@bongos/core 1.21.174 → 1.21.176

package/scripts/bongos/provision-render.js

@@ -0,0 +1,201 @@
+'use strict';
+// provision-render.js — the Render standup leg: the runner half of the `render-standup`
+// intent (task 1004183; ADR 0327, ADR 0345). What it stands up is the project's APP, from
+// the project's own repository — never the Bongos hall, which we host (task 1004350). Its own file because provision.js sits at
+// the size ratchet; the dispatch there requires it inline.
+//
+// WHAT IT DOES. Stands a project up on its OWNER's Render account, with a key the owner
+// lent for this one run:
+//   - ADOPT links a Render service the owner already runs for this repository. It reads
+//     that service through the workspace guard, checks it builds this project's
+//     repository, and records it. It makes NO write call to their account.
+//   - GREENFIELD creates the Postgres when the owner asked for one, then the web service
+//     (render-payload.js decides what they are). Render deploys a new service on its own.
+// Ids are written to the row as each resource is created, so an owner who re-enters their
+// key after a failure resumes onto what already exists instead of creating a second one.
+//
+// THE KEY IS BORROWED, NEVER STORED (ADR 0327 §2). It reaches this leg encrypted on the
+// intent (provisioning_intents.borrowed_key_enc). It is decrypted here, used for this run
+// only, and the column is cleared in a `finally` — on success, on a refusal and on a
+// throw. resolveIntent clears it again, and the table's CHECK refuses a resolved intent
+// that still holds one. What the encryption buys, said plainly: it protects the key from
+// a database dump or a nightly backup while the intent waits. It does NOT defend against
+// a compromised web tier — the key arrives there in plaintext before anything can
+// encrypt it.
+//
+// A FAILURE IS TERMINAL. Every failure returns `terminal: true`, so the runner retires the
+// intent instead of re-queuing it. There is no key left to retry with, and an unattended
+// retry holding someone else's cloud credential is not a thing this platform does: the
+// owner retries by entering their key again.
+//
+// Every Render call goes through scripts/bongos/render-api.js, which pins the workspace and
+// asserts it on every response, and which cannot delete.
+
+const { RenderApi } = require('./render-api.js');
+const payload = require('./render-payload.js');
+const { parseTargetRef } = require('./provision-repo-auth.js');
+
+// A key waiting longer than this was lent for a run that never came. It is refused and
+// cleared rather than spent late.
+const KEY_TTL_MS = 30 * 60 * 1000;
+
+function renderApiFor(deps, token, ownerId) {
+  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
+  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
+}
+
+// Merge `patch` into the row's app_host. The runner is the only writer while an intent
+// runs, and the web tier only writes it when enqueuing, which the open-intent index
+// serialises — so a merge needs no read-modify-write.
+async function recordAppHost(db, instId, patch) {
+  await db.query(
+    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
+    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
+}
+
+async function clearBorrowedKey(db, intentId) {
+  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
+}
+
+// Whether a Render service's repository is this project's. Render reports it as a URL;
+// compared as owner/name, case-insensitively, the way GitHub resolves them.
+function sameRepo(renderRepo, targetRef) {
+  const a = parseTargetRef(renderRepo), b = parseTargetRef(targetRef);
+  return !!(a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase());
+}
+
+async function adopt(api, inst, host, { db, log }) {
+  if (!host.serviceId) throw new Error('adopting needs the id of the Render service to link');
+  const svc = await api.getService(host.serviceId);
+  // Linking someone's other service to this project would show its URL as this app's.
+  if (!sameRepo(svc.repo, inst.target_ref)) {
+    throw new Error(`Render service ${svc.id} builds ${svc.repo || 'no repository'}, not ${inst.target_ref}`);
+  }
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+  await recordAppHost(db, inst.id, { state: 'linked', serviceUrl: url, error: null });
+  log(`  [render] linked ${inst.slug} to service ${svc.id}${url ? ` (${url})` : ''} — nothing created or changed on Render`);
+  return { ok: true };
+}
+
+async function greenfield(api, inst, host, deps) {
+  const { db, log } = deps;
+  const plans = payload.plansFor(host);
+  const build = payload.buildFor(host);
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) throw new Error('the project has no GitHub repository for Render to build from');
+
+  // 1. The database, only when the owner asked for one — reused if a previous run got
+  //    this far.
+  let dbUrl = null;
+  if (host.database === true) {
+    let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
+    if (!pg) {
+      pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
+      await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
+      log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
+    }
+    await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
+    const conn = await api.postgresConnectionInfo(pg.id);
+    dbUrl = conn && conn.internalConnectionString;
+    if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
+  }
+
+  // 2. The app's web service — reused likewise. Render starts its first deploy itself.
+  let svc = host.serviceId ? await api.getService(host.serviceId) : null;
+  if (!svc) {
+    const created = await api.createService(payload.renderServicePayload(inst, {
+      ownerId: api.ownerId, repoUrl: `https://github.com/${repo.owner}/${repo.name}`, branch: host.branch,
+      webPlan: plans.webPlan, region: plans.region, build, dbUrl,
+    }));
+    svc = created.service;
+    await recordAppHost(db, inst.id, { serviceId: svc.id, webPlan: plans.webPlan, region: plans.region, state: 'creating' });
+    log(`  [render] created web service ${svc.id} (${plans.webPlan}, ${build.runtime})`);
+  }
+  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
+  await recordAppHost(db, inst.id, { state: 'deploying', serviceUrl: url, error: null });
+  log(`  [render] ${inst.slug} is deploying at ${url}`);
+  return { ok: true };
+}
+
+// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
+// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
+// so an answer from Render is re-said as a sentence with Render's own reason kept whole
+// (task 1004464). Anything else is already the leg's own words.
+function plainReason(e) {
+  const msg = e && e.message ? e.message : String(e);
+  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
+  if (said) return `Render would not set up the app: ${said}`;
+  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
+  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
+}
+
+async function renderStandupInstance(inst, deps, intent) {
+  const { db, log } = deps;
+  const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
+  const host = inst.app_host || {};
+  try {
+    if (!intent || !intent.borrowed_key_enc) return refuse('no Render key came with this request — enter it again to retry');
+    if (host.platform !== 'render') return refuse(`this project's app is not set to run on Render (platform '${host.platform || 'none'}')`);
+    if (!host.ownerId) return refuse('no Render workspace was chosen');
+    const age = Date.now() - new Date(intent.created_at || 0).getTime();
+    if (!(age < KEY_TTL_MS)) return refuse('the Render key waited too long to be used and was cleared — enter it again to retry');
+    if (host.mode !== 'adopt' && host.mode !== 'greenfield') return refuse(`unknown Render setup mode '${host.mode}'`);
+
+    const api = renderApiFor(deps, secretBox.decrypt(intent.borrowed_key_enc), host.ownerId);
+    // Membership, never selection: the workspace is the one the owner named, and it must
+    // be one this key can act in.
+    const owners = await api.listOwners();
+    if (!owners.some((o) => o.id === host.ownerId)) return refuse(`this Render key cannot reach workspace ${host.ownerId}`);
+
+    return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
+  } catch (e) {
+    return refuse(plainReason(e));
+  } finally {
+    if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
+  }
+
+  async function refuse(error) {
+    await recordAppHost(db, inst.id, { state: 'failed', error }).catch(() => {});
+    log(`  ✖ [render] ${inst.slug}: ${error}`);
+    return { ok: false, terminal: true, error };
+  }
+}
+
+// The wizard's path (task 1004352): Create queues the project's `provision` run, and the
+// key the owner lent arrives on THAT run a moment later (render-standup.js
+// attachToProvision). So after the project is set up, this runs the Render leg in the same
+// drain. The key is re-read from the row, because it may have been attached after this
+// run was claimed. Whatever happens the key is gone when this returns:
+//   - project up → the Render leg spends and clears it. Its failure is the APP's, recorded
+//     on app_host; the project itself is still up, so the provision run stays a success;
+//   - project not up → the key is cleared now and the app marked failed, so a provision
+//     retry never carries a key into a later run. The owner connects Render again once the
+//     project is up.
+async function afterProvision(inst, deps, intent, result) {
+  const { db } = deps;
+  const { rows } = await db.query(`SELECT borrowed_key_enc FROM provisioning_intents WHERE id = $1`, [intent.id]);
+  const keyEnc = rows[0] && rows[0].borrowed_key_enc;
+  if (!keyEnc) return result;
+  if (!result || result.ok === false) {
+    await clearBorrowedKey(db, intent.id);
+    await recordAppHost(db, inst.id, { state: 'failed', error: 'the project could not be set up, so its app was not set up on Render — connect Render again once the project is live' }).catch(() => {});
+    return result;
+  }
+  const fresh = (await deps.provisioning.getInstanceById(db, inst.id)) || inst;
+  const app = await renderStandupInstance(fresh, deps, { ...intent, borrowed_key_enc: keyEnc });
+  if (app.ok) return result;
+  return { ...result, doneNote: `project is up, but its app was not set up on Render: ${app.error}` };
+}
+
+// Teardown's half (ADR 0327 §3): forget the Render app, never delete it. The ids stay on
+// the row so an operator can still say which services were the project's; the owner
+// deletes them in their own Render dashboard if they want to stop paying.
+async function forgetRenderApp(inst, { db, log, apply }) {
+  const host = inst.app_host;
+  if (!host || host.platform !== 'render') return;
+  const what = [host.serviceId && `service ${host.serviceId}`, host.postgresId && `database ${host.postgresId}`].filter(Boolean).join(' and ') || 'nothing yet';
+  log(`  [render] ${apply ? 'disconnected' : 'would disconnect'} from Render (${what}); nothing on Render is deleted — the owner removes it in their own dashboard`);
+  if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
+}
+
+module.exports = { renderStandupInstance, afterProvision, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };

package/scripts/bongos/provision-repo-auth.js

@@ -0,0 +1,164 @@
+// scripts/bongos/provision-repo-auth.js — the repo-identity + owner-credential leaf: parse a
+// `target_ref` into { owner, name }, build an instance's SSH deploy remote, find the
+// provisioning row that owns a checkout, and read that owner's stored GitHub token
+// (task 1003081).
+//
+// WHY THIS FILE EXISTS AT ALL. scripts/bongos/upgrade.js is inside the merge resolver's
+// EXECUTED CLOSURE (modules/lifecycle/executed-closure.js; 2026-08-29 security audit ref
+// B1) — the set of files the server may run out of a CLONED BUILDER BRANCH. That closure
+// is a STATIC walk of string-literal requires, and it does not care whether a require is
+// lazy or inside a function: upgrade.js reaching these helpers through `./provision`
+// dragged provision.js plus provision-config/-repo/-units/-net.js into the closure with
+// it — five more files a branch could edit into the live server's process, three of them
+// carrying computed requires (provision-config 7, provision-repo 1, provision-units 1)
+// that tests/executed_closure.mjs has no account of. Carving the helpers into this LEAF
+// instead grows the closure by exactly ONE small file, whose computed-require count is
+// pinned in that test.
+//
+// THE RULE THAT KEEPS IT THAT WAY. Top level requires node builtins ONLY. Every
+// non-builtin require is lazy AND inside a function body, so nothing on the generator
+// path ever resolves it. Never require provision-config.js (or any other provision file)
+// from here — REPO_ROOT is recomputed below precisely so we don't have to.
+//
+// provision-repo.js requires this module and re-exports parseTargetRef,
+// instanceRepoRemote and resolveOwnerGithubToken unchanged, so provision.js,
+// provision-units.js, modules/provisioning/credential-preflight.js and their tests see
+// exactly the surface they saw before.
+
+'use strict';
+
+const { execFileSync } = require('node:child_process');
+const path = require('node:path');
+
+// The same value provision-config.js exports as REPO_ROOT, recomputed here rather than
+// imported: that module carries seven computed requires, and importing it would put all
+// of them inside the executed closure (see the header).
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// Parse an 'owner/repo' (or a github SSH/HTTPS URL) target_ref → { owner, name }.
+// Null when unparseable, so the scaffold can fail with actionable guidance.
+function parseTargetRef(ref) {
+  const m = String(ref || '').trim()
+    .replace(/^git@[^:]+:/, '')
+    .replace(/^https?:\/\/[^/]+\//, '')
+    .match(/^([A-Za-z0-9][A-Za-z0-9_.-]*)\/([A-Za-z0-9][A-Za-z0-9_.-]*?)(?:\.git)?$/);
+  return m ? { owner: m[1], name: m[2] } : null;
+}
+
+// The SSH alias the founder control plane wires for the platform repo (ADR 0125/0129).
+const DEPLOY_ALIAS = 'github-deploy';
+
+// One probe per alias per process — `ssh -G` re-reads the same static config every call.
+const aliasProbeCache = new Map();
+
+// Does an SSH host alias actually resolve HERE? `ssh -G <name>` prints the effective
+// config for that name: a real `Host <name>` block rewrites `hostname`, an absent one
+// echoes the name straight back — which is then exactly what git hands to DNS, and
+// fails on. A box with no ssh client at all answers the same way. This has to be probed
+// rather than assumed because the alias is a property of ONE box's ~/.ssh/config, not of
+// this code (task 1003996). `runSsh` is injectable for tests; nothing spawns at require
+// time, so this file stays inert on the merge-resolver path (see the header).
+function sshAliasResolves(alias, runSsh) {
+  if (!runSsh && aliasProbeCache.has(alias)) return aliasProbeCache.get(alias);
+  let resolves = false;
+  try {
+    const probe = runSsh || ((a) => execFileSync('ssh', ['-G', a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }));
+    const hostname = (String(probe(alias)).match(/^hostname[ \t]+(\S+)/mi) || [])[1];
+    resolves = !!hostname && hostname.toLowerCase() !== alias.toLowerCase();
+  } catch { resolves = false; }
+  if (!runSsh) aliasProbeCache.set(alias, resolves);
+  return resolves;
+}
+
+// The git remote for an instance's OWN repo — git@<alias>:<owner>/<repo>.git, NO secret
+// in the command (SSH-key auth, nothing to leak into journald).
+//
+// Which <alias>: an explicit one, else PROVISION_GIT_SSH_ALIAS, else the control plane's
+// own deploy alias WHEN IT RESOLVES here, else github.com. The last two rungs are the
+// point: reusing the founder box's alias is what makes the instance repo reachable by the
+// same key that already pushes the platform repo (ADR 0125), and on that box the probe
+// keeps choosing it. Anywhere else the alias is a dangling name, and `git@github.com:` is
+// both the correct address and the one a plane's own deploy key is issued against.
+function instanceRepoRemote(repo, { sshAlias, runSsh } = {}) {
+  const alias = sshAlias
+    || process.env.PROVISION_GIT_SSH_ALIAS
+    || (sshAliasResolves(DEPLOY_ALIAS, runSsh) ? DEPLOY_ALIAS : 'github.com');
+  return `git@${alias}:${repo.owner}/${repo.name}.git`;
+}
+
+// Every remote URL shape this code writes for `repo`: the github.com form plus the deploy
+// alias in play. What a stored remote is VALIDATED against (upgrade.js), which must not
+// re-run the probe — a remote we wrote stays ours even from a box where the alias no
+// longer resolves.
+function instanceRepoRemotes(repo) {
+  const aliases = new Set(['github.com', DEPLOY_ALIAS]);
+  if (process.env.PROVISION_GIT_SSH_ALIAS) aliases.add(process.env.PROVISION_GIT_SSH_ALIAS);
+  return [...aliases].map((a) => `git@${a}:${repo.owner}/${repo.name}.git`);
+}
+
+// The instance owner's stored `repo`-scoped OAuth token (ADR 0155), or null (none
+// stored, org-owned repo, secret-box off). Shared by the scaffold push, the
+// private-repo deploy-key wiring, the teardown revoke, and upgrade.js's pin push.
+// `deps.getGithubToken` is injectable for tests; production resolves it lazily against
+// the core db slice with the runner's pool.
+async function resolveOwnerGithubToken(inst, deps, { tag = '[repo-auth]' } = {}) {
+  if (!inst.owner_builder_id) return null;
+  try {
+    const fetchTok = deps.getGithubToken
+      || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db })); // eslint-disable-line global-require
+    const r = await fetchTok(inst.owner_builder_id);
+    return r && r.token ? r.token : null;
+  } catch (e) {
+    (deps.log || (() => {}))(`  ${tag} owner OAuth token lookup failed (${e && e.message})`);
+    return null;
+  }
+}
+
+// The provisioning row that owns a checkout — where `owner_builder_id` (whose token) and
+// `target_ref` (which repo) come from. A control-plane caller hands it over as
+// `deps.instance`; a CLI run on the control plane (`--instance /srv/bongos/<slug>`) finds
+// it by the checkout's basename, which standaloneRoot makes the slug. An instance's own
+// database has no provisioning table and answers null — that is the origin path, not an
+// error, so every failure here is swallowed. The default lookup requires the core pool
+// in-process (a CLI run exits right after; a programmatic caller passes `deps.db` or
+// `deps.getInstanceBySlug`).
+//
+// It lives HERE rather than in its only caller, upgrade.js: both of its default requires
+// are computed, and upgrade.js is in the executed closure with a pinned count of its own
+// (see the header). Keeping them on this side leaves upgrade.js string-literal-only.
+async function lookupInstanceRow(instanceDir, deps = {}) {
+  if (deps.instance) return deps.instance;
+  const slug = path.basename(instanceDir);
+  try {
+    const bySlug = deps.getInstanceBySlug || (async (s) => {
+      const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
+      const db = deps.db || require(path.join(REPO_ROOT, 'src/bongos/pool')).pool; // eslint-disable-line global-require
+      return provisioning.getInstanceBySlug(db, s);
+    });
+    const row = await bySlug(slug);
+    return row && row.owner_builder_id && row.target_ref ? row : null;
+  } catch { return null; }
+}
+
+// What upgrade.js's pin push says when lookupInstanceRow found NO row on a checkout wired
+// with a read-only deploy key (task 1004065). PURE.
+//
+// That pairing is NOT the origin path the header above describes. The key says this is a
+// hosted private project (ADR 0176), and its own database never has the provisioning row
+// (ADR 0281) — so the owner's token cannot be looked up here, and the remote the push
+// falls back to cannot write. Silence made that indistinguishable from a misconfiguration.
+// A missing row anywhere else IS the origin path and stays quiet, which is why the caller
+// only asks for this line when the key is present. Lives here rather than beside its
+// caller because upgrade.js sits exactly at the oversized-file ratchet.
+function missingRowNote(key, remote = 'origin') {
+  return `  • pin push: no provisioning row is readable from this database, so the owner's GitHub token cannot be looked up here — and ${remote} is the read-only deploy key at ${key}. A hosted project's own database never has that row (ADR 0281); the deploy door pushes the pin from the hub instead (task 1004065).`;
+}
+
+module.exports = {
+  instanceRepoRemote,
+  instanceRepoRemotes,
+  lookupInstanceRow,
+  missingRowNote,
+  parseTargetRef,
+  resolveOwnerGithubToken,
+};

package/scripts/bongos/provision-repo-private.js

@@ -0,0 +1,98 @@
+'use strict';
+// provision-repo-private.js — "make this project's repository private": the runner leg
+// (task 1004193, split (b) of task 1003078; ADR 0176).
+//
+// WHY. A project stood up while its repository was public reads its code with the
+// platform's shared deploy key, which cannot read a private repository. Flip such a
+// repository private and the project's next deploy pull fails (walk finding N4). Standups
+// since ADR 0176 give a private repository the project's own read-only deploy key; this
+// leg gives an EXISTING project the same wiring, and only then flips.
+//
+// ORDER IS THE SAFETY PROPERTY. Wire the key FIRST, flip SECOND. A deploy key authenticates
+// against a still-public repository, so wiring first leaves no window in which the repo is
+// private and the checkout still reads with the shared key. ensurePrivateRepoAccess would
+// see the repo as public and do nothing, so it is told where the repo is going
+// (`intendedPrivate`, task 1004167). If the flip then fails, the repository is public with
+// a working key — harmless, and the retry re-runs both steps idempotently.
+//
+// Every expected failure returns { ok:false } rather than throwing: a throw makes the
+// runner mark the whole project 'error', and a project that could not be made private is
+// still running fine. The error text is the owner's sentence — it rides error_note onto
+// the project card once the retries are spent.
+//
+// Its own file because provision.js sits at the size ratchet (the provision-disconnect.js
+// precedent). The web tier only enqueues (modules/provisioning/repo-private.js).
+
+const path = require('node:path');
+const { REPO_ROOT } = require('./provision-config.js');
+const { parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
+const { ensurePrivateRepoAccess } = require('./provision-repo.js');
+
+// A failed shell step (execSync: stderr/output) or file read (a Node system error: syscall)
+// carries the command line, box paths and stderr in its message. It never reaches the
+// owner's card; a GithubApiError, or a fetch error whose syscall sits on its own cause,
+// matches neither.
+const isBoxFailure = (e) => !!e && (e.stderr !== undefined || Array.isArray(e.output) || typeof e.syscall === 'string');
+
+async function repoPrivateInstance(inst, deps) {
+  const { db, provisioning, log, apply } = deps;
+  log(`repo-private ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
+
+  // Only a standalone project has its own checkout to wire; any other shape reads from a
+  // checkout this project does not own, so a key minted here would change nothing.
+  if (inst.hosting_shape !== 'cloud-host') {
+    return { ok: false, error: 'This project shares its code checkout with others, so its repository cannot be made private from here.' };
+  }
+  if (inst.status !== 'active') {
+    return { ok: false, error: `This project is ${inst.status}, not running, so its repository was not changed. Try again once it is live.` };
+  }
+  const repo = parseTargetRef(inst.target_ref);
+  if (!repo) return { ok: false, error: 'This project has no GitHub repository on record, so there is nothing to make private.' };
+
+  let wired;
+  try {
+    wired = await ensurePrivateRepoAccess(inst, { ...deps, intendedPrivate: true });
+  } catch (e) {
+    if (isBoxFailure(e) || isBoxFailure(e && e.cause)) {
+      log(`  [repo-private] deploy-key setup failed on the box: ${(e && e.message) || e}`);
+      return { ok: false, error: `${repo.owner}/${repo.name} is still public: its deploy key could not be set up on the server. Nothing on your side caused this, and trying again is safe.` };
+    }
+    return { ok: false, error: (e && e.message) || String(e) };
+  }
+  if (!apply) {
+    log(`  [repo-private] would then make ${repo.owner}/${repo.name} private with the owner's credential — only after the deploy key above is wired (dry-run — nothing ran)`);
+    return { ok: true, planned: true };
+  }
+  if (!wired || wired.private !== true) {
+    // Defensive: with intendedPrivate set, a standalone row with a repo either wires or
+    // throws. Anything else means the checkout is unwired, and flipping would break it.
+    return { ok: false, error: `The deploy key for ${repo.owner}/${repo.name} could not be set up, so the repository was left public.` };
+  }
+
+  const token = await resolveOwnerGithubToken(inst, deps);
+  if (!token) {
+    return { ok: false, error: `${repo.owner}/${repo.name} was not made private: the project's GitHub credential could not be read. Its deploy key is already in place, so reconnect GitHub and try again.` };
+  }
+  const ghRepos = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos'));
+  try {
+    log(`  [repo-private] making ${repo.owner}/${repo.name} private`);
+    await ghRepos.makeRepoPrivate(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
+  } catch (e) {
+    const why = e && e.code === 'not_repo_admin' ? 'GitHub refused — the connected account cannot change this repository’s settings'
+      : e && e.code === 'repo_not_found' ? 'GitHub could not find the repository with the connected account'
+      : `GitHub could not make the change (${(e && e.message) || e})`;
+    return { ok: false, error: `${repo.owner}/${repo.name} is still public: ${why}. Its deploy key is already in place, so trying again is safe.` };
+  }
+
+  await provisioning.recordEvent(db, {
+    instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'repo-private',
+    detail: `${repo.owner}/${repo.name} made private — the project now reads it with its own read-only deploy key${wired.minted ? ' (newly registered)' : ''}`,
+    actor: 'runner',
+  }).catch(() => {});
+  // A make-private that failed earlier left "still public" on the card; this run made it private.
+  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'repo-private').catch(() => {});
+  log(`  ✓ ${repo.owner}/${repo.name} is private; ${inst.slug} reads it with its own deploy key`);
+  return { ok: true, minted: !!wired.minted };
+}
+
+module.exports = { repoPrivateInstance };