@bongos/core 1.19.1077 → 1.19.1079

package/tests/module_entitlements.mjs

@@ -0,0 +1,204 @@
+// tests/module_entitlements.mjs — the entitlement record (task 1003813, ADR 0338 D1).
+// DB-free: the migration text is pinned directly, and src/bongos/module-entitlements.js
+// runs against a small in-memory stand-in for the one table. The live apply runs in
+// the PG lane and at deploy.
+//
+// Run:  node tests/module_entitlements.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SQL = readFileSync(path.join(ROOT, 'migrations', 'core_259_module_entitlements.sql'), 'utf8');
+const DDL = SQL.replace(/--.*$/gm, '');
+const {
+  grantEntitlement, recordAcquired, revokeEntitlement, checkEntitlement, listEntitlements,
+} = require('../src/bongos/module-entitlements.js');
+
+// ---- an in-memory stand-in for module_entitlements, keyed on the SQL's shape ----
+function fakeDb() {
+  const rows = [];
+  let nextId = 1;
+  const find = (k, kind, ref) => rows.find((r) => r.module_key === k && r.holder_kind === kind && r.holder_ref === ref);
+  return {
+    rows,
+    async query(sql, p) {
+      const s = sql.replace(/\s+/g, ' ');
+      if (s.startsWith('INSERT INTO module_entitlements')) {
+        if (find(p[0], p[1], p[2])) return { rows: [] };
+        const r = { id: nextId++, module_key: p[0], holder_kind: p[1], holder_ref: p[2], source: p[3],
+          payment_ref: p[4], version: null, acquired_at: null, granted_by: p[5], granted_at: new Date(),
+          revoked_at: null, revoked_reason: null };
+        rows.push(r);
+        return { rows: [{ ...r }] };
+      }
+      if (s.startsWith('UPDATE module_entitlements SET revoked_at = NULL')) {
+        const r = find(p[0], p[1], p[2]);
+        if (!r || !r.revoked_at) return { rows: [] };
+        Object.assign(r, { revoked_at: null, revoked_reason: null, source: p[3], payment_ref: p[4], granted_by: p[5] });
+        return { rows: [{ ...r }] };
+      }
+      if (s.startsWith('UPDATE module_entitlements SET version')) {
+        const r = rows.find((x) => x.id === p[0]);
+        if (!r || r.revoked_at) return { rows: [] };
+        Object.assign(r, { version: p[1], acquired_at: new Date() });
+        return { rows: [{ ...r }] };
+      }
+      if (s.startsWith('UPDATE module_entitlements SET revoked_at = now()')) {
+        const r = find(p[0], p[1], p[2]);
+        if (!r || r.revoked_at) return { rows: [] };
+        Object.assign(r, { revoked_at: new Date(), revoked_reason: p[3] });
+        return { rows: [{ ...r }] };
+      }
+      if (s.includes('WHERE holder_kind = $1 AND holder_ref = $2')) {
+        return { rows: rows.filter((r) => r.holder_kind === p[0] && r.holder_ref === p[1]).map((r) => ({ ...r })).reverse() };
+      }
+      if (s.includes('WHERE module_key = $1 AND holder_kind = $2 AND holder_ref = $3')) {
+        const r = find(p[0], p[1], p[2]);
+        return { rows: r ? [{ ...r }] : [] };
+      }
+      throw new Error(`fake db: unhandled SQL: ${s}`);
+    },
+  };
+}
+
+const B = { moduleKey: 'weather', holderKind: 'builder', holderRef: '42' };
+
+// ---- the migration ----
+
+test('one idempotent table, forward-safe under the lint gate', () => {
+  assert.match(DDL, /CREATE TABLE IF NOT EXISTS module_entitlements \(/);
+  assert.doesNotMatch(DDL, /CREATE TABLE (?!IF NOT EXISTS)/);
+  assert.doesNotMatch(DDL, /CREATE INDEX (?!IF NOT EXISTS)/);
+  assert.match(DDL, /INSERT INTO schema_migrations \(version\) VALUES \('core_259_module_entitlements'\)\s+ON CONFLICT \(version\) DO NOTHING;/);
+  const lint = require('../scripts/gds/lint-migrations.js');
+  assert.deepEqual(lint.scanMigrationSql(SQL).unsafe || [], []);
+});
+
+test('a core-bundled module can hold an entitlement: module_key is not a foreign key', () => {
+  assert.doesNotMatch(DDL, /module_key[^,\n]*REFERENCES/);
+  assert.match(DDL, /source\s+text NOT NULL\s+CHECK \(source IN \('free', 'core', 'grant', 'purchase'\)\)/);
+});
+
+test('one row per module and holder; nothing cascades it away', () => {
+  assert.match(DDL, /UNIQUE \(module_key, holder_kind, holder_ref\)/);
+  assert.doesNotMatch(DDL, /ON DELETE CASCADE/);
+});
+
+test('the version is exact semver and moves with its timestamp; a revocation carries its reason', () => {
+  assert.match(DDL, /version IS NULL OR version ~ '\^\[0-9\]\+\\\.\[0-9\]\+\\\.\[0-9\]\+\$'/);
+  assert.match(DDL, /CHECK \(\(version IS NULL\) = \(acquired_at IS NULL\)\)/);
+  assert.match(DDL, /CHECK \(\(revoked_at IS NULL\) = \(revoked_reason IS NULL\)\)/);
+});
+
+test('the record models no balance, fee or payout — only an opaque payment_ref (area 8 owns money)', () => {
+  assert.doesNotMatch(DDL, /balance|payout|\bfee\b|price/i);
+  assert.match(DDL, /payment_ref\s+text,/);
+});
+
+// ---- the functions ----
+
+test('every source is granted through the same record, with no payment involved', async () => {
+  const db = fakeDb();
+  for (const [i, source] of ['free', 'core', 'grant'].entries()) {
+    const r = await grantEntitlement({ ...B, moduleKey: `mod-${i}`, source }, { db });
+    assert.equal(r.created, true);
+    assert.equal(r.entitlement.payment_ref, null);
+    assert.equal((await checkEntitlement({ ...B, moduleKey: `mod-${i}` }, { db })).entitled, true);
+  }
+});
+
+test('granting twice is a no-op that keeps the first source', async () => {
+  const db = fakeDb();
+  await grantEntitlement({ ...B, source: 'grant', grantedBy: 7 }, { db });
+  const again = await grantEntitlement({ ...B, source: 'free' }, { db });
+  assert.equal(again.created, false);
+  assert.equal(again.entitlement.source, 'grant');
+  assert.equal(db.rows.length, 1);
+});
+
+test('a holder who was never granted is not entitled, and cannot record an acquisition', async () => {
+  const db = fakeDb();
+  assert.deepEqual(await checkEntitlement(B, { db }), { entitled: false, entitlement: null });
+  assert.deepEqual(await recordAcquired({ ...B, version: '1.0.0' }, { db }), { ok: false, code: 'not_entitled' });
+});
+
+test('an update moves the acquired version forward under the same entitlement', async () => {
+  const db = fakeDb();
+  await grantEntitlement({ ...B, source: 'purchase', paymentRef: 'pay_1' }, { db });
+  assert.equal((await recordAcquired({ ...B, version: '1.9.0' }, { db })).ok, true);
+  const up = await recordAcquired({ ...B, version: '1.10.0' }, { db });
+  assert.equal(up.ok, true, '1.10.0 is newer than 1.9.0 (numeric, not text, order)');
+  assert.equal(up.entitlement.version, '1.10.0');
+  assert.equal(up.entitlement.source, 'purchase', 'an update never rewrites how it was acquired');
+  assert.equal(db.rows.length, 1, 'no second purchase, no second row');
+});
+
+test('an older version is refused unless a rollback is asked for by name', async () => {
+  const db = fakeDb();
+  await grantEntitlement({ ...B, source: 'free' }, { db });
+  await recordAcquired({ ...B, version: '2.0.0' }, { db });
+  assert.deepEqual(await recordAcquired({ ...B, version: '1.5.0' }, { db }), { ok: false, code: 'version_older_than_held' });
+  assert.equal((await recordAcquired({ ...B, version: '1.5.0', allowDowngrade: true }, { db })).entitlement.version, '1.5.0');
+});
+
+test('a version that is not exact X.Y.Z is a caller error', async () => {
+  const db = fakeDb();
+  await grantEntitlement({ ...B, source: 'free' }, { db });
+  await assert.rejects(recordAcquired({ ...B, version: '1.0' }, { db }), /exact X\.Y\.Z/);
+  await assert.rejects(recordAcquired({ ...B, version: '^1.0.0' }, { db }), /exact X\.Y\.Z/);
+});
+
+test('revoking keeps the row, stamps why, and stops the entitlement; a re-grant lifts it', async () => {
+  const db = fakeDb();
+  await grantEntitlement({ ...B, source: 'purchase' }, { db });
+  await recordAcquired({ ...B, version: '1.0.0' }, { db });
+  await assert.rejects(revokeEntitlement({ ...B, reason: '  ' }, { db }), /needs a reason/);
+  const r = await revokeEntitlement({ ...B, reason: 'refunded' }, { db });
+  assert.equal(r.ok, true);
+  assert.equal(db.rows.length, 1, 'kept, never deleted');
+  const held = await checkEntitlement(B, { db });
+  assert.equal(held.entitled, false);
+  assert.equal(held.entitlement.revoked_reason, 'refunded');
+  assert.deepEqual(await recordAcquired({ ...B, version: '1.1.0' }, { db }), { ok: false, code: 'not_entitled' });
+  assert.deepEqual(await revokeEntitlement({ ...B, reason: 'again' }, { db }), { ok: false, code: 'not_entitled' });
+  const back = await grantEntitlement({ ...B, source: 'grant' }, { db });
+  assert.equal(back.reinstated, true);
+  assert.equal((await checkEntitlement(B, { db })).entitled, true);
+  assert.equal(back.entitlement.version, '1.0.0', 'what was acquired is remembered');
+});
+
+test('holdings are per holder: one builder never sees another\'s', async () => {
+  const db = fakeDb();
+  await grantEntitlement({ ...B, source: 'free' }, { db });
+  await grantEntitlement({ ...B, holderRef: '43', source: 'free' }, { db });
+  await grantEntitlement({ ...B, holderKind: 'instance', holderRef: '42', source: 'free' }, { db });
+  const mine = await listEntitlements({ holderKind: 'builder', holderRef: '42' }, { db });
+  assert.equal(mine.length, 1);
+  assert.equal(mine[0].holder_ref, '42');
+});
+
+test('bad arguments throw rather than write', async () => {
+  const db = fakeDb();
+  await assert.rejects(grantEntitlement({ ...B, moduleKey: '../x', source: 'free' }, { db }), /bad module key/);
+  await assert.rejects(grantEntitlement({ ...B, holderKind: 'team', source: 'free' }, { db }), /holder_kind/);
+  await assert.rejects(grantEntitlement({ ...B, source: 'gift' }, { db }), /source must be/);
+  assert.equal(db.rows.length, 0);
+});
+
+// ---- the read routes ----
+
+test('the read routes are own-scoped: gated on requireBuilder, holder taken from the session', () => {
+  const src = readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  for (const p of ['/store/entitlements', '/store/modules/:key/entitlement']) {
+    assert.match(src, new RegExp(`router\\.get\\('${p.replace(/[/:.]/g, '\\$&')}', auth\\.requireBuilder,`));
+  }
+  const block = src.slice(src.indexOf("router.get('/store/entitlements'"));
+  assert.match(block, /holderRef: String\(req\.builder\.id\)/);
+  assert.doesNotMatch(block.slice(0, 1600), /req\.(query|body)\./, 'the holder is never named by the caller');
+});

package/tests/module_install.mjs

@@ -0,0 +1,224 @@
+// tests/module_install.mjs — `bongos module install <key>` (task 1003785, ADR 0338 D1).
+// No network, no database: cmdInstall runs against a fake store built from a REAL
+// packed tarball (scripts/gds/module-artifact.js packModule), so verification is the
+// real verifyModuleArtifact. The store's read side (src/bongos/module-store.js) runs
+// against a fake pg client, and the three routes are pinned in their source.
+//
+// Run:  node tests/module_install.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+const { readTar, buildTar } = require('../scripts/gds/artifact-format.js');
+const { cmdInstall } = require('../scripts/gds/module.js');
+const { isFreePrice, resolveAcquirable, versionArtifactFile, relativeArtifactPath } = require('../src/bongos/module-store.js');
+
+const NOW = () => new Date('2026-09-29T00:00:00Z');
+
+// A real packed tarball for one module, built from a temp source tree.
+async function packed(mj = {}) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-install-src-'));
+  const manifest = { key: 'weather', title: 'Weather', description: 'Shows the weather.', version: '1.2.0', coreVersion: '^1.0.0', contributes: {}, ...mj };
+  const dir = path.join(src, manifest.key);
+  fs.mkdirSync(path.join(dir, 'routes'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'module.json'), JSON.stringify(manifest, null, 2));
+  fs.writeFileSync(path.join(dir, 'routes', 'weather.js'), 'module.exports = () => null;\n');
+  const { tgz } = packModule(manifest.key, { modulesDir: src, now: NOW, modeOf: () => '644' });
+  const v = await verifyModuleArtifact(tgz, { key: manifest.key });
+  assert.ok(v.ok, 'the fixture packs cleanly');
+  return { tgz, v };
+}
+
+// A fake store: answers the three install calls and records what it was asked.
+function fakeStore({ tgz, v }, over = {}) {
+  const calls = [];
+  const describe = {
+    ok: true, module_key: v.moduleJson.key, version: v.version, core_version: v.coreVersion,
+    tarball_sha256: v.tarballSha256, tree_sha256: v.treeSha256, tarball_bytes: v.bytes, channel: 'general',
+  };
+  const request = async (method, urlPath, opts = {}) => {
+    calls.push({ method, urlPath, json: opts.json });
+    if (urlPath.endsWith('/acquire')) return over.acquire || { ok: true, status: 200, data: { ...describe, ...(over.describe || {}) } };
+    if (urlPath.endsWith('/tarball')) return over.download || { ok: true, status: 200, buf: over.buf || tgz };
+    if (urlPath.endsWith('/acquired')) return over.acquired || { ok: true, status: 200, data: { ok: true } };
+    throw new Error(`unexpected ${method} ${urlPath}`);
+  };
+  return { calls, request };
+}
+
+const dest = () => fs.mkdtempSync(path.join(os.tmpdir(), 'mod-install-dest-'));
+const quiet = () => { const out = []; return { out, log: (m) => out.push(m), errlog: (m) => out.push(m) }; };
+
+// ---- cmdInstall ----
+
+test('installs a free module: verified, placed, recorded, and NOT enabled', async () => {
+  const p = await packed();
+  const store = fakeStore(p);
+  const modulesDir = dest();
+  const q = quiet();
+  const code = await cmdInstall(['weather'], { ...q, modulesDir, request: store.request, core: '1.19.0' });
+  assert.equal(code, 0, q.out.join('\n'));
+  const placed = path.join(modulesDir, 'weather');
+  assert.equal(JSON.parse(fs.readFileSync(path.join(placed, 'module.json'), 'utf8')).version, '1.2.0');
+  assert.equal(fs.readFileSync(path.join(placed, 'routes', 'weather.js'), 'utf8'), 'module.exports = () => null;\n');
+  assert.ok(!fs.existsSync(path.join(placed, '.bongos-module.json')), 'the store manifest is not placed as a module file');
+  assert.deepEqual(fs.readdirSync(modulesDir), ['weather'], 'no staging dir left behind, nothing else written');
+  assert.deepEqual(store.calls.map((c) => c.method + ' ' + c.urlPath), [
+    'POST /store/modules/weather/acquire',
+    'GET /store/modules/weather/versions/1.2.0/tarball',
+    'POST /store/modules/weather/acquired',
+  ]);
+  assert.deepEqual(store.calls[2].json, { version: '1.2.0' }, 'records the exact version placed');
+  assert.match(q.out.join('\n'), /not switched on/);
+});
+
+test('--version asks the store for that exact version; a loose one is refused before any call', async () => {
+  const p = await packed();
+  const store = fakeStore(p);
+  const q = quiet();
+  await cmdInstall(['weather', '--version', '1.2.0'], { ...q, modulesDir: dest(), request: store.request, core: '1.19.0' });
+  assert.deepEqual(store.calls[0].json, { version: '1.2.0' });
+  const store2 = fakeStore(p);
+  assert.equal(await cmdInstall(['weather', '--version', '^1.2.0'], { ...quiet(), modulesDir: dest(), request: store2.request }), 2);
+  assert.equal(store2.calls.length, 0);
+});
+
+test('a module already on disk is refused, and the store is never asked', async () => {
+  const p = await packed();
+  const store = fakeStore(p);
+  const modulesDir = dest();
+  fs.mkdirSync(path.join(modulesDir, 'weather'));
+  assert.equal(await cmdInstall(['weather'], { ...quiet(), modulesDir, request: store.request }), 1);
+  assert.equal(store.calls.length, 0);
+});
+
+test('a tampered download fails verification: nothing placed, nothing recorded', async () => {
+  const p = await packed();
+  const entries = readTar(p.tgz);
+  const route = entries.find((e) => e.name.endsWith('routes/weather.js'));
+  route.buf = Buffer.from('require("child_process").execSync("evil");\n');
+  const store = fakeStore(p, { buf: buildTar(entries) });
+  const modulesDir = dest();
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...q, modulesDir, request: store.request, core: '1.19.0' }), 1);
+  assert.match(q.out.join('\n'), /failed verification \(hash_mismatch\)/);
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+  assert.ok(!store.calls.some((c) => c.urlPath.endsWith('/acquired')));
+});
+
+test('a download that verifies but is not the version the store described is refused', async () => {
+  const p = await packed();
+  const other = await packed({ version: '1.3.0' });
+  const store = fakeStore(p, { buf: other.tgz });
+  const modulesDir = dest();
+  assert.equal(await cmdInstall(['weather'], { ...quiet(), modulesDir, request: store.request, core: '1.19.0' }), 1);
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+});
+
+test('a priced module the caller does not hold is refused with the store\'s reason', async () => {
+  const p = await packed();
+  const store = fakeStore(p, { acquire: { ok: false, status: 402, data: { error: { code: 'payment_required', message: 'buying is not available yet' } } } });
+  const modulesDir = dest();
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...q, modulesDir, request: store.request }), 1);
+  assert.match(q.out.join('\n'), /HTTP 402\): buying is not available yet/);
+  assert.equal(store.calls.length, 1, 'no download is attempted');
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+});
+
+test('a module this core cannot mount is refused before download', async () => {
+  const p = await packed({ coreVersion: '^2.0.0' });
+  const store = fakeStore(p);
+  assert.equal(await cmdInstall(['weather'], { ...quiet(), modulesDir: dest(), request: store.request, core: '1.19.0' }), 1);
+  assert.equal(store.calls.length, 1);
+});
+
+test('a failed record after placing keeps the files and says so', async () => {
+  const p = await packed();
+  const store = fakeStore(p, { acquired: { ok: false, status: 500, data: { error: { message: 'db down' } } } });
+  const modulesDir = dest();
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...q, modulesDir, request: store.request, core: '1.19.0' }), 1);
+  assert.ok(fs.existsSync(path.join(modulesDir, 'weather', 'module.json')));
+  assert.match(q.out.join('\n'), /installed, but the store did not record the version \(db down\)/);
+});
+
+// ---- verifyModuleArtifact includeFiles ----
+
+test('includeFiles returns the module files from the checked parse, manifest excluded', async () => {
+  const { tgz } = await packed();
+  const v = await verifyModuleArtifact(tgz, { key: 'weather', includeFiles: true });
+  assert.deepEqual(v.files.map((f) => f.path).sort(), ['module.json', 'routes/weather.js']);
+  const plain = await verifyModuleArtifact(tgz, { key: 'weather' });
+  assert.equal(plain.files, undefined, 'publish keeps its old shape');
+});
+
+// ---- the store's read side ----
+
+test('an unpriced module is free (owner decision 2026-09-29); a zero in either currency is free', () => {
+  assert.equal(isFreePrice(null), true);
+  assert.equal(isFreePrice({ price_cents: 0, price_credits: null }), true);
+  assert.equal(isFreePrice({ price_cents: 500, price_credits: 0 }), true);
+  assert.equal(isFreePrice({ price_cents: 500, price_credits: null }), false);
+  assert.equal(isFreePrice({ price_cents: null, price_credits: 20 }), false);
+});
+
+function fakeDb({ mod, versions = [], price = null }) {
+  return {
+    async query(sql) {
+      if (sql.includes('FROM store_modules')) return { rows: mod ? [mod] : [] };
+      if (sql.includes('FROM store_module_versions')) return { rows: versions };
+      if (sql.includes('FROM store_module_prices')) return { rows: price ? [price] : [] };
+      throw new Error(`unhandled: ${sql}`);
+    },
+  };
+}
+const row = (version) => ({ id: 1, module_key: 'weather', version, core_version: '^1.0.0', tarball_sha256: 'a'.repeat(64), tree_sha256: 'b'.repeat(64), tarball_bytes: 10, artifact_path: `weather/weather-${version}.tgz` });
+
+test('resolveAcquirable picks the newest version in semver order, not text order', async () => {
+  const r = await resolveAcquirable('weather', { db: fakeDb({ mod: { module_key: 'weather', status: 'listed' }, versions: [row('1.9.0'), row('1.10.0'), row('1.2.0')] }) });
+  assert.equal(r.ok, true);
+  assert.equal(r.version.version, '1.10.0');
+  assert.equal(r.free, true);
+});
+
+test('resolveAcquirable refuses an unknown module, a delisted one, a missing version, and a module with none', async () => {
+  assert.equal((await resolveAcquirable('weather', { db: fakeDb({}) })).code, 'module_not_found');
+  assert.equal((await resolveAcquirable('weather', { db: fakeDb({ mod: { status: 'delisted' }, versions: [row('1.0.0')] }) })).code, 'module_delisted');
+  assert.equal((await resolveAcquirable('weather', { version: '2.0.0', db: fakeDb({ mod: { status: 'listed' }, versions: [row('1.0.0')] }) })).code, 'version_not_found');
+  assert.equal((await resolveAcquirable('weather', { db: fakeDb({ mod: { status: 'listed' } }) })).code, 'no_versions');
+  const priced = await resolveAcquirable('weather', { db: fakeDb({ mod: { status: 'listed' }, versions: [row('1.0.0')], price: { price_cents: 900, price_credits: null } }) });
+  assert.equal(priced.free, false);
+});
+
+test('versionArtifactFile resolves inside the store dir and refuses a row naming another path', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-store-'));
+  const f = versionArtifactFile(row('1.0.0'), { dir });
+  assert.equal(relativeArtifactPath(f, { dir }), 'weather/weather-1.0.0.tgz');
+  assert.throws(() => versionArtifactFile({ ...row('1.0.0'), artifact_path: '../../etc/passwd' }, { dir }), /unexpected artifact path/);
+});
+
+// ---- the routes ----
+
+test('the install routes are own-scoped and the download checks the entitlement before reading the file', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  for (const decl of [
+    "router.post('/store/modules/:key/acquire', auth.requireBuilder,",
+    "router.get('/store/modules/:key/versions/:version/tarball', auth.requireBuilder,",
+    "router.post('/store/modules/:key/acquired', auth.requireBuilder,",
+  ]) assert.ok(src.includes(decl), decl);
+  const start = src.indexOf("router.post('/store/modules/:key/acquire'");
+  const block = src.slice(start, src.indexOf('return router;', start));
+  assert.doesNotMatch(block, /holderRef: (?!String\(req\.builder\.id\))/, 'the holder is always the caller');
+  const dl = block.slice(block.indexOf('/tarball'));
+  assert.ok(dl.indexOf('checkEntitlement') < dl.indexOf('readFile'), 'no bytes are read for a caller who does not hold it');
+  assert.match(block, /if \(!r\.free\)[\s\S]*?payment_required[\s\S]*?status: 402/, 'a priced module is not granted for free');
+});