@bongos/core 1.19.582 → 1.19.584

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1709,
-    "unique_ids": 1478,
-    "certain": 1709,
+    "strings": 1710,
+    "unique_ids": 1479,
+    "certain": 1710,
     "heuristic": 0,
     "duplicate_ids": 162
   },
@@ -23,7 +23,7 @@
     "landing": {
       "at": "modules/public-landing/public",
       "files": 5,
-      "strings": 372
+      "strings": 373
     }
   },
   "blind_spots": [
@@ -92,9 +92,9 @@
         "modules/public-landing/public/projects.html:1018",
         "modules/public-landing/public/projects.html:1049",
         "modules/public-landing/public/projects.html:1088",
-        "modules/public-landing/public/projects.html:1160",
-        "modules/public-landing/public/projects.html:1200",
-        "modules/public-landing/public/projects.html:1213"
+        "modules/public-landing/public/projects.html:1167",
+        "modules/public-landing/public/projects.html:1207",
+        "modules/public-landing/public/projects.html:1220"
       ]
     },
     {
@@ -106,7 +106,7 @@
         "modules/public-landing/public/contact.html:71",
         "modules/public-landing/public/index.html:900",
         "modules/public-landing/public/privacy.html:80",
-        "modules/public-landing/public/projects.html:1338",
+        "modules/public-landing/public/projects.html:1345",
         "modules/public-landing/public/terms.html:84"
       ]
     },
@@ -119,8 +119,8 @@
         "modules/public-landing/public/projects.html:1019",
         "modules/public-landing/public/projects.html:1052",
         "modules/public-landing/public/projects.html:1091",
-        "modules/public-landing/public/projects.html:1161",
-        "modules/public-landing/public/projects.html:1201"
+        "modules/public-landing/public/projects.html:1168",
+        "modules/public-landing/public/projects.html:1208"
       ]
     },
     {
@@ -132,7 +132,7 @@
         "modules/public-landing/public/contact.html:71",
         "modules/public-landing/public/index.html:900",
         "modules/public-landing/public/privacy.html:80",
-        "modules/public-landing/public/projects.html:1338",
+        "modules/public-landing/public/projects.html:1345",
         "modules/public-landing/public/terms.html:84"
       ]
     },
@@ -183,7 +183,7 @@
         "modules/public-landing/public/index.html:906",
         "modules/public-landing/public/projects.html:550",
         "modules/public-landing/public/projects.html:550",
-        "modules/public-landing/public/projects.html:1338"
+        "modules/public-landing/public/projects.html:1345"
       ]
     },
     {
@@ -218,8 +218,8 @@
       "at": [
         "modules/public-landing/public/projects.html:864",
         "modules/public-landing/public/projects.html:865",
-        "modules/public-landing/public/projects.html:1240",
-        "modules/public-landing/public/projects.html:1241"
+        "modules/public-landing/public/projects.html:1247",
+        "modules/public-landing/public/projects.html:1248"
       ]
     },
     {
@@ -13011,7 +13011,7 @@
       "surface": "landing",
       "text": "A non-profit, capture-resistant commons.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1338,
+      "line": 1345,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13029,7 +13029,7 @@
       "surface": "landing",
       "text": "A pair of bongo drums",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1267,
+      "line": 1274,
       "origin": "html-attr:aria-label",
       "confidence": "certain"
     },
@@ -13218,7 +13218,7 @@
       "surface": "landing",
       "text": "Builders' hall",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1338,
+      "line": 1345,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13245,7 +13245,7 @@
       "surface": "landing",
       "text": "Built by agents, on",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1338,
+      "line": 1345,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13425,7 +13425,7 @@
       "surface": "landing",
       "text": "Create my project",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1214,
+      "line": 1221,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13461,7 +13461,7 @@
       "surface": "landing",
       "text": "Domain you own",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1189,
+      "line": 1196,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13722,7 +13722,7 @@
       "surface": "landing",
       "text": "GitHub username",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1240,
+      "line": 1247,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13731,7 +13731,7 @@
       "surface": "landing",
       "text": "GitHub username",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1241,
+      "line": 1248,
       "origin": "html-attr:placeholder",
       "confidence": "certain"
     },
@@ -13812,7 +13812,7 @@
       "surface": "landing",
       "text": "Invite builders",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1237,
+      "line": 1244,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -13848,7 +13848,7 @@
       "surface": "landing",
       "text": "Its address in the sky",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1176,
+      "line": 1183,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14019,7 +14019,7 @@
       "surface": "landing",
       "text": "Next →",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1161,
+      "line": 1168,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14028,7 +14028,7 @@
       "surface": "landing",
       "text": "Next →",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1201,
+      "line": 1208,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14109,7 +14109,7 @@
       "surface": "landing",
       "text": "One tap files the request and the platform starts standing your project up — server, database, address. Here's the beat you're about to drop:",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1209,
+      "line": 1216,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14163,7 +14163,7 @@
       "surface": "landing",
       "text": "Open source (AGPL-3.0)",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1338,
+      "line": 1345,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14199,7 +14199,7 @@
       "surface": "landing",
       "text": "Optional — invite people by GitHub username. Each one gets an invitation to accept from their own projects page, and they need to have signed in here at least once. Skip this and invite anyone later; nothing about your project waits on it.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1238,
+      "line": 1245,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14280,7 +14280,7 @@
       "surface": "landing",
       "text": "Project handle",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1179,
+      "line": 1186,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14316,7 +14316,7 @@
       "surface": "landing",
       "text": "Projects aren’t created from this instance — this is a project, not the platform that hosts them.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1330,
+      "line": 1337,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14469,7 +14469,7 @@
       "surface": "landing",
       "text": "Ready to roll",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1208,
+      "line": 1215,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14775,7 +14775,7 @@
       "surface": "landing",
       "text": "Start without an address — possible, but sign-in on your project can’t be set up until it has one.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1196,
+      "line": 1203,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14883,7 +14883,7 @@
       "surface": "landing",
       "text": "The drums are rolling",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1223,
+      "line": 1230,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14901,7 +14901,7 @@
       "surface": "landing",
       "text": "The handle names your project on the platform — and its address comes with it. Once it stands up, a few GitHub steps (the next screen walks you through them) switch sign-in on.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1177,
+      "line": 1184,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -14991,7 +14991,7 @@
       "surface": "landing",
       "text": "These are the same steps however a project is created — nothing here is special to this page.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1258,
+      "line": 1265,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -15018,7 +15018,7 @@
       "surface": "landing",
       "text": "This files the request; the control plane does the real standup and nothing touches servers from this page. You'll get the few steps only you can do right after.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1216,
+      "line": 1223,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -15108,7 +15108,16 @@
       "surface": "landing",
       "text": "Use a domain I own instead",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1187,
+      "line": 1194,
+      "origin": "html-text",
+      "confidence": "certain"
+    },
+    {
+      "id": "9be878db0d86",
+      "surface": "landing",
+      "text": "Use my GitHub repositories instead",
+      "file": "modules/public-landing/public/projects.html",
+      "line": 1163,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -15504,7 +15513,7 @@
       "surface": "landing",
       "text": "Your steps — the parts only you can play",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1253,
+      "line": 1260,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -15522,7 +15531,7 @@
       "surface": "landing",
       "text": "Yours from the moment it stands up. You can point a domain you own at it any time.",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1185,
+      "line": 1192,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -16179,7 +16188,7 @@
       "surface": "landing",
       "text": "← Back",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1160,
+      "line": 1167,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -16188,7 +16197,7 @@
       "surface": "landing",
       "text": "← Back",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1200,
+      "line": 1207,
       "origin": "html-text",
       "confidence": "certain"
     },
@@ -16197,7 +16206,7 @@
       "surface": "landing",
       "text": "← Back",
       "file": "modules/public-landing/public/projects.html",
-      "line": 1213,
+      "line": 1220,
       "origin": "html-text",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -1613,5 +1613,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.580 with no explicit bump. run 34158683008. (task 1002620)
   1.19.582 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.581 with no explicit bump. run 34160253741. (task 1002620)
+  1.19.583 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.582 with no explicit bump. run 34162998083. (task 1002620)
+  1.19.584 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.583 with no explicit bump. run 34164936809. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/paid-shape-gate.js

@@ -0,0 +1,57 @@
+// modules/provisioning/paid-shape-gate.js — who may ask for METERED infrastructure
+// (task 1003682).
+//
+// The create route is open to any authenticated builder, and it must stay that way:
+// standing up a project is the platform's front door, not a privilege. But one of the
+// hosting shapes it accepts is not free. `dedicated` is the only shape whose runner leg
+// allocates a real droplet (`scripts/gds/provision.js` — billed monthly, defaulting to
+// s-2vcpu-4gb when no tier is named); every other shape co-tenants on infrastructure the
+// platform already pays for, which is why `costEstimateUsd` returns 0 for all of them.
+//
+// So the authority question belongs to the SHAPE, not the route. Gating the whole route
+// would make ordinary project creation require a rank — the wrong trade entirely, and the
+// reason this is a middleware over one field rather than a floor on the endpoint.
+//
+// The atom is `provisioning.fleet.manage` (floor: metic), deliberately the same one that
+// already guards the fleet cost-ledger and force-teardown. Spending on the fleet and
+// managing the fleet are one authority, and before this the route that SPENDS money was
+// less gated than the route that stops it.
+//
+// Split into its own file rather than inlined beside the route for two reasons, both
+// mechanical: `routes/provisioning.js` sits at its 1500-line fitness ratchet (the same
+// pressure that produced `callback-page.js` under task 1003570), and a bare `req.body`
+// read placed between two route declarations is attributed by the ADR 0118 body-validation
+// scanner to the PRECEDING route, which turns a correct gate into a false "unvalidated
+// write route" failure on an unrelated endpoint.
+'use strict';
+
+// The shapes that cost money. Kept as a set of one rather than a bare `=== 'dedicated'`
+// so a second metered shape is a one-line change here instead of a hunt through gates;
+// `tests/provisioning_paid_shape_gate.mjs` pins HOSTING_SHAPES so adding one without
+// revisiting this file fails loudly.
+const METERED_SHAPES = Object.freeze(new Set(['dedicated']));
+
+// isMeteredShape — does this hosting shape allocate infrastructure someone is billed for?
+// Matches the exact wire value: the route's own validator refuses anything not in
+// HOSTING_SHAPES, so a case or whitespace variant is rejected as a bad shape rather than
+// admitted here as a cheap one.
+function isMeteredShape(shape) {
+  return METERED_SHAPES.has(shape);
+}
+
+// requireAuthorityForMeteredShape — the create route's paid-shape gate. Mount it AFTER
+// requireBuilder and BEFORE the handler, so a refusal leaves no row behind for the runner
+// to drain later. `requirePermission` is injected (rather than required here) so the gate
+// is exercisable without standing up the auth stack.
+function requireAuthorityForMeteredShape(requirePermission) {
+  const gate = requirePermission('provisioning.fleet.manage');
+  return function meteredShapeGate(req, res, next) {
+    if (!isMeteredShape(req.body && req.body.hosting_shape)) return next();
+    return gate(req, res, next);
+  };
+}
+
+// Only the gate is exported. METERED_SHAPES and isMeteredShape are deliberately private:
+// nothing outside this file needs to ask "is this shape metered" separately from being
+// gated on it, and an export nobody consumes is one more thing to keep true.
+module.exports = { requireAuthorityForMeteredShape };

package/modules/provisioning/routes/provisioning.js

@@ -12,6 +12,9 @@
 //
 //   own-scoped (requireBuilder — the caller's OWN instances):
 //     POST   /provisioning/instances               — request a new instance
+//                                                     (a `dedicated` shape ALSO needs
+//                                                      provisioning.fleet.manage — it is the
+//                                                      only shape that bills; ../paid-shape-gate.js)
 //     GET    /provisioning/instances               — list the caller's instances
 //     GET    /provisioning/instances/:id           — read one of the caller's instances
 //                                                     (also SELF-HEALS its catalog projection,
@@ -45,6 +48,7 @@ const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+const { requireAuthorityForMeteredShape } = require('../paid-shape-gate');
 const catalogBridge = require('../catalog-bridge');
 const { callbackPage } = require('./callback-page');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
@@ -342,7 +346,9 @@ module.exports = function provisioningRoutes() {
   });
 
   // POST /provisioning/instances — request a new instance. rank: any authenticated
-  // builder (own resource). ENQUEUES a 'provision' intent + records the request;
+  // builder (own resource); a `dedicated` (metered) shape additionally requires
+  // provisioning.fleet.manage — see requireAuthorityForMeteredShape above.
+  // ENQUEUES a 'provision' intent + records the request;
   // the runner (task P3) does the real standup. Idempotent on slug for the SAME
   // owner (re-request returns the existing row); a slug owned by ANOTHER builder → 409.
   // Body: { slug (required), target_ref?, hosting_shape? (co-tenant|dedicated),
@@ -353,7 +359,7 @@ module.exports = function provisioningRoutes() {
   // ALREADY has, so the runner must clone + layer onto its history instead of pushing a
   // fresh tree at `main` (which an existing repo rejects as unrelated history). Absent →
   // 'greenfield', the safe default.
-  router.post('/provisioning/instances', auth.requireBuilder, async (req, res) => {
+  router.post('/provisioning/instances', auth.requireBuilder, requireAuthorityForMeteredShape(auth.requirePermission), async (req, res) => {
     if (validateOrRespond(req, res, {
       slug: { required: true, type: 'string', maxLength: 40 },
       target_ref: { type: 'string', maxLength: 200 },

package/modules/public-landing/public/projects.html

@@ -1154,6 +1154,13 @@ summary{min-height:24px;padding:3px 0;}
                 <!-- visibility stated BEFORE GitHub's own radio is the first place it
                      appears (task 1002721, owner firsthand in the QA walk) -->
                 <div class="hint" style="grid-column:1 / -1;">Creating the repo yourself on GitHub? Public or private is your choice there — both work here, and we never change it.</div>
+                <!-- the way back from the manual fallback (task 1003683). Choosing "or enter
+                     it manually" used to hide the connect offer for good: #ghConnect renders
+                     only while repoAccess is 'need-connect', and nothing ever set it back, so
+                     a full reload was the only route to the button. Stays hidden when the
+                     fallback was FORCED (repoAccess 'unavailable'), where connecting cannot
+                     help and the offer would be a lie. -->
+                <button type="button" class="linklike" id="ghManualBack" style="grid-column:1 / -1;" hidden>Use my GitHub repositories instead</button>
               </div>
               <div class="hint" id="h-home">&nbsp;</div>
               <div class="nav">
@@ -3498,6 +3505,7 @@ summary{min-height:24px;padding:3px 0;}
     }
     $('ghConnectBtn').addEventListener('click', connectRepos);
     $('ghManualToggle').addEventListener('click', function () { repoAccess = 'manual'; syncHome(); $('f-owner').focus(); });
+    $('ghManualBack').addEventListener('click', function () { repoAccess = 'need-connect'; syncHome(); $('ghConnectBtn').focus(); });
 
     function syncHome() {
       var need = repoAccess === 'need-connect';
@@ -3508,6 +3516,9 @@ summary{min-height:24px;padding:3px 0;}
       $('ghAdopt').hidden = !(ok && adopt);
       $('ghFresh').hidden = !(ok && !adopt);
       $('manualHome').hidden = !isManualHome();
+      /* only when the visitor CHOSE manual: with 'unavailable' the server cannot hold a
+         token, so a connect round-trip would land back here having changed nothing */
+      $('ghManualBack').hidden = repoAccess !== 'manual';
       if (need) {
         /* Informed consent (ADR 0155): this grants `repo`, which GitHub's own screen
            words as full control of ALL your repositories — so say plainly why we ask
@@ -4568,7 +4579,14 @@ summary{min-height:24px;padding:3px 0;}
          re-enters to the real draft step the moment /me answers */
       var step = authKnown && state.step >= 1 && state.step <= 7 ? state.step : 1;
       if (step === 1) {
+        /* Pre-auth, step 1 is a PLACEHOLDER, not where the visitor is — but show()
+           persists whatever step it renders, so it used to overwrite the draft's real
+           position with 1 and leave onAuth() nothing to re-enter to (task 1003683). Every
+           return through GitHub landed the visitor back at the name step. Put the real
+           step back after rendering the placeholder, in memory AND in the draft. */
+        var resumeStep = state.step;
         show(1, false);
+        if (!authKnown && resumeStep >= 1 && resumeStep <= 7) { state.step = resumeStep; saveDraft(); }
         if (focus) $('newName').focus();
       } else {
         show(step, !!focus);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.582",
+  "version": "1.19.584",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.582",
+      "version": "1.19.584",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.582",
+  "version": "1.19.584",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.582'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.584'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');