@bongos/core 1.19.1080 → 1.20.1

package/modules/public-landing/public/projects.states.json

@@ -24,6 +24,12 @@
     "in-manage-card": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mCard", "#mCardPick .pick .pickPreview .cardBand", "#mCardPick [data-card-save]", "#mCardWhat summary"], "count": [["#mCardPick .pickCells[role=\"radiogroup\"]", 1], ["#mCardPick .pickCell", 5], ["#mCardPick .pickCell.on", 1]], "checked": "#mCardPick input[name=\"mCardBackdrop\"][value=\"\"]", "attr": [["#mCardPick .cardBand", "data-own", ""]] } },
     "in-manage-kind": { "auth": true, "url": "/projects?view=manage&id=101", "expect": {"visible":["#mKind","#mKindPick .modBand","#mKindWhat summary"],"count":[["#mKindPick .modOpt",5],["#mKindPick .modOpt[aria-pressed=\"true\"]",0]],"text":[["#mKindPick .modOpt b","Game"],["#mKindPick .finePrint","This project has never said what kind it is. Saying so puts the word beside its name wherever it is listed; it changes nothing else."]]} },
     "in-manage-invite": { "auth": true, "url": "/projects?view=manage&id=101", "expect": { "visible": ["#mInvite", "#mInvite h2", "#mInviteWho", "#mInvite [data-invite-send]"] } },
+    "in-manage-app-live": { "auth": true, "url": "/projects?view=manage&id=101", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStat","#mApp .appVars"],"hidden":[]} },
+    "in-manage-app-building": { "auth": true, "url": "/projects?view=manage&id=102", "actions": [["wait",900],["focus","#mApp a"]], "expect": {"visible":["#mAppCard","#mApp .appStages"],"hidden":[]} },
+    "in-manage-app-failed": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["focus","#mApp .appRetryBtn"]], "expect": {"visible":["#mAppCard","#mApp p.err","#mApp .appRetryBtn"],"hidden":["#mApp .appRetry"]} },
+    "in-manage-app-retry": { "auth": true, "url": "/projects?view=manage&id=105", "actions": [["wait",900],["click","#mApp .appRetryBtn"],["wait",200]], "expect": {"visible":["#mApp .appRetry","#mApp .appRetryKey"],"hidden":[]} },
+    "in-manage-app-offer": { "auth": true, "url": "/projects?view=manage&id=103", "actions": [["wait",900],["focus","#mAppConnectOpen"]], "expect": {"visible":["#mAppCard","#mAppConnect","#mAppConnectOpen"],"hidden":["#mAppConnectForm"]} },
+    "in-manage-app-connect": { "auth": true, "url": "/projects?view=manage&id=103", "actions": [["wait",900],["click","#mAppConnectOpen"],["wait",200]], "expect": {"visible":["#mAppConnectForm","#m-renderSetup","#m-f-renderKey","#mAppConnectGo"],"hidden":["#mAppConnectOpen","#m-renderWs"]} },
     "in-manage-snag": { "auth": true, "url": "/projects?view=manage&id=103", "expect": { "visible": ["#mMain", "#mErr", "#mActs"], "hidden": ["#mAddress"], "text": [["#mName", "tidepool"]] } },
     "in-manage-gone": { "auth": true, "url": "/projects?view=manage&id=104", "expect": { "visible": ["#mMain", "#mActs"], "hidden": ["#mErr", "#mAddress"], "text": [["#mName", "old-lantern"]] } },
     "in-manage-missing": { "auth": true, "url": "/projects?view=manage&id=999", "expect": { "visible": ["#mMissing"], "hidden": ["#mMain", "#mGate"] } },
@@ -36,7 +42,8 @@
     "in-new-modules-search": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["fill","#modQ","discord"],["wait",200]], "expect": {"visible":["#panel-modules","#modQ"],"value":[["#modQ","discord"]],"count":[["#modCards .tpill",1],["#modCards .tpill[data-mod=\"discord\"]",1]],"text":[["#modFilterNote","Showing 1 of 3. 2 extras are switched on, including any this search is hiding."]]} },
     "in-new-home": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-home"],"hidden":["#panel-detail","#qWrap"]} },
     "in-new-address": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-address"],"hidden":["#panel-home","#qWrap"]} },
-    "in-new-app": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-app","#appOpts","#appOptRender .soonTag"],"hidden":["#panel-address","#panel-review","#qWrap"]} },
+    "in-new-app": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-app","#appOpts","#appOptRender"],"hidden":["#panel-address","#panel-review","#qWrap"]} },
+    "in-new-app-render": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#appOptRender input"],["wait",300]], "expect": {"visible":["#panel-app","#renderSetup","#f-renderKey","#renderCheck"],"hidden":["#renderWs","#renderSvc","#renderNew"]} },
     "in-new-review": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-review","#reviewList li"],"hidden":["#panel-address","#qWrap"]} },
     "in-new-done": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]], "expect": {"visible":["#panel-done","#liveProgress .prog","#humanSteps li"],"hidden":["#panel-review","#qWrap"]} },
     "in-new-resume-offer": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#panel-app button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500],["click","#projTrig"],["wait",350],["click","#menuProjects [data-nav=\"new\"]"],["wait",500]], "expect": {"visible":["#panel-name","#wizResume","#wizResumeGo"],"hidden":["#panel-done"],"text":[["#wizResumeName","Mercury"]]} },

package/modules/render-deploy/deploys.js

@@ -0,0 +1,203 @@
+'use strict';
+
+// modules/render-deploy/deploys.js — the reading behind a Render project's deploy page
+// (task 1004270): the service's Render deploys, each tied to its commit and to the Bongos tasks
+// in it, with what is live now marked. Pure shaping plus one ledger query; every call to Render
+// goes through the client the caller hands in (scripts/gds/render-api.js, the ONE Render client,
+// with its ownerId guard), so this file never holds a key and never talks to the network.
+//
+// WHAT "THE TASKS IN A COMMIT RANGE" MEANS HERE. Render's API names the commit a deploy built
+// and nothing about the commits between two deploys, and the hall has no clone of the app's
+// repository to diff. So a deploy's tasks are the union of two readings, and each task says
+// which one named it:
+//   named   the commit message names the task (`task 1004057`, or a `task-1004057` branch in a
+//           merge message), which is how a Bongos ship writes its merge;
+//   window  the ledger shipped the task after the previous deploy's commit and up to this
+//           deploy's commit. An approximation of a range, said as one, never as a diff.
+// The oldest deploy Render lists has no earlier one to bound it, so it carries `named` only and
+// the page says its range starts there.
+//
+// WHAT RENDER CAN AND CANNOT SHOW. Render has no address for "this earlier deploy, running", and
+// the page does not invent one: previewOf() answers that it cannot, with the reason a reader can
+// act on. Rolling back to a deploy is the only way to see it run, and the page says that too.
+
+const KEY_RE = /^rnd_[A-Za-z0-9]{16,128}$/;
+const OWNER_RE = /^(tea|usr)-[a-z0-9]{8,64}$/;
+const SERVICE_RE = /^srv-[a-z0-9]{8,64}$/;
+const DEPLOY_RE = /^dep-[a-z0-9]{8,64}$/;
+
+const HISTORY_LIMIT = 30;
+
+// Render's deploy statuses, in words a person would say (voice.md V2: no slug shown as is).
+const STATUS_WORDS = Object.freeze({
+  created: 'Queued',
+  build_in_progress: 'Building',
+  update_in_progress: 'Starting',
+  pre_deploy_in_progress: 'Running its pre-deploy step',
+  live: 'Live',
+  deactivated: 'Replaced by a newer deploy',
+  build_failed: 'The build failed',
+  update_failed: 'It did not start',
+  pre_deploy_failed: 'Its pre-deploy step failed',
+  canceled: 'Canceled',
+});
+
+function statusWords(status) {
+  return STATUS_WORDS[status] || 'Unknown to this page';
+}
+
+// Only a deploy that once ran and was then replaced can be rolled back to. A build that failed
+// never served; one still in flight is not finished; the live one is already what is running.
+const ROLLBACK_STATUSES = Object.freeze(['deactivated']);
+
+/** The task ids a commit message names: "task 1004057", "task-1004057", "task/1004057". */
+function taskIdsIn(message) {
+  const ids = [];
+  const re = /\btask[\s/_-]{0,2}#?(\d{3,12})\b/gi;
+  let m;
+  while ((m = re.exec(String(message || ''))) !== null) if (!ids.includes(m[1])) ids.push(m[1]);
+  return ids;
+}
+
+/**
+ * Can this deploy be looked at running? Render answers no, and the page says why.
+ * `service.previews.generation` is Render's preview-environments setting: it makes a short-lived
+ * copy of the service for an open pull request, never for an earlier deploy, so even a plan that
+ * has it does not give this page an address to show. Kept as a function so a verified per-deploy
+ * address can replace the answer in one place.
+ */
+function previewOf(service) {
+  const gen = service && service.previews && service.previews.generation;
+  const has = gen && gen !== 'off';
+  return {
+    available: false,
+    reason: has
+      ? 'Render gives an earlier deploy no address of its own. Its preview environments are copies made for pull requests. The only way to see this deploy running is to roll back to it.'
+      : 'This service has no preview environments, and Render gives an earlier deploy no address of its own on any plan. The only way to see this deploy running is to roll back to it.',
+  };
+}
+
+/** What a press costs, said in one sentence per action. The cost lands on the owner's account. */
+function costOf(service) {
+  const plan = service && service.serviceDetails && service.serviceDetails.plan;
+  const where = plan ? `Your Render plan for this service (${plan}) is billed as it always is.` : 'Your Render plan for this service is billed as it always is.';
+  return {
+    deploy: `${where} A deploy runs a new build on your Render account. If your workspace is past the build minutes its plan includes, Render bills the extra minutes to you.`,
+    rollback: `${where} A rollback re-serves an earlier build and runs no new build. After a rollback Render can pause automatic deploys for the service, so check that setting in Render afterwards.`,
+  };
+}
+
+const ms = (iso) => { const t = Date.parse(iso); return Number.isFinite(t) ? t : null; };
+
+function shortId(id) { return String(id || '').slice(0, 7); }
+
+/**
+ * Shape Render's deploys into the page's history. `ledger` is the shipped tasks (`{ id, title,
+ * at }`) the caller read for the span the deploys cover; `titles` maps an id to its title for the
+ * tasks a commit message named that the ledger window did not carry.
+ */
+function shapeHistory({ service, deploys, ledger = [], titles = {} }) {
+  const list = Array.isArray(deploys) ? deploys : [];
+  const liveDeploy = list.find((d) => d.status === 'live') || null;
+  const preview = previewOf(service);
+  const out = list.map((d, i) => {
+    const commit = d.commit || {};
+    const at = ms(commit.createdAt) ?? ms(d.createdAt);
+    // The previous DIFFERENT commit: two deploys of one commit (a manual redeploy) carry nothing new.
+    const older = list.slice(i + 1).find((o) => o.commit && o.commit.id && o.commit.id !== commit.id) || null;
+    const since = older ? (ms(older.commit.createdAt) ?? ms(older.createdAt)) : null;
+    const tasks = [];
+    for (const id of taskIdsIn(commit.message)) tasks.push({ id, title: titles[id] || null, via: 'named' });
+    if (since !== null && at !== null) {
+      for (const t of ledger) {
+        const ta = ms(t.at);
+        if (ta !== null && ta > since && ta <= at && !tasks.some((x) => x.id === String(t.id))) {
+          tasks.push({ id: String(t.id), title: t.title || null, via: 'window' });
+        }
+      }
+    }
+    return {
+      id: d.id,
+      commit: { id: commit.id || null, short: shortId(commit.id), message: String(commit.message || '').split('\n')[0].slice(0, 300), at: commit.createdAt || null },
+      status: d.status,
+      statusWords: statusWords(d.status),
+      trigger: d.trigger || null,
+      at: d.createdAt || null,
+      finishedAt: d.finishedAt || null,
+      live: !!liveDeploy && d.id === liveDeploy.id,
+      canRollbackTo: ROLLBACK_STATUSES.includes(d.status),
+      rangeStartsHere: older === null,
+      tasks,
+      preview,
+    };
+  });
+  return { liveDeployId: liveDeploy ? liveDeploy.id : null, deploys: out, cost: costOf(service) };
+}
+
+// A task counts as done for the ledger once it is completed, confirmed or shipped, the same
+// reading the npm-release page takes of "recent work".
+const DONE_STATUSES = ['completed', 'confirmed', 'shipped'];
+
+async function readLedger(pool, deploys) {
+  const times = (deploys || []).map((d) => ms(d.commit && d.commit.createdAt) ?? ms(d.createdAt)).filter((t) => t !== null);
+  if (times.length < 2) return [];
+  const { rows } = await pool.query(
+    `SELECT id, title, COALESCE(shipped_at, updated_at) AS at
+       FROM tasks
+      WHERE status = ANY($3::text[])
+        AND COALESCE(shipped_at, updated_at) > $1::timestamptz
+        AND COALESCE(shipped_at, updated_at) <= $2::timestamptz
+      ORDER BY COALESCE(shipped_at, updated_at) DESC
+      LIMIT 500`,
+    [new Date(Math.min(...times)).toISOString(), new Date(Math.max(...times)).toISOString(), DONE_STATUSES],
+  );
+  return rows.map((r) => ({ id: String(r.id), title: r.title, at: r.at instanceof Date ? r.at.toISOString() : r.at }));
+}
+
+async function readTitles(pool, ids) {
+  if (!ids.length) return {};
+  const { rows } = await pool.query('SELECT id, title FROM tasks WHERE id = ANY($1::bigint[])', [ids]);
+  return Object.fromEntries(rows.map((r) => [String(r.id), r.title]));
+}
+
+/**
+ * The page's whole reading. `client` is a RenderApi already bound to the app's workspace; the
+ * service is read through its guard first, so a service in another workspace never gets this far.
+ */
+async function readHistory({ pool, client, app, limit = HISTORY_LIMIT }) {
+  const service = await client.getService(app.service_id);
+  const deploys = await client.listDeploys(app.service_id, { limit });
+  const ledger = await readLedger(pool, deploys);
+  const named = [...new Set(deploys.flatMap((d) => taskIdsIn(d.commit && d.commit.message)))];
+  const titles = await readTitles(pool, named);
+  const details = (service && service.serviceDetails) || {};
+  return {
+    app: { serviceId: app.service_id, serviceName: (service && service.name) || app.service_name || null, ownerId: app.owner_id },
+    service: { name: (service && service.name) || null, plan: details.plan || null, url: details.url || null },
+    ...shapeHistory({ service, deploys, ledger, titles }),
+  };
+}
+
+async function getApp(pool) {
+  const { rows } = await pool.query('SELECT owner_id, service_id, service_name, connected_at FROM render_deploy_app WHERE id = 1');
+  return rows[0] || null;
+}
+
+async function saveApp(pool, { ownerId, serviceId, serviceName, builderId }) {
+  const { rows } = await pool.query(
+    `INSERT INTO render_deploy_app (id, owner_id, service_id, service_name, connected_by)
+     VALUES (1, $1, $2, $3, $4)
+     ON CONFLICT (id) DO UPDATE
+       SET owner_id = EXCLUDED.owner_id, service_id = EXCLUDED.service_id, service_name = EXCLUDED.service_name,
+           connected_by = EXCLUDED.connected_by, connected_at = now()
+     RETURNING owner_id, service_id, service_name, connected_at`,
+    [ownerId, serviceId, serviceName || null, builderId == null ? null : builderId],
+  );
+  return rows[0];
+}
+
+module.exports = {
+  KEY_RE, OWNER_RE, SERVICE_RE, DEPLOY_RE, HISTORY_LIMIT,
+  statusWords, taskIdsIn, previewOf, costOf, shapeHistory, readHistory, getApp, saveApp,
+  ROLLBACK_STATUSES,
+};

package/modules/render-deploy/migrations/render_deploy_001_app.sql

@@ -0,0 +1,22 @@
+-- render_deploy_001_app.sql — which Render service this hall's deploy page reads (task 1004270).
+--
+-- ONE ROW, because a hall is one project and the module manages one app. It holds two ids and
+-- nothing secret: the Render workspace (owner) the app lives in and the service. The owner's
+-- Render API key is NEVER stored anywhere (ADR 0327 §2): the page asks for it on each request,
+-- the server spends it on that one request and drops it. Storing the workspace id is what lets
+-- every call go through the ownerId guard (scripts/gds/render-api.js) with a workspace the owner
+-- NAMED, never one picked out of the key's own list.
+--
+-- Additive only (docs/modules-contract.md): one new table, the module's own prefix.
+
+CREATE TABLE IF NOT EXISTS render_deploy_app (
+  id            smallint PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  owner_id      text NOT NULL,
+  service_id    text NOT NULL,
+  service_name  text,
+  connected_by  bigint,
+  connected_at  timestamptz NOT NULL DEFAULT now()
+);
+
+COMMENT ON TABLE render_deploy_app IS
+  'The one Render service this hall manages (task 1004270): workspace id + service id, no secrets. The Render API key is never stored (ADR 0327 §2).';

package/modules/render-deploy/module.json

@@ -0,0 +1,25 @@
+{
+  "key": "render-deploy",
+  "title": "Render deploy",
+  "description": "The deploy page for a project whose app deploys through Render: the service's Render deploys, each tied to its commit and the Bongos tasks it carried, what is live now, and deploy and roll back behind a two-step confirm (task 1004270). Off in every hall until its owner turns it on.",
+  "version": "1.0.0",
+  "coreVersion": "^1.19.0",
+  "default": false,
+  "author": "Cloud Bongos",
+  "origin": "Cloud Bongos core",
+  "license": "AGPL-3.0",
+  "maintainer": "Cloud Bongos maintainers",
+  "maintenance": {
+    "status": "core-maintained"
+  },
+  "contributes": {
+    "routes": [
+      "app",
+      "history",
+      "act"
+    ],
+    "migrations": true
+  },
+  "provides": [],
+  "consumes": []
+}

package/modules/render-deploy/public/deploy.css

@@ -0,0 +1,10 @@
+/* modules/render-deploy/public/deploy.css — spacing the Render deploy page needs beyond
+   oversight.css (task 1004270). Loaded by deploy.js beside itself, so a hall without the module
+   never fetches it. Spacing only: every colour, face and size is the shared row family's. */
+
+#rd-panel .rd-key { margin: 12px 0; }
+#rd-panel .rd-key input,
+#rd-panel .rd-form input { display: block; width: 100%; max-width: 32rem; margin: 4px 0 8px; }
+#rd-panel .rd-form { margin: 12px 0; }
+#rd-panel .rd-acts { margin: 8px 0 4px; }
+#rd-panel .ov-group > .ov-row__sub { margin: 8px 0 6px; }

package/modules/render-deploy/public/deploy.js

@@ -0,0 +1,249 @@
+// modules/render-deploy/public/deploy.js — the deploy page of a project whose app deploys
+// through Render (task 1004270). Loaded by /deploy only when the render-deploy module is on
+// (hall-ui/public/deploy.js), and rendered into #rd-panel.
+//
+// THE PAGE KNOWS NOTHING (deploy.js's rule, kept). Every deploy, status, task and cost sentence
+// is the server's reading of Render and the ledger; nothing is compared or inferred here.
+//
+// THE KEY IS NEVER KEPT. Render's API key is the owner's, is account-wide, and is not stored
+// anywhere (ADR 0327 §2). It lives in one variable on this page, is sent in the x-render-key
+// header of each request, and is gone when the tab closes. It is never written to storage, the
+// address, or the page's markup, and the field that takes it is a password field that is never
+// re-rendered with a value in it.
+//
+// TWO STEPS, NEVER ONE (ADR 0293 D4). Pressing Deploy or Roll back only opens step two: what
+// would happen, what it costs, and a confirm button built FROM the deploy that was shown, so a
+// repaint cannot swap what the press does. The server holds the second step as well: the confirm
+// names the deploy that was live when this step was drawn, and is refused if Render's has moved.
+(() => {
+  'use strict';
+
+  const API = '/api/bongos';
+  const client = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
+  const { escapeHtml } = window.OTB;
+  const $ = (id) => document.getElementById(id);
+
+  // The key, in memory only. See the header.
+  let renderKey = '';
+  const state = { app: undefined, hist: null, viewing: null, pending: null, busy: false, error: null, done: null };
+
+  // Voice rule V4 (docs/voice.md): a dash in QUOTED data (a task title, a commit message) is
+  // a comma at render, never an edit to the data.
+  const unDash = (raw) => String(raw == null ? '' : raw).replace(/\s*[—–]\s*/g, ', ').replace(/,\s*,/g, ',').trim();
+
+  function when(iso) {
+    const t = Date.parse(iso);
+    if (!Number.isFinite(t)) return '';
+    const mins = Math.round((Date.now() - t) / 60000);
+    if (mins < 1) return 'just now';
+    if (mins < 60) return `${mins}m ago`;
+    if (mins < 48 * 60) return `${Math.round(mins / 60)}h ago`;
+    return new Date(t).toLocaleDateString(undefined, { day: 'numeric', month: 'short' });
+  }
+
+  async function call(method, path, body) {
+    const headers = renderKey ? { 'x-render-key': renderKey } : {};
+    const res = await client.request(method, `${API}${path}`, { body, headers });
+    if (res.status === 401) { window.location.assign(`${API}/auth/web/start`); throw new Error('Sign in again.'); }
+    if (!res.ok) {
+      const err = (res.data && res.data.error) || {};
+      const e = new Error(err.message || `${path} → ${res.status}`);
+      e.code = err.code || null;
+      throw e;
+    }
+    return res.data;
+  }
+
+  // ---- painting -------------------------------------------------------------
+
+  function keyBoxHtml() {
+    return `<div class="rd-key">
+        <label for="rd-key">Render API key</label>
+        <input type="password" id="rd-key" autocomplete="off" spellcheck="false" placeholder="rnd_…">
+        <p class="ov-row__sub">Used for the request you make, then dropped. It is never saved, and this page forgets it when you close the tab.</p>
+      </div>`;
+  }
+
+  function connectHtml() {
+    return `<div class="ov-note">
+        <p><strong>Connect this project to its Render service.</strong> Copy the workspace id and the service id from Render, and enter your key above. The key must be able to act in that workspace.</p>
+      </div>
+      <div class="rd-form">
+        <label for="rd-owner">Workspace id</label>
+        <input type="text" id="rd-owner" autocomplete="off" spellcheck="false" placeholder="tea-…">
+        <label for="rd-service">Service id</label>
+        <input type="text" id="rd-service" autocomplete="off" spellcheck="false" placeholder="srv-…">
+        <button type="button" class="btn btn--primary" id="rd-connect"${state.busy ? ' disabled' : ''}>Connect</button>
+      </div>`;
+  }
+
+  function taskLine(t) {
+    const label = unDash(t.title) || `Task ${t.id}`;
+    const how = t.via === 'named' ? 'named in the commit' : 'shipped in this range';
+    return `<li class="ov-row ov-row--dense"><div class="ov-row__main">
+        <a class="ov-row__title" href="/task/${encodeURIComponent(t.id)}">${escapeHtml(label)}</a>
+        <p class="ov-row__sub">${escapeHtml(how)}</p></div></li>`;
+  }
+
+  function deployHtml(d) {
+    const marks = [];
+    if (d.live) marks.push('<strong>Live now</strong>');
+    marks.push(escapeHtml(d.statusWords));
+    const tasks = d.tasks.length
+      ? `<ul class="ov-rows">${d.tasks.map(taskLine).join('')}</ul>`
+      : `<p class="ov-row__sub">${d.rangeStartsHere ? 'No task is named in this commit, and it is the oldest deploy shown, so its range starts here.' : 'No Bongos task is named in this commit or shipped in its range.'}</p>`;
+    const acts = [`<button type="button" class="btn btn--sm btn--ghost" data-view="${escapeHtml(d.id)}">View</button>`];
+    if (d.canRollbackTo && !d.live) acts.push(`<button type="button" class="btn btn--sm" data-rollback="${escapeHtml(d.id)}">Roll back to this</button>`);
+    return `<div class="ov-group" data-deploy="${escapeHtml(d.id)}">
+        <div class="ov-group__head">
+          <span class="ov-group__name ov-key">${escapeHtml(d.commit.short || d.id)}</span>
+          <span class="ov-group__n">${d.tasks.length}</span>
+          <span class="ov-group__note">${marks.join(' · ')} · ${escapeHtml(when(d.at))}</span>
+        </div>
+        <p class="ov-row__sub">${escapeHtml(unDash(d.commit.message) || 'No commit message.')}</p>
+        ${tasks}
+        <div class="rd-acts">${acts.join(' ')}</div>
+      </div>`;
+  }
+
+  // Step two of a press: what would happen, what it costs, and the confirm, built from the
+  // deploy that was shown.
+  function stepTwoHtml(h) {
+    const p = state.pending;
+    if (!p) return '';
+    const target = p.action === 'rollback' ? h.deploys.find((d) => d.id === p.deployId) : null;
+    const what = p.action === 'rollback'
+      ? `Roll ${escapeHtml(h.app.serviceName || 'the service')} back to deploy ${escapeHtml(target ? target.commit.short : p.deployId)}. That is what your users will get next.`
+      : `Start a new deploy of ${escapeHtml(h.app.serviceName || 'the service')} from the latest commit on its branch.`;
+    return `<div class="ov-note ov-note--warn" id="rd-step2">
+        <p><strong>Check this before you confirm.</strong> ${what}</p>
+        <p>${escapeHtml(h.cost[p.action])}</p>
+        <p><button type="button" class="btn btn--primary" id="rd-confirm"${state.busy ? ' disabled' : ''}>${p.action === 'rollback' ? 'Confirm roll back' : 'Confirm deploy'}</button>
+           <button type="button" class="btn btn--ghost" id="rd-cancel">Cancel</button></p>
+      </div>`;
+  }
+
+  // "You're viewing X": the record of one deploy, and the honest word on previews.
+  function viewingHtml(h) {
+    const d = h.deploys.find((x) => x.id === state.viewing);
+    if (!d) return '';
+    return `<div class="ov-note" id="rd-viewing" role="status">
+        <p><strong>You’re viewing deploy ${escapeHtml(d.commit.short || d.id)}.</strong> ${d.live ? 'It is what is live now.' : 'It is not what is live now.'} This is the record of that deploy, not the running app.</p>
+        <p>${escapeHtml(d.preview.available ? 'A preview of this deploy is open.' : d.preview.reason)}</p>
+        <p><button type="button" class="btn btn--sm btn--ghost" id="rd-unview">Back to the history</button></p>
+      </div>`;
+  }
+
+  function paint() {
+    const el = $('rd-panel');
+    if (!el) return;
+    const h = state.hist;
+    let body = '';
+    if (state.error) body += `<div class="ov-note ov-note--warn"><p><strong>Nothing was changed.</strong> ${escapeHtml(state.error)}</p></div>`;
+    if (state.done) body += `<div class="ov-note"><p>${escapeHtml(state.done)}</p></div>`;
+    if (state.app === undefined) body += '<span class="kit-skel"></span>';
+    else if (state.app === null) body += connectHtml();
+    else if (!h) {
+      body += `<p class="scroll__lede">Connected to ${escapeHtml(state.app.serviceName || state.app.serviceId)}. Enter your Render key to read its deploys.</p>
+        <p><button type="button" class="btn btn--primary" id="rd-read"${state.busy ? ' disabled' : ''}>Read from Render</button></p>`;
+    } else {
+      body += `<p class="scroll__lede">${escapeHtml(h.app.serviceName || 'This service')}${h.service.plan ? `, on the ${escapeHtml(h.service.plan)} plan` : ''}. Each deploy is tied to its commit and to the Bongos tasks in it.</p>
+        ${viewingHtml(h)}
+        <p><button type="button" class="btn btn--primary" id="rd-deploy"${state.busy ? ' disabled' : ''}>Deploy the latest commit</button>
+           <button type="button" class="btn btn--ghost" id="rd-refresh"${state.busy ? ' disabled' : ''}>Read again</button></p>
+        ${stepTwoHtml(h)}
+        ${h.deploys.map(deployHtml).join('') || '<p class="ov-row__sub">Render lists no deploys for this service yet.</p>'}`;
+    }
+    // The key field is written once and kept, so a repaint never clears or re-creates it.
+    const list = $('rd-list');
+    if (list) list.innerHTML = body;
+    el.hidden = false;
+  }
+
+  function mount() {
+    const el = $('rd-panel');
+    if (!el) return false;
+    el.innerHTML = `<h2 class="scroll__h" id="rd-h">Render deploys</h2>
+      <p class="scroll__lede">This project’s app deploys through Render. Deploying or rolling back here acts on your Render account, so each one asks twice.</p>
+      ${keyBoxHtml()}<div id="rd-list"></div>`;
+    $('rd-key').addEventListener('input', (ev) => { renderKey = String(ev.target.value || '').trim(); });
+    return true;
+  }
+
+  // ---- acts -----------------------------------------------------------------
+
+  async function run(fn) {
+    if (state.busy) return;
+    state.busy = true; state.error = null; state.done = null; paint();
+    try { await fn(); }
+    catch (e) { state.error = e.message || String(e); }
+    finally { state.busy = false; paint(); }
+  }
+
+  const readHistory = () => run(async () => {
+    const d = await call('GET', '/render-deploy/history');
+    if (d.connected === false) { state.app = null; state.hist = null; return; }
+    if (d.needsKey) { state.app = d.app; state.hist = null; state.error = 'Enter your Render key first.'; return; }
+    state.app = d.app; state.hist = d; state.viewing = null; state.pending = null;
+  });
+
+  const connect = () => run(async () => {
+    const ownerId = String(($('rd-owner') || {}).value || '').trim();
+    const serviceId = String(($('rd-service') || {}).value || '').trim();
+    const d = await call('PUT', '/render-deploy/app', { ownerId, serviceId });
+    state.app = d.app;
+    const h = await call('GET', '/render-deploy/history');
+    if (!h.needsKey) { state.hist = h; }
+  });
+
+  // Step two. Closes over `p`, the press that was shown, so what is sent is what was displayed.
+  const confirm = () => {
+    const p = state.pending;
+    if (!p) return;
+    return run(async () => {
+      const r = await call('POST', '/render-deploy/act', { action: p.action, deployId: p.deployId, confirm: true, expectLiveDeployId: p.liveWas });
+      state.pending = null;
+      state.done = `Render accepted it${r.render ? `, and now reports the newest deploy as: ${r.render.statusWords.toLowerCase()}` : ''}. Read again to follow it.`;
+      const d = await call('GET', '/render-deploy/history');
+      if (!d.needsKey) state.hist = d;
+    });
+  };
+
+  document.addEventListener('click', (ev) => {
+    const t = ev.target;
+    if (!(t instanceof Element) || !$('rd-panel') || !$('rd-panel').contains(t)) return;
+    if (t.closest('#rd-connect')) return connect();
+    if (t.closest('#rd-read') || t.closest('#rd-refresh')) return readHistory();
+    if (t.closest('#rd-deploy')) { state.pending = { action: 'deploy', liveWas: state.hist.liveDeployId }; state.error = null; state.done = null; return paint(); }
+    const rb = t.closest('[data-rollback]');
+    if (rb) { state.pending = { action: 'rollback', deployId: rb.getAttribute('data-rollback'), liveWas: state.hist.liveDeployId }; state.error = null; state.done = null; return paint(); }
+    if (t.closest('#rd-cancel')) { state.pending = null; return paint(); }
+    if (t.closest('#rd-confirm')) return confirm();
+    const v = t.closest('[data-view]');
+    if (v) { state.viewing = v.getAttribute('data-view'); return paint(); }
+    if (t.closest('#rd-unview')) { state.viewing = null; return paint(); }
+  });
+
+  function loadSheet() {
+    if (document.getElementById('rd-css') || !document.createElement) return;
+    const l = document.createElement('link');
+    l.id = 'rd-css'; l.rel = 'stylesheet'; l.href = '/modules/render-deploy/public/deploy.css';
+    document.head.appendChild(l);
+  }
+
+  async function start() {
+    if (!mount()) return;
+    loadSheet();
+    paint();
+    try {
+      const d = await call('GET', '/render-deploy/app');
+      state.app = d.app;
+    } catch (e) {
+      // Not this reader's to see, or the module is off: show nothing, like the npm page.
+      $('rd-panel').hidden = true; return;
+    }
+    paint();
+  }
+
+  start();
+})();

package/modules/render-deploy/render.js

@@ -0,0 +1,56 @@
+'use strict';
+
+// modules/render-deploy/render.js — how a request reaches Render (task 1004270).
+//
+// THE KEY. The owner's Render key is account-wide and is never stored (ADR 0327 §2). So it
+// rides each request in the `x-render-key` header (a header, not a body: the kernel's audit
+// log keeps a copy of every write body, and no header), is shape-checked, handed to the ONE
+// Render client for that request, and dropped when the request ends. Nothing here logs it,
+// echoes it, or writes it anywhere. An error from Render is turned into a sentence that names
+// what happened, never the key or the request that carried it.
+//
+// What that costs, said plainly: the key passes through this hall's web tier in plaintext for
+// the length of the request (ADR 0327 §2 records the same of the standup). The owner types it
+// on the page each time they read from or act on Render.
+//
+// THE CLIENT. scripts/gds/render-api.js, unchanged in kind: built for one workspace, asserts
+// the workspace on every answer, and has no delete. This file only builds it.
+
+const { KEY_RE } = require('./deploys');
+
+function defaultMakeClient({ key, ownerId }) {
+  // Lazy, so a hall that never reaches Render never loads the client.
+  const { RenderApi } = require('../../scripts/gds/render-api');
+  return new RenderApi({ token: key, ownerId, dryRun: false });
+}
+
+const refusal = (res, status, code, message) => res.status(status).json({ error: { code, message } });
+
+/** The key off the request, or null. Never returned to the caller in any response. */
+function keyFrom(req) {
+  const raw = req.headers && req.headers['x-render-key'];
+  const key = typeof raw === 'string' ? raw.trim() : '';
+  return KEY_RE.test(key) ? key : null;
+}
+
+const NEEDS_KEY = 'Enter your Render API key. It is used for this one request, then dropped. It is never saved.';
+
+/**
+ * A Render failure as a response. A 401 from Render is answered 422 here, never 401: to the
+ * hall's client a 401 means "your Bongos session ended" and sends the browser to sign in.
+ */
+function renderFailure(res, e, log) {
+  const name = e && e.name;
+  if (log) log.error(`render call failed: ${name || 'error'} ${e && e.status ? e.status : ''}`.trim());
+  if (name === 'RenderOwnerMismatch') {
+    return refusal(res, 403, 'wrong_workspace', 'Render answered from a different workspace than the one this project is connected to, so nothing was done.');
+  }
+  const status = e && e.status;
+  if (status === 401 || status === 403) {
+    return refusal(res, 422, 'render_refused_key', 'Render did not accept that key for this service. Check the key, and that it belongs to a user in the connected workspace.');
+  }
+  if (status === 404) return refusal(res, 404, 'render_not_found', 'Render has no such service or deploy in the connected workspace.');
+  return refusal(res, 502, 'render_unreachable', 'Render did not answer that request. Nothing was changed. Try again in a moment.');
+}
+
+module.exports = { defaultMakeClient, keyFrom, refusal, renderFailure, NEEDS_KEY };