@bongos/core 1.19.1080 → 1.19.1081

package/docs/api/openapi.json

@@ -14645,6 +14645,69 @@
         ]
       }
     },
+    "/provisioning/instances/{id}/render": {
+      "post": {
+        "operationId": "post_provisioning_instances_id_render",
+        "tags": [
+          "provisioning"
+        ],
+        "summary": "POST /provisioning/instances/:id/render",
+        "description": "POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER ONLY: the key is the owner's and so is the account it acts in, so an archon on someone else's project gets the same 404 as a stranger. The reply is a receipt; nothing has happened on Render when it is sent.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "modules/provisioning/routes/render-standup.js",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "description": "Path parameter `id`."
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostProvisioningInstancesIdRenderRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostProvisioningInstancesIdRenderResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/NotFound"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/provisioning/instances/{id}/repo-private": {
       "post": {
         "operationId": "post_provisioning_instances_id_repo_private",
@@ -26353,6 +26416,66 @@
           "expires_at"
         ]
       },
+      "PostProvisioningInstancesIdRenderRequest": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string",
+            "maxLength": 200
+          },
+          "owner_id": {
+            "type": "string",
+            "maxLength": 80
+          },
+          "mode": {
+            "type": "string",
+            "maxLength": 20
+          },
+          "service_id": {
+            "type": "string",
+            "maxLength": 80
+          },
+          "web_plan": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "db_plan": {
+            "type": "string",
+            "maxLength": 40
+          },
+          "region": {
+            "type": "string",
+            "maxLength": 40
+          }
+        },
+        "required": [
+          "key",
+          "owner_id",
+          "mode"
+        ],
+        "additionalProperties": false
+      },
+      "PostProvisioningInstancesIdRenderResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "queued": {
+            "type": "boolean"
+          },
+          "action": {},
+          "mode": {},
+          "message": {}
+        },
+        "required": [
+          "ok",
+          "queued",
+          "action",
+          "mode",
+          "message"
+        ]
+      },
       "PostProvisioningInstancesIdRepoPrivateResponse": {
         "type": "object",
         "properties": {
@@ -28072,9 +28195,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 439,
-  "x-schema-count": 471,
+  "x-endpoint-count": 440,
+  "x-schema-count": 473,
   "x-undocumented-bodies": 11,
-  "x-response-schemas": 322,
+  "x-response-schemas": 323,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 439 endpoints across 75 route files.
+> **Generated from the live route files** — the route file is authoritative. 440 endpoints across 76 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -538,7 +538,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | GET | `/api/bongos/projects/featured` | `public` | — | the public map of projects; no auth by design. |
 | POST | `/api/bongos/projects/invite` | `metic+archon` | `client_id`, `github_login` | own-or-metic in effect: invite a builder into a project (ADR 0141 §5, task 1002115), called by a `project.curate` holder OR the project's… |
 
-## `provisioning` (31)
+## `provisioning` (32)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -563,6 +563,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/provisioning/instances/:id/force-teardown` | `metic+archon` | — | POST /provisioning/instances/:id/force-teardown — Archon tears down ANY instance. |
 | POST | `/api/bongos/provisioning/instances/:id/github-app` | `any-builder` | `account` | POST /provisioning/instances/:id/github-app — mint a GitHub-App-Manifest onboarding link for the caller's OWN instance (task 2080, ADR 01… |
 | GET | `/api/bongos/provisioning/instances/:id/invite-suggestions` | `any-builder` | — | ── Who is worth inviting (BV1.R28, task 1002347, goal 1000046 C6) ──────── GET /provisioning/instances/:id/invite-suggestions — turn the … |
+| POST | `/api/bongos/provisioning/instances/:id/render` | `any-builder` | `key`, `owner_id`, `mode`, `service_id`, `web_plan`, `db_plan`, `region` | POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER ONLY: the key is the owner's and so is the account i… |
 | POST | `/api/bongos/provisioning/instances/:id/repo-private` | `any-builder` | validated | POST /provisioning/instances/:id/repo-private — rank: any authenticated builder, and OWNER ONLY: no archon override, because the runner f… |
 | POST | `/api/bongos/provisioning/instances/:id/restart` | `any-builder` | — | POST /provisioning/instances/:id/restart — restart an ACTIVE project the heartbeat cannot reach (task 1003238). |
 | GET | `/api/bongos/provisioning/instances/:id/settings` | `any-builder` | — | GET /provisioning/instances/:id/settings — read a project's effective settings + the allowed values (so a form can render its choices). |

package/docs/module-api-changelog.md

@@ -2651,5 +2651,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.1078 with no explicit bump. run 36602720244. (task 1002620)
   1.19.1080 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.1079 with no explicit bump. run 36638268217. (task 1002620)
+  1.19.1081 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.1080 with no explicit bump. run 36639564721. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/migrations/provisioning_028_render_standup.sql

@@ -0,0 +1,46 @@
+-- provisioning_028_render_standup.sql — the Render standup leg (task 1004183; ADR 0327, ADR 0345).
+--
+-- WHY THIS EXISTS. A project's owner lends the platform their Render API key once, so the
+-- runner can create their services on THEIR Render account. Nothing afterwards needs the
+-- key (ADR 0327 §2), so it is never stored — but it must still cross from the web tier,
+-- which receives it, to the runner, which spends it. It rides the intent that asks for the
+-- standup, encrypted with src/bongos/secret-box.js, and the runner clears it within the
+-- drain that claims the intent, whether the standup worked or not.
+--
+-- What the encryption buys, said plainly: it protects the key from a database dump or a
+-- nightly backup taken while the intent waits. It does NOT defend against a compromised web
+-- tier — the key arrives there in plaintext before anything can encrypt it.
+--
+-- WHAT IT ADDS.
+--   provisioning_intents.borrowed_key_enc — the encrypted key, only while the intent is
+--     open. The CHECK below is the backstop: a resolved intent CANNOT keep a key, so a
+--     resolution path that forgets to clear it fails loudly instead of leaving it behind.
+--   provisioning_instances.app_host — where the project's app runs and what the platform
+--     needs to know about it afterwards: {platform, mode, ownerId, serviceId, postgresId,
+--     serviceUrl, webPlan, dbPlan, region, state, error}. Ids, plans and a URL — never the
+--     key and never an env var value. One jsonb column rather than a column per field so
+--     a second platform is an added option (ADR 0345 D3), not a second schema change.
+--     publicInstance() is an allow-list and does not carry it.
+--   'render-standup' in the intents' action allow-list.
+--
+-- Additive and namespaced (ADR 0083): no down-migration, idempotent — safe to re-run.
+
+BEGIN;
+
+ALTER TABLE provisioning_intents ADD COLUMN IF NOT EXISTS borrowed_key_enc text;
+
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_borrowed_key_open_only;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_borrowed_key_open_only
+  CHECK (borrowed_key_enc IS NULL OR state IN ('pending', 'running'));
+
+ALTER TABLE provisioning_instances ADD COLUMN IF NOT EXISTS app_host jsonb;
+
+-- INTENT_ACTIONS in modules/provisioning/provisioning.js is the other spelling of this list;
+-- tests/provisioning_restart.mjs and tests/core_upgrade_door.mjs fail if the two disagree.
+ALTER TABLE provisioning_intents DROP CONSTRAINT IF EXISTS provisioning_intents_action_check;
+ALTER TABLE provisioning_intents ADD CONSTRAINT provisioning_intents_action_check
+  CHECK (action IN ('provision', 'teardown', 'oauth-manifest', 'domain-attach',
+                    'settings-apply', 'restart', 'disconnect', 'core-upgrade',
+                    'core-upgrade-preflight', 'repo-private', 'render-standup'));
+
+COMMIT;

package/modules/provisioning/module.json

@@ -18,7 +18,8 @@
       "disconnect",
       "core-upgrade",
       "env-manifest",
-      "repo-private"
+      "repo-private",
+      "render-standup"
     ],
     "migrations": true,
     "pollers": [

package/modules/provisioning/provisioning.js

@@ -59,7 +59,7 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
 // 'core-upgrade' (task 1003159, ADR 0293): move this instance's core pin — the owner's
 // deploy door. The web tier only QUEUES it; the control-plane runner performs it.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private'];
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private', 'render-standup'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1168,9 +1168,9 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 async function enqueueTeardown(db, instanceId, requestedBy) {
   const { rows: superseded } = await db.query(
     `UPDATE provisioning_intents
-        SET state = 'error', last_error = 'superseded: teardown requested',
+        SET state = 'error', last_error = 'superseded: teardown requested', borrowed_key_enc = NULL,
             updated_at = now(), resolved_at = now()
-      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
+      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup') AND state = 'pending'
         AND NOT EXISTS (SELECT 1 FROM provisioning_instances WHERE id = $1 AND hosting_shape = 'control-plane') RETURNING id`,
     [instanceId]
   );
@@ -1248,8 +1248,8 @@ async function claimNextIntent(db) {
 async function resolveIntent(db, id, state, lastError) {
   await db.query(
     `UPDATE provisioning_intents
-        SET state = $2, last_error = $3, updated_at = now(), resolved_at = now()
-      WHERE id = $1`,
+        SET state = $2, last_error = $3, borrowed_key_enc = NULL, updated_at = now(), resolved_at = now()
+      WHERE id = $1`, // a resolved intent never keeps a borrowed key (task 1004183; the table's CHECK is the backstop)
     [id, state, lastError ?? null]
   );
 }

package/modules/provisioning/render-standup.js

@@ -0,0 +1,91 @@
+// modules/provisioning/render-standup.js — the queue half of "set this project up on my
+// Render account" (task 1004183; ADR 0327, ADR 0345).
+//
+// The web tier never calls Render (ADR 0111 §2): it checks the SHAPE of what the owner
+// sent, encrypts their key, and queues a `render-standup` intent carrying it. The runner
+// leg, scripts/gds/provision-render.js, spends the key in one drain and clears it.
+//
+// What the encryption buys, said plainly: it protects the key from a database dump or a
+// nightly backup while the intent waits for the runner. It does NOT defend against a
+// compromised web tier — the key arrives here in plaintext before anything can encrypt
+// it. Nothing here stores the key anywhere else, logs it, or sends it back.
+//
+// Its own file because provisioning.js sits at the size ratchet.
+'use strict';
+
+// The plan and region vocabulary — shared with the runner's payload builder, which
+// requires it from here, so the web tier and the runner can never disagree on a name.
+const WEB_PLANS = ['starter', 'standard', 'pro', 'pro_plus', 'pro_max', 'pro_ultra'];
+const DB_PLANS = ['basic_256mb', 'basic_1gb', 'basic_4gb', 'pro_4gb', 'pro_8gb'];
+const REGIONS = ['virginia', 'ohio', 'oregon', 'frankfurt', 'singapore'];
+const MODES = ['adopt', 'greenfield'];
+
+// Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
+// one); services `srv-…`. Shape checks only — whether the key works, and whether it can
+// reach the workspace, is the runner's to find out, because only the runner calls Render.
+const KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
+const OWNER_RE = /^(tea|usr)-[a-z0-9]{8,64}$/;
+const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
+
+// The reason a request cannot be queued, in the owner's words, or null. `body` is the
+// validated request body.
+function badRequest(body) {
+  const b = body || {};
+  if (!KEY_RE.test(String(b.key || ''))) return 'That doesn’t look like a Render API key. It starts with “rnd_” — create one under Account Settings → API Keys in Render.';
+  if (!OWNER_RE.test(String(b.owner_id || ''))) return 'Choose the Render workspace to use. Its id starts with “tea-” or “usr-”.';
+  if (!MODES.includes(b.mode)) return 'Say whether to link a Render service you already have, or create a new one.';
+  if (b.mode === 'adopt' && !SERVICE_RE.test(String(b.service_id || ''))) return 'Choose the Render service to link. Its id starts with “srv-”.';
+  if (b.mode === 'greenfield' && b.service_id) return 'A new setup creates its own service, so leave the service out.';
+  if (b.web_plan != null && !WEB_PLANS.includes(b.web_plan)) return `“${b.web_plan}” is not a Render web plan.`;
+  if (b.db_plan != null && !DB_PLANS.includes(b.db_plan)) return `“${b.db_plan}” is not a Render database plan.`;
+  if (b.region != null && !REGIONS.includes(b.region)) return `“${b.region}” is not a Render region.`;
+  return null;
+}
+
+// What the row records about the request — ids and plans, never the key.
+function appHostFrom(body) {
+  const h = { platform: 'render', mode: body.mode, ownerId: body.owner_id, state: 'requested', error: null };
+  if (body.mode === 'adopt') h.serviceId = body.service_id;
+  if (body.web_plan) h.webPlan = body.web_plan;
+  if (body.db_plan) h.dbPlan = body.db_plan;
+  if (body.region) h.region = body.region;
+  return h;
+}
+
+// Queue the standup with the encrypted key, and record the request on the row, in ONE
+// statement: either both land or neither does. A re-request for the same workspace and
+// mode keeps the ids an earlier run recorded, so the runner resumes onto what already
+// exists; a different workspace or mode starts clean, because ids from another workspace
+// would only trip the runner's guard.
+//
+// The partial unique index ux_provisioning_intents_open is the arbiter: if anything is
+// already open for this project the insert collides and NOTHING is written — the key is
+// not stored and the row is not touched. Returns { intent } or { conflict: 'open_intent',
+// intent } with the blocking one.
+async function enqueueRenderStandup(db, instanceId, { keyEnc, appHost, requestedBy }) {
+  await require('./control-plane-guard').assertIntentAllowed(db, instanceId, 'render-standup');
+  try {
+    const { rows } = await db.query(
+      `WITH i AS (
+         INSERT INTO provisioning_intents (instance_id, action, requested_by, state, borrowed_key_enc)
+         VALUES ($1, 'render-standup', $2, 'pending', $3) RETURNING *
+       ), u AS (
+         UPDATE provisioning_instances
+            SET app_host = CASE WHEN app_host->>'ownerId' = $5 AND app_host->>'mode' = $6 THEN app_host ELSE '{}'::jsonb END || $4::jsonb
+          WHERE id = $1 RETURNING id
+       )
+       SELECT i.id, i.instance_id, i.action, i.state, i.created_at FROM i`,
+      [instanceId, requestedBy ?? null, keyEnc, JSON.stringify(appHost), appHost.ownerId, appHost.mode]);
+    return { intent: rows[0] };
+  } catch (e) {
+    if (e && e.code === '23505') {
+      const { rows } = await db.query(
+        `SELECT id, action, state FROM provisioning_intents
+          WHERE instance_id = $1 AND state IN ('pending', 'running') ORDER BY created_at DESC LIMIT 1`, [instanceId]);
+      return { conflict: 'open_intent', intent: rows[0] || { action: 'unknown', state: 'open' } };
+    }
+    throw e;
+  }
+}
+
+module.exports = { WEB_PLANS, DB_PLANS, REGIONS, MODES, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/provisioning/routes/render-standup.js

@@ -0,0 +1,90 @@
+// modules/provisioning/routes/render-standup.js — POST /provisioning/instances/:id/render
+// (task 1004183; ADR 0327, ADR 0345).
+//
+// The owner lends their Render API key once, names the workspace, and says whether to link
+// a service they already run (adopt) or create a new one (greenfield). This route checks
+// the shape, encrypts the key with the secret box, and queues a `render-standup` intent;
+// the runner (scripts/gds/provision-render.js) spends the key in one drain and clears it.
+// This process never calls Render (ADR 0111 §2).
+//
+// What the encryption buys, said plainly: protection from a database dump or a backup
+// while the intent waits. Not from a compromised web tier — the key is in plaintext here
+// before it is encrypted. The key is never logged, never stored anywhere else, and never
+// sent back.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/repo-private.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const renderStandup = require('../render-standup');
+const { failFrom } = require('../public-refusal');
+
+const log = api.logger('provisioning');
+
+// What the runner leg would refuse about the PROJECT, answered here so the owner hears it
+// before lending a key. The runner keeps its own checks.
+function unavailableReason(inst, mode) {
+  if (inst.status === 'torn_down' || inst.status === 'tearing_down') return 'This project has been removed, so it can’t be set up on Render.';
+  if (mode === 'greenfield' && !inst.target_ref) return 'This project has no GitHub repository linked, so Render has nothing to build.';
+  return null;
+}
+
+module.exports = function buildRenderStandupRouter() {
+  const router = express.Router();
+
+  // POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
+  // ONLY: the key is the owner's and so is the account it acts in, so an archon on
+  // someone else's project gets the same 404 as a stranger. The reply is a receipt;
+  // nothing has happened on Render when it is sent.
+  router.post('/provisioning/instances/:id/render', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      owner_id: { required: true, type: 'string', maxLength: 80 },
+      mode: { required: true, type: 'string', maxLength: 20 },
+      service_id: { type: 'string', maxLength: 80 },
+      web_plan: { type: 'string', maxLength: 40 },
+      db_plan: { type: 'string', maxLength: 40 },
+      region: { type: 'string', maxLength: 40 },
+    })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) return res.fail('instance_not_found', 404);
+      const bad = renderStandup.badRequest(req.body);
+      if (bad) return res.fail('render_request_invalid', { status: 400, message: bad });
+      const why = unavailableReason(inst, req.body.mode);
+      if (why) return res.fail('render_unavailable', { status: 409, message: why, details: { status: inst.status } });
+      if (!api.secretBox.isConfigured()) {
+        return res.fail('render_unavailable', { status: 503, message: 'The platform can’t take a key safely right now, so nothing was sent. Try again later.' });
+      }
+      const appHost = renderStandup.appHostFrom(req.body);
+      const r = await renderStandup.enqueueRenderStandup(pool, id, {
+        keyEnc: api.secretBox.encrypt(req.body.key), appHost, requestedBy: 'api:self',
+      });
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is ${r.intent.state} for this project, so your key was not kept. Try again once it has finished.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      await provisioning.recordEvent(pool, {
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'render-standup',
+        detail: `Render ${appHost.mode === 'adopt' ? 'link' : 'setup'} requested by owner (workspace ${appHost.ownerId})`, actor: 'api:self',
+      }).catch(() => {});
+      res.json({ ok: true, queued: true, action: 'render-standup', mode: appHost.mode,
+        message: appHost.mode === 'adopt'
+          ? 'Queued. The platform will check the service in your Render account and link it, without changing anything there. Your key is used once and then thrown away.'
+          : 'Queued. The platform will create your database and web service in your Render account. Your key is used once and then thrown away; Render bills you directly.' });
+    } catch (err) {
+      // Never log the request: it carries the key.
+      log.error('[provisioning] POST /provisioning/instances/:id/render', err && err.message);
+      failFrom(res, err, 'render_standup_failed');
+    }
+  });
+
+  return router;
+};

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1080",
+  "version": "1.19.1081",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.1080",
+      "version": "1.19.1081",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.1080",
+  "version": "1.19.1081",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -7873,5 +7873,15 @@
       "id": "1003786",
       "text": "Installed modules can now be updated with one command. Paid and free modules update the exact same way, you are never charged twice, and a failed update leaves your working version in place."
     }
+  ],
+  "1.19.1081": [
+    {
+      "id": "1004183",
+      "text": "Bongos can now set a project up on its owner's own Render account. The owner lends their Render key once; it is used for that one run and then erased, and it can never act in a workspace the owner did not name. Linking an exis"
+    },
+    {
+      "id": "1004364",
+      "text": "Every module in the store will now come with a how-to guide. Publishing is refused without one, and an AI gives each guide a Docs score that buyers can see next to the module's other scores."
+    }
   ]
 }