@bongos/core 1.19.1073 → 1.19.1074

package/tests/module_store_publish.mjs

@@ -0,0 +1,307 @@
+// tests/module_store_publish.mjs — `bongos module publish` end to end without a
+// network or a database (task 1004271, ADR 0338 D1): the pack/verify pair in
+// scripts/gds/module-artifact.js, the store's stage/commit + registry transaction in
+// src/bongos/module-store.js (against a fake pg client), and cmdPublish's refusals.
+//
+// Run:  node tests/module_store_publish.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const artifact = require('../scripts/gds/module-artifact.js');
+const format = require('../scripts/gds/artifact-format.js');
+const store = require('../src/bongos/module-store.js');
+const moduleCli = require('../scripts/gds/module.js');
+
+const NOW = () => new Date('2026-09-28T00:00:00Z');
+
+function moduleJson(over = {}) {
+  return {
+    key: 'weather', title: 'Weather', description: 'Shows the weather.',
+    version: '1.2.0', coreVersion: '^1.0.0', contributes: {}, ...over,
+  };
+}
+
+// A temp modules/ root holding one module. files: { relPath: content }.
+function fixture(files = {}, mj = moduleJson()) {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-publish-'));
+  const dir = path.join(root, mj.key);
+  const all = { 'module.json': JSON.stringify(mj, null, 2), 'routes/weather.js': 'module.exports = () => null;\n', ...files };
+  for (const [rel, body] of Object.entries(all)) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), body);
+  }
+  return root;
+}
+
+const pack = (root, key = 'weather') => artifact.packModule(key, { modulesDir: root, now: NOW, modeOf: () => '644' });
+
+// Rebuild a tarball from { name: Buffer } with the real writer, for tamper cases.
+function retar(tgz, edit) {
+  const entries = format.readTar(tgz);
+  const map = new Map(entries.map((e) => [e.name, e]));
+  edit(map);
+  return format.buildTar([...map.values()]);
+}
+
+// ---- pack ------------------------------------------------------------------
+
+test('pack: the tarball is the core release format — package/ root, inner manifest, a tree pin', async () => {
+  const { tgz, manifest, sidecar } = pack(fixture());
+  const names = format.readTar(tgz).map((e) => e.name).sort();
+  assert.deepEqual(names, ['package/.bongos-module.json', 'package/module.json', 'package/routes/weather.js']);
+  assert.equal(manifest.artifact, 'bongos-module');
+  assert.equal(manifest.module_key, 'weather');
+  assert.equal(manifest.module_version, '1.2.0');
+  assert.equal(manifest.core_version, '^1.0.0');
+  assert.equal(manifest.file_count, 2);
+  assert.equal(manifest.tree_sha256, format.canonicalTreeHash(manifest.files));
+  assert.equal(sidecar.tarball.sha256, format.sha256hex(tgz));
+  assert.equal(sidecar.tarball.name, 'bongos-module-weather-1.2.0.tgz');
+});
+
+test('pack: deterministic — the same module packs to the same bytes', async () => {
+  const root = fixture();
+  assert.equal(format.sha256hex(pack(root).tgz), format.sha256hex(pack(root).tgz));
+});
+
+test('pack: refuses a module.json without a version, or naming another key', async () => {
+  const noVersion = moduleJson(); delete noVersion.version;
+  assert.throws(() => pack(fixture({}, noVersion)), /version/);
+  const root = fixture();
+  fs.writeFileSync(path.join(root, 'weather', 'module.json'), JSON.stringify(moduleJson({ key: 'other' })));
+  assert.throws(() => pack(root), /names key "other"/);
+});
+
+test('pack: a credential-named file anywhere in the module refuses the whole publish', async () => {
+  for (const bad of ['.env', 'config/.env.local', 'certs/server.pem', 'deploy/id_rsa']) {
+    assert.throws(() => pack(fixture({ [bad]: 'SECRET=1' })), /denylist refuses/, bad);
+  }
+});
+
+test('pack: the repo denylist applies at the module\'s canonical path', async () => {
+  // modules/game/ is on PUBLISH_DENYLIST — a module keyed "game" can never publish.
+  const mj = moduleJson({ key: 'game' });
+  assert.throws(() => pack(fixture({}, mj), 'game'), /denylist refuses: modules\/game\//);
+});
+
+test('pack: the local sign-off record is never packed', async () => {
+  const { tgz } = pack(fixture({ '.upstream-signoff.json': '{}' }));
+  assert.ok(!format.readTar(tgz).some((e) => e.name.endsWith('.upstream-signoff.json')));
+});
+
+// ---- verify (the store's side) ----------------------------------------------
+
+test('verify: a freshly packed module passes and reports its own pins', async () => {
+  const { tgz, manifest } = pack(fixture());
+  const v = (await artifact.verifyModuleArtifact(tgz, { key: 'weather' }));
+  assert.equal(v.ok, true, v.message);
+  assert.equal(v.version, '1.2.0');
+  assert.equal(v.treeSha256, manifest.tree_sha256);
+  assert.equal(v.tarballSha256, format.sha256hex(tgz));
+  assert.equal(v.bytes, tgz.length);
+});
+
+test('verify: an upload for a different key is refused', async () => {
+  const { tgz } = pack(fixture());
+  assert.equal((await artifact.verifyModuleArtifact(tgz, { key: 'forecast' })).code, 'key_mismatch');
+});
+
+test('verify: a file changed after packing is caught by its hash', async () => {
+  const { tgz } = pack(fixture());
+  const bad = retar(tgz, (m) => { m.get('package/routes/weather.js').buf = Buffer.from('evil()'); });
+  assert.equal((await artifact.verifyModuleArtifact(bad, { key: 'weather' })).code, 'hash_mismatch');
+});
+
+test('verify: a file smuggled in beside the manifest is caught', async () => {
+  const { tgz } = pack(fixture());
+  const bad = retar(tgz, (m) => m.set('package/extra.js', { name: 'package/extra.js', mode: 0o644, buf: Buffer.from('x') }));
+  assert.equal((await artifact.verifyModuleArtifact(bad, { key: 'weather' })).code, 'hash_mismatch');
+});
+
+test('verify: a path that climbs out of the module is refused before anything else', async () => {
+  const { tgz } = pack(fixture());
+  const bad = retar(tgz, (m) => m.set('package/../../etc/x', { name: 'package/../../etc/x', mode: 0o644, buf: Buffer.from('x') }));
+  assert.equal((await artifact.verifyModuleArtifact(bad, { key: 'weather' })).code, 'bad_tarball');
+});
+
+test('verify: a secret file re-hashed into a consistent manifest is still refused', async () => {
+  // A hostile client can make the hashes agree; the denylist must run server-side anyway.
+  const root = fixture();
+  const good = pack(root);
+  const entries = format.readTar(good.tgz).filter((e) => e.name !== 'package/.bongos-module.json');
+  entries.push({ name: 'package/.env', mode: 0o644, buf: Buffer.from('K=1') });
+  const files = entries.map((e) => ({ path: e.name.slice(8), mode: '0000644', sha256: format.sha256hex(e.buf) }));
+  const manifest = { ...good.manifest, files, file_count: files.length, tree_sha256: format.canonicalTreeHash(files) };
+  entries.push({ name: 'package/.bongos-module.json', mode: 0o644, buf: Buffer.from(JSON.stringify(manifest)) });
+  assert.equal((await artifact.verifyModuleArtifact(format.buildTar(entries), { key: 'weather' })).code, 'denied_content');
+});
+
+test('verify: garbage, an empty body and an oversize body are refused plainly', async () => {
+  assert.equal((await artifact.verifyModuleArtifact(Buffer.from('not a tarball'), { key: 'weather' })).code, 'bad_tarball');
+  assert.equal((await artifact.verifyModuleArtifact(Buffer.alloc(0), { key: 'weather' })).code, 'empty_artifact');
+  const { tgz } = pack(fixture());
+  assert.equal((await artifact.verifyModuleArtifact(tgz, { key: 'weather', maxBytes: 10 })).code, 'artifact_too_large');
+});
+
+test('verify: a small upload that inflates past the unpacked cap (a gzip bomb) is refused', async () => {
+  const bomb = format.buildTar([{ name: 'package/zeros.bin', mode: 0o644, buf: Buffer.alloc(17 * 1024 * 1024) }]);
+  assert.ok(bomb.length < artifact.MAX_TARBALL_BYTES, 'it fits the wire cap, so only the unpacked cap can catch it');
+  const v = await artifact.verifyModuleArtifact(bomb, { key: 'weather' });
+  assert.equal(v.code, 'bad_tarball');
+  assert.match(v.message, /within 16777216 bytes/);
+});
+
+test('readTar: refuses entry types the writer never makes (a symlink)', async () => {
+  const tar = Buffer.concat([format.ustarHeader({ name: 'package/link', mode: 0o644, size: 0, typeflag: '2' }), Buffer.alloc(1024)]);
+  const zlib = require('node:zlib');
+  assert.throws(() => format.readTar(zlib.gzipSync(tar)), /only regular files/);
+});
+
+// ---- the store: disk + registry transaction ---------------------------------
+
+test('store: a staged tarball becomes the final file only on commit', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-store-'));
+  const staged = await store.stageArtifact(Buffer.from('tgz'), { key: 'weather', version: '1.2.0', dir });
+  assert.ok(fs.existsSync(staged.tmp));
+  assert.ok(!fs.existsSync(staged.final));
+  await store.commitArtifact(staged);
+  assert.equal(fs.readFileSync(staged.final, 'utf8'), 'tgz');
+  assert.equal(store.relativeArtifactPath(staged.final, { dir }), 'weather/weather-1.2.0.tgz');
+  await store.removeArtifact(staged.tmp); // already moved — a no-op, never a throw
+});
+
+test('store: a key or version that could escape the store dir is refused before any write', async () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-store-'));
+  await assert.rejects(store.stageArtifact(Buffer.from('x'), { key: '../x', version: '1.0.0', dir }));
+  await assert.rejects(store.stageArtifact(Buffer.from('x'), { key: 'weather', version: '../../1', dir }));
+  assert.deepEqual(fs.readdirSync(dir), []);
+});
+
+// A fake pg pool: `state` is the registry, answers are computed from it.
+function fakeDb(state = { modules: {}, versions: [] }) {
+  const log = [];
+  const client = {
+    async query(sql, params = []) {
+      log.push(sql.trim().split(/\s+/).slice(0, 2).join(' '));
+      if (/^SELECT module_key, author_id, status FROM store_modules/.test(sql)) {
+        const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+      }
+      if (/^INSERT INTO store_modules/.test(sql)) {
+        state.modules[params[0]] = { module_key: params[0], author_id: params[3], status: 'listed' }; return { rows: [] };
+      }
+      if (/^SELECT version FROM store_module_versions/.test(sql)) {
+        return { rows: state.versions.filter((v) => v.module_key === params[0]) };
+      }
+      if (/^INSERT INTO store_module_versions/.test(sql)) {
+        const row = { id: state.versions.length + 1, module_key: params[0], version: params[1] };
+        state.versions.push(row); return { rows: [row] };
+      }
+      return { rows: [] };
+    },
+    release() {},
+  };
+  return { pool: { connect: async () => client }, state, log };
+}
+
+const input = (over = {}) => ({
+  key: 'weather', title: 'Weather', description: 'd', version: '1.2.0', coreVersion: '^1.0.0',
+  manifest: {}, treeSha256: 'a'.repeat(64), tarballSha256: 'b'.repeat(64), bytes: 10,
+  artifactPath: 'weather/weather-1.2.0.tgz', builderId: 7, ...over,
+});
+
+test('registry: the first publish creates the module with the publisher as author', async () => {
+  const db = fakeDb();
+  const r = await store.publishVersion(input(), { db: db.pool });
+  assert.equal(r.ok, true);
+  assert.equal(r.created, true);
+  assert.equal(db.state.modules.weather.author_id, 7);
+  assert.deepEqual(db.log.filter((l) => /BEGIN|COMMIT|ROLLBACK/.test(l)), ['BEGIN', 'COMMIT']);
+});
+
+test('registry: only the author can publish a later version', async () => {
+  const db = fakeDb({ modules: { weather: { module_key: 'weather', author_id: 7, status: 'listed' } }, versions: [] });
+  const r = await store.publishVersion(input({ builderId: 8 }), { db: db.pool });
+  assert.equal(r.ok, false);
+  assert.equal(r.status, 403);
+  assert.equal(r.code, 'not_module_author');
+  assert.equal(db.state.versions.length, 0);
+});
+
+test('registry: a delisted module takes no new version (ADR 0338 D2)', async () => {
+  const db = fakeDb({ modules: { weather: { module_key: 'weather', author_id: 7, status: 'delisted' } }, versions: [] });
+  assert.equal((await store.publishVersion(input(), { db: db.pool })).code, 'module_delisted');
+});
+
+test('registry: a version is published once, and never older than the latest', async () => {
+  const state = { modules: { weather: { module_key: 'weather', author_id: 7, status: 'listed' } },
+    versions: [{ module_key: 'weather', version: '1.2.0' }] };
+  assert.equal((await store.publishVersion(input(), { db: fakeDb(state).pool })).code, 'version_exists');
+  assert.equal((await store.publishVersion(input({ version: '1.1.9' }), { db: fakeDb(state).pool })).code, 'version_not_newer');
+  const ok = await store.publishVersion(input({ version: '1.10.0' }), { db: fakeDb(state).pool });
+  assert.equal(ok.ok, true, 'numeric, not string, ordering: 1.10.0 > 1.2.0');
+});
+
+test('registry: if putting the file in place fails, the row is rolled back', async () => {
+  const db = fakeDb();
+  await assert.rejects(
+    store.publishVersion(input(), { db: db.pool, beforeCommit: () => { throw new Error('disk full'); } }),
+    /disk full/);
+  assert.ok(db.log.includes('ROLLBACK'));
+  assert.ok(!db.log.includes('COMMIT'));
+});
+
+// ---- the CLI ------------------------------------------------------------------
+
+const sink = () => { const lines = []; return { lines, log: (s) => lines.push(String(s)) }; };
+
+test('cli: --dry-run packs and reports, and never uploads', async () => {
+  const out = sink();
+  let uploaded = false;
+  const code = await moduleCli.cmdPublish(['weather', '--dry-run'], {
+    log: out.log, errlog: out.log, modulesDir: fixture(), upload: async () => { uploaded = true; },
+  });
+  assert.equal(code, 0);
+  assert.equal(uploaded, false);
+  assert.ok(out.lines.some((l) => /"weather" 1\.2\.0/.test(l)));
+});
+
+test('cli: a module the gate refuses never reaches the network', async () => {
+  const out = sink();
+  let uploaded = false;
+  const code = await moduleCli.cmdPublish(['weather'], {
+    log: out.log, errlog: out.log, modulesDir: fixture({ '.env': 'K=1' }), upload: async () => { uploaded = true; },
+  });
+  assert.equal(code, 1);
+  assert.equal(uploaded, false);
+  assert.ok(out.lines.some((l) => /REFUSING/.test(l)));
+});
+
+test('cli: uploads the packed bytes, and a store refusal is a failure exit with its reason', async () => {
+  const root = fixture();
+  let sent = null;
+  const ok = await moduleCli.cmdPublish(['weather'], {
+    log: () => {}, errlog: () => {}, modulesDir: root,
+    upload: async (k, body) => { sent = { k, body }; return { ok: true, status: 201, data: { created_module: true, version: { version: '1.2.0' } } }; },
+  });
+  assert.equal(ok, 0);
+  assert.equal(sent.k, 'weather');
+  assert.equal((await artifact.verifyModuleArtifact(sent.body, { key: 'weather' })).ok, true, 'what is sent is what the store accepts');
+
+  const out = sink();
+  const refused = await moduleCli.cmdPublish(['weather'], {
+    log: () => {}, errlog: out.log, modulesDir: root,
+    upload: async () => ({ ok: false, status: 409, data: { error: { code: 'version_exists', message: 'weather 1.2.0 is already published' } } }),
+  });
+  assert.equal(refused, 1);
+  assert.ok(out.lines.some((l) => /HTTP 409/.test(l) && /already published/.test(l)));
+});
+
+test('cli: no key is a usage error', async () => {
+  assert.equal(await moduleCli.cmdPublish([], { log: () => {}, errlog: () => {} }), 2);
+});

package/tests/module_store_publish_route.mjs

@@ -0,0 +1,121 @@
+// tests/module_store_publish_route.mjs — the seam test for POST
+// /store/modules/:key/versions (task 1004271). module_store_publish.mjs covers each
+// piece; this drives the real handler off the real router, so a lost require or a
+// mis-wired call between verify → stage → registry → commit is a failure here, not in
+// production. Same harness shape as modules_route_wiring.mjs: no port, no real DB —
+// src/bongos/pool.js is replaced in the require cache before the route loads, and the
+// store dir is a temp dir.
+//
+// Run:  node tests/module_store_publish_route.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const STORE = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-store-route-'));
+process.env.MODULE_STORE_DIR = STORE;
+
+// The registry, as the fake pool sees it.
+const state = { modules: {}, versions: [] };
+const client = {
+  async query(sql, params = []) {
+    if (/^SELECT module_key, author_id, status FROM store_modules/.test(sql)) {
+      const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+    }
+    if (/^INSERT INTO store_modules/.test(sql)) {
+      state.modules[params[0]] = { module_key: params[0], author_id: params[3], status: 'listed' }; return { rows: [] };
+    }
+    if (/^SELECT version FROM store_module_versions/.test(sql)) {
+      return { rows: state.versions.filter((v) => v.module_key === params[0]) };
+    }
+    if (/^\s*INSERT INTO store_module_versions/.test(sql)) {
+      const row = { id: state.versions.length + 1, module_key: params[0], version: params[1], artifact_path: params[7], published_by: params[8] };
+      state.versions.push(row); return { rows: [row] };
+    }
+    return { rows: [] };
+  },
+  release() {},
+};
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => client, query: client.query } } };
+
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const artifact = require('../scripts/gds/module-artifact.js');
+
+function handlerFor(router, method, p) {
+  const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${p} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, names: stack.map((s) => s.name) };
+}
+
+async function invoke(handle, req) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    fail(code, opts) { this.statusCode = opts.status; this.body = { error: code, ...opts }; return this; },
+  };
+  let nextErr = null;
+  await handle(req, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+function packed(version = '1.0.0') {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-src-'));
+  const dir = path.join(root, 'weather');
+  fs.mkdirSync(dir);
+  fs.writeFileSync(path.join(dir, 'module.json'), JSON.stringify({
+    key: 'weather', title: 'Weather', description: 'd', version, coreVersion: '^1.0.0', contributes: {},
+  }));
+  return artifact.packModule('weather', { modulesDir: root, modeOf: () => '644' }).tgz;
+}
+
+const router = buildModulesRouter();
+const route = handlerFor(router, 'post', '/store/modules/:key/versions');
+
+test('the route is gated before it reads a byte: builder, then permission, then the capped parser', async () => {
+  assert.deepEqual(route.names.slice(0, 3), ['requireBuilder', route.names[1], 'tarballBody']);
+  assert.notEqual(route.names[1], 'tarballBody');
+});
+
+test('a good upload is verified, recorded and kept on disk; the audit sees a marker, not the bytes', async () => {
+  const req = { params: { key: 'weather' }, body: packed('1.0.0'), builder: { id: 42 } };
+  const res = await invoke(route.handle, req);
+  assert.equal(res.statusCode, 201, JSON.stringify(res.body));
+  assert.equal(res.body.created_module, true);
+  assert.equal(state.modules.weather.author_id, 42);
+  assert.equal(state.versions[0].artifact_path, 'weather/weather-1.0.0.tgz');
+  const onDisk = fs.readFileSync(path.join(STORE, 'weather', 'weather-1.0.0.tgz'));
+  assert.equal((await artifact.verifyModuleArtifact(onDisk, { key: 'weather' })).ok, true);
+  assert.deepEqual(fs.readdirSync(path.join(STORE, 'weather')), ['weather-1.0.0.tgz'], 'no temp file left behind');
+  assert.deepEqual(req.body, { tarball_bytes: onDisk.length });
+});
+
+test('a refused publish leaves nothing on disk', async () => {
+  const res = await invoke(route.handle, { params: { key: 'weather' }, body: packed('1.0.0'), builder: { id: 42 } });
+  assert.equal(res.statusCode, 409);
+  assert.equal(res.body.error, 'version_exists');
+  assert.deepEqual(fs.readdirSync(path.join(STORE, 'weather')), ['weather-1.0.0.tgz']);
+});
+
+test('someone else cannot publish over the author', async () => {
+  const res = await invoke(route.handle, { params: { key: 'weather' }, body: packed('1.1.0'), builder: { id: 7 } });
+  assert.equal(res.statusCode, 403);
+  assert.equal(res.body.error, 'not_module_author');
+  assert.ok(!fs.existsSync(path.join(STORE, 'weather', 'weather-1.1.0.tgz')));
+});
+
+test('a tarball for another key, garbage, or no body is refused before the registry is touched', async () => {
+  const before = state.versions.length;
+  assert.equal((await invoke(route.handle, { params: { key: 'forecast' }, body: packed('2.0.0'), builder: { id: 42 } })).body.error, 'key_mismatch');
+  assert.equal((await invoke(route.handle, { params: { key: 'weather' }, body: Buffer.from('nope'), builder: { id: 42 } })).statusCode, 422);
+  assert.equal((await invoke(route.handle, { params: { key: 'weather' }, body: {}, builder: { id: 42 } })).body.error, 'empty_artifact');
+  assert.equal((await invoke(route.handle, { params: { key: 'Bad_Key' }, body: packed(), builder: { id: 42 } })).body.error, 'bad_module_key');
+  assert.equal(state.versions.length, before);
+});

package/tests/module_store_registry_migration.mjs

@@ -0,0 +1,70 @@
+// tests/module_store_registry_migration.mjs — the module store registry tables
+// (task 1003812, ADR 0338 D1). DB-free: the unit gate has no Postgres, so this
+// pins the rules the owner decided directly in the migration text, where a
+// later edit that loosened one would otherwise land silently. The live apply
+// runs in the PG lane (scripts/verify-gds-only-schema.sh) and at deploy.
+//
+// Run:  node tests/module_store_registry_migration.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const FILE = 'core_257_module_store_registry.sql';
+const SQL = readFileSync(path.join(ROOT, 'migrations', FILE), 'utf8');
+// Comments stripped so an assertion can only be satisfied by real DDL.
+const DDL = SQL.replace(/--.*$/gm, '');
+
+// The body of one CREATE TABLE, up to its closing ");".
+function table(name) {
+  const m = new RegExp(`CREATE TABLE IF NOT EXISTS ${name} \\(([\\s\\S]*?)\\n\\);`).exec(DDL);
+  assert.ok(m, `${name} is created`);
+  return m[1];
+}
+
+test('the three registry tables exist, idempotently', () => {
+  for (const t of ['store_modules', 'store_module_versions', 'store_module_prices']) table(t);
+  assert.doesNotMatch(DDL, /CREATE TABLE (?!IF NOT EXISTS)/, 'every CREATE TABLE is IF NOT EXISTS');
+  assert.doesNotMatch(DDL, /CREATE INDEX (?!IF NOT EXISTS)/, 'every CREATE INDEX is IF NOT EXISTS');
+  assert.match(DDL, /INSERT INTO schema_migrations \(version\) VALUES \('core_257_module_store_registry'\)\s+ON CONFLICT \(version\) DO NOTHING;/);
+});
+
+test('a price of zero is allowed in both currencies — free modules are first-class', () => {
+  const t = table('store_module_prices');
+  assert.match(t, /price_cents\s+integer CHECK \(price_cents >= 0\)/);
+  assert.match(t, /price_credits\s+integer CHECK \(price_credits >= 0\)/);
+  assert.doesNotMatch(t, /price_(cents|credits)[^,\n]*> 0\)/, 'no price column may forbid zero');
+  // money OR credits (or both), never neither
+  assert.match(t, /CHECK \(price_cents IS NOT NULL OR price_credits IS NOT NULL\)/);
+});
+
+test('a version is exact semver and can be published only once per module', () => {
+  const t = table('store_module_versions');
+  assert.match(t, /version\s+text NOT NULL\s+CHECK \(version ~ '\^\[0-9\]\+\\\.\[0-9\]\+\\\.\[0-9\]\+\$'\)/);
+  assert.match(t, /UNIQUE \(module_key, version\)/);
+  // the package-core.js pins install verifies against
+  assert.match(t, /tree_sha256\s+text NOT NULL CHECK \(tree_sha256 ~ '\^\[0-9a-f\]\{64\}\$'\)/);
+  assert.match(t, /tarball_sha256\s+text NOT NULL/);
+  assert.match(t, /artifact_path\s+text NOT NULL/);
+});
+
+test('delisting is a status, never a delete — and the timestamp moves with it (ADR 0338 D2)', () => {
+  const t = table('store_modules');
+  assert.match(t, /CHECK \(status IN \('listed', 'delisted'\)\)/);
+  assert.match(t, /CHECK \(\(status = 'delisted'\) = \(delisted_at IS NOT NULL\)\)/);
+  assert.doesNotMatch(DDL, /ON DELETE CASCADE/, 'nothing cascades away a version or price');
+});
+
+test('the store surface models no payment, balance or payout (area 8 owns those)', () => {
+  assert.doesNotMatch(DDL, /balance|payout|payment|fee/i);
+});
+
+test('the migration is forward-safe under the lint gate', () => {
+  const lint = require('../scripts/gds/lint-migrations.js');
+  assert.deepEqual(lint.scanMigrationSql(SQL).unsafe || [], []);
+});