@bongos/core 1.24.8 → 1.24.10

package/tests/market_watch_settings.mjs

@@ -0,0 +1,392 @@
+// tests/market_watch_settings.mjs — the owner's Market Watch settings (task 1004938, goal
+// 1000137): the four routes in modules/market-watch/routes/settings.js, through real HTTP,
+// the route's own owner-seat check and the real error envelope, over an in-memory pool that
+// answers the module's own SQL. The permission atom gate (project.settings.manage, floor
+// metic) is stood in by a fake that admits exactly its floor, since the real one resolves
+// grants from the database; tests/government_parity.mjs proves the real one matches the
+// floor. So a Xenos is refused by the atom and a Metic, who holds it, by the owner seat.
+//
+// What it proves, in the task's words:
+//   - a non-owner cannot change anything: every route answers 403 to a Metic and a Xenos,
+//     and the stored settings and key are unchanged afterwards;
+//   - turning Market Watch off stops the next run, asserted against the run's OWN gate:
+//     run.js runDue reading settings through store.js createStore over the same pool the
+//     route wrote, with the key read back by key.js readProjectKey;
+//   - the key is write-only: stored sealed, opened by the run's reader, and never in any
+//     response, not even its last four characters.
+//
+// No database, no network, no paid call: the run's createRun is stubbed, so a run that
+// passes every pre-check stops there. The SQL runs on real Postgres in
+// tests/market_watch_data_db.mjs (INTEGRATION set).
+//
+// Run:  node tests/market_watch_settings.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import http from 'node:http';
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const api = require('../src/module-api.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const settings = require('../modules/market-watch/settings.js');
+const key = require('../modules/market-watch/key.js');
+const run = require('../modules/market-watch/run.js');
+const store = require('../modules/market-watch/store.js');
+
+const P = 'https://watch.example.test';
+const OTHER = 'https://other.example.test';
+const KEY = 'sk-ant-api03-the-projects-own-key-QX7Z';
+const NOW = Date.parse('2026-10-29T10:00:00Z');
+
+// --- an in-memory pool that answers the module's SQL ----------------------------------
+// Each branch matches ONE statement by a phrase only that statement has; anything else
+// throws, so a new query can never be silently answered by the wrong branch.
+function fakePool() {
+  const rows = new Map(); // project → settings row
+  const runs = [];        // { id, project, status, reason, trigger, created_at, cost_usd, items_total, items_done }
+  const items = [];       // { project, status }
+  const seen = [];
+  const row = (p) => rows.get(p);
+  const ensure = (p) => {
+    if (!rows.has(p)) rows.set(p, { project: p, enabled: false, monthly_cap_usd: '20.00', cadence: 'weekly', anthropic_key_enc: null, anthropic_key_last4: null, anthropic_key_set_at: null, updated_by: null });
+    return rows.get(p);
+  };
+  async function query(sql, params = []) {
+    seen.push(sql);
+    const s = String(sql);
+    const p = params[0];
+    if (/INSERT INTO market_watch_settings \(project, enabled,/.test(s)) {
+      const existed = rows.has(p);
+      const r = ensure(p);
+      const pick = (v, cur, dflt) => (v !== null ? v : existed ? cur : dflt);
+      r.enabled = pick(params[1], r.enabled, params[5]);
+      r.monthly_cap_usd = String(pick(params[2], r.monthly_cap_usd, params[6]));
+      r.cadence = pick(params[3], r.cadence, params[7]);
+      r.updated_by = params[4];
+      return { rows: [{ enabled: r.enabled, monthly_cap_usd: r.monthly_cap_usd, cadence: r.cadence }] };
+    }
+    if (/INSERT INTO market_watch_settings \(project, anthropic_key_enc,/.test(s)) {
+      const r = ensure(p);
+      assert.match(params[1], /^v1\./, 'the stored key is a secret-box blob');
+      assert.equal(params[2].length, 4);
+      Object.assign(r, { anthropic_key_enc: params[1], anthropic_key_last4: params[2], anthropic_key_set_at: 'now', updated_by: params[3] });
+      return { rows: [{ project: p }] };
+    }
+    if (/SET anthropic_key_enc = NULL/.test(s)) {
+      const r = row(p);
+      if (!r || r.anthropic_key_enc === null) return { rows: [] };
+      Object.assign(r, { anthropic_key_enc: null, anthropic_key_last4: null, anthropic_key_set_at: null, updated_by: params[1] });
+      return { rows: [{ project: p }] };
+    }
+    if (/SELECT \(anthropic_key_enc IS NOT NULL\) AS key_set/.test(s)) {
+      return { rows: row(p) ? [{ key_set: row(p).anthropic_key_enc !== null }] : [] };
+    }
+    if (/^SELECT anthropic_key_enc FROM market_watch_settings/.test(s.trim())) {
+      return { rows: row(p) ? [{ anthropic_key_enc: row(p).anthropic_key_enc }] : [] };
+    }
+    if (/^SELECT enabled, monthly_cap_usd, cadence(, updated_by, updated_at)?\s+FROM market_watch_settings/.test(s.trim())) {
+      return { rows: row(p) ? [{ ...row(p) }] : [] };
+    }
+    if (/COALESCE\(sum\(ri\.cost_usd\), 0\) AS spent/.test(s)) {
+      const spent = runs.filter((r) => r.project === p).reduce((n, r) => n + r.cost_usd, 0);
+      return { rows: [{ spent: String(spent) }] };
+    }
+    if (/AS items_done/.test(s)) {
+      return { rows: runs.filter((r) => r.project === p && r.trigger !== 'seed').slice().reverse().slice(0, params[1]).map((r) => ({ ...r, cost_usd: String(r.cost_usd) })) };
+    }
+    if (/count\(\*\)::int AS n FROM market_watch_items/.test(s)) {
+      return { rows: [{ n: items.filter((i) => i.project === p && i.status === 'active').length }] };
+    }
+    if (/^SELECT created_at FROM market_watch_runs/.test(s.trim())) {
+      const mine = runs.filter((r) => r.project === p);
+      return { rows: mine.length ? [{ created_at: mine[mine.length - 1].created_at }] : [] };
+    }
+    throw new Error(`fake pool: unexpected SQL ${s.slice(0, 80)}`);
+  }
+  return { query, rows, runs, items, seen };
+}
+
+// The secret box, faked so a test can see that the route sealed the key and the run's
+// reader opened it. A route must never decrypt: the box counts every decrypt.
+let decrypts = 0;
+let configured = true;
+const box = {
+  isConfigured: () => configured,
+  encrypt: (s) => `v1.iv.tag.${Buffer.from(s).toString('base64url')}`,
+  decrypt: (b) => { decrypts += 1; return Buffer.from(b.split('.')[3], 'base64url').toString(); },
+};
+
+// --- the app: real envelope, the route's owner seat, a stubbed session and atom --------
+let viewer = null;
+Object.defineProperty(api, 'requireBuilder', {
+  configurable: true,
+  value: (req, res, next) => {
+    if (!viewer) return res.fail('unauthenticated', 401);
+    req.builder = viewer;
+    next();
+  },
+});
+// The atom gate, at the catalog floor it names: read from catalog.js, not retyped here.
+const catalog = require('../modules/government/catalog.js');
+const atomsAsked = [];
+Object.defineProperty(api, 'requirePermission', {
+  configurable: true,
+  value: (...atoms) => {
+    atomsAsked.push(...atoms);
+    return (req, res, next) => {
+      const ok = atoms.every((a) => {
+        const p = catalog.PERMISSIONS.find((x) => x.key === a);
+        return p && api.rankMeetsThreshold(req.builder && req.builder.rank, [p.floor]);
+      });
+      return ok ? next() : res.fail('permission_forbidden', 403);
+    };
+  },
+});
+const quiet = { info() {}, warn() {}, error() {}, debug() {}, child() { return quiet; } };
+Object.defineProperty(api, 'logger', { configurable: true, value: () => quiet });
+
+const pool = fakePool();
+const express = require('express');
+const app = express();
+app.use(attachFail);
+app.use(express.json());
+const buildRouter = require('../modules/market-watch/routes/settings.js');
+app.use('/api/bongos', buildRouter({ pool, project: P, secretBox: box, now: () => NOW, ceilingUsd: 0.27 }));
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const raw = Buffer.concat(chunks).toString(); let parsed = null; try { parsed = JSON.parse(raw); } catch (_) { /* not json */ } resolve({ status: res.statusCode, raw, body: parsed }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+const OWNER = { id: 1, rank: 'archon' };
+const METIC = { id: 2, rank: 'metic' };
+const XENOS = { id: 3, rank: 'xenos' };
+const as = (who) => { viewer = who; };
+
+// The run, with its own gate: settings through store.js over the SAME pool, the key
+// through key.js readProjectKey. Everything past the pre-checks is stubbed, so a run that
+// would start is recorded as `started` and nothing is ever researched or paid for.
+async function nextTick() {
+  const real = store.createStore(pool);
+  const started = [];
+  const skipped = [];
+  const r = await run.runDue({
+    project: P,
+    now: () => NOW,
+    store: {
+      ...real,
+      openRun: async () => null,
+      lastRun: async () => null,
+      monthSpend: async () => 0,
+      activeRules: async () => ({ id: 1 }),
+      insertSkipped: async (project, o) => { skipped.push(o.reason); return 900 + skipped.length; },
+      createRun: async () => { started.push(true); return null; },
+    },
+    readKey: (project) => key.readProjectKey(pool, project, { decrypt: box.decrypt }),
+    ceilingUsd: 0.27,
+    createClient: () => { throw new Error('no client may be built in this test'); },
+    warn: () => {},
+  });
+  return { r, started: started.length > 0, skipped };
+}
+
+const ROUTES = [
+  ['GET', '/market-watch/settings', undefined],
+  ['PATCH', '/market-watch/settings', { enabled: false }],
+  ['PUT', '/market-watch/settings/key', { key: 'sk-ant-api03-somebody-elses-key-0000' }],
+  ['DELETE', '/market-watch/settings/key', undefined],
+];
+
+// ---------------------------------------------------------------------------------------
+
+test('no session: every route answers 401', async () => {
+  as(null);
+  for (const [m, p, b] of ROUTES) assert.equal((await call(m, p, b)).status, 401, `${m} ${p}`);
+});
+
+test('the owner turns it on, sets the cap and the cadence, and pastes the key', async () => {
+  as(OWNER);
+  const first = await call('GET', '/market-watch/settings');
+  assert.equal(first.status, 200);
+  assert.equal(first.body.enabled, false, 'off until the owner turns it on');
+  assert.equal(first.body.key_set, false);
+  const on = await call('PATCH', '/market-watch/settings', { enabled: true, monthly_cap_usd: 30, cadence: 'biweekly' });
+  assert.equal(on.status, 200, on.raw);
+  assert.deepEqual([on.body.enabled, on.body.monthly_cap_usd, on.body.cadence], [true, 30, 'biweekly']);
+  const k = await call('PUT', '/market-watch/settings/key', { key: KEY });
+  assert.equal(k.status, 200, k.raw);
+  assert.equal(k.body.key_set, true);
+  assert.equal(pool.rows.get(P).updated_by, OWNER.id);
+  // A one-field change keeps the others.
+  const cap = await call('PATCH', '/market-watch/settings', { monthly_cap_usd: 25 });
+  assert.deepEqual([cap.body.enabled, cap.body.monthly_cap_usd, cap.body.cadence], [true, 25, 'biweekly']);
+});
+
+test('a non-owner gets 403 from every route, and nothing changes', async () => {
+  const before = JSON.stringify(pool.rows.get(P));
+  // A Xenos lacks the atom; a Metic holds it and is refused by the owner seat.
+  for (const [who, code] of [[METIC, 'rank_forbidden'], [XENOS, 'permission_forbidden']]) {
+    as(who);
+    for (const [m, p, b] of ROUTES) {
+      const res = await call(m, p, b);
+      assert.equal(res.status, 403, `${who.rank} ${m} ${p}: ${res.raw}`);
+      assert.equal(res.body.error.code, code, `${who.rank} ${m} ${p}`);
+    }
+  }
+  assert.deepEqual([...new Set(atomsAsked)], ['project.settings.manage']);
+  assert.equal(JSON.stringify(pool.rows.get(P)), before, 'a refused write left the settings and the key as they were');
+});
+
+test('with the watch on and a key set, the next run starts', async () => {
+  const { r, started, skipped } = await nextTick();
+  assert.equal(started, true, JSON.stringify(r));
+  assert.deepEqual(skipped, []);
+});
+
+test('a non-owner cannot turn it off: the run still starts', async () => {
+  as(METIC);
+  assert.equal((await call('PATCH', '/market-watch/settings', { enabled: false })).status, 403);
+  const { started } = await nextTick();
+  assert.equal(started, true);
+});
+
+test('turning Market Watch off stops the next run (the run records it skipped: off)', async () => {
+  as(OWNER);
+  const off = await call('PATCH', '/market-watch/settings', { enabled: false });
+  assert.equal(off.status, 200);
+  assert.equal(off.body.enabled, false);
+  assert.deepEqual(off.body.next_run, { state: 'paused', due_at: null });
+  const { r, started, skipped } = await nextTick();
+  assert.equal(started, false, 'no run started');
+  assert.deepEqual([r.outcome, r.reason], ['skipped', 'off']);
+  assert.deepEqual(skipped, ['off']);
+  // On again, and it runs again.
+  await call('PATCH', '/market-watch/settings', { enabled: true });
+  assert.equal((await nextTick()).started, true);
+});
+
+test('the key is stored sealed, opened by the run\'s reader, and never sent back', async () => {
+  as(OWNER);
+  decrypts = 0;
+  const blob = pool.rows.get(P).anthropic_key_enc;
+  assert.ok(blob.startsWith('v1.') && !blob.includes(KEY), 'sealed, not plaintext');
+  for (const [m, p, b] of [['GET', '/market-watch/settings'], ['PATCH', '/market-watch/settings', { cadence: 'weekly' }], ['PUT', '/market-watch/settings/key', { key: KEY }]]) {
+    const res = await call(m, p, b);
+    assert.equal(res.status, 200);
+    assert.ok(!res.raw.includes(KEY), `${m} ${p} returned the key`);
+    assert.ok(!res.raw.includes(KEY.slice(-4)), `${m} ${p} returned the key's last four`);
+    assert.ok(!res.raw.includes('anthropic_key'), `${m} ${p} named a key column`);
+  }
+  assert.equal(decrypts, 0, 'no route decrypts the key');
+  assert.equal(await key.readProjectKey(pool, P, { decrypt: box.decrypt }), KEY, 'the run reads exactly what the owner pasted');
+});
+
+test('clearing the key stops the next run with no_key; replacing it brings it back', async () => {
+  as(OWNER);
+  const cleared = await call('DELETE', '/market-watch/settings/key');
+  assert.equal(cleared.status, 200);
+  assert.equal(cleared.body.key_set, false);
+  assert.equal(await key.readProjectKey(pool, P, { decrypt: box.decrypt }), null);
+  const { r, started } = await nextTick();
+  assert.equal(started, false);
+  assert.equal(r.reason, 'no_key');
+  const replaced = await call('PUT', '/market-watch/settings/key', { key: `${KEY}-2` });
+  assert.equal(replaced.body.key_set, true);
+  assert.equal(await key.readProjectKey(pool, P, { decrypt: box.decrypt }), `${KEY}-2`);
+  assert.equal((await nextTick()).started, true);
+});
+
+test('bad input is refused with 400 and changes nothing', async () => {
+  as(OWNER);
+  const before = JSON.stringify(pool.rows.get(P));
+  for (const body of [{}, { enabled: 'yes' }, { monthly_cap_usd: 0 }, { monthly_cap_usd: 5000 }, { monthly_cap_usd: '20' }, { cadence: 'daily' }, { enabled: true, colour: 'red' }]) {
+    const res = await call('PATCH', '/market-watch/settings', body);
+    assert.equal(res.status, 400, JSON.stringify(body));
+  }
+  for (const body of [{}, { key: 'short' }, { key: 'sk-ant-api03 with spaces in it' }, { key: 42 }]) {
+    const res = await call('PUT', '/market-watch/settings/key', body);
+    assert.equal(res.status, 400, JSON.stringify(body));
+    assert.ok(!res.raw.includes('with spaces'), 'a refused key is not echoed');
+  }
+  assert.equal(JSON.stringify(pool.rows.get(P)), before);
+});
+
+test('no key storage on the project: the key is refused with 409, never stored in the clear', async () => {
+  as(OWNER);
+  configured = false;
+  try {
+    const res = await call('PUT', '/market-watch/settings/key', { key: KEY });
+    assert.equal(res.status, 409);
+    assert.equal(res.body.error.code, 'storage_not_configured');
+  } finally { configured = true; }
+});
+
+test('another project\'s settings are never read or written', async () => {
+  assert.equal(pool.rows.has(OTHER), false);
+  for (const sql of pool.seen) assert.ok(!sql.includes(OTHER));
+});
+
+test('the view: spend, runs of fuel left, the next run, and recent runs with skipped ones marked', async () => {
+  as(OWNER);
+  const day = (d) => new Date(Date.parse('2026-10-01T09:00:00Z') + d * 86_400_000).toISOString();
+  pool.runs.push(
+    { id: 1, project: P, status: 'done', reason: null, trigger: 'seed', created_at: day(0), cost_usd: 0, items_total: 0, items_done: 0 },
+    { id: 2, project: P, status: 'done', reason: null, trigger: 'poller', created_at: day(7), cost_usd: 3, items_total: 33, items_done: 33 },
+    { id: 3, project: P, status: 'skipped', reason: 'cap_reached', trigger: 'poller', created_at: day(14), cost_usd: 0, items_total: 0, items_done: 0 },
+    { id: 4, project: P, status: 'done', reason: null, trigger: 'poller', created_at: day(23), cost_usd: 3.2, items_total: 35, items_done: 35 },
+  );
+  await call('PATCH', '/market-watch/settings', { enabled: true, monthly_cap_usd: 20, cadence: 'weekly' });
+  const v = (await call('GET', '/market-watch/settings')).body;
+  assert.equal(v.spent_this_month_usd, 6.2);
+  assert.equal(v.left_this_month_usd, 13.8);
+  assert.equal(v.month, 'october');
+  assert.equal(v.run_estimate_usd, 3.1);
+  assert.equal(v.run_estimate_basis, 'recent');
+  assert.equal(v.runs_left, 4);
+  assert.deepEqual(v.next_run, { state: 'scheduled', due_at: new Date(Date.parse(day(23)) + 7 * 86_400_000).toISOString() });
+  assert.deepEqual(v.recent_runs.map((r) => [r.id, r.status, r.reason]), [[4, 'done', null], [3, 'skipped', 'cap_reached'], [2, 'done', null]], 'newest first, the seed run hidden');
+  assert.deepEqual(v.cadences, ['weekly', 'biweekly', 'monthly']);
+});
+
+// --- pure ---------------------------------------------------------------------------
+
+test('runEstimate: recent runs first, else every active item at its ceiling, else nothing', () => {
+  assert.deepEqual(settings.runEstimate([{ status: 'done', cost_usd: 2 }, { status: 'skipped', cost_usd: 0 }, { status: 'partial', cost_usd: 4 }], 10, 0.27), { usd: 3, basis: 'recent' });
+  assert.deepEqual(settings.runEstimate([], 10, 0.27), { usd: 2.7, basis: 'ceiling' });
+  assert.deepEqual(settings.runEstimate([], 0, 0.27), { usd: null, basis: 'none' });
+});
+
+test('nextRun: paused when off, soon when due, else the date', () => {
+  const now = Date.parse('2026-10-29T00:00:00Z');
+  assert.deepEqual(settings.nextRun(false, '2026-10-28T00:00:00Z', 'weekly', now), { state: 'paused', due_at: null });
+  assert.deepEqual(settings.nextRun(true, null, 'weekly', now), { state: 'soon', due_at: null });
+  assert.deepEqual(settings.nextRun(true, '2026-10-01T00:00:00Z', 'weekly', now), { state: 'soon', due_at: null });
+  assert.equal(settings.nextRun(true, '2026-10-28T00:00:00Z', 'biweekly', now).due_at, '2026-11-11T00:00:00.000Z');
+});
+
+// --- the wall is on every route, not just the ones above -------------------------------
+
+test('every route in the settings router mounts requireBuilder, the atom, then the owner seat', () => {
+  const src = readFileSync(new URL('../modules/market-watch/routes/settings.js', import.meta.url), 'utf8');
+  const routes = [...src.matchAll(/router\.(get|post|put|patch|delete)\(\s*'([^']+)'\s*,([^\n]*)/g)];
+  assert.equal(routes.length, ROUTES.length, 'a new route joins ROUTES above, so its 403 is tested');
+  for (const [, m, p, rest] of routes) {
+    assert.match(rest, /^\s*api\.requireBuilder,\s*api\.requirePermission\('project\.settings\.manage'\),\s*ownerSeat,/, `${m.toUpperCase()} ${p}`);
+    assert.ok(ROUTES.some(([rm, rp]) => rm === m.toUpperCase() && rp === p), `${m.toUpperCase()} ${p} is in ROUTES`);
+  }
+});

package/tests/module_store_cli.mjs

@@ -133,8 +133,8 @@ test('the same query through both: a sort and a maximum price give the same modu
   for (const [args, query] of [
     [['--sort', 'tests'], { sort: 'tests' }],
     [['--max-cents', '500'], { max_cents: '500' }],
-    [['--max-credits', '0'], { max_credits: '0' }],
-    [['--sort', 'docs', '--max-cents', '1000', '--max-credits', '100'], { sort: 'docs', max_cents: '1000', max_credits: '100' }],
+    [['--max-cents', '0'], { max_cents: '0' }],
+    [['--sort', 'docs', '--max-cents', '1000'], { sort: 'docs', max_cents: '1000' }],
   ]) {
     const api = (await apiGet(query)).body;
     const cli = await cliJson(args);
@@ -144,6 +144,15 @@ test('the same query through both: a sort and a maximum price give the same modu
   }
 });
 
+test('there is no maximum in credits, in the CLI or the API (task 1004989)', async () => {
+  seed();
+  const errs = [];
+  const never = async () => { throw new Error('must not be called'); };
+  assert.equal(await mod.cmdStore(['--max-credits', '100'], { log: () => {}, errlog: (l) => errs.push(l), request: never }), 2);
+  assert.match(errs.join('\n'), /credits do not price modules/);
+  assert.equal((await apiGet({ max_credits: '100' })).statusCode, 400);
+});
+
 test('the text view keeps the API order: listed ranked, then New, and says the floor and the cap', async () => {
   seed();
   const api = (await apiGet({})).body;
@@ -158,7 +167,9 @@ test('the text view keeps the API order: listed ranked, then New, and says the f
   assert.equal(at('stripe-10'), -1, 'the eleventh is not shown');
   assert.match(text, /stripe-00@1\.0\.0 {2}99\/100 {2}free {2}Money › Stripe payments/);
   assert.match(text, /stripe-01@1\.0\.0 {2}98\/100 {2}\$9\.00/);
-  assert.match(text, /loose@1\.0\.0 {2}88\/100 {2}40 credits \(not yet buyable\)$/m, 'no category, no place; paid is not yet buyable (task 1004894)');
+  assert.match(text, /loose@1\.0\.0 {2}88\/100 {2}price coming \(not yet buyable\)$/m,
+    'an old credit-only price shows as price coming, never as credits (task 1004989); no category, no place');
+  assert.doesNotMatch(text, /\d credits/, 'no credit price anywhere in the text view');
   assert.match(text, /waiting@1\.0\.0 {2}60\/100 {2}free {2}Money$/m, 'a proposed sub-category shows its parent only');
   assert.match(text, /New — not ranked[\s\S]*fresh@1\.0\.0/);
 });

package/tests/module_store_listing.mjs

@@ -347,11 +347,27 @@ test('the criterion: two modules with the same overall score read differently',
 // the ranking: quality first, price breaks ties, optional max price (task 1003808)
 // ---------------------------------------------------------------------------
 
-test('priceOf: no price row is free; 0 in either currency is free; null is not offered', () => {
-  assert.deepEqual(priceOf(null), { cents: null, credits: null, free: true });
-  assert.deepEqual(priceOf({ price_cents: 0, price_credits: null }), { cents: 0, credits: null, free: true });
-  assert.deepEqual(priceOf({ price_cents: 500, price_credits: 0 }), { cents: 500, credits: 0, free: true });
-  assert.deepEqual(priceOf({ price_cents: 500, price_credits: null }), { cents: 500, credits: null, free: false });
+test('priceOf: no price row is free; a cash price of 0 is free; never a credit amount', () => {
+  assert.deepEqual(priceOf(null), { cents: null, free: true, coming: false });
+  assert.deepEqual(priceOf({ price_cents: 0, price_credits: null }), { cents: 0, free: true, coming: false });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: null }), { cents: 500, free: false, coming: false });
+});
+
+// Task 1004989 (ADR 0385 decision 2; owner, 2026-10-29): OLD rows may carry a
+// credit price. They are read, never shown as a credit price, and never buyable
+// with credits.
+test('priceOf on old credit rows: credit-only is "price coming", 0 credits stays free, cash wins', () => {
+  assert.deepEqual(priceOf({ price_cents: null, price_credits: 40 }), { cents: null, free: false, coming: true },
+    'a module priced only in credits is still listed, with its cash price coming');
+  assert.deepEqual(priceOf({ price_cents: null, price_credits: 0 }), { cents: null, free: true, coming: false },
+    'an old 0-credit offer stays free: no credit moves to have it');
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: 0 }), { cents: 500, free: true, coming: false },
+    'an old row offered at 0 credits stays free, as it was');
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: 40 }), { cents: 500, free: false, coming: false },
+    'with a cash price the credit amount is ignored');
+  for (const row of [{ price_credits: 40 }, { price_cents: 500, price_credits: 40 }]) {
+    assert.equal('credits' in priceOf(row), false, 'no credit amount leaves priceOf');
+  }
 });
 
 test('rankListed: a higher score always wins, whatever it costs — price never buys a place', () => {
@@ -362,7 +378,7 @@ test('rankListed: a higher score always wins, whatever it costs — price never
   assert.deepEqual(ranked.map((e) => e.key), ['dear', 'cheap']);
 });
 
-test('rankListed: between equal scores, free first, then lowest cash, then lowest credits, then key', () => {
+test('rankListed: between equal scores, free first, then lowest cash, a price still coming last, then key', () => {
   const input = [
     { key: 'z-credits', overall: 80, price: priceOf({ price_credits: 5 }) },
     { key: 'cents-900', overall: 80, price: priceOf({ price_cents: 900 }) },
@@ -374,14 +390,14 @@ test('rankListed: between equal scores, free first, then lowest cash, then lowes
   assert.equal(input[0].key, 'z-credits', 'the input is untouched');
 });
 
-test('withinMaxPrice: free always passes; a priced module must be offered at or under a cap the buyer set', () => {
+test('withinMaxPrice: free always passes; a priced module must cost at or under the cash cap', () => {
   const p = priceOf({ price_cents: 500, price_credits: 7 });
   assert.equal(withinMaxPrice(p, null), true, 'no cap, no filter');
-  assert.equal(withinMaxPrice(p, { cents: 500, credits: null }), true, 'at the cap is in');
-  assert.equal(withinMaxPrice(p, { cents: 499, credits: null }), false);
-  assert.equal(withinMaxPrice(p, { cents: 1, credits: 7 }), true, 'either currency under its cap is enough');
-  assert.equal(withinMaxPrice(priceOf({ price_cents: 500 }), { cents: null, credits: 100 }), false, 'not offered in credits, so a credit cap cannot let it in');
-  assert.equal(withinMaxPrice(priceOf(null), { cents: 0, credits: null }), true);
+  assert.equal(withinMaxPrice(p, { cents: 500 }), true, 'at the cap is in');
+  assert.equal(withinMaxPrice(p, { cents: 499 }), false);
+  assert.equal(withinMaxPrice(p, { cents: 1, credits: 7 }), false, 'a credit cap is ignored: credits never price a module');
+  assert.equal(withinMaxPrice(priceOf({ price_credits: 7 }), { cents: 100000 }), false, 'a price still coming has no cash price to compare');
+  assert.equal(withinMaxPrice(priceOf(null), { cents: 0 }), true);
 });
 
 test('GET /store/modules: ranks by score then price, and ?max_cents= leaves out what costs more', async () => {
@@ -416,7 +432,7 @@ test('GET /store/modules: ranks by score then price, and ?max_cents= leaves out
   assert.equal(all.body.max_price, null);
 
   const capped = await invoke(handle, { query: { max_cents: '1000' } });
-  assert.deepEqual(capped.body.max_price, { cents: 1000, credits: null });
+  assert.deepEqual(capped.body.max_price, { cents: 1000 });
   assert.deepEqual(capped.body.listed.map((m) => m.key), ['tie-free', 'tie-paid']);
   assert.deepEqual(capped.body.new, [], 'the cap applies to New modules too');
 
@@ -427,13 +443,48 @@ test('GET /store/modules: ranks by score then price, and ?max_cents= leaves out
 
 test('GET /store/modules: a maximum price that is not a whole number of 0 or more is refused', async () => {
   const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
-  for (const query of [{ max_cents: '-1' }, { max_cents: '5.5' }, { max_credits: 'ten' }, { max_cents: ['1', '2'] }]) {
+  for (const query of [{ max_cents: '-1' }, { max_cents: '5.5' }, { max_cents: ['1', '2'] }]) {
     const res = await invoke(handle, { query });
     assert.equal(res.statusCode, 400, JSON.stringify(query));
     assert.match(res.body.message, /maximum price/);
   }
 });
 
+test('GET /store/modules: there is no maximum in credits (task 1004989)', async () => {
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  for (const query of [{ max_credits: '100' }, { max_credits: 'ten' }, { max_cents: '500', max_credits: '1' }]) {
+    const res = await invoke(handle, { query });
+    assert.equal(res.statusCode, 400, JSON.stringify(query));
+    assert.match(res.body.message, /Credits do not price modules/);
+  }
+});
+
+test('GET /store/modules: an old credit-only price is listed as "price coming", never as credits, and not buyable', async () => {
+  state.modules = { legacy: { status: 'listed', title: 'Legacy' }, cash: { status: 'listed', title: 'Cash' } };
+  state.versions = [
+    { id: 41, module_key: 'legacy', version: '1.0.0', published_at: 't' },
+    { id: 42, module_key: 'cash', version: '1.0.0', published_at: 't' },
+  ];
+  state.scores = [
+    { id: 41, version_id: 41, computed_at: 1, ...score({ overall: 80 }) },
+    { id: 42, version_id: 42, computed_at: 1, ...score({ overall: 80 }) },
+  ];
+  state.signals = [];
+  state.prices = [
+    { module_key: 'legacy', price_cents: null, price_credits: 40, set_at: 1 },
+    { module_key: 'cash', price_cents: 900, price_credits: null, set_at: 1 },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const res = await invoke(handle, { query: {} });
+  const legacy = res.body.listed.find((m) => m.key === 'legacy');
+  assert.ok(legacy, 'a credit-priced module stays visible (owner, 2026-10-29)');
+  assert.deepEqual(legacy.price, { cents: null, free: false, coming: true });
+  assert.equal(legacy.buyable, false, 'credits never buy it');
+  assert.doesNotMatch(JSON.stringify(res.body), /credits/, 'no credit price appears anywhere in the catalog');
+  assert.deepEqual(res.body.listed.map((m) => m.key), ['cash', 'legacy'], 'between equal scores a price still coming sorts after a cash price');
+  state.prices = [];
+});
+
 // ---------------------------------------------------------------------------
 // why a module is or is not listed (task 1003810)
 // ---------------------------------------------------------------------------