@bongos/core 1.19.98 → 1.19.99

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.98",
-  "core_contract": "1.19.98",
-  "source_commit": "6616c83d7f0ee7029db21b183e3983fc16568aad",
+  "core_version": "1.19.99",
+  "core_contract": "1.19.99",
+  "source_commit": "7ab95a1bcf1751dbc3f5890c41461dcad6826506",
   "source_ref": "HEAD",
-  "built_at": "2026-08-13T22:25:33.504Z",
+  "built_at": "2026-08-13T22:41:45.519Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 298,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1549,
-  "tree_sha256": "729068034b75cf1c5878e8099c36f949384e07228d6337ea7387c7d586abd68e",
+  "tree_sha256": "37c2c9f1fb605b8e730ce3562abac5ed38699596c45f2113f0066464fb12b85f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4127,12 +4127,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "1fac3202890f9d9899a8aaa72a473e4f73b6c27dccc28dd7a064a3c5b1367b85"
+      "sha256": "1df1aa5e45f918110c6adebcec118d46207c09bfadd5bf17ddc1b563cb67d8f7"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b8338943bf583ab9caa3686836ebeafb43be12df7f156f991763278abcca02dc"
+      "sha256": "4cf100a9e30702e1e1bdcb42c3437e2ce4fe61795bca9c305ce08fb17c42438d"
     },
     {
       "path": "public-docs/index.html",
@@ -5702,7 +5702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "fb7a891d2f7b815e57271245e93c4e4ede5f78bedb76e4648fcbf56b69ad3de3"
+      "sha256": "896f7912e0981f27a671fb68d5cada8481f84e2cfc1025c3cb3c69eda95f7fe9"
     },
     {
       "path": "src/module-loader/loader.js",
@@ -5737,7 +5737,7 @@
     {
       "path": "src/platform-server.js",
       "mode": "0000644",
-      "sha256": "181c9850c374b653136a259d80e276ac285d2ee5f55fadeb9109aef418190d91"
+      "sha256": "6ffe23398bc452b4224e7c4aa49dbd3c4f61a61da0fd51d43bb6c5ce0bd51aa7"
     },
     {
       "path": "src/ui/adapters/claude-design/index.js",
@@ -7247,7 +7247,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "489ad330f7fe118ffd66a22b0a437743a2f3d3610a5324ba764abc4fc88b0c74"
+      "sha256": "e03bbf258cb4b8ffd3e242ab2ddd927d1f52706347d06b539a386ca502caf1e4"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.98",
+  "version": "1.19.99",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.98",
+      "version": "1.19.99",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.98",
+  "version": "1.19.99",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -623,8 +623,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.96 with no explicit bump. run 31749223878. (task 1002620)
 //   1.19.98 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.97 with no explicit bump. run 31749841394. (task 1002620)
+//   1.19.99 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.98 with no explicit bump. run 31750941866. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.98'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.99'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/src/platform-server.js

@@ -60,12 +60,58 @@ const HOST = process.env.HOST || '127.0.0.1';
 // branding pack is injected once at boot (theme + window.__BRANDING__), exactly
 // as the hall pages are, so the look + identity come from config, not hardcode.
 const LANDING_DIR = path.join(__dirname, '..', 'public-landing');
+// ── CONTENT-STAMPED STATIC ASSETS (task 1002766) ──
+// The landing HTML is `cf-cache-status: DYNAMIC` and never cached, but the
+// assets it references come back `Cache-Control: public, max-age=14400` — four
+// hours, Cloudflare's default Browser Cache TTL, not a header this app sets. So
+// after a deploy a RETURNING visitor gets brand-new markup styled by a
+// stylesheet up to four hours old: markup whose components that stylesheet has
+// never heard of. Measured live — a cached cosmos.css of 25,693 bytes with no
+// `.shell{` against 42,610 fresh — and again when the project card shipped and
+// rendered as an unstyled block at the foot of the page.
+//
+// A COLD visitor is unaffected, which is exactly what makes it easy to miss:
+// whoever deploys usually reloads in the browser holding the stale copy.
+//
+// Fixed by changing the URL rather than by fighting the header: a content hash
+// means a new core produces a new URL, so there is nothing to invalidate and no
+// Cloudflare purge token to hold (task 1002766 weighed both). Same `?v=<sha8>`
+// shape serve-internal.js already stamps onto the hall's own scripts.
+//
+// Stamped by RESOLUTION, not by a path allow-list: a URL is an asset if it
+// actually names a file under public-landing/. Routes (`/projects`, `/create`)
+// and API paths resolve to nothing and are left alone, so a new asset is
+// stamped the day it is added and nobody has to remember to list it.
+const _assetStamps = new Map();
+function assetStamp(url) {
+  if (!_assetStamps.has(url)) {
+    let v = '';
+    try {
+      const abs = path.resolve(LANDING_DIR, '.' + url);
+      // never let a template's own text walk out of the landing dir
+      if (abs.startsWith(LANDING_DIR + path.sep)) {
+        v = require('node:crypto').createHash('sha256')
+          .update(fs.readFileSync(abs)).digest('hex').slice(0, 8);
+      }
+    } catch { v = ''; }   // not a file → not an asset → no stamp
+    _assetStamps.set(url, v);
+  }
+  return _assetStamps.get(url);
+}
+const LOCAL_ASSET = /(href|src)="(\/[A-Za-z0-9._~/-]+\.[A-Za-z0-9]+)"/g;
+function stampAssets(html) {
+  return String(html).replace(LOCAL_ASSET, (m, attr, url) =>
+    assetStamp(url) ? `${attr}="${url}?v=${assetStamp(url)}"` : m);
+}
+
 const _landingPages = new Map(); // memoized per file; '' if absent (instance ships no landing)
 function landingPage(file) {
   if (!_landingPages.has(file)) {
     let html = '';
     try {
-      html = injectBrandingGlobal(stripApexOnly(fs.readFileSync(path.join(LANDING_DIR, file), 'utf8')));
+      // stamped LAST, so anything a later transform introduces is stamped too
+      html = stampAssets(injectBrandingGlobal(stripApexOnly(
+        fs.readFileSync(path.join(LANDING_DIR, file), 'utf8'))));
     } catch { /* absent → '' */ }
     _landingPages.set(file, html);
   }

package/tests/public_landing_projects.mjs

@@ -119,3 +119,62 @@ test('create.html: the poll give-up points at /projects — "the hall has it" is
   assert.match(body, /\/projects/, 'the give-up path must hand the owner the projects page');
   assert.doesNotMatch(body, /the hall has it/, 'the false poll-stop copy must be gone');
 });
+
+/* ── Content-stamped assets (task 1002766) ──────────────────────────────────
+   The landing HTML is never cached but its assets come back max-age=14400 —
+   Cloudflare's default browser TTL, not ours. So a returning visitor gets new
+   markup with up to four-hour-old CSS: markup whose components that stylesheet
+   has never heard of. Twice now that has shipped a visibly broken page. The URL
+   carries the version so there is nothing to invalidate. ── */
+
+test('the stylesheet URL carries a content stamp, so new markup cannot meet old CSS', async () => {
+  const res = await request('/projects');
+  assert.equal(res.status, 200);
+  const m = res.body.match(/href="\/assets\/cosmos\.css\?v=([0-9a-f]+)"/);
+  assert.ok(m, 'cosmos.css must be served with a ?v= content stamp');
+  assert.equal(m[1].length, 8, 'the stamp is the first 8 hex of a sha256');
+  assert.doesNotMatch(res.body, /href="\/assets\/cosmos\.css"/,
+    'no unstamped copy may survive alongside the stamped one');
+});
+
+test('the stamp is derived from CONTENT, so it changes only when the file does', async () => {
+  const fsMod = await import('node:fs');
+  const pathMod = await import('node:path');
+  const cryptoMod = await import('node:crypto');
+  const url = await import('node:url');
+  const root = pathMod.dirname(url.fileURLToPath(import.meta.url));
+  const css = fsMod.readFileSync(pathMod.join(root, '..', 'public-landing', 'assets', 'cosmos.css'));
+  const want = cryptoMod.createHash('sha256').update(css).digest('hex').slice(0, 8);
+  const res = await request('/projects');
+  assert.ok(res.body.includes(`cosmos.css?v=${want}`),
+    'the stamp must be the hash of the bytes actually on disk');
+});
+
+test('every landing surface is stamped, not just the one that broke', async () => {
+  for (const p of ['/', '/projects', '/create']) {
+    const res = await request(p);
+    if (res.status !== 200) continue;
+    assert.doesNotMatch(res.body, /(href|src)="\/assets\/[^"?]+"/,
+      `${p} still serves an unstamped /assets/ URL`);
+  }
+});
+
+test('routes and API paths are never mistaken for assets', async () => {
+  // stamping resolves the URL against public-landing/ — a route names no file,
+  // so it must come back untouched rather than acquiring a meaningless ?v=
+  const res = await request('/projects');
+  assert.match(res.body, /href="\/create"/, '/create is a route, not an asset');
+  assert.doesNotMatch(res.body, /href="\/create\?v=/);
+  assert.doesNotMatch(res.body, /href="\/projects\?v=/);
+  assert.doesNotMatch(res.body, /\/api\/bongos\/[^"]*\?v=[0-9a-f]{8}/,
+    'API paths must never be stamped');
+});
+
+test('a stamped asset still serves — the query string is not part of the filename', async () => {
+  const page = await request('/projects');
+  const stamped = (page.body.match(/\/assets\/cosmos\.css\?v=[0-9a-f]+/) || [])[0];
+  assert.ok(stamped, 'need a stamped URL to fetch');
+  const res = await request(stamped);
+  assert.equal(res.status, 200, 'express.static must ignore the ?v= when resolving the file');
+  assert.match(res.body, /\.shell\{/, 'and it must be the real stylesheet');
+});