@bongos/core 1.19.1080 → 1.20.1

package/modules/provisioning/provisioning.js

@@ -59,7 +59,7 @@ const PROJECT_TYPES = ['game', 'research', 'business', 'non-profit', 'not-sure']
 // 'disconnect' (task 1003249, migration provisioning_016): the owner's true delete — ./disconnect.js.
 // 'core-upgrade' (task 1003159, ADR 0293): move this instance's core pin — the owner's
 // deploy door. The web tier only QUEUES it; the control-plane runner performs it.
-const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private'];
+const INTENT_ACTIONS = ['provision', 'teardown', 'oauth-manifest', 'domain-attach', 'settings-apply', 'restart', 'disconnect', 'core-upgrade', 'core-upgrade-preflight', 'repo-private', 'render-standup'];
 // Every state a teardown can be asked for — i.e. everything except the one
 // state where there is provably nothing left to release. DERIVED from
 // INSTANCE_STATES on purpose (task 1003042, walk finding N5): the old hand-kept
@@ -1168,9 +1168,9 @@ async function enqueueIntent(db, instanceId, action, requestedBy, targetVersion
 async function enqueueTeardown(db, instanceId, requestedBy) {
   const { rows: superseded } = await db.query(
     `UPDATE provisioning_intents
-        SET state = 'error', last_error = 'superseded: teardown requested',
+        SET state = 'error', last_error = 'superseded: teardown requested', borrowed_key_enc = NULL,
             updated_at = now(), resolved_at = now()
-      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private') AND state = 'pending'
+      WHERE instance_id = $1 AND action IN ('provision', 'settings-apply', 'restart', 'repo-private', 'render-standup') AND state = 'pending'
         AND NOT EXISTS (SELECT 1 FROM provisioning_instances WHERE id = $1 AND hosting_shape = 'control-plane') RETURNING id`,
     [instanceId]
   );
@@ -1248,8 +1248,8 @@ async function claimNextIntent(db) {
 async function resolveIntent(db, id, state, lastError) {
   await db.query(
     `UPDATE provisioning_intents
-        SET state = $2, last_error = $3, updated_at = now(), resolved_at = now()
-      WHERE id = $1`,
+        SET state = $2, last_error = $3, borrowed_key_enc = NULL, updated_at = now(), resolved_at = now()
+      WHERE id = $1`, // a resolved intent never keeps a borrowed key (task 1004183; the table's CHECK is the backstop)
     [id, state, lastError ?? null]
   );
 }

package/modules/provisioning/render-lookup.js

@@ -0,0 +1,68 @@
+// modules/provisioning/render-lookup.js — the ONE Render call the web tier may make: a
+// read-only look at what an owner's key can see (task 1004352; ADR 0348).
+//
+// The setup wizard has to tell the owner at once when a key is refused, and has to make
+// them choose among the workspaces the key reaches (a Render key belongs to a USER and
+// reaches every workspace that user is in — ADR 0327). Only a call to Render can answer
+// either, and the owner is still on the page. So ADR 0348 makes one narrow exception to
+// ADR 0111 §2 ("the web tier never calls a cloud API"), and this file is all of it:
+//
+//   - GET only — two calls, the workspace list and the services in ONE named workspace.
+//     Nothing here can create, change or delete anything, and there is no way to ask it to.
+//   - the key is the owner's own, held in memory for this one request; it is never
+//     stored, logged or returned, and it is not encrypted here because it is not kept.
+//   - every service in the answer is asserted to carry the workspace asked about — the
+//     same guard the runner's client applies (scripts/gds/render-api.js). A module may
+//     not require that file (ADR 0083), so this carries its own two GETs rather than a
+//     second client.
+//
+// `fetchImpl` is injectable so tests never touch the network.
+'use strict';
+
+const RENDER_API = 'https://api.render.com/v1';
+const TIMEOUT_MS = 10_000;
+
+class RenderLookupError extends Error {
+  constructor(code, message) { super(message); this.code = code; }
+}
+
+async function get(path, key, fetchImpl) {
+  let res;
+  try {
+    res = await fetchImpl(`${RENDER_API}${path}`, {
+      method: 'GET',
+      headers: { Authorization: `Bearer ${key}`, Accept: 'application/json' },
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    });
+  } catch (_) {
+    throw new RenderLookupError('render_unreachable', 'Render didn’t answer. Try again in a moment.');
+  }
+  if (res.status === 401 || res.status === 403) {
+    throw new RenderLookupError('render_key_refused', 'Render refused that key. Check you copied all of it, and that it hasn’t been deleted.');
+  }
+  if (!res.ok) throw new RenderLookupError('render_unreachable', `Render answered ${res.status}. Try again in a moment.`);
+  try { return await res.json(); } catch (_) { throw new RenderLookupError('render_unreachable', 'Render sent an answer we couldn’t read.'); }
+}
+
+const unwrap = (json, field) => (Array.isArray(json) ? json : []).map((e) => (e && e[field]) || e).filter((o) => o && typeof o.id === 'string');
+
+// What the key can see: every workspace, and — when `ownerId` names one of them — the
+// web services in it. Throws RenderLookupError with a code the route maps to a reply.
+async function lookupRender(key, { ownerId = null, fetchImpl = globalThis.fetch } = {}) {
+  const workspaces = unwrap(await get('/owners?limit=100', key, fetchImpl), 'owner')
+    .map((o) => ({ id: o.id, name: String(o.name || o.email || o.id), type: o.type === 'user' ? 'user' : 'team' }));
+  if (!ownerId) return { workspaces };
+  if (!workspaces.some((w) => w.id === ownerId)) {
+    throw new RenderLookupError('render_workspace_unreachable', 'That key can’t reach the workspace you chose.');
+  }
+  const services = unwrap(await get(`/services?ownerId=${encodeURIComponent(ownerId)}&type=web_service&limit=100`, key, fetchImpl), 'service')
+    .map((s) => {
+      if (s.ownerId !== ownerId) {
+        throw new RenderLookupError('render_owner_mismatch', 'Render answered with a service from another workspace, so nothing was shown.');
+      }
+      return { id: s.id, name: String(s.name || s.id), repo: s.repo || null, url: (s.serviceDetails && s.serviceDetails.url) || null };
+    });
+  return { workspaces, services };
+}
+
+module.exports = { lookupRender, RenderLookupError, RENDER_API };

package/modules/provisioning/render-standup.js

@@ -0,0 +1,134 @@
+// modules/provisioning/render-standup.js — the queue half of "set this project up on my
+// Render account" (task 1004183; ADR 0327, ADR 0345).
+//
+// The web tier never calls Render (ADR 0111 §2): it checks the SHAPE of what the owner
+// sent, encrypts their key, and queues a `render-standup` intent carrying it. The runner
+// leg, scripts/gds/provision-render.js, spends the key in one drain and clears it.
+//
+// What the encryption buys, said plainly: it protects the key from a database dump or a
+// nightly backup while the intent waits for the runner. It does NOT defend against a
+// compromised web tier — the key arrives here in plaintext before anything can encrypt
+// it. Nothing here stores the key anywhere else, logs it, or sends it back.
+//
+// A PROJECT STILL BEING SET UP. The wizard sends the key right after Create, while the
+// project's own `provision` run holds the one open-intent slot. Rather than refuse, the key
+// rides THAT run (task 1004352): the runner sets the app up on Render straight after the
+// project is up, in the same drain, and clears the key either way
+// (scripts/gds/provision-render.js afterProvision).
+//
+// Its own file because provisioning.js sits at the size ratchet.
+'use strict';
+
+// The plan and region vocabulary — shared with the runner's payload builder, which
+// requires it from here, so the web tier and the runner can never disagree on a name.
+const WEB_PLANS = ['starter', 'standard', 'pro', 'pro_plus', 'pro_max', 'pro_ultra'];
+const DB_PLANS = ['basic_256mb', 'basic_1gb', 'basic_4gb', 'pro_4gb', 'pro_8gb'];
+const REGIONS = ['virginia', 'ohio', 'oregon', 'frankfurt', 'singapore'];
+const MODES = ['adopt', 'greenfield'];
+// How the owner's app is built (task 1004350): a native runtime with their commands, or
+// `docker`, which builds the repository's own Dockerfile.
+const RUNTIMES = ['node', 'python', 'ruby', 'go', 'rust', 'elixir', 'docker'];
+
+// Render API keys start `rnd_`; workspaces are `tea-…` (a team) or `usr-…` (a personal
+// one); services `srv-…`. Shape checks only — whether the key works, and whether it can
+// reach the workspace, is the runner's to find out, because only the runner calls Render.
+const KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
+const OWNER_RE = /^(tea|usr)-[a-z0-9]{8,64}$/;
+const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
+
+// The reason a request cannot be queued, in the owner's words, or null. `body` is the
+// validated request body.
+function badRequest(body) {
+  const b = body || {};
+  if (!KEY_RE.test(String(b.key || ''))) return 'That doesn’t look like a Render API key. It starts with “rnd_” — create one under Account Settings → API Keys in Render.';
+  if (!OWNER_RE.test(String(b.owner_id || ''))) return 'Choose the Render workspace to use. Its id starts with “tea-” or “usr-”.';
+  if (!MODES.includes(b.mode)) return 'Say whether to link a Render service you already have, or create a new one.';
+  if (b.mode === 'adopt' && !SERVICE_RE.test(String(b.service_id || ''))) return 'Choose the Render service to link. Its id starts with “srv-”.';
+  if (b.mode === 'greenfield' && b.service_id) return 'A new setup creates its own service, so leave the service out.';
+  if (b.mode === 'adopt' && (b.runtime != null || b.build_command != null || b.start_command != null || b.database != null)) return 'Linking keeps your Render service exactly as it is, so leave out how it is built.';
+  if (b.mode === 'greenfield') {
+    if (!RUNTIMES.includes(b.runtime)) return 'Say what your app is built with — for example Node or Python, or Docker to use your repository’s Dockerfile.';
+    if (b.runtime === 'docker' && (b.build_command || b.start_command)) return 'Docker builds and starts your app from your Dockerfile, so leave the commands out.';
+    if (b.runtime !== 'docker' && !String(b.start_command || '').trim()) return 'Say how your app starts — the command Render should run, for example “npm start”.';
+  }
+  if (b.web_plan != null && !WEB_PLANS.includes(b.web_plan)) return `“${b.web_plan}” is not a Render web plan.`;
+  if (b.db_plan != null && !DB_PLANS.includes(b.db_plan)) return `“${b.db_plan}” is not a Render database plan.`;
+  if (b.region != null && !REGIONS.includes(b.region)) return `“${b.region}” is not a Render region.`;
+  if (b.db_plan != null && b.database !== true) return 'A database plan needs a database — ask for one, or leave the plan out.';
+  return null;
+}
+
+// What the row records about the request — ids and plans, never the key.
+function appHostFrom(body) {
+  const h = { platform: 'render', mode: body.mode, ownerId: body.owner_id, state: 'requested', error: null };
+  if (body.mode === 'adopt') h.serviceId = body.service_id;
+  if (body.mode === 'greenfield') {
+    h.runtime = body.runtime;
+    if (body.runtime !== 'docker') { h.startCommand = body.start_command.trim(); if (body.build_command) h.buildCommand = body.build_command.trim(); }
+    h.database = body.database === true;
+  }
+  if (body.web_plan) h.webPlan = body.web_plan;
+  if (body.db_plan) h.dbPlan = body.db_plan;
+  if (body.region) h.region = body.region;
+  return h;
+}
+
+// Queue the standup with the encrypted key, and record the request on the row, in ONE
+// statement: either both land or neither does. A re-request for the same workspace and
+// mode keeps the ids an earlier run recorded, so the runner resumes onto what already
+// exists; a different workspace or mode starts clean, because ids from another workspace
+// would only trip the runner's guard.
+//
+// The partial unique index ux_provisioning_intents_open is the arbiter: if anything is
+// already open for this project the insert collides and NOTHING is written — the key is
+// not stored and the row is not touched. Returns { intent } or { conflict: 'open_intent',
+// intent } with the blocking one.
+async function enqueueRenderStandup(db, instanceId, { keyEnc, appHost, requestedBy }) {
+  await require('./control-plane-guard').assertIntentAllowed(db, instanceId, 'render-standup');
+  try {
+    const { rows } = await db.query(
+      `WITH i AS (
+         INSERT INTO provisioning_intents (instance_id, action, requested_by, state, borrowed_key_enc)
+         VALUES ($1, 'render-standup', $2, 'pending', $3) RETURNING *
+       ), u AS (
+         UPDATE provisioning_instances
+            SET app_host = CASE WHEN app_host->>'ownerId' = $5 AND app_host->>'mode' = $6 THEN app_host ELSE '{}'::jsonb END || $4::jsonb
+          WHERE id = $1 RETURNING id
+       )
+       SELECT i.id, i.instance_id, i.action, i.state, i.created_at FROM i`,
+      [instanceId, requestedBy ?? null, keyEnc, JSON.stringify(appHost), appHost.ownerId, appHost.mode]);
+    return { intent: rows[0] };
+  } catch (e) {
+    if (e && e.code === '23505') {
+      const attached = await attachToProvision(db, instanceId, { keyEnc, appHost });
+      if (attached) return { intent: attached, attached: true };
+      const { rows } = await db.query(
+        `SELECT id, action, state FROM provisioning_intents
+          WHERE instance_id = $1 AND state IN ('pending', 'running') ORDER BY created_at DESC LIMIT 1`, [instanceId]);
+      return { conflict: 'open_intent', intent: rows[0] || { action: 'unknown', state: 'open' } };
+    }
+    throw e;
+  }
+}
+
+// Put the key on the project's OPEN provision run, and record the request on the row, in
+// one statement. Only a run that holds no key yet: a second request never overwrites the
+// first. Returns the intent, or null when there is no such run (the caller then reports
+// the conflict as usual). The table's CHECK still refuses a key on a resolved intent, so
+// a run that finished a moment ago cannot be handed one.
+async function attachToProvision(db, instanceId, { keyEnc, appHost }) {
+  const { rows } = await db.query(
+    `WITH i AS (
+       UPDATE provisioning_intents SET borrowed_key_enc = $2, updated_at = now()
+        WHERE instance_id = $1 AND action = 'provision' AND state IN ('pending', 'running') AND borrowed_key_enc IS NULL
+        RETURNING id, instance_id, action, state, created_at
+     ), u AS (
+       UPDATE provisioning_instances SET app_host = $3::jsonb
+        WHERE id = $1 AND EXISTS (SELECT 1 FROM i) RETURNING id
+     )
+     SELECT * FROM i`,
+    [instanceId, keyEnc, JSON.stringify(appHost)]);
+  return rows[0] || null;
+}
+
+module.exports = { attachToProvision, KEY_RE, OWNER_RE, WEB_PLANS, DB_PLANS, REGIONS, MODES, RUNTIMES, badRequest, appHostFrom, enqueueRenderStandup };

package/modules/provisioning/routes/render-standup.js

@@ -0,0 +1,165 @@
+// modules/provisioning/routes/render-standup.js — POST /provisioning/instances/:id/render
+// (task 1004183; ADR 0327, ADR 0345).
+//
+// The owner lends their Render API key once, names the workspace, and says whether to link
+// a service they already run for this repository (adopt) or create a new one for their app
+// (greenfield: how it is built and started, and whether it needs a database — task 1004350). This route checks
+// the shape, encrypts the key with the secret box, and queues a `render-standup` intent;
+// the runner (scripts/gds/provision-render.js) spends the key in one drain and clears it.
+// This process never calls Render (ADR 0111 §2).
+//
+// What the encryption buys, said plainly: protection from a database dump or a backup
+// while the intent waits. Not from a compromised web tier — the key is in plaintext here
+// before it is encrypted. The key is never logged, never stored anywhere else, and never
+// sent back.
+//
+// Its own routes file (declared in module.json) because routes/provisioning.js sits at the
+// size ratchet — the routes/repo-private.js precedent.
+'use strict';
+
+const express = require('express');
+const api = require('../../../src/module-api');
+const { pool, validateOrRespond, parseId } = api;
+const provisioning = require('../provisioning');
+const renderStandup = require('../render-standup');
+const { failFrom } = require('../public-refusal');
+const { lookupRender, RenderLookupError } = require('../render-lookup');
+const { appStatus } = require('../app-status');
+const envManifest = require('../env-manifest');
+const { makeAskRateLimiter } = require('../rate-limit');
+
+const log = api.logger('provisioning');
+
+// What the runner leg would refuse about the PROJECT, answered here so the owner hears it
+// before lending a key. The runner keeps its own checks.
+function unavailableReason(inst, mode) {
+  if (inst.status === 'torn_down' || inst.status === 'tearing_down') return 'This project has been removed, so it can’t be set up on Render.';
+  if (!inst.target_ref) return mode === 'adopt' ? 'This project has no GitHub repository linked, so there is no app to check the Render service against.' : 'This project has no GitHub repository linked, so Render has nothing to build.';
+  return null;
+}
+
+// The lookup is a Render call made on the owner's behalf, so it is capped per builder:
+// a wizard needs a handful (check the key, then one workspace or two), never a stream.
+const LOOKUP_STATUS = { render_key_refused: 422, render_workspace_unreachable: 422, render_owner_mismatch: 502, render_unreachable: 502 };
+
+// OWNER ONLY, no archon override, for every Render route: the key and the account it acts
+// in are the owner's. A missing project and someone else's answer the same 404, so an id is
+// never confirmed.
+function ownedBy(inst, builder) { return !!(inst && builder && String(inst.owner_builder_id) === String(builder.id)); }
+
+module.exports = function buildRenderStandupRouter({ fetchImpl } = {}) {
+  const router = express.Router();
+  const lookupLimit = makeAskRateLimiter({ windowMs: 60_000, max: 20, key: (req) => `b:${req.builder && req.builder.id}` });
+  const statusLimit = makeAskRateLimiter({ windowMs: 60_000, max: 60, key: (req) => `s:${req.builder && req.builder.id}` });
+
+  // POST /provisioning/render/lookup — rank: any authenticated builder. What the owner's
+  // Render key can see: its workspaces, and the web services in the one they name. The
+  // ONLY Render call this process makes (ADR 0348): GET only, the key held for this
+  // request and never stored, logged or sent back. POST so the key travels in a body,
+  // never a URL.
+  router.post('/provisioning/render/lookup', api.requireBuilder, lookupLimit, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      owner_id: { type: 'string', maxLength: 80 },
+    })) return;
+    if (!renderStandup.KEY_RE.test(req.body.key)) {
+      return res.fail('render_request_invalid', { status: 400, message: 'That doesn’t look like a Render API key. It starts with “rnd_”.' });
+    }
+    if (req.body.owner_id != null && !renderStandup.OWNER_RE.test(req.body.owner_id)) {
+      return res.fail('render_request_invalid', { status: 400, message: 'That isn’t a Render workspace id.' });
+    }
+    try {
+      const out = await lookupRender(req.body.key, { ownerId: req.body.owner_id || null, fetchImpl: fetchImpl || globalThis.fetch });
+      res.json({ ok: true, ...out });
+    } catch (err) {
+      if (err instanceof RenderLookupError) return res.fail(err.code, { status: LOOKUP_STATUS[err.code] || 502, message: err.message });
+      log.error('[provisioning] POST /provisioning/render/lookup', err && err.message);
+      failFrom(res, err, 'render_lookup_failed');
+    }
+  });
+
+  // GET /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
+  // ONLY, like the POST (task 1004353). Where the project's app setup on Render stands:
+  // the stage, the app's address, the Render links, a failure as one sentence with the
+  // answers a Retry re-sends, and the env var NAMES still to set there (task 1004062's
+  // manifest — never a value; this platform holds none). Read from the row alone: nothing
+  // here calls Render, and there is no key to hold. `app` is null when the project's app
+  // has no platform chosen.
+  router.get('/provisioning/instances/:id/render', api.requireBuilder, statusLimit, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      // A run that still carries the lent key has not spent it yet: the owner waits.
+      const { rows } = await pool.query(
+        `SELECT EXISTS (SELECT 1 FROM provisioning_intents WHERE instance_id = $1 AND state IN ('pending', 'running') AND borrowed_key_enc IS NOT NULL) AS waiting`,
+        [id]);
+      const app = appStatus(inst.app_host, { keyWaiting: !!(rows[0] && rows[0].waiting) });
+      const dbSet = !!(inst.app_host && inst.app_host.database === true);
+      const envVars = app && app.state !== 'disconnected'
+        ? (await envManifest.listEnvVars(pool, id)).map((v) => ({ name: v.name, required: v.required !== false, set_for_you: dbSet && v.name === 'DATABASE_URL' }))
+        : [];
+      res.json({ ok: true, app, env_vars: envVars, values_held: false });
+    } catch (err) {
+      log.error('[provisioning] GET /provisioning/instances/:id/render', err && err.message);
+      failFrom(res, err, 'render_status_failed');
+    }
+  });
+
+  // POST /provisioning/instances/:id/render — rank: any authenticated builder, and OWNER
+  // ONLY: the key is the owner's and so is the account it acts in, so an archon on
+  // someone else's project gets the same 404 as a stranger. The reply is a receipt;
+  // nothing has happened on Render when it is sent.
+  router.post('/provisioning/instances/:id/render', api.requireBuilder, async (req, res) => {
+    const id = parseId(req, res, { positiveInt: true });
+    if (!id) return;
+    if (validateOrRespond(req, res, {
+      key: { required: true, type: 'string', maxLength: 200 },
+      owner_id: { required: true, type: 'string', maxLength: 80 },
+      mode: { required: true, type: 'string', maxLength: 20 },
+      service_id: { type: 'string', maxLength: 80 },
+      web_plan: { type: 'string', maxLength: 40 },
+      db_plan: { type: 'string', maxLength: 40 },
+      region: { type: 'string', maxLength: 40 },
+      runtime: { type: 'string', maxLength: 20 },
+      build_command: { type: 'string', maxLength: 500 },
+      start_command: { type: 'string', maxLength: 500 },
+      database: { type: 'boolean' },
+    })) return;
+    try {
+      const inst = await provisioning.getInstanceById(pool, id);
+      if (!ownedBy(inst, req.builder)) return res.fail('instance_not_found', 404);
+      const bad = renderStandup.badRequest(req.body);
+      if (bad) return res.fail('render_request_invalid', { status: 400, message: bad });
+      const why = unavailableReason(inst, req.body.mode);
+      if (why) return res.fail('render_unavailable', { status: 409, message: why, details: { status: inst.status } });
+      if (!api.secretBox.isConfigured()) {
+        return res.fail('render_unavailable', { status: 503, message: 'The platform can’t take a key safely right now, so nothing was sent. Try again later.' });
+      }
+      const appHost = renderStandup.appHostFrom(req.body);
+      const r = await renderStandup.enqueueRenderStandup(pool, id, {
+        keyEnc: api.secretBox.encrypt(req.body.key), appHost, requestedBy: 'api:self',
+      });
+      if (r.conflict) {
+        return res.fail('intent_conflict', { status: 409,
+          message: `A '${r.intent.action}' run is ${r.intent.state} for this project, so your key was not kept. Try again once it has finished.`,
+          details: { action: r.intent.action, state: r.intent.state } });
+      }
+      await provisioning.recordEvent(pool, {
+        instanceId: id, ownerBuilderId: inst.owner_builder_id, event: 'render-standup',
+        detail: `Render ${appHost.mode === 'adopt' ? 'link' : 'setup'} requested by owner (workspace ${appHost.ownerId})`, actor: 'api:self',
+      }).catch(() => {});
+      res.json({ ok: true, queued: true, action: 'render-standup', mode: appHost.mode, with_setup: !!r.attached,
+        message: appHost.mode === 'adopt'
+          ? 'Queued. The platform will check the service in your Render account and link it, without changing anything there. Your key is used once and then thrown away.'
+          : `Queued. The platform will create ${appHost.database ? 'a database and ' : ''}a web service for your app in your Render account. Your key is used once and then thrown away; Render bills you directly.` });
+    } catch (err) {
+      // Never log the request: it carries the key.
+      log.error('[provisioning] POST /provisioning/instances/:id/render', err && err.message);
+      failFrom(res, err, 'render_standup_failed');
+    }
+  });
+
+  return router;
+};

package/modules/provisioning/starter-bundles.js

@@ -73,7 +73,10 @@ const ALWAYS_ON_CORE = Object.freeze([
 // the hub creates receives those releases, so none is offered the publisher's page. It
 // is package-agnostic by construction, so offering it to a project that publishes its
 // own npm package is a later, deliberate removal from this list — with picker copy.
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release']);
+// `render-deploy` (task 1004270) is the deploy page of a project whose app deploys through
+// Render: it is turned on by the connect-Render step, never chosen in this picker, so it is
+// kept out of the opt-in catalog by the same list.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/modules/public-landing/public/account-private.states.json

@@ -0,0 +1,14 @@
+{
+  "_": "The account page for a private account with its record hidden and no published profile yet (task 1004259): the recruiter copy shrinks to name and picture and says it is the one exception to 'not found', the record line says nothing has been reported and that the profile is not published, and the empty profile fields show their placeholders. stub.fixtures points the account read at fixtures/me-cross-project-private.json.",
+  "page": "/account",
+  "surface": "public-landing",
+  "stub": { "fixtures": { "me__cross-project": "me-cross-project-private" } },
+  "modes": ["dark"],
+  "modeQuery": false,
+  "ignoreRequests": ["/api/(gds|bongos)/me/cross-project$"],
+  "ignoreConsole": ["/api/(gds|bongos)/me/cross-project", "\\b401\\b", "Unauthorized"],
+  "ignoreControls": [".vh"],
+  "states": {
+    "in-private": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#recWhat"], "checked": "input[name=visibility][value=private]", "value": [["#fName", ""], ["#fBio", ""]], "text": [["#recordLine", "No cross-project activity reported yet. Your profile is not published yet; it publishes after your next sign-in."]] } }
+  }
+}