@bongos/core 1.19.1077 → 1.19.1079

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.1077",
-  "core_contract": "1.19.1077",
-  "source_commit": "8213cd0b6b6ae2e91300c953bee2bed1d3558da3",
+  "core_version": "1.19.1079",
+  "core_contract": "1.19.1079",
+  "source_commit": "0383ae383a565f9a6b3c9cef65e5db1a25fda1b8",
   "source_ref": "HEAD",
-  "built_at": "2026-09-29T10:54:54.299Z",
+  "built_at": "2026-09-29T17:08:08.029Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 550,
     "agent_docs_stubbed": 25,
-    "functional_verbatim": 2530,
+    "functional_verbatim": 2534,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 3106,
-  "tree_sha256": "90651971ad753afab30ed83277bfc27c910ad7279d6264170b9045d3726e1d5f",
+  "file_count": 3110,
+  "tree_sha256": "09c2966aeb5069bc3a6d9f1f306e4d993ec3f09da7b4136e4cab9b93e0f3e690",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -322,12 +322,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "9d1e621dcf8b0a3b92cd67f700fd1d48f469d55833b494147e0a4c29be452d37"
+      "sha256": "8aa624b247e99bb0a7e3a97745ecd4aa64d7fdddc89d92f47cb20d433d2ad5b0"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "9fcd3ca52df7d24f22ee6efcd5a0167af53835ec8bd3ffad139185a7aebb90b0"
+      "sha256": "510df3006216f3a54f88d90e802d565cc52753ab723061787229ee3d65bd5c83"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -337,17 +337,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "0bbe77783e3bf8a1dd8bc594dc28372a8c982be8e10a468f97d17ec8a5ff8cfc"
+      "sha256": "3e76df3485bb6fb4555e2b85b6637104718eee1fd325f9a951641dc971833295"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "7aa307fe6518433b5d85216d098c1d4cfedb25995aceb5717113e2233de62f48"
+      "sha256": "129e807451025dd8346054523b1829db460319c04c640b9e78af39ba012c73bc"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "a9ca2bf984f00e1b6506904f789fccf8acfedd7ca7418322f50713d82680f783"
+      "sha256": "de3ceb5761e334327e7e6367acc8dc4daea75561c1b17c967bb0b7fc43aa7dc1"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -2207,17 +2207,17 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "1b53174253962c6d9d45d3fc107770fa0af26899c7a638fa2ed8be55712a001c"
+      "sha256": "db6392644382a35358daedffe8289ba644ee4d005e842110271702966a8e7cd3"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "efbdeaf4b09c7113ece416afdc79b4a46a4088504d5398ce02afd4d9aa5f917e"
+      "sha256": "b3795bc67242cfbebf5cd0023327dfc768293fbe09b5998b3c0c2a8f26754ea0"
     },
     {
       "path": "docs/architecture.md",
       "mode": "0000644",
-      "sha256": "c7e6113f1819b535619c163c097253314cefaf24b665e727f1e16c65aff9c19e"
+      "sha256": "cb0de2130b810b17ba5b79cc52a6bf4594e84d9aa2d88405be7dd96f66e3cf06"
     },
     {
       "path": "docs/branding-contract.md",
@@ -2742,12 +2742,12 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3c225690f0579fca6dbada87f49ee760d816a1135a3ae8ae30dcea4983ccccc8"
+      "sha256": "cd8f1a1404e5c2fc789d2efa06eb513c165de83c6c9af94350ec8fbaf90a897a"
     },
     {
       "path": "docs/modules-contract.md",
       "mode": "0000644",
-      "sha256": "7cd6e586e2763199194c3b5752c618ed2eaa728499800c5383d78b0c21869370"
+      "sha256": "31b76c94f9c9703249328a9faa71a87e79e644c41ba41acb7c7209135ccbcb21"
     },
     {
       "path": "docs/onboarding/diagrams/01-task-lifecycle.mmd",
@@ -3889,6 +3889,11 @@
       "mode": "0000644",
       "sha256": "6591b63dc385fd1d3a69b2729ef16141bdd6017bf3442cac1642403332edc601"
     },
+    {
+      "path": "migrations/core_259_module_entitlements.sql",
+      "mode": "0000644",
+      "sha256": "496e1605d0bcac75631217e55ff87d707971332c25fab0730a592eed5d7da8b9"
+    },
     {
       "path": "modules/agents/CLAUDE.md",
       "mode": "0000644",
@@ -8597,12 +8602,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "f474f9d00b0d9bdcbb709d52ebb4f1e61e24b06ebe698ea4a423a3e67bfd3abe"
+      "sha256": "b94499c149cab0d2b61e2c16da48bdc29e750538aa9c60363cf4d4cc0511b145"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9fcd91f348d585a802db0d0c881b29f64c915c1af4bebe34f3c25d76f322efb8"
+      "sha256": "fc349b40ca4dc25724895e0982b5b689b4ed60e44b1eb567ffc1bbd620977ed9"
     },
     {
       "path": "public-docs/index.html",
@@ -8622,7 +8627,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "797b5505242d566628e1fef62b4afc9e66cc77708ac3115eb48791ff15b763fe"
+      "sha256": "5a79e67ac4a575bc5d0f4a1d8b2e38e4adc746bacaac066d02cea4698e39d79b"
     },
     {
       "path": "scripts/bongos-mcp.js",
@@ -9447,12 +9452,12 @@
     {
       "path": "scripts/gds/module-artifact.js",
       "mode": "0000644",
-      "sha256": "5f20d948077635bd07a4a840577ead7a07adbb5f6a94ac4e892c3426161ef2bf"
+      "sha256": "09211dcd5bae4b935b5f80a2c021a1c10a376236b1c7ea7ebc1f53b84d1ead40"
     },
     {
       "path": "scripts/gds/module.js",
       "mode": "0000644",
-      "sha256": "fed0e897534be08932018b1048a09bafdade0c242a5eb8f9693ff50a5e354d51"
+      "sha256": "eccf6ccfa68342268d8d63ebde68af4402ff3c6cfcecec2262656801e24bf263"
     },
     {
       "path": "scripts/gds/newcomer-floor.config.json",
@@ -10474,6 +10479,11 @@
       "mode": "0000644",
       "sha256": "efe34f92930419444ec31d84c7787488db4984ea761d1bb77d5375388758e68c"
     },
+    {
+      "path": "src/bongos/module-entitlements.js",
+      "mode": "0000644",
+      "sha256": "917f364b804f25437dea7fe507abe50e9b64cac79b6cc29ac786de0e24350d33"
+    },
     {
       "path": "src/bongos/module-overrides.js",
       "mode": "0000644",
@@ -10487,7 +10497,7 @@
     {
       "path": "src/bongos/module-store.js",
       "mode": "0000644",
-      "sha256": "312e7dda5cbeb9a257864f43e486e857c8127683254b4c4fab68bdbfc61a1972"
+      "sha256": "2bc2e05af26a1e416fb083dda7cfce7e7693a56dccd46f7d1f233343ec73d215"
     },
     {
       "path": "src/bongos/module-submissions.js",
@@ -10622,7 +10632,7 @@
     {
       "path": "src/bongos/routes/modules.js",
       "mode": "0000644",
-      "sha256": "1178db97cfa28a54a41c90bde0fe4a5f47192278c3a51ab01b68f334f8e4374a"
+      "sha256": "bd4e80ff8712d0797a62bddb3577f52f4cf161ac2273028e8a8def0455118e63"
     },
     {
       "path": "src/bongos/routes/my-sessions.js",
@@ -10692,7 +10702,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "30a3d4c45217ac814326057165b0ff3f6627a03fb15e80586e6b602bfa9e8514"
+      "sha256": "b65c0562481a90446f4881d84eeda91c28949f216835e6a0bab6105755403932"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -13539,11 +13549,21 @@
       "mode": "0000644",
       "sha256": "02862e4df8c3df0f6e255c8ad8108b518de7a665881f744eb3e59537193f4587"
     },
+    {
+      "path": "tests/module_entitlements.mjs",
+      "mode": "0000644",
+      "sha256": "50e4d45bf544efe755dda538a93eafc40dcd9caa071e987d8833d97ecf1b7e0f"
+    },
     {
       "path": "tests/module_exports_unique_keys.mjs",
       "mode": "0000644",
       "sha256": "b84800d125bff6227c4c47edc0b606ee5c458248cca247b9d9df92568af55d55"
     },
+    {
+      "path": "tests/module_install.mjs",
+      "mode": "0000644",
+      "sha256": "7aea6f842ba53a4a00a7857d0e406575ebcd9831cd17eb7f1a1ac88b99af88c6"
+    },
     {
       "path": "tests/module_loader.mjs",
       "mode": "0000644",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 434 operations across 67 resource groups
+- 439 operations across 67 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -971,8 +971,18 @@ function createClient(opts = {}) {
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
     "store": {
+      // GET /store/entitlements — rank: any-builder — GET /store/entitlements
+      getStoreEntitlements: (args) => request("GET", "/store/entitlements", { hasBody: false }, args),
+      // POST /store/modules/{key}/acquire — rank: any-builder — POST /store/modules/:key/acquire
+      postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
+      // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
+      postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
+      getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
+      getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.cjs

@@ -970,8 +970,18 @@ function createClient(opts = {}) {
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
     "store": {
+      // GET /store/entitlements — rank: any-builder — GET /store/entitlements
+      getStoreEntitlements: (args) => request("GET", "/store/entitlements", { hasBody: false }, args),
+      // POST /store/modules/{key}/acquire — rank: any-builder — POST /store/modules/:key/acquire
+      postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
+      // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
+      postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
+      getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
+      getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations

package/clients/bongos-client/index.d.ts

@@ -157,6 +157,7 @@ export interface GetSpecialitiesIdResponse { speciality: unknown }
 export interface GetSpecialitiesOfferedResponse { suggestions: unknown }
 export interface GetSpecialitiesResponse { specialities: unknown }
 export interface GetSsoPubkeyResponse { alg: unknown; format: unknown; public_key_b64: unknown }
+export interface GetStoreEntitlementsResponse { entitlements: unknown }
 export interface GetTaskRecommendationsForMeResponse { recommendations: unknown; count: unknown }
 export interface GetTaskRecommendationsMineResponse { recommendations: unknown; count: unknown }
 export interface GetTasksClaimableResponse { claimable: unknown; claimable_total: unknown; active_claims: unknown }
@@ -429,6 +430,10 @@ export interface PostSsoMembershipCheckInRequest { client_id: string; client_sec
 export interface PostSsoMembershipCheckInResponse { ok: boolean }
 export interface PostSsoTokenRequest { client_id: string; client_secret: string; code: string; redirect_uri: string }
 export interface PostSsoTokenResponse { github_id: unknown; github_login: unknown; display_name: unknown; avatar_url: unknown }
+export interface PostStoreModulesKeyAcquireRequest { version?: string }
+export interface PostStoreModulesKeyAcquireResponse { ok: boolean; module_key: unknown; version: unknown; core_version: unknown; tarball_sha256: unknown; tree_sha256: unknown; tarball_bytes: unknown; channel: unknown; entitlement: unknown }
+export interface PostStoreModulesKeyAcquiredRequest { version: string }
+export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown }
 export interface PostTaskRecommendationsRequest { task_id: number; recommended_to: number; reason: string }
 export interface PostTaskRecommendationsResponse { ok: boolean; recommendation: unknown }
@@ -1370,8 +1375,18 @@ export interface BongosClient {
     postSsoToken(args: RequestArgs & { body: PostSsoTokenRequest }): Promise<PostSsoTokenResponse>;
   };
   "store": {
+    /** GET /store/entitlements — rank: any-builder */
+    getStoreEntitlements(args?: RequestArgs): Promise<GetStoreEntitlementsResponse>;
+    /** POST /store/modules/{key}/acquire — rank: any-builder */
+    postStoreModulesKeyAcquire(args?: RequestArgs & { body?: PostStoreModulesKeyAcquireRequest }): Promise<PostStoreModulesKeyAcquireResponse>;
+    /** POST /store/modules/{key}/acquired — rank: any-builder */
+    postStoreModulesKeyAcquired(args: RequestArgs & { body: PostStoreModulesKeyAcquiredRequest }): Promise<PostStoreModulesKeyAcquiredResponse>;
+    /** GET /store/modules/{key}/entitlement — rank: any-builder */
+    getStoreModulesKeyEntitlement(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /store/modules/{key}/versions — rank: metic+archon */
     postStoreModulesKeyVersions(args?: RequestArgs): Promise<PostStoreModulesKeyVersionsResponse>;
+    /** GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder */
+    getStoreModulesKeyVersionsVersionTarball(args?: RequestArgs): Promise<ApiResponse>;
   };
   "taskRecommendations": {
     /** POST /task-recommendations — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -967,8 +967,18 @@ export function createClient(opts = {}) {
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
     "store": {
+      // GET /store/entitlements — rank: any-builder — GET /store/entitlements
+      getStoreEntitlements: (args) => request("GET", "/store/entitlements", { hasBody: false }, args),
+      // POST /store/modules/{key}/acquire — rank: any-builder — POST /store/modules/:key/acquire
+      postStoreModulesKeyAcquire: (args) => request("POST", "/store/modules/{key}/acquire", { hasBody: true }, args),
+      // POST /store/modules/{key}/acquired — rank: any-builder — POST /store/modules/:key/acquired
+      postStoreModulesKeyAcquired: (args) => request("POST", "/store/modules/{key}/acquired", { hasBody: true }, args),
+      // GET /store/modules/{key}/entitlement — rank: any-builder — GET /store/modules/:key/entitlement
+      getStoreModulesKeyEntitlement: (args) => request("GET", "/store/modules/{key}/entitlement", { hasBody: false }, args),
       // POST /store/modules/{key}/versions — rank: metic+archon — POST /store/modules/:key/versions
       postStoreModulesKeyVersions: (args) => request("POST", "/store/modules/{key}/versions", { hasBody: true }, args),
+      // GET /store/modules/{key}/versions/{version}/tarball — rank: any-builder — GET /store/modules/:key/versions/:version/tarball
+      getStoreModulesKeyVersionsVersionTarball: (args) => request("GET", "/store/modules/{key}/versions/{version}/tarball", { hasBody: false }, args),
     },
     "taskRecommendations": {
       // POST /task-recommendations — rank: any-builder — POST /task-recommendations