@bongos/core 1.19.1078 → 1.19.1080

package/tests/module_install.mjs

@@ -0,0 +1,224 @@
+// tests/module_install.mjs — `bongos module install <key>` (task 1003785, ADR 0338 D1).
+// No network, no database: cmdInstall runs against a fake store built from a REAL
+// packed tarball (scripts/gds/module-artifact.js packModule), so verification is the
+// real verifyModuleArtifact. The store's read side (src/bongos/module-store.js) runs
+// against a fake pg client, and the three routes are pinned in their source.
+//
+// Run:  node tests/module_install.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+const { readTar, buildTar } = require('../scripts/gds/artifact-format.js');
+const { cmdInstall } = require('../scripts/gds/module.js');
+const { isFreePrice, resolveAcquirable, versionArtifactFile, relativeArtifactPath } = require('../src/bongos/module-store.js');
+
+const NOW = () => new Date('2026-09-29T00:00:00Z');
+
+// A real packed tarball for one module, built from a temp source tree.
+async function packed(mj = {}) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-install-src-'));
+  const manifest = { key: 'weather', title: 'Weather', description: 'Shows the weather.', version: '1.2.0', coreVersion: '^1.0.0', contributes: {}, ...mj };
+  const dir = path.join(src, manifest.key);
+  fs.mkdirSync(path.join(dir, 'routes'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'module.json'), JSON.stringify(manifest, null, 2));
+  fs.writeFileSync(path.join(dir, 'routes', 'weather.js'), 'module.exports = () => null;\n');
+  const { tgz } = packModule(manifest.key, { modulesDir: src, now: NOW, modeOf: () => '644' });
+  const v = await verifyModuleArtifact(tgz, { key: manifest.key });
+  assert.ok(v.ok, 'the fixture packs cleanly');
+  return { tgz, v };
+}
+
+// A fake store: answers the three install calls and records what it was asked.
+function fakeStore({ tgz, v }, over = {}) {
+  const calls = [];
+  const describe = {
+    ok: true, module_key: v.moduleJson.key, version: v.version, core_version: v.coreVersion,
+    tarball_sha256: v.tarballSha256, tree_sha256: v.treeSha256, tarball_bytes: v.bytes, channel: 'general',
+  };
+  const request = async (method, urlPath, opts = {}) => {
+    calls.push({ method, urlPath, json: opts.json });
+    if (urlPath.endsWith('/acquire')) return over.acquire || { ok: true, status: 200, data: { ...describe, ...(over.describe || {}) } };
+    if (urlPath.endsWith('/tarball')) return over.download || { ok: true, status: 200, buf: over.buf || tgz };
+    if (urlPath.endsWith('/acquired')) return over.acquired || { ok: true, status: 200, data: { ok: true } };
+    throw new Error(`unexpected ${method} ${urlPath}`);
+  };
+  return { calls, request };
+}
+
+const dest = () => fs.mkdtempSync(path.join(os.tmpdir(), 'mod-install-dest-'));
+const quiet = () => { const out = []; return { out, log: (m) => out.push(m), errlog: (m) => out.push(m) }; };
+
+// ---- cmdInstall ----
+
+test('installs a free module: verified, placed, recorded, and NOT enabled', async () => {
+  const p = await packed();
+  const store = fakeStore(p);
+  const modulesDir = dest();
+  const q = quiet();
+  const code = await cmdInstall(['weather'], { ...q, modulesDir, request: store.request, core: '1.19.0' });
+  assert.equal(code, 0, q.out.join('\n'));
+  const placed = path.join(modulesDir, 'weather');
+  assert.equal(JSON.parse(fs.readFileSync(path.join(placed, 'module.json'), 'utf8')).version, '1.2.0');
+  assert.equal(fs.readFileSync(path.join(placed, 'routes', 'weather.js'), 'utf8'), 'module.exports = () => null;\n');
+  assert.ok(!fs.existsSync(path.join(placed, '.bongos-module.json')), 'the store manifest is not placed as a module file');
+  assert.deepEqual(fs.readdirSync(modulesDir), ['weather'], 'no staging dir left behind, nothing else written');
+  assert.deepEqual(store.calls.map((c) => c.method + ' ' + c.urlPath), [
+    'POST /store/modules/weather/acquire',
+    'GET /store/modules/weather/versions/1.2.0/tarball',
+    'POST /store/modules/weather/acquired',
+  ]);
+  assert.deepEqual(store.calls[2].json, { version: '1.2.0' }, 'records the exact version placed');
+  assert.match(q.out.join('\n'), /not switched on/);
+});
+
+test('--version asks the store for that exact version; a loose one is refused before any call', async () => {
+  const p = await packed();
+  const store = fakeStore(p);
+  const q = quiet();
+  await cmdInstall(['weather', '--version', '1.2.0'], { ...q, modulesDir: dest(), request: store.request, core: '1.19.0' });
+  assert.deepEqual(store.calls[0].json, { version: '1.2.0' });
+  const store2 = fakeStore(p);
+  assert.equal(await cmdInstall(['weather', '--version', '^1.2.0'], { ...quiet(), modulesDir: dest(), request: store2.request }), 2);
+  assert.equal(store2.calls.length, 0);
+});
+
+test('a module already on disk is refused, and the store is never asked', async () => {
+  const p = await packed();
+  const store = fakeStore(p);
+  const modulesDir = dest();
+  fs.mkdirSync(path.join(modulesDir, 'weather'));
+  assert.equal(await cmdInstall(['weather'], { ...quiet(), modulesDir, request: store.request }), 1);
+  assert.equal(store.calls.length, 0);
+});
+
+test('a tampered download fails verification: nothing placed, nothing recorded', async () => {
+  const p = await packed();
+  const entries = readTar(p.tgz);
+  const route = entries.find((e) => e.name.endsWith('routes/weather.js'));
+  route.buf = Buffer.from('require("child_process").execSync("evil");\n');
+  const store = fakeStore(p, { buf: buildTar(entries) });
+  const modulesDir = dest();
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...q, modulesDir, request: store.request, core: '1.19.0' }), 1);
+  assert.match(q.out.join('\n'), /failed verification \(hash_mismatch\)/);
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+  assert.ok(!store.calls.some((c) => c.urlPath.endsWith('/acquired')));
+});
+
+test('a download that verifies but is not the version the store described is refused', async () => {
+  const p = await packed();
+  const other = await packed({ version: '1.3.0' });
+  const store = fakeStore(p, { buf: other.tgz });
+  const modulesDir = dest();
+  assert.equal(await cmdInstall(['weather'], { ...quiet(), modulesDir, request: store.request, core: '1.19.0' }), 1);
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+});
+
+test('a priced module the caller does not hold is refused with the store\'s reason', async () => {
+  const p = await packed();
+  const store = fakeStore(p, { acquire: { ok: false, status: 402, data: { error: { code: 'payment_required', message: 'buying is not available yet' } } } });
+  const modulesDir = dest();
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...q, modulesDir, request: store.request }), 1);
+  assert.match(q.out.join('\n'), /HTTP 402\): buying is not available yet/);
+  assert.equal(store.calls.length, 1, 'no download is attempted');
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+});
+
+test('a module this core cannot mount is refused before download', async () => {
+  const p = await packed({ coreVersion: '^2.0.0' });
+  const store = fakeStore(p);
+  assert.equal(await cmdInstall(['weather'], { ...quiet(), modulesDir: dest(), request: store.request, core: '1.19.0' }), 1);
+  assert.equal(store.calls.length, 1);
+});
+
+test('a failed record after placing keeps the files and says so', async () => {
+  const p = await packed();
+  const store = fakeStore(p, { acquired: { ok: false, status: 500, data: { error: { message: 'db down' } } } });
+  const modulesDir = dest();
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...q, modulesDir, request: store.request, core: '1.19.0' }), 1);
+  assert.ok(fs.existsSync(path.join(modulesDir, 'weather', 'module.json')));
+  assert.match(q.out.join('\n'), /installed, but the store did not record the version \(db down\)/);
+});
+
+// ---- verifyModuleArtifact includeFiles ----
+
+test('includeFiles returns the module files from the checked parse, manifest excluded', async () => {
+  const { tgz } = await packed();
+  const v = await verifyModuleArtifact(tgz, { key: 'weather', includeFiles: true });
+  assert.deepEqual(v.files.map((f) => f.path).sort(), ['module.json', 'routes/weather.js']);
+  const plain = await verifyModuleArtifact(tgz, { key: 'weather' });
+  assert.equal(plain.files, undefined, 'publish keeps its old shape');
+});
+
+// ---- the store's read side ----
+
+test('an unpriced module is free (owner decision 2026-09-29); a zero in either currency is free', () => {
+  assert.equal(isFreePrice(null), true);
+  assert.equal(isFreePrice({ price_cents: 0, price_credits: null }), true);
+  assert.equal(isFreePrice({ price_cents: 500, price_credits: 0 }), true);
+  assert.equal(isFreePrice({ price_cents: 500, price_credits: null }), false);
+  assert.equal(isFreePrice({ price_cents: null, price_credits: 20 }), false);
+});
+
+function fakeDb({ mod, versions = [], price = null }) {
+  return {
+    async query(sql) {
+      if (sql.includes('FROM store_modules')) return { rows: mod ? [mod] : [] };
+      if (sql.includes('FROM store_module_versions')) return { rows: versions };
+      if (sql.includes('FROM store_module_prices')) return { rows: price ? [price] : [] };
+      throw new Error(`unhandled: ${sql}`);
+    },
+  };
+}
+const row = (version) => ({ id: 1, module_key: 'weather', version, core_version: '^1.0.0', tarball_sha256: 'a'.repeat(64), tree_sha256: 'b'.repeat(64), tarball_bytes: 10, artifact_path: `weather/weather-${version}.tgz` });
+
+test('resolveAcquirable picks the newest version in semver order, not text order', async () => {
+  const r = await resolveAcquirable('weather', { db: fakeDb({ mod: { module_key: 'weather', status: 'listed' }, versions: [row('1.9.0'), row('1.10.0'), row('1.2.0')] }) });
+  assert.equal(r.ok, true);
+  assert.equal(r.version.version, '1.10.0');
+  assert.equal(r.free, true);
+});
+
+test('resolveAcquirable refuses an unknown module, a delisted one, a missing version, and a module with none', async () => {
+  assert.equal((await resolveAcquirable('weather', { db: fakeDb({}) })).code, 'module_not_found');
+  assert.equal((await resolveAcquirable('weather', { db: fakeDb({ mod: { status: 'delisted' }, versions: [row('1.0.0')] }) })).code, 'module_delisted');
+  assert.equal((await resolveAcquirable('weather', { version: '2.0.0', db: fakeDb({ mod: { status: 'listed' }, versions: [row('1.0.0')] }) })).code, 'version_not_found');
+  assert.equal((await resolveAcquirable('weather', { db: fakeDb({ mod: { status: 'listed' } }) })).code, 'no_versions');
+  const priced = await resolveAcquirable('weather', { db: fakeDb({ mod: { status: 'listed' }, versions: [row('1.0.0')], price: { price_cents: 900, price_credits: null } }) });
+  assert.equal(priced.free, false);
+});
+
+test('versionArtifactFile resolves inside the store dir and refuses a row naming another path', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-store-'));
+  const f = versionArtifactFile(row('1.0.0'), { dir });
+  assert.equal(relativeArtifactPath(f, { dir }), 'weather/weather-1.0.0.tgz');
+  assert.throws(() => versionArtifactFile({ ...row('1.0.0'), artifact_path: '../../etc/passwd' }, { dir }), /unexpected artifact path/);
+});
+
+// ---- the routes ----
+
+test('the install routes are own-scoped and the download checks the entitlement before reading the file', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  for (const decl of [
+    "router.post('/store/modules/:key/acquire', auth.requireBuilder,",
+    "router.get('/store/modules/:key/versions/:version/tarball', auth.requireBuilder,",
+    "router.post('/store/modules/:key/acquired', auth.requireBuilder,",
+  ]) assert.ok(src.includes(decl), decl);
+  const start = src.indexOf("router.post('/store/modules/:key/acquire'");
+  const block = src.slice(start, src.indexOf('return router;', start));
+  assert.doesNotMatch(block, /holderRef: (?!String\(req\.builder\.id\))/, 'the holder is always the caller');
+  const dl = block.slice(block.indexOf('/tarball'));
+  assert.ok(dl.indexOf('checkEntitlement') < dl.indexOf('readFile'), 'no bytes are read for a caller who does not hold it');
+  assert.match(block, /if \(!r\.free\)[\s\S]*?payment_required[\s\S]*?status: 402/, 'a priced module is not granted for free');
+});

package/tests/module_update.mjs

@@ -0,0 +1,232 @@
+// tests/module_update.mjs — `bongos module update <key>` (task 1003786, ADR 0338 D1,
+// criterion wa5-module-economy). No network, no database: cmdUpdate runs against a
+// fake store serving REAL packed tarballs, so verification is the real
+// verifyModuleArtifact.
+//
+// The criterion's teeth are the parity tests: an update to a paid module the caller
+// holds and to a free one make the identical calls with the identical outcome, and
+// the shared acquisition path carries no price-conditional code at all.
+//
+// Run:  node tests/module_update.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+const { readTar, buildTar } = require('../scripts/gds/artifact-format.js');
+const { cmdUpdate, cmdInstall } = require('../scripts/gds/module.js');
+
+const NOW = () => new Date('2026-09-29T00:00:00Z');
+
+// A real packed tarball for weather@version, with `extra` files beside module.json.
+async function packed(version, extra = {}, mj = {}) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-src-'));
+  const manifest = { key: 'weather', title: 'Weather', description: 'Shows the weather.', version, coreVersion: '^1.0.0', contributes: {}, ...mj };
+  const dir = path.join(src, 'weather');
+  const files = { 'module.json': JSON.stringify(manifest, null, 2), 'routes/weather.js': `module.exports = () => '${version}';\n`, ...extra };
+  for (const [rel, body] of Object.entries(files)) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), body);
+  }
+  const { tgz } = packModule('weather', { modulesDir: src, now: NOW, modeOf: () => '644' });
+  const v = await verifyModuleArtifact(tgz, { key: 'weather' });
+  assert.ok(v.ok);
+  return { tgz, v };
+}
+
+// An installed weather@version in a fresh modules dir.
+function installedAt(version, extra = {}) {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-dest-'));
+  const dir = path.join(modulesDir, 'weather');
+  const files = { 'module.json': JSON.stringify({ key: 'weather', version }), 'routes/weather.js': `module.exports = () => '${version}';\n`, ...extra };
+  for (const [rel, body] of Object.entries(files)) {
+    fs.mkdirSync(path.dirname(path.join(dir, rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), body);
+  }
+  return modulesDir;
+}
+
+// A fake store. `source` is how the caller came to hold the module; the store's own
+// acquire route never looks at price for a holder, so nothing else differs.
+function fakeStore({ tgz, v }, { source = 'free', over = {} } = {}) {
+  const calls = [];
+  const request = async (method, urlPath, opts = {}) => {
+    calls.push({ method, urlPath, json: opts.json });
+    if (urlPath.endsWith('/acquire')) {
+      return over.acquire || { ok: true, status: 200, data: {
+        ok: true, module_key: 'weather', version: v.version, core_version: v.coreVersion,
+        tarball_sha256: v.tarballSha256, tree_sha256: v.treeSha256, tarball_bytes: v.bytes, channel: 'general',
+        entitlement: { module_key: 'weather', holder_kind: 'builder', holder_ref: '42', source, version: '1.2.0' },
+      } };
+    }
+    if (urlPath.endsWith('/tarball')) return { ok: true, status: 200, buf: over.buf || tgz };
+    if (urlPath.endsWith('/acquired')) return { ok: true, status: 200, data: { ok: true } };
+    throw new Error(`unexpected ${method} ${urlPath}`);
+  };
+  return { calls, request };
+}
+
+const quiet = () => { const out = []; return { out, log: (m) => out.push(m), errlog: (m) => out.push(m) }; };
+const opts = (modulesDir, store, q = quiet()) => ({ ...q, modulesDir, roots: [], request: store.request, core: '1.19.0' });
+const route = (modulesDir) => fs.readFileSync(path.join(modulesDir, 'weather', 'routes', 'weather.js'), 'utf8');
+
+// ---- update ----
+
+test('updates an installed module to the newest version: files replaced, old-only files gone, version recorded', async () => {
+  const modulesDir = installedAt('1.2.0', { 'old-only.js': 'x' });
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 0, q.out.join('\n'));
+  assert.equal(route(modulesDir), "module.exports = () => '1.3.0';\n");
+  assert.ok(!fs.existsSync(path.join(modulesDir, 'weather', 'old-only.js')), 'the new version is exactly what was published');
+  assert.deepEqual(fs.readdirSync(modulesDir), ['weather'], 'no staging or previous dir left behind');
+  assert.deepEqual(store.calls.map((c) => `${c.method} ${c.urlPath}`), [
+    'POST /store/modules/weather/acquire',
+    'GET /store/modules/weather/versions/1.3.0/tarball',
+    'POST /store/modules/weather/acquired',
+  ]);
+  assert.deepEqual(store.calls[2].json, { version: '1.3.0' });
+  assert.match(q.out.join('\n'), /1\.2\.0 → 1\.3\.0\. Its on\/off switch is unchanged/);
+});
+
+test('already on the newest version: says so and downloads nothing', async () => {
+  const modulesDir = installedAt('1.3.0');
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 0);
+  assert.deepEqual(store.calls.map((c) => c.urlPath), ['/store/modules/weather/acquire']);
+  assert.match(q.out.join('\n'), /up to date at 1\.3\.0/);
+});
+
+test('an older --version is refused before the store is asked: update only moves forward', async () => {
+  const modulesDir = installedAt('1.3.0');
+  const store = fakeStore(await packed('1.2.0'));
+  assert.equal(await cmdUpdate(['weather', '--version', '1.2.0'], opts(modulesDir, store)), 1);
+  assert.equal(store.calls.length, 0);
+  assert.equal(route(modulesDir), "module.exports = () => '1.3.0';\n");
+});
+
+test('--version asks the store for that exact version', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const store = fakeStore(await packed('1.4.0'));
+  assert.equal(await cmdUpdate(['weather', '--version', '1.4.0'], opts(modulesDir, store)), 0);
+  assert.deepEqual(store.calls[0].json, { version: '1.4.0' });
+});
+
+test('a module that is not installed is refused, pointing at install', async () => {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-empty-'));
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 1);
+  assert.match(q.out.join('\n'), /not installed here\. Run `bongos module install weather`/);
+  assert.equal(store.calls.length, 0);
+});
+
+test('a module bundled with the core is refused: it updates with the core', async () => {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-update-empty-'));
+  const coreRoot = installedAt('1.0.0');
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], { ...opts(modulesDir, store, q), roots: [coreRoot] }), 1);
+  assert.match(q.out.join('\n'), /comes with the core, not the store/);
+  assert.equal(store.calls.length, 0);
+});
+
+test('a tampered download leaves the installed version untouched', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const next = await packed('1.3.0');
+  const entries = readTar(next.tgz);
+  entries.find((e) => e.name.endsWith('routes/weather.js')).buf = Buffer.from('evil();\n');
+  const store = fakeStore(next, { over: { buf: buildTar(entries) } });
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 1);
+  assert.match(q.out.join('\n'), /failed verification \(hash_mismatch\)/);
+  assert.equal(route(modulesDir), "module.exports = () => '1.2.0';\n");
+  assert.deepEqual(fs.readdirSync(modulesDir), ['weather']);
+  assert.ok(!store.calls.some((c) => c.urlPath.endsWith('/acquired')));
+});
+
+test('a version this core cannot mount is refused before download, the installed one kept', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const store = fakeStore(await packed('2.0.0', {}, { coreVersion: '^2.0.0' }));
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store)), 1);
+  assert.equal(store.calls.length, 1);
+  assert.equal(route(modulesDir), "module.exports = () => '1.2.0';\n");
+});
+
+test('a store refusal (e.g. a delisted module) keeps the installed version', async () => {
+  const modulesDir = installedAt('1.2.0');
+  const store = fakeStore(await packed('1.3.0'), { over: { acquire: { ok: false, status: 409, data: { error: { code: 'module_delisted', message: 'delisted' } } } } });
+  const q = quiet();
+  assert.equal(await cmdUpdate(['weather'], opts(modulesDir, store, q)), 1);
+  assert.match(q.out.join('\n'), /HTTP 409\): delisted/);
+  assert.equal(route(modulesDir), "module.exports = () => '1.2.0';\n");
+});
+
+// ---- parity: paid and free take one path (criterion wa5-module-economy) ----
+
+test('a paid module the caller holds and a free one update through identical calls with an identical outcome', async () => {
+  const next = await packed('1.3.0');
+  const runs = {};
+  for (const source of ['free', 'purchase', 'grant', 'core']) {
+    const modulesDir = installedAt('1.2.0');
+    const store = fakeStore(next, { source });
+    const q = quiet();
+    const code = await cmdUpdate(['weather'], opts(modulesDir, store, q));
+    runs[source] = { code, calls: store.calls, out: q.out.join('\n').replaceAll(modulesDir, '<dir>'), route: route(modulesDir) };
+  }
+  for (const source of ['purchase', 'grant', 'core']) {
+    assert.deepEqual(runs[source], runs.free, `an update of a module held as '${source}' must not differ from a free one`);
+  }
+  assert.equal(runs.free.code, 0);
+});
+
+// Strip comments so only code is scanned; a word in an explanation is not a branch.
+function codeOf(src, fnName) {
+  const start = src.indexOf(`function ${fnName}(`);
+  assert.ok(start !== -1, `${fnName} exists`);
+  const next = src.indexOf('\nfunction ', start + 1);
+  const nextAsync = src.indexOf('\nasync function ', start + 1);
+  const end = [next, nextAsync].filter((i) => i > start).sort((a, b) => a - b)[0] ?? src.length;
+  return src.slice(start, end).replace(/\/\/.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+}
+
+test('the shared acquisition path, install and update carry no price-conditional code', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/module.js'), 'utf8');
+  for (const fn of ['fetchVerified', 'recordPlaced', 'cmdInstall', 'cmdUpdate', 'replaceModule', 'placeModule']) {
+    assert.doesNotMatch(codeOf(src, fn), /\b(price|priced|paid|cents|credits|free|purchase|source)\b/i, `${fn} must not read how the module was obtained`);
+  }
+  // Both commands go through the one path, not two copies of it.
+  assert.match(codeOf(src, 'cmdInstall'), /await fetchVerified\(key,/);
+  assert.match(codeOf(src, 'cmdUpdate'), /await fetchVerified\(key,/);
+});
+
+test('the store only looks at price for a caller who holds no entitlement, so a holder is never charged again', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/modules.js'), 'utf8');
+  const start = src.indexOf("router.post('/store/modules/:key/acquire'");
+  const block = src.slice(start, src.indexOf('router.get(', start));
+  const priceAt = block.indexOf('r.free');
+  const guardAt = block.indexOf('if (!held.entitled) {');
+  assert.ok(guardAt !== -1 && priceAt > guardAt, 'the price check sits inside the not-entitled branch');
+  assert.equal(block.split('r.free').length - 1, 1, 'price is read in exactly one place');
+});
+
+// ---- install: the grader's finding on task 1003785 ----
+
+test('install refuses a key already present in another discovery root (a module bundled with the core)', async () => {
+  const modulesDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-install-empty-'));
+  const coreRoot = installedAt('1.0.0');
+  const store = fakeStore(await packed('1.3.0'));
+  const q = quiet();
+  assert.equal(await cmdInstall(['weather'], { ...opts(modulesDir, store, q), roots: [coreRoot] }), 1);
+  assert.match(q.out.join('\n'), /already on disk at .*run `bongos module update weather`/);
+  assert.equal(store.calls.length, 0);
+  assert.deepEqual(fs.readdirSync(modulesDir), []);
+});