@bongos/core 1.19.514 → 1.19.516

package/tests/projects_hub_module_picker.mjs

@@ -0,0 +1,369 @@
+// tests/projects_hub_module_picker.mjs — the create wizard's module picker,
+// EXECUTED (BV1.R20, task 1002339; goal 1000046 criterion `proj-module-select`).
+//
+// tests/projects_hub.mjs pins this surface statically, on purpose (C7: "real
+// markup, not JS-built"). But the picker is the one part of the wizard whose
+// whole behaviour is decisions — what is preselected, what a toggle does, what a
+// skip means — and a static regex cannot tell a preselect that works from one
+// that silently paints nothing. So this file runs the picker's own source in
+// `vm` under a small DOM stub and asserts what an owner would actually see.
+//
+// The precedent is tests/task_detail_ui.mjs (there is no jsdom in this repo).
+// The difference: task-detail.js is a whole file, while the picker lives inside
+// projects.html's one big inline <script> — so the block is sliced out by its
+// own comment sentinels and run with the five things it closes over ($, root,
+// esc, state, saveDraft/show) supplied by the harness. That slice is itself an
+// assertion: rename the sentinels and this file fails loudly rather than
+// quietly testing nothing.
+//
+// Run:  node --test --test-reporter=tap tests/projects_hub_module_picker.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+
+const START = '/* ── the module picker (task 1002339, BV1.R20) ──';
+const END = "$('skipModules').addEventListener('click', function () { show(5, true); });";
+const from = HUB.indexOf(START);
+const to = HUB.indexOf(END);
+assert.ok(from > -1, 'the picker block opens with its sentinel comment');
+assert.ok(to > from, 'the picker block closes with the skip wiring');
+const PICKER = HUB.slice(from, to + END.length).replace(/\r\n/g, '\n');
+
+// The payload GET /provisioning/starter-bundles serves (ADR 0237 + task 1002339).
+// Deliberately a FIXTURE and not a live require: this asserts the picker reads
+// the shape, and tests/provisioning_starter_bundles.mjs asserts the route emits
+// it. Two files, one shape, neither trusting the other's word for it.
+const PAYLOAD = {
+  core: ['autonomy', 'builder-settings', 'copy-desk', 'economy', 'government', 'grading',
+    'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'public-landing',
+    'security', 'sessions', 'status-ui', 'ui-design'],
+  bundles: [
+    { type: 'game', bundle: ['dev-box', 'discord'] },
+    { type: 'research', bundle: ['agents'] },
+    { type: 'business', bundle: ['agents', 'dev-box'] },
+    { type: 'non-profit', bundle: ['discord'] },
+    { type: 'not-sure', bundle: [] },
+  ],
+  optional: [
+    { key: 'agents', label: 'Extra agents', summary: 'More AI agents alongside the ones every project gets.' },
+    { key: 'dev-box', label: 'Dev boxes', summary: 'A cloud workspace where a change can be tried out first.' },
+    { key: 'discord', label: 'Discord', summary: 'A Discord server that carries your build news.' },
+  ],
+};
+
+function makeEl(id) {
+  const classes = new Set();
+  const attrs = new Map();
+  return {
+    id, _html: '', textContent: '', hidden: false, _handlers: {},
+    set innerHTML(v) { this._html = String(v); },
+    get innerHTML() { return this._html; },
+    classList: {
+      add: (c) => classes.add(c),
+      remove: (c) => classes.delete(c),
+      toggle: (c, on) => { if (on) classes.add(c); else classes.delete(c); },
+      contains: (c) => classes.has(c),
+    },
+    setAttribute(k, v) { attrs.set(k, String(v)); },
+    getAttribute(k) { return attrs.has(k) ? attrs.get(k) : null; },
+    addEventListener(type, fn) { this._handlers[type] = fn; },
+  };
+}
+
+// Parse the rows the picker WROTE, so a selector resolves only when the markup
+// is genuinely there — the point of the harness.
+function rowsOf(html) {
+  const out = [];
+  const re = /<button type="button" class="tpill" data-mod="([^"]+)" aria-pressed="(true|false)"><span><b>([^<]*)<\/b><small>([^<]*)<\/small><\/span><\/button>/g;
+  let m;
+  while ((m = re.exec(html))) out.push({ key: m[1], pressed: m[2] === 'true', label: m[3], summary: m[4] });
+  return out;
+}
+
+// Boot the picker with a given draft state. `fetchOk: false` drives the
+// couldn't-load branch. Returns the handles the assertions drive it through.
+function boot({ state: seed = {}, fetchOk = true } = {}) {
+  const els = new Map();
+  const $ = (id) => { if (!els.has(id)) els.set(id, makeEl(id)); return els.get(id); };
+  const form = makeEl('panel-modules-form');
+  const state = { step: 4, projType: null, modules: null, ...seed };
+  const shown = [];
+  let saves = 0;
+  let fetches = 0;
+  let reviews = 0;
+
+  const sandbox = {
+    $,
+    root: { querySelector: (sel) => (sel === '#panel-modules form' ? form : null) },
+    esc: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+    state,
+    saveDraft: () => { saves++; },
+    show: (step) => { shown.push(step); },
+    // the block repaints the review when the read lands on step 7 (a resumed
+    // draft can reach it having never opened the picker)
+    renderReview: () => { reviews++; },
+    API: '/api/bongos',
+    fetch: () => { fetches++; return Promise.resolve(fetchOk
+      ? { ok: true, json: () => Promise.resolve(PAYLOAD) }
+      : { ok: false, json: () => Promise.resolve(null) }); },
+    Promise, JSON, Math, Object, Array, String, Number, console,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(PICKER, sandbox, { filename: 'projects.html#module-picker' });
+
+  const band = $('modCards');
+  return {
+    state, shown, sandbox, form,
+    saves: () => saves,
+    fetches: () => fetches,
+    reviews: () => reviews,
+    extrasRow: () => sandbox.extrasRow(),
+    // The read is LAZY: the first render kicks it, and its .then repaints when it
+    // lands. open() is that whole sequence, which is exactly what entering the
+    // step does — so a test never asserts against a paint the browser skips.
+    settle: async () => { for (let i = 0; i < 20; i++) await Promise.resolve(); },
+    render: () => sandbox.renderModules(),
+    open: async function () { sandbox.renderModules(); for (let i = 0; i < 20; i++) await Promise.resolve(); },
+    rows: () => rowsOf(band.innerHTML),
+    coreNote: () => $('modCoreNote').textContent,
+    coreShown: () => $('modCoreNote').classList.contains('on'),
+    click: (key) => {
+      const target = {
+        closest: (sel) => (sel === '.tpill[data-mod]' ? { getAttribute: (k) => (k === 'data-mod' ? key : null) } : null),
+      };
+      band._handlers.click({ target });
+    },
+    next: () => form._handlers.submit({}),
+    skip: () => $('skipModules')._handlers.click(),
+    forCreate: () => sandbox.modulesForCreate(),
+    picked: () => sandbox.pickedModules(),
+  };
+}
+
+test('the declared project type preselects its bundle, and the rest of the catalog is offered switched off', async () => {
+  // Arrange — the owner said "game" on the Type step and has touched nothing here
+  const h = boot({ state: { projType: 'game' } });
+
+  // Act
+  await h.open();
+
+  // Assert — every opt-in module is a row; the bundle's two are on
+  const rows = h.rows();
+  assert.deepEqual(rows.map((r) => r.key), ['agents', 'dev-box', 'discord'], 'the whole opt-in catalog is offered');
+  assert.deepEqual(rows.filter((r) => r.pressed).map((r) => r.key), ['dev-box', 'discord'], 'the game bundle is preselected');
+  assert.equal(rows.find((r) => r.key === 'agents').pressed, false, 'and nothing else is');
+  // each row carries the copy an owner can actually read
+  assert.equal(rows[1].label, 'Dev boxes');
+  assert.match(rows[1].summary, /cloud workspace/);
+});
+
+test('a different type preselects a different bundle, and "not sure" preselects nothing', async () => {
+  for (const [type, expected] of [['research', ['agents']], ['business', ['agents', 'dev-box']], ['non-profit', ['discord']], ['not-sure', []], [null, []]]) {
+    const h = boot({ state: { projType: type } });
+    await h.open();
+    assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), expected, `type=${type}`);
+  }
+});
+
+test('the always-on core is stated, not rendered as sixteen toggles nobody may touch', async () => {
+  // A disabled control reads as a choice the owner failed to make. The core was
+  // never a choice, so it is a clause — visible, and outside the band.
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  assert.equal(h.coreShown(), true, 'the core is stated on the panel, not hidden');
+  assert.match(h.coreNote(), /16 core parts/, 'and it names how many');
+  assert.match(h.coreNote(), /always on/, 'and that they are not part of this choice');
+  for (const key of PAYLOAD.core) {
+    assert.ok(!h.rows().some((r) => r.key === key), `"${key}" is never a toggle`);
+  }
+});
+
+test('a toggle flips one module and leaves the rest of the preselect standing', async () => {
+  // Arrange
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  // Act — switch the bundle's discord off, switch agents on
+  h.click('discord');
+  h.click('agents');
+
+  // Assert
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'dev-box']);
+  assert.deepEqual(h.state.modules, ['agents', 'dev-box'], 'and the draft holds the real answer, in catalog order');
+  assert.ok(h.saves() >= 2, 'each toggle is written to the draft');
+});
+
+test('the first toggle is what turns "not answered" into an answer', async () => {
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  assert.equal(h.state.modules, null, 'before a touch, nothing has been said');
+  assert.equal(h.forCreate(), undefined, 'so the create request carries no modules key');
+
+  h.click('agents');
+  assert.deepEqual(h.forCreate(), ['agents', 'dev-box', 'discord'], 'after a touch it carries the whole set');
+});
+
+test('switching every module off is a real answer, not a reset to the bundle', async () => {
+  // The case a NOT NULL DEFAULT [] column could never have expressed: the owner
+  // said "none", and Next must not hand them the bundle back.
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  h.click('dev-box');
+  h.click('discord');
+
+  assert.deepEqual(h.state.modules, []);
+  assert.deepEqual(h.forCreate(), [], 'an empty answer travels — it is not the same as absent');
+  assert.deepEqual(h.rows().filter((r) => r.pressed), [], 'and the panel shows it');
+});
+
+test('Skip walks past WITHOUT answering, so the server applies the bundle the panel showed', async () => {
+  // Arrange
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  // Act
+  h.skip();
+
+  // Assert — skipping is the one path that must leave nothing said, because the
+  // preselect and the server's fallback are the same declaration (ADR 0237)
+  assert.deepEqual(h.shown, [5], 'it advances to the Home step');
+  assert.equal(h.state.modules, null, 'and answers nothing');
+  assert.equal(h.forCreate(), undefined);
+  assert.deepEqual(h.picked(), ['dev-box', 'discord'], 'while the set they were shown is still the set they get');
+});
+
+test('Skip does not erase a toggle already made', async () => {
+  // The About step's rule: a visitor who changed something and then pressed Skip
+  // meant "I'm done here", not "throw that away".
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  h.click('agents');
+  h.skip();
+
+  assert.deepEqual(h.state.modules, ['agents', 'dev-box', 'discord']);
+});
+
+test('Next CONFIRMS the set on screen — looking at it and accepting it is not the same as never being asked', async () => {
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  h.next();
+
+  assert.deepEqual(h.state.modules, ['dev-box', 'discord'], 'the preselect becomes the answer');
+  assert.deepEqual(h.forCreate(), ['dev-box', 'discord'], 'and rides the create request');
+});
+
+test('changing the project type re-preselects while nothing has been said, and never after', async () => {
+  // The arrow runs type -> modules (ADR 0237 §2). It must not run backwards over
+  // a choice the owner already made.
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+
+  h.state.projType = 'research';
+  h.render();
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents'], 'an untouched picker follows the type');
+
+  h.click('discord');
+  h.state.projType = 'non-profit';
+  h.render();
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents', 'discord'],
+    'an answered picker keeps the answer');
+});
+
+test('a draft resumed with a stored answer repaints that answer, not the bundle', async () => {
+  // sessionStorage survives a reload; the panel must not quietly re-apply the
+  // preselect over what the owner picked before they closed the tab.
+  const h = boot({ state: { projType: 'game', modules: ['agents'] } });
+  await h.open();
+
+  assert.deepEqual(h.rows().filter((r) => r.pressed).map((r) => r.key), ['agents']);
+});
+
+test('a catalog that will not load degrades to a clause — it never blocks a project from being created', async () => {
+  // Arrange
+  const h = boot({ state: { projType: 'game' }, fetchOk: false });
+
+  // Act
+  await h.open();
+
+  // Assert
+  assert.deepEqual(h.rows(), [], 'no rows are invented');
+  assert.match(h.coreNote(), /couldn’t load/, 'the panel says so in the owner\'s words');
+  assert.equal(h.state.modules, null, 'nothing is answered on their behalf');
+  h.skip();
+  assert.deepEqual(h.shown, [5], 'and the wizard still walks on — the server applies the bundle');
+});
+
+test('every rendered value goes through the page escaper', async () => {
+  // The rows are built with innerHTML (renderReview's existing idiom in this
+  // file), so the escaping is the safety property and it is asserted, not assumed.
+  const h = boot({ state: { projType: 'game' } });
+  await h.open();
+  h.sandbox.starterBundles = {
+    core: [], bundles: [],
+    optional: [{ key: 'x"><script>', label: '<b>bad</b>', summary: 'a & b' }],
+  };
+  h.render();
+
+  const html = h.sandbox.$('modCards').innerHTML;
+  assert.ok(!html.includes('<script>'), 'a hostile key cannot break out of the attribute');
+  assert.ok(html.includes('&lt;b&gt;bad&lt;/b&gt;'), 'a label is escaped');
+  assert.ok(html.includes('a &amp; b'), 'and so is a summary');
+});
+
+test('the catalog read is LAZY and asked once — /projects serves four views from one file', async () => {
+  // The map view has no business paying for the picker's read, and re-entering
+  // the step must not re-ask. fetchPlan() beside it memoises for the same reason.
+  // The counter is wired INTO the sandbox before the block runs, so a fetch at
+  // boot would be caught — a counter installed afterwards would prove nothing.
+  const h = boot({ state: { projType: 'game' } });
+
+  assert.equal(h.fetches(), 0, 'loading the page does not ask');
+  await h.open();
+  await h.open();
+  assert.equal(h.fetches(), 1, 'entering the step asks exactly once, however often it is entered');
+});
+
+test('the review names the set even when the picker was never opened (task 1002339)', async () => {
+  // A resumed draft lands straight on the review, so the catalog has not loaded
+  // and the module NAMES are not known. "None — just the core" would be a false
+  // promise on the last screen before Create: the server is about to apply the
+  // type's bundle. The row says that instead, then repaints when the read lands.
+  const h = boot({ state: { projType: 'game', step: 7 } });
+
+  // Arrange + Act — the review asks for the value before the read can answer
+  const first = h.extrasRow();
+
+  // Assert
+  assert.match(first, /suggested set/, 'it promises what the owner will actually get');
+  assert.equal(h.fetches(), 1, 'and asking for it is what starts the read');
+
+  await h.settle();
+  assert.equal(h.reviews(), 1, 'the review repaints itself once the names are known');
+  assert.equal(h.extrasRow(), 'Dev boxes, Discord', 'and then it names them');
+});
+
+test('the review reads an answered picker back, empty included', async () => {
+  const chosen = boot({ state: { projType: 'game', modules: ['agents'], step: 7 } });
+  // before the catalog lands the row says the true thing without the names —
+  // never the raw module keys, which are jargon on an owner-facing screen
+  assert.equal(chosen.extrasRow(), 'The extras you picked');
+  await chosen.settle();
+  assert.equal(chosen.extrasRow(), 'Extra agents', 'and names them once it has');
+
+  const none = boot({ state: { projType: 'game', modules: [], step: 7 } });
+  none.extrasRow();
+  await none.settle();
+  assert.equal(none.extrasRow(), 'None — just the core', 'a deliberate "none" is stated as one');
+});

package/tests/provisioning_module_selection.mjs

@@ -0,0 +1,286 @@
+// tests/provisioning_module_selection.mjs
+//
+// Where the creation picker's chosen module set LANDS (BV1.R20, task 1002339;
+// goal 1000046 criterion `proj-module-select`, migration provisioning_014).
+//
+// R19 declared the bundles and served them; this is the half that stores an
+// answer. The whole contract is three-valued and every test below exists to keep
+// one of the three legible:
+//
+//   absent  the owner skipped the picker  → the column stores NULL and the READ
+//           resolves the declared type's starter bundle, so a skip yields exactly
+//           the set the panel preselected.
+//   []      the owner said "none of them" → stored as an empty array, and it
+//           stays empty. A NOT NULL DEFAULT '[]' column could never have said this.
+//   [...]   what they picked.
+//
+// Three layers, mirroring tests/provisioning_onboard_mode.mjs beside it:
+//   • createInstance  — what actually reaches the INSERT params
+//   • POST /instances — validation (loud, never a silent drop) + threading
+//   • publicInstance  — what a reader gets back, resolved rather than raw
+//
+// DB-free: the pool is a recording fake and the data-access fns the route needs
+// are stubbed on the cached module object. No network beyond a loopback listener.
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_module_selection.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+// ESM named imports off the CJS module on purpose — knip cannot trace a
+// createRequire() import, so these would read as dead exports (the repo's knip
+// learning; tests/provisioning_starter_bundles.mjs does the same).
+import { ALWAYS_ON_CORE, bundleForProjectType } from '../modules/provisioning/starter-bundles.js';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ── createInstance: what reaches the column ─────────────────────────────────
+// A recording pool: assert the STORED value, not just the returned row. A
+// normalization bug that only shows up in the column is the one that would
+// mislabel a project's modules forever.
+function recordingDb(returnRow = {}) {
+  const calls = [];
+  return {
+    calls,
+    query: async (text, params) => {
+      calls.push({ text, params });
+      return { rows: [{ id: 1, owner_builder_id: 7, slug: 'demo', ...returnRow }] };
+    },
+  };
+}
+
+function insertParams(db) {
+  const insert = db.calls.find((c) => /INSERT INTO provisioning_instances/i.test(c.text));
+  assert.ok(insert, 'issued an INSERT');
+  assert.match(insert.text, /modules/, 'the modules column is in the INSERT');
+  return insert.params;
+}
+
+await ta('createInstance: a chosen set is stored as a jsonb array, in catalog order', async () => {
+  // Arrange
+  const db = recordingDb();
+
+  // Act
+  await provisioning.createInstance(db, {
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game',
+    modules: ['discord', 'agents'],
+  });
+
+  // Assert
+  const params = insertParams(db);
+  assert.ok(params.includes(JSON.stringify(['agents', 'discord'])),
+    `the normalized selection reached the INSERT (got ${JSON.stringify(params)})`);
+});
+
+await ta('createInstance: NO answer stores NULL — the skip has to stay readable as a skip', async () => {
+  // If this stored '[]' the row would claim the owner turned every module off,
+  // and the read-time bundle fallback could never fire again.
+  for (const modules of [undefined, null, 'discord', 42]) {
+    const db = recordingDb();
+    await provisioning.createInstance(db, {
+      ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game', modules,
+    });
+    const params = insertParams(db);
+    assert.equal(params[13], null, `modules=${JSON.stringify(modules)} stores NULL, not an empty list`);
+  }
+});
+
+await ta('createInstance: an explicit empty answer is stored, and is NOT the same as absent', async () => {
+  const db = recordingDb();
+  await provisioning.createInstance(db, {
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', type: 'game', modules: [],
+  });
+  assert.equal(insertParams(db)[13], '[]', 'the owner said none of them, and the row says so');
+});
+
+await ta('createInstance: the always-on core is never written into the selection', async () => {
+  // The core is the floor every project gets, not a pick. Storing it would make
+  // the column disagree with ALWAYS_ON_CORE the day a manifest flips its default.
+  const db = recordingDb();
+  await provisioning.createInstance(db, {
+    ownerBuilderId: 7, slug: 'demo', hostingShape: 'standalone', modules: ['memory', 'discord', 'provisioning'],
+  });
+  assert.equal(insertParams(db)[13], JSON.stringify(['discord']));
+});
+
+// ── publicInstance: what a reader gets back ────────────────────────────────
+
+t('publicInstance: a skipped picker reads as the declared type\'s bundle', () => {
+  // Arrange — the row a skip writes
+  const row = { id: 1, slug: 'demo', status: 'requested', type: 'game', modules: null, detail: {} };
+
+  // Act
+  const out = provisioning.publicInstance(row);
+
+  // Assert — resolved, never raw: no caller should have to re-derive the rule,
+  // which is the one way two surfaces come to name different modules.
+  assert.deepEqual(out.modules.selected, bundleForProjectType('game').bundle);
+  assert.deepEqual(out.modules.core, [...ALWAYS_ON_CORE]);
+  assert.equal(out.modules.source, 'bundle');
+});
+
+t('publicInstance: a chosen set reads back as chosen, empty included', () => {
+  const chosen = provisioning.publicInstance({ id: 1, type: 'game', modules: ['agents'], detail: {} });
+  assert.deepEqual(chosen.modules.selected, ['agents']);
+  assert.equal(chosen.modules.source, 'chosen');
+
+  const none = provisioning.publicInstance({ id: 1, type: 'game', modules: [], detail: {} });
+  assert.deepEqual(none.modules.selected, []);
+  assert.equal(none.modules.source, 'chosen', 'a project that switched the bundle off does not get it back');
+});
+
+t('publicInstance: a row written before provisioning_014 reads as the bundle, not as an error', () => {
+  // Every existing row has no `modules` key at all. Nullable + read-time
+  // resolution is what makes the migration a no-op for them.
+  const out = provisioning.publicInstance({ id: 1, slug: 'old', status: 'active', type: 'research', detail: {} });
+  assert.deepEqual(out.modules.selected, ['agents']);
+  assert.equal(out.modules.source, 'bundle');
+});
+
+// ── POST /instances, over a real mounted router ────────────────────────────
+
+let lastCreateArgs = null;
+let existingRow = null;
+provisioning.getInstanceBySlug = async () => existingRow;
+provisioning.getInstanceByDomain = async () => null;
+provisioning.getInstanceById = async () => null;
+provisioning.createInstance = async (_db, args) => {
+  lastCreateArgs = args;
+  return existingRow
+    ? { instance: existingRow, created: false }
+    : { instance: { id: 41, owner_builder_id: 7, slug: args.slug, status: 'requested', hosting_shape: 'standalone', type: args.type || null, detail: {} }, created: true };
+};
+provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
+provisioning.getOpenIntent = async () => null;
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(details || (typeof opts === 'object' ? opts : {})) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+await ta('POST /instances: the picker\'s ids ride the create request through to storage', async () => {
+  // Arrange
+  lastCreateArgs = null; existingRow = null;
+
+  // Act — the body the wizard files
+  const res = await post('/provisioning/instances', {
+    slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: ['dev-box', 'discord'],
+  });
+
+  // Assert
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.deepEqual(lastCreateArgs && lastCreateArgs.modules, ['dev-box', 'discord']);
+});
+
+await ta('POST /instances: an omitted modules key is still a valid create — skipping is supported, not an error', async () => {
+  lastCreateArgs = null; existingRow = null;
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', type: 'game' });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.equal(lastCreateArgs.modules, undefined, 'nothing is invented on the owner\'s behalf');
+  // …and the receipt already carries the set they will actually get.
+  assert.deepEqual(res.body.instance.modules.selected, bundleForProjectType('game').bundle);
+  assert.equal(res.body.instance.modules.source, 'bundle');
+});
+
+await ta('POST /instances: an explicit empty selection is accepted as an answer', async () => {
+  lastCreateArgs = null; existingRow = null;
+  const res = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', type: 'game', modules: [] });
+  assert.equal(res.status, 201, `expected 201, got ${res.status} ${res.raw}`);
+  assert.deepEqual(lastCreateArgs.modules, []);
+});
+
+await ta('POST /instances: an unknown module is REFUSED and named, never silently dropped', async () => {
+  // The normalizer would drop it on the way to storage and the caller would be
+  // told nothing — the exact silent-drop failure the strict validator exists to
+  // prevent, and the reason badProjectDetail was written beside this.
+  existingRow = null;
+  const res = await post('/provisioning/instances', {
+    slug: 'mercury', hosting_shape: 'standalone', modules: ['discrod'],
+  });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_modules');
+  assert.match(res.body.error.message, /discrod/, 'the message names what was wrong');
+  assert.match(res.body.error.message, /agents/, 'and what the choices are');
+});
+
+await ta('POST /instances: naming an always-on module is refused with the reason, not the generic miss', async () => {
+  existingRow = null;
+  const res = await post('/provisioning/instances', {
+    slug: 'mercury', hosting_shape: 'standalone', modules: ['memory'],
+  });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_modules');
+  assert.match(res.body.error.message, /always on/i, '"memory" exists — it just was never a choice');
+});
+
+await ta('POST /instances: modules must be an array of strings', async () => {
+  existingRow = null;
+  const notArray = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', modules: 'discord' });
+  assert.equal(notArray.status, 400, notArray.raw);
+  assert.equal(notArray.body.error.code, 'validation_failed');
+
+  const notStrings = await post('/provisioning/instances', { slug: 'mercury', hosting_shape: 'standalone', modules: [7] });
+  assert.equal(notStrings.status, 400, notStrings.raw);
+  assert.equal(notStrings.body.error.code, 'validation_failed');
+});
+
+await ta('POST /instances: a re-request never changes an existing project\'s modules — and SAYS so', async () => {
+  // Same honesty as type_ignored (task 1002772). There is no mutation route yet
+  // (R23, task 1002342 is "add modules later"), so the receipt does not name one.
+  existingRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: ['agents'], detail: {} };
+  const res = await post('/provisioning/instances', {
+    slug: 'mercury', hosting_shape: 'standalone', modules: ['discord'],
+  });
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(res.body.modules_ignored, 'the dropped answer is reported, not swallowed');
+  assert.match(res.body.modules_ignored.hint, /never changes/);
+  assert.deepEqual(res.body.instance.modules.selected, ['agents'], 'and the stored answer is what reads back');
+  existingRow = null;
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);