@bongos/core 1.21.174 → 1.21.176

package/scripts/gds/bug-triage.js

@@ -1,292 +1,7 @@
 #!/usr/bin/env node
-// /bug-triage — walk every open kind=bug task and verdict it one-at-a-time
-// (task 1001478). The idea-triage precedent for a queue with no gate: bugs now
-// land directly as kind=bug tasks with no triage step (task 1003071), so
-// near-duplicate reports accumulate with nothing to fold them together.
-//
-// Usage:
-//   node scripts/gds/bug-triage.js
-//
-// BATCH CLUSTER PASS, mirroring /idea-triage's (task 1001465): before the
-// one-at-a-time walk, near-duplicate open bug tasks are grouped (shared
-// `goal_id`, high title/description word overlap — `clusterRecords`, shared
-// with triage.js so the union-find/Jaccard core is written once) and offered
-// ONE verdict per group: keep a canonical task and merge the rest into it,
-// dismiss the whole group as won't-fix, walk them individually, or skip.
-// Partitioned by `goal_id` rather than `kind` (every row here is already
-// kind=bug, so that gate would be a no-op) — two bug reports in unrelated
-// goals describing similar-sounding symptoms are not the same triage
-// decision, the same reasoning idea-triage applies to its own `kind` gate.
-//
-// Prompts per bug task:
-//   [m]erge with #N  → POST /tasks/:id/merge {into_task_id:N} (N is the
-//                      canonical TASK to keep; this task's status becomes
-//                      'abandoned' with merged_into_task_id=N — no new
-//                      'merged' status, see db-ship.js mergeTask's header)
-//   [w]on't-fix      → POST /tasks/:id/abandon {reason} (not a bug / already
-//                      fixed / can't reproduce — the report itself is closed,
-//                      not folded into another task)
-//   [s]kip           → no write; the task surfaces again next triage
-//   [q]uit           → exit early, print partial summary
-//
-// Prompts per duplicate cluster (before the per-task walk):
-//   [k]eep #N        → merge every other member into #N (default: the
-//                      oldest); #N itself is NOT verdicted here — it still
-//                      gets the normal per-task walk below
-//   [d]iscard        → won't-fix every member in the cluster
-//   [i]ndividually   → ignore the cluster grouping; walk each member normally
-//   [s]kip           → no write; the whole cluster surfaces again next triage
-//
-// Exit codes:
-//   0  walked cleanly (incl. nothing open)
-//   1  api / network error
-//   2  no session
-
-const readline = require('node:readline');
-const { cliClient, requireSession, cliExit } = require('./cli-lib');
-const { clusterRecords } = require('./triage');
-
-function prompt(rl, question) {
-  return new Promise((resolve) => rl.question(question, resolve));
-}
-
-function trim(s, n) {
-  const str = String(s || '');
-  return str.length > n ? `${str.slice(0, n - 1)}…` : str;
-}
-
-// Statuses a bug can still be triaged FROM. 'shipped'/'abandoned' are terminal
-// (the latter includes already-merged rows, since merge reuses that status —
-// see db-ship.js mergeTask's header), so neither belongs in an "open" walk.
-const OPEN_STATUSES = new Set(['backlog', 'ready', 'active', 'blocked', 'completed', 'confirmed']);
-
-async function listOpenBugTasks() {
-  const api = await cliClient();
-  const r = await api.tasks.getTasks({ query: { kind: 'bug', limit: 1000 } });
-  if (!r.ok) throw new Error(`GET /tasks?kind=bug failed (${r.status}): ${JSON.stringify(r.data)}`);
-  // GET /tasks responds { tasks: [...] } (modules/lifecycle/routes/tasks.js),
-  // not a bare array — triage.js:163's `r.data?.ideas ?? []` is the same shape
-  // one route over. Grade finding: this was `(r.data || [])`, an object with
-  // no .filter, so every real run threw before listing a single bug.
-  return (r.data?.tasks ?? []).filter((t) => OPEN_STATUSES.has(t.status));
-}
-
-async function mergeTaskInto(id, intoTaskId, reason) {
-  const api = await cliClient();
-  const r = await api.tasks.postTasksIdMerge({ id, body: { into_task_id: Number(intoTaskId), reason: reason || '' } });
-  if (!r.ok) throw Object.assign(new Error(`merge failed (${r.status}): ${JSON.stringify(r.data)}`), { code: r.data?.error?.code || r.data?.error });
-  return r.data;
-}
-
-async function dismissTask(id, reason) {
-  const api = await cliClient();
-  const r = await api.tasks.postTasksIdAbandon({ id, body: { reason: reason || '' } });
-  if (!r.ok) throw Object.assign(new Error(`won't-fix failed (${r.status}): ${JSON.stringify(r.data)}`), { code: r.data?.error?.code || r.data?.error });
-  return r.data;
-}
-
-function printTask(task, idx, total) {
-  console.log(`\n[${idx + 1}/${total}] #${task.id}  [${task.status}]  ${task.title}`);
-  if (task.description) console.log(`  ${trim(task.description, 300)}`);
-  if (task.goal_id) console.log(`  goal ${task.goal_id}`);
-}
-
-function printCluster(cluster) {
-  const sep = '┄'.repeat(72);
-  console.log(`\n${sep}`);
-  console.log(`Cluster of ${cluster.length} likely-duplicate bug reports (oldest first — the suggested keeper):`);
-  for (const m of cluster) console.log(`  #${m.id}  [${m.status}]  ${trim(m.title, 80)}`);
-  console.log(sep);
-}
-
-// The interactive batch pass over one cluster. Mutates `state` (summary
-// counts) and returns nothing; `clusteredIds` is mutated in place so a choice
-// of "individually" or "keep #N" puts the affected task(s) back into the
-// normal per-task walk that runs after every cluster has been offered.
-// Mirrors triage.js's handleCluster exactly, task-shaped.
-async function handleCluster(rl, cluster, clusteredIds, state) {
-  printCluster(cluster);
-  let handled = false;
-  while (!handled) {
-    const ans = (await prompt(rl, `  [k]eep #${cluster[0].id} & merge the rest / [d]iscard all / [i]ndividually / [s]kip cluster > `)).trim().toLowerCase();
-
-    if (ans === 's' || ans === 'skip' || ans === '') { handled = true; break; }
-
-    if (ans === 'i' || ans === 'individually') {
-      for (const m of cluster) clusteredIds.delete(m.id);
-      console.log('  → walking this cluster\'s bugs individually');
-      handled = true; break;
-    }
-
-    if (ans === 'd' || ans === 'discard') {
-      const reason = (await prompt(rl, '  reason (optional, enter to skip): ')).trim();
-      for (const m of cluster) {
-        try {
-          await dismissTask(m.id, reason || 'won\'t-fix as part of a batch-verdicted duplicate cluster');
-          state.summary.dismissed++;
-          state.dismissedIds.push(m.id);
-        } catch (err) {
-          console.error(`  ! #${m.id}: ${err.message}`);
-        }
-      }
-      console.log(`  ✖ dismissed ${cluster.length} duplicate bug reports`);
-      handled = true; break;
-    }
-
-    if (ans === 'k' || ans === 'keep' || ans.startsWith('k ') || ans.startsWith('k#')) {
-      let canonicalId = cluster[0].id;
-      const inline = ans.replace(/^k(eep)?(\s|#)*/, '').trim();
-      if (inline) {
-        const n = Number(inline.replace(/^#/, ''));
-        if (Number.isFinite(n) && n > 0 && cluster.some((m) => String(m.id) === String(n))) canonicalId = n;
-        else if (Number.isFinite(n) && n > 0) console.log(`  ! #${n} isn't in this cluster; keeping #${canonicalId}`);
-      }
-      for (const m of cluster) {
-        if (String(m.id) === String(canonicalId)) continue;
-        try {
-          await mergeTaskInto(m.id, canonicalId, `duplicate cluster batch-merged into #${canonicalId}`);
-          state.summary.merged++;
-          state.mergedIds.push(m.id);
-        } catch (err) {
-          console.error(`  ! #${m.id}: ${err.message}`);
-          // A failed merge must not silently vanish the bug for this session:
-          // without this, the member stays in clusteredIds and the later
-          // `tasks.filter((t) => !clusteredIds.has(t.id))` drops it from BOTH
-          // the batch verdict (it never merged) and the individual walk —
-          // one stderr line and the report is skipped entirely.
-          clusteredIds.delete(m.id);
-        }
-      }
-      // The keeper is untouched by the batch verdict — it still needs its own
-      // won't-fix/merge/skip decision, so it goes back into the normal walk.
-      clusteredIds.delete(canonicalId);
-      console.log(`  ⇢ merged ${cluster.length - 1} duplicate(s) into #${canonicalId} — #${canonicalId} still needs its own verdict below`);
-      handled = true; break;
-    }
-
-    console.log('  ? unknown — type k, d, i, or s');
-  }
-}
-
-async function main() {
-  await requireSession();
-
-  let tasks;
-  try {
-    tasks = await listOpenBugTasks();
-  } catch (err) {
-    console.error(err.message);
-    cliExit(1);
-    return;
-  }
-
-  if (tasks.length === 0) {
-    console.log('bug queue empty — nothing to triage.');
-    cliExit(0);
-    return;
-  }
-
-  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  const summary = { merged: 0, dismissed: 0, skipped: 0 };
-  const mergedIds = [];
-  const dismissedIds = [];
-  let quit = false;
-
-  // BATCH CLUSTER PASS — partitioned by goal_id, not kind (every row here is
-  // already kind=bug, so a kind gate would be a no-op; see module header).
-  const { clusters, clusteredIds } = clusterRecords(tasks, {
-    textOf: (t) => `${t.title || ''} ${t.description || ''}`,
-    kindOf: (t) => t.goal_id || null,
-    timeOf: (t) => new Date(t.created_at),
-  });
-  if (clusters.length > 0) {
-    console.log(`\n🔗 ${clusters.length} likely-duplicate cluster${clusters.length === 1 ? '' : 's'} found (${clusteredIds.size} bug reports) — batch verdict available before the individual walk.`);
-    const state = { summary, mergedIds, dismissedIds };
-    for (const cluster of clusters) {
-      await handleCluster(rl, cluster, clusteredIds, state);
-    }
-  }
-  tasks = tasks.filter((t) => !clusteredIds.has(t.id));
-  if (tasks.length === 0) {
-    console.log('\nnothing left to walk individually — every open bug report was resolved in a batch cluster verdict.');
-    rl.close();
-    printSummary(summary, mergedIds, dismissedIds);
-    cliExit(0);
-    return;
-  }
-
-  console.log(`\n🐛 ${tasks.length} open bug report${tasks.length === 1 ? '' : 's'} to triage individually.`);
-
-  let walked = 0;
-  for (let i = 0; i < tasks.length && !quit; i++) {
-    const task = tasks[i];
-    printTask(task, i, tasks.length);
-
-    let handled = false;
-    while (!handled) {
-      const ans = (await prompt(rl, '[m]erge / [w]on\'t-fix / [s]kip / [q]uit > ')).trim().toLowerCase();
-
-      if (ans === 'q' || ans === 'quit') { quit = true; handled = true; break; }
-
-      if (ans === 's' || ans === 'skip' || ans === '') {
-        summary.skipped++;
-        handled = true; break;
-      }
-
-      if (ans === 'w' || ans === 'wontfix' || ans === "won't-fix" || ans === 'dismiss') {
-        const reason = (await prompt(rl, '  reason (not a bug / already fixed / cannot reproduce): ')).trim();
-        try {
-          await dismissTask(task.id, reason);
-          summary.dismissed++;
-          dismissedIds.push(task.id);
-          console.log(`  ✖ dismissed #${task.id}`);
-        } catch (err) {
-          console.error(`  ! ${err.message}`);
-          continue;
-        }
-        handled = true; break;
-      }
-
-      if (ans === 'm' || ans === 'merge' || ans.startsWith('m ') || ans.startsWith('m#')) {
-        const inline = ans.replace(/^m(erge)?(\s|#)*/, '').trim();
-        const target = inline || (await prompt(rl, '  merge into which task id? #')).trim().replace(/^#/, '');
-        const n = Number(target);
-        if (!Number.isFinite(n) || n <= 0) { console.log('  ? not a valid task id'); continue; }
-        try {
-          await mergeTaskInto(task.id, n, '');
-          summary.merged++;
-          mergedIds.push(task.id);
-          console.log(`  ⇢ merged #${task.id} into #${n}`);
-        } catch (err) {
-          console.error(`  ! ${err.message}`);
-          continue;
-        }
-        handled = true; break;
-      }
-
-      console.log('  ? unknown — type m, w, s, or q');
-    }
-    if (handled && !quit) walked++;
-  }
-
-  rl.close();
-  printSummary(summary, mergedIds, dismissedIds, tasks.length - walked);
-  cliExit(0);
-}
-
-function printSummary(summary, mergedIds, dismissedIds, unseen = 0) {
-  console.log('\n── bug triage summary ──');
-  console.log(`  merged:    ${summary.merged}${mergedIds.length ? ` (${mergedIds.map((i) => `#${i}`).join(', ')})` : ''}`);
-  console.log(`  dismissed: ${summary.dismissed}${dismissedIds.length ? ` (${dismissedIds.map((i) => `#${i}`).join(', ')})` : ''}`);
-  console.log(`  skipped:   ${summary.skipped}`);
-  if (unseen > 0) console.log(`  ${unseen} unseen (quit early) — will surface again next triage`);
-}
-
-if (require.main === module) {
-  main().catch((err) => {
-    console.error('fatal:', err);
-    cliExit(1);
-  });
-}
-
-module.exports = { listOpenBugTasks, mergeTaskInto, dismissTask, OPEN_STATUSES };
+// scripts/gds/bug-triage.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/bug-triage.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'bug-triage.js');

package/scripts/gds/build-bongos.js

@@ -1,94 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/build-bongos.js — compile the standalone `bongos` CLI binaries
-// (GDS-V4 · V4.R81 · task 1248). CI (.github/workflows/build-bongos-cli.yml) runs
-// this; a maintainer can run it locally too.
-//
-// Uses `bun build --compile`, which CROSS-compiles every target from a single
-// host (mac arm64/x64, linux x64/arm64, windows x64) — no per-OS runner matrix.
-// The binary is fully self-contained: no Node, no repo needed at runtime. The
-// on-ramp verbs (login/box/shell/code/init/reauth) are bundled + dispatched
-// in-process by bin/bongos.js (its COMPILED branch); work verbs print how to get
-// a real environment.
-//
-//   node scripts/gds/build-bongos.js                 # all targets → dist/
-//   node scripts/gds/build-bongos.js --target mac-arm64
-//   node scripts/gds/build-bongos.js --outdir /tmp/out
-//
-// Output filenames match config/bongos-cli.json's `assets` exactly (so the
-// /downloads/bongos redirects resolve after `gh release create`). Version comes
-// from that same config — the single source of truth for a release.
-
+// scripts/gds/build-bongos.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/build-bongos.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-const { spawnSync } = require('node:child_process');
-const { arg } = require('./cli-lib');
-
-const REPO_ROOT = path.join(__dirname, '..', '..');
-const ENTRY = path.join(REPO_ROOT, 'bin', 'bongos.js');
-const cfg = require(path.join(REPO_ROOT, 'config', 'bongos-cli.json'));
-const VERSION = cfg.version;
-
-// target key (matches config assets) → { bunTarget, asset filename }
-const TARGETS = {
-  'mac-arm64': { bun: 'bun-darwin-arm64', file: cfg.assets['mac-arm64'] },
-  'mac-x64': { bun: 'bun-darwin-x64', file: cfg.assets['mac-x64'] },
-  'linux-x64': { bun: 'bun-linux-x64', file: cfg.assets['linux-x64'] },
-  'linux-arm64': { bun: 'bun-linux-arm64', file: cfg.assets['linux-arm64'] },
-  'win-x64': { bun: 'bun-windows-x64', file: cfg.assets['win-x64'] },
-};
-
-function bunPresent() {
-  const r = spawnSync('bun', ['--version'], { encoding: 'utf8', shell: process.platform === 'win32' });
-  return !!r && !r.error && r.status === 0;
-}
-
-function build(one, outDir) {
-  const t = TARGETS[one];
-  if (!t) throw new Error(`unknown target "${one}" (known: ${Object.keys(TARGETS).join(', ')})`);
-  if (!t.file) throw new Error(`config/bongos-cli.json has no asset for target "${one}"`);
-  const outfile = path.join(outDir, t.file);
-  console.log(`  building ${one} → ${path.relative(REPO_ROOT, outfile)} (${t.bun})`);
-  const r = spawnSync(
-    'bun',
-    ['build', '--compile', `--target=${t.bun}`, ENTRY, '--outfile', outfile],
-    { stdio: 'inherit', cwd: REPO_ROOT, shell: process.platform === 'win32' }
-  );
-  if (!r || r.error || r.status !== 0) {
-    throw new Error(`bun build failed for ${one}${r && r.error ? `: ${r.error.message}` : ` (exit ${r ? r.status : '?'})`}`);
-  }
-  return outfile;
-}
-
-function main() {
-  if (!bunPresent()) {
-    console.error('✖ `bun` is required to compile the standalone binary but was not found.');
-    console.error('  Install it (https://bun.sh) — e.g. `curl -fsSL https://bun.sh/install | bash` —');
-    console.error('  or in CI use the oven-sh/setup-bun action. Then re-run.');
-    process.exit(1);
-  }
-  const outDir = arg('--outdir') || path.join(REPO_ROOT, 'dist');
-  fs.mkdirSync(outDir, { recursive: true });
-  const only = arg('--target');
-  const targets = only ? [only] : Object.keys(TARGETS);
-
-  console.log(`bongos build — version ${VERSION}, ${targets.length} target(s) → ${path.relative(REPO_ROOT, outDir) || '.'}`);
-  const built = [];
-  for (const t of targets) built.push(build(t, outDir));
-
-  console.log(`\n✓ Built ${built.length} binary(ies):`);
-  for (const f of built) {
-    let size = '';
-    try { size = ` (${(fs.statSync(f).size / 1e6).toFixed(1)} MB)`; } catch { /* ignore */ }
-    console.log(`  ${path.relative(REPO_ROOT, f)}${size}`);
-  }
-  console.log('\nNext: publish these as assets on a `v' + VERSION + '` release of the public releases repo');
-  console.log('(config/bongos-cli.json → releases_repo). See docs/recipes/bongos-cli-release.md.');
-}
-
-if (require.main === module) {
-  try { main(); } catch (e) { console.error(`✖ ${e.message}`); process.exit(1); }
-}
-
-module.exports = { TARGETS, VERSION };
+require('../bongos/forwarder.js').forward(module, 'build-bongos.js');

package/scripts/gds/bump-version.js

@@ -1,221 +1,7 @@
 #!/usr/bin/env node
-// scripts/gds/bump-version.js — the mechanical CORE_VERSION patch bump for the
-// publish-on-merge lane (ADR 0161, task 1002620).
-//
-// WHY THIS EXISTS. ADR 0161 makes every merge to main publishable: when a merge
-// lands without a human version bump, CI bumps a PATCH itself so the release
-// has a unique version. The bump writes the two places the repo's version
-// discipline lives — the `const CORE_VERSION` literal in src/module-api.js and
-// the release ledger in docs/module-api-changelog.md — because a bare literal
-// change with no changelog line is exactly the drift the discipline prevents.
-//
-// WHERE THE LEDGER LIVES (ADR 0203). It used to be a comment block directly
-// above the literal, in src/module-api.js. Appending two lines there on EVERY
-// release grew that file past the 1500-line oversized-file fitness ratchet, and
-// because this lane pushes straight to main it broke the very `unit` gate it
-// rides behind — for main and for every open PR at once. The ledger is now a
-// markdown file, which `git ls-files '*.js'` never counts, so it can grow
-// forever. The INSERTION CONTRACT is unchanged: entries stay oldest-first and
-// each new one goes immediately above the divider that closes the ledger.
-//
-// POLICY (deliberately narrow): this script only ever bumps PATCH. A MINOR or
-// MAJOR is a statement about the doorway surface that only a human (or a far
-// smarter check) can make — it stays an in-task hand edit, exactly as before.
-//
-// SHAPE-PRESERVING: deploy-divergence.js finds bump commits with
-// `git log -G"^const CORE_VERSION = "` and reads the literal with a regex; the
-// rewrite here keeps that exact line shape. tests/bump_version.mjs pins this.
-//
-// Usage:
-//   node scripts/gds/bump-version.js                # dry-run: print the plan
-//   node scripts/gds/bump-version.js --apply        # rewrite both files
-//   node scripts/gds/bump-version.js --apply --note "run 123456"  # extra provenance
-// stdout (both modes): one JSON line { from, to, applied } for CI to capture.
-
+// scripts/gds/bump-version.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/bump-version.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const fs = require('node:fs');
-const path = require('node:path');
-
-const TARGET = path.join(__dirname, '..', '..', 'src', 'module-api.js');
-// The release ledger (ADR 0203) — markdown, so the .js line ratchet never counts it.
-const CHANGELOG = path.join(__dirname, '..', '..', 'docs', 'module-api-changelog.md');
-const CONST_RE = /^const CORE_VERSION = '(\d+)\.(\d+)\.(\d+)';.*$/m;
-// The ledger's closing divider — the last line inside its fenced block, and the
-// insertion anchor each new entry goes immediately above. Same 75-dash rule the
-// comment block used, minus the `// ` that made it a JS comment.
-const DIVIDER = '---------------------------------------------------------------------------';
-
-// Pure transform: (module-api source, { note, changelog }) -> { from, to, text,
-// changelogText }. Pass the ledger's current text as `changelog` to get the
-// entry appended too; omit it to bump the literal alone (the unit tests do).
-// Throws with a precise message on any shape it does not recognize — a silent
-// mis-edit of the version literal is the worst possible failure mode here.
-function bumpPatch(src, { note = '', changelog = null } = {}) {
-  const m = src.match(CONST_RE);
-  if (!m) throw new Error(`bump-version: could not find the CORE_VERSION literal in ${TARGET} (expected: const CORE_VERSION = 'x.y.z';)`);
-  const [major, minor, patch] = [Number(m[1]), Number(m[2]), Number(m[3])];
-  const from = `${major}.${minor}.${patch}`;
-  const to = `${major}.${minor}.${patch + 1}`;
-
-  // 1. The literal — same line shape deploy-divergence greps for.
-  const newConstLine = `const CORE_VERSION = '${to}'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md`;
-  const text = src.replace(CONST_RE, newConstLine);
-
-  // 2. The ledger entry — inserted just above the divider that closes the
-  //    ledger, keeping the historic two-line entry style byte-for-byte (the
-  //    old `//   ` / `//         ` comment prefixes minus the `// ` marker).
-  let changelogText = null;
-  if (changelog !== null) {
-    const dividerStart = changelog.lastIndexOf(DIVIDER);
-    if (dividerStart === -1) throw new Error(`bump-version: could not find the changelog closing divider in ${CHANGELOG} — the ledger's insertion anchor is gone (ADR 0203)`);
-    const noteSuffix = note ? ` ${note}.` : '';
-    const entry =
-      `  ${to} — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges\n` +
-      `        landed since ${from} with no explicit bump.${noteSuffix} (task 1002620)\n`;
-    changelogText = changelog.slice(0, dividerStart) + entry + changelog.slice(dividerStart);
-  }
-
-  return { from, to, text, changelogText };
-}
-
-function main() {
-  const apply = process.argv.includes('--apply');
-  const noteIdx = process.argv.indexOf('--note');
-  const note = noteIdx !== -1 ? (process.argv[noteIdx + 1] || '') : '';
-
-  // Read and transform BOTH files before writing EITHER: a half-applied bump
-  // (literal moved, ledger silent) is precisely the drift this script exists
-  // to prevent, and it would be committed and pushed to main before anyone saw it.
-  const src = fs.readFileSync(TARGET, 'utf8');
-  const changelog = fs.readFileSync(CHANGELOG, 'utf8');
-  const { from, to, text, changelogText } = bumpPatch(src, { note, changelog });
-  if (changelogText === null) throw new Error('bump-version: the ledger was not rewritten — refusing to write a versionless release');
-  if (apply) {
-    fs.writeFileSync(TARGET, text);
-    fs.writeFileSync(CHANGELOG, changelogText);
-  } else {
-    console.error(`bump-version: would bump ${from} → ${to} in ${TARGET} + ${CHANGELOG} (dry-run; pass --apply to write)`);
-  }
-  console.log(JSON.stringify({ from, to, applied: apply }));
-}
-
-// The commit subject THIS lane writes for its own bump commits — publish.yml's
-// `git commit -m` mirrors it verbatim (tests/bump_version.mjs pins the two
-// against each other). isReleaseCommit is the cascade terminator (task 1002636):
-// publish.yml no-ops when current main HEAD matches, because everything at that
-// HEAD was already published by the run that created the commit. Deliberately
-// narrow — a HUMAN release commit ("release: core 1.19.2 — carrier for the
-// init-blocker fixes") must NOT match: that version is new and still needs
-// publishing.
-const RELEASE_COMMIT_RE = /^release: core \d+\.\d+\.\d+ — CI auto-patch carrier \(publish-on-merge/;
-
-function isReleaseCommit(subject) {
-  return RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
-}
-
-// laneReleasedVersions — every version THIS lane has announced it published, read
-// from its own release commits (task 1003202).
-//
-// WHY THIS EXISTS. publish.yml used to answer "is HEAD's version already on the
-// registry?" with `npm view @bongos/core@<v>`. That needs a credential:
-// @bongos/core is PRIVATE, so an unauthenticated read is a flat E404, not a
-// "no". Moving the lane to OIDC trusted publishing removes the token — and OIDC
-// only authenticates `npm publish`, nothing else — so the old check would have
-// silently reported "not taken" on EVERY run, skipped the auto-bump, and then
-// collided on the already-published version. It would have looked fine for
-// exactly one release.
-//
-// The answer is already in the repo. Every version this lane ships is announced
-// by a `release: core X.Y.Z — CI auto-patch carrier` commit it writes itself, and
-// RELEASE_COMMIT_RE above is that contract. So the registry is not the only place
-// that knows; git knows too, needs no auth, and is the same source the cascade
-// terminator already trusts.
-//
-// Deliberately shares RELEASE_COMMIT_RE with isReleaseCommit, so a HUMAN release
-// commit ("release: core 1.19.2 — carrier for the init-blocker fixes") is NOT
-// counted here either — that version is new and still needs publishing, which is
-// exactly the distinction the constant was written to make.
-//
-// BOTH failure directions are safe, which is what makes this acceptable on a
-// release-critical lane — but only since task 1003914 reordered publish.yml so
-// the bump commit is PUSHED AFTER a successful publish, not before it:
-//   • pack or publish failed  → the bump commit was never pushed (it only ever
-//     existed on the discarded runner), so no version looks taken and the next
-//     run recomputes and retries the SAME version. No gap, nothing burned.
-//   • published, push then failed → version looks free, so the next run bumps to
-//     it and npm refuses the duplicate. publish.yml treats that refusal as
-//     success and falls through to the record step, which commits the release
-//     line main was missing. Self-healing, and nothing wrong ships.
-//
-// Before that reorder the first case was the lossy one: the push landed first,
-// so a failed publish left main declaring a version the registry never had, the
-// cascade terminator no-opped every following run, and only a fresh work merge
-// moved past it. That is how 1.19.716-723 were minted and lost (2026-09-13).
-// HUMAN_RELEASE_COMMIT_RE — a release commit a PERSON wrote (task 1003526).
-//
-// ADR 0161 §2 promises "a minor or major stays a deliberate in-task human edit".
-// The lane could not keep that promise: a branch that hand-bumped to 1.20.0 had no
-// commit shape the lane recognised, so the LIVE test below failed its own PR's
-// `unit` check by construction (that is what killed task 1003044's first ship,
-// PR #391) and, had it merged, publish.yml would have packaged 1.20.0 forever
-// without ever recording it — its record step fires only when CI itself bumped,
-// so every later merge would re-pack the same taken version and NOTHING NEW WOULD
-// EVER PUBLISH AGAIN. A stalled lane, not just a blocked PR.
-//
-// So a human release is now a first-class shape: `release: core X.Y.Z — <reason>`
-// that is NOT this lane's own carrier phrase. Deliberately the complement of
-// RELEASE_COMMIT_RE, so no subject can ever be read as both.
-const HUMAN_RELEASE_COMMIT_RE = /^release: core \d+\.\d+\.\d+ \u2014 (?!CI auto-patch carrier \(publish-on-merge)\S/;
-
-function isHumanReleaseCommit(subject) {
-  return HUMAN_RELEASE_COMMIT_RE.test(String(subject == null ? '' : subject));
-}
-
-// laneReleasedVersions answers "is this version SPOKEN FOR?" — which is a different
-// question from isReleaseCommit's "did this lane already publish everything at this
-// HEAD?", and task 1003526 is where the difference started to matter.
-//
-// They used to share RELEASE_COMMIT_RE, and the old comment treated that as the
-// invariant. It is not: the two callers want OPPOSITE answers for a human release
-// commit, and keeping them identical is exactly what made a human minor impossible.
-//
-//   • the cascade terminator (isReleaseCommit) must say NO — a human-declared
-//     version is new and still needs publishing. Saying yes would no-op the run and
-//     the version would be bumped but never packaged (the 1.19.0 hole).
-//   • this function must say YES — the number is claimed, so the lane must not try
-//     to publish onto it. publish.yml reads that as taken=true, auto-bumps one patch
-//     past it, publishes THAT, and records its own carrier. The lane keeps moving
-//     and the human still gets their minor: 1.19.x → (declare 1.20.0) → 1.20.1.
-//
-// A human therefore spends a version number to change the minor/major digit. That is
-// the whole cost of keeping this inside bump-version.js: publishing 1.20.0 EXACTLY
-// would mean teaching publish.yml's record step to fire without a bump, and that file
-// is a protected surface on the lane that already minted-and-lost 1.19.716-723. Not
-// worth it for a digit.
-//
-// BOTH failure directions stay safe, which is what makes this acceptable here. A
-// subject wrongly counted → the lane bumps PAST a free version (a gap, harmless). A
-// real release missed → npm refuses the duplicate and publish.yml's already-present
-// branch records it (task 1003914). Neither direction can double-publish.
-function laneReleasedVersions(subjects = []) {
-  const out = new Set();
-  for (const subject of subjects) {
-    const line = String(subject == null ? '' : subject);
-    if (!RELEASE_COMMIT_RE.test(line) && !HUMAN_RELEASE_COMMIT_RE.test(line)) continue;
-    const m = /^release: core (\d+\.\d+\.\d+) /.exec(line);
-    if (m) out.add(m[1]);
-  }
-  return out;
-}
-
-module.exports = {
-  bumpPatch,
-  CONST_RE,
-  RELEASE_COMMIT_RE,
-  HUMAN_RELEASE_COMMIT_RE,
-  isReleaseCommit,
-  isHumanReleaseCommit,
-  laneReleasedVersions,
-};
-if (require.main === module) main();
+require('../bongos/forwarder.js').forward(module, 'bump-version.js');