@bongos/core 1.20.45 → 1.20.46

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.20.45",
-  "core_contract": "1.20.45",
-  "source_commit": "500731f1c26e69eac1e926352f63dd62d7665967",
+  "core_version": "1.20.46",
+  "core_contract": "1.20.46",
+  "source_commit": "142b5284e83f46dcf982c77650b5a1f1fd469845",
   "source_ref": "HEAD",
-  "built_at": "2026-10-01T02:30:19.832Z",
+  "built_at": "2026-10-01T02:42:50.444Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 567,
     "agent_docs_stubbed": 27,
-    "functional_verbatim": 2698,
+    "functional_verbatim": 2699,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3293,
-  "tree_sha256": "eb4ea6fda587ab5e49faeab142db13463c88c592c9cbdec22dec9d914cb739bf",
+  "file_count": 3294,
+  "tree_sha256": "3dad0ef7c6f44bf0e8b3bb367a339239cae6d0741134c8c20f211dfac4358b16",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -317,12 +317,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "567f4e867d2e4e4c8a9848dcc839eabd38131b931d00b1d376d60ea00a9da5b6"
+      "sha256": "babd77a306b2908653f49e176b742a3321428be77accd7514963a0a6543643ae"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "d68299ce87e19a630ff6cd5fffcfc480490bb21be66336282f547bbf75eab57e"
+      "sha256": "6203efb07ef0cfd92639563c0c7b8f3539b0f0d9d57e042f3fb3991de416bef7"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -332,17 +332,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "0a97565f7b9f850c87359dd1e11b66944a1bc5d5aaa55e7e06136d1c330558e7"
+      "sha256": "6bb408bf7d8dc8e10448bbc5a5305bdd3f2edeff59ae3049aac3a56579c7f7f9"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "8aca809dac8482b3015ebc780c7da72943296cc33b7556868b3707ad8b811f52"
+      "sha256": "511a2a545be895971f0122057a93a0f96270be8242ef2131393033d544b887b5"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "3f3ea0f601dcf725794a3b35e1643a5124833e0e6350911b684a9785b4251eb5"
+      "sha256": "de6f684b63139f01844b8fb304489769377205822a461110ab0be4ac78db4b1d"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2257,12 +2257,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "a9d5356ba4e2dfbffe67abafaf61272ae85f42dd177bbdd912b2abc0b5e6a5a8"
+      "sha256": "4db9e523ef0c4d44f326a733165ddba0d2110d957f3f870d31327b01675cb1e5"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "ab32aee0c20597431aa24f89aac65706af4bc8e73067232b688fab032aebc5b2"
+      "sha256": "168ed8033455dd5bbf2156d7bd656ba88135344a5891c6d1edb8367fb360097f"
     },
     {
       "path": "docs/architecture.md",
@@ -2287,12 +2287,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "a144f3e1169ab018ef174d25bb93051944a2f3599adb2ede5dc2ea428c30ca45"
+      "sha256": "8efd7a93af9021c9a272ee1bd9d5dfedb2d59f8d4c41eabea2647804eba29519"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "d5e1034fe8d4b7dad849f15b41e1cdbf0c319a8d883b8735322328e905d457cb"
+      "sha256": "aec2c8e768a2476c13fb265b14afcccdd41ecb6d9c6960ab49701b0e0cb8ee8d"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -2797,12 +2797,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "2f590139a6bc3a910985d58828c98f13ae3813b1a92a510e8ef7719dfab04f05"
+      "sha256": "5c667985867ed5f3dba299588a1a59731b3cbf8e539b181b2b28b1a89098af75"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "15148b0d5a175c6eaf24fcc54709500e2c036ef966011c8505ecc8988a904b97"
+      "sha256": "5d78d2fa2266bfed7e1034c0649274cb544333aa0c81ecdcb34413524729764f"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -2882,12 +2882,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "0503f35180d448a154bc32e82f71149231c207a2f4120993844cf6aa5cce4419"
+      "sha256": "81d729d1ac8ff5a290c8dace60973a56d984143d2b88e8a728803dc518bb9b09"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "4bf5248643bb0656fdb6afdbbf1a2642658e463302fa816e47c0a3c9a08eb03e"
+      "sha256": "b5dc412caf32f6adc131940f4902d0f2db2fe2f5a5f9bffe5cee7d52bcc41649"
     },
     {
       "path": "docs/project-context.template.md",
@@ -5562,17 +5562,17 @@
     {
       "path": "modules/hall-ui/public/modules.css",
       "mode": "0000644",
-      "sha256": "9a00c3965acc3defb8d711950ee9a15e941bbd9cc005a48babfa9b0f31a5068d"
+      "sha256": "29b552f18e5b9b02fd633e7d41dd6172b33ee4bd0567740177c6a11774d888ea"
     },
     {
       "path": "modules/hall-ui/public/modules.html",
       "mode": "0000644",
-      "sha256": "4a81932842ef18a9d2f71949ea7f41164d7977c9c6d3875004a864415d057632"
+      "sha256": "9631772bb478c09835ce6277e30e6899599a731a51718a4994d50df1c65a2108"
     },
     {
       "path": "modules/hall-ui/public/modules.js",
       "mode": "0000644",
-      "sha256": "cd2ce2e4116e618e3c9d94ab6caf0d917a0a13d991eddeeedd27f3f04dc29db4"
+      "sha256": "01fbd0bd0ac6910e9deb91599598c5c4aa1f5139b9cdcc05aeed4def50359c55"
     },
     {
       "path": "modules/hall-ui/public/modules.states.json",
@@ -6017,7 +6017,7 @@
     {
       "path": "modules/hall-ui/records/catalog.md",
       "mode": "0000644",
-      "sha256": "a21149740fc70e2cd07524a83bf61b60c9682c279bfe31430c48612b9668a520"
+      "sha256": "1348a368109f3b5f1f57428f26b1a019bf8b3ec6d3aee967245ced17da5f6ee1"
     },
     {
       "path": "modules/hall-ui/records/collaboration.md",
@@ -9082,12 +9082,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "06b4fc03bee8b756f3b285d27f8e9ffece9608c8ef1e84faafe0cdb23cc25836"
+      "sha256": "b9179362a537af928b9de1d7ca6db62760d915b391fc29d00fb2cdcb76c080a1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "d36ec2c223737d20c61047828838d16732e7aa9bd1a25069717210c20c514ea8"
+      "sha256": "42938a871175427a6287de358dbdaa5eb97f8066ff8977a654310f3b0ae7de2c"
     },
     {
       "path": "public-docs/index.html",
@@ -9107,7 +9107,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "88c13089d0db2acf601693be2fee84010e6af2856e32eb4ffecf83746c831790"
+      "sha256": "a188100f02dbc3700e935dd539de5ddf46bf1f76a4f6c659f697981d2ff369f9"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9952,7 +9952,7 @@
     {
       "path": "scripts/gds/module-artifact.js",
       "mode": "0000644",
-      "sha256": "f2d0770ca07105a0555190783cd37ff838babcec337a93a2ebd2a448efc37062"
+      "sha256": "7b10d8fd5146325c218d59eadfb6feaeb8819e14c4b27b166ad9ff714e1caed0"
     },
     {
       "path": "scripts/gds/module-assess-security.js",
@@ -9967,7 +9967,7 @@
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "8563b7fa47b7c3f00e6c070c496a924875ea49ca41b681c1209c5819d2551f97"
+      "sha256": "7ac7a4234d44c592f51a28d95a91f14379c6271977eb05d1e89700ba72827817"
     },
     {
       "path": "scripts/gds/move-escalation.js",
@@ -10832,7 +10832,7 @@
     {
       "path": "scripts/hall-preview/server.js",
       "mode": "0000644",
-      "sha256": "974c71c0a21d62d5c702d611f1ff26c5e5e8eb58e3bb38271665bd56598b4200"
+      "sha256": "72a4ab518608fb77101e74b38c802af09bbf041f95ba3acdb97b0c9095b499df"
     },
     {
       "path": "scripts/hall-preview/task-visual.js",
@@ -11057,7 +11057,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "2bc2e05af26a1e416fb083dda7cfce7e7693a56dccd46f7d1f233343ec73d215"
+      "sha256": "6e058031cd08e741f970c6f4a535e36ff96bd61a34d335e72ab82d91e508d21f"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -11202,7 +11202,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "3acd1e40da2502d9c69f7260548585f31e35a102c6dcc5cd58a71965a6b8a42c"
+      "sha256": "9a73d17319e72baaf1214bad5b8ae7847c8c11a4caa7cb7db74ef5b5dce1be8d"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -11272,7 +11272,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8962044325961f1bbe248348bc45c6999e6ea90ac2ef51599739a35dc9b1d19f"
+      "sha256": "45272b4675551e89ab4372cccfb4fdd58a0308fadd071d8a5d9a1f4c13cbe339"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13387,7 +13387,7 @@
     {
       "path": "tests/hall_catalog_world.mjs",
       "mode": "0000644",
-      "sha256": "79c8759cbb0d17477139acae6e0057caa70021ff0edfeba9c419c14ad729a1ac"
+      "sha256": "9a2434b3d54cbc23b3874e757d5d2fc6ab5b50e239c07d013f8cfe1409c11806"
     },
     {
       "path": "tests/hall_client_request_shape.mjs",
@@ -14339,6 +14339,11 @@
       "mode": "0000644",
       "sha256": "ba4233ed072c87df9dbc5c75af10655ad8eaaf9d8ccbe69df146052467a1279e"
     },
+    {
+      "path": "tests/module_store_howto.mjs",
+      "mode": "0000644",
+      "sha256": "43828c1a95652180d558e7676cc2053d0599a61c0edf4cd1ab100820fc7de493"
+    },
     {
       "path": "tests/module_store_publish.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 470 operations across 72 resource groups
+- 471 operations across 72 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -1053,6 +1053,8 @@ function createClient(opts = {}) {
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
+      getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
     },

package/clients/bongos-client/index.cjs

@@ -1052,6 +1052,8 @@ function createClient(opts = {}) {
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
+      getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
     },

package/clients/bongos-client/index.d.ts

@@ -165,6 +165,7 @@ export interface GetSpecialitiesOfferedResponse { suggestions: unknown }
 export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
 export interface GetStoreEntitlementsResponse { entitlements: unknown }
+export interface GetStoreModulesKeyVersionsVersionHowtoResponse { module_key: unknown; title: unknown; version: unknown; published_at: unknown; delisted: unknown; markdown: unknown; artifact_url: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
 export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
@@ -1488,6 +1489,8 @@ export interface BongosClient {
     getStoreModulesKeyEntitlement(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /store/modules/{key}/versions — rank: metic+archon */
     postStoreModulesKeyVersions(args?: RequestArgs): Promise<PostStoreModulesKeyVersionsResponse>;
+    /** GET /store/modules/{key}/versions/{version}/howto — rank: any-builder */
+    getStoreModulesKeyVersionsVersionHowto(args?: RequestArgs): Promise<GetStoreModulesKeyVersionsVersionHowtoResponse>;
     /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
     getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
   };

package/clients/bongos-client/index.mjs

@@ -1049,6 +1049,8 @@ export function createClient(opts = {}) {
       getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // GET /store/modules/{key}/versions/{version}/howto — rank: any-builder — GET /store/modules/:key/versions/:version/howto
+      getStoreModulesKeyVersionsVersionHowto: (args) => request("GET", "/store/modules/{key}/versions/{version}/howto", { hasBody: false }, args),
       // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
       getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
     },

package/docs/api/openapi.json

@@ -19385,6 +19385,67 @@
         ]
       }
     },
+    "/store/modules/{key}/versions/{version}/howto": {
+      "get": {
+        "operationId": "get_store_modules_key_versions_version_howto",
+        "tags": [
+          "store"
+        ],
+        "summary": "GET /store/modules/:key/versions/:version/howto",
+        "description": "GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from that version's own stored tarball after the install hash check, so it always matches the version and cannot change after publishing. Returns the markdown as TEXT, never HTML: the hall's Modules tab renders it through its one escaping markdown reader (md-reader.js), because the file is author-written and must be treated as untrusted input. rank: any-builder — no entitlement needed, since a buyer reads the how-to before deciding. The one exception is a delisted module: ADR 0338 D2 keeps it readable only for the people who already hold it, so there the caller's own entitlement is checked (own-scoped, like the reads above).\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/modules.js",
+        "parameters": [
+          {
+            "name": "key",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `key`."
+          },
+          {
+            "name": "version",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `version`."
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetStoreModulesKeyVersionsVersionHowtoResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/store/modules/{key}/versions/{version}/tarball": {
       "get": {
         "operationId": "get_store_modules_key_versions_version_tarball",
@@ -24102,6 +24163,27 @@
           "entitlements"
         ]
       },
+      "GetStoreModulesKeyVersionsVersionHowtoResponse": {
+        "type": "object",
+        "properties": {
+          "module_key": {},
+          "title": {},
+          "version": {},
+          "published_at": {},
+          "delisted": {},
+          "markdown": {},
+          "artifact_url": {}
+        },
+        "required": [
+          "module_key",
+          "title",
+          "version",
+          "published_at",
+          "delisted",
+          "markdown",
+          "artifact_url"
+        ]
+      },
       "GetTaskRecommendationsForMeResponse": {
         "type": "object",
         "properties": {
@@ -30051,9 +30133,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 470,
-  "x-schema-count": 502,
+  "x-endpoint-count": 471,
+  "x-schema-count": 503,
   "x-undocumented-bodies": 12,
-  "x-response-schemas": 338,
+  "x-response-schemas": 339,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 470 endpoints across 85 route files.
+> **Generated from the live route files** — the route file is authoritative. 471 endpoints across 85 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -750,7 +750,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/sso/pubkey` | `public` | — | GET /sso/pubkey — the hub's Ed25519 assertion-verification key (public). |
 | POST | `/api/bongos/sso/token` | `public` | `client_id`, `client_secret`, `code`, `redirect_uri` | POST /sso/token — server-to-server code redemption. |
 
-## `store` (6)
+## `store` (7)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -759,6 +759,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/acquired` | `any-builder` | `version` |  |
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
+| GET | `/api/bongos/store/modules/:key/versions/:version/howto` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/howto — the how-to a version shipped with (task 1004366, ADR 0347 D1/D3), read from … |
 | GET | `/api/bongos/store/modules/:key/versions/:version/tarball` | `any-builder` | — |  |
 
 ## `task-recommendations` (4)