@bongos/core 1.22.1 → 1.22.2

package/modules/lifecycle/version-close.js

@@ -101,7 +101,6 @@ async function getCloseSuggestionsForBuildingVersions() {
 }
 
 module.exports = {
-  PERCENT_GATE,
   suggestClose,
   getCloseSuggestionsForBuildingVersions,
 };

package/modules/memory/memory.js

@@ -568,5 +568,4 @@ module.exports = {
   assertBfgPath,
   isReservedNamespacePath,
   BFG_NAMESPACE_PREFIX,
-  BFG_KINDS,
 };

package/modules/memory/search-chunker.js

@@ -275,4 +275,4 @@ function chunkMarkdown({ path, content, maxTokens = DEFAULT_MAX_TOKENS, targetTo
   return { path: path || null, title, frontmatter: frontmatter || null, chunks };
 }
 
-module.exports = { chunkMarkdown, parseFrontMatter, estTokens, fileLabel, stripPrivate, sanitizeForText, PG_INVALID_TEXT_RE, DEFAULT_TARGET_TOKENS, DEFAULT_MAX_TOKENS };
+module.exports = { chunkMarkdown, parseFrontMatter, estTokens, stripPrivate, sanitizeForText };

package/modules/memory/search.js

@@ -581,8 +581,5 @@ module.exports = {
   RANK_LADDER,
   DEFAULT_LIMIT,
   MAX_LIMIT,
-  RRF_K,
   TRGM_THRESHOLD,
-  USEFULNESS_WEIGHT,
-  USEFULNESS_SCALE,
 };

package/modules/npm-release/preview/divert.js

@@ -102,4 +102,4 @@ function createDivert({ supervisor, forward, requireBuilder, requirePermission }
   };
 }
 
-module.exports = { createDivert, cookieVersion, clearCookie, setCookie, AUTH_PATH, PREVIEW_PATH };
+module.exports = { createDivert, cookieVersion, clearCookie, setCookie, AUTH_PATH };

package/modules/npm-release/preview/runtime.js

@@ -114,4 +114,4 @@ function createRuntime({ liveDb, log, env = process.env, instanceRoot = null } =
   return supervisor;
 }
 
-module.exports = { createRuntime, runCommand, probeHealth };
+module.exports = { createRuntime, probeHealth };

package/modules/onboarding/founding-builders.js

@@ -124,4 +124,4 @@ async function foundingBuildersFor(deps = {}) {
   }
 }
 
-module.exports = { stageAt, shapeFoundingBuilders, foundingBuildersFor, MAX_MARKS };
+module.exports = { stageAt, shapeFoundingBuilders, foundingBuildersFor };

package/modules/onboarding/founding-mode.js

@@ -204,6 +204,6 @@ async function setFoundingMode({ active, stage } = {}, builderId = null, deps =
 
 module.exports = {
   STAGES, WAKES, WAKES_WHEN_ALIVE, KEYS, stageAtKey,
-  parseActive, asleepRooms, dayOf, shapeFoundingMode, waitingOnFromGovernment,
+  dayOf, shapeFoundingMode, waitingOnFromGovernment,
   foundingModeFor, setFoundingMode,
 };

package/modules/onboarding/howto-guide.js

@@ -262,4 +262,4 @@ if (require.main === module) {
   }
 }
 
-module.exports = { MOMENTS, STEPS, MOMENT_IDS, stepById, stepsForMoment, nextUnread, formatStep, formatGuide };
+module.exports = { MOMENTS, STEPS, MOMENT_IDS, stepById, stepsForMoment, nextUnread, formatGuide };

package/modules/onboarding/howto-state.js

@@ -105,4 +105,4 @@ async function reset(builderId, { steps, all = false } = {}, deps = {}) {
   return { ok: true, state: await readState(builderId, deps) };
 }
 
-module.exports = { HOWS, checkSteps, shapeState, readState, markRead, reset };
+module.exports = { shapeState, readState, markRead, reset };

package/modules/onboarding/onboarding-state.js

@@ -495,12 +495,8 @@ module.exports = {
   GRADUATED,
   ALL_STAGES,
   PRE_AUTH_STEP,
-  SHIP_GRADUATION_TARGET,
-  STAGE_LABELS,
   STAGE_HINTS,
-  DISPLAY_STEPS,
   DISPLAY_LABELS,
-  DISPLAY_HINTS,
   isKnownStage,
   nextStage,
   hasCleared,

package/modules/onboarding/onboarding.js

@@ -489,20 +489,14 @@ function buildIdeaPayload({ sessionMeta = {}, analysis, signals = {} }) {
 
 module.exports = {
   ONBOARDING_FRICTION_TAG,
-  ONBOARDING_FRICTION_KIND,
   // parsing
   parseTranscript,
-  stripMachineNoise,
   // signals
   detectFrictionSignals,
-  LONG_RESPONSE_CHARS,
-  SIMILARITY_THRESHOLD,
   // subagent
   buildAnalysisPrompt,
-  compactTranscript,
   extractJson,
   validateAnalysis,
-  VALID_MOMENT_KINDS,
   // payload
   buildIdeaPayload,
 };

package/modules/page-notes/notes.js

@@ -236,7 +236,6 @@ module.exports = {
   wholeDocIdea,
   noteLink,
   SITE_SURFACE,
-  STUDIO_PATH,
   isSiteNote,
   siteListItem,
   ideaBody,

package/modules/platform-identity/community-leaderboard.js

@@ -231,5 +231,4 @@ module.exports = {
   MAX_LIMIT,
   MAX_OFFSET,
   MAX_DISCIPLINE_CHARS,
-  TOTALS_TTL_MS,
 };

package/modules/platform-identity/hub-keys.js

@@ -157,8 +157,6 @@ function mintHubApplicationVouch({ clientId, githubId, githubLogin, handle }, op
 }
 
 module.exports = {
-  ASSERTION_TTL_MS,
-  ISSUER,
   LOGOUT_PURPOSE,
   generateHubKeypair,
   loadHubSigningKey,

package/modules/platform-identity/instance-feedback.js

@@ -229,7 +229,6 @@ module.exports = {
   sha256Hex,
   projectOrigin,
   isHostedBy,
-  verifyDirectReport,
   fileDirectReport,
   FEEDBACK_KINDS,
   MESSAGE_MAX,

package/modules/platform-identity/read-rate-limit.js

@@ -65,4 +65,4 @@ function createReadRateLimit({ scope, limit, windowMs = 60 * 1000, maxTrackedIps
   return limiter;
 }
 
-module.exports = { createReadRateLimit, MAX_TRACKED_IPS };
+module.exports = { createReadRateLimit };

package/modules/platform-identity/visibility-pull.js

@@ -59,14 +59,6 @@ const { pool: defaultPool } = require('../../src/module-api');
 const { ORB_BY_STATE } = require('./projects-feed');
 const projectStats = require('./project-stats');
 
-// The manifest route every Cloud Bongos instance already serves, unauthenticated and
-// CORS-open (ADR 0114's discovery surface; `src/bongos/routes/instance.js`). Nothing is
-// added to it by this task — ADR 0252 §2.3: the field already ships in every core, so
-// there is no wire change on anyone else's upgrade schedule. The API router is
-// dual-mounted at `/api/bongos` (canonical) and at the permanent legacy alias ADR 0252
-// happened to write, so either prefix reaches it; the fetch uses the canonical one.
-const MANIFEST_ROUTE = '/api/bongos/instance';
-
 // Rows the PULL may write: the ones the ADR 0246 control-plane bridge has never claimed.
 // `IS DISTINCT FROM` rather than `<> `, deliberately — a NULL source is the unclaimed
 // state and plain inequality would drop exactly those rows on a NULL comparison.
@@ -190,7 +182,6 @@ async function sweepVisibilityOnce({ pool = defaultPool, limit = 200, fetchVisib
 }
 
 module.exports = {
-  MANIFEST_ROUTE,
   PULLABLE_SQL,
   visibilityFromManifest,
   pullDecision,

package/modules/provisioning/app-status.js

@@ -93,4 +93,4 @@ function retryAnswers(h) {
   return r;
 }
 
-module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE, SERVICE_ID_RE };
+module.exports = { appStatus, appUrl, serviceLinks, oneSentence, retryAnswers, STAGES, QUIET_AFTER_MS, RENDER_URL_RE };

package/modules/provisioning/catalog-bridge.js

@@ -161,7 +161,6 @@ async function healInstanceCatalog(db, row) {
 }
 
 module.exports = {
-  CATALOG_HIDDEN_STATES,
   catalogEntryForInstance,
   // the disconnect runner leg forgets exactly what a publish wrote (task 1003249)
   catalogOriginForInstance, ownerGithubIdForInstance,

package/modules/provisioning/core-upgrade.js

@@ -551,5 +551,5 @@ function makeUpdateChannelHandler({ provisioning, pool, parseId, validateOrRespo
   };
 }
 
-module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, CORE_UPGRADE_FROM, lastCoreMove, lastMoveSuperseded, parseRepoNote, preflightForOffer, UPGRADE_SHAPES, VERSION_RE, isCoreVersion, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
+module.exports = { loadPreview, UPDATE_CHANNELS, DEFAULT_UPDATE_CHANNEL, updateChannelOf, selfUpdateChannel, makeUpdateChannelHandler, lastCoreMove, lastMoveSuperseded, parseRepoNote, UPGRADE_SHAPES, VERSION_RE, coreUpgradeFault, enqueueCoreUpgrade, makeCoreUpgradeHandler, previewFromSnapshot, makeCoreUpgradePreviewHandler, makeControlPlaneHandler };
 

package/modules/provisioning/credential-preflight.js

@@ -167,4 +167,4 @@ async function adoptCredentialFault({ builderId, onboardMode, targetRef }, deps)
   return null;
 }
 
-module.exports = { adoptCredentialFault, parseTargetRef, readOwnerRepoToken, fetchRepoVisibility };
+module.exports = { adoptCredentialFault, parseTargetRef };

package/modules/provisioning/demo.js

@@ -171,6 +171,6 @@ async function sweepDemos(db, { enqueueTeardown, recordEvent, now = new Date() }
 }
 
 module.exports = {
-  DEMO_LIMITS, DEMO_OFFLINE_DAYS, DEMO_WARN_DAYS, DEMO_DETAIL, DEMO_SETTINGS, OUTCOMES,
-  parseDemo, fitCheck, withDemoDetail, demoRecord, demoView, startDemo, startDemoProject, settleDemo, sweepDemos,
+  DEMO_LIMITS, DEMO_SETTINGS, OUTCOMES,
+  parseDemo, fitCheck, withDemoDetail, demoRecord, demoView, startDemoProject, settleDemo, sweepDemos,
 };

package/modules/provisioning/look.js

@@ -165,5 +165,5 @@ module.exports = {
   upsertLogo, deleteLogo, readLogo,
   LIBRARY_LOOKS, LOOK_SETTINGS_VOCAB, LOOK_DEFAULTS, LOOK_COMPANION_ENV,
   lookChoice, lookAdjustAccent, lookAccentOf, logoUrlOf,
-  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, sniffLogo, logoFileName, LOGO_FILE,
+  LOGO_MAX_BYTES, LOGO_MIME, screenLogo, logoFileName, LOGO_FILE,
 };

package/modules/provisioning/routes/callback-page.js

@@ -190,4 +190,4 @@ function callbackPage({ ok, title, body, state, domain, next }) {
 </body></html>`;
 }
 
-module.exports = { esc, callbackPage, returnHref, RETURN_PATH };
+module.exports = { esc, callbackPage, returnHref };

package/modules/raise/raise.js

@@ -170,5 +170,5 @@ module.exports = {
   TOKENS, SETTING_KEYS, MAX_BLOCK, EDIT_MIN_RANK, TBA,
   defaultCopy, defaultSettings, ndaBody, ndaVersion, isEditableKey,
   esc, usd, kindOf, normalizeBlock, renderInline, renderBlock, renderContext, fill, cleanSetting,
-  hashPassword, passwordOk, validLinkedin, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
+  hashPassword, passwordOk, normalizeSignin, newSessionToken, hashToken, plainForDiscord,
 };

package/modules/render-deploy/deploys.js

@@ -197,7 +197,7 @@ async function saveApp(pool, { ownerId, serviceId, serviceName, builderId }) {
 }
 
 module.exports = {
-  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE, HISTORY_LIMIT,
+  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE,
   statusWords, taskIdsIn, previewOf, costOf, shapeHistory, readHistory, getApp, saveApp,
   ROLLBACK_STATUSES,
 };

package/modules/security/artifact-scan/aggregate.js

@@ -33,7 +33,6 @@ const TIER_CLAMP = Object.freeze({
 // A lens that did not finish cleanly contributes caution, never silence: an
 // errored/timed-out/budget-exhausted lens means its surface went UNREVIEWED.
 const LENS_OK = 'ok';
-const LENS_PROBLEM_STATUSES = Object.freeze(['error', 'timeout', 'budget_exhausted']);
 
 const rank = (v) => VERDICT_RANK[v] ?? VERDICT_RANK.dangerous; // unknown → worst
 const maxVerdict = (a, b) => (rank(a) >= rank(b) ? a : b);
@@ -123,11 +122,8 @@ function reduceVerdict({ floorReport = {}, lenses = [], tier = 'low', declaredDe
 
 module.exports = {
   VERDICTS,
-  TIER_CLAMP,
   LENS_OK,
-  LENS_PROBLEM_STATUSES,
   panelOutcome,
-  lensHealth,
   coverageCap,
   reduceVerdict,
 };

package/modules/security/artifact-scan/detectors/capabilities.js

@@ -50,4 +50,4 @@ function inventory(corpus) {
 
 // Constants exported as the white-box surface: the reducer/report stages and
 // tests read them to stay in lockstep with what the inventory actually covers.
-module.exports = { inventory, CAPABILITY_PATTERNS, SCRIPT_EXTENSIONS };
+module.exports = { inventory };

package/modules/security/artifact-scan/detectors/config-obfuscation.js

@@ -38,4 +38,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, isJsonConfig };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/credentials.js

@@ -114,4 +114,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, perFileHits, CREDENTIAL_PATTERNS };
+module.exports = { detect, perFileHits };

package/modules/security/artifact-scan/detectors/dependencies.js

@@ -112,4 +112,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, specSeverity, DEP_SECTIONS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/injection.js

@@ -115,4 +115,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, OVERRIDE_PHRASES, SCANNER_PHRASES, codepointClasses };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/network.js

@@ -64,4 +64,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, perFileHits, NETWORK_PATTERNS };
+module.exports = { detect, perFileHits };

package/modules/security/artifact-scan/detectors/npm-lifecycle.js

@@ -78,4 +78,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, AUTO_RUN_SCRIPTS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/permissions.js

@@ -88,4 +88,4 @@ function detect(corpus) {
   return findings;
 }
 
-module.exports = { detect, BYPASS_MARKERS };
+module.exports = { detect };

package/modules/security/artifact-scan/detectors/shared.js

@@ -202,14 +202,11 @@ function escapedConfigKeyCount(text) {
 }
 
 module.exports = {
-  EXCERPT_MAX_CHARS,
   SEVERITIES,
-  SENSITIVE_BASENAMES,
   isSensitivePath,
   basename,
   finding,
   excerpt,
-  sanitizeDetail,
   lineAt,
   parseJsonStrict,
   rawKeyCounts,

package/modules/security/artifact-scan/floor.js

@@ -359,12 +359,9 @@ async function runFloor({ pristineDir, quarantineRoot, entries, sha = null, cont
 
 module.exports = {
   FLOOR_VERSION,
-  REPORT_BASENAME,
   VERDICT_RANK,
   DETECTORS,
   buildCorpus,
-  computeFloorVerdict,
-  countBySeverity,
   coOccurrence,
   coverageFindings,
   dedupeFindings,

package/modules/security/artifact-scan/mirror.js

@@ -155,4 +155,4 @@ async function buildMirror({ pristineDir, mirrorDir, quarantineRoot, entries, ca
   return { mirrored, stubs, unreviewedBytes, fenceDelim, indexPath };
 }
 
-module.exports = { buildMirror, MIRROR_CAPS, INDEX_BASENAME };
+module.exports = { buildMirror, MIRROR_CAPS };

package/modules/security/artifact-scan/quarantine.js

@@ -254,7 +254,6 @@ function createQuarantine({ tmpRoot = os.tmpdir(), forbiddenRoots } = {}) {
 module.exports = {
   canonical,
   isInsideLexical,
-  canonicalUncached,
   clearCanonicalCache,
   CAPS,
   REPO_ROOT,

package/modules/security/artifact-scan/rebuild-spec.js

@@ -112,8 +112,6 @@ function assembleRebuildSpec({
 }
 
 module.exports = {
-  SPEC_LIMITS,
-  GROUND_RULES,
   isDocPath,
   selectDocFiles,
   assembleRebuildSpec,

package/modules/security/artifact-scan/report.js

@@ -152,4 +152,4 @@ function assembleReport({
   return out.join('\n');
 }
 
-module.exports = { assembleReport, findingLine };
+module.exports = { assembleReport };

package/modules/security/artifact-scan/sanitize.js

@@ -313,8 +313,6 @@ async function buildSanitizedCopy({ pristineDir, quarantineRoot, entries, remova
 }
 
 module.exports = {
-  SANITIZED_DIRNAME,
-  DIFF_BASENAME,
   hasMaliceIndicator,
   planSanitize,
   buildSanitizedCopy,

package/modules/security/secret-scrub.js

@@ -255,15 +255,11 @@ function scrubSecrets(text, extraSecrets = [], opts = undefined) {
 module.exports = {
   REDACTED,
   SECRET_PATTERNS,
-  SECRET_ASSIGNMENT_RE,
   shannonEntropy,
-  charClasses,
   looksHighEntropySecret,
-  ENTROPY_CANDIDATE_RE,
   redactHighEntropy,
   ENV_SECRET_KEY_RE,
   ENV_SECRET_PREFIX_RE,
-  ENV_BENIGN_KEY_RE,
   collectEnvSecrets,
   scrubSecrets,
 };

package/modules/security/security.js

@@ -283,8 +283,6 @@ async function linkVulnerabilityReportFix(id, fixTaskId) {
 module.exports = {
   SEVERITIES,
   VULN_STATUSES,
-  DEFAULT_BOUNTY,
-  SEVERITY_BLURB,
   envName,
   bountyTable,
   bountyTableDetailed,

package/modules/sessions/accessibility.js

@@ -356,7 +356,6 @@ module.exports = {
   scoreAccessibility,
   // Exported so the tests can pin the contracts (waivers, leniency, each
   // detector) without reconstructing a whole digest for every case.
-  resolveProfile,
   waiversFor,
   leniencyFor,
   assistantProse,
@@ -366,7 +365,6 @@ module.exports = {
   bandFor,
   SIGNAL_SPEC,
   JARGON_TERMS,
-  UI_BACKED_SUBJECTS,
   LOW_CONFIDENCE_CHARS,
   PROFILE_DEFAULTS,
   PROFILE_VALUES,

package/modules/sessions/bfg.js

@@ -346,12 +346,8 @@ module.exports = {
   buildAdoptionSuggestion,
   // 6C.2 correction builder
   buildCorrection,
-  TRANSFERABLE_TYPES,
-  PII_PATTERNS,
   // exported for tests + reuse
   parseFrontmatter,
-  stripFrontmatter,
   clamp01,
   QUALITY_WEIGHTS,
-  ALLOWED_MEMORY_TYPES,
 };

package/modules/sessions/upload-health.js

@@ -187,11 +187,8 @@ function uploadHealthVerdict(rows, opts = {}) {
 module.exports = {
   DEFAULT_WINDOW_HOURS,
   DEFAULT_LOOKBACK_DAYS,
-  DEFAULT_MIN_SHIPS,
-  DEFAULT_MAX_UNCOVERED_SHARE,
   clampLookbackDays,
   clampWindowHours,
   clampSampleLimit,
-  normalizeBuilderRows,
   uploadHealthVerdict,
 };

package/modules/specialities/db.js

@@ -278,5 +278,5 @@ module.exports = {
   createSpeciality, getSpeciality, listVisibleTo, updateSpeciality,
   addDocument, listDocuments, deleteDocument,
   linkLearning, countTraining,
-  adopt, abandon, deactivateCraft, activeForCraft, listAdoptions, setEnabledSkills,
+  adopt, abandon, activeForCraft, listAdoptions, setEnabledSkills,
 };

package/modules/specialities/specialities.js

@@ -303,4 +303,4 @@ function offeredTo(specialities, viewer, adoptions = []) {
   });
 }
 
-module.exports = { VISIBILITIES, LIMITS, SKILL_NAME_RE, slugify, validateDraft, skillListErrors, enabledSkillsErrors, canAdopt, describeForApi, offeredTo };
+module.exports = { VISIBILITIES, LIMITS, SKILL_NAME_RE, slugify, validateDraft, enabledSkillsErrors, canAdopt, describeForApi, offeredTo };

package/modules/ui-design/kit/lib.js

@@ -524,9 +524,9 @@ function packColors(pack) {
 }
 
 module.exports = {
-  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS, EXPECT_KEYS,
+  REPO_ROOT, KIT_DIR, STYLES_DIR, EXIT, FLOORS, SIZES, DEFAULT_SIZES, MODES, CHANNELS, SETTLE_MS, ACTIONS,
   argOf, hasFlag, listArg, pageName, normalizePageArg, resolveSurfaceDir, sidecarPath, readJson,
-  validateActions, runActions, validateExpect, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
+  runActions, factsInPage, expectProblems, auditFloors, reducedMotionProblems, craftTells,
   validateStatesFile, validateProbesFile, NoBrowserError, launchBrowser, attachCollectors, withMode,
   freePort, startStub, parseColor, composite, luminance, contrastRatio, instancePack, packColors,
   listStyles, resolveStyle, styleBrandingFile,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.22.1",
+  "version": "1.22.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.22.1",
+      "version": "1.22.2",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.22.1",
+  "version": "1.22.2",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10376,5 +10376,11 @@
       "id": "1004876",
       "text": "Builder-written text now goes through one safety filter in the browser and one on the server instead of 42 hand-made copies, six of which let a stray quote through — and a check stops a new copy from creeping back."
     }
+  ],
+  "1.22.2": [
+    {
+      "id": "1004891",
+      "text": "Cleaned up 220 internal code hooks nothing else used, cutting the project's dead-code count from 439 to 213."
+    }
   ]
 }

package/src/module-api.js

@@ -79,7 +79,7 @@ const { escapeHtml } = require('./html-escape');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.22.1'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.22.2'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/modules_external_export_contract.mjs

@@ -0,0 +1,48 @@
+// tests/modules_external_export_contract.mjs — modules/ exports whose callers no
+// code-file scan can see (task 1004891).
+//
+// Task 1004891 un-exported every modules/ export that no other code file names
+// (knip's finding, filtered by countKnipFindings in scripts/bongos/fitness-ratchets.js).
+// Six were deliberately KEPT, because their consumer is a document rather than code:
+//   - gatherInteractionSignals: the bfg scheduled task calls it by path
+//     (`node -e "require('./modules/sessions/bfg').gatherInteractionSignals(...)"`),
+//     so dropping it breaks that routine at run time with no test or scan noticing;
+//   - fieldCatalog, recordPulse, OWNERLESS_CATEGORIES, SOFT_CAP_FRACTION,
+//     CONTROL_PLANE_SHAPES: each module's CLAUDE.md names it as that module's API.
+// This file pins them, so the next dead-export sweep cannot quietly take them.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+
+test('bfg.gatherInteractionSignals stays exported: the bfg scheduled task calls it by path', () => {
+  const skill = read('.claude/scheduled-tasks/bfg/SKILL.md');
+  assert.match(skill, /require\('\.\/modules\/sessions\/bfg'\)/, 'the skill still requires bfg by path');
+  assert.match(skill, /\.gatherInteractionSignals\(/, 'the skill still calls gatherInteractionSignals');
+  const bfg = require(path.join(ROOT, 'modules/sessions/bfg.js'));
+  assert.equal(typeof bfg.gatherInteractionSignals, 'function');
+});
+
+const DOCUMENTED = [
+  ['modules/builder-settings/interaction-prefs.js', 'fieldCatalog', 'function'],
+  ['modules/sessions/pulse.js', 'recordPulse', 'function'],
+  ['modules/economy/cost-classify.js', 'OWNERLESS_CATEGORIES', 'object'],
+  ['modules/economy/cost-classify.js', 'SOFT_CAP_FRACTION', 'number'],
+  ['modules/provisioning/onboard-plan.js', 'CONTROL_PLANE_SHAPES', 'object'],
+];
+
+for (const [file, name, type] of DOCUMENTED) {
+  test(`${file} keeps exporting ${name}: its module CLAUDE.md names it as the module's API`, () => {
+    const doc = read(path.join(path.dirname(file), 'CLAUDE.md'));
+    assert.ok(doc.includes(name), `${name} is still documented in ${path.dirname(file)}/CLAUDE.md`);
+    const mod = require(path.join(ROOT, file));
+    assert.ok(name in mod, `${name} is exported from ${file}`);
+    assert.equal(typeof mod[name], type);
+  });
+}