@bongos/core 1.19.508 → 1.19.510

package/modules/public-landing/public/projects.html

@@ -54,6 +54,22 @@
    cosmos vocabulary, scoped to #view-manage there (task 1003345) ── */
 #view-manage .empty{text-align:left;}
 #view-manage .empty p{margin-bottom:0;}
+/* the publish gate's one field (task 1002335). The description is prose, so it
+   is a textarea — and it wears a skin scoped to THIS view, because the wizard's
+   field rules are scoped to #view-new and borrowing them would couple the two.
+   Same grammar as those fields, though: one bottom hairline that takes ink on
+   focus, never a box — the manage page is cosmos vocabulary throughout. */
+#view-manage textarea{
+  width:100%;font-family:var(--font-body);font-size:15.5px;font-weight:400;color:var(--ink);line-height:1.5;
+  background:none;border:0;border-bottom:1px solid var(--rule);border-radius:0;padding:8px 0;outline:none;
+  resize:vertical;min-height:64px;display:block;
+  transition:border-color .15s ease;
+}
+#view-manage textarea::placeholder{color:var(--ink-faint);font-weight:400;}
+#view-manage textarea:focus{border-bottom-color:var(--ink);box-shadow:none;}
+/* the verdict leads the card — it is the answer, not fine print */
+#view-manage .pubVerdict{font-size:15px;font-weight:500;line-height:1.55;color:var(--ink-soft);margin-bottom:14px;}
+#view-manage .pubVerdict b{font-weight:700;color:var(--ink);}
 
 /* The bongo pair on the New-project view. Component-scoped custom properties,
    never :root (C1). The drum head is SKIN — using --bg-card would turn it black
@@ -690,6 +706,29 @@ summary{min-height:24px;padding:3px 0;}
         <div class="actions" id="mActs" hidden></div>
       </div>
 
+      <!-- live since task 1002335 (BV1.R16): the PUBLISH GATE. A project is on
+           the public map if and only if it has a name and a description — that
+           is the whole bar (ADR 0182 D4), identity only, deliberately not a
+           completeness check. Until it is met the project is DARK MATTER: off
+           the map and un-joinable. This card is the "name what is missing" half
+           of that decision, because a project that cannot be published and is
+           not told why is indistinguishable from a broken one.
+           The verdict rendered here is the SERVER's (instance.publish, derived
+           from the one gate definition platform-identity owns and hands over
+           the kernel seam) — never re-derived in the browser, which is how two
+           surfaces start telling one owner two different stories about one rule.
+           Hidden outright when the server sent no verdict: a platform with no
+           public map has nothing to say here, and inventing a local rule to
+           fill the silence is exactly what the seam exists to prevent. -->
+      <div class="card mSec" id="mPublish" hidden>
+        <h2>On the public map</h2>
+        <div id="mPub"><p class="finePrint">Reading the project…</p></div>
+        <details class="finePrint" id="mPubWhat">
+          <summary>What puts a project on the map</summary>
+          <p>Two things, and only two: a name — this project already has one — and a description of what it is. Modules, artwork, a finished setup interview: none of them are required, because the bar is there to keep empty shells off the map, not to make you finish anything. Until it is met the project is not listed publicly and nobody can ask to join it; the project itself runs exactly the same either way. Adding a description puts it on the map, and clearing one takes it back off.</p>
+        </details>
+      </div>
+
       <!-- its address (task 1003355): the bring-your-own-domain control, moved
            off the list row when a row shrank to view and manage. Its home is
            here, under the ledger's address fact. The section hides itself where
@@ -4577,6 +4616,22 @@ summary{min-height:24px;padding:3px 0;}
         : '<a href="?view=manage&id=' + esc(String(inst.id)) + '" data-manage="' + esc(String(inst.id)) + '">Give it an address on its own page</a>.');
   }
 
+  /* the publish gate on the LIST card (task 1002335, BV1.R16). Only the refusal
+     earns a line here: being on the map is the expected state, and a card that
+     announces it for every healthy project is noise — while a project that is
+     invisible and never told why reads as broken (ADR 0182 D4). It names what is
+     missing in the server's own words and points at the one page that fixes it.
+     A torn-down project is silent: nothing about the public map is its problem
+     while it is off. */
+  function publishRow(inst) {
+    var v = inst && inst.publish;
+    if (!v || v.publishable) return '';
+    if (inst.status === 'torn_down' || inst.status === 'tearing_down') return '';
+    return 'Not on the public map yet — it has ' + esc(v.missing_phrase || 'no description') +
+      '. <a href="?view=manage&id=' + esc(String(inst.id)) + '" data-manage="' + esc(String(inst.id)) +
+      '">Say what it is</a> and it goes on.';
+  }
+
   function renderCard(inst) {
     /* iid is for MARKUP interpolation only (esc() = HTML escape); the DOM
        lookup goes through liFor(), which CSS-escapes — the two escapes are
@@ -4598,6 +4653,8 @@ summary{min-height:24px;padding:3px 0;}
       (meta.length ? '<div class="projMeta">' + meta.map(function (m) { return '<span>' + m + '</span>'; }).join('') + '</div>' : '');
     var addr = addressRow(inst);
     if (addr) body += '<div class="addr">' + addr + '</div>';
+    var pub = publishRow(inst);
+    if (pub) body += '<div class="projMsg">' + pub + '</div>';
     if ((inst.status === 'error' || inst.error_note) && !inst.open_intent) {
       /* once a retry is queued the strip tells the story — the stale error
          paragraph would just contradict it (owner walk, 2026-08-12). Also
@@ -5111,6 +5168,11 @@ summary{min-height:24px;padding:3px 0;}
            the GitHub read: entry + tab return, never the in-flight tick */
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
+        /* the publish gate (task 1002335) needs no second read — the verdict
+           rode in on the instance itself. It sits behind the same keepRepo
+           guard because its card holds a textarea the in-flight tick must
+           never repaint out from under a typing owner. */
+        if (!keepRepo) renderPublish(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -5256,6 +5318,101 @@ summary{min-height:24px;padding:3px 0;}
     if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
   });
 
+  /* ── on the public map (task 1002335, BV1.R16): the publish gate ──────────
+     The verdict is the SERVER's — instance.publish, derived from the ONE gate
+     definition platform-identity owns and publishes over the kernel seam (ADR
+     0182 D4). This page renders it and offers the one identity field that can
+     be missing; it never re-derives the rule, because a browser-side copy is
+     how the card and the server start disagreeing about whether a project is
+     published. No verdict at all (an instance whose platform runs no public
+     map) hides the card rather than guessing.
+
+     Rendered on ENTRY and after a save — deliberately NOT from renderManage,
+     which the fetch-free minute tick and the in-flight watch both call: this
+     card holds a textarea, and a repaint mid-sentence would eat what the owner
+     is typing. Nothing the server does in the background changes the answer
+     anyway; only this form does. ── */
+
+  function pubMsg(html) { $('mPub').innerHTML = html; }
+
+  function renderPublish(inst) {
+    var v = inst && inst.publish;
+    if (!v) { $('mPublish').hidden = true; return; }
+    $('mPublish').hidden = false;
+    var on = !!v.publishable;
+    /* the refusal NAMES what is absent, in the server's own words (ADR 0182
+       D4) — a project told only "no" is indistinguishable from a broken one */
+    var verdict = on
+      ? '<b>' + esc(inst.slug) + ' is on the public map.</b> People can find it and ask to join.'
+      : '<b>' + esc(inst.slug) + ' is not on the public map yet</b> — it has ' +
+        esc(v.missing_phrase || 'no description') +
+        '. Nobody can find it there or ask to join until it does.';
+    pubMsg('<p class="pubVerdict">' + verdict + '</p>' +
+      '<label class="wizField" for="mPubDesc"><span>What is this project?' +
+      ' <small>' + (on ? 'Change it any time.' : 'A sentence or two is plenty.') + '</small></span>' +
+      '<textarea id="mPubDesc" maxlength="600" rows="3" placeholder="A weather simulator you can play with in the browser."></textarea></label>' +
+      '<div class="actions"><button type="button" class="btn small" data-pub-save>' +
+      (on ? 'Save' : 'Put it on the map') + '</button></div>' +
+      '<div class="projMsg" id="mPubMsg" role="status" aria-live="polite"></div>');
+    /* the owner's own prose is set as a PROPERTY, never interpolated into the
+       markup above — what someone typed about their project is not HTML */
+    $('mPubDesc').value = inst.description || '';
+  }
+
+  /* Saving sends the description and takes the server's verdict WHOLE. An empty
+     box is a real answer, not a no-op: it clears the description and the project
+     leaves the map — the honest consequence of deleting half the identity gate,
+     which is why the receipt says so instead of just "Saved." */
+  function doPubSave() {
+    var ta = $('mPubDesc');
+    if (!manageInst || !ta) return;
+    var box = $('mPubMsg');
+    var btn = document.querySelector('#mPub [data-pub-save]');
+    if (btn) btn.disabled = true;
+    box.className = 'projMsg'; box.textContent = 'Saving…';
+    var asked = manageId; /* a stale answer must never repaint a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/detail', {
+      method: 'PATCH', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ description: ta.value })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (asked !== manageId) return;
+        if (res.status === 401) { box.className = 'projMsg err'; box.innerHTML = signInAgain(); return; }
+        if (!res.ok) {
+          var e = apiError(data, res.status);
+          box.className = 'projMsg err';
+          box.textContent = e.message || 'The description could not be saved — try again in a moment.';
+          return;
+        }
+        manageInst.description = data.description || null;
+        manageInst.publish = data.publish || manageInst.publish;
+        renderPublish(manageInst);
+        var m = $('mPubMsg'); /* the re-render replaced the box this closure held */
+        m.className = 'projMsg ok';
+        m.textContent = (manageInst.publish && manageInst.publish.publishable)
+          ? 'Saved — it’s on the public map.'
+          : 'Saved. With no description it stays off the public map.';
+        /* the list card carries the same verdict, and the owner may go back */
+        if (byId[manageInst.id]) {
+          byId[manageInst.id].description = manageInst.description;
+          byId[manageInst.id].publish = manageInst.publish;
+        }
+      });
+    }).catch(function () {
+      if (asked !== manageId) return;
+      var b = $('mPubMsg');
+      if (b) { b.className = 'projMsg err'; b.textContent = 'Couldn’t reach the platform — check your connection and try again.'; }
+    }).then(function () {
+      var b = document.querySelector('#mPub [data-pub-save]');
+      if (b) b.disabled = false;
+    });
+  }
+
+  $('mPub').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (t && t.hasAttribute('data-pub-save')) doPubSave();
+  });
+
   /* ── who can see it (task 1003043): the platform-visibility toggle. Two
      reads, kept apart on purpose: the CHOICE comes from the platform's own
      settings row (what the owner asked for), and the line under it reads what

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.508",
+  "version": "1.19.510",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.508",
+      "version": "1.19.510",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.508",
+  "version": "1.19.510",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.508'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.510'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -1813,6 +1813,68 @@ test('one row grammar: the every-project row and the Your-projects row lay the S
   assert.match(COSMOS, /#sub-table-body\{overflow-x:auto;\}/, 'the wrap scrolls, never the page');
 });
 
+// ── the publish gate on the owner's own pages (task 1002335, BV1.R16) ────────
+
+test('the manage page carries an "on the public map" card, and it ships as real markup', () => {
+  const card = (HUB.match(/<div class="card mSec" id="mPublish"[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, '#mPublish ships as markup, not built by script (C7)');
+  assert.match(card, /hidden/, 'hidden until the server sends a verdict — a platform with no map says nothing');
+  assert.match(card, /id="mPub"/, 'the volatile slot the verdict renders into');
+  // the explanation is a SIBLING of the volatile slot, the #mRepoVisWhy shape, so
+  // no re-render of the slot can drop it
+  assert.match(card, /<details class="finePrint" id="mPubWhat">/);
+  assert.match(card, /keep empty shells off the map/, 'it says why the bar exists, not just what it is');
+});
+
+test('the verdict rendered is the SERVER’s — the browser never re-derives the gate', () => {
+  const fn = (SCRIPT.match(/function renderPublish\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'renderPublish exists');
+  assert.match(fn, /inst && inst\.publish/, 'it reads the verdict off the instance');
+  assert.match(fn, /v\.missing_phrase/, 'and names what is missing in the server’s own words (ADR 0182 D4)');
+  // no second copy of the two-field rule anywhere in the page
+  assert.doesNotMatch(SCRIPT, /publishable\s*=\s*[^;]*description/,
+    'the page must never compute publishability itself — that is how two surfaces disagree');
+  // a missing verdict HIDES the card rather than guessing one
+  assert.match(fn, /if \(!v\) \{ \$\('mPublish'\)\.hidden = true; return; \}/);
+});
+
+test('the owner’s prose is set as a property, never interpolated into markup', () => {
+  const fn = (SCRIPT.match(/function renderPublish\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /\$\('mPubDesc'\)\.value = inst\.description \|\| '';/,
+    'what someone typed about their project is not HTML');
+  assert.doesNotMatch(fn, /esc\(inst\.description/, 'and it never rides the innerHTML string at all');
+});
+
+test('the publish card is rendered on entry only — the in-flight tick must not eat a half-typed sentence', () => {
+  // renderManage() is called by the fetch-free minute tick AND the 5s in-flight
+  // watch. A textarea repainted from either loses the caret and the text.
+  const renderManage = (SCRIPT.match(/function renderManage\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.doesNotMatch(renderManage, /renderPublish/,
+    'renderPublish must NOT hang off the repaint path');
+  assert.match(SCRIPT, /if \(!keepRepo\) renderPublish\(inst\);/,
+    'it rides the entry + tab-return guard the other fetching sections use');
+});
+
+test('saving the description takes the server’s verdict whole, and clearing it is a real answer', () => {
+  const fn = (SCRIPT.match(/function doPubSave\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.match(fn, /\/detail'/, 'it PATCHes the detail route R15 built as the way back');
+  assert.match(fn, /method: 'PATCH'/);
+  assert.match(fn, /manageInst\.publish = data\.publish \|\| manageInst\.publish/,
+    'the verdict comes back from the server, not from what was typed');
+  assert.match(fn, /stays off the public map/,
+    'clearing the description un-publishes the project, and the receipt says so');
+});
+
+test('a dark-matter project says so on its list card too, and only then', () => {
+  const fn = (SCRIPT.match(/function publishRow\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'publishRow exists');
+  assert.match(fn, /if \(!v \|\| v\.publishable\) return '';/,
+    'being on the map is the expected state — announcing it on every card is noise');
+  assert.match(fn, /torn_down/, 'a torn-down project has no business being told about the public map');
+  assert.match(fn, /view=manage&id=/, 'the refusal points at the one page that fixes it');
+  assert.match(SCRIPT, /var pub = publishRow\(inst\);/, 'and the card actually renders it');
+});
+
 test('the sort left the column head for a control the keyboard and a screen reader can both read (task 1003356)', () => {
   // aria-sort is only valid on a columnheader; with no header row the order has
   // to be stated by the control itself and by a sentence in a live region

package/tests/provisioning_starter_bundles.mjs

@@ -0,0 +1,268 @@
+// tests/provisioning_starter_bundles.mjs — the curated starter bundles (BV1.R19,
+// task 1002338; goal 1000046 criterion `proj-module-select`).
+//
+// Three things are pinned here, and the middle one is the reason this file exists.
+//
+//   1. The resolver — bundleForProjectType(type) for each declared type, and the
+//      core-only fallback for a type nobody declared. A creation form must never
+//      be handed a guess.
+//   2. Bundle <-> catalog integrity — a bundle is a list of module KEYS, declared
+//      in a pure file that may not import the live catalog (the one-way rule, ADR
+//      0083). This test IS the link: it reads every modules/*/module.json off disk
+//      and fails the build the moment a bundle names a module that does not exist,
+//      names an always-on one (a preselect that toggles nothing), or the declared
+//      always-on list drifts from the manifests' `default: true` set.
+//   3. The read surface — GET /provisioning/starter-bundles is public and returns
+//      exactly what the resolver returns, so R20's picker and R17's rule engine
+//      cannot read a different answer than a script would.
+//
+// DB-free: the route is a pure read, so nothing here touches Postgres or the
+// network beyond a loopback listener on port 0.
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_starter_bundles.mjs
+
+import { test, before, after } from 'node:test';
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+// ESM named imports off the CJS module on purpose: knip cannot trace a
+// createRequire() import, so a test-only export would read as dead code and move
+// the knip ratchet (see the repo's knip learning).
+import {
+  ALWAYS_ON_CORE,
+  STARTER_BUNDLES,
+  HUB_ONLY_MODULES,
+  bundleForProjectType,
+  allStarterBundles,
+} from '../modules/provisioning/starter-bundles.js';
+
+const require = createRequire(import.meta.url);
+
+// Stub the doorway in require.cache BEFORE the route file loads (the
+// access_requests_invite pattern): the route destructures `pool` at require time,
+// and a real pg pool would hold the event loop open long after the assertions
+// pass. Nothing here needs a database — the route under test is a pure read.
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+require.cache[apiPath].exports = {
+  ...realApi,
+  pool: { async query() { throw new Error('the starter-bundles route must not touch the database'); } },
+};
+
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+const MODULES_DIR = fileURLToPath(new URL('../modules', import.meta.url));
+
+// Every module key on disk, with the manifest's `default` — the live catalog as
+// the loader discovers it (src/module-loader/loader.js scans exactly this).
+function manifestsOnDisk() {
+  const out = new Map();
+  for (const ent of fs.readdirSync(MODULES_DIR, { withFileTypes: true })) {
+    if (!ent.isDirectory()) continue;
+    const manifestPath = path.join(MODULES_DIR, ent.name, 'module.json');
+    if (!fs.existsSync(manifestPath)) continue;
+    const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    out.set(manifest.key, manifest);
+  }
+  return out;
+}
+
+// ── the resolver ────────────────────────────────────────────────────────────
+
+test('bundleForProjectType returns the always-on core plus the type\'s opt-in modules', () => {
+  // Arrange
+  const type = 'game';
+
+  // Act
+  const resolved = bundleForProjectType(type);
+
+  // Assert
+  assert.equal(resolved.type, 'game');
+  assert.deepEqual(resolved.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(resolved.bundle, [...STARTER_BUNDLES.game.modules]);
+  assert.deepEqual(resolved.modules, [...ALWAYS_ON_CORE, ...STARTER_BUNDLES.game.modules]);
+  assert.ok(resolved.label && resolved.summary, 'carries owner-facing copy for the picker to render');
+});
+
+test('every declared project type resolves to a bundle', () => {
+  // Arrange — the shipped vocabulary (task 1002772, owner decision 2026-08-13).
+  const declared = provisioning.PROJECT_TYPES;
+
+  // Act + Assert
+  for (const type of declared) {
+    const resolved = bundleForProjectType(type);
+    assert.equal(resolved.type, type, `${type} resolves to itself, not the fallback`);
+  }
+  assert.deepEqual(
+    Object.keys(STARTER_BUNDLES).sort(),
+    [...declared].sort(),
+    'the bundle table covers the declared type vocabulary exactly — no missing type, no invented one',
+  );
+});
+
+test('an undeclared or unknown project type falls back to the core, and never guesses a type', () => {
+  // A project may have no type at all: the column is nullable because every row
+  // predates the field and must not be back-filled with a guess (migration
+  // provisioning_007). The fallback must be honest about that.
+  for (const type of [null, undefined, '', 'saas-tool', 'GAME', 42, {}]) {
+    // Act
+    const resolved = bundleForProjectType(type);
+
+    // Assert
+    assert.equal(resolved.type, null, `${JSON.stringify(type)} → no declared type`);
+    assert.deepEqual(resolved.bundle, [], 'nothing is preselected on a guess');
+    assert.deepEqual(resolved.modules, [...ALWAYS_ON_CORE]);
+  }
+});
+
+test('"not-sure" is a real answer that resolves to the core only, distinct from an undeclared type', () => {
+  // Arrange + Act
+  const notSure = bundleForProjectType('not-sure');
+  const undeclared = bundleForProjectType(null);
+
+  // Assert — same modules, different provenance: one owner said "not sure", the
+  // other said nothing at all, and the picker should be able to tell them apart.
+  assert.deepEqual(notSure.modules, undeclared.modules);
+  assert.equal(notSure.type, 'not-sure');
+  assert.equal(undeclared.type, null);
+  assert.deepEqual(notSure.bundle, [], 'the escape hatch adds nothing — nothing depends on it');
+});
+
+test('a caller mutating a resolved bundle cannot corrupt the declaration', () => {
+  // Arrange
+  const first = bundleForProjectType('game');
+
+  // Act
+  first.modules.push('not-a-module');
+  first.bundle.length = 0;
+  first.core.length = 0;
+
+  // Assert
+  const second = bundleForProjectType('game');
+  assert.deepEqual(second.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(second.bundle, [...STARTER_BUNDLES.game.modules]);
+  assert.ok(!second.modules.includes('not-a-module'));
+});
+
+test('allStarterBundles returns one resolved bundle per declared type', () => {
+  // Act
+  const all = allStarterBundles();
+
+  // Assert
+  assert.deepEqual(all.map((b) => b.type), Object.keys(STARTER_BUNDLES));
+  for (const row of all) assert.deepEqual(row, bundleForProjectType(row.type));
+});
+
+// ── bundle <-> catalog integrity ────────────────────────────────────────────
+
+test('every module a bundle names exists in the module catalog', () => {
+  // Arrange
+  const onDisk = manifestsOnDisk();
+  assert.ok(onDisk.size > 0, 'read the manifests off disk');
+
+  // Act + Assert
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(onDisk.has(key), `bundle "${type}" names "${key}", which is not a module on disk`);
+    }
+  }
+});
+
+test('every always-on module is a real module whose manifest says default: true', () => {
+  // Arrange
+  const onDisk = manifestsOnDisk();
+
+  // Act + Assert
+  for (const key of ALWAYS_ON_CORE) {
+    assert.ok(onDisk.has(key), `ALWAYS_ON_CORE names "${key}", which is not a module on disk`);
+    assert.equal(onDisk.get(key).default, true, `"${key}" is listed as always-on but its manifest is not default: true`);
+  }
+  const defaultsOnDisk = [...onDisk.values()].filter((m) => m.default === true).map((m) => m.key).sort();
+  assert.deepEqual(
+    [...ALWAYS_ON_CORE].sort(),
+    defaultsOnDisk,
+    'the declared always-on list has drifted from the manifests — a module was added, removed, or flipped its default',
+  );
+});
+
+test('a bundle may only add opt-in modules — never one that is already always-on', () => {
+  // A preselect that names an always-on module toggles nothing and reads to the
+  // owner as a choice they made; that is a lie the picker would render.
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(!ALWAYS_ON_CORE.includes(key), `bundle "${type}" names always-on module "${key}"`);
+    }
+  }
+});
+
+test('no bundle names a hub-only module', () => {
+  // platform-identity and provisioning are the control plane's own modules — the
+  // hub runs them, a project created THROUGH the hub never should.
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    for (const key of bundle.modules) {
+      assert.ok(!HUB_ONLY_MODULES.includes(key), `bundle "${type}" names hub-only module "${key}"`);
+    }
+  }
+});
+
+test('a bundle lists each module once', () => {
+  for (const [type, bundle] of Object.entries(STARTER_BUNDLES)) {
+    assert.equal(new Set(bundle.modules).size, bundle.modules.length, `bundle "${type}" repeats a module`);
+  }
+});
+
+// ── the read surface ────────────────────────────────────────────────────────
+
+// Mount the real router. The route under test is a pure read, so it needs no
+// session gate and no res.fail helper — which is itself the point of the
+// assertion below.
+const express = require('express');
+const buildProvisioningRouter = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use('/api/bongos', buildProvisioningRouter());
+
+let server;
+let port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  port = server.address().port;
+});
+after(async () => { await new Promise((resolve) => server.close(resolve)); });
+
+function get(pathname) {
+  return new Promise((resolve, reject) => {
+    http.get({ host: '127.0.0.1', port, path: pathname }, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => {
+        let parsed = null;
+        try { parsed = JSON.parse(body); } catch { /* non-JSON */ }
+        resolve({ status: res.statusCode, body: parsed, raw: body });
+      });
+    }).on('error', reject);
+  });
+}
+
+test('GET /provisioning/starter-bundles is public and serves the resolved bundles', async () => {
+  // Act — no session: `rank: public`, the same gate (none) the signed-out create
+  // wizard reads GET /provisioning/onboard-plan with.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+
+  // Assert
+  assert.equal(res.status, 200, `readable with no session (got ${res.status} ${res.raw})`);
+  assert.deepEqual(res.body.core, [...ALWAYS_ON_CORE]);
+  assert.deepEqual(res.body.bundles, allStarterBundles());
+  assert.equal(res.body.bundles.length, provisioning.PROJECT_TYPES.length);
+});
+
+test('the route never reaches the database — the bundles are a declaration, not a query', async () => {
+  // The stubbed pool throws on any query, so a 200 here IS the assertion: an
+  // owner picking a type in the wizard must not cost a round trip to Postgres.
+  const res = await get('/api/bongos/provisioning/starter-bundles');
+  assert.equal(res.status, 200);
+});