@bongos/core 1.19.1080 → 1.19.1081

package/scripts/gds/provision-render.js

@@ -0,0 +1,158 @@
+'use strict';
+// provision-render.js — the Render standup leg: the runner half of the `render-standup`
+// intent (task 1004183; ADR 0327, ADR 0345). Its own file because provision.js sits at
+// the size ratchet; the dispatch there requires it inline.
+//
+// WHAT IT DOES. Stands a project up on its OWNER's Render account, with a key the owner
+// lent for this one run:
+//   - ADOPT links a Render service the owner already runs. It reads that service through
+//     the workspace guard and records it. It makes NO write call to their account.
+//   - GREENFIELD creates the Postgres and the web service (render-payload.js decides what
+//     they are), sets the env vars that need the service's URL, and asks for a deploy.
+// Ids are written to the row as each resource is created, so an owner who re-enters their
+// key after a failure resumes onto what already exists instead of creating a second one.
+//
+// THE KEY IS BORROWED, NEVER STORED (ADR 0327 §2). It reaches this leg encrypted on the
+// intent (provisioning_intents.borrowed_key_enc). It is decrypted here, used for this run
+// only, and the column is cleared in a `finally` — on success, on a refusal and on a
+// throw. resolveIntent clears it again, and the table's CHECK refuses a resolved intent
+// that still holds one. What the encryption buys, said plainly: it protects the key from
+// a database dump or a nightly backup while the intent waits. It does NOT defend against
+// a compromised web tier — the key arrives there in plaintext before anything can
+// encrypt it.
+//
+// A FAILURE IS TERMINAL. Every failure returns `terminal: true`, so the runner retires the
+// intent instead of re-queuing it. There is no key left to retry with, and an unattended
+// retry holding someone else's cloud credential is not a thing this platform does: the
+// owner retries by entering their key again.
+//
+// Every Render call goes through scripts/gds/render-api.js, which pins the workspace and
+// asserts it on every response, and which cannot delete.
+
+const { RenderApi } = require('./render-api.js');
+const payload = require('./render-payload.js');
+const { parseTargetRef } = require('./provision-repo-auth.js');
+const { provisionedEnvPrefix } = require('./provision-units.js');
+
+// A key waiting longer than this was lent for a run that never came. It is refused and
+// cleared rather than spent late.
+const KEY_TTL_MS = 30 * 60 * 1000;
+
+function renderApiFor(deps, token, ownerId) {
+  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
+  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
+}
+
+// Merge `patch` into the row's app_host. The runner is the only writer while an intent
+// runs, and the web tier only writes it when enqueuing, which the open-intent index
+// serialises — so a merge needs no read-modify-write.
+async function recordAppHost(db, instId, patch) {
+  await db.query(
+    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
+    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
+}
+
+async function clearBorrowedKey(db, intentId) {
+  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
+}
+
+async function ownerLoginOf(db, inst) {
+  if (!inst.owner_builder_id) return null;
+  const { rows } = await db.query(`SELECT github_login FROM builders WHERE id = $1`, [inst.owner_builder_id]);
+  return (rows[0] && rows[0].github_login) || null;
+}
+
+async function adopt(api, inst, host, { db, log }) {
+  if (!host.serviceId) throw new Error('adopting needs the id of the Render service to link');
+  const svc = await api.getService(host.serviceId);
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+  await recordAppHost(db, inst.id, { state: 'linked', serviceUrl: url, error: null });
+  log(`  [render] linked ${inst.slug} to service ${svc.id}${url ? ` (${url})` : ''} — nothing created or changed on Render`);
+  return { ok: true };
+}
+
+async function greenfield(api, inst, host, deps) {
+  const { db, log } = deps;
+  const plans = payload.plansFor(host);
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) throw new Error('the project has no GitHub repository for Render to build from');
+  const envPrefix = deps.envPrefix || provisionedEnvPrefix();
+
+  // 1. The database — reused if a previous run got this far.
+  let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
+  if (!pg) {
+    pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
+    await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
+    log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
+  }
+  await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
+  const conn = await api.postgresConnectionInfo(pg.id);
+  const dbUrl = conn && conn.internalConnectionString;
+  if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
+
+  // 2. The web service — reused likewise.
+  let svc = host.serviceId ? await api.getService(host.serviceId) : null;
+  if (!svc) {
+    const firstAdmin = (await ownerLoginOf(db, inst)) || repo.owner;
+    const created = await api.createService(payload.renderServicePayload(inst, {
+      ownerId: api.ownerId, repoUrl: `https://github.com/${repo.owner}/${repo.name}`, branch: host.branch,
+      webPlan: plans.webPlan, region: plans.region, dbUrl, secretKey: payload.freshSecretKey(), envPrefix, firstAdmin,
+    }));
+    svc = created.service;
+    await recordAppHost(db, inst.id, { serviceId: svc.id, webPlan: plans.webPlan, region: plans.region, state: 'creating' });
+    log(`  [render] created web service ${svc.id} (${plans.webPlan})`);
+  }
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+
+  // 3. What needs the URL, then one deploy that picks it all up.
+  for (const { key, value } of payload.renderAfterCreateEnv(url, { envPrefix })) await api.putEnvVar(svc.id, key, value);
+  await api.triggerDeploy(svc.id);
+  await recordAppHost(db, inst.id, { state: 'deploying', serviceUrl: url, error: null });
+  log(`  [render] ${inst.slug} is deploying at ${url}`);
+  return { ok: true };
+}
+
+async function renderStandupInstance(inst, deps, intent) {
+  const { db, log } = deps;
+  const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
+  const host = inst.app_host || {};
+  try {
+    if (!intent || !intent.borrowed_key_enc) return refuse('no Render key came with this request — enter it again to retry');
+    if (host.platform !== 'render') return refuse(`this project's app is not set to run on Render (platform '${host.platform || 'none'}')`);
+    if (!host.ownerId) return refuse('no Render workspace was chosen');
+    const age = Date.now() - new Date(intent.created_at || 0).getTime();
+    if (!(age < KEY_TTL_MS)) return refuse('the Render key waited too long to be used and was cleared — enter it again to retry');
+    if (host.mode !== 'adopt' && host.mode !== 'greenfield') return refuse(`unknown Render setup mode '${host.mode}'`);
+
+    const api = renderApiFor(deps, secretBox.decrypt(intent.borrowed_key_enc), host.ownerId);
+    // Membership, never selection: the workspace is the one the owner named, and it must
+    // be one this key can act in.
+    const owners = await api.listOwners();
+    if (!owners.some((o) => o.id === host.ownerId)) return refuse(`this Render key cannot reach workspace ${host.ownerId}`);
+
+    return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
+  } catch (e) {
+    return refuse(e && e.message ? e.message : String(e));
+  } finally {
+    if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
+  }
+
+  async function refuse(error) {
+    await recordAppHost(db, inst.id, { state: 'failed', error }).catch(() => {});
+    log(`  ✖ [render] ${inst.slug}: ${error}`);
+    return { ok: false, terminal: true, error };
+  }
+}
+
+// Teardown's half (ADR 0327 §3): forget the Render app, never delete it. The ids stay on
+// the row so an operator can still say which services were the project's; the owner
+// deletes them in their own Render dashboard if they want to stop paying.
+async function forgetRenderApp(inst, { db, log, apply }) {
+  const host = inst.app_host;
+  if (!host || host.platform !== 'render') return;
+  const what = [host.serviceId && `service ${host.serviceId}`, host.postgresId && `database ${host.postgresId}`].filter(Boolean).join(' and ') || 'nothing yet';
+  log(`  [render] ${apply ? 'disconnected' : 'would disconnect'} from Render (${what}); nothing on Render is deleted — the owner removes it in their own dashboard`);
+  if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
+}
+
+module.exports = { renderStandupInstance, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };

package/scripts/gds/provision-teardown.js

@@ -42,6 +42,8 @@ async function teardownInstance(inst, deps) {
     await deps.doApi.deleteDroplet(inst.droplet_id);
   }
   parkAddress(inst, { controlExec, log, apply });
+  // The app's Render services are the OWNER's: forget them, never delete them (ADR 0327 §3, task 1004183).
+  await require('./provision-render.js').forgetRenderApp(inst, { db, log, apply });
   // Revoke the instance's deploy key (ADR 0176) and remove its local halves. The
   // checkout itself is deliberately left in place (data is precious), so the key
   // files must NOT ride along — and a revoke skip must be LOUD: a torn-down project

package/scripts/gds/provision.js

@@ -1293,10 +1293,10 @@ async function cmdRunIntents(deps) {
       else if (intent.action === 'disconnect') result = await disconnectInstance(inst, deps);
       else if (intent.action === 'core-upgrade') result = await coreUpgradeInstance(inst, deps, intent); // also reads the INTENT: the version the owner previewed (ADR 0293 D4)
       else if (intent.action === 'core-upgrade-preflight') result = await preflightCoreUpgrade(inst, deps, intent); // changes nothing; caches what the move WOULD say (task 1004121)
-      else if (intent.action === 'repo-private') result = await require('./provision-repo-private.js').repoPrivateInstance(inst, deps); // wire the deploy key, THEN flip (task 1004193); required here — this file is at the size ratchet
+      else if (intent.action === 'repo-private' || intent.action === 'render-standup') result = intent.action === 'repo-private' ? await require('./provision-repo-private.js').repoPrivateInstance(inst, deps) : await require('./provision-render.js').renderStandupInstance(inst, deps, intent); // wire the deploy key, THEN flip (task 1004193) · spend the borrowed Render key once (task 1004183); required here — this file is at the size ratchet
       else result = { ok: false, error: `unknown_action '${intent.action}' — runner core ${coreVersionSafe() || '?'} does not know it (runner too old?); refusing to guess` };
       if (result && result.ok === false) {
-        if (intent.attempts >= MAX_INTENT_ATTEMPTS) {
+        if (intent.attempts >= MAX_INTENT_ATTEMPTS || result.terminal) { // terminal: a leg that must not be retried unattended (the Render leg's key is already gone — task 1004183)
           await provisioning.resolveIntent(db, intent.id, 'error', result.error || 'op failed');
           // A retired intent stops silently otherwise (F19): record the reason
           // on the instance WITHOUT changing its lifecycle status — passing the

package/scripts/gds/render-api.js

@@ -0,0 +1,178 @@
+// scripts/gds/render-api.js — a thin Render API v1 client for the control plane, with
+// the workspace (ownerId) guard (task 1004183; ADR 0327).
+//
+// Control-plane code, like its model scripts/gds/do-api.js: only the provisioning runner
+// uses it, never the web tier (ADR 0111 §2). Same skeleton (JsonHttpApi): injectable
+// transport, dry-run by default, and live mode refuses to start without a token.
+//
+// THE GUARD. A Render API key belongs to a USER, not a workspace, and carries that user's
+// rights in every workspace they belong to — measured 2026-09-22: one owner's key reached
+// three workspaces, one of them another builder's, holding live production services. So:
+//
+//   - the client is built for ONE workspace (`ownerId`) and refuses to exist without it —
+//     never defaulted, and never derived by taking the first of GET /owners;
+//   - every call that names an owner sends this one;
+//   - every response that carries an owner is ASSERTED to carry this one, and a missing
+//     or different owner is a hard error (RenderOwnerMismatch). Assert on the response,
+//     not the request: a request you got right says nothing about a response that came
+//     from somewhere else. A list is checked element by element.
+//
+// Render's own shapes decide where the owner sits: a service carries `ownerId`, a
+// Postgres carries `owner.id` (both measured by the pilot, task 1004142). A few calls
+// answer with no owner at all (a database's connection-info, an env-var PUT, a deploy
+// trigger). Those are only reachable through a method that first reads the parent
+// resource through the guard, so nothing is ever sent to or read from a resource whose
+// workspace was not checked.
+//
+// NO DELETE. The platform must not hold the ability to destroy infrastructure in an
+// account it does not own (ADR 0327 §3). There is no delete method, and _req refuses the
+// verb outright, so adding one later is a visible change to this file, not a one-liner.
+
+'use strict';
+
+const { JsonHttpApi, makeApiError } = require('./http-api-client');
+
+const RENDER_API_BASE = 'https://api.render.com/v1';
+
+const RenderApiError = makeApiError('RenderApiError', 'RENDER_API_ERROR');
+const RenderOwnerMismatch = makeApiError('RenderOwnerMismatch', 'RENDER_OWNER_MISMATCH');
+
+// The owner id a Render resource carries, in either of the two shapes Render uses.
+// null when it carries none.
+function ownerOf(resource) {
+  if (!resource || typeof resource !== 'object') return null;
+  if (typeof resource.ownerId === 'string' && resource.ownerId) return resource.ownerId;
+  if (resource.owner && typeof resource.owner.id === 'string' && resource.owner.id) return resource.owner.id;
+  return null;
+}
+
+// Env var values are the owner's secrets on their way to Render. A dry-run log is the one
+// place this client would otherwise print a request body, so it prints the names only.
+function redact(body) {
+  if (!body || typeof body !== 'object') return body;
+  const out = { ...body };
+  if (Array.isArray(out.envVars)) out.envVars = out.envVars.map((v) => ({ key: v && v.key, value: '[redacted]' }));
+  if ('value' in out) out.value = '[redacted]';
+  return out;
+}
+
+class RenderApi extends JsonHttpApi {
+  // opts: { token, ownerId, dryRun=true, fetchImpl=globalThis.fetch, base, log }
+  constructor(opts = {}) {
+    super(opts, { base: RENDER_API_BASE, logTag: 'Render', ErrorClass: RenderApiError });
+    if (typeof opts.ownerId !== 'string' || !opts.ownerId.trim()) {
+      throw new RenderApiError('a Render client needs the workspace it acts in (ownerId) — it is never defaulted');
+    }
+    this.ownerId = opts.ownerId.trim();
+    if (!this.dryRun && !this.token) {
+      throw new RenderApiError('live Render call requested with no API key');
+    }
+    if (!this.dryRun && typeof this.fetchImpl !== 'function') {
+      throw new RenderApiError('no fetch implementation available for live mode');
+    }
+  }
+
+  async _req(method, path, body, opts = {}) {
+    if (method === 'DELETE') throw new RenderApiError(`refusing ${method} ${path}: the platform never deletes in an account it does not own (ADR 0327 §3)`);
+    if (this.dryRun) {
+      this.log(`[dry-run] Render ${method} ${path}${body ? ' ' + JSON.stringify(redact(body)) : ''}`);
+      return { dryRun: true, ...(opts.dryRunResult || {}) };
+    }
+    return super._req(method, path, body, opts);
+  }
+
+  // Throws unless `resource` carries exactly this client's workspace.
+  assertOwned(resource, what) {
+    const got = ownerOf(resource);
+    if (got !== this.ownerId) {
+      throw new RenderOwnerMismatch(
+        got
+          ? `Render answered ${what} from workspace ${got}, not ${this.ownerId} — refusing to go on`
+          : `Render answered ${what} with no workspace on it — refusing to go on`,
+        { body: null });
+    }
+    return resource;
+  }
+
+  // ---- workspaces ------------------------------------------------------------
+
+  // The workspaces the key can reach, as [{ id, name, type }]. Used for MEMBERSHIP only —
+  // "is the workspace the owner named one this key can act in" — never to pick one.
+  async listOwners() {
+    const json = await this._req('GET', '/owners?limit=100', null, {
+      dryRunResult: { items: [{ owner: { id: this.ownerId, name: '(dry-run)', type: 'team' } }] },
+    });
+    const items = Array.isArray(json) ? json : (json && json.items) || [];
+    return items.map((e) => (e && e.owner) || e).filter((o) => o && typeof o.id === 'string');
+  }
+
+  // ---- services --------------------------------------------------------------
+
+  async getService(serviceId) {
+    const json = await this._req('GET', `/services/${encodeURIComponent(serviceId)}`, null, {
+      dryRunResult: { id: serviceId, ownerId: this.ownerId, serviceDetails: { url: null } },
+    });
+    return this.assertOwned(json && json.service ? json.service : json, `service ${serviceId}`);
+  }
+
+  // payload: the POST /services body (render-payload.js). Its ownerId must be ours — the
+  // payload builder takes it as an argument, so this is checked, not overwritten.
+  async createService(payload) {
+    if (!payload || payload.ownerId !== this.ownerId) throw new RenderApiError('a service payload must name this client\'s workspace');
+    const json = await this._req('POST', '/services', payload, {
+      dryRunResult: { deployId: null, service: { id: `dryrun-srv-${payload.name}`, ownerId: this.ownerId, serviceDetails: { url: null } } },
+    });
+    return { deployId: (json && json.deployId) || null, service: this.assertOwned(json && json.service, 'the new service') };
+  }
+
+  // Set one env var on a service this workspace owns. The PUT answers with no owner, so
+  // the service is read through the guard first.
+  async putEnvVar(serviceId, key, value) {
+    await this.getService(serviceId);
+    return this._req('PUT', `/services/${encodeURIComponent(serviceId)}/env-vars/${encodeURIComponent(key)}`, { value }, { dryRunResult: { key } });
+  }
+
+  async triggerDeploy(serviceId) {
+    await this.getService(serviceId);
+    return this._req('POST', `/services/${encodeURIComponent(serviceId)}/deploys`, {}, { dryRunResult: { id: null } });
+  }
+
+  // ---- Postgres --------------------------------------------------------------
+
+  async createPostgres(payload) {
+    if (!payload || payload.ownerId !== this.ownerId) throw new RenderApiError('a Postgres payload must name this client\'s workspace');
+    const json = await this._req('POST', '/postgres', payload, {
+      dryRunResult: { id: `dryrun-pg-${payload.name}`, status: 'creating', owner: { id: this.ownerId } },
+    });
+    return this.assertOwned(json, 'the new database');
+  }
+
+  async getPostgres(postgresId) {
+    const json = await this._req('GET', `/postgres/${encodeURIComponent(postgresId)}`, null, {
+      dryRunResult: { id: postgresId, status: 'available', owner: { id: this.ownerId } },
+    });
+    return this.assertOwned(json, `database ${postgresId}`);
+  }
+
+  // The database's connection strings. The answer carries no owner, so the database is
+  // read through the guard first.
+  async postgresConnectionInfo(postgresId) {
+    await this.getPostgres(postgresId);
+    return this._req('GET', `/postgres/${encodeURIComponent(postgresId)}/connection-info`, null, {
+      dryRunResult: { internalConnectionString: 'postgres://dry-run' },
+    });
+  }
+
+  // Poll until a new database is 'available'. `sleepFn` lets tests drive it with no clock.
+  async settlePostgres(postgresId, { tries = 60, sleepMs = 5000, sleepFn } = {}) {
+    const sleep = sleepFn || ((ms) => new Promise((r) => setTimeout(r, ms)));
+    for (let i = 0; i < tries; i++) {
+      const pg = await this.getPostgres(postgresId);
+      if (pg.status === 'available') return pg;
+      await sleep(sleepMs);
+    }
+    throw new RenderApiError(`database ${postgresId} did not become available in time`);
+  }
+}
+
+module.exports = { RenderApi, RenderApiError, RenderOwnerMismatch, RENDER_API_BASE, ownerOf, redact };

package/scripts/gds/render-payload.js

@@ -0,0 +1,110 @@
+// scripts/gds/render-payload.js — WHAT the Render standup leg creates, kept apart from
+// HOW it creates it (scripts/gds/provision-render.js) (task 1004183).
+//
+// Pure functions, no I/O. They are separate so the thing being stood up can change
+// without touching the guard or the key plumbing: this file builds the Bongos instance
+// the Render pilot proved (task 1004142, docs/recipes/render-pilot.md §4 and its
+// "Corrections" box), and task 1004350 retargets it at the project's own app, per
+// ADR 0345 (we host the hall; the owner's app is what goes to their Render account).
+//
+// The plans are per-instance settings (ADR 0327 §5), never constants. The defaults are
+// what the pilot measured as enough for a new instance at idle: a `starter` web service
+// (48-62 MiB of 512) and a paid `basic_256mb` Postgres, because Render's free Postgres
+// has no backups of any kind.
+
+'use strict';
+
+const crypto = require('node:crypto');
+
+// The vocabulary lives with the web tier's validation, so the two can never disagree.
+const { WEB_PLANS, DB_PLANS, REGIONS } = require('../../modules/provisioning/render-standup.js');
+const DEFAULTS = Object.freeze({ webPlan: 'starter', dbPlan: 'basic_256mb', region: 'virginia' });
+
+// A Render resource name from the project's slug. Render allows letters, digits and
+// dashes; the slug already is that, this only makes sure.
+function resourceName(inst, suffix) {
+  const base = String(inst.slug || `project-${inst.id}`).toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 50);
+  return suffix ? `${base}-${suffix}` : base;
+}
+
+// The plan and region an instance asked for, with the defaults filled in. A value outside
+// the vocabulary is refused rather than passed through for Render to reject.
+function plansFor(appHost) {
+  const h = appHost || {};
+  const out = {
+    webPlan: h.webPlan || DEFAULTS.webPlan,
+    dbPlan: h.dbPlan || DEFAULTS.dbPlan,
+    region: h.region || DEFAULTS.region,
+  };
+  if (!WEB_PLANS.includes(out.webPlan)) throw new Error(`unknown Render web plan '${out.webPlan}'`);
+  if (!DB_PLANS.includes(out.dbPlan)) throw new Error(`unknown Render database plan '${out.dbPlan}'`);
+  if (!REGIONS.includes(out.region)) throw new Error(`unknown Render region '${out.region}'`);
+  return out;
+}
+
+// POST /postgres. `plan` is never 'free' — see the header.
+function renderPostgresPayload(inst, { ownerId, dbPlan, region }) {
+  return { name: resourceName(inst, 'db'), ownerId, plan: dbPlan, region, version: '16' };
+}
+
+// POST /services, for a Bongos instance from its repository. `dbUrl` is the database's
+// internal connection string; `secretKey` is a fresh BUILDER_SECRET_KEY. Both are VALUES
+// sent to Render and held there — the platform keeps neither.
+//
+// What each non-obvious line is for, from the pilot's corrections:
+//   - runtime + startCommand are explicit: a hybrid repo defaults to Python on Render, and
+//     an adopted instance has no `npm start`;
+//   - HOST=0.0.0.0: the server binds 127.0.0.1 otherwise and Render's router never reaches it;
+//   - PGDATABASE = the URL: migrate.sh addresses the database as `psql -d "$PGDATABASE"`;
+//   - BUILDER_SECRET_KEY: Render's disk is wiped each deploy, so the key-file fallback
+//     would mint a new key every time and orphan every stored per-builder secret;
+//   - no PORT: Render injects it.
+// Bongos reads DATABASE_URL first (src/bongos/pool.js), so none of the PG* family the box
+// writes is needed — the one simplification Render buys.
+function renderServicePayload(inst, { ownerId, repoUrl, branch, webPlan, region, dbUrl, secretKey, envPrefix, firstAdmin }) {
+  const envVars = [
+    { key: 'NODE_VERSION', value: '22' },
+    { key: 'HOST', value: '0.0.0.0' },
+    { key: 'DATABASE_URL', value: dbUrl },
+    { key: 'PGDATABASE', value: dbUrl },
+    { key: 'PGPOOL_MAX', value: '5' },
+    { key: 'BUILDER_SECRET_KEY', value: secretKey },
+  ];
+  if (firstAdmin) envVars.push({ key: `${envPrefix}_FIRST_ADMIN`, value: firstAdmin });
+  return {
+    type: 'web_service',
+    name: resourceName(inst),
+    ownerId,
+    repo: repoUrl,
+    branch: branch || 'main',
+    autoDeploy: 'yes',
+    serviceDetails: {
+      runtime: 'node',
+      plan: webPlan,
+      region,
+      healthCheckPath: '/healthz',
+      envSpecificDetails: {
+        buildCommand: 'npm ci',
+        startCommand: 'node node_modules/@bongos/core/src/platform-server.js',
+        preDeployCommand: 'bash node_modules/@bongos/core/scripts/migrate.sh',
+      },
+    },
+    envVars,
+  };
+}
+
+// The env vars that can only be set once the service exists, because they name the URL
+// Render gave it. The four origins must all be that one host: a single-host instance has
+// no separate builders./status. subdomain, and without them the hall never loads.
+function renderAfterCreateEnv(serviceUrl, { envPrefix }) {
+  const origin = String(serviceUrl || '').replace(/\/+$/, '');
+  if (!/^https:\/\//.test(origin)) throw new Error(`Render gave the service no https URL (${serviceUrl || 'none'})`);
+  return ['PUBLIC', 'BUILDERS', 'STATUS', 'OAUTH'].map((k) => ({ key: `${envPrefix}_${k}_ORIGIN`, value: origin }));
+}
+
+function freshSecretKey() { return crypto.randomBytes(32).toString('hex'); }
+
+module.exports = {
+  WEB_PLANS, DB_PLANS, REGIONS, DEFAULTS,
+  resourceName, plansFor, renderPostgresPayload, renderServicePayload, renderAfterCreateEnv, freshSecretKey,
+};

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.19.1080'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1081'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');