@bongos/core 1.23.4 → 1.23.6

package/scripts/bongos/module-store-cli.js

@@ -0,0 +1,182 @@
+'use strict';
+//
+// scripts/bongos/module-store-cli.js — the module STORE from the terminal: the store
+// client every store verb calls, and `bongos module store` / `bongos module price`
+// (tasks 1003811, 1004894). Carved out of scripts/bongos/module.js, which requires
+// and re-exports all of it, so `bongos module <verb>` and every importer are
+// unchanged.
+//
+// WHY its own file. module.js crossed the 1,500-line ratchet (fitness.js) when the
+// price command landed, and these pieces share one concern — talking to the store —
+// while the rest of module.js works on the checkout's own modules/ tree.
+//
+// Like module.js it may be required by the server process, so cli-lib's
+// session/fetch plumbing is required lazily inside storeRequest, never at load.
+
+const { KEY_RE } = require('../../src/module-loader/manifest-schema');
+
+// The store half of the CLI, over three calls (src/bongos/routes/modules.js):
+// acquire (take the entitlement, learn the version), download the tarball, and
+// once the files are placed, record the version acquired. Injected in tests.
+function storeRequest() {
+  // Lazy require — cli-lib's session/fetch plumbing must never load in the server
+  // process, which requires this file too (the same reason cmdPublish gives).
+  const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
+  const session = readSessionToken();
+  if (!session) throw new Error('no Bongos session — run `bongos setup` first');
+  const call = async (method, urlPath, { json, binary = false } = {}) => {
+    const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${session.token}`, 'User-Agent': CLI_USER_AGENT,
+        ...(json ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: json ? JSON.stringify(json) : undefined,
+      dispatcher: noKeepAliveDispatcher(),
+    });
+    if (binary && res.ok) return { ok: true, status: res.status, buf: Buffer.from(await res.arrayBuffer()) };
+    const text = await res.text();
+    let data;
+    try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
+    return { ok: res.ok, status: res.status, data };
+  };
+  // Where the store lives, so install can print a full link to the how-to page.
+  call.apiBase = session.apiBase;
+  return call;
+}
+
+// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
+// opened on one version. null when the version shipped without one (published
+// before ADR 0347's gate), so install never prints a link that would 404.
+function howtoLink(key, version, files, apiBase) {
+  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
+  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
+  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
+}
+
+function storeError(res) {
+  const err = res.data && (res.data.error || res.data);
+  return (err && (err.message || err.code)) || `HTTP ${res.status}`;
+}
+
+// ---------------------------------------------------------------------------
+// bongos module store — what the store lists (task 1003811)
+// ---------------------------------------------------------------------------
+
+const STORE_USAGE = 'usage: bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]';
+
+// The query GET /store/modules takes, from argv. Returns { query } or { error }.
+// The server checks the values too; this only refuses what is not a value at all.
+function storeQuery(args) {
+  const params = [];
+  for (const [flag, param] of [['--sort', 'sort'], ['--max-cents', 'max_cents'], ['--max-credits', 'max_credits']]) {
+    const i = args.indexOf(flag);
+    if (i === -1) continue;
+    const v = args[i + 1];
+    if (!v || v.startsWith('--')) return { error: `${flag} needs a value` };
+    params.push(`${param}=${encodeURIComponent(v)}`);
+  }
+  return { query: params.length ? `?${params.join('&')}` : '' };
+}
+
+function formatPrice(price) {
+  if (!price || price.free) return 'free';
+  const parts = [];
+  if (price.cents != null) parts.push(`$${(price.cents / 100).toFixed(2)}`);
+  if (price.credits != null) parts.push(`${price.credits} credits`);
+  return parts.join(' or ') || 'free';
+}
+
+function formatPlace(category) {
+  if (!category) return '';
+  return category.label ? `${category.parent_title} › ${category.label}` : category.parent_title;
+}
+
+// Pure renderer over the GET /store/modules body. It keeps the server's order and
+// adds nothing to it: listed in rank, then New, never ranked.
+function formatStore(body) {
+  const out = [];
+  out.push('bongos module store — what the store lists, best first');
+  out.push(`  floor ${body.floor} out of 100 · at most ${body.cap} per sub-category`);
+  out.push(`  ${body.ranking}`);
+  if (body.sort) {
+    const part = (body.sort_parts || []).find((x) => x.part === body.sort);
+    out.push(`  sorted by ${part ? part.title : body.sort}`);
+  }
+  const max = body.max_price;
+  if (max) out.push(`  at most ${[max.cents != null ? `$${(max.cents / 100).toFixed(2)}` : null, max.credits != null ? `${max.credits} credits` : null].filter(Boolean).join(' or ')}`);
+  out.push('');
+  const listed = body.listed || [];
+  if (!listed.length) out.push('  Nothing is listed yet.');
+  listed.forEach((m, i) => {
+    out.push(`  ${String(i + 1).padStart(2)}. ${m.key}@${m.version}  ${m.overall}/100  ${formatPrice(m.price)}${m.buyable === false ? ' (not yet buyable)' : ''}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
+  });
+  const fresh = body.new || [];
+  if (fresh.length) {
+    out.push('');
+    out.push('  New — not ranked until projects have installed and used them:');
+    for (const m of fresh) out.push(`      ${m.key}@${m.version}  ${formatPrice(m.price)}${m.buyable === false ? ' (not yet buyable)' : ''}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
+  }
+  out.push('');
+  out.push('  Why a module is not here: GET /store/modules/<key>/listing');
+  return out.join('\n');
+}
+
+async function cmdStore(args, { log = console.log, errlog = console.error, request } = {}) {
+  const q = storeQuery(args);
+  if (q.error) { errlog(`bongos module store: ${q.error}`); errlog(STORE_USAGE); return 2; }
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module store: ${e.message}`); return 1; }
+  let res;
+  try { res = await call('GET', `/store/modules${q.query}`); }
+  catch (e) { errlog(`bongos module store: the store could not be reached — ${e.message}`); return 1; }
+  if (!res.ok) { errlog(`bongos module store: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
+  if (args.includes('--json')) { log(JSON.stringify(res.data, null, 2)); return 0; }
+  log(formatStore(res.data || {}));
+  return 0;
+}
+
+// ---------------------------------------------------------------------------
+// bongos module price — the author sets a module's price (task 1004894)
+// ---------------------------------------------------------------------------
+
+const PRICE_USAGE = 'usage: bongos module price <key> [--cents N] [--credits N]   (0 in either makes it free)';
+
+// argv -> { key, cents, credits } or { error }. Pure.
+function priceArgs(args) {
+  const key = args[0];
+  if (!key || key.startsWith('--') || !KEY_RE.test(key)) return { error: 'name the module: a lowercase kebab-case key' };
+  const out = { key, cents: null, credits: null };
+  for (const [flag, field] of [['--cents', 'cents'], ['--credits', 'credits']]) {
+    const i = args.indexOf(flag);
+    if (i === -1) continue;
+    const v = args[i + 1];
+    if (!v || !/^\d{1,9}$/.test(v)) return { error: `${flag} needs a whole number, 0 or more` };
+    out[field] = Number(v);
+  }
+  if (out.cents === null && out.credits === null) return { error: 'give --cents, --credits or both' };
+  return out;
+}
+
+async function cmdPrice(args, { log = console.log, errlog = console.error, request } = {}) {
+  const p = priceArgs(args);
+  if (p.error) { errlog(`bongos module price: ${p.error}`); errlog(PRICE_USAGE); return 2; }
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module price: ${e.message}`); return 1; }
+  let res;
+  try { res = await call('POST', `/store/modules/${encodeURIComponent(p.key)}/price`, { json: { cents: p.cents, credits: p.credits } }); }
+  catch (e) { errlog(`bongos module price: the store could not be reached — ${e.message}`); return 1; }
+  if (!res.ok) { errlog(`bongos module price: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
+  const withFree = (p) => ({ ...p, free: p.cents === 0 || p.credits === 0 });
+  const shown = formatPrice(withFree(res.data.price));
+  const was = res.data.previous ? formatPrice(withFree(res.data.previous)) : 'free (no price set)';
+  log(`✓ "${p.key}" now costs ${shown} (was ${was}).`);
+  if (shown !== 'free') log('  Buying is not open yet, so the store lists it as not yet buyable until it is.');
+  return 0;
+}
+
+module.exports = {
+  storeRequest, storeError, howtoLink, formatStore, cmdStore, priceArgs, cmdPrice,
+};

package/scripts/bongos/module.js

@@ -39,6 +39,12 @@
 //     sub-category live in one place (src/bongos/module-listing.js), so the hall
 //     and the terminal cannot disagree about which modules are the best.
 //
+//   bongos module price <key> [--cents N] [--credits N]
+//     Task 1004894 — the module's author sets its price in the store, in money
+//     (cents), credits or both; 0 in either makes it free. The store keeps every
+//     change and shows the newest. A paid module is listed as not yet buyable until
+//     buying arrives (task 1003788).
+//
 //   bongos module check <key>
 //     ADR 0107 §4 — the submit-time pre-check a module must clear before it can
 //     be upstreamed into the shared core catalog. REUSES (never re-types) the
@@ -82,6 +88,8 @@ const { validateManifest, assertValidManifest, KEY_RE, SUNSET_STATUSES } = requi
 const { parseVersion, cmp } = require('../../src/module-loader/semver');
 const loader = require('../../src/module-loader/loader');
 const catalog = require('../../src/module-loader/catalog');
+// The store client and the `store` / `price` verbs (task 1004894 carve).
+const { storeRequest, storeError, howtoLink, formatStore, cmdStore, priceArgs, cmdPrice } = require('./module-store-cli');
 const { resolveModules, MODULE_REGISTRY, NEUTRAL_PATH, INSTANCE_PATH } = require('../../src/modules');
 // The public-mirror publish boundary (ADR 0098) — REUSED, never re-typed, for
 // the ADR 0107 §4 upstreaming pre-check. Only matchesDeny is used (not the full
@@ -712,7 +720,7 @@ async function gatherUpdates(rows, { request } = {}) {
   // A 404 here is a server whose core predates this route, not a missing module.
   if (res.status === 404) return { checked: false, reason: "this server's store does not answer update checks yet (its core is older)" };
   if (!res.ok) return { checked: false, reason: `the store answered ${storeError(res)}` };
-  return { checked: true, latest: (res.data && res.data.latest) || {} };
+  return { checked: true, latest: (res.data && res.data.latest) || {}, withdrawn: (res.data && res.data.withdrawn) || {} };
 }
 
 // Decide what is stale from rows + the store's answer (pure — tests drive it).
@@ -722,13 +730,22 @@ async function gatherUpdates(rows, { request } = {}) {
 // installed module the store has delisted: it keeps working, but no further
 // versions will come (ADR 0338 D2). Neither ever blocks — an update is news, and
 // what blocks `bongos upgrade` is still only an incompatible ENABLED module.
-function evaluateUpdates(rows = [], latest = {}, core) {
+function evaluateUpdates(rows = [], latest = {}, core, withdrawnByKey = {}) {
   const { satisfies } = require('../../src/module-loader/semver');
   const updates = [];
   const delisted = [];
+  const withdrawn = [];
   for (const r of rows) {
     const store = latest[r.key];
     const have = r.version && parseVersion(String(r.version));
+    // WITHDRAWN (task 1004895) = the store took back the exact version installed
+    // here. It keeps working; the update below, when there is one, is the way off it.
+    const taken = have && (withdrawnByKey[r.key] || [])
+      .map((w) => (typeof w === 'string' ? { version: w, note: null } : w))
+      .find((w) => w && w.version === String(r.version));
+    if (taken) {
+      withdrawn.push({ key: r.key, installed: r.version, latest: store ? store.version : null, enabled: r.enabled, note: taken.note || null });
+    }
     if (!store || !have) continue;
     if (store.status === 'delisted') { delisted.push({ key: r.key, installed: r.version, enabled: r.enabled }); continue; }
     const next = parseVersion(String(store.version));
@@ -737,7 +754,7 @@ function evaluateUpdates(rows = [], latest = {}, core) {
     try { fits = !!(core && store.core_version && satisfies(core, store.core_version)); } catch { fits = false; }
     updates.push({ key: r.key, installed: r.version, latest: store.version, coreVersion: store.core_version, enabled: r.enabled, fits });
   }
-  return { updates, delisted };
+  return { updates, delisted, withdrawn };
 }
 
 function reportUpdates(found, verdict, { log, errlog }) {
@@ -746,7 +763,7 @@ function reportUpdates(found, verdict, { log, errlog }) {
     log(`  not checked — ${found.reason}. The compatibility check above still stands.`);
     return;
   }
-  const { updates, delisted } = evaluateUpdates(verdict.rows, found.latest, verdict.core);
+  const { updates, delisted, withdrawn } = evaluateUpdates(verdict.rows, found.latest, verdict.core, found.withdrawn);
   for (const u of updates) {
     const how = u.fits
       ? `run \`bongos module update ${u.key}\``
@@ -756,7 +773,17 @@ function reportUpdates(found, verdict, { log, errlog }) {
   for (const d of delisted) {
     errlog(`  ! ${d.key.padEnd(18)} ${d.installed}  — delisted in the store: it keeps working, but no further versions will come`);
   }
-  if (!updates.length && !delisted.length) log('  every installed store module is on its newest version.');
+  for (const w of withdrawn) {
+    // Update only moves forward, so an OLDER served version is no way off it: until a
+    // fixed version is published, say so rather than name a command that refuses.
+    const newer = w.latest && parseVersion(String(w.latest))
+      && cmp(parseVersion(String(w.latest)), parseVersion(String(w.installed))) > 0;
+    const next = newer
+      ? `move to ${w.latest} with \`bongos module update ${w.key}\``
+      : 'no newer version is out yet; `bongos upgrade` will offer the fix once one is published';
+    errlog(`  ! ${w.key.padEnd(18)} ${w.installed}  — withdrawn in the store${w.note ? ` (${w.note})` : ''}: it keeps working here, but ${next}`);
+  }
+  if (!updates.length && !delisted.length && !withdrawn.length) log('  every installed store module is on its newest version.');
 }
 
 async function cmdUpgrade(args = [], { log = console.log, errlog = console.error, gather = gatherUpgrade, checkUpdates = gatherUpdates } = {}) {
@@ -939,18 +966,31 @@ async function cmdSubmit(args, {
 // Distinct from `submit`, which proposes a module INTO core (ADR 0135).
 async function cmdPublish(args, {
   log = console.log, errlog = console.error,
-  modulesDir = MODULES_DIR, pack, upload, writeFile = fs.writeFileSync,
+  modulesDir = MODULES_DIR, pack, upload, writeFile = fs.writeFileSync, priceRequest,
 } = {}) {
-  const key = args.find((a, i) => !a.startsWith('-') && args[i - 1] !== '--out');
+  const PUBLISH_USAGE = 'usage: bongos module publish <key> [--dry-run] [--out <dir>] [--cents N] [--credits N]';
+  const VALUED = new Set(['--out', '--cents', '--credits']);
+  const key = args.find((a, i) => !a.startsWith('-') && !VALUED.has(args[i - 1]));
   if (!key) {
-    errlog('usage: bongos module publish <key> [--dry-run] [--out <dir>]');
+    errlog(PUBLISH_USAGE);
     return 2;
   }
+  // An optional price set right after the upload (task 1004894), with the same rules
+  // as `bongos module price`, checked BEFORE anything is packed or sent.
+  const priceFlags = [];
+  for (const flag of ['--cents', '--credits']) {
+    const i = args.indexOf(flag);
+    if (i !== -1) priceFlags.push(flag, args[i + 1]);
+  }
+  if (priceFlags.length) {
+    const p = priceArgs([key, ...priceFlags]);
+    if (p.error) { errlog(`bongos module publish: ${p.error}`); errlog(PUBLISH_USAGE); return 2; }
+  }
   const dryRun = args.includes('--dry-run');
   const outIdx = args.indexOf('--out');
   const outDir = outIdx !== -1 ? args[outIdx + 1] : null;
   if (outIdx !== -1 && (!outDir || outDir.startsWith('--'))) {
-    errlog('usage: bongos module publish <key> [--dry-run] [--out <dir>]');
+    errlog(PUBLISH_USAGE);
     return 2;
   }
 
@@ -1018,135 +1058,18 @@ async function cmdPublish(args, {
   if (res.data && res.data.channel === 'tester') {
     log('  It goes to testing projects first, and reaches every project once it has been tested (ADR 0344).');
   }
-  return 0;
+  if (!priceFlags.length) return 0;
+  // The version is published whatever happens next; a price that fails is reported
+  // with the one command that sets it, and the exit code says something needs doing.
+  const priced = await cmdPrice([key, ...priceFlags], { log, errlog, request: priceRequest });
+  if (priced !== 0) errlog(`  The version is published, but its price was not set. Run \`bongos module price ${key} ${priceFlags.join(' ')}\` to set it.`);
+  return priced === 0 ? 0 : 1;
 }
 
 // ---------------------------------------------------------------------------
 // bongos module install <key> — acquire a module from the store (ADR 0338 D1)
 // ---------------------------------------------------------------------------
 
-// The store half of the CLI, over three calls (src/bongos/routes/modules.js):
-// acquire (take the entitlement, learn the version), download the tarball, and
-// once the files are placed, record the version acquired. Injected in tests.
-function storeRequest() {
-  // Lazy require — cli-lib's session/fetch plumbing must never load in the server
-  // process, which requires this file too (the same reason cmdPublish gives).
-  const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
-  const session = readSessionToken();
-  if (!session) throw new Error('no Bongos session — run `bongos setup` first');
-  const call = async (method, urlPath, { json, binary = false } = {}) => {
-    const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${session.token}`, 'User-Agent': CLI_USER_AGENT,
-        ...(json ? { 'Content-Type': 'application/json' } : {}),
-      },
-      body: json ? JSON.stringify(json) : undefined,
-      dispatcher: noKeepAliveDispatcher(),
-    });
-    if (binary && res.ok) return { ok: true, status: res.status, buf: Buffer.from(await res.arrayBuffer()) };
-    const text = await res.text();
-    let data;
-    try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
-    return { ok: res.ok, status: res.status, data };
-  };
-  // Where the store lives, so install can print a full link to the how-to page.
-  call.apiBase = session.apiBase;
-  return call;
-}
-
-// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
-// opened on one version. null when the version shipped without one (published
-// before ADR 0347's gate), so install never prints a link that would 404.
-function howtoLink(key, version, files, apiBase) {
-  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
-  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
-  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
-}
-
-function storeError(res) {
-  const err = res.data && (res.data.error || res.data);
-  return (err && (err.message || err.code)) || `HTTP ${res.status}`;
-}
-
-// ---------------------------------------------------------------------------
-// bongos module store — what the store lists (task 1003811)
-// ---------------------------------------------------------------------------
-
-const STORE_USAGE = 'usage: bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]';
-
-// The query GET /store/modules takes, from argv. Returns { query } or { error }.
-// The server checks the values too; this only refuses what is not a value at all.
-function storeQuery(args) {
-  const params = [];
-  for (const [flag, param] of [['--sort', 'sort'], ['--max-cents', 'max_cents'], ['--max-credits', 'max_credits']]) {
-    const i = args.indexOf(flag);
-    if (i === -1) continue;
-    const v = args[i + 1];
-    if (!v || v.startsWith('--')) return { error: `${flag} needs a value` };
-    params.push(`${param}=${encodeURIComponent(v)}`);
-  }
-  return { query: params.length ? `?${params.join('&')}` : '' };
-}
-
-function formatPrice(price) {
-  if (!price || price.free) return 'free';
-  const parts = [];
-  if (price.cents != null) parts.push(`$${(price.cents / 100).toFixed(2)}`);
-  if (price.credits != null) parts.push(`${price.credits} credits`);
-  return parts.join(' or ') || 'free';
-}
-
-function formatPlace(category) {
-  if (!category) return '';
-  return category.label ? `${category.parent_title} › ${category.label}` : category.parent_title;
-}
-
-// Pure renderer over the GET /store/modules body. It keeps the server's order and
-// adds nothing to it: listed in rank, then New, never ranked.
-function formatStore(body) {
-  const out = [];
-  out.push('bongos module store — what the store lists, best first');
-  out.push(`  floor ${body.floor} out of 100 · at most ${body.cap} per sub-category`);
-  out.push(`  ${body.ranking}`);
-  if (body.sort) {
-    const part = (body.sort_parts || []).find((x) => x.part === body.sort);
-    out.push(`  sorted by ${part ? part.title : body.sort}`);
-  }
-  const max = body.max_price;
-  if (max) out.push(`  at most ${[max.cents != null ? `$${(max.cents / 100).toFixed(2)}` : null, max.credits != null ? `${max.credits} credits` : null].filter(Boolean).join(' or ')}`);
-  out.push('');
-  const listed = body.listed || [];
-  if (!listed.length) out.push('  Nothing is listed yet.');
-  listed.forEach((m, i) => {
-    out.push(`  ${String(i + 1).padStart(2)}. ${m.key}@${m.version}  ${m.overall}/100  ${formatPrice(m.price)}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
-  });
-  const fresh = body.new || [];
-  if (fresh.length) {
-    out.push('');
-    out.push('  New — not ranked until projects have installed and used them:');
-    for (const m of fresh) out.push(`      ${m.key}@${m.version}  ${formatPrice(m.price)}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
-  }
-  out.push('');
-  out.push('  Why a module is not here: GET /store/modules/<key>/listing');
-  return out.join('\n');
-}
-
-async function cmdStore(args, { log = console.log, errlog = console.error, request } = {}) {
-  const q = storeQuery(args);
-  if (q.error) { errlog(`bongos module store: ${q.error}`); errlog(STORE_USAGE); return 2; }
-  let call;
-  try { call = request || storeRequest(); }
-  catch (e) { errlog(`bongos module store: ${e.message}`); return 1; }
-  let res;
-  try { res = await call('GET', `/store/modules${q.query}`); }
-  catch (e) { errlog(`bongos module store: the store could not be reached — ${e.message}`); return 1; }
-  if (!res.ok) { errlog(`bongos module store: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
-  if (args.includes('--json')) { log(JSON.stringify(res.data, null, 2)); return 0; }
-  log(formatStore(res.data || {}));
-  return 0;
-}
-
 // Where install places a module: the INSTANCE's own modules/ root (ADR 0108 §1),
 // which the loader discovers. In a single checkout that is this repo's modules/.
 function instanceModulesDir() {
@@ -1408,13 +1331,15 @@ function printHelp(out = console.log) {
   out('                              Browse the module catalog — what you can enable, with author + origin credit');
   out('  bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]');
   out('                              What the store lists, best first: above the quality floor, ranked, ten per sub-category');
+  out('  bongos module price <key> [--cents N] [--credits N]');
+  out('                              Set your module\'s price in the store (0 in either makes it free)');
   out('  bongos upgrade [--no-store] Pre-check enabled modules against the core version (fail-closed),');
   out('                              then list newer store versions of installed modules (never blocks)');
   out('  bongos module check <key> [--sign-off "Name <email>"]');
   out('                              AGPL/publish pre-check before upstreaming + record a DCO-style sign-off');
   out('  bongos module submit <key> [--sign-off "Name <email>"]');
   out('                              Pre-check + sign-off, then file into the rank-gated upstreaming review queue');
-  out('  bongos module publish <key> [--dry-run] [--out <dir>]');
+  out('  bongos module publish <key> [--dry-run] [--out <dir>] [--cents N] [--credits N]');
   out('                              Pack a module version (tarball + hash manifest) and upload it to the module store');
   out('  bongos module install <key> [--version X.Y.Z]');
   out('                              Acquire a module from the store, verify it and place it under modules/ (not enabled)');
@@ -1428,6 +1353,7 @@ async function main(argv) {
   if (sub === 'new') return cmdNew(args.slice(1));
   if (sub === 'list' || sub === 'ls') return cmdList(args.slice(1));
   if (sub === 'store') return cmdStore(args.slice(1));
+  if (sub === 'price') return cmdPrice(args.slice(1));
   if (sub === 'upgrade') return cmdUpgrade(args.slice(1));
   if (sub === 'check') return cmdCheck(args.slice(1));
   if (sub === 'submit') return cmdSubmit(args.slice(1));
@@ -1444,7 +1370,7 @@ async function main(argv) {
 }
 
 module.exports = {
-  main, cmdNew, cmdList, cmdStore, formatStore, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
+  main, cmdNew, cmdList, cmdStore, formatStore, cmdPrice, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
   storeRequest,
   gatherCatalog, formatCatalog, ownProjectName,
   scaffoldModule, gatherUpgrade, evaluateUpgrade, gatherUpdates, evaluateUpdates, buildManifest,

package/scripts/gds/module-store-cli.js

@@ -0,0 +1,6 @@
+// scripts/gds/module-store-cli.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/module-store-cli.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'module-store-cli.js');

package/src/bongos/auth-admission.js

@@ -373,9 +373,9 @@ function firstTimeAdmissionBlocked({ existing, approved, login }) {
 // existing request-access page rather than a spinner that never resolves.
 //
 // NB the onboarding module's public GET /access-requests/status (used by the
-// CLI) reports member|invited|pending|none but knows nothing about the
-// firstAdmin bypass or open enrollment — so it reports the OWNER as 'none'
-// forever. That is exactly why this auth-domain probe exists.
+// CLI) reports member|invited|not_admitted but knows nothing about the
+// firstAdmin bypass or open enrollment — so it reports the OWNER as
+// 'not_admitted' forever. That is exactly why this auth-domain probe exists.
 async function webAdmissionStatus(login) {
   const name = String(login || '').trim();
   if (!name) return { admitted: false, expectedSoon: false };

package/src/bongos/middleware/rate-limit.js

@@ -38,7 +38,7 @@
 //                            by BOTH routes that answer "does this GitHub login
 //                            have an account here?": the onboarding module's
 //                            GET /access-requests/status (the richer
-//                            member|invited|pending|dismissed|none) and core's
+//                            member|invited|not_admitted) and core's
 //                            GET /auth/web/admission-status (its boolean twin).
 //                            Task 1003339 / ADR 0209. They are ONE oracle read
 //                            two ways, so they share one budget — give each its

package/src/bongos/module-listing.js

@@ -152,6 +152,15 @@ function priceOf(row) {
   return { cents, credits, free: !row || cents === 0 || credits === 0 };
 }
 
+// Whether a module can be bought today. Buying arrives with task 1003788 (area 8's
+// wallet); until then only a free module can be had, and a paid one is listed with
+// its price and marked not yet buyable (owner, 2026-10-26). Flip BUYING_OPEN when
+// the buy action ships, and nothing else needs to change. Pure.
+const BUYING_OPEN = false;
+function buyableNow(price) {
+  return !!(price && (price.free || BUYING_OPEN));
+}
+
 // Within a buyer's maximum ({ cents, credits }, either may be null): a free module
 // always is; a priced one is when it is offered at or under a cap the buyer set. Pure.
 function withinMaxPrice(price, max) {
@@ -228,7 +237,7 @@ function newestPerModule(rows) {
 }
 
 // The catalog: { floor, cap, ranking, sort, sort_parts, max_price, listed: [...], new: [...] },
-// each entry { key, title, version, published_at, price, category, overall, is_new,
+// each entry { key, title, version, published_at, price, buyable, category, overall, is_new,
 // parts, strengths, weaknesses, unmeasured } (the last four from readParts). Excluded
 // versions are left out entirely: a module below the bar is not listed at all, nor
 // is one past the cap of its sub-category, nor one over the buyer's `maxPrice`.
@@ -291,9 +300,10 @@ async function buildCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice =
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
     if (placement === 'excluded') continue;
+    const price = priceOf(prices.get(r.module_key));
     out[placement].push({
       key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
-      price: priceOf(prices.get(r.module_key)), category: categoryOf(cats.get(r.module_key)),
+      price, category: categoryOf(cats.get(r.module_key)), buyable: buyableNow(price),
       overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
       ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });

package/src/bongos/module-store.js

@@ -383,6 +383,95 @@ async function latestVersions(keys, { db, channelsFor = null } = {}) {
   return out;
 }
 
+// Set a module's price (task 1004894, criterion wa5-module-economy). Only its
+// author may, and a delisted module takes no new price (it can no longer be
+// acquired). The price is a HISTORY: each change appends a row and the newest is
+// current, which is what the catalog (module-listing.js priceOf) and acquire
+// (isFreePrice above) already read. `cents` / `credits`: a whole number of 0 or
+// more, or null for "not offered in that currency"; at least one must be given
+// (core_257's CHECK), and 0 in either is free. A paid price may be set before
+// buying exists (owner, 2026-10-26): the module is listed with it and marked not yet
+// buyable, and acquire keeps refusing it without an entitlement. Price is never an
+// input to the score (ADR 0343 D6). The history IS the audit of price changes:
+// every row names who set it and when, and the row before it is what it changed
+// from (the audit middleware also logs the request). One transaction, the module row
+// locked FOR UPDATE as publishVersion does, so two changes at once each report the
+// price they really replaced. Returns { ok: true, previous, price } (each
+// { cents, credits } or null) or { ok: false, status, code, message }.
+async function setPrice({ key, cents = null, credits = null, builderId }, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const refuse = (status, code, message) => ({ ok: false, status, code, message });
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows: [mod] } = await client.query(
+      'SELECT module_key, author_id, status FROM store_modules WHERE module_key = $1 FOR UPDATE', [key]);
+    let out;
+    if (!mod) out = refuse(404, 'module_not_found', `The store has no module "${key}".`);
+    else if (String(mod.author_id) !== String(builderId)) out = refuse(403, 'not_module_author', `Only the author of "${key}" may set its price.`);
+    else if (mod.status === 'delisted') out = refuse(409, 'module_delisted', `"${key}" is delisted: it takes no new price.`);
+    if (out) { await client.query('ROLLBACK'); return out; }
+    const { rows: [prev] } = await client.query(
+      `SELECT price_cents, price_credits FROM store_module_prices
+        WHERE module_key = $1 ORDER BY set_at DESC, id DESC LIMIT 1`, [key]);
+    await client.query(
+      'INSERT INTO store_module_prices (module_key, price_cents, price_credits, set_by) VALUES ($1, $2, $3, $4)',
+      [key, cents, credits, builderId]);
+    await client.query('COMMIT');
+    return {
+      ok: true,
+      previous: prev ? { cents: prev.price_cents, credits: prev.price_credits } : null,
+      price: { cents, credits },
+    };
+  } catch (e) {
+    try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
+// Withdraw one version (task 1004895, criterion wa5-staged-rollout): the store
+// stops handing it out. Staged rollout catches a bad version on the tester channel;
+// this is the way back once one has reached general. It is one channel row,
+// 'withdrawn' (core_276), which servedChannels never serves, so acquire, install,
+// update and the update check all stop offering it with no other change. Like a
+// delist it reaches nothing a project already holds: an installed copy keeps
+// working (ADR 0338 D2), and `bongos upgrade` and the hall tell its holder, with
+// `note` — the reason the person gave, kept on the row (core_281). The insert only
+// lands while the version is not already withdrawn, so two people withdrawing at
+// once write one row. Returns { ok: true, channel } or { ok: false, status, code, message }.
+const WITHDRAWN_CHANNEL = 'withdrawn';
+
+async function withdrawVersion(versionId, builderId, note, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const { rowCount } = await pool.query(
+    `INSERT INTO store_module_version_channels (version_id, channel, reason, set_by, note)
+     SELECT $1, '${WITHDRAWN_CHANNEL}', 'withdrawn_by_person', $2, $3
+      WHERE (SELECT c.channel FROM store_module_version_channels c
+              WHERE c.version_id = $1 ORDER BY c.set_at DESC, c.id DESC LIMIT 1)
+            IS DISTINCT FROM '${WITHDRAWN_CHANNEL}'`, [versionId, builderId, note]);
+  if (rowCount === 1) return { ok: true, channel: WITHDRAWN_CHANNEL };
+  return { ok: false, status: 409, code: 'already_withdrawn', message: 'This version is already withdrawn: the store does not hand it out.' };
+}
+
+// Which versions of these module keys are withdrawn, as { key: [{ version, note }] }
+// — so the update check and the hall can tell a project that the version it runs
+// was taken back, and why. `note` is the reason from the withdrawing row.
+async function withdrawnVersions(keys, { db } = {}) {
+  if (!keys.length) return {};
+  const pool = db || require('./pool').pool;
+  const { rows } = await pool.query(
+    `SELECT v.module_key, v.version,
+            (SELECT c.note FROM store_module_version_channels c
+              WHERE c.version_id = v.id ORDER BY c.set_at DESC, c.id DESC LIMIT 1) AS note
+       FROM store_module_versions v
+      WHERE v.module_key = ANY($1) AND ${currentChannelSql('v.id')} = '${WITHDRAWN_CHANNEL}'`, [keys]);
+  const out = {};
+  for (const r of rows) (out[r.module_key] = out[r.module_key] || []).push({ version: r.version, note: r.note || null });
+  return out;
+}
+
 // Delist a module (task 1003797, ADR 0338 D2): it leaves the catalog, takes no new
 // acquisitions or versions, and serves no further downloads — every read above
 // already refuses on status 'delisted', so this one UPDATE is the whole act. It
@@ -427,5 +516,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   isFreePrice, servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet, storeDir, storeDirFor, migrateLegacyStore,
+  delistModule, delistedKeySet, setPrice, withdrawVersion, withdrawnVersions, storeDir, storeDirFor, migrateLegacyStore,
 };