@bongos/core 1.21.171 → 1.21.173

package/src/bongos/auth-github.js

@@ -234,7 +234,7 @@ async function pollDeviceFlow(deviceCode, userAgent) {
 // Web Flow (browser)
 // -------------------------------------------------------------------------
 
-function buildAuthorizeUrl(state, redirectUri, { repos = false } = {}) {
+function buildAuthorizeUrl(state, redirectUri, { repos = false, switchAccount = false } = {}) {
   const creds = loadGithubCreds();
   if (!creds) throw new Error('GitHub OAuth credentials not configured');
   const u = new URL('https://github.com/login/oauth/authorize');
@@ -244,6 +244,11 @@ function buildAuthorizeUrl(state, redirectUri, { repos = false } = {}) {
   // other caller gets identity-only. scopeForWebFlow keeps that decision in one place.
   u.searchParams.set('scope', scopeForWebFlow({ repos }));
   u.searchParams.set('state', state);
+  // `switchAccount:true` (the home page's "New account" button, task 1004789):
+  // GitHub otherwise silently re-uses whoever is logged in to github.com in this
+  // browser, so a second account could never be reached. select_account makes
+  // GitHub show its account picker, with "Use a different account".
+  if (switchAccount) u.searchParams.set('prompt', 'select_account');
   return u.toString();
 }
 

package/src/bongos/module-listing.js

@@ -126,6 +126,54 @@ function sortByPart(entries, part) {
   });
 }
 
+// ---------------------------------------------------------------------------
+// The ranking: quality first, price breaks ties (task 1003808, owner 2026-10-23)
+// ---------------------------------------------------------------------------
+//
+// Above the floor, the default order of `listed` is the rule an author and a buyer
+// can both check in one sentence:
+//
+//   highest overall score first; between equal scores the cheaper module first
+//   (free first, then the lowest cash price, then the lowest credit price); then
+//   the key.
+//
+// Price never buys a better place: it only orders modules the score could not tell
+// apart (price is never an input to the score, ADR 0343 D6). A buyer may also set a
+// maximum price, which leaves out what costs more — a filter, not a ranking.
+const RANKING = 'Highest overall score first; between equal scores, free modules and then the cheapest come first.';
+
+// A module's current price row ({ price_cents, price_credits } or none) as the
+// catalog shows it. No row is free (isFreePrice, module-store.js); 0 in either
+// currency is free; null means not offered in that currency (core_257). Pure.
+function priceOf(row) {
+  const cents = row && row.price_cents != null ? Number(row.price_cents) : null;
+  const credits = row && row.price_credits != null ? Number(row.price_credits) : null;
+  return { cents, credits, free: !row || cents === 0 || credits === 0 };
+}
+
+// Within a buyer's maximum ({ cents, credits }, either may be null): a free module
+// always is; a priced one is when it is offered at or under a cap the buyer set. Pure.
+function withinMaxPrice(price, max) {
+  if (!max || (max.cents == null && max.credits == null)) return true;
+  if (price.free) return true;
+  return (max.cents != null && price.cents != null && price.cents <= max.cents)
+    || (max.credits != null && price.credits != null && price.credits <= max.credits);
+}
+
+// The default order of `listed`, per RANKING. Returns a new array. Pure.
+function rankListed(entries) {
+  const cheap = (n) => (n == null ? Infinity : n);
+  return [...entries].sort((a, b) => {
+    const pa = a.price || priceOf(null);
+    const pb = b.price || priceOf(null);
+    return ((b.overall ?? -1) - (a.overall ?? -1))
+      || (Number(pb.free) - Number(pa.free))
+      || (cheap(pa.cents) - cheap(pb.cents))
+      || (cheap(pa.credits) - cheap(pb.credits))
+      || a.key.localeCompare(b.key);
+  });
+}
+
 // The newest version row per module key, in semver order (a version that does not
 // parse is skipped, as latestVersions does in module-store.js).
 function newestPerModule(rows) {
@@ -140,13 +188,14 @@ function newestPerModule(rows) {
   return [...out.values()];
 }
 
-// The catalog: { floor, sort, sort_parts, listed: [...], new: [...] }, each entry
-// { key, title, version, published_at, overall, is_new, parts, strengths, weaknesses,
-// unmeasured } (the last four from readParts). Excluded versions are left
-// out entirely: a module below the bar is not listed at all. Both lists are in key
-// order unless `sort` names a part, which orders `listed` by sortByPart; ranking
-// is a separate task (1003808) and does not happen here.
-async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
+// The catalog: { floor, ranking, sort, sort_parts, max_price, listed: [...], new: [...] },
+// each entry { key, title, version, published_at, price, overall, is_new, parts,
+// strengths, weaknesses, unmeasured } (the last four from readParts). Excluded
+// versions are left out entirely: a module below the bar is not listed at all, and
+// neither is one over the buyer's `maxPrice`. `listed` is in rankListed order unless
+// `sort` names a part, which orders it by sortByPart; `new` is never ranked and
+// stays in key order.
+async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice = null } = {}) {
   const pool = db || require('./pool').pool;
   const { rows: versions } = await pool.query(
     `SELECT m.module_key, m.title, v.id AS version_id, v.version, v.published_at
@@ -162,6 +211,15 @@ async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
         ORDER BY version_id, computed_at DESC, id DESC`, [newest.map((r) => r.version_id)]);
     for (const s of rows) scores.set(String(s.version_id), s);
   }
+  const prices = new Map();
+  if (newest.length) {
+    const { rows } = await pool.query(
+      `SELECT DISTINCT ON (module_key) module_key, price_cents, price_credits
+         FROM store_module_prices
+        WHERE module_key = ANY($1)
+        ORDER BY module_key, set_at DESC, id DESC`, [newest.map((r) => r.module_key)]);
+    for (const p of rows) prices.set(p.module_key, p);
+  }
   // Each version's current result per part: the newest row per (version, part),
   // the read idx_module_assessment_signals_current exists for (core_265).
   const signals = new Map();
@@ -177,19 +235,26 @@ async function listCatalog({ db, floor = QUALITY_FLOOR, sort = null } = {}) {
       signals.get(k).push(s);
     }
   }
-  const out = { floor, sort: sort || null, sort_parts: SORT_PARTS, listed: [], new: [] };
+  const max = maxPrice && (maxPrice.cents != null || maxPrice.credits != null)
+    ? { cents: maxPrice.cents ?? null, credits: maxPrice.credits ?? null } : null;
+  const out = { floor, ranking: RANKING, sort: sort || null, sort_parts: SORT_PARTS, max_price: max, listed: [], new: [] };
   for (const r of newest.sort((a, b) => a.module_key.localeCompare(b.module_key))) {
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
     if (placement === 'excluded') continue;
+    const price = priceOf(prices.get(r.module_key));
+    if (!withinMaxPrice(price, max)) continue;
     out[placement].push({
-      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
+      key: r.module_key, title: r.title, version: r.version, published_at: r.published_at, price,
       overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
       ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });
   }
-  if (sort) out.listed = sortByPart(out.listed, sort);
+  out.listed = sort ? sortByPart(out.listed, sort) : rankListed(out.listed);
   return out;
 }
 
-module.exports = { QUALITY_FLOOR, STRONG_AT, SORT_PARTS, placeVersion, readParts, sortByPart, listCatalog };
+module.exports = {
+  QUALITY_FLOOR, STRONG_AT, SORT_PARTS, RANKING, placeVersion, readParts, sortByPart,
+  priceOf, withinMaxPrice, rankListed, listCatalog,
+};

package/src/bongos/routes/auth.js

@@ -697,6 +697,9 @@ module.exports = function buildAuthRouter() {
       return sendAuthNotConfigured(res);
     }
     const wantsRepos = req.query.repos === '1' || req.query.repos === 'true';
+    // ?switch=1 — sign in as a DIFFERENT GitHub account (task 1004789): show
+    // GitHub's account picker instead of re-using the one logged in there.
+    const wantsSwitch = req.query.switch === '1' || req.query.switch === 'true';
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
     // the canonical host (task 1004357). The handshake cookies are host-only now,
     // and the callback always lands on the canonical host, so a state cookie set
@@ -708,13 +711,14 @@ module.exports = function buildAuthRouter() {
       const back = raw.startsWith('/') ? `https://${host}${raw}` : raw;
       const params = new URLSearchParams({ return: back });
       if (wantsRepos) params.set('repos', '1');
+      if (wantsSwitch) params.set('switch', '1');
       return res.redirect(`${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/web/start?${params}`);
     }
     // Already signed in on the canonical host and headed for a satellite hub
     // host (a builder who signed in on the apex, then opened builders.): no
     // GitHub round-trip, just hand that host its copy. A repo-scope sign-in
     // still goes to GitHub — it exists to ask for the broader grant.
-    if (!wantsRepos) {
+    if (!wantsRepos && !wantsSwitch) {
       const target = safeReturnTo(req.query.return);
       if (target && !target.startsWith('/')) {
         try {
@@ -774,7 +778,7 @@ module.exports = function buildAuthRouter() {
     // way — the callback validates it identically, so the hub leg is CSRF-protected too.
     res.redirect(auth.idpConfigured()
       ? auth.buildIdpAuthorizeUrl(state, redirectUri)
-      : auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos }));
+      : auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos, switchAccount: wantsSwitch }));
   });
 
   // GET /auth/web/handoff?code=&return= — the far side of the one-time session

package/src/bongos/routes/modules.js

@@ -841,6 +841,9 @@ module.exports = function buildModulesRouter() {
   // is not listed at all. The floor is fixed in module-listing.js and returned here.
   // `?sort=<part>` orders the listed modules by the part a buyer cares about
   // (task 1003800, sortByPart); the parts it accepts come back as sort_parts.
+  // Without it the listed modules are ranked quality first, price breaking ties
+  // (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules
+  // that cost more.
   //
   // rank: any-builder — a read of public store metadata, like /store/modules/latest:
   // no entitlement taken, nothing changed.
@@ -852,7 +855,18 @@ module.exports = function buildModulesRouter() {
         const names = SORT_PARTS.map((p) => `${p.title} (${p.part})`).join(', ');
         return res.fail('bad_request', { status: 400, message: `The store can be sorted by one part of the score: ${names}.` });
       }
-      const listing = await listCatalog({ sort });
+      // An optional maximum price (task 1003808): ?max_cents= and/or ?max_credits=,
+      // each a whole number of at least 0. Free modules always pass.
+      const maxPrice = {};
+      for (const [param, field] of [['max_cents', 'cents'], ['max_credits', 'credits']]) {
+        const v = req.query && req.query[param];
+        if (v == null || v === '') continue;
+        if (typeof v !== 'string' || !/^\d{1,9}$/.test(v)) {
+          return res.fail('bad_request', { status: 400, message: `${param} is a maximum price: a whole number, 0 or more.` });
+        }
+        maxPrice[field] = Number(v);
+      }
+      const listing = await listCatalog({ sort, maxPrice });
       res.set('Cache-Control', 'no-store');
       res.json(listing);
     }));

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.171'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.173'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auth_switch_account.mjs

@@ -0,0 +1,38 @@
+// tests/auth_switch_account.mjs — the home page's "New account" door (task 1004789).
+//
+// WHY. GitHub silently re-uses whoever is logged in to github.com in the browser,
+// so a second Cloud Bongos account was unreachable. ?switch=1 on /auth/web/start
+// must add prompt=select_account (GitHub's account picker); a plain sign-in must not.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'test-secret';
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+
+test('switchAccount adds prompt=select_account; a plain sign-in does not', () => {
+  const plain = new URL(auth.buildAuthorizeUrl('s', 'https://x/cb'));
+  assert.equal(plain.searchParams.get('prompt'), null);
+  const sw = new URL(auth.buildAuthorizeUrl('s', 'https://x/cb', { switchAccount: true }));
+  assert.equal(sw.searchParams.get('prompt'), 'select_account');
+  assert.equal(sw.searchParams.get('scope'), plain.searchParams.get('scope'));
+});
+
+test('the start route reads ?switch=1 and passes it to the GitHub leg', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
+  assert.match(src, /const wantsSwitch = req\.query\.switch === '1'/);
+  assert.match(src, /switchAccount: wantsSwitch/);
+  // a switch must reach GitHub, never short-circuit through the live-session handoff
+  assert.match(src, /if \(!wantsRepos && !wantsSwitch\) \{/);
+});
+
+test('the landing carries the New account door beside Sign in', () => {
+  const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/index.html'), 'utf8');
+  assert.match(html, /<a class="pill newacct" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1&amp;switch=1"[^>]*>New account<\/a>/);
+});

package/tests/hall_studio_home.mjs

@@ -360,6 +360,30 @@ try {
     assert.ok(!s.html.classList.contains('st-open'));
   });
 
+  // task 1004670: the worst-pages report, through the real composer into the
+  // real Studio panel: the pages with the most text, most first.
+  await test('Most words to write: the worst-pages report, most text first, linked to the editor', async () => {
+    const T = (key, text) => ({ key, section: 's', text, placement: 'placed' });
+    const readings = { pages: INV.pages.map((p, i) => ({ id: p.id, reading_hash: `r${i}`, lines: Array.from({ length: i + 2 }, (_, k) => T(`L${k}`, `${p.id} line ${k}`)) })) };
+    const pagesWithReadings = ps.composePages({ inventory: INV, readings, tasks: TASKS });
+    assert.ok(pagesWithReadings.worst_pages.length >= 1);
+    const top = pagesWithReadings.worst_pages[0];
+    assert.equal(top.page_id, INV.pages[INV.pages.length - 1].id, 'the page with the most text leads');
+    const rows = lib.worstRows(pagesWithReadings);
+    assert.equal(rows[0].size, `${top.text_lines} lines of text`);
+    const s = bootStudio({ answers: { ...HOME, 'GET /copy-desk/pages': ok(pagesWithReadings) } });
+    await s.settle();
+    await s.click('st-status');
+    const body = s.el('st-panel-body').innerHTML;
+    assert.match(body, /Most words to write/);
+    assert.match(body, new RegExp(`${top.text_lines} lines of text`));
+    assert.match(body, new RegExp(`href="/builders/tweak-editor\\?page=${top.page_id}"`));
+    const plain = bootStudio({ answers: HOME });
+    await plain.settle();
+    await plain.click('st-status');
+    assert.doesNotMatch(plain.el('st-panel-body').innerHTML, /Most words to write/, 'no readings, no report');
+  });
+
   await test('the studio\'s words: a first click offers the studio page, and nothing is taken until the artist says so', async () => {
     const s = bootStudio({ answers: { ...HOME, 'GET /copy-desk/pages/builders:studio/draft': ok(studioRead({ held: false })) } });
     await s.settle();

package/tests/module_store_listing.mjs

@@ -15,9 +15,18 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
 // ---- the fake registry the route reads ----
-const state = { modules: {}, versions: [], scores: [], signals: [] };
+const state = { modules: {}, versions: [], scores: [], signals: [], prices: [] };
 const pool = {
   async query(sql, params = []) {
+    if (/FROM store_module_prices/.test(sql)) {
+      const newest = new Map();
+      for (const p of state.prices) {
+        if (!params[0].includes(p.module_key)) continue;
+        const have = newest.get(p.module_key);
+        if (!have || p.set_at > have.set_at) newest.set(p.module_key, p);
+      }
+      return { rows: [...newest.values()] };
+    }
     if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
       return {
         rows: state.versions
@@ -53,7 +62,7 @@ const poolPath = require.resolve('../src/bongos/pool.js');
 require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
 
 const buildModulesRouter = require('../src/bongos/routes/modules.js');
-const { QUALITY_FLOOR, SORT_PARTS, placeVersion, sortByPart } = require('../src/bongos/module-listing.js');
+const { QUALITY_FLOOR, SORT_PARTS, RANKING, placeVersion, sortByPart, priceOf, withinMaxPrice, rankListed } = require('../src/bongos/module-listing.js');
 
 function handlerFor(router, method, p) {
   const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
@@ -153,7 +162,7 @@ test('GET /store/modules: lists by the newest version\'s current score, drops wh
   assert.equal(res.statusCode, 200);
   assert.equal(res.headers['Cache-Control'], 'no-store');
   assert.equal(res.body.floor, 50);
-  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['fixed', '2.0.0', 60], ['good', '1.10.0', 80]]);
+  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['good', '1.10.0', 80], ['fixed', '2.0.0', 60]], 'highest score first');
   assert.deepEqual(res.body.new.map((m) => [m.key, m.is_new, m.overall]), [['fresh', true, null]]);
   const all = [...res.body.listed, ...res.body.new].map((m) => m.key);
   for (const k of ['low', 'unsafe', 'unscored', 'gone']) assert.ok(!all.includes(k), `${k} must not be listed`);
@@ -163,7 +172,7 @@ test('GET /store/modules: an empty store answers empty lists and the floor', asy
   state.modules = {}; state.versions = []; state.scores = [];
   const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
   const res = await invoke(handle, {});
-  assert.deepEqual(res.body, { floor: 50, sort: null, sort_parts: SORT_PARTS, listed: [], new: [] });
+  assert.deepEqual(res.body, { floor: 50, ranking: RANKING, sort: null, sort_parts: SORT_PARTS, max_price: null, listed: [], new: [] });
 });
 
 // ---------------------------------------------------------------------------
@@ -229,7 +238,7 @@ test('GET /store/modules?sort=: orders the listed modules by the part, leaves Ne
   assert.deepEqual(byTests.body.listed.map((m) => m.key), ['tested', 'steady']);
   const plain = await invoke(handle, { query: {} });
   assert.equal(plain.body.sort, null);
-  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is key order, as before');
+  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is the ranking: equal scores, both free, so key order');
   state.signals = [];
 });
 
@@ -307,3 +316,94 @@ test('the criterion: two modules with the same overall score read differently',
   assert.equal(by.steady.parts.reliability.score, 90);
   state.signals = [];
 });
+
+// ---------------------------------------------------------------------------
+// the ranking: quality first, price breaks ties, optional max price (task 1003808)
+// ---------------------------------------------------------------------------
+
+test('priceOf: no price row is free; 0 in either currency is free; null is not offered', () => {
+  assert.deepEqual(priceOf(null), { cents: null, credits: null, free: true });
+  assert.deepEqual(priceOf({ price_cents: 0, price_credits: null }), { cents: 0, credits: null, free: true });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: 0 }), { cents: 500, credits: 0, free: true });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: null }), { cents: 500, credits: null, free: false });
+});
+
+test('rankListed: a higher score always wins, whatever it costs — price never buys a place', () => {
+  const ranked = rankListed([
+    { key: 'cheap', overall: 70, price: priceOf(null) },
+    { key: 'dear', overall: 90, price: priceOf({ price_cents: 99900 }) },
+  ]);
+  assert.deepEqual(ranked.map((e) => e.key), ['dear', 'cheap']);
+});
+
+test('rankListed: between equal scores, free first, then lowest cash, then lowest credits, then key', () => {
+  const input = [
+    { key: 'z-credits', overall: 80, price: priceOf({ price_credits: 5 }) },
+    { key: 'cents-900', overall: 80, price: priceOf({ price_cents: 900 }) },
+    { key: 'cents-100', overall: 80, price: priceOf({ price_cents: 100 }) },
+    { key: 'b-free', overall: 80, price: priceOf(null) },
+    { key: 'a-free', overall: 80, price: priceOf({ price_cents: 0 }) },
+  ];
+  assert.deepEqual(rankListed(input).map((e) => e.key), ['a-free', 'b-free', 'cents-100', 'cents-900', 'z-credits']);
+  assert.equal(input[0].key, 'z-credits', 'the input is untouched');
+});
+
+test('withinMaxPrice: free always passes; a priced module must be offered at or under a cap the buyer set', () => {
+  const p = priceOf({ price_cents: 500, price_credits: 7 });
+  assert.equal(withinMaxPrice(p, null), true, 'no cap, no filter');
+  assert.equal(withinMaxPrice(p, { cents: 500, credits: null }), true, 'at the cap is in');
+  assert.equal(withinMaxPrice(p, { cents: 499, credits: null }), false);
+  assert.equal(withinMaxPrice(p, { cents: 1, credits: 7 }), true, 'either currency under its cap is enough');
+  assert.equal(withinMaxPrice(priceOf({ price_cents: 500 }), { cents: null, credits: 100 }), false, 'not offered in credits, so a credit cap cannot let it in');
+  assert.equal(withinMaxPrice(priceOf(null), { cents: 0, credits: null }), true);
+});
+
+test('GET /store/modules: ranks by score then price, and ?max_cents= leaves out what costs more', async () => {
+  state.modules = {
+    top: { status: 'listed', title: 'Top' }, 'tie-paid': { status: 'listed', title: 'Tie paid' },
+    'tie-free': { status: 'listed', title: 'Tie free' }, fresh: { status: 'listed', title: 'Fresh' },
+  };
+  state.versions = [
+    { id: 31, module_key: 'top', version: '1.0.0', published_at: 't' },
+    { id: 32, module_key: 'tie-paid', version: '1.0.0', published_at: 't' },
+    { id: 33, module_key: 'tie-free', version: '1.0.0', published_at: 't' },
+    { id: 34, module_key: 'fresh', version: '1.0.0', published_at: 't' },
+  ];
+  state.scores = [
+    { id: 31, version_id: 31, computed_at: 1, ...score({ overall: 92 }) },
+    { id: 32, version_id: 32, computed_at: 1, ...score({ overall: 75 }) },
+    { id: 33, version_id: 33, computed_at: 1, ...score({ overall: 75 }) },
+    { id: 34, version_id: 34, computed_at: 1, ...score({ is_new: true }) },
+  ];
+  state.signals = [];
+  state.prices = [
+    { module_key: 'top', price_cents: 2000, price_credits: null, set_at: 1 },
+    { module_key: 'tie-paid', price_cents: 900, price_credits: null, set_at: 1 },
+    { module_key: 'tie-paid', price_cents: 500, price_credits: null, set_at: 2 },
+    { module_key: 'fresh', price_cents: 3000, price_credits: null, set_at: 1 },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const all = await invoke(handle, { query: {} });
+  assert.equal(all.body.ranking, RANKING);
+  assert.deepEqual(all.body.listed.map((m) => m.key), ['top', 'tie-free', 'tie-paid']);
+  assert.deepEqual(all.body.listed.map((m) => m.price.cents), [2000, null, 500], 'the CURRENT price is shown');
+  assert.equal(all.body.max_price, null);
+
+  const capped = await invoke(handle, { query: { max_cents: '1000' } });
+  assert.deepEqual(capped.body.max_price, { cents: 1000, credits: null });
+  assert.deepEqual(capped.body.listed.map((m) => m.key), ['tie-free', 'tie-paid']);
+  assert.deepEqual(capped.body.new, [], 'the cap applies to New modules too');
+
+  const free = await invoke(handle, { query: { max_cents: '0' } });
+  assert.deepEqual(free.body.listed.map((m) => m.key), ['tie-free'], 'a cap of 0 is free only');
+  state.prices = [];
+});
+
+test('GET /store/modules: a maximum price that is not a whole number of 0 or more is refused', async () => {
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  for (const query of [{ max_cents: '-1' }, { max_cents: '5.5' }, { max_credits: 'ten' }, { max_cents: ['1', '2'] }]) {
+    const res = await invoke(handle, { query });
+    assert.equal(res.statusCode, 400, JSON.stringify(query));
+    assert.match(res.body.message, /maximum price/);
+  }
+});

package/tests/speciality_injection.mjs

@@ -105,3 +105,23 @@ test('the adoption read selects the contract itself', () => {
   // while still looking well-formed.
   assert.match(src('modules/specialities/db.js'), /SELECT s\.id, s\.slug, s\.name, s\.discipline, s\.summary, s\.contract_md/);
 });
+
+// task 1004817: two sessions, two worktrees, two claims in two crafts. Each
+// session gets ONLY the contract for the claim bound to its own worktree; the
+// account-wide pool is only the fallback when no claim is bound here.
+test('two claims in two worktrees: each session gets only its own contract', () => {
+  const claims = [
+    { ...claim('artist'), task_id: '1', worktree_name: 'task-1' },
+    { ...claim('engineer'), task_id: '2', worktree_name: 'task-2' },
+  ];
+  const specs = [
+    sp({ discipline: 'artist', contract: 'Speciality: Pixel art (under artist).' }),
+    sp({ discipline: 'engineer', contract: 'Speciality: Compilers (under engineer).' }),
+  ];
+  const got = (worktree) => ids(conductor.evaluateTriggers({ activeClaims: claims, specialities: specs, worktree }))
+    .filter((i) => String(i).startsWith('speciality:'));
+  assert.deepEqual(got('task-1'), ['speciality:artist']);
+  assert.deepEqual(got('task-2'), ['speciality:engineer']);
+  // No claim bound to this tree (main checkout): today's behaviour, every craft in play.
+  assert.deepEqual(got('main-checkout').sort(), ['speciality:artist', 'speciality:engineer']);
+});