"
     },
     {
       "path": "public-docs/index.html",
@@ -8222,7 +8222,7 @@
     {
       "path": "scripts/gds/api-alias-caller-scan.js",
       "mode": "0000644",
-      "sha256": "bc4fc8d9590f642eb4f0b1175cdb1faf0c3245eecc3c0d01956f4c64dff79b37"
+      "sha256": "b4c2dea7c692c034903e847179e9e4e067b31562341334a0b31af0f558bf81fc"
     },
     {
       "path": "scripts/gds/api.js",
@@ -10147,7 +10147,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5c4f2b444f4f874cffab074db62621204eb8b2e198cf31cad9536ea6b0268911"
+      "sha256": "73c3906d1ea53795c24dcd8af24d34cbe94784bf6373676d6c7d436f7498d2c6"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -10342,7 +10342,7 @@
     {
       "path": "tests/api_alias_caller_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "ed6f7125359286b760f57355b50d04c00e6e8c0c9ecfb3f4f9f8cf3a6babb1ae"
+      "sha256": "d212b275e725aef98e9f35ea79742ec2409167f07e812cb9cfc8c4ad93d27ed8"
     },
     {
       "path": "tests/api_alias_exceptions.mjs",

package/docs/module-api-changelog.md

@@ -2420,5 +2420,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.971 with no explicit bump. run 35806478158. (task 1002620)
   1.19.973 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.972 with no explicit bump. run 35813381436. (task 1002620)
+  1.19.974 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.973 with no explicit bump. run 35816317024. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.973",
+  "version": "1.19.974",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.973",
+      "version": "1.19.974",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.973",
+  "version": "1.19.974",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/api-alias-caller-scan.js

@@ -146,8 +146,14 @@ const ALIAS_COMMENTARY_RE = /\balias\b|\blegacy\b|\bpermanent\b|\bforever\b/i;
 // Two shapes: the URL itself, and prose ABOUT it — a heading such as "Authorized callback URL must
 // include the full /api/gds path" names the prefix without the /auth/ segment, and sweeping it left
 // the heading contradicting the body two lines below it. Caught in review on task 1004113; the rule
-// is widened rather than the heading rewritten, because the heading is right.
-const ALIAS_PINNED_AUTH_RE = /\/api\/gds\/auth\/|\bcallback\b/i;
+// covers the heading rather than the heading being rewritten, because the heading is right.
+//
+// NARROWED after grade review on 1004113: the first cut of this was a bare `\bcallback\b`, which
+// excused ANY line carrying the word — "the webhook fires a callback to /api/gds/tasks" would have
+// gone silently uncounted, and a shrink-only ratchet whose exclusions can be triggered by a common
+// noun is not shrink-only. `callback URL` is the OAuth-registration phrase specifically, and the
+// negative cases below are tested, not just the positive ones.
+const ALIAS_PINNED_AUTH_RE = /\/api\/gds\/auth\/|\bcallback URL\b/i;
 
 function isExcludedPath(relPath) {
   const p = relPath.replace(/\\/g, '/');

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.973'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.974'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/api_alias_caller_ratchet.mjs

@@ -164,6 +164,12 @@ test('a PINNED auth URL is not a caller anyone may move (rule 10, task 1004113)'
   // The rule is NOT so wide that an ordinary caller in an auth-adjacent file escapes it.
   assert.equal(scan.isCountedLine('node scripts/gds/api.js GET /api/gds/me'), true);
   assert.equal(scan.isCountedLine('POST /api/gds/auth-free/thing'), true, 'only the /auth/ segment, not any word starting auth');
+  // …and the NEGATIVE half, which is the half that keeps a shrink-only metric shrink-only. The
+  // first cut of this rule was a bare `\bcallback\b`; a line that merely USES the common noun must
+  // still count, or the exclusion becomes a way to hide a caller by wording a sentence around it.
+  assert.equal(scan.isCountedLine('the webhook fires a callback to /api/gds/tasks'), true, 'a plain "callback" is not the pinned URL');
+  assert.equal(scan.isCountedLine('// callback handler posts to /api/gds/hooks'), true);
+  assert.equal(scan.isCountedLine('pass a callback; the poller reads /api/gds/versions'), true);
 });
 
 test('occurrences are counted, not lines — moving ONE of two callers on a line lowers the number', () => {