@bongos/core 1.23.5 → 1.23.6

package/modules/onboarding/routes/access-requests.js

@@ -357,9 +357,12 @@ module.exports = function buildAccessRequestsRouter() {
   // (the device_code is spent), so the CLI can't re-poll the flow — it polls this
   // instead, then restarts sign-in once admitted. Exposes nothing the public POST
   // above doesn't already reveal through its 409s (already_member / already_approved).
-  // status ∈ member | invited | expired | pending | dismissed | none; admitted =
-  // member||invited. `expired` is an invite past its 30 days (task 1002969): the door
-  // is shut, and the CLI stops waiting rather than polling a door that will not open.
+  // status ∈ member | invited | not_admitted; admitted = member||invited (ADR 0217 D4,
+  // task 1003359). `not_admitted` covers pending, declined, a lapsed invite and no
+  // request at all, so a caller who is not the subject cannot learn that someone
+  // applied here or was turned down. It does NOT close the membership oracle —
+  // `admitted` still answers that, and the limiter below is what bounds enumeration.
+  // A lapsed invite answering `not_admitted` rather than `expired` amends ADR 0356 D4.
   // rank: public — a would-be builder is by definition outside the system.
   // Declared BEFORE `GET /access-requests` so the literal `/status` path is matched
   // as its own route (not swallowed as a query on the list route).
@@ -370,9 +373,7 @@ module.exports = function buildAccessRequestsRouter() {
   // per-IP budget: core's GET /auth/web/admission-status (the boolean twin of
   // this answer) mounts the very same instance, so the two cannot be alternated
   // for double the rate. The limiter runs before the queries, so a refused probe
-  // costs no DB work. Whether the ANSWER should also collapse — so a caller who
-  // is not the subject cannot tell pending/dismissed/none apart — is the owner's
-  // call and is filed as a blocker, not decided here.
+  // costs no DB work.
   router.get('/access-requests/status', accountExistenceReadRateLimit, async (req, res) => {
     const login = normalizeLogin(req.query.github_login);
     if (!GITHUB_LOGIN_RE.test(login)) {
@@ -386,7 +387,7 @@ module.exports = function buildAccessRequestsRouter() {
       if (member.rows.length > 0) {
         return res.json({ github_login: login, status: 'member', admitted: true });
       }
-      // Prefer an invite that still admits, else the most recent request.
+      // A live invite sorts first, so the top row admits only if it is one.
       const ar = await pool.query(
         `SELECT status, (status = 'invited' AND ${inviteExpiredSql()}) AS expired
            FROM access_requests
@@ -396,8 +397,8 @@ module.exports = function buildAccessRequestsRouter() {
         [login]
       );
       const top = ar.rows[0];
-      const status = !top ? 'none' : top.expired ? 'expired' : top.status;
-      return res.json({ github_login: login, status, admitted: status === 'invited' });
+      const invited = !!top && top.status === 'invited' && !top.expired;
+      return res.json({ github_login: login, status: invited ? 'invited' : 'not_admitted', admitted: invited });
     } catch (err) {
       console.error('[gds] GET /access-requests/status', err);
       return res.fail('status_failed', { status: 500, message: 'internal error' });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.5",
+  "version": "1.23.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.23.5",
+      "version": "1.23.6",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.23.5",
+  "version": "1.23.6",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10413,5 +10413,15 @@
       "id": "1004895",
       "text": "A broken module version can now be pulled back from the store, so new installs and updates stop getting it while projects that already have it are told."
     }
+  ],
+  "1.23.6": [
+    {
+      "id": "1004894",
+      "text": "Module authors can now set a price for their module, in money or credits; paid modules show their price and are marked not yet buyable until buying opens."
+    },
+    {
+      "id": "1003359",
+      "text": "People checking whether someone has applied to a project can no longer tell a pending, declined or never-filed request apart, and the sign-in tool no longer promises an approval that may never come."
+    }
   ]
 }

package/scripts/bongos/login.js

@@ -43,17 +43,24 @@ function normalizeInstanceBase(raw) {
   return s;
 }
 
-// Decide what an /access-requests/status poll means for the sign-in loop.
+// Decide what an /access-requests/status poll means for the sign-in loop. The probe
+// answers only admitted or not (ADR 0217 D4), so anything else is a wait — even an
+// older instance's `dismissed`/`expired`, which the loop no longer reads.
 function pollDecision(body) {
   if (!body || typeof body !== 'object') return 'wait';
   if (body.admitted === true) return 'admitted';
   if (body.status === 'member' || body.status === 'invited') return 'admitted';
-  if (body.status === 'dismissed') return 'dismissed';
-  // An invite past its 30 days (task 1002969): the door is shut until they invite again.
-  if (body.status === 'expired') return 'expired';
   return 'wait';
 }
 
+// What the loop says when it stops waiting. It cannot know whether the request is
+// still pending, was declined, or rode a lapsed invite, so it promises nothing.
+function waitTimeoutMessage(base) {
+  return "✖ Stopped waiting after 30 minutes — you haven't been let in yet. If your request was turned down "
+    + "or your invite has run out, waiting longer won't change that. Ask the project's owner, "
+    + `then re-run \`bongos login ${base}\`.`;
+}
+
 // --- I/O helpers -------------------------------------------------------------
 
 async function fetchJson(url, opts = {}) {
@@ -300,16 +307,8 @@ async function main() {
         log('\n  ✓ Approved! Finishing sign-in — approve once more in your browser.');
         break;
       }
-      if (decision === 'dismissed') {
-        console.error('\n✖ your access request was declined.');
-        process.exit(1);
-      }
-      if (decision === 'expired') {
-        console.error('\n✖ your invite has expired — ask the project to invite you again.');
-        process.exit(1);
-      }
       if (Date.now() > admitDeadline) {
-        console.error('\n✖ timed out waiting for approval — re-run `bongos login` once an Archon has approved you.');
+        console.error(`\n${waitTimeoutMessage(base)}`);
         process.exit(1);
       }
       process.stdout.write('.');
@@ -357,4 +356,4 @@ if (require.main === module) {
   });
 }
 
-module.exports = { normalizeInstanceBase, pollDecision, runDeviceFlow, logOtherInstances };
+module.exports = { normalizeInstanceBase, pollDecision, waitTimeoutMessage, runDeviceFlow, logOtherInstances };

package/scripts/bongos/module-store-cli.js

@@ -0,0 +1,182 @@
+'use strict';
+//
+// scripts/bongos/module-store-cli.js — the module STORE from the terminal: the store
+// client every store verb calls, and `bongos module store` / `bongos module price`
+// (tasks 1003811, 1004894). Carved out of scripts/bongos/module.js, which requires
+// and re-exports all of it, so `bongos module <verb>` and every importer are
+// unchanged.
+//
+// WHY its own file. module.js crossed the 1,500-line ratchet (fitness.js) when the
+// price command landed, and these pieces share one concern — talking to the store —
+// while the rest of module.js works on the checkout's own modules/ tree.
+//
+// Like module.js it may be required by the server process, so cli-lib's
+// session/fetch plumbing is required lazily inside storeRequest, never at load.
+
+const { KEY_RE } = require('../../src/module-loader/manifest-schema');
+
+// The store half of the CLI, over three calls (src/bongos/routes/modules.js):
+// acquire (take the entitlement, learn the version), download the tarball, and
+// once the files are placed, record the version acquired. Injected in tests.
+function storeRequest() {
+  // Lazy require — cli-lib's session/fetch plumbing must never load in the server
+  // process, which requires this file too (the same reason cmdPublish gives).
+  const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
+  const session = readSessionToken();
+  if (!session) throw new Error('no Bongos session — run `bongos setup` first');
+  const call = async (method, urlPath, { json, binary = false } = {}) => {
+    const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
+      method,
+      headers: {
+        Authorization: `Bearer ${session.token}`, 'User-Agent': CLI_USER_AGENT,
+        ...(json ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: json ? JSON.stringify(json) : undefined,
+      dispatcher: noKeepAliveDispatcher(),
+    });
+    if (binary && res.ok) return { ok: true, status: res.status, buf: Buffer.from(await res.arrayBuffer()) };
+    const text = await res.text();
+    let data;
+    try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
+    return { ok: res.ok, status: res.status, data };
+  };
+  // Where the store lives, so install can print a full link to the how-to page.
+  call.apiBase = session.apiBase;
+  return call;
+}
+
+// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
+// opened on one version. null when the version shipped without one (published
+// before ADR 0347's gate), so install never prints a link that would 404.
+function howtoLink(key, version, files, apiBase) {
+  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
+  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
+  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
+}
+
+function storeError(res) {
+  const err = res.data && (res.data.error || res.data);
+  return (err && (err.message || err.code)) || `HTTP ${res.status}`;
+}
+
+// ---------------------------------------------------------------------------
+// bongos module store — what the store lists (task 1003811)
+// ---------------------------------------------------------------------------
+
+const STORE_USAGE = 'usage: bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]';
+
+// The query GET /store/modules takes, from argv. Returns { query } or { error }.
+// The server checks the values too; this only refuses what is not a value at all.
+function storeQuery(args) {
+  const params = [];
+  for (const [flag, param] of [['--sort', 'sort'], ['--max-cents', 'max_cents'], ['--max-credits', 'max_credits']]) {
+    const i = args.indexOf(flag);
+    if (i === -1) continue;
+    const v = args[i + 1];
+    if (!v || v.startsWith('--')) return { error: `${flag} needs a value` };
+    params.push(`${param}=${encodeURIComponent(v)}`);
+  }
+  return { query: params.length ? `?${params.join('&')}` : '' };
+}
+
+function formatPrice(price) {
+  if (!price || price.free) return 'free';
+  const parts = [];
+  if (price.cents != null) parts.push(`$${(price.cents / 100).toFixed(2)}`);
+  if (price.credits != null) parts.push(`${price.credits} credits`);
+  return parts.join(' or ') || 'free';
+}
+
+function formatPlace(category) {
+  if (!category) return '';
+  return category.label ? `${category.parent_title} › ${category.label}` : category.parent_title;
+}
+
+// Pure renderer over the GET /store/modules body. It keeps the server's order and
+// adds nothing to it: listed in rank, then New, never ranked.
+function formatStore(body) {
+  const out = [];
+  out.push('bongos module store — what the store lists, best first');
+  out.push(`  floor ${body.floor} out of 100 · at most ${body.cap} per sub-category`);
+  out.push(`  ${body.ranking}`);
+  if (body.sort) {
+    const part = (body.sort_parts || []).find((x) => x.part === body.sort);
+    out.push(`  sorted by ${part ? part.title : body.sort}`);
+  }
+  const max = body.max_price;
+  if (max) out.push(`  at most ${[max.cents != null ? `$${(max.cents / 100).toFixed(2)}` : null, max.credits != null ? `${max.credits} credits` : null].filter(Boolean).join(' or ')}`);
+  out.push('');
+  const listed = body.listed || [];
+  if (!listed.length) out.push('  Nothing is listed yet.');
+  listed.forEach((m, i) => {
+    out.push(`  ${String(i + 1).padStart(2)}. ${m.key}@${m.version}  ${m.overall}/100  ${formatPrice(m.price)}${m.buyable === false ? ' (not yet buyable)' : ''}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
+  });
+  const fresh = body.new || [];
+  if (fresh.length) {
+    out.push('');
+    out.push('  New — not ranked until projects have installed and used them:');
+    for (const m of fresh) out.push(`      ${m.key}@${m.version}  ${formatPrice(m.price)}${m.buyable === false ? ' (not yet buyable)' : ''}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
+  }
+  out.push('');
+  out.push('  Why a module is not here: GET /store/modules/<key>/listing');
+  return out.join('\n');
+}
+
+async function cmdStore(args, { log = console.log, errlog = console.error, request } = {}) {
+  const q = storeQuery(args);
+  if (q.error) { errlog(`bongos module store: ${q.error}`); errlog(STORE_USAGE); return 2; }
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module store: ${e.message}`); return 1; }
+  let res;
+  try { res = await call('GET', `/store/modules${q.query}`); }
+  catch (e) { errlog(`bongos module store: the store could not be reached — ${e.message}`); return 1; }
+  if (!res.ok) { errlog(`bongos module store: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
+  if (args.includes('--json')) { log(JSON.stringify(res.data, null, 2)); return 0; }
+  log(formatStore(res.data || {}));
+  return 0;
+}
+
+// ---------------------------------------------------------------------------
+// bongos module price — the author sets a module's price (task 1004894)
+// ---------------------------------------------------------------------------
+
+const PRICE_USAGE = 'usage: bongos module price <key> [--cents N] [--credits N]   (0 in either makes it free)';
+
+// argv -> { key, cents, credits } or { error }. Pure.
+function priceArgs(args) {
+  const key = args[0];
+  if (!key || key.startsWith('--') || !KEY_RE.test(key)) return { error: 'name the module: a lowercase kebab-case key' };
+  const out = { key, cents: null, credits: null };
+  for (const [flag, field] of [['--cents', 'cents'], ['--credits', 'credits']]) {
+    const i = args.indexOf(flag);
+    if (i === -1) continue;
+    const v = args[i + 1];
+    if (!v || !/^\d{1,9}$/.test(v)) return { error: `${flag} needs a whole number, 0 or more` };
+    out[field] = Number(v);
+  }
+  if (out.cents === null && out.credits === null) return { error: 'give --cents, --credits or both' };
+  return out;
+}
+
+async function cmdPrice(args, { log = console.log, errlog = console.error, request } = {}) {
+  const p = priceArgs(args);
+  if (p.error) { errlog(`bongos module price: ${p.error}`); errlog(PRICE_USAGE); return 2; }
+  let call;
+  try { call = request || storeRequest(); }
+  catch (e) { errlog(`bongos module price: ${e.message}`); return 1; }
+  let res;
+  try { res = await call('POST', `/store/modules/${encodeURIComponent(p.key)}/price`, { json: { cents: p.cents, credits: p.credits } }); }
+  catch (e) { errlog(`bongos module price: the store could not be reached — ${e.message}`); return 1; }
+  if (!res.ok) { errlog(`bongos module price: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
+  const withFree = (p) => ({ ...p, free: p.cents === 0 || p.credits === 0 });
+  const shown = formatPrice(withFree(res.data.price));
+  const was = res.data.previous ? formatPrice(withFree(res.data.previous)) : 'free (no price set)';
+  log(`✓ "${p.key}" now costs ${shown} (was ${was}).`);
+  if (shown !== 'free') log('  Buying is not open yet, so the store lists it as not yet buyable until it is.');
+  return 0;
+}
+
+module.exports = {
+  storeRequest, storeError, howtoLink, formatStore, cmdStore, priceArgs, cmdPrice,
+};

package/scripts/bongos/module.js

@@ -39,6 +39,12 @@
 //     sub-category live in one place (src/bongos/module-listing.js), so the hall
 //     and the terminal cannot disagree about which modules are the best.
 //
+//   bongos module price <key> [--cents N] [--credits N]
+//     Task 1004894 — the module's author sets its price in the store, in money
+//     (cents), credits or both; 0 in either makes it free. The store keeps every
+//     change and shows the newest. A paid module is listed as not yet buyable until
+//     buying arrives (task 1003788).
+//
 //   bongos module check <key>
 //     ADR 0107 §4 — the submit-time pre-check a module must clear before it can
 //     be upstreamed into the shared core catalog. REUSES (never re-types) the
@@ -82,6 +88,8 @@ const { validateManifest, assertValidManifest, KEY_RE, SUNSET_STATUSES } = requi
 const { parseVersion, cmp } = require('../../src/module-loader/semver');
 const loader = require('../../src/module-loader/loader');
 const catalog = require('../../src/module-loader/catalog');
+// The store client and the `store` / `price` verbs (task 1004894 carve).
+const { storeRequest, storeError, howtoLink, formatStore, cmdStore, priceArgs, cmdPrice } = require('./module-store-cli');
 const { resolveModules, MODULE_REGISTRY, NEUTRAL_PATH, INSTANCE_PATH } = require('../../src/modules');
 // The public-mirror publish boundary (ADR 0098) — REUSED, never re-typed, for
 // the ADR 0107 §4 upstreaming pre-check. Only matchesDeny is used (not the full
@@ -958,18 +966,31 @@ async function cmdSubmit(args, {
 // Distinct from `submit`, which proposes a module INTO core (ADR 0135).
 async function cmdPublish(args, {
   log = console.log, errlog = console.error,
-  modulesDir = MODULES_DIR, pack, upload, writeFile = fs.writeFileSync,
+  modulesDir = MODULES_DIR, pack, upload, writeFile = fs.writeFileSync, priceRequest,
 } = {}) {
-  const key = args.find((a, i) => !a.startsWith('-') && args[i - 1] !== '--out');
+  const PUBLISH_USAGE = 'usage: bongos module publish <key> [--dry-run] [--out <dir>] [--cents N] [--credits N]';
+  const VALUED = new Set(['--out', '--cents', '--credits']);
+  const key = args.find((a, i) => !a.startsWith('-') && !VALUED.has(args[i - 1]));
   if (!key) {
-    errlog('usage: bongos module publish <key> [--dry-run] [--out <dir>]');
+    errlog(PUBLISH_USAGE);
     return 2;
   }
+  // An optional price set right after the upload (task 1004894), with the same rules
+  // as `bongos module price`, checked BEFORE anything is packed or sent.
+  const priceFlags = [];
+  for (const flag of ['--cents', '--credits']) {
+    const i = args.indexOf(flag);
+    if (i !== -1) priceFlags.push(flag, args[i + 1]);
+  }
+  if (priceFlags.length) {
+    const p = priceArgs([key, ...priceFlags]);
+    if (p.error) { errlog(`bongos module publish: ${p.error}`); errlog(PUBLISH_USAGE); return 2; }
+  }
   const dryRun = args.includes('--dry-run');
   const outIdx = args.indexOf('--out');
   const outDir = outIdx !== -1 ? args[outIdx + 1] : null;
   if (outIdx !== -1 && (!outDir || outDir.startsWith('--'))) {
-    errlog('usage: bongos module publish <key> [--dry-run] [--out <dir>]');
+    errlog(PUBLISH_USAGE);
     return 2;
   }
 
@@ -1037,135 +1058,18 @@ async function cmdPublish(args, {
   if (res.data && res.data.channel === 'tester') {
     log('  It goes to testing projects first, and reaches every project once it has been tested (ADR 0344).');
   }
-  return 0;
+  if (!priceFlags.length) return 0;
+  // The version is published whatever happens next; a price that fails is reported
+  // with the one command that sets it, and the exit code says something needs doing.
+  const priced = await cmdPrice([key, ...priceFlags], { log, errlog, request: priceRequest });
+  if (priced !== 0) errlog(`  The version is published, but its price was not set. Run \`bongos module price ${key} ${priceFlags.join(' ')}\` to set it.`);
+  return priced === 0 ? 0 : 1;
 }
 
 // ---------------------------------------------------------------------------
 // bongos module install <key> — acquire a module from the store (ADR 0338 D1)
 // ---------------------------------------------------------------------------
 
-// The store half of the CLI, over three calls (src/bongos/routes/modules.js):
-// acquire (take the entitlement, learn the version), download the tarball, and
-// once the files are placed, record the version acquired. Injected in tests.
-function storeRequest() {
-  // Lazy require — cli-lib's session/fetch plumbing must never load in the server
-  // process, which requires this file too (the same reason cmdPublish gives).
-  const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
-  const session = readSessionToken();
-  if (!session) throw new Error('no Bongos session — run `bongos setup` first');
-  const call = async (method, urlPath, { json, binary = false } = {}) => {
-    const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${session.token}`, 'User-Agent': CLI_USER_AGENT,
-        ...(json ? { 'Content-Type': 'application/json' } : {}),
-      },
-      body: json ? JSON.stringify(json) : undefined,
-      dispatcher: noKeepAliveDispatcher(),
-    });
-    if (binary && res.ok) return { ok: true, status: res.status, buf: Buffer.from(await res.arrayBuffer()) };
-    const text = await res.text();
-    let data;
-    try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
-    return { ok: res.ok, status: res.status, data };
-  };
-  // Where the store lives, so install can print a full link to the how-to page.
-  call.apiBase = session.apiBase;
-  return call;
-}
-
-// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
-// opened on one version. null when the version shipped without one (published
-// before ADR 0347's gate), so install never prints a link that would 404.
-function howtoLink(key, version, files, apiBase) {
-  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
-  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
-  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
-}
-
-function storeError(res) {
-  const err = res.data && (res.data.error || res.data);
-  return (err && (err.message || err.code)) || `HTTP ${res.status}`;
-}
-
-// ---------------------------------------------------------------------------
-// bongos module store — what the store lists (task 1003811)
-// ---------------------------------------------------------------------------
-
-const STORE_USAGE = 'usage: bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]';
-
-// The query GET /store/modules takes, from argv. Returns { query } or { error }.
-// The server checks the values too; this only refuses what is not a value at all.
-function storeQuery(args) {
-  const params = [];
-  for (const [flag, param] of [['--sort', 'sort'], ['--max-cents', 'max_cents'], ['--max-credits', 'max_credits']]) {
-    const i = args.indexOf(flag);
-    if (i === -1) continue;
-    const v = args[i + 1];
-    if (!v || v.startsWith('--')) return { error: `${flag} needs a value` };
-    params.push(`${param}=${encodeURIComponent(v)}`);
-  }
-  return { query: params.length ? `?${params.join('&')}` : '' };
-}
-
-function formatPrice(price) {
-  if (!price || price.free) return 'free';
-  const parts = [];
-  if (price.cents != null) parts.push(`$${(price.cents / 100).toFixed(2)}`);
-  if (price.credits != null) parts.push(`${price.credits} credits`);
-  return parts.join(' or ') || 'free';
-}
-
-function formatPlace(category) {
-  if (!category) return '';
-  return category.label ? `${category.parent_title} › ${category.label}` : category.parent_title;
-}
-
-// Pure renderer over the GET /store/modules body. It keeps the server's order and
-// adds nothing to it: listed in rank, then New, never ranked.
-function formatStore(body) {
-  const out = [];
-  out.push('bongos module store — what the store lists, best first');
-  out.push(`  floor ${body.floor} out of 100 · at most ${body.cap} per sub-category`);
-  out.push(`  ${body.ranking}`);
-  if (body.sort) {
-    const part = (body.sort_parts || []).find((x) => x.part === body.sort);
-    out.push(`  sorted by ${part ? part.title : body.sort}`);
-  }
-  const max = body.max_price;
-  if (max) out.push(`  at most ${[max.cents != null ? `$${(max.cents / 100).toFixed(2)}` : null, max.credits != null ? `${max.credits} credits` : null].filter(Boolean).join(' or ')}`);
-  out.push('');
-  const listed = body.listed || [];
-  if (!listed.length) out.push('  Nothing is listed yet.');
-  listed.forEach((m, i) => {
-    out.push(`  ${String(i + 1).padStart(2)}. ${m.key}@${m.version}  ${m.overall}/100  ${formatPrice(m.price)}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
-  });
-  const fresh = body.new || [];
-  if (fresh.length) {
-    out.push('');
-    out.push('  New — not ranked until projects have installed and used them:');
-    for (const m of fresh) out.push(`      ${m.key}@${m.version}  ${formatPrice(m.price)}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
-  }
-  out.push('');
-  out.push('  Why a module is not here: GET /store/modules/<key>/listing');
-  return out.join('\n');
-}
-
-async function cmdStore(args, { log = console.log, errlog = console.error, request } = {}) {
-  const q = storeQuery(args);
-  if (q.error) { errlog(`bongos module store: ${q.error}`); errlog(STORE_USAGE); return 2; }
-  let call;
-  try { call = request || storeRequest(); }
-  catch (e) { errlog(`bongos module store: ${e.message}`); return 1; }
-  let res;
-  try { res = await call('GET', `/store/modules${q.query}`); }
-  catch (e) { errlog(`bongos module store: the store could not be reached — ${e.message}`); return 1; }
-  if (!res.ok) { errlog(`bongos module store: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
-  if (args.includes('--json')) { log(JSON.stringify(res.data, null, 2)); return 0; }
-  log(formatStore(res.data || {}));
-  return 0;
-}
-
 // Where install places a module: the INSTANCE's own modules/ root (ADR 0108 §1),
 // which the loader discovers. In a single checkout that is this repo's modules/.
 function instanceModulesDir() {
@@ -1427,13 +1331,15 @@ function printHelp(out = console.log) {
   out('                              Browse the module catalog — what you can enable, with author + origin credit');
   out('  bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]');
   out('                              What the store lists, best first: above the quality floor, ranked, ten per sub-category');
+  out('  bongos module price <key> [--cents N] [--credits N]');
+  out('                              Set your module\'s price in the store (0 in either makes it free)');
   out('  bongos upgrade [--no-store] Pre-check enabled modules against the core version (fail-closed),');
   out('                              then list newer store versions of installed modules (never blocks)');
   out('  bongos module check <key> [--sign-off "Name <email>"]');
   out('                              AGPL/publish pre-check before upstreaming + record a DCO-style sign-off');
   out('  bongos module submit <key> [--sign-off "Name <email>"]');
   out('                              Pre-check + sign-off, then file into the rank-gated upstreaming review queue');
-  out('  bongos module publish <key> [--dry-run] [--out <dir>]');
+  out('  bongos module publish <key> [--dry-run] [--out <dir>] [--cents N] [--credits N]');
   out('                              Pack a module version (tarball + hash manifest) and upload it to the module store');
   out('  bongos module install <key> [--version X.Y.Z]');
   out('                              Acquire a module from the store, verify it and place it under modules/ (not enabled)');
@@ -1447,6 +1353,7 @@ async function main(argv) {
   if (sub === 'new') return cmdNew(args.slice(1));
   if (sub === 'list' || sub === 'ls') return cmdList(args.slice(1));
   if (sub === 'store') return cmdStore(args.slice(1));
+  if (sub === 'price') return cmdPrice(args.slice(1));
   if (sub === 'upgrade') return cmdUpgrade(args.slice(1));
   if (sub === 'check') return cmdCheck(args.slice(1));
   if (sub === 'submit') return cmdSubmit(args.slice(1));
@@ -1463,7 +1370,7 @@ async function main(argv) {
 }
 
 module.exports = {
-  main, cmdNew, cmdList, cmdStore, formatStore, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
+  main, cmdNew, cmdList, cmdStore, formatStore, cmdPrice, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
   storeRequest,
   gatherCatalog, formatCatalog, ownProjectName,
   scaffoldModule, gatherUpgrade, evaluateUpgrade, gatherUpdates, evaluateUpdates, buildManifest,

package/scripts/gds/module-store-cli.js

@@ -0,0 +1,6 @@
+// scripts/gds/module-store-cli.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/module-store-cli.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'module-store-cli.js');

package/src/bongos/auth-admission.js

@@ -373,9 +373,9 @@ function firstTimeAdmissionBlocked({ existing, approved, login }) {
 // existing request-access page rather than a spinner that never resolves.
 //
 // NB the onboarding module's public GET /access-requests/status (used by the
-// CLI) reports member|invited|pending|none but knows nothing about the
-// firstAdmin bypass or open enrollment — so it reports the OWNER as 'none'
-// forever. That is exactly why this auth-domain probe exists.
+// CLI) reports member|invited|not_admitted but knows nothing about the
+// firstAdmin bypass or open enrollment — so it reports the OWNER as
+// 'not_admitted' forever. That is exactly why this auth-domain probe exists.
 async function webAdmissionStatus(login) {
   const name = String(login || '').trim();
   if (!name) return { admitted: false, expectedSoon: false };

package/src/bongos/middleware/rate-limit.js

@@ -38,7 +38,7 @@
 //                            by BOTH routes that answer "does this GitHub login
 //                            have an account here?": the onboarding module's
 //                            GET /access-requests/status (the richer
-//                            member|invited|pending|dismissed|none) and core's
+//                            member|invited|not_admitted) and core's
 //                            GET /auth/web/admission-status (its boolean twin).
 //                            Task 1003339 / ADR 0209. They are ONE oracle read
 //                            two ways, so they share one budget — give each its

package/src/bongos/module-listing.js

@@ -152,6 +152,15 @@ function priceOf(row) {
   return { cents, credits, free: !row || cents === 0 || credits === 0 };
 }
 
+// Whether a module can be bought today. Buying arrives with task 1003788 (area 8's
+// wallet); until then only a free module can be had, and a paid one is listed with
+// its price and marked not yet buyable (owner, 2026-10-26). Flip BUYING_OPEN when
+// the buy action ships, and nothing else needs to change. Pure.
+const BUYING_OPEN = false;
+function buyableNow(price) {
+  return !!(price && (price.free || BUYING_OPEN));
+}
+
 // Within a buyer's maximum ({ cents, credits }, either may be null): a free module
 // always is; a priced one is when it is offered at or under a cap the buyer set. Pure.
 function withinMaxPrice(price, max) {
@@ -228,7 +237,7 @@ function newestPerModule(rows) {
 }
 
 // The catalog: { floor, cap, ranking, sort, sort_parts, max_price, listed: [...], new: [...] },
-// each entry { key, title, version, published_at, price, category, overall, is_new,
+// each entry { key, title, version, published_at, price, buyable, category, overall, is_new,
 // parts, strengths, weaknesses, unmeasured } (the last four from readParts). Excluded
 // versions are left out entirely: a module below the bar is not listed at all, nor
 // is one past the cap of its sub-category, nor one over the buyer's `maxPrice`.
@@ -291,9 +300,10 @@ async function buildCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice =
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
     if (placement === 'excluded') continue;
+    const price = priceOf(prices.get(r.module_key));
     out[placement].push({
       key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
-      price: priceOf(prices.get(r.module_key)), category: categoryOf(cats.get(r.module_key)),
+      price, category: categoryOf(cats.get(r.module_key)), buyable: buyableNow(price),
       overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
       ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });