@bongos/core 1.23.5 → 1.23.7

package/scripts/bongos/module.js

@@ -39,6 +39,12 @@
 //     sub-category live in one place (src/bongos/module-listing.js), so the hall
 //     and the terminal cannot disagree about which modules are the best.
 //
+//   bongos module price <key> [--cents N] [--credits N]
+//     Task 1004894 — the module's author sets its price in the store, in money
+//     (cents), credits or both; 0 in either makes it free. The store keeps every
+//     change and shows the newest. A paid module is listed as not yet buyable until
+//     buying arrives (task 1003788).
+//
 //   bongos module check <key>
 //     ADR 0107 §4 — the submit-time pre-check a module must clear before it can
 //     be upstreamed into the shared core catalog. REUSES (never re-types) the
@@ -82,6 +88,8 @@ const { validateManifest, assertValidManifest, KEY_RE, SUNSET_STATUSES } = requi
 const { parseVersion, cmp } = require('../../src/module-loader/semver');
 const loader = require('../../src/module-loader/loader');
 const catalog = require('../../src/module-loader/catalog');
+// The store client and the `store` / `price` verbs (task 1004894 carve).
+const { storeRequest, storeError, howtoLink, formatStore, cmdStore, priceArgs, cmdPrice } = require('./module-store-cli');
 const { resolveModules, MODULE_REGISTRY, NEUTRAL_PATH, INSTANCE_PATH } = require('../../src/modules');
 // The public-mirror publish boundary (ADR 0098) — REUSED, never re-typed, for
 // the ADR 0107 §4 upstreaming pre-check. Only matchesDeny is used (not the full
@@ -958,18 +966,31 @@ async function cmdSubmit(args, {
 // Distinct from `submit`, which proposes a module INTO core (ADR 0135).
 async function cmdPublish(args, {
   log = console.log, errlog = console.error,
-  modulesDir = MODULES_DIR, pack, upload, writeFile = fs.writeFileSync,
+  modulesDir = MODULES_DIR, pack, upload, writeFile = fs.writeFileSync, priceRequest,
 } = {}) {
-  const key = args.find((a, i) => !a.startsWith('-') && args[i - 1] !== '--out');
+  const PUBLISH_USAGE = 'usage: bongos module publish <key> [--dry-run] [--out <dir>] [--cents N] [--credits N]';
+  const VALUED = new Set(['--out', '--cents', '--credits']);
+  const key = args.find((a, i) => !a.startsWith('-') && !VALUED.has(args[i - 1]));
   if (!key) {
-    errlog('usage: bongos module publish <key> [--dry-run] [--out <dir>]');
+    errlog(PUBLISH_USAGE);
     return 2;
   }
+  // An optional price set right after the upload (task 1004894), with the same rules
+  // as `bongos module price`, checked BEFORE anything is packed or sent.
+  const priceFlags = [];
+  for (const flag of ['--cents', '--credits']) {
+    const i = args.indexOf(flag);
+    if (i !== -1) priceFlags.push(flag, args[i + 1]);
+  }
+  if (priceFlags.length) {
+    const p = priceArgs([key, ...priceFlags]);
+    if (p.error) { errlog(`bongos module publish: ${p.error}`); errlog(PUBLISH_USAGE); return 2; }
+  }
   const dryRun = args.includes('--dry-run');
   const outIdx = args.indexOf('--out');
   const outDir = outIdx !== -1 ? args[outIdx + 1] : null;
   if (outIdx !== -1 && (!outDir || outDir.startsWith('--'))) {
-    errlog('usage: bongos module publish <key> [--dry-run] [--out <dir>]');
+    errlog(PUBLISH_USAGE);
     return 2;
   }
 
@@ -1037,133 +1058,22 @@ async function cmdPublish(args, {
   if (res.data && res.data.channel === 'tester') {
     log('  It goes to testing projects first, and reaches every project once it has been tested (ADR 0344).');
   }
-  return 0;
+  if (!priceFlags.length) return 0;
+  // The version is published whatever happens next; a price that fails is reported
+  // with the one command that sets it, and the exit code says something needs doing.
+  const priced = await cmdPrice([key, ...priceFlags], { log, errlog, request: priceRequest });
+  if (priced !== 0) errlog(`  The version is published, but its price was not set. Run \`bongos module price ${key} ${priceFlags.join(' ')}\` to set it.`);
+  return priced === 0 ? 0 : 1;
 }
 
 // ---------------------------------------------------------------------------
 // bongos module install <key> — acquire a module from the store (ADR 0338 D1)
 // ---------------------------------------------------------------------------
 
-// The store half of the CLI, over three calls (src/bongos/routes/modules.js):
-// acquire (take the entitlement, learn the version), download the tarball, and
-// once the files are placed, record the version acquired. Injected in tests.
-function storeRequest() {
-  // Lazy require — cli-lib's session/fetch plumbing must never load in the server
-  // process, which requires this file too (the same reason cmdPublish gives).
-  const { readSessionToken, dispatchedFetch, noKeepAliveDispatcher, CLI_USER_AGENT } = require('./cli-lib');
-  const session = readSessionToken();
-  if (!session) throw new Error('no Bongos session — run `bongos setup` first');
-  const call = async (method, urlPath, { json, binary = false } = {}) => {
-    const res = await dispatchedFetch(`${session.apiBase}/api/bongos${urlPath}`, {
-      method,
-      headers: {
-        Authorization: `Bearer ${session.token}`, 'User-Agent': CLI_USER_AGENT,
-        ...(json ? { 'Content-Type': 'application/json' } : {}),
-      },
-      body: json ? JSON.stringify(json) : undefined,
-      dispatcher: noKeepAliveDispatcher(),
-    });
-    if (binary && res.ok) return { ok: true, status: res.status, buf: Buffer.from(await res.arrayBuffer()) };
-    const text = await res.text();
-    let data;
-    try { data = text ? JSON.parse(text) : null; } catch { data = { raw: text }; }
-    return { ok: res.ok, status: res.status, data };
-  };
-  // Where the store lives, so install can print a full link to the how-to page.
-  call.apiBase = session.apiBase;
-  return call;
-}
-
-// The hall page that shows a version's HOWTO.md (task 1004366) — the Modules tab,
-// opened on one version. null when the version shipped without one (published
-// before ADR 0347's gate), so install never prints a link that would 404.
-function howtoLink(key, version, files, apiBase) {
-  if (!files.some((f) => f.path === 'HOWTO.md')) return null;
-  const p = `/builders/modules?howto=${encodeURIComponent(key)}&version=${encodeURIComponent(version)}`;
-  return apiBase ? `${String(apiBase).replace(/\/+$/, '')}${p}` : p;
-}
-
-function storeError(res) {
-  const err = res.data && (res.data.error || res.data);
-  return (err && (err.message || err.code)) || `HTTP ${res.status}`;
-}
-
-// ---------------------------------------------------------------------------
-// bongos module store — what the store lists (task 1003811)
-// ---------------------------------------------------------------------------
-
-const STORE_USAGE = 'usage: bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]';
-
-// The query GET /store/modules takes, from argv. Returns { query } or { error }.
-// The server checks the values too; this only refuses what is not a value at all.
-function storeQuery(args) {
-  const params = [];
-  for (const [flag, param] of [['--sort', 'sort'], ['--max-cents', 'max_cents'], ['--max-credits', 'max_credits']]) {
-    const i = args.indexOf(flag);
-    if (i === -1) continue;
-    const v = args[i + 1];
-    if (!v || v.startsWith('--')) return { error: `${flag} needs a value` };
-    params.push(`${param}=${encodeURIComponent(v)}`);
-  }
-  return { query: params.length ? `?${params.join('&')}` : '' };
-}
-
-function formatPrice(price) {
-  if (!price || price.free) return 'free';
-  const parts = [];
-  if (price.cents != null) parts.push(`$${(price.cents / 100).toFixed(2)}`);
-  if (price.credits != null) parts.push(`${price.credits} credits`);
-  return parts.join(' or ') || 'free';
-}
-
-function formatPlace(category) {
-  if (!category) return '';
-  return category.label ? `${category.parent_title} › ${category.label}` : category.parent_title;
-}
-
-// Pure renderer over the GET /store/modules body. It keeps the server's order and
-// adds nothing to it: listed in rank, then New, never ranked.
-function formatStore(body) {
-  const out = [];
-  out.push('bongos module store — what the store lists, best first');
-  out.push(`  floor ${body.floor} out of 100 · at most ${body.cap} per sub-category`);
-  out.push(`  ${body.ranking}`);
-  if (body.sort) {
-    const part = (body.sort_parts || []).find((x) => x.part === body.sort);
-    out.push(`  sorted by ${part ? part.title : body.sort}`);
-  }
-  const max = body.max_price;
-  if (max) out.push(`  at most ${[max.cents != null ? `$${(max.cents / 100).toFixed(2)}` : null, max.credits != null ? `${max.credits} credits` : null].filter(Boolean).join(' or ')}`);
-  out.push('');
-  const listed = body.listed || [];
-  if (!listed.length) out.push('  Nothing is listed yet.');
-  listed.forEach((m, i) => {
-    out.push(`  ${String(i + 1).padStart(2)}. ${m.key}@${m.version}  ${m.overall}/100  ${formatPrice(m.price)}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
-  });
-  const fresh = body.new || [];
-  if (fresh.length) {
-    out.push('');
-    out.push('  New — not ranked until projects have installed and used them:');
-    for (const m of fresh) out.push(`      ${m.key}@${m.version}  ${formatPrice(m.price)}${m.category ? `  ${formatPlace(m.category)}` : ''}`);
-  }
-  out.push('');
-  out.push('  Why a module is not here: GET /store/modules/<key>/listing');
-  return out.join('\n');
-}
-
-async function cmdStore(args, { log = console.log, errlog = console.error, request } = {}) {
-  const q = storeQuery(args);
-  if (q.error) { errlog(`bongos module store: ${q.error}`); errlog(STORE_USAGE); return 2; }
-  let call;
-  try { call = request || storeRequest(); }
-  catch (e) { errlog(`bongos module store: ${e.message}`); return 1; }
-  let res;
-  try { res = await call('GET', `/store/modules${q.query}`); }
-  catch (e) { errlog(`bongos module store: the store could not be reached — ${e.message}`); return 1; }
-  if (!res.ok) { errlog(`bongos module store: the store answered ${storeError(res)}`); return res.status === 400 ? 2 : 1; }
-  if (args.includes('--json')) { log(JSON.stringify(res.data, null, 2)); return 0; }
-  log(formatStore(res.data || {}));
-  return 0;
+// `bongos module remove` lives in its own file (task 1004896); this hands it the
+// catalog and the store client it needs.
+function cmdRemove(args, deps = {}) {
+  return require('./module-remove').cmdRemove(args, { gather: gatherCatalog, storeRequest, storeError, ...deps });
 }
 
 // Where install places a module: the INSTANCE's own modules/ root (ADR 0108 §1),
@@ -1427,13 +1337,16 @@ function printHelp(out = console.log) {
   out('                              Browse the module catalog — what you can enable, with author + origin credit');
   out('  bongos module store [--sort <part>] [--max-cents N] [--max-credits N] [--json]');
   out('                              What the store lists, best first: above the quality floor, ranked, ten per sub-category');
+  out('  bongos module price <key> [--cents N] [--credits N]');
+  out('                              Set your module\'s price in the store (0 in either makes it free)');
+  out('  bongos module remove <key>  Take a store module off this project (switch it off first; its folder is kept aside)');
   out('  bongos upgrade [--no-store] Pre-check enabled modules against the core version (fail-closed),');
   out('                              then list newer store versions of installed modules (never blocks)');
   out('  bongos module check <key> [--sign-off "Name <email>"]');
   out('                              AGPL/publish pre-check before upstreaming + record a DCO-style sign-off');
   out('  bongos module submit <key> [--sign-off "Name <email>"]');
   out('                              Pre-check + sign-off, then file into the rank-gated upstreaming review queue');
-  out('  bongos module publish <key> [--dry-run] [--out <dir>]');
+  out('  bongos module publish <key> [--dry-run] [--out <dir>] [--cents N] [--credits N]');
   out('                              Pack a module version (tarball + hash manifest) and upload it to the module store');
   out('  bongos module install <key> [--version X.Y.Z]');
   out('                              Acquire a module from the store, verify it and place it under modules/ (not enabled)');
@@ -1447,6 +1360,8 @@ async function main(argv) {
   if (sub === 'new') return cmdNew(args.slice(1));
   if (sub === 'list' || sub === 'ls') return cmdList(args.slice(1));
   if (sub === 'store') return cmdStore(args.slice(1));
+  if (sub === 'price') return cmdPrice(args.slice(1));
+  if (sub === 'remove') return cmdRemove(args.slice(1));
   if (sub === 'upgrade') return cmdUpgrade(args.slice(1));
   if (sub === 'check') return cmdCheck(args.slice(1));
   if (sub === 'submit') return cmdSubmit(args.slice(1));
@@ -1463,7 +1378,7 @@ async function main(argv) {
 }
 
 module.exports = {
-  main, cmdNew, cmdList, cmdStore, formatStore, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
+  main, cmdNew, cmdList, cmdStore, formatStore, cmdPrice, cmdRemove, cmdUpgrade, cmdCheck, cmdSubmit, cmdPublish, cmdInstall, cmdUpdate, printHelp,
   storeRequest,
   gatherCatalog, formatCatalog, ownProjectName,
   scaffoldModule, gatherUpgrade, evaluateUpgrade, gatherUpdates, evaluateUpdates, buildManifest,

package/scripts/gds/module-remove.js

@@ -0,0 +1,6 @@
+// scripts/gds/module-remove.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/module-remove.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'module-remove.js');

package/scripts/gds/module-store-cli.js

@@ -0,0 +1,6 @@
+// scripts/gds/module-store-cli.js — @bongos-forwarder (task 1004848). Generated by
+// scripts/bongos/codemod-rename-scripts-gds.js; do not edit.
+// The real script is scripts/bongos/module-store-cli.js. This forwarder keeps callers that still name
+// the old path working, and warns once so they get repointed. Task 1003706 removes it.
+'use strict';
+require('../bongos/forwarder.js').forward(module, 'module-store-cli.js');

package/src/bongos/auth-admission.js

@@ -373,9 +373,9 @@ function firstTimeAdmissionBlocked({ existing, approved, login }) {
 // existing request-access page rather than a spinner that never resolves.
 //
 // NB the onboarding module's public GET /access-requests/status (used by the
-// CLI) reports member|invited|pending|none but knows nothing about the
-// firstAdmin bypass or open enrollment — so it reports the OWNER as 'none'
-// forever. That is exactly why this auth-domain probe exists.
+// CLI) reports member|invited|not_admitted but knows nothing about the
+// firstAdmin bypass or open enrollment — so it reports the OWNER as
+// 'not_admitted' forever. That is exactly why this auth-domain probe exists.
 async function webAdmissionStatus(login) {
   const name = String(login || '').trim();
   if (!name) return { admitted: false, expectedSoon: false };

package/src/bongos/middleware/rate-limit.js

@@ -38,7 +38,7 @@
 //                            by BOTH routes that answer "does this GitHub login
 //                            have an account here?": the onboarding module's
 //                            GET /access-requests/status (the richer
-//                            member|invited|pending|dismissed|none) and core's
+//                            member|invited|not_admitted) and core's
 //                            GET /auth/web/admission-status (its boolean twin).
 //                            Task 1003339 / ADR 0209. They are ONE oracle read
 //                            two ways, so they share one budget — give each its

package/src/bongos/module-listing.js

@@ -152,6 +152,15 @@ function priceOf(row) {
   return { cents, credits, free: !row || cents === 0 || credits === 0 };
 }
 
+// Whether a module can be bought today. Buying arrives with task 1003788 (area 8's
+// wallet); until then only a free module can be had, and a paid one is listed with
+// its price and marked not yet buyable (owner, 2026-10-26). Flip BUYING_OPEN when
+// the buy action ships, and nothing else needs to change. Pure.
+const BUYING_OPEN = false;
+function buyableNow(price) {
+  return !!(price && (price.free || BUYING_OPEN));
+}
+
 // Within a buyer's maximum ({ cents, credits }, either may be null): a free module
 // always is; a priced one is when it is offered at or under a cap the buyer set. Pure.
 function withinMaxPrice(price, max) {
@@ -228,7 +237,7 @@ function newestPerModule(rows) {
 }
 
 // The catalog: { floor, cap, ranking, sort, sort_parts, max_price, listed: [...], new: [...] },
-// each entry { key, title, version, published_at, price, category, overall, is_new,
+// each entry { key, title, version, published_at, price, buyable, category, overall, is_new,
 // parts, strengths, weaknesses, unmeasured } (the last four from readParts). Excluded
 // versions are left out entirely: a module below the bar is not listed at all, nor
 // is one past the cap of its sub-category, nor one over the buyer's `maxPrice`.
@@ -291,9 +300,10 @@ async function buildCatalog({ db, floor = QUALITY_FLOOR, sort = null, maxPrice =
     const score = scores.get(String(r.version_id)) || null;
     const { placement } = placeVersion(score, floor);
     if (placement === 'excluded') continue;
+    const price = priceOf(prices.get(r.module_key));
     out[placement].push({
       key: r.module_key, title: r.title, version: r.version, published_at: r.published_at,
-      price: priceOf(prices.get(r.module_key)), category: categoryOf(cats.get(r.module_key)),
+      price, category: categoryOf(cats.get(r.module_key)), buyable: buyableNow(price),
       overall: placement === 'new' ? null : score.overall, is_new: placement === 'new',
       ...readParts(signals.get(String(r.version_id)) || [], { floor }),
     });

package/src/bongos/module-store.js

@@ -383,6 +383,54 @@ async function latestVersions(keys, { db, channelsFor = null } = {}) {
   return out;
 }
 
+// Set a module's price (task 1004894, criterion wa5-module-economy). Only its
+// author may, and a delisted module takes no new price (it can no longer be
+// acquired). The price is a HISTORY: each change appends a row and the newest is
+// current, which is what the catalog (module-listing.js priceOf) and acquire
+// (isFreePrice above) already read. `cents` / `credits`: a whole number of 0 or
+// more, or null for "not offered in that currency"; at least one must be given
+// (core_257's CHECK), and 0 in either is free. A paid price may be set before
+// buying exists (owner, 2026-10-26): the module is listed with it and marked not yet
+// buyable, and acquire keeps refusing it without an entitlement. Price is never an
+// input to the score (ADR 0343 D6). The history IS the audit of price changes:
+// every row names who set it and when, and the row before it is what it changed
+// from (the audit middleware also logs the request). One transaction, the module row
+// locked FOR UPDATE as publishVersion does, so two changes at once each report the
+// price they really replaced. Returns { ok: true, previous, price } (each
+// { cents, credits } or null) or { ok: false, status, code, message }.
+async function setPrice({ key, cents = null, credits = null, builderId }, { db } = {}) {
+  const pool = db || require('./pool').pool;
+  const refuse = (status, code, message) => ({ ok: false, status, code, message });
+  const client = await pool.connect();
+  try {
+    await client.query('BEGIN');
+    const { rows: [mod] } = await client.query(
+      'SELECT module_key, author_id, status FROM store_modules WHERE module_key = $1 FOR UPDATE', [key]);
+    let out;
+    if (!mod) out = refuse(404, 'module_not_found', `The store has no module "${key}".`);
+    else if (String(mod.author_id) !== String(builderId)) out = refuse(403, 'not_module_author', `Only the author of "${key}" may set its price.`);
+    else if (mod.status === 'delisted') out = refuse(409, 'module_delisted', `"${key}" is delisted: it takes no new price.`);
+    if (out) { await client.query('ROLLBACK'); return out; }
+    const { rows: [prev] } = await client.query(
+      `SELECT price_cents, price_credits FROM store_module_prices
+        WHERE module_key = $1 ORDER BY set_at DESC, id DESC LIMIT 1`, [key]);
+    await client.query(
+      'INSERT INTO store_module_prices (module_key, price_cents, price_credits, set_by) VALUES ($1, $2, $3, $4)',
+      [key, cents, credits, builderId]);
+    await client.query('COMMIT');
+    return {
+      ok: true,
+      previous: prev ? { cents: prev.price_cents, credits: prev.price_credits } : null,
+      price: { cents, credits },
+    };
+  } catch (e) {
+    try { await client.query('ROLLBACK'); } catch { /* the connection may be gone */ }
+    throw e;
+  } finally {
+    client.release();
+  }
+}
+
 // Withdraw one version (task 1004895, criterion wa5-staged-rollout): the store
 // stops handing it out. Staged rollout catches a bad version on the tester channel;
 // this is the way back once one has reached general. It is one channel row,
@@ -468,5 +516,5 @@ function versionArtifactFile(row, { dir = storeDir() } = {}) {
 module.exports = {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   isFreePrice, servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet, withdrawVersion, withdrawnVersions, storeDir, storeDirFor, migrateLegacyStore,
+  delistModule, delistedKeySet, setPrice, withdrawVersion, withdrawnVersions, storeDir, storeDirFor, migrateLegacyStore,
 };

package/src/bongos/route-rank-check.js

@@ -250,6 +250,9 @@ const EXPECTED_RANKS = {
   // Delisting a store module (task 1003797, ADR 0338 D2) stops every new install of
   // it for every instance, so it is pinned to its own atom.
   'POST /store/modules/:key/delist': 'perm:module.delist',
+  // Setting a store module's price (task 1004894) rides the publish atom; only the
+  // module's author passes the check inside the handler.
+  'POST /store/modules/:key/price': 'perm:module.submit',
   // Releasing a version the promotion gate held on tester (task 1003804) hands it to
   // every project; the owner put it on the delist atom (2026-10-23), so it is pinned.
   'POST /store/modules/:key/versions/:version/release': 'perm:module.delist',

package/src/bongos/routes/auth.js

@@ -828,19 +828,15 @@ module.exports = function buildAuthRouter() {
   // bounded the honest client, not an attacker. accountExistenceReadRateLimit
   // below is the ceiling — 120 reads/60s per IP, and the SAME instance is
   // mounted on the onboarding module's GET /access-requests/status, which is
-  // this route's strictly richer twin (member|invited|pending|dismissed|none
-  // plus its own `admitted`). One budget across both, because they are one
-  // oracle: hardening either alone would accomplish nothing, and giving each its
-  // own budget would just let an enumerator alternate for double the rate.
-  //
-  // WHAT IS STILL OPEN and is deliberately NOT decided here: whether the answer
-  // itself should collapse, so a caller who is not the subject cannot tell
-  // pending/dismissed/none apart from a bare "not admitted". That changes what a
-  // real invited user sees during onboarding, so it is the owner's call — filed
-  // as a blocker against task 1003339, not settled by a comment in this file.
+  // this route's strictly richer twin (member|invited|not_admitted plus its own
+  // `admitted`). One budget across both, because they are one oracle: hardening
+  // either alone would accomplish nothing, and giving each its own budget would
+  // just let an enumerator alternate for double the rate. That twin once told
+  // pending/declined/none apart too; it collapsed to `not_admitted` on the
+  // owner's call (ADR 0217 D4, task 1003359).
   //
   // That endpoint is also why this one exists: it models neither the firstAdmin
-  // bypass nor open enrollment, so it reports the OWNER as 'none' forever —
+  // bypass nor open enrollment, so it reports the OWNER as 'not_admitted' forever —
   // the exact case this page has to resolve.
   router.get('/auth/web/admission-status', accountExistenceReadRateLimit, async (req, res) => {
     const login = typeof req.query.login === 'string' ? req.query.login.slice(0, 100) : '';

package/src/bongos/routes/modules.js

@@ -97,7 +97,7 @@ const { checkEntitlement, listEntitlements, grantEntitlement, recordAcquired } =
 const {
   stageArtifact, commitArtifact, removeArtifact, relativeArtifactPath, publishVersion,
   servedChannels, resolveAcquirable, resolveReadable, publishedVersionSet, latestVersions, versionArtifactFile,
-  delistModule, delistedKeySet, withdrawVersion, withdrawnVersions, migrateLegacyStore,
+  delistModule, delistedKeySet, setPrice, withdrawVersion, withdrawnVersions, migrateLegacyStore,
 } = require('../module-store');
 const {
   isOptedOut, setReporting, installReportError, errorCountError, recordInstallReport, recordErrorCount,
@@ -575,6 +575,37 @@ module.exports = function buildModulesRouter() {
       res.status(202).json({ ok: true, queued: true, module_key: key, version, version_id: r.version.id });
     }));
 
+  // POST /api/bongos/store/modules/:key/price — the module's author sets its price
+  // (task 1004894, criterion wa5-module-economy). Body: { cents?, credits? }, each a
+  // whole number of 0 or more, or null for "not offered in that currency"; at least
+  // one is given, and 0 in either is free. Appends a row to the price history; the
+  // newest is what the catalog shows and what acquire charges. A paid price may be
+  // set before buying exists (owner, 2026-10-26): the catalog marks it not yet
+  // buyable. Price never moves the score (ADR 0343 D6). The audit middleware records
+  // who changed it and to what.
+  //
+  // rank: metic+archon — the same gate as publishing (module.submit), plus the
+  // author check inside setPrice: only the person who published the module prices it.
+  router.post('/store/modules/:key/price', auth.requireBuilder, auth.requirePermission('module.submit'),
+    asyncHandler('POST /store/modules/:key/price', async (req, res) => {
+      const AMOUNT = { type: 'integer', min: 0, max: 100000000 };
+      if (validateOrRespond(req, res, { cents: AMOUNT, credits: AMOUNT })) return;
+      const { key } = req.params;
+      if (!KEY_RE.test(key)) {
+        return res.fail('bad_module_key', { status: 400, message: 'A module key is lowercase kebab-case.' });
+      }
+      const body = req.body || {};
+      const cents = body.cents ?? null;
+      const credits = body.credits ?? null;
+      if (cents === null && credits === null) {
+        return res.fail('bad_price', { status: 400, message: 'Give a price in cents, credits or both. 0 in either makes the module free.' });
+      }
+      const out = await setPrice({ key, cents, credits, builderId: req.builder.id });
+      if (!out.ok) return res.fail(out.code, { status: out.status, message: out.message });
+      log.info({ key, builderId: req.builder.id, cents, credits }, `${key} price set`);
+      res.json({ ok: true, module_key: key, previous: out.previous, price: out.price });
+    }));
+
   // POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out
   // of the store (task 1003797, ADR 0338 D2). It leaves the catalog, cannot be newly
   // acquired, takes no new versions and serves no further downloads: every store

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.23.5'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.23.7'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/account_existence_rate_limit.mjs

@@ -3,7 +3,7 @@
 //
 // The hole this pins shut: two PUBLIC routes answer "does this GitHub login have
 // an account here?" — the onboarding module's GET /access-requests/status (the
-// rich member|invited|pending|dismissed|none) and core's
+// richer member|invited|not_admitted) and core's
 // GET /auth/web/admission-status (its boolean twin) — and neither was throttled.
 // The global limiter returns early for non-write methods, so every GET bypassed
 // it. Scripted at line rate, either route turns a list of GitHub usernames into a
@@ -220,8 +220,12 @@ await t('under the ceiling both probes still answer truthfully — this is a cap
   assert.deepEqual(member.body, { github_login: 'ada', status: 'member', admitted: true });
   const invited = await call(RICH('bo'), ip);
   assert.equal(invited.body.status, 'invited');
-  const stranger = await call(RICH('zzz'), ip);
-  assert.equal(stranger.body.status, 'none');
+  // task 1003359 (ADR 0217 D4): a stranger, a pending applicant and a declined one
+  // get the same body, so the probe says nothing about who applied here.
+  for (const login of ['zzz', 'cy', 'dez']) {
+    const r = await call(RICH(login), ip);
+    assert.deepEqual(r.body, { github_login: login, status: 'not_admitted', admitted: false }, login);
+  }
   const bool = await call(BOOL('ada'), ip);
   assert.deepEqual(bool.body, { admitted: true });
   assert.equal((await call(BOOL('zzz'), ip)).body.admitted, false);

package/tests/application_lifecycle.mjs

@@ -1087,17 +1087,18 @@ test('expiry: another sender re-inviting the login retires your expired line fro
   assert.deepEqual(theirs.json.invites.map((x) => [x.github_login, x.expired]), [['fay', false]]);
 });
 
-test('expiry: the public status probe says expired, and an expired invitee may apply', async () => {
+test('expiry: the public status probe says not_admitted, and an expired invitee may apply', async () => {
   reset();
   builders.push(...ARCHONS);
   await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });
   age(rows.find((x) => x.github_login === 'fay'), 31);
   const st = await call('GET', '/api/gds/access-requests/status?github_login=fay');
-  assert.deepEqual(st.json, { github_login: 'fay', status: 'expired', admitted: false });
+  // task 1003359 (ADR 0217 D4): a lapsed invite is not told apart from no request at all
+  assert.deepEqual(st.json, { github_login: 'fay', status: 'not_admitted', admitted: false });
   const asked = await call('POST', '/api/gds/access-requests', { github_login: 'fay' });
   assert.equal(asked.status, 201, 'not already_approved: an expired invite is not an approval');
   const st2 = await call('GET', '/api/gds/access-requests/status?github_login=fay');
-  assert.equal(st2.json.status, 'pending', 'the newer request is what the probe reports');
+  assert.deepEqual(st2.json, { github_login: 'fay', status: 'not_admitted', admitted: false }, 'nor is a pending request');
 });
 
 test('expiry: rescinding the last live invite clears the hub notice even though an expired one remains', async () => {

package/tests/bongos_login.mjs

@@ -13,7 +13,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
-const { normalizeInstanceBase, pollDecision } = require('../scripts/bongos/login.js');
+const { normalizeInstanceBase, pollDecision, waitTimeoutMessage } = require('../scripts/bongos/login.js');
 const LOGIN_JS = path.join(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..'), 'scripts', 'bongos', 'login.js');
 
 test('normalizeInstanceBase adds https, strips trailing slashes + a pasted /api/bongos', () => {
@@ -38,15 +38,26 @@ test('pollDecision maps the /access-requests/status body to a loop action', () =
   assert.equal(pollDecision({ admitted: true, status: 'invited' }), 'admitted');
   assert.equal(pollDecision({ status: 'invited' }), 'admitted');
   assert.equal(pollDecision({ status: 'member', admitted: true }), 'admitted');
-  assert.equal(pollDecision({ status: 'dismissed' }), 'dismissed');
-  // task 1002969: an invite past its 30 days stops the loop rather than waiting on a shut door
-  assert.equal(pollDecision({ status: 'expired', admitted: false }), 'expired');
+  // task 1003359 (ADR 0217 D4): the probe answers only admitted or not, so the loop
+  // cannot tell a decline or a lapsed invite from a wait — nor can an older
+  // instance's richer answer make it claim to.
+  assert.equal(pollDecision({ status: 'not_admitted', admitted: false }), 'wait');
+  assert.equal(pollDecision({ status: 'dismissed' }), 'wait');
+  assert.equal(pollDecision({ status: 'expired', admitted: false }), 'wait');
   assert.equal(pollDecision({ status: 'pending', admitted: false }), 'wait');
   assert.equal(pollDecision({ status: 'none' }), 'wait');
   assert.equal(pollDecision(null), 'wait');
   assert.equal(pollDecision({}), 'wait');
 });
 
+test('giving up on the wait promises no approval and names who to ask', () => {
+  const msg = waitTimeoutMessage('https://x.example');
+  assert.doesNotMatch(msg, /once an Archon has approved/i, 'a declined person must not be told an approval is coming');
+  assert.match(msg, /waiting longer won.t change/i);
+  assert.match(msg, /owner/i);
+  assert.match(msg, /bongos login https:\/\/x\.example/);
+});
+
 // ---- the Device-Flow dead end (task 1003881) -------------------------------
 //
 // Device Flow is OFF on every GitHub App created from a manifest and GitHub offers no

package/tests/invite_expiry_db.mjs

@@ -141,7 +141,7 @@ try {
     'and says when each invite closes; an application has no such day');
 
   const probe = (await call('GET', '/api/gds/access-requests/status?github_login=fay')).json;
-  ok(probe.status === 'expired' && probe.admitted === false, 'the status probe reports expired, not invited');
+  ok(probe.status === 'not_admitted' && probe.admitted === false, 'the status probe reports not_admitted, not invited (ADR 0217 D4)');
 
   notices = [];
   const again = await call('POST', '/api/gds/access-requests/invite', { github_login: 'fay' });