@bongos/core 1.19.514 → 1.19.516

package/modules/public-landing/public/projects.html

@@ -328,6 +328,16 @@ summary{min-height:24px;padding:3px 0;}
 .tpill:hover::before{border-color:var(--ink-faint);}
 .tpill[aria-pressed=true]{background:none;border-color:var(--rule-soft);color:var(--ink);}
 .tpill[aria-pressed=true]::before{background:var(--accent);border-color:var(--accent);outline:4px solid color-mix(in srgb,var(--accent) 22%,transparent);}
+/* the module picker (task 1002339) wears the SAME band as the type and team
+   questions — one hairline cell per choice, the dot on the chosen ones. The only
+   difference is that a module carries a one-line summary under its name, so its
+   cells stack full width and align to the top instead of centring on one line. */
+#modCards{grid-template-columns:1fr;}
+#modCards .tpill{align-items:flex-start;border-left:0;padding-left:0;border-top:1px solid var(--rule-soft);}
+#modCards .tpill:first-child{border-top:0;}
+#modCards .tpill::before{margin-top:5px;}
+#modCards .tpill b{display:block;font-weight:500;}
+#modCards .tpill small{display:block;font-family:var(--font-body);font-size:14px;font-weight:400;color:var(--ink-soft);line-height:1.5;max-width:62ch;margin-top:3px;}
 .typeCard{border:0;border-radius:0;padding:4px 0 0;margin-bottom:6px;background:none;}
 .typeCard b{display:block;font-family:var(--font-body);font-size:15px;font-weight:500;color:var(--ink);margin-bottom:4px;}
 .typeCard p{font-size:14px;font-weight:400;color:var(--ink-soft);line-height:1.5;max-width:62ch;}
@@ -877,9 +887,10 @@ summary{min-height:24px;padding:3px 0;}
         <li class="now" data-step="1" aria-current="step"><span class="snum">1</span><span class="slbl">Name</span></li>
         <li data-step="2"><span class="snum">2</span><span class="slbl">Type</span></li>
         <li data-step="3"><span class="snum">3</span><span class="slbl">About</span></li>
-        <li data-step="4"><span class="snum">4</span><span class="slbl">Home</span></li>
-        <li data-step="5"><span class="snum">5</span><span class="slbl">Address</span></li>
-        <li data-step="6"><span class="snum">6</span><span class="slbl">Create</span></li>
+        <li data-step="4"><span class="snum">4</span><span class="slbl">Modules</span></li>
+        <li data-step="5"><span class="snum">5</span><span class="slbl">Home</span></li>
+        <li data-step="6"><span class="snum">6</span><span class="slbl">Address</span></li>
+        <li data-step="7"><span class="snum">7</span><span class="slbl">Create</span></li>
       </ol>
 
       <div class="createSplit">
@@ -993,11 +1004,41 @@ summary{min-height:24px;padding:3px 0;}
             </form>
           </section>
 
-          <!-- step 4 · home (repo + mode) -->
+          <!-- step 4 · modules (task 1002339, BV1.R20) — the picker. Skippable
+               like About, and for the same reason: an owner who has met none of
+               these modules should not have to audit a list to get a project.
+               What Skip means here is spelled out on the panel and is TRUE by
+               construction — the request omits the field, and the server resolves
+               the same starter bundle this panel preselected (ADR 0237), so the
+               set is the one they were shown either way.
+
+               The always-on core is stated as a clause, never as a row of dead
+               toggles: sixteen disabled controls read as choices the owner failed
+               to make, when in fact they were never choices. -->
+          <section class="panel" id="panel-modules" aria-labelledby="mod-h">
+            <h1 id="mod-h">What it comes with</h1>
+            <p class="lede">Optional — skip it and you get the suggested set below. These are extras on top of everything every project already has, and you can switch any of them on or off later.</p>
+            <form data-next="5">
+              <div class="wizField"><span id="modLbl">Extras for this project</span>
+                <div class="typeCards" id="modCards" role="group" aria-labelledby="modLbl"></div>
+              </div>
+              <div class="reassure" id="modCoreNote"></div>
+              <div class="hint" id="h-modules">&nbsp;</div>
+              <div class="nav">
+                <button type="button" class="btn ghost" data-back="3">← Back</button>
+                <span class="navPair">
+                  <button type="button" class="btn ghost" id="skipModules">Skip for now</button>
+                  <button type="submit" class="btn">Next →</button>
+                </span>
+              </div>
+            </form>
+          </section>
+
+          <!-- step 5 · home (repo + mode) -->
           <section class="panel" id="panel-home" aria-labelledby="home-h">
             <h1 id="home-h">Where the code lives</h1>
             <p class="lede">Every project is a real GitHub repository that you own. Start from a clean slate, or bring a repo you already have.</p>
-            <form data-next="5">
+            <form data-next="6">
               <div class="choices" role="group" aria-label="Starting point">
                 <button type="button" class="choice" id="c-green" aria-pressed="true">
                   <!-- token-built, not platform orange — public-landing/ ships wholesale to
@@ -1056,13 +1097,13 @@ summary{min-height:24px;padding:3px 0;}
               </div>
               <div class="hint" id="h-home">&nbsp;</div>
               <div class="nav">
-                <button type="button" class="btn ghost" data-back="3">← Back</button>
+                <button type="button" class="btn ghost" data-back="4">← Back</button>
                 <button type="submit" class="btn">Next →</button>
               </div>
             </form>
           </section>
 
-          <!-- step 5 · address — a CONFIRMATION, not a form (task 1002704: every project
+          <!-- step 6 · address — a CONFIRMATION, not a form (task 1002704: every project
                gets its slug subdomain assigned up front). The domainless default was a
                proven dead-end (QA walk, task 1002702).
                Three choices, all legible without opening anything (task 1002898 N8):
@@ -1074,7 +1115,7 @@ summary{min-height:24px;padding:3px 0;}
           <section class="panel" id="panel-address" aria-labelledby="addr-h">
             <h1 id="addr-h">Its address in the sky</h1>
             <p class="lede">The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub steps (the next screen walks you through them) switch sign-in on.</p>
-            <form data-next="6">
+            <form data-next="7">
               <label class="wizField"><span>Project handle</span>
                 <input type="text" id="f-slug" placeholder="mercury" autocomplete="off" maxlength="40" spellcheck="false">
                 <div class="hint" id="h-slug">&nbsp;</div>
@@ -1096,20 +1137,20 @@ summary{min-height:24px;padding:3px 0;}
                 </label>
               </div>
               <div class="nav">
-                <button type="button" class="btn ghost" data-back="4">← Back</button>
+                <button type="button" class="btn ghost" data-back="5">← Back</button>
                 <button type="submit" class="btn">Next →</button>
               </div>
             </form>
           </section>
 
-          <!-- step 6 · review + create -->
+          <!-- step 7 · review + create -->
           <section class="panel" id="panel-review" aria-labelledby="rev-h">
             <h1 id="rev-h">Ready to roll</h1>
             <p class="lede">One tap files the request and the platform starts standing your project up — server, database, address. Here's the beat you're about to drop:</p>
             <ul class="review" id="reviewList"></ul>
             <div class="alert" id="createAlert" role="alert"></div>
             <div class="nav">
-              <button type="button" class="btn ghost" data-back="5">← Back</button>
+              <button type="button" class="btn ghost" data-back="6">← Back</button>
               <button type="button" class="btn big" id="doCreate">Create my project</button>
             </div>
             <p class="finePrint">This files the request; the control plane does the real standup and nothing touches servers from this page. You'll get the few steps only you can do right after.</p>
@@ -2690,11 +2731,16 @@ summary{min-height:24px;padding:3px 0;}
        reinterpreted — a stale step 4 meant Address under v1 and Home under v3,
        and replaying it would land on the wrong panel with the rail already
        marking the skipped ones done. Bump this key on EVERY renumbering. */
-    var DRAFT_KEY = 'cb-create-draft-v3';
+    var DRAFT_KEY = 'cb-create-draft-v4';
     var CREATED_KEY = 'cb-created-instance';
     /* `description` + `teamShape` are the optional About step (task 1002334) —
        both legitimately stay empty, and empty is what the create request omits. */
-    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
+    /* `modules` is the picker's answer (task 1002339) and is THREE-VALUED like
+       the column behind it: null = not answered (the preselect is shown and the
+       request omits the field), [] = the owner switched them all off, [...] =
+       what they picked. Never seed it with the preselect — that would store an
+       answer nobody gave. */
+    var state = { step: 0, name: '', projType: null, description: '', teamShape: null, modules: null, mode: 'greenfield', owner: '', ownerTouched: false, repo: '', repoTouched: false, slug: '', slugTouched: false, domain: '', noAddress: false };
     try { Object.assign(state, JSON.parse(sessionStorage.getItem(DRAFT_KEY) || '{}')); } catch (e) {}
     var authKnown = false;   /* flips true when the boot's /me settles, either way */
 
@@ -2708,7 +2754,7 @@ summary{min-height:24px;padding:3px 0;}
         state.name = handedName.trim().slice(0, 80);
         state.slug = deriveSlug(state.name); state.slugTouched = false;
         state.repo = deriveRepo(state.name); state.repoTouched = false;
-        state.step = state.step >= 1 && state.step <= 6 ? state.step : 1;
+        state.step = state.step >= 1 && state.step <= 7 ? state.step : 1;
         try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
       }
     } catch (e) {}
@@ -2900,17 +2946,18 @@ summary{min-height:24px;padding:3px 0;}
     }
 
     /* ── step navigation ──
-       Seven steps since task 1002334: gate 0 · name 1 · type 2 · about 3 ·
-       home 4 · address 5 · review 6 · done 7 (the rail shows 1-6; done marks it
-       all). About is the one step Next can pass with nothing filled in. */
-    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-detail', 4: 'panel-home', 5: 'panel-address', 6: 'panel-review', 7: 'panel-done' };
+       Eight steps since task 1002339: gate 0 · name 1 · type 2 · about 3 ·
+       modules 4 · home 5 · address 6 · review 7 · done 8 (the rail shows 1-7;
+       done marks it all). About and Modules are the two steps Next can pass with
+       nothing filled in. */
+    var panels = { 0: 'panel-gate', 1: 'panel-name', 2: 'panel-type', 3: 'panel-detail', 4: 'panel-modules', 5: 'panel-home', 6: 'panel-address', 7: 'panel-review', 8: 'panel-done' };
     /* the rail at the done panel (task 1003244): "done" is the Create step
        still running — the marker stays on 5 until the project actually
        answers, and only then does the whole rail read finished. aria-current
        tells a screen reader the same thing. */
     function paintRail(step) {
-      var landed = step === 7 && !!(live && live.instStatus === 'active');
-      var cur = step === 7 ? 6 : step;
+      var landed = step === 8 && !!(live && live.instStatus === 'active');
+      var cur = step === 8 ? 7 : step;
       root.querySelectorAll('.steps li').forEach(function (li) {
         var n = Number(li.getAttribute('data-step'));
         var now = !landed && n === cur;
@@ -2921,7 +2968,7 @@ summary{min-height:24px;padding:3px 0;}
            the button role, the tab stop and the data-goto the delegated handler
            below reads. The done panel offers none — the project is filed, and
            there is nothing behind it to change. */
-        if (step < 7 && n < cur) {
+        if (step < 8 && n < cur) {
           li.setAttribute('role', 'button');
           li.setAttribute('tabindex', '0');
           li.setAttribute('data-goto', String(n));
@@ -2940,7 +2987,7 @@ summary{min-height:24px;padding:3px 0;}
       paintRail(step);
       saveDraft();
       /* the done step takes the whole card — the bongo pair steps aside */
-      root.querySelector('.createSplit').classList.toggle('wizDone', step === 7);
+      root.querySelector('.createSplit').classList.toggle('wizDone', step === 8);
       /* focus moves ONLY on a deliberate step (the hub rule setView already
          applies to this view: never on boot, never on a background settle) */
       if (moveFocus) {
@@ -2950,15 +2997,18 @@ summary{min-height:24px;padding:3px 0;}
       /* the repo probe is authenticated — never fire it before /me settles
          (a pre-auth probe 401s for strangers and, worse, could seed the
          draft's owner with myLogin()'s placeholder) */
-      if (step === 4) { syncHome(); if (authKnown) ensureRepoAccess(); }
+      /* the picker repaints on entry, not once at boot: the owner can walk back
+         to the Type step and change the answer the preselect is keyed to */
+      if (step === 4) renderModules();
+      if (step === 5) { syncHome(); if (authKnown) ensureRepoAccess(); }
       /* a resumed draft can land PAST the Home step with the probe never run —
          Create would then file a repo it promised to make but never did */
-      else if (step > 4 && step < 7 && authKnown && repoAccess === null) ensureRepoAccess();
+      else if (step > 5 && step < 8 && authKnown && repoAccess === null) ensureRepoAccess();
       /* re-check on every entry, not just on typing: a resumed draft arrives here with
          a handle nobody has asked the server about, and a handle free ten minutes ago
          may not be now (task 1002898 N10) */
-      if (step === 5) { checkSlugAvailable(); renderAddrPanel(); }
-      if (step === 6) renderReview();
+      if (step === 6) { checkSlugAvailable(); renderAddrPanel(); }
+      if (step === 7) renderReview();
     }
 
     /* One delegated pair on the rail, so paintRail can add and drop data-goto
@@ -3110,6 +3160,142 @@ summary{min-height:24px;padding:3px 0;}
        then pressed Skip meant "I'm done here", not "throw that away". */
     $('skipDetail').addEventListener('click', function () { show(4, true); });
 
+    /* ── the module picker (task 1002339, BV1.R20) ──
+       ONE public read gives the panel both halves it needs: `optional` is the
+       catalog it renders, `bundles` is what each project type preselects
+       (GET /provisioning/starter-bundles, ADR 0237). They arrive together
+       because a second round trip is exactly what would let a preselect name a
+       module the panel has no row for.
+
+       state.modules is null until the owner SAYS something — a toggle, or Next
+       off this panel. While it is null the panel paints the bundle and the
+       create request omits the field, and the server resolves the same bundle
+       from the same declaration. So "skip" and "accept what you were shown"
+       reach the same modules by construction rather than by two copies of a
+       list agreeing. Changing the project type while nothing has been said
+       re-preselects for free; once the owner has answered, their answer stands.
+
+       No fetch failure mode is fatal: with no catalog the band renders its
+       "couldn't load" clause, state.modules stays null, and the create still
+       files — the server applies the bundle. A picker that could block a
+       project from being created would be worse than no picker. */
+    var starterBundles = null;   /* the payload once it lands; null until then */
+    var bundlesPromise = null;   /* memoised like fetchPlan below — entering the step twice asks once */
+    var bundlesFailed = false;   /* asked and did not get it; distinct from not yet asked */
+    /* Lazy, not at boot: /projects serves four views from one file, and the map
+       has no business paying for the picker's read. */
+    function ensureBundles() {
+      if (bundlesPromise) return bundlesPromise;
+      bundlesPromise = fetch(API + '/provisioning/starter-bundles', { credentials: 'same-origin' })
+        .then(function (res) { return res.ok ? res.json() : null; })
+        .then(function (data) {
+          if (data && data.optional) starterBundles = data; else bundlesFailed = true;
+          repaintForBundles();
+        })
+        .catch(function () { bundlesFailed = true; repaintForBundles(); });
+      return bundlesPromise;
+    }
+    /* Whichever panel is asking gets repainted when the read lands. The review
+       is in this list because a resumed draft can arrive there having never
+       opened the picker — and a review that named the wrong extras would be the
+       exact dishonesty the About row's "off the public map" clause exists to
+       prevent, one screen before Create. */
+    function repaintForBundles() {
+      if (state.step === 4) renderModules();
+      else if (state.step === 7) renderReview();
+    }
+    function preselectedModules() {
+      if (!starterBundles) return [];
+      var forType = (starterBundles.bundles || []).filter(function (b) { return b.type === state.projType; })[0];
+      return forType ? forType.bundle.slice() : [];
+    }
+    /* What the panel paints and the review names: the owner's answer if they
+       gave one, otherwise the type's preselect. */
+    function pickedModules() {
+      return state.modules === null ? preselectedModules() : state.modules.slice();
+    }
+    /* What rides the create request — undefined while nothing has been said, so
+       an unanswered picker files no answer (task 1002339). */
+    function modulesForCreate() {
+      return state.modules === null ? undefined : state.modules.slice();
+    }
+    function moduleLabel(key) {
+      var rows = (starterBundles && starterBundles.optional) || [];
+      for (var i = 0; i < rows.length; i++) if (rows[i].key === key) return rows[i].label;
+      return key;
+    }
+    function renderModules() {
+      ensureBundles();
+      var band = $('modCards');
+      var note = $('modCoreNote');
+      if (!starterBundles) {
+        /* nothing yet. While the read is still in flight that is a blank band for
+           a moment; only a read that ANSWERED badly gets the clause, so a slow
+           network never tells the owner something is broken when it isn't. */
+        band.innerHTML = '';
+        note.textContent = bundlesFailed
+          ? 'We couldn’t load the list of extras just now. Your project is created with everything it needs either way, and you can add extras from its settings.'
+          : '';
+        note.classList.toggle('on', bundlesFailed);
+        return;
+      }
+      var on = pickedModules();
+      band.innerHTML = (starterBundles.optional || []).map(function (m) {
+        return '<button type="button" class="tpill" data-mod="' + esc(m.key) + '" aria-pressed="'
+          + (on.indexOf(m.key) === -1 ? 'false' : 'true') + '"><span><b>' + esc(m.label)
+          + '</b><small>' + esc(m.summary) + '</small></span></button>';
+      }).join('');
+      var core = (starterBundles.core || []).length;
+      note.textContent = core
+        ? 'Every project also starts with the same ' + core + ' core parts — the platform itself, the way it tracks work, and the builders’ hall. They are always on, so they are not part of this choice.'
+        : '';
+      note.classList.toggle('on', core > 0);
+    }
+    /* One delegated listener, because the rows are painted from the fetch. */
+    $('modCards').addEventListener('click', function (ev) {
+      var btn = ev.target.closest && ev.target.closest('.tpill[data-mod]');
+      if (!btn) return;
+      var key = btn.getAttribute('data-mod');
+      var on = pickedModules();
+      var want = on.indexOf(key) === -1 ? on.concat([key]) : on.filter(function (k) { return k !== key; });
+      /* Re-derive in CATALOG order rather than appending: the draft, the review
+         row and the array the server stores are then the same list in the same
+         order, so a resumed draft or a re-read can never look like a change. */
+      state.modules = (starterBundles.optional || []).map(function (m) { return m.key; })
+        .filter(function (k) { return want.indexOf(k) !== -1; });
+      renderModules();
+      saveDraft();
+    });
+    /* Next off this panel CONFIRMS what is on screen — the owner looked at the
+       set and accepted it, which is a different fact from never being asked. */
+    root.querySelector('#panel-modules form').addEventListener('submit', function () {
+      state.modules = pickedModules();
+      saveDraft();
+    });
+    /* What the review ledger names. Three cases, and the third is the one worth
+       writing down: with nothing said and the catalog not (yet) loaded we do not
+       know the module NAMES, but we do know the owner will get the type's
+       suggested set — so the row says that rather than "None", which would be a
+       false promise on the last screen before Create. */
+    function extrasRow() {
+      ensureBundles();
+      if (!starterBundles) {
+        /* the names live in the catalog, so until it lands say the true thing
+           WITHOUT them — never the raw module keys, which are jargon, and never
+           "None", which would be a false promise */
+        return state.modules === null
+          ? 'The suggested set for the kind of project you picked'
+          : 'The extras you picked';
+      }
+      var picked = pickedModules();
+      return picked.length ? esc(picked.map(moduleLabel).join(', ')) : 'None — just the core';
+    }
+
+    /* Skip = walk past without answering. It does NOT erase a toggle already
+       made (the About step's rule), and with nothing said it leaves state.modules
+       null so the server applies the bundle this panel was showing. */
+    $('skipModules').addEventListener('click', function () { show(5, true); });
+
     /* ── GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099 / ADR 0143.
           Progressive enhancement: probe GET /github/repos once we reach the Home step.
             200 → we hold repo access → show the picker (adopt) / name field (fresh);
@@ -3306,9 +3492,10 @@ summary{min-height:24px;padding:3px 0;}
         }
         return true;
       }
-      /* step 3 (About) has no clause: it is the optional one, and Next past an
-         empty answer is the whole point (task 1002334). */
-      if (step === 4) {
+      /* steps 3 (About) and 4 (Modules) have no clause: they are the optional
+         ones, and Next past an empty answer is the whole point (tasks 1002334,
+         1002339). */
+      if (step === 5) {
         var homeErr = function (msg) { $('h-home').textContent = msg; $('h-home').className = 'hint err'; return false; };
         if (repoAccess === 'need-connect') return homeErr('Allow GitHub repo access to pick or create your repository — or choose “enter it manually”.');
         if (repoAccess === true && state.mode !== 'adopt') {
@@ -3323,7 +3510,7 @@ summary{min-height:24px;padding:3px 0;}
         $('h-home').innerHTML = '&nbsp;'; $('h-home').className = 'hint';
         return true;
       }
-      if (step === 5) {
+      if (step === 6) {
         if (!validSlug(state.slug)) {
           $('h-slug').textContent = '2–40 lowercase letters, numbers, or dashes; no leading/trailing/double dash.';
           $('h-slug').className = 'hint err'; $('f-slug').classList.add('bad');
@@ -3396,6 +3583,10 @@ summary{min-height:24px;padding:3px 0;}
           ? esc(String(state.description).trim())
           : '<em style="font-weight:600;color:var(--warn)">not said — off the public map until you add it</em>'],
         ['Who’s building it', teamLabel(state.teamShape) || 'Not said'],
+        /* the picker is optional too, so this row shows what the project will
+           ACTUALLY come with — the owner's picks, or the preselect they walked
+           past — never a blank that a Create is about to turn into a surprise */
+        ['Extras', extrasRow()],
         ['Starting from', state.mode === 'adopt' ? 'A repo you already have' : 'A fresh, empty repo'],
         ['Repository', '<code>' + esc(state.owner + '/' + state.repo) + '</code>'],
         ['Handle', '<code>' + esc(state.slug) + '</code>'],
@@ -3487,6 +3678,10 @@ summary{min-height:24px;padding:3px 0;}
                answered-but-blank description to the publish gate */
             description: String(state.description || '').trim() || undefined,
             detail: state.teamShape ? { team_shape: state.teamShape } : undefined,
+            /* the picker's answer (task 1002339) — omitted while unanswered, and
+               the server then applies the SAME starter bundle the panel showed,
+               so a skip and an accept land the same modules */
+            modules: modulesForCreate(),
             hosting_shape: 'standalone',
             /* ONLY a bring-your-own domain travels (task 1002898 N2). The server owns
                the assigned <slug>.<apex> default (task 1002704) and applies it to an
@@ -3531,7 +3726,7 @@ summary{min-height:24px;padding:3px 0;}
           sessionStorage.removeItem(DRAFT_KEY);
         } catch (e) {}
         renderDone();
-        show(7, true);
+        show(8, true);
         startProgress(data.instance && data.instance.id);
       }).catch(function (err) {
         if (String(err && err.message) === 'signing in') return;
@@ -3539,7 +3734,7 @@ summary{min-height:24px;padding:3px 0;}
         if (err && err.gotoHome) {
           /* A repo-creation problem (name taken / reconnect) — bounce back to the Home
              step with the reason, so the user fixes it where the repo is chosen. */
-          show(4, true);
+          show(5, true);
           $('h-home').textContent = err.homeMsg || 'Please revisit the repository step.';
           $('h-home').className = 'hint err';
           return;
@@ -4085,7 +4280,7 @@ summary{min-height:24px;padding:3px 0;}
                5s tick never clobbers an open dropdown or mid-flight button) */
             if (inst && inst.status !== live.instStatus) {
               live.instStatus = inst.status; renderSteps();
-              if (state.step === 7) paintRail(7);   /* the rail finishes only when the project answers */
+              if (state.step === 8) paintRail(8);   /* the rail finishes only when the project answers */
             }
             var terminal = renderProgress(inst);
             if (!terminal) pollTimer = setTimeout(tick, 5000);
@@ -4162,7 +4357,7 @@ summary{min-height:24px;padding:3px 0;}
           manifestState = created.manifest_state; manifestPending = true;
         }
         renderDone();
-        show(7, !!focus);
+        show(8, !!focus);
         startProgress(created.id);
         resumePolls();
         return;
@@ -4170,7 +4365,7 @@ summary{min-height:24px;padding:3px 0;}
       /* before identity settles, never render past the name step: deeper steps
          carry authenticated side effects (the Home-step repo probe), and onAuth()
          re-enters to the real draft step the moment /me answers */
-      var step = authKnown && state.step >= 1 && state.step <= 6 ? state.step : 1;
+      var step = authKnown && state.step >= 1 && state.step <= 7 ? state.step : 1;
       if (step === 1) {
         show(1, false);
         if (focus) $('newName').focus();

package/modules/public-landing/public/projects.probes.json

@@ -156,10 +156,10 @@
       "steps": [["wait",900],["click","[data-del-ask]"],["wait",200],["fill","#mDelName","mooring"],["wait",100],["click","[data-del-yes]"],["wait",900]],
       "expect": {"text":[["#mDel .addr","A teardown is queued for this project."],["#mName","mooring"]],"hidden":["#mDelName","[data-del-ask]"],"visible":["#mStrip .strip.flowDown"]} },
     { "name": "the wizard driver (task 1003346): name, type, about, home (fresh; the stub grants repo access, so the new repository is named from the project), address (the handle's verdict), the review as a ledger, then the filing — the done panel with the standup rail and the human steps", "auth": true, "width": 1440, "url": "/projects?view=new",
-      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
+      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]],
       "expect": {"visible":["#panel-done","#liveProgress .prog","#liveProgress .prog .stages li.now","#humanSteps li"],"hidden":["#panel-review","#panel-name"],"text":[["#done-h","The drums are rolling"]],"attr":[["#panel-done","class","panel on"]]} },
     { "name": "the wizard driver at 390: the rail folds to two rows of three and the walk still reaches the review", "auth": true, "width": 390, "url": "/projects?view=new",
-      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]],
+      "steps": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]],
       "expect": {"visible":["#panel-review","#reviewList li","#doCreate"],"hidden":["#panel-address"],"text":[["#rev-h","Ready to roll"]]} }
   ]
 }

package/modules/public-landing/public/projects.states.json

@@ -30,10 +30,11 @@
     "out-new": { "auth": false, "url": "/projects?view=new", "expect": { "hidden": ["#qWrap"] } },
     "in-new-type": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-type"],"hidden":["#panel-name","#qWrap"]} },
     "in-new-about": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-detail"],"hidden":["#panel-type","#qWrap"]} },
-    "in-new-home": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900]], "expect": {"visible":["#panel-home"],"hidden":["#panel-detail","#qWrap"]} },
-    "in-new-address": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-home button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-address"],"hidden":["#panel-home","#qWrap"]} },
-    "in-new-review": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-review","#reviewList li"],"hidden":["#panel-address","#qWrap"]} },
-    "in-new-done": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]], "expect": {"visible":["#panel-done","#liveProgress .prog","#humanSteps li"],"hidden":["#panel-review","#qWrap"]} },
+    "in-new-modules": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900]], "expect": {"visible":["#panel-modules","#modCards .tpill[aria-pressed=\"true\"]","#modCoreNote"],"hidden":["#panel-detail","#qWrap"]} },
+    "in-new-home": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-home"],"hidden":["#panel-detail","#qWrap"]} },
+    "in-new-address": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-address"],"hidden":["#panel-home","#qWrap"]} },
+    "in-new-review": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400]], "expect": {"visible":["#panel-review","#reviewList li"],"hidden":["#panel-address","#qWrap"]} },
+    "in-new-done": { "auth": true, "url": "/projects?view=new", "actions": [["wait",600],["fill","#newName","Mercury"],["click","#panel-name button[type=submit]"],["wait",400],["click","#typeCards .tpill[data-type=\"game\"]"],["click","#panel-type button[type=submit]"],["wait",400],["fill","#f-desc","A co-op farming game where the seasons never repeat."],["click","#teamCards .tpill[data-team=\"small-team\"]"],["click","#panel-detail button[type=submit]"],["wait",900],["click","#panel-modules button[type=submit]"],["wait",400],["click","#panel-home button[type=submit]"],["wait",400],["fill","#f-slug","mercury"],["wait",900],["fill","#f-domain","mercury.example.com"],["wait",200],["click","#panel-address button[type=submit]"],["wait",400],["click","#doCreate"],["wait",1500]], "expect": {"visible":["#panel-done","#liveProgress .prog","#humanSteps li"],"hidden":["#panel-review","#qWrap"]} },
     "out-map-projects": { "auth": false, "actions": [["click", "#projTrig"], ["wait", 350]], "expect": { "expanded": true, "hidden": ["#menuProjects [data-nav=\"mine\"]"] } },
     "card": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://amazonprimea.com\"]"], ["wait", 900]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art"]], "visible": ["#cardArt", "#cardFaces", "#cardBuildersFig", "#cardShippedFig", "#cardOpen", "#cardHall"], "text": [["#cardBuilders", "11"], ["#cardShipped", "0"], ["#cardRel", "you build here"], ["#cardRuns", "amazonprimea.com"], ["#cardFaces .facesMore", "+6"]], "count": [["#cardFaces img", 5]], "href": [["#cardHall", "https://builders.amazonprimea.com/"]] } },
     "card-noart": { "auth": true, "actions": [["dispatchClick", "#orbField a.worldOrb[data-origin=\"https://emersonian-circles.cloudbongos.com\"]"], ["wait", 600]], "expect": { "dialog": true, "hasClass": [["#projCard", "has-art", false]], "hidden": ["#cardArt", "#cardFaces", "#cardHall"], "visible": ["#cardBuildersFig", "#cardShippedFig", "#cardOpen"], "text": [["#cardShipped", "30+"], ["#cardRel", "you build here"]] } },

package/modules/ui-design/kit/serve.js

@@ -108,6 +108,32 @@ const FEEDS = {
 const AUTHED = { '/my-projects': 'my-projects' };
 const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' } };
 
+// GET /provisioning/starter-bundles as the create wizard's module picker reads it
+// (task 1002339 / BV1.R19's route, ADR 0237). A fixture rather than an import —
+// the kit stub deliberately requires no module — kept honest by
+// tests/provisioning_starter_bundles.mjs, which reads this file and compares it
+// against the real declaration. `core` is the count the panel's clause names, so
+// only its length matters here; `optional` and `bundles` are byte-for-byte.
+const STARTER_BUNDLES_FIXTURE = {
+  core: [
+    'autonomy', 'builder-settings', 'copy-desk', 'economy', 'government', 'grading',
+    'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'public-landing',
+    'security', 'sessions', 'status-ui', 'ui-design',
+  ],
+  bundles: [
+    { type: 'game', bundle: ['dev-box', 'discord'] },
+    { type: 'research', bundle: ['agents'] },
+    { type: 'business', bundle: ['agents', 'dev-box'] },
+    { type: 'non-profit', bundle: ['discord'] },
+    { type: 'not-sure', bundle: [] },
+  ],
+  optional: [
+    { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets, for reading, research and review.' },
+    { key: 'dev-box', label: 'Dev boxes', summary: 'A cloud workspace where a change can be tried out before anyone else sees it. Nothing is charged until someone asks for one.' },
+    { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news, and lets people send ideas and bug reports back.' },
+  ],
+};
+
 function json(res, status, body) { res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' }); res.end(JSON.stringify(body)); }
 function fixture(name, res, origin) {
   if (FAIL.has(name)) return json(res, 500, { error: { code: 'stub_failure', message: `FAIL=${name}` } });
@@ -277,6 +303,12 @@ const server = http.createServer((req, res) => {
     }
     if (rest.startsWith('/github/repo')) return AUTH ? json(res, 200, { repo: { private: false, admin: true } }) : json(res, 401, UNAUTH);
     if (rest.startsWith('/provisioning/slug-available')) return json(res, 200, { available: true }); /* the wizard's handle check (task 1003346): every handle is free on the stub */
+    /* the module picker's one read (task 1002339). A FIXTURE, like everything
+       else here — the stub imports no module — but not a free-hand one:
+       tests/provisioning_starter_bundles.mjs pins it against the real
+       starter-bundles.js declaration, so the picture the kit renders and the
+       payload the route serves cannot drift apart silently. */
+    if (rest === '/provisioning/starter-bundles') return json(res, 200, STARTER_BUNDLES_FIXTURE);
     if (rest === '/auth/logout') return json(res, 200, { ok: true });
     if (rest.startsWith('/auth/web/start')) { res.writeHead(302, { location: PREFIX }); return res.end(); }
     if (rest === '/instance') { const b = pages.size ? pages.values().next().value.brand : {}; return json(res, 200, { brand: { productName: (b && b.productName) || '', project: {} }, modules: {} }); }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.514",
+  "version": "1.19.516",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.514",
+      "version": "1.19.516",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.514",
+  "version": "1.19.516",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.514'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.516'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');