@bongos/core 1.24.59 → 1.24.60

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.59",
-  "core_contract": "1.24.59",
-  "source_commit": "a6ac4e31607a82978349eba6f0d2c113bdc48345",
+  "core_version": "1.24.60",
+  "core_contract": "1.24.60",
+  "source_commit": "fef925d217da9148be0808c73ee46288043dc2de",
   "source_ref": "HEAD",
-  "built_at": "2026-11-07T15:21:01.170Z",
+  "built_at": "2026-11-07T15:39:07.882Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 638,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 4571,
-  "tree_sha256": "0d58836fc7200aa61d37a68fc94e1fef65ba9556f5afb9e9c7105fcc474f0d4b",
+  "tree_sha256": "02fb38f9111b66794f346c5bb82422a3f315f456b1c9d73a5b3eb1c136097fc1",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -3007,7 +3007,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "b68ba24d900494bac49e77694a228c04794d1c0b5a43c4733159ee5429cbec4f"
+      "sha256": "71913622d0d94c4120e620d5aea32ff476a6e879c5e166da3144eedc75619dda"
     },
     {
       "path": "docs/modules-contract.md",
@@ -11902,12 +11902,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "38c4ec31d6cb51fd92185003e550832f29d0e44f18f3a2df2b7d3594bdca972e"
+      "sha256": "dfea60d54c9a25b94f32d02e56aecb552db65f0a68d3ca9470db04acbd8b3fd3"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "0a9fbd43bcf2caa7e6c2b6faeef134a0dc96d7c5f1ee29519edf5d48ffb78db9"
+      "sha256": "fe9083b4b86df7ab6427311717f99a1bba6d8c7e079e2f37c32b4722a3bc4186"
     },
     {
       "path": "public-docs/index.html",
@@ -11927,7 +11927,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "9735ab47bbd28140534686e37156442e586d1a7c5abce86f23ab0d546c9da0a7"
+      "sha256": "2735b7f5e5d4c0bf2b24fc78d79738c5b57a9eaf4734823a79e67ea8e0fb39b2"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12267,7 +12267,7 @@
     {
       "path": "scripts/bongos/css-literal-scan.js",
       "mode": "0000644",
-      "sha256": "8da46806402a840192f29f93d98afd6b5018715f6fd4ce6fbe060e23ffc977de"
+      "sha256": "1dbcdb46cfd195c1080bdd37bc8337b0926cd5f6e281cd131656801f6c92b236"
     },
     {
       "path": "scripts/bongos/cutover-codemod.js",
@@ -15877,7 +15877,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "06c54ea826895a4de9a90970d7b72e6479fada3880d45e1c1f164f29e7c319c5"
+      "sha256": "66eed53ac99b04f6c4c0b5e33b13b44c2b1d53239198bf8b41fe13a454d866d9"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17412,7 +17412,7 @@
     {
       "path": "tests/design_counts_ratchet.mjs",
       "mode": "0000644",
-      "sha256": "2fd9ecdc86bb0a9b2392db350568eb4776a27b3d3bd43e896686475707a61a85"
+      "sha256": "3e7457685c915d01d11ba4dd1481e726f82c83a3ce481f5190893e4b0636b7bc"
     },
     {
       "path": "tests/design_reference.mjs",

package/docs/module-api-changelog.md

@@ -3372,5 +3372,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.57 with no explicit bump. run 42380593295. (task 1002620)
   1.24.59 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.58 with no explicit bump. run 42385816081. (task 1002620)
+  1.24.60 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.59 with no explicit bump. run 42387285187. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.59",
+  "version": "1.24.60",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.59",
+      "version": "1.24.60",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.59",
+  "version": "1.24.60",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11329,5 +11329,11 @@
       "id": "1005133",
       "text": "The logo files and the link-preview pictures are now checked automatically, so a logo change can no longer ship with out-of-date copies; the docs now say plainly that the off-site status page is updated by hand."
     }
+  ],
+  "1.24.60": [
+    {
+      "id": "1005134",
+      "text": "The automatic check that stops pages from typing in their own colours and sizes now also catches colours given a custom name and styles written directly inside a page, so those shortcuts can no longer slip new colours past it."
+    }
   ]
 }

package/scripts/bongos/css-literal-scan.js

@@ -21,16 +21,28 @@
 //                 tokens; the count stops the set of breakpoints sprawling).
 // Sizes, radii, shadows and breakpoints are counted per DECLARATION / RULE.
 //
-// WHAT IT DOES NOT COUNT. A custom-property declaration (`--x: #123`) is a token
-// DEFINITION — tokens.css and the hall's token block are exactly where literals
-// belong — so its value is skipped. Page-private palettes are guarded separately
-// (tests/hall_private_palettes.mjs). Custom-property NAMES are removed from a
-// value before it is read (so --ds-space-12 is not a "12"), and url(...) bodies
-// are emptied (a data URI is not a colour). A literal inside a var() fallback
-// DOES count: a fallback is a typed-in value.
+// CUSTOM PROPERTIES (task 1005134). A colour typed into a custom-property
+// declaration (`:root{--mine:#123456}`, `body{--x:rgb(…)}`) COUNTS as a colour,
+// so a new sheet cannot dodge its zero start by naming its colours. Only the
+// shared token definitions are exempt, because they are exactly where literals
+// belong: the whole of the shared token sheet and the hall's token block (its
+// :root and the two byte-identical dark twins) — TOKEN_SHEETS. The pack splice
+// (serve-internal.js themeMarkup) is built in JavaScript at serve time and is
+// never scanned. A custom property's sizes/radii/shadows are not counted — those
+// kinds are read off the property that SPENDS a value, and a --x is not one.
+// Page-private palettes are also guarded by tests/hall_private_palettes.mjs.
+//
+// WHAT IT DOES NOT COUNT. Custom-property NAMES are removed from a value before
+// it is read (so --ds-space-12 is not a "12"), and url(...) bodies are emptied (a
+// data URI is not a colour). A literal inside a var() fallback DOES count: a
+// fallback is a typed-in value.
 //
 // Scope: every tracked *.css outside docs/ (the design mocks there are not
-// served), node_modules and vendor/.
+// served), node_modules and vendor/; the inline <style> blocks of every served
+// .html (one under a public/, public-docs/, views/ or content/ folder); and the
+// <style> blocks a server file writes as a string (STYLE_STRING_SOURCES: the
+// branded error page). Task 1005134: a page could otherwise type its colours into
+// a <style> tag and never be counted.
 //
 // Print the counts:  node scripts/bongos/css-literal-scan.js [--all]
 
@@ -42,6 +54,18 @@ const ROOT = path.resolve(__dirname, '..', '..');
 const KINDS = ['colours', 'font_sizes', 'radii', 'shadows', 'breakpoints'];
 
 const EXCLUDE_RE = /^docs\/|(^|\/)(node_modules|vendor)\//;
+// A served page: an .html under a folder the server serves or renders from.
+const SERVED_HTML_RE = /(^|\/)(public|public-docs|views|content)\/.*\.html$/;
+// Server files that write a page's <style> block as a string.
+const STYLE_STRING_SOURCES = ['src/error-page.js'];
+const STYLE_BLOCK_RE = /<style\b[^>]*>([\s\S]*?)<\/style>/gi;
+// The shared token definitions, where a typed-in colour belongs: `true` exempts
+// every custom property in the sheet; a RegExp exempts those in a rule whose
+// selector matches it (the hall's token block: :root and the two dark twins).
+const TOKEN_SHEETS = {
+  'modules/ui-design/public/tokens.css': true,
+  'modules/hall-ui/public/style.css': /^(?::root|html\[data-theme="dark"\]|html:not\(\[data-theme\]\))$/,
+};
 const COMMENT_RE = /\/\*[\s\S]*?\*\//g;
 const URL_RE = /url\(\s*(?:"[^"]*"|'[^']*'|[^)]*)\)/gi;
 const VAR_NAME_RE = /--[\w-]+/g;
@@ -84,17 +108,43 @@ function hasLength(value) {
   return false;
 }
 
-/** The five counts for one stylesheet's text. */
-function countSheet(text) {
+// The selector of the innermost rule around a position, read by walking the text
+// forward (positions must be asked in increasing order). '' at the top level.
+function selectorWalker(css) {
+  const stack = [];
+  let pos = 0;
+  let segStart = 0;
+  return (idx) => {
+    for (; pos < idx; pos += 1) {
+      const ch = css[pos];
+      if (ch === '{') { stack.push(css.slice(segStart, pos).replace(/\s+/g, ' ').trim()); segStart = pos + 1; }
+      else if (ch === '}') { stack.pop(); segStart = pos + 1; }
+      else if (ch === ';') segStart = pos + 1;
+    }
+    return stack.length ? stack[stack.length - 1] : '';
+  };
+}
+
+/**
+ * The five counts for one stylesheet's text. `tokens` marks the shared token
+ * definitions: true (the whole sheet) or a RegExp over a rule's selector.
+ */
+function countSheet(text, { tokens = false } = {}) {
   const counts = Object.fromEntries(KINDS.map((k) => [k, 0]));
   const css = String(text).replace(COMMENT_RE, ' ').replace(URL_RE, 'url()');
   AT_RULE_RE.lastIndex = 0;
   let m;
   while ((m = AT_RULE_RE.exec(css))) if (MEDIA_LENGTH_RE.test(m[2])) counts.breakpoints += 1;
+  const selectorAt = selectorWalker(css);
   DECL_RE.lastIndex = 0;
   while ((m = DECL_RE.exec(css))) {
     const prop = m[1].toLowerCase();
-    if (prop.startsWith('--')) continue; // a token definition
+    if (prop.startsWith('--')) {
+      // A custom property: its colours count unless it is a shared token definition.
+      const exempt = tokens === true || (tokens instanceof RegExp && tokens.test(selectorAt(m.index + m[0].indexOf(m[1]))));
+      if (!exempt) counts.colours += colourCount(m[2].replace(VAR_NAME_RE, ' '));
+      continue;
+    }
     const value = m[2].replace(VAR_NAME_RE, ' ');
     counts.colours += colourCount(value);
     if ((prop === 'font-size' || prop === 'font') && hasLength(value)) counts.font_sizes += 1;
@@ -106,8 +156,16 @@ function countSheet(text) {
 }
 
 function trackedStylesheets(root = ROOT) {
-  const out = execFileSync('git', ['ls-files', '-z', '--', '*.css'], { cwd: root, encoding: 'utf8' });
-  return out.split('\0').filter((f) => f && !EXCLUDE_RE.test(f)).sort();
+  const out = execFileSync('git', ['ls-files', '-z', '--', '*.css', '*.html', ...STYLE_STRING_SOURCES], { cwd: root, encoding: 'utf8' });
+  return out.split('\0').filter((f) => f && !EXCLUDE_RE.test(f)
+    && (f.endsWith('.css') || SERVED_HTML_RE.test(f) || STYLE_STRING_SOURCES.includes(f))).sort();
+}
+
+// The CSS a file carries: a stylesheet is all CSS; a page or a server file
+// carries only what sits inside its <style> blocks.
+function cssOf(file, text) {
+  if (file.endsWith('.css')) return text;
+  return [...String(text).matchAll(STYLE_BLOCK_RE)].map((b) => b[1]).join('\n');
 }
 
 /**
@@ -123,7 +181,7 @@ function scanCssLiterals({ root = ROOT, files = null, read = null } = {}) {
     let text;
     try { text = reader(f); } catch { continue; }
     scanned += 1;
-    const c = countSheet(text);
+    const c = countSheet(cssOf(f, text), { tokens: TOKEN_SHEETS[f] || false });
     if (KINDS.some((k) => c[k] > 0)) sheets[f] = c;
   }
   return { sheets, scanned };

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.59'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.60'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/design_counts_ratchet.mjs

@@ -28,7 +28,7 @@ const readReal = (f) => fs.readFileSync(path.join(ROOT, f), 'utf8');
 
 test('the detector counts typed-in values and leaves tokens alone', () => {
   const c = scan.countSheet(`
-    :root { --ds-x: 14px; --tone: #123456; }            /* token definitions: not counted */
+    :root { --ds-x: 14px; --tone: #123456; }            /* a token sheet's definitions: not counted */
     .a { font-size: 13px; border-radius: 6px; color: #abc; }
     .b { font-size: var(--ds-text-sm); border-radius: var(--ds-radius-tile); color: var(--ink); }
     .c { box-shadow: 0 2px 4px rgba(0, 0, 0, .2); }      /* a shadow; the black scrim is allowed */
@@ -36,7 +36,7 @@ test('the detector counts typed-in values and leaves tokens alone', () => {
     .e { background: color-mix(in srgb, var(--ink) 40%, rgb(12 34 56)); padding: 0; }
     @media (max-width: 720px) { .f { border-radius: 0; } }
     @media (prefers-reduced-motion: reduce) { .g { transition: none; } }
-  `);
+  `, { tokens: true });
   assert.deepEqual(c, { colours: 2, font_sizes: 1, radii: 1, shadows: 1, breakpoints: 1 });
 });
 
@@ -170,3 +170,60 @@ test('the freshness gate covers the logo set: mark.svg, the pack and both PNGs',
     fs.rmSync(dir, { recursive: true, force: true });
   }
 });
+
+// task 1005134: two loopholes closed. (1) A sheet that names its colours as custom
+// properties used to count zero, so a new sheet could bypass its zero start; now
+// only the shared token definitions are exempt. (2) A page's inline <style> and the
+// error page's CSS string were never scanned; now they are, with baselines.
+const HALL_TOKENS = /^(?::root|html\[data-theme="dark"\]|html:not\(\[data-theme\]\))$/;
+
+test('a colour typed into a custom property counts, outside the shared token definitions', () => {
+  assert.equal(scan.countSheet(':root { --mine: #123456; }').colours, 1, ':root{--mine:#123456}');
+  assert.equal(scan.countSheet('body { --x: rgb(10, 20, 30); --y: hsl(1 2% 3%); }').colours, 2, 'body{--x:rgb(...)}');
+  assert.equal(scan.countSheet('.v { --veil: rgba(0, 0, 0, .4); --tone: var(--ink); }').colours, 0, 'a scrim and a reference are not typed-in colours');
+  assert.equal(scan.countSheet(':root { --mine: #123456; } .x { --y: #654321; }', { tokens: true }).colours, 0, 'the shared token sheet is exempt');
+  const hall = ':root { --a: #111111; } html[data-theme="dark"] { --a: #222222; } '
+    + '@media (prefers-color-scheme: dark) { html:not([data-theme]) { --a: #222222; } } '
+    + '.brand { --mark-ink: #333333; } @media (max-width: 1px) { .y { --z: #444444; } }';
+  assert.equal(scan.countSheet(hall, { tokens: HALL_TOKENS }).colours, 2, 'the hall token block is exempt; its other rules are not');
+});
+
+test('a NEW sheet that names its colours as custom properties fails fitness', () => {
+  const NEW = 'modules/x/public/new.css';
+  const { sheets } = scan.scanCssLiterals({ files: [NEW], read: () => ':root { --mine: #123456; } body { --x: rgb(1, 2, 3); }' });
+  const d = ratchets.compareDesignCounts(sheets, { _comment: 'note' });
+  assert.ok(d.violations.some((v) => v.includes(`colours in ${NEW} regressed: 2 > baseline 0`)), d.violations.join('\n'));
+  // …while a definition planted in the shared token sheet, or the hall's :root, stays exempt.
+  const planted = scan.scanCssLiterals({
+    read: (f) => readReal(f) + (f === 'modules/ui-design/public/tokens.css' || f === HALL_SHEET ? '\n:root { --mine: #123456; }\n' : ''),
+  });
+  assert.deepEqual(ratchets.checkQualityRatchets({ metrics: {}, designCounts: planted.sheets }).violations, []);
+  const leak = scan.scanCssLiterals({ read: (f) => readReal(f) + (f === HALL_SHEET ? '\n.planted { --mine: #123456; }\n' : '') });
+  const r = ratchets.checkQualityRatchets({ metrics: {}, designCounts: leak.sheets });
+  assert.ok(r.violations.some((v) => v.includes(`colours in ${HALL_SHEET} regressed`)), r.violations.join('\n'));
+});
+
+test('inline <style> blocks in served pages and the error page CSS are scanned', () => {
+  const PAGE = 'modules/public-landing/public/terms.html';
+  const ERR = 'src/error-page.js';
+  const { sheets } = scan.scanCssLiterals();
+  assert.ok(sheets[ERR], `${ERR} is scanned`);
+  assert.ok(sheets[PAGE], `${PAGE} is scanned`);
+  assert.ok(!Object.keys(sheets).some((f) => /\/styles\/[^/]+\/mock\.html$|\/specimens\/.*\.html$/.test(f)), 'unserved mocks and specimens are not');
+  assert.equal(scan.countSheet('').colours, 0);
+  const planted = scan.scanCssLiterals({
+    read: (f) => {
+      const t = readReal(f);
+      if (f === PAGE || f === ERR) return t.replace('</style>', '.planted { color: #123456; font-size: 13px; }\n</style>');
+      return t;
+    },
+  });
+  const r = ratchets.checkQualityRatchets({ metrics: {}, designCounts: planted.sheets });
+  for (const f of [PAGE, ERR]) {
+    assert.ok(r.violations.some((v) => v.includes(`colours in ${f} regressed`)), `${f} colours: ${r.violations.join('\n')}`);
+    assert.ok(r.violations.some((v) => v.includes(`font_sizes in ${f} regressed`)), `${f} sizes: ${r.violations.join('\n')}`);
+  }
+  // Text outside a <style> block is not CSS: a hex in a page's prose is not counted.
+  const prose = scan.scanCssLiterals({ read: (f) => readReal(f) + (f === PAGE ? '\n<p>color: #123456;</p>\n' : '') });
+  assert.deepEqual(prose.sheets[PAGE], sheets[PAGE]);
+});