@bongos/core 1.21.175 → 1.21.176

package/scripts/gds/provision-render.js

@@ -1,201 +1,6 @@
+// scripts/gds/provision-render.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-render.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// provision-render.js — the Render standup leg: the runner half of the `render-standup`
-// intent (task 1004183; ADR 0327, ADR 0345). What it stands up is the project's APP, from
-// the project's own repository — never the Bongos hall, which we host (task 1004350). Its own file because provision.js sits at
-// the size ratchet; the dispatch there requires it inline.
-//
-// WHAT IT DOES. Stands a project up on its OWNER's Render account, with a key the owner
-// lent for this one run:
-//   - ADOPT links a Render service the owner already runs for this repository. It reads
-//     that service through the workspace guard, checks it builds this project's
-//     repository, and records it. It makes NO write call to their account.
-//   - GREENFIELD creates the Postgres when the owner asked for one, then the web service
-//     (render-payload.js decides what they are). Render deploys a new service on its own.
-// Ids are written to the row as each resource is created, so an owner who re-enters their
-// key after a failure resumes onto what already exists instead of creating a second one.
-//
-// THE KEY IS BORROWED, NEVER STORED (ADR 0327 §2). It reaches this leg encrypted on the
-// intent (provisioning_intents.borrowed_key_enc). It is decrypted here, used for this run
-// only, and the column is cleared in a `finally` — on success, on a refusal and on a
-// throw. resolveIntent clears it again, and the table's CHECK refuses a resolved intent
-// that still holds one. What the encryption buys, said plainly: it protects the key from
-// a database dump or a nightly backup while the intent waits. It does NOT defend against
-// a compromised web tier — the key arrives there in plaintext before anything can
-// encrypt it.
-//
-// A FAILURE IS TERMINAL. Every failure returns `terminal: true`, so the runner retires the
-// intent instead of re-queuing it. There is no key left to retry with, and an unattended
-// retry holding someone else's cloud credential is not a thing this platform does: the
-// owner retries by entering their key again.
-//
-// Every Render call goes through scripts/gds/render-api.js, which pins the workspace and
-// asserts it on every response, and which cannot delete.
-
-const { RenderApi } = require('./render-api.js');
-const payload = require('./render-payload.js');
-const { parseTargetRef } = require('./provision-repo-auth.js');
-
-// A key waiting longer than this was lent for a run that never came. It is refused and
-// cleared rather than spent late.
-const KEY_TTL_MS = 30 * 60 * 1000;
-
-function renderApiFor(deps, token, ownerId) {
-  if (deps.renderApiFactory) return deps.renderApiFactory({ token, ownerId });
-  return new RenderApi({ token, ownerId, dryRun: !deps.apply, fetchImpl: deps.fetchImpl, log: deps.log });
-}
-
-// Merge `patch` into the row's app_host. The runner is the only writer while an intent
-// runs, and the web tier only writes it when enqueuing, which the open-intent index
-// serialises — so a merge needs no read-modify-write.
-async function recordAppHost(db, instId, patch) {
-  await db.query(
-    `UPDATE provisioning_instances SET app_host = COALESCE(app_host, '{}'::jsonb) || $2::jsonb WHERE id = $1`,
-    [instId, JSON.stringify({ ...patch, updatedAt: new Date().toISOString() })]);
-}
-
-async function clearBorrowedKey(db, intentId) {
-  await db.query(`UPDATE provisioning_intents SET borrowed_key_enc = NULL WHERE id = $1`, [intentId]);
-}
-
-// Whether a Render service's repository is this project's. Render reports it as a URL;
-// compared as owner/name, case-insensitively, the way GitHub resolves them.
-function sameRepo(renderRepo, targetRef) {
-  const a = parseTargetRef(renderRepo), b = parseTargetRef(targetRef);
-  return !!(a && b && a.owner.toLowerCase() === b.owner.toLowerCase() && a.name.toLowerCase() === b.name.toLowerCase());
-}
-
-async function adopt(api, inst, host, { db, log }) {
-  if (!host.serviceId) throw new Error('adopting needs the id of the Render service to link');
-  const svc = await api.getService(host.serviceId);
-  // Linking someone's other service to this project would show its URL as this app's.
-  if (!sameRepo(svc.repo, inst.target_ref)) {
-    throw new Error(`Render service ${svc.id} builds ${svc.repo || 'no repository'}, not ${inst.target_ref}`);
-  }
-  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
-  await recordAppHost(db, inst.id, { state: 'linked', serviceUrl: url, error: null });
-  log(`  [render] linked ${inst.slug} to service ${svc.id}${url ? ` (${url})` : ''} — nothing created or changed on Render`);
-  return { ok: true };
-}
-
-async function greenfield(api, inst, host, deps) {
-  const { db, log } = deps;
-  const plans = payload.plansFor(host);
-  const build = payload.buildFor(host);
-  const repo = parseTargetRef(inst.target_ref);
-  if (!repo) throw new Error('the project has no GitHub repository for Render to build from');
-
-  // 1. The database, only when the owner asked for one — reused if a previous run got
-  //    this far.
-  let dbUrl = null;
-  if (host.database === true) {
-    let pg = host.postgresId ? await api.getPostgres(host.postgresId) : null;
-    if (!pg) {
-      pg = await api.createPostgres(payload.renderPostgresPayload(inst, { ownerId: api.ownerId, dbPlan: plans.dbPlan, region: plans.region }));
-      await recordAppHost(db, inst.id, { postgresId: pg.id, dbPlan: plans.dbPlan, state: 'creating' });
-      log(`  [render] created database ${pg.id} (${plans.dbPlan})`);
-    }
-    await api.settlePostgres(pg.id, { sleepFn: deps.sleepFn });
-    const conn = await api.postgresConnectionInfo(pg.id);
-    dbUrl = conn && conn.internalConnectionString;
-    if (!dbUrl) throw new Error(`Render gave database ${pg.id} no internal connection string`);
-  }
-
-  // 2. The app's web service — reused likewise. Render starts its first deploy itself.
-  let svc = host.serviceId ? await api.getService(host.serviceId) : null;
-  if (!svc) {
-    const created = await api.createService(payload.renderServicePayload(inst, {
-      ownerId: api.ownerId, repoUrl: `https://github.com/${repo.owner}/${repo.name}`, branch: host.branch,
-      webPlan: plans.webPlan, region: plans.region, build, dbUrl,
-    }));
-    svc = created.service;
-    await recordAppHost(db, inst.id, { serviceId: svc.id, webPlan: plans.webPlan, region: plans.region, state: 'creating' });
-    log(`  [render] created web service ${svc.id} (${plans.webPlan}, ${build.runtime})`);
-  }
-  const url = (svc.serviceDetails && svc.serviceDetails.url) || null;
-  await recordAppHost(db, inst.id, { state: 'deploying', serviceUrl: url, error: null });
-  log(`  [render] ${inst.slug} is deploying at ${url}`);
-  return { ok: true };
-}
-
-// The owner reads this reason on the setup screen (app-status.js oneSentence). A refusal
-// from Render's API used to arrive as its raw line — "Render POST /services failed: …" —
-// so an answer from Render is re-said as a sentence with Render's own reason kept whole
-// (task 1004464). Anything else is already the leg's own words.
-function plainReason(e) {
-  const msg = e && e.message ? e.message : String(e);
-  const said = e && e.status != null && e.body && typeof e.body.message === 'string' ? e.body.message.trim() : '';
-  if (said) return `Render would not set up the app: ${said}`;
-  const m = /^Render (?:GET|POST|PATCH|PUT|DELETE) \S+ failed: ([\s\S]+)$/.exec(msg);
-  return m ? `Render would not set up the app: ${m[1].trim()}` : msg;
-}
-
-async function renderStandupInstance(inst, deps, intent) {
-  const { db, log } = deps;
-  const secretBox = deps.secretBox || require('../../src/bongos/secret-box');
-  const host = inst.app_host || {};
-  try {
-    if (!intent || !intent.borrowed_key_enc) return refuse('no Render key came with this request — enter it again to retry');
-    if (host.platform !== 'render') return refuse(`this project's app is not set to run on Render (platform '${host.platform || 'none'}')`);
-    if (!host.ownerId) return refuse('no Render workspace was chosen');
-    const age = Date.now() - new Date(intent.created_at || 0).getTime();
-    if (!(age < KEY_TTL_MS)) return refuse('the Render key waited too long to be used and was cleared — enter it again to retry');
-    if (host.mode !== 'adopt' && host.mode !== 'greenfield') return refuse(`unknown Render setup mode '${host.mode}'`);
-
-    const api = renderApiFor(deps, secretBox.decrypt(intent.borrowed_key_enc), host.ownerId);
-    // Membership, never selection: the workspace is the one the owner named, and it must
-    // be one this key can act in.
-    const owners = await api.listOwners();
-    if (!owners.some((o) => o.id === host.ownerId)) return refuse(`this Render key cannot reach workspace ${host.ownerId}`);
-
-    return host.mode === 'adopt' ? await adopt(api, inst, host, deps) : await greenfield(api, inst, host, deps);
-  } catch (e) {
-    return refuse(plainReason(e));
-  } finally {
-    if (intent && intent.id != null) await clearBorrowedKey(db, intent.id);
-  }
-
-  async function refuse(error) {
-    await recordAppHost(db, inst.id, { state: 'failed', error }).catch(() => {});
-    log(`  ✖ [render] ${inst.slug}: ${error}`);
-    return { ok: false, terminal: true, error };
-  }
-}
-
-// The wizard's path (task 1004352): Create queues the project's `provision` run, and the
-// key the owner lent arrives on THAT run a moment later (render-standup.js
-// attachToProvision). So after the project is set up, this runs the Render leg in the same
-// drain. The key is re-read from the row, because it may have been attached after this
-// run was claimed. Whatever happens the key is gone when this returns:
-//   - project up → the Render leg spends and clears it. Its failure is the APP's, recorded
-//     on app_host; the project itself is still up, so the provision run stays a success;
-//   - project not up → the key is cleared now and the app marked failed, so a provision
-//     retry never carries a key into a later run. The owner connects Render again once the
-//     project is up.
-async function afterProvision(inst, deps, intent, result) {
-  const { db } = deps;
-  const { rows } = await db.query(`SELECT borrowed_key_enc FROM provisioning_intents WHERE id = $1`, [intent.id]);
-  const keyEnc = rows[0] && rows[0].borrowed_key_enc;
-  if (!keyEnc) return result;
-  if (!result || result.ok === false) {
-    await clearBorrowedKey(db, intent.id);
-    await recordAppHost(db, inst.id, { state: 'failed', error: 'the project could not be set up, so its app was not set up on Render — connect Render again once the project is live' }).catch(() => {});
-    return result;
-  }
-  const fresh = (await deps.provisioning.getInstanceById(db, inst.id)) || inst;
-  const app = await renderStandupInstance(fresh, deps, { ...intent, borrowed_key_enc: keyEnc });
-  if (app.ok) return result;
-  return { ...result, doneNote: `project is up, but its app was not set up on Render: ${app.error}` };
-}
-
-// Teardown's half (ADR 0327 §3): forget the Render app, never delete it. The ids stay on
-// the row so an operator can still say which services were the project's; the owner
-// deletes them in their own Render dashboard if they want to stop paying.
-async function forgetRenderApp(inst, { db, log, apply }) {
-  const host = inst.app_host;
-  if (!host || host.platform !== 'render') return;
-  const what = [host.serviceId && `service ${host.serviceId}`, host.postgresId && `database ${host.postgresId}`].filter(Boolean).join(' and ') || 'nothing yet';
-  log(`  [render] ${apply ? 'disconnected' : 'would disconnect'} from Render (${what}); nothing on Render is deleted — the owner removes it in their own dashboard`);
-  if (apply) await recordAppHost(db, inst.id, { state: 'disconnected' });
-}
-
-module.exports = { renderStandupInstance, afterProvision, forgetRenderApp, clearBorrowedKey, recordAppHost, KEY_TTL_MS };
+require('../bongos/forwarder.js').forward(module, 'provision-render.js');

package/scripts/gds/provision-repo-auth.js

@@ -1,164 +1,6 @@
-// scripts/gds/provision-repo-auth.js — the repo-identity + owner-credential leaf: parse a
-// `target_ref` into { owner, name }, build an instance's SSH deploy remote, find the
-// provisioning row that owns a checkout, and read that owner's stored GitHub token
-// (task 1003081).
-//
-// WHY THIS FILE EXISTS AT ALL. scripts/gds/upgrade.js is inside the merge resolver's
-// EXECUTED CLOSURE (modules/lifecycle/executed-closure.js; 2026-08-29 security audit ref
-// B1) — the set of files the server may run out of a CLONED BUILDER BRANCH. That closure
-// is a STATIC walk of string-literal requires, and it does not care whether a require is
-// lazy or inside a function: upgrade.js reaching these helpers through `./provision`
-// dragged provision.js plus provision-config/-repo/-units/-net.js into the closure with
-// it — five more files a branch could edit into the live server's process, three of them
-// carrying computed requires (provision-config 7, provision-repo 1, provision-units 1)
-// that tests/executed_closure.mjs has no account of. Carving the helpers into this LEAF
-// instead grows the closure by exactly ONE small file, whose computed-require count is
-// pinned in that test.
-//
-// THE RULE THAT KEEPS IT THAT WAY. Top level requires node builtins ONLY. Every
-// non-builtin require is lazy AND inside a function body, so nothing on the generator
-// path ever resolves it. Never require provision-config.js (or any other provision file)
-// from here — REPO_ROOT is recomputed below precisely so we don't have to.
-//
-// provision-repo.js requires this module and re-exports parseTargetRef,
-// instanceRepoRemote and resolveOwnerGithubToken unchanged, so provision.js,
-// provision-units.js, modules/provisioning/credential-preflight.js and their tests see
-// exactly the surface they saw before.
-
+// scripts/gds/provision-repo-auth.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-repo-auth.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-
-const { execFileSync } = require('node:child_process');
-const path = require('node:path');
-
-// The same value provision-config.js exports as REPO_ROOT, recomputed here rather than
-// imported: that module carries seven computed requires, and importing it would put all
-// of them inside the executed closure (see the header).
-const REPO_ROOT = path.resolve(__dirname, '..', '..');
-
-// Parse an 'owner/repo' (or a github SSH/HTTPS URL) target_ref → { owner, name }.
-// Null when unparseable, so the scaffold can fail with actionable guidance.
-function parseTargetRef(ref) {
-  const m = String(ref || '').trim()
-    .replace(/^git@[^:]+:/, '')
-    .replace(/^https?:\/\/[^/]+\//, '')
-    .match(/^([A-Za-z0-9][A-Za-z0-9_.-]*)\/([A-Za-z0-9][A-Za-z0-9_.-]*?)(?:\.git)?$/);
-  return m ? { owner: m[1], name: m[2] } : null;
-}
-
-// The SSH alias the founder control plane wires for the platform repo (ADR 0125/0129).
-const DEPLOY_ALIAS = 'github-deploy';
-
-// One probe per alias per process — `ssh -G` re-reads the same static config every call.
-const aliasProbeCache = new Map();
-
-// Does an SSH host alias actually resolve HERE? `ssh -G <name>` prints the effective
-// config for that name: a real `Host <name>` block rewrites `hostname`, an absent one
-// echoes the name straight back — which is then exactly what git hands to DNS, and
-// fails on. A box with no ssh client at all answers the same way. This has to be probed
-// rather than assumed because the alias is a property of ONE box's ~/.ssh/config, not of
-// this code (task 1003996). `runSsh` is injectable for tests; nothing spawns at require
-// time, so this file stays inert on the merge-resolver path (see the header).
-function sshAliasResolves(alias, runSsh) {
-  if (!runSsh && aliasProbeCache.has(alias)) return aliasProbeCache.get(alias);
-  let resolves = false;
-  try {
-    const probe = runSsh || ((a) => execFileSync('ssh', ['-G', a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 5000 }));
-    const hostname = (String(probe(alias)).match(/^hostname[ \t]+(\S+)/mi) || [])[1];
-    resolves = !!hostname && hostname.toLowerCase() !== alias.toLowerCase();
-  } catch { resolves = false; }
-  if (!runSsh) aliasProbeCache.set(alias, resolves);
-  return resolves;
-}
-
-// The git remote for an instance's OWN repo — git@<alias>:<owner>/<repo>.git, NO secret
-// in the command (SSH-key auth, nothing to leak into journald).
-//
-// Which <alias>: an explicit one, else PROVISION_GIT_SSH_ALIAS, else the control plane's
-// own deploy alias WHEN IT RESOLVES here, else github.com. The last two rungs are the
-// point: reusing the founder box's alias is what makes the instance repo reachable by the
-// same key that already pushes the platform repo (ADR 0125), and on that box the probe
-// keeps choosing it. Anywhere else the alias is a dangling name, and `git@github.com:` is
-// both the correct address and the one a plane's own deploy key is issued against.
-function instanceRepoRemote(repo, { sshAlias, runSsh } = {}) {
-  const alias = sshAlias
-    || process.env.PROVISION_GIT_SSH_ALIAS
-    || (sshAliasResolves(DEPLOY_ALIAS, runSsh) ? DEPLOY_ALIAS : 'github.com');
-  return `git@${alias}:${repo.owner}/${repo.name}.git`;
-}
-
-// Every remote URL shape this code writes for `repo`: the github.com form plus the deploy
-// alias in play. What a stored remote is VALIDATED against (upgrade.js), which must not
-// re-run the probe — a remote we wrote stays ours even from a box where the alias no
-// longer resolves.
-function instanceRepoRemotes(repo) {
-  const aliases = new Set(['github.com', DEPLOY_ALIAS]);
-  if (process.env.PROVISION_GIT_SSH_ALIAS) aliases.add(process.env.PROVISION_GIT_SSH_ALIAS);
-  return [...aliases].map((a) => `git@${a}:${repo.owner}/${repo.name}.git`);
-}
-
-// The instance owner's stored `repo`-scoped OAuth token (ADR 0155), or null (none
-// stored, org-owned repo, secret-box off). Shared by the scaffold push, the
-// private-repo deploy-key wiring, the teardown revoke, and upgrade.js's pin push.
-// `deps.getGithubToken` is injectable for tests; production resolves it lazily against
-// the core db slice with the runner's pool.
-async function resolveOwnerGithubToken(inst, deps, { tag = '[repo-auth]' } = {}) {
-  if (!inst.owner_builder_id) return null;
-  try {
-    const fetchTok = deps.getGithubToken
-      || ((bid) => require(path.join(REPO_ROOT, 'src/bongos/db')).getGithubToken({ builderId: bid, p: deps.db })); // eslint-disable-line global-require
-    const r = await fetchTok(inst.owner_builder_id);
-    return r && r.token ? r.token : null;
-  } catch (e) {
-    (deps.log || (() => {}))(`  ${tag} owner OAuth token lookup failed (${e && e.message})`);
-    return null;
-  }
-}
-
-// The provisioning row that owns a checkout — where `owner_builder_id` (whose token) and
-// `target_ref` (which repo) come from. A control-plane caller hands it over as
-// `deps.instance`; a CLI run on the control plane (`--instance /srv/bongos/<slug>`) finds
-// it by the checkout's basename, which standaloneRoot makes the slug. An instance's own
-// database has no provisioning table and answers null — that is the origin path, not an
-// error, so every failure here is swallowed. The default lookup requires the core pool
-// in-process (a CLI run exits right after; a programmatic caller passes `deps.db` or
-// `deps.getInstanceBySlug`).
-//
-// It lives HERE rather than in its only caller, upgrade.js: both of its default requires
-// are computed, and upgrade.js is in the executed closure with a pinned count of its own
-// (see the header). Keeping them on this side leaves upgrade.js string-literal-only.
-async function lookupInstanceRow(instanceDir, deps = {}) {
-  if (deps.instance) return deps.instance;
-  const slug = path.basename(instanceDir);
-  try {
-    const bySlug = deps.getInstanceBySlug || (async (s) => {
-      const provisioning = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
-      const db = deps.db || require(path.join(REPO_ROOT, 'src/bongos/pool')).pool; // eslint-disable-line global-require
-      return provisioning.getInstanceBySlug(db, s);
-    });
-    const row = await bySlug(slug);
-    return row && row.owner_builder_id && row.target_ref ? row : null;
-  } catch { return null; }
-}
-
-// What upgrade.js's pin push says when lookupInstanceRow found NO row on a checkout wired
-// with a read-only deploy key (task 1004065). PURE.
-//
-// That pairing is NOT the origin path the header above describes. The key says this is a
-// hosted private project (ADR 0176), and its own database never has the provisioning row
-// (ADR 0281) — so the owner's token cannot be looked up here, and the remote the push
-// falls back to cannot write. Silence made that indistinguishable from a misconfiguration.
-// A missing row anywhere else IS the origin path and stays quiet, which is why the caller
-// only asks for this line when the key is present. Lives here rather than beside its
-// caller because upgrade.js sits exactly at the oversized-file ratchet.
-function missingRowNote(key, remote = 'origin') {
-  return `  • pin push: no provisioning row is readable from this database, so the owner's GitHub token cannot be looked up here — and ${remote} is the read-only deploy key at ${key}. A hosted project's own database never has that row (ADR 0281); the deploy door pushes the pin from the hub instead (task 1004065).`;
-}
-
-module.exports = {
-  instanceRepoRemote,
-  instanceRepoRemotes,
-  lookupInstanceRow,
-  missingRowNote,
-  parseTargetRef,
-  resolveOwnerGithubToken,
-};
+require('../bongos/forwarder.js').forward(module, 'provision-repo-auth.js');

package/scripts/gds/provision-repo-private.js

@@ -1,98 +1,6 @@
+// scripts/gds/provision-repo-private.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/provision-repo-private.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
 'use strict';
-// provision-repo-private.js — "make this project's repository private": the runner leg
-// (task 1004193, split (b) of task 1003078; ADR 0176).
-//
-// WHY. A project stood up while its repository was public reads its code with the
-// platform's shared deploy key, which cannot read a private repository. Flip such a
-// repository private and the project's next deploy pull fails (walk finding N4). Standups
-// since ADR 0176 give a private repository the project's own read-only deploy key; this
-// leg gives an EXISTING project the same wiring, and only then flips.
-//
-// ORDER IS THE SAFETY PROPERTY. Wire the key FIRST, flip SECOND. A deploy key authenticates
-// against a still-public repository, so wiring first leaves no window in which the repo is
-// private and the checkout still reads with the shared key. ensurePrivateRepoAccess would
-// see the repo as public and do nothing, so it is told where the repo is going
-// (`intendedPrivate`, task 1004167). If the flip then fails, the repository is public with
-// a working key — harmless, and the retry re-runs both steps idempotently.
-//
-// Every expected failure returns { ok:false } rather than throwing: a throw makes the
-// runner mark the whole project 'error', and a project that could not be made private is
-// still running fine. The error text is the owner's sentence — it rides error_note onto
-// the project card once the retries are spent.
-//
-// Its own file because provision.js sits at the size ratchet (the provision-disconnect.js
-// precedent). The web tier only enqueues (modules/provisioning/repo-private.js).
-
-const path = require('node:path');
-const { REPO_ROOT } = require('./provision-config.js');
-const { parseTargetRef, resolveOwnerGithubToken } = require('./provision-repo-auth.js');
-const { ensurePrivateRepoAccess } = require('./provision-repo.js');
-
-// A failed shell step (execSync: stderr/output) or file read (a Node system error: syscall)
-// carries the command line, box paths and stderr in its message. It never reaches the
-// owner's card; a GithubApiError, or a fetch error whose syscall sits on its own cause,
-// matches neither.
-const isBoxFailure = (e) => !!e && (e.stderr !== undefined || Array.isArray(e.output) || typeof e.syscall === 'string');
-
-async function repoPrivateInstance(inst, deps) {
-  const { db, provisioning, log, apply } = deps;
-  log(`repo-private ${inst.slug} (shape=${inst.hosting_shape}, status=${inst.status})`);
-
-  // Only a standalone project has its own checkout to wire; any other shape reads from a
-  // checkout this project does not own, so a key minted here would change nothing.
-  if (inst.hosting_shape !== 'cloud-host') {
-    return { ok: false, error: 'This project shares its code checkout with others, so its repository cannot be made private from here.' };
-  }
-  if (inst.status !== 'active') {
-    return { ok: false, error: `This project is ${inst.status}, not running, so its repository was not changed. Try again once it is live.` };
-  }
-  const repo = parseTargetRef(inst.target_ref);
-  if (!repo) return { ok: false, error: 'This project has no GitHub repository on record, so there is nothing to make private.' };
-
-  let wired;
-  try {
-    wired = await ensurePrivateRepoAccess(inst, { ...deps, intendedPrivate: true });
-  } catch (e) {
-    if (isBoxFailure(e) || isBoxFailure(e && e.cause)) {
-      log(`  [repo-private] deploy-key setup failed on the box: ${(e && e.message) || e}`);
-      return { ok: false, error: `${repo.owner}/${repo.name} is still public: its deploy key could not be set up on the server. Nothing on your side caused this, and trying again is safe.` };
-    }
-    return { ok: false, error: (e && e.message) || String(e) };
-  }
-  if (!apply) {
-    log(`  [repo-private] would then make ${repo.owner}/${repo.name} private with the owner's credential — only after the deploy key above is wired (dry-run — nothing ran)`);
-    return { ok: true, planned: true };
-  }
-  if (!wired || wired.private !== true) {
-    // Defensive: with intendedPrivate set, a standalone row with a repo either wires or
-    // throws. Anything else means the checkout is unwired, and flipping would break it.
-    return { ok: false, error: `The deploy key for ${repo.owner}/${repo.name} could not be set up, so the repository was left public.` };
-  }
-
-  const token = await resolveOwnerGithubToken(inst, deps);
-  if (!token) {
-    return { ok: false, error: `${repo.owner}/${repo.name} was not made private: the project's GitHub credential could not be read. Its deploy key is already in place, so reconnect GitHub and try again.` };
-  }
-  const ghRepos = deps.githubRepos || require(path.join(REPO_ROOT, 'src/bongos/github-repos'));
-  try {
-    log(`  [repo-private] making ${repo.owner}/${repo.name} private`);
-    await ghRepos.makeRepoPrivate(token, { owner: repo.owner, name: repo.name, fetchImpl: deps.fetchImpl });
-  } catch (e) {
-    const why = e && e.code === 'not_repo_admin' ? 'GitHub refused — the connected account cannot change this repository’s settings'
-      : e && e.code === 'repo_not_found' ? 'GitHub could not find the repository with the connected account'
-      : `GitHub could not make the change (${(e && e.message) || e})`;
-    return { ok: false, error: `${repo.owner}/${repo.name} is still public: ${why}. Its deploy key is already in place, so trying again is safe.` };
-  }
-
-  await provisioning.recordEvent(db, {
-    instanceId: inst.id, ownerBuilderId: inst.owner_builder_id, event: 'repo-private',
-    detail: `${repo.owner}/${repo.name} made private — the project now reads it with its own read-only deploy key${wired.minted ? ' (newly registered)' : ''}`,
-    actor: 'runner',
-  }).catch(() => {});
-  // A make-private that failed earlier left "still public" on the card; this run made it private.
-  if (provisioning.clearErrorNote) await provisioning.clearErrorNote(db, inst.id, 'repo-private').catch(() => {});
-  log(`  ✓ ${repo.owner}/${repo.name} is private; ${inst.slug} reads it with its own deploy key`);
-  return { ok: true, minted: !!wired.minted };
-}
-
-module.exports = { repoPrivateInstance };
+require('../bongos/forwarder.js').forward(module, 'provision-repo-private.js');