@bongos/core 1.23.4 → 1.23.6

package/src/bongos/route-rank-check.js

@@ -250,9 +250,15 @@ const EXPECTED_RANKS = {
   // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
   // it for every instance, so it is pinned to its own atom.
   'POST /store/modules/:key/delist': 'perm:module.delist',
+  // Setting a store module's price (task 1004894) rides the publish atom; only the
+  // module's author passes the check inside the handler.
+  'POST /store/modules/:key/price': 'perm:module.submit',
   // Releasing a version the promotion gate held on tester (task 1003804) hands it to
   // every project; the owner put it on the delist atom (2026-10-23), so it is pinned.
   'POST /store/modules/:key/versions/:version/release': 'perm:module.delist',
+  // Withdrawing a version (task 1004895) stops it being handed to every project, the
+  // same reach as a delist, so it rides the delist atom and is pinned.
+  'POST /store/modules/:key/versions/:version/withdraw': 'perm:module.delist',
 };
 
 // The authz-core route pins (ADR 0174). Paths and the gating atom were renamed

package/src/bongos/routes/auth.js

@@ -828,19 +828,15 @@ module.exports = function buildAuthRouter() {
   // bounded the honest client, not an attacker. accountExistenceReadRateLimit
   // below is the ceiling — 120 reads/60s per IP, and the SAME instance is
   // mounted on the onboarding module's GET /access-requests/status, which is
-  // this route's strictly richer twin (member|invited|pending|dismissed|none
-  // plus its own `admitted`). One budget across both, because they are one
-  // oracle: hardening either alone would accomplish nothing, and giving each its
-  // own budget would just let an enumerator alternate for double the rate.
-  //
-  // WHAT IS STILL OPEN and is deliberately NOT decided here: whether the answer
-  // itself should collapse, so a caller who is not the subject cannot tell
-  // pending/dismissed/none apart from a bare "not admitted". That changes what a
-  // real invited user sees during onboarding, so it is the owner's call — filed
-  // as a blocker against task 1003339, not settled by a comment in this file.
+  // this route's strictly richer twin (member|invited|not_admitted plus its own
+  // `admitted`). One budget across both, because they are one oracle: hardening
+  // either alone would accomplish nothing, and giving each its own budget would
+  // just let an enumerator alternate for double the rate. That twin once told
+  // pending/declined/none apart too; it collapsed to `not_admitted` on the
+  // owner's call (ADR 0217 D4, task 1003359).
   //
   // That endpoint is also why this one exists: it models neither the firstAdmin
-  // bypass nor open enrollment, so it reports the OWNER as 'none' forever —
+  // bypass nor open enrollment, so it reports the OWNER as 'not_admitted' forever —
   // the exact case this page has to resolve.
   router.get('/auth/web/admission-status', accountExistenceReadRateLimit, async (req, res) => {
     const login = typeof req.query.login === 'string' ? req.query.login.slice(0, 100) : '';

package/src/bongos/routes/modules.js

@@ -97,7 +97,7 @@ const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } =
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet, migrateLegacyStore,
+  delistModule, delistedKeySet, setPrice, withdrawVersion, withdrawnVersions, migrateLegacyStore,
 } = require('../module-store');
 const {
   isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
@@ -272,6 +272,11 @@ module.exports = function buildModulesRouter() {
     let delistedKeys = new Set();
     try { delistedKeys = await delistedKeySet(all.filter((m) => m.source === 'instance').map((m) => m.key)); }
     catch (e) { log.warn({ err: e.message }, 'store status unreadable for the modules list'); }
+    // Which installed store modules run a version the store took back (task 1004895),
+    // so the row says so, with the reason. Same tolerance.
+    let withdrawn = {};
+    try { withdrawn = await withdrawnVersions(all.filter((m) => m.source === 'instance').map((m) => m.key)); }
+    catch (e) { log.warn({ err: e.message }, 'withdrawn versions unreadable for the modules list'); }
     for (const m of all) {
       m.enabled_source = sources[m.key] || 'default';
       m.override = byKey.has(m.key)
@@ -283,6 +288,9 @@ module.exports = function buildModulesRouter() {
         ? `/builders/modules?howto=${encodeURIComponent(m.key)}&version=${encodeURIComponent(String(m.version))}`
         : null;
       m.store_delisted = m.source === 'instance' && delistedKeys.has(m.key);
+      const taken = m.source === 'instance' && m.version
+        ? (withdrawn[m.key] || []).find((w) => w.version === String(m.version)) : null;
+      m.store_withdrawn = taken ? { version: taken.version, note: taken.note } : null;
       // what of this module still waits for a restart to match its toggle (task 1004463)
       m.restart_pending = restartPendingFor(m.key, m.enabled === true);
     }
@@ -567,6 +575,37 @@ module.exports = function buildModulesRouter() {
       res.status(202).json({ ok: true, queued: true, module_key: key, version, version_id: r.version.id });
     }));
 
+  // POST /api/bongos/store/modules/:key/price — the module's author sets its price
+  // (task 1004894, criterion wa5-module-economy). Body: { cents?, credits? }, each a
+  // whole number of 0 or more, or null for "not offered in that currency"; at least
+  // one is given, and 0 in either is free. Appends a row to the price history; the
+  // newest is what the catalog shows and what acquire charges. A paid price may be
+  // set before buying exists (owner, 2026-10-26): the catalog marks it not yet
+  // buyable. Price never moves the score (ADR 0343 D6). The audit middleware records
+  // who changed it and to what.
+  //
+  // rank: metic+archon — the same gate as publishing (module.submit), plus the
+  // author check inside setPrice: only the person who published the module prices it.
+  router.post('/store/modules/:key/price', auth.requireBuilder, auth.requirePermission('module.submit'),
+    asyncHandler('POST /store/modules/:key/price', async (req, res) => {
+      const AMOUNT = { type: 'integer', min: 0, max: 100000000 };
+      if (validateOrRespond(req, res, { cents: AMOUNT, credits: AMOUNT })) return;
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const body = req.body || {};
+      const cents = body.cents ?? null;
+      const credits = body.credits ?? null;
+      if (cents === null && credits === null) {
+        return res.fail('bad_price', { status: 400, message: 'Give a price in cents, credits or both. 0 in either makes the module free.' });
+      }
+      const out = await setPrice({ key, cents, credits, builderId: req.builder.id });
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      log.info({ key, builderId: req.builder.id, cents, credits }, `${key} price set`);
+      res.json({ ok: true, module_key: key, previous: out.previous, price: out.price });
+    }));
+
   // POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out
   // of the store (task 1003797, ADR 0338 D2). It leaves the catalog, cannot be newly
   // acquired, takes no new versions and serves no further downloads: every store
@@ -637,6 +676,35 @@ module.exports = function buildModulesRouter() {
       res.json({ ok: true, module_key: key, version, channel: out.channel, reason: out.reason });
     }));
 
+  // POST /api/bongos/store/modules/:key/versions/:version/withdraw — a Metic+ person
+  // takes one version back (task 1004895, criterion wa5-staged-rollout). The store
+  // stops handing it out: acquire, install, update and the update check skip it, and
+  // the newest version still served is offered instead. A project that already runs
+  // it keeps it, and `bongos upgrade` and the hall's Modules tab tell it the version
+  // was withdrawn, with the reason. Withdrawing the only served version is allowed;
+  // acquire then says nothing can be handed out. A reason is required: it is kept on
+  // the channel row (core_281) and shown to holders, and the audit middleware also
+  // records it with who asked. The permission is module.delist, the one that already
+  // guards delist and release.
+  router.post('/store/modules/:key/versions/:version/withdraw', auth.requireBuilder, auth.requirePermission('module.delist'),
+    asyncHandler('POST /store/modules/:key/versions/:version/withdraw', async (req, res) => {
+      if (validateOrRespond(req, res, { reason: { type: 'string', maxLength: 2000 } })) return;
+      const { key, version } = req.params;
+      if (!KEY_RE.test(key) || !parseVersion(version)) {
+        return res.fail('bad_request', { status: 400, message: 'A module key is lowercase kebab-case and a version is exact X.Y.Z.' });
+      }
+      const reason = String(req.body?.reason || '').trim();
+      if (!reason) {
+        return res.fail('reason_required', { status: 400, message: 'Say why this version is being taken back, in reason. Projects that already run it keep it.' });
+      }
+      const r = await resolveReadable(key, version);
+      if (!r.ok) return res.fail(r.code, { status: r.status, message: r.message });
+      const out = await withdrawVersion(r.version.id, req.builder.id, reason);
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      log.info({ versionId: r.version.id, builderId: req.builder.id, reason }, `${key} ${version} withdrawn from the store`);
+      res.json({ ok: true, module_key: key, version, channel: out.channel, reason });
+    }));
+
   // GET /api/bongos/store/entitlements and /store/modules/:key/entitlement — the
   // read side of the entitlement record (task 1003813, ADR 0338 D1). Own-scoped
   // like /me/sessions: the holder is ALWAYS the caller (holder_kind 'builder',
@@ -832,9 +900,14 @@ module.exports = function buildModulesRouter() {
       if (!keys.length || keys.length > STORE_LATEST_MAX_KEYS || !keys.every((k) => KEY_RE.test(k))) {
         return res.fail('bad_request', { status: 400, message: `keys is a comma-separated list of 1 to ${STORE_LATEST_MAX_KEYS} module keys (lowercase kebab-case).` });
       }
-      const latest = await latestVersions(keys, { channelsFor: await projectChannels() });
+      // Which of these keys have versions taken back (task 1004895), so a project
+      // running one is told, with the reason; a key with none is absent.
+      const [latest, withdrawn] = await Promise.all([
+        latestVersions(keys, { channelsFor: await projectChannels() }),
+        withdrawnVersions(keys),
+      ]);
       res.set('Cache-Control', 'no-store');
-      res.json({ latest });
+      res.json({ latest, withdrawn });
     }));
 
   // The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.4'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.6'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/account_existence_rate_limit.mjs

@@ -3,7 +3,7 @@
 //
 // The hole this pins shut: two PUBLIC routes answer "does this GitHub login have
 // an account here?" — the onboarding module's GET /access-requests/status (the
-// rich member|invited|pending|dismissed|none) and core's
+// richer member|invited|not_admitted) and core's
 // GET /auth/web/admission-status (its boolean twin) — and neither was throttled.
 // The global limiter returns early for non-write methods, so every GET bypassed
 // it. Scripted at line rate, either route turns a list of GitHub usernames into a
@@ -220,8 +220,12 @@ await t('under the ceiling both probes still answer truthfully — this is a cap
   assert.deepEqual(member.body, { github_login: 'ada', status: 'member', admitted: true });
   const invited = await call(RICH('bo'), ip);
   assert.equal(invited.body.status, 'invited');
-  const stranger = await call(RICH('zzz'), ip);
-  assert.equal(stranger.body.status, 'none');
+  // task 1003359 (ADR 0217 D4): a stranger, a pending applicant and a declined one
+  // get the same body, so the probe says nothing about who applied here.
+  for (const login of ['zzz', 'cy', 'dez']) {
+    const r = await call(RICH(login), ip);
+    assert.deepEqual(r.body, { github_login: login, status: 'not_admitted', admitted: false }, login);
+  }
   const bool = await call(BOOL('ada'), ip);
   assert.deepEqual(bool.body, { admitted: true });
   assert.equal((await call(BOOL('zzz'), ip)).body.admitted, false);

package/tests/application_lifecycle.mjs

@@ -1087,17 +1087,18 @@ test('expiry: another sender re-inviting the login retires your expired line fro
   assert.deepEqual(theirs.json.invites.map((x) => [x.github_login, x.expired]), [['fay', false]]);
 });
 
-test('expiry: the public status probe says expired, and an expired invitee may apply', async () => {
+test('expiry: the public status probe says not_admitted, and an expired invitee may apply', async () => {
   reset();
   builders.push(...ARCHONS);
   await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
   age(rows.find((x) => x.github_login === 'fay'), 31);
   const st = await call('GET', '/api/gds/access-requests/status?github_login=fay');
-  assert.deepEqual(st.json, { github_login: 'fay', status: 'expired', admitted: false });
+  // task 1003359 (ADR 0217 D4): a lapsed invite is not told apart from no request at all
+  assert.deepEqual(st.json, { github_login: 'fay', status: 'not_admitted', admitted: false });
   const asked = await call('POST', '/api/gds/access-requests', { github_login: 'fay' });
   assert.equal(asked.status, 201, 'not already_approved: an expired invite is not an approval');
   const st2 = await call('GET', '/api/gds/access-requests/status?github_login=fay');
-  assert.equal(st2.json.status, 'pending', 'the newer request is what the probe reports');
+  assert.deepEqual(st2.json, { github_login: 'fay', status: 'not_admitted', admitted: false }, 'nor is a pending request');
 });
 
 test('expiry: rescinding the last live invite clears the hub notice even though an expired one remains', async () => {

package/tests/bongos_login.mjs

@@ -13,7 +13,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const { normalizeInstanceBase, pollDecision } = require('../scripts/bongos/login.js');
+const { normalizeInstanceBase, pollDecision, waitTimeoutMessage } = require('../scripts/bongos/login.js');
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'bongos', 'login.js');
 
 test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/bongos', () => {
@@ -38,15 +38,26 @@ test('pollDecision maps the /access-requests/status body to a loop action', () =
   assert.equal(pollDecision({ admitted: true, status: 'invited' }), 'admitted');
   assert.equal(pollDecision({ status: 'invited' }), 'admitted');
   assert.equal(pollDecision({ status: 'member', admitted: true }), 'admitted');
-  assert.equal(pollDecision({ status: 'dismissed' }), 'dismissed');
-  // task 1002969: an invite past its 30 days stops the loop rather than waiting on a shut door
-  assert.equal(pollDecision({ status: 'expired', admitted: false }), 'expired');
+  // task 1003359 (ADR 0217 D4): the probe answers only admitted or not, so the loop
+  // cannot tell a decline or a lapsed invite from a wait — nor can an older
+  // instance's richer answer make it claim to.
+  assert.equal(pollDecision({ status: 'not_admitted', admitted: false }), 'wait');
+  assert.equal(pollDecision({ status: 'dismissed' }), 'wait');
+  assert.equal(pollDecision({ status: 'expired', admitted: false }), 'wait');
   assert.equal(pollDecision({ status: 'pending', admitted: false }), 'wait');
   assert.equal(pollDecision({ status: 'none' }), 'wait');
   assert.equal(pollDecision(null), 'wait');
   assert.equal(pollDecision({}), 'wait');
 });
 
+test('giving up on the wait promises no approval and names who to ask', () => {
+  const msg = waitTimeoutMessage('https://x.example');
+  assert.doesNotMatch(msg, /once an Archon has approved/i, 'a declined person must not be told an approval is coming');
+  assert.match(msg, /waiting longer won.t change/i);
+  assert.match(msg, /owner/i);
+  assert.match(msg, /bongos login https:\/\/x\.example/);
+});
+
 // ---- the Device-Flow dead end (task 1003881) -------------------------------
 //
 // Device Flow is OFF on every GitHub App created from a manifest and GitHub offers no

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{categoryFact\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}\$\{restartFact\(m\)\}<\/div>/, 'provenance, (task 1003784) the category, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill and (task 1004463) the waits-for-a-restart pill are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{categoryFact\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}\$\{withdrawnFact\(m\)\}\$\{restartFact\(m\)\}<\/div>/, 'provenance, (task 1003784) the category, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill, (task 1004895) the withdrawn pill and (task 1004463) the waits-for-a-restart pill are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');

package/tests/invite_expiry_db.mjs

@@ -141,7 +141,7 @@ try {
     'and says when each invite closes; an application has no such day');
 
   const probe = (await call('GET', '/api/gds/access-requests/status?github_login=fay')).json;
-  ok(probe.status === 'expired' && probe.admitted === false, 'the status probe reports expired, not invited');
+  ok(probe.status === 'not_admitted' && probe.admitted === false, 'the status probe reports not_admitted, not invited (ADR 0217 D4)');
 
   notices = [];
   const again = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });

package/tests/module_store_cli.mjs

@@ -158,7 +158,7 @@ test('the text view keeps the API order: listed ranked, then New, and says the f
   assert.equal(at('stripe-10'), -1, 'the eleventh is not shown');
   assert.match(text, /stripe-00@1\.0\.0 {2}99\/100 {2}free {2}Money › Stripe payments/);
   assert.match(text, /stripe-01@1\.0\.0 {2}98\/100 {2}\$9\.00/);
-  assert.match(text, /loose@1\.0\.0 {2}88\/100 {2}40 credits$/m, 'no category, no place');
+  assert.match(text, /loose@1\.0\.0 {2}88\/100 {2}40 credits \(not yet buyable\)$/m, 'no category, no place; paid is not yet buyable (task 1004894)');
   assert.match(text, /waiting@1\.0\.0 {2}60\/100 {2}free {2}Money$/m, 'a proposed sub-category shows its parent only');
   assert.match(text, /New — not ranked[\s\S]*fresh@1\.0\.0/);
 });

package/tests/module_store_price.mjs

@@ -0,0 +1,207 @@
+// tests/module_store_price.mjs — a store module's author sets its price (task
+// 1004894, criterion wa5-module-economy). Drives the real POST
+// /store/modules/:key/price handler off the real router, the real setPrice and
+// isFreePrice behind it, the real catalog read, and `bongos module price`, against a
+// stand-in pool that keeps the price history (no port, no real DB — the
+// module_store_delist.mjs harness).
+//
+// Run:  node tests/module_store_price.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const fresh = () => ({
+  modules: {
+    weather: { module_key: 'weather', title: 'Weather', author_id: 42, status: 'listed' },
+    gone: { module_key: 'gone', title: 'Gone', author_id: 42, status: 'delisted' },
+  },
+  prices: [],
+  setAt: 0,
+});
+let state = fresh();
+const newestPrice = (key) => state.prices.filter((p) => p.module_key === key).at(-1) || null;
+const query = async (sql, params = []) => {
+  if (/^INSERT INTO store_module_prices/.test(sql)) {
+    const [module_key, price_cents, price_credits, set_by] = params;
+    state.prices.push({ module_key, price_cents, price_credits, set_by, set_at: ++state.setAt });
+    return { rows: [] };
+  }
+  if (/FROM store_module_prices\s+WHERE module_key = \$1/.test(sql)) {
+    const p = newestPrice(params[0]); return { rows: p ? [p] : [] };
+  }
+  if (/FROM store_module_prices\s+WHERE module_key = ANY/.test(sql)) {
+    return { rows: params[0].map(newestPrice).filter(Boolean) };
+  }
+  if (/FROM store_modules WHERE module_key = \$1/.test(sql)) {
+    const m = state.modules[params[0]]; return { rows: m ? [m] : [] };
+  }
+  if (/FROM store_module_versions WHERE module_key = \$1/.test(sql)) {
+    return { rows: [{ id: 1, module_key: params[0], version: '1.0.0', channel: 'general' }] };
+  }
+  if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
+    return { rows: [{ module_key: 'weather', title: 'Weather', version_id: 1, version: '1.0.0', published_at: 't' }] };
+  }
+  if (/FROM module_assessment_scores/.test(sql)) {
+    return { rows: [{ version_id: 1, overall: 80, security_passed: true, is_new: false }] };
+  }
+  return { rows: [] };
+};
+const pool = { connect: async () => ({ query, release() {} }), query };
+const poolPath = require.resolve('../src/bongos/pool.js');
+require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool } };
+
+const store = require('../src/bongos/module-store.js');
+const listing = require('../src/bongos/module-listing.js');
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+const mod = require('../scripts/bongos/module.js');
+
+const PRICE = '/store/modules/:key/price';
+function handlerFor() {
+  const layer = buildModulesRouter().stack.find((l) => l.route && l.route.path === PRICE && l.route.methods.post);
+  assert.ok(layer, `no POST ${PRICE} on the router`);
+  const stack = layer.route.stack;
+  return { handle: stack[stack.length - 1].handle, depth: stack.length };
+}
+async function setPrice(body, { key = 'weather', builderId = 42 } = {}) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    set() { return this; },
+    fail(code, opts, details) {
+      const o = typeof opts === 'number' ? { status: opts, details } : (opts || {});
+      this.statusCode = o.status; this.body = { error: { code, message: o.message } }; return this;
+    },
+  };
+  let nextErr = null;
+  await handlerFor().handle({ params: { key }, body, builder: { id: builderId } }, res, (err) => { nextErr = err; });
+  if (nextErr) throw nextErr;
+  return res;
+}
+
+test('the route rides the publish atom and is pinned', () => {
+  assert.ok(handlerFor().depth >= 3, 'requireBuilder + requirePermission sit in front of the handler');
+  const rank = fs.readFileSync(path.join(ROOT, 'src/bongos/route-rank-check.js'), 'utf8');
+  assert.match(rank, /'POST \/store\/modules\/:key\/price': 'perm:module\.submit'/);
+});
+
+test('only the author may set the price; a stranger and a delisted module are refused', async () => {
+  state = fresh();
+  const stranger = await setPrice({ cents: 500 }, { builderId: 7 });
+  assert.equal(stranger.statusCode, 403);
+  assert.equal(stranger.body.error.code, 'not_module_author');
+  const gone = await setPrice({ cents: 500 }, { key: 'gone' });
+  assert.equal(gone.statusCode, 409);
+  const missing = await setPrice({ cents: 500 }, { key: 'nope' });
+  assert.equal(missing.statusCode, 404);
+  assert.equal(state.prices.length, 0, 'nothing was written');
+});
+
+test('a price must be whole numbers of 0 or more, and name at least one currency', async () => {
+  state = fresh();
+  for (const body of [{}, { cents: null, credits: null }, { cents: -1 }, { cents: 1.5 }, { credits: '10' }, { cents: 1e12 }]) {
+    const r = await setPrice(body);
+    assert.equal(r.statusCode, 400, JSON.stringify(body));
+    assert.ok(['bad_price', 'validation_failed'].includes(r.body.error.code), r.body.error.code);
+  }
+  assert.equal(state.prices.length, 0);
+});
+
+test('each change appends a row naming who set it, and the newest is what acquire reads', async () => {
+  state = fresh();
+  const first = await setPrice({ cents: 900 });
+  assert.equal(first.statusCode, 200);
+  assert.deepEqual(first.body, { ok: true, module_key: 'weather', previous: null, price: { cents: 900, credits: null } });
+  const second = await setPrice({ cents: 500, credits: 40 });
+  assert.deepEqual(second.body.previous, { cents: 900, credits: null });
+  assert.equal(state.prices.length, 2, 'the history is kept');
+  assert.equal(state.prices[1].set_by, 42);
+  const acq = await store.resolveAcquirable('weather', {});
+  assert.equal(acq.ok, true);
+  assert.deepEqual([acq.price.price_cents, acq.price.price_credits], [500, 40]);
+  assert.equal(acq.free, false);
+  await setPrice({ credits: 0 });
+  assert.equal((await store.resolveAcquirable('weather', {})).free, true, '0 in either currency is free');
+});
+
+test('the catalog shows the price, and marks a paid module not yet buyable until buying opens', async () => {
+  state = fresh();
+  let cat = await listing.listCatalog({});
+  assert.equal(cat.listed[0].price.free, true);
+  assert.equal(cat.listed[0].buyable, true, 'a free module can be had today');
+  await setPrice({ cents: 900 });
+  cat = await listing.listCatalog({});
+  assert.deepEqual(cat.listed[0].price, { cents: 900, credits: null, free: false });
+  assert.equal(cat.listed[0].buyable, false, 'buying arrives with task 1003788');
+});
+
+test('bongos module price: sends the price, says what it was and now is, and that paid is not yet buyable', async () => {
+  const sent = [];
+  const request = async (method, url, opts) => {
+    sent.push({ method, url, json: opts && opts.json });
+    return { ok: true, status: 200, data: { ok: true, previous: { cents: 0, credits: null }, price: { cents: 900, credits: 40 } } };
+  };
+  const out = [];
+  assert.equal(await mod.cmdPrice(['weather', '--cents', '900', '--credits', '40'], { log: (l) => out.push(l), errlog: () => {}, request }), 0);
+  assert.deepEqual(sent, [{ method: 'POST', url: '/store/modules/weather/price', json: { cents: 900, credits: 40 } }]);
+  assert.match(out.join('\n'), /"weather" now costs \$9\.00 or 40 credits \(was free\)/);
+  assert.match(out.join('\n'), /not yet buyable/);
+});
+
+test('bongos module price: refuses no key, no amount and a non-number before asking the store', async () => {
+  const request = async () => { throw new Error('must not be called'); };
+  for (const args of [[], ['--cents', '5'], ['weather'], ['weather', '--cents', 'five'], ['weather', '--credits', '-3']]) {
+    const errs = [];
+    assert.equal(await mod.cmdPrice(args, { log: () => {}, errlog: (l) => errs.push(l), request }), 2, args.join(' '));
+    assert.match(errs.join('\n'), /usage: bongos module price/);
+  }
+});
+
+test('bongos module price: the store refusing is reported, not swallowed', async () => {
+  const errs = [];
+  const request = async () => ({ ok: false, status: 403, data: { error: { code: 'not_module_author', message: 'Only the author of "weather" may set its price.' } } });
+  assert.equal(await mod.cmdPrice(['weather', '--cents', '100'], { log: () => {}, errlog: (l) => errs.push(l), request }), 1);
+  assert.match(errs.join('\n'), /Only the author of "weather" may set its price/);
+});
+
+test('the price history is the audit: who set each price and when, and what it replaced', async () => {
+  state = fresh();
+  await setPrice({ cents: 900 });
+  await setPrice({ cents: 500 }, { builderId: 42 });
+  const rows = state.prices.filter((r) => r.module_key === 'weather');
+  assert.deepEqual(rows.map((r) => [r.price_cents, r.set_by]), [[900, 42], [500, 42]], 'every change is a row naming who set it');
+  assert.ok(rows[1].set_at > rows[0].set_at, 'in order, so the row before is what it changed from');
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/module-store.js'), 'utf8');
+  assert.match(src, /FROM store_modules WHERE module_key = \$1 FOR UPDATE/, 'one transaction, the module row locked');
+});
+
+test('bongos module publish --cents/--credits sets the price after the upload, and checks it before packing', async () => {
+  const packed = { tgz: Buffer.from('x'), sidecar: { module_version: '1.0.0', core_version: '^1.0.0', file_count: 1, tree_sha256: 'a'.repeat(64), tarball: { name: 'x.tgz' } } };
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'publish-price-'));
+  fs.mkdirSync(path.join(dir, 'weather'));
+  const artifact = require('../scripts/bongos/module-artifact.js');
+  fs.writeFileSync(path.join(dir, 'weather', artifact.HOWTO_FILE), artifact.HOWTO_SECTIONS.map((h) => `## ${h}\n\nText.\n`).join('\n'));
+  const sent = [];
+  const priceRequest = async (method, url, opts) => { sent.push([method, url, opts.json]); return { ok: true, status: 200, data: { previous: null, price: opts.json } }; };
+  const upload = async () => ({ ok: true, status: 201, data: { version: { version: '1.0.0' }, channel: 'tester' } });
+  const out = [];
+  const code = await mod.cmdPublish(['--cents', '900', 'weather'], { log: (l) => out.push(l), errlog: (l) => out.push(l), modulesDir: dir, pack: () => packed, upload, priceRequest });
+  assert.equal(code, 0, out.join('\n'));
+  assert.deepEqual(sent, [['POST', '/store/modules/weather/price', { cents: 900, credits: null }]], 'the key is found even after a valued flag');
+  let packedAtAll = false;
+  const bad = await mod.cmdPublish(['weather', '--cents', 'nine'], { log: () => {}, errlog: () => {}, modulesDir: dir, pack: () => { packedAtAll = true; return packed; }, upload, priceRequest });
+  assert.equal(bad, 2);
+  assert.equal(packedAtAll, false, 'a bad price refuses before anything is packed or sent');
+  const failing = async () => ({ ok: false, status: 403, data: { error: { message: 'Only the author' } } });
+  const errs = [];
+  assert.equal(await mod.cmdPublish(['weather', '--credits', '40'], { log: () => {}, errlog: (l) => errs.push(l), modulesDir: dir, pack: () => packed, upload, priceRequest: failing }), 1);
+  assert.match(errs.join('\n'), /The version is published, but its price was not set\. Run `bongos module price weather --credits 40`/);
+});