@bongos/core 1.24.8 → 1.24.10

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 643 operations across 80 resource groups
+- 647 operations across 80 resource groups
 
 ## Use it from your project
 

package/clients/bongos-client/bongos-client.global.js

@@ -771,6 +771,14 @@ function createClient(opts = {}) {
       getMarketWatchRules: (args) => request("GET", "/market-watch/rules", { hasBody: false }, args),
       // POST /market-watch/rules/proposals — rank: any-builder — POST /market-watch/rules/proposals
       postMarketWatchRulesProposals: (args) => request("POST", "/market-watch/rules/proposals", { hasBody: true }, args),
+      // GET /market-watch/settings — rank: metic+archon — GET /market-watch/settings
+      getMarketWatchSettings: (args) => request("GET", "/market-watch/settings", { hasBody: false }, args),
+      // PATCH /market-watch/settings — rank: metic+archon — PATCH /market-watch/settings
+      patchMarketWatchSettings: (args) => request("PATCH", "/market-watch/settings", { hasBody: true }, args),
+      // DELETE /market-watch/settings/key — rank: metic+archon — DELETE /market-watch/settings/key
+      deleteMarketWatchSettingsKey: (args) => request("DELETE", "/market-watch/settings/key", { hasBody: false }, args),
+      // PUT /market-watch/settings/key — rank: metic+archon — PUT /market-watch/settings/key
+      putMarketWatchSettingsKey: (args) => request("PUT", "/market-watch/settings/key", { hasBody: true }, args),
     },
     "me": {
       // GET /me — rank: any-builder — GET /me

package/clients/bongos-client/index.cjs

@@ -770,6 +770,14 @@ function createClient(opts = {}) {
       getMarketWatchRules: (args) => request("GET", "/market-watch/rules", { hasBody: false }, args),
       // POST /market-watch/rules/proposals — rank: any-builder — POST /market-watch/rules/proposals
       postMarketWatchRulesProposals: (args) => request("POST", "/market-watch/rules/proposals", { hasBody: true }, args),
+      // GET /market-watch/settings — rank: metic+archon — GET /market-watch/settings
+      getMarketWatchSettings: (args) => request("GET", "/market-watch/settings", { hasBody: false }, args),
+      // PATCH /market-watch/settings — rank: metic+archon — PATCH /market-watch/settings
+      patchMarketWatchSettings: (args) => request("PATCH", "/market-watch/settings", { hasBody: true }, args),
+      // DELETE /market-watch/settings/key — rank: metic+archon — DELETE /market-watch/settings/key
+      deleteMarketWatchSettingsKey: (args) => request("DELETE", "/market-watch/settings/key", { hasBody: false }, args),
+      // PUT /market-watch/settings/key — rank: metic+archon — PUT /market-watch/settings/key
+      putMarketWatchSettingsKey: (args) => request("PUT", "/market-watch/settings/key", { hasBody: true }, args),
     },
     "me": {
       // GET /me — rank: any-builder — GET /me

package/clients/bongos-client/index.d.ts

@@ -243,6 +243,7 @@ export interface PatchInboxIdBodyRequest { body_md: string }
 export interface PatchInboxIdBodyResponse { ok: boolean; idea: unknown; delta: unknown; unchanged: unknown }
 export interface PatchInboxIdRequest { status?: "open" | "promoted" | "discarded" | "merged"; kind?: string; promoted_to_task_id?: number; reviewed_at?: unknown; merged_into_idea_id?: number; triage_note?: string }
 export interface PatchInboxIdResponse { idea: unknown }
+export interface PatchMarketWatchSettingsRequest { enabled?: unknown; monthly_cap_usd?: unknown; cadence?: unknown }
 export interface PatchMeCoreMoveSeenRequest { id: string }
 export interface PatchMeCoreMoveSeenResponse { ok: boolean; seen: unknown }
 export interface PatchMeCrossProjectRequest { hide_stats?: boolean; account_visibility?: string; recruiter_discoverable?: boolean }
@@ -623,7 +624,7 @@ export interface PostStoreModulesKeyAcquiredRequest { version: string }
 export interface PostStoreModulesKeyAcquiredResponse { ok: boolean; entitlement: unknown }
 export interface PostStoreModulesKeyDelistRequest { reason?: string }
 export interface PostStoreModulesKeyDelistResponse { ok: boolean; module_key: unknown; status: unknown; delisted_at: unknown }
-export interface PostStoreModulesKeyPriceRequest { cents?: unknown; credits?: unknown }
+export interface PostStoreModulesKeyPriceRequest { cents?: number }
 export interface PostStoreModulesKeyPriceResponse { ok: boolean; module_key: unknown; previous: unknown; price: unknown }
 export interface PostStoreModulesKeyVersionsResponse { ok: boolean; created_module: unknown; version: unknown; channel: unknown; category: unknown }
 export interface PostStoreModulesKeyVersionsVersionErrorCountRequest { day: string; count: number }
@@ -680,6 +681,7 @@ export interface PutDoneWhenCriterionIdBackendOnlyResponse { ok: boolean; criter
 export interface PutGovernmentAsksMatterIdResponse { ok: boolean; matter_id: unknown; ask: unknown }
 export interface PutGovernmentRanksRankKeyPermissionsPermissionKeyResponse { ok: boolean; rank_key: unknown; permission_key: unknown; granted: unknown }
 export interface PutGovernmentTreasuryPotsGoalIdRequest { budget_usd?: unknown }
+export interface PutMarketWatchSettingsKeyRequest { key: string }
 export interface PutMingleOptInRequest { opted_in: boolean }
 export interface PutMingleOptInResponse { opted_in: unknown; updated_at: unknown }
 export interface PutMingleProjectRequest { enabled: boolean }
@@ -1395,6 +1397,14 @@ export interface BongosClient {
     getMarketWatchRules(args?: RequestArgs): Promise<ApiResponse>;
     /** POST /market-watch/rules/proposals — rank: any-builder */
     postMarketWatchRulesProposals(args: RequestArgs & { body: PostMarketWatchRulesProposalsRequest }): Promise<PostMarketWatchRulesProposalsResponse>;
+    /** GET /market-watch/settings — rank: metic+archon */
+    getMarketWatchSettings(args?: RequestArgs): Promise<ApiResponse>;
+    /** PATCH /market-watch/settings — rank: metic+archon */
+    patchMarketWatchSettings(args?: RequestArgs & { body?: PatchMarketWatchSettingsRequest }): Promise<ApiResponse>;
+    /** DELETE /market-watch/settings/key — rank: metic+archon */
+    deleteMarketWatchSettingsKey(args?: RequestArgs): Promise<ApiResponse>;
+    /** PUT /market-watch/settings/key — rank: metic+archon */
+    putMarketWatchSettingsKey(args: RequestArgs & { body: PutMarketWatchSettingsKeyRequest }): Promise<ApiResponse>;
   };
   "me": {
     /** GET /me — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -767,6 +767,14 @@ export function createClient(opts = {}) {
       getMarketWatchRules: (args) => request("GET", "/market-watch/rules", { hasBody: false }, args),
       // POST /market-watch/rules/proposals — rank: any-builder — POST /market-watch/rules/proposals
       postMarketWatchRulesProposals: (args) => request("POST", "/market-watch/rules/proposals", { hasBody: true }, args),
+      // GET /market-watch/settings — rank: metic+archon — GET /market-watch/settings
+      getMarketWatchSettings: (args) => request("GET", "/market-watch/settings", { hasBody: false }, args),
+      // PATCH /market-watch/settings — rank: metic+archon — PATCH /market-watch/settings
+      patchMarketWatchSettings: (args) => request("PATCH", "/market-watch/settings", { hasBody: true }, args),
+      // DELETE /market-watch/settings/key — rank: metic+archon — DELETE /market-watch/settings/key
+      deleteMarketWatchSettingsKey: (args) => request("DELETE", "/market-watch/settings/key", { hasBody: false }, args),
+      // PUT /market-watch/settings/key — rank: metic+archon — PUT /market-watch/settings/key
+      putMarketWatchSettingsKey: (args) => request("PUT", "/market-watch/settings/key", { hasBody: true }, args),
     },
     "me": {
       // GET /me — rank: any-builder — GET /me

package/docs/adr/0385-money-lives-with-a-processor-credits-stay-a-project-meter.md

@@ -69,7 +69,7 @@ The owner answered the questions left open by the payments build plan ([task 100
 - **Decision 2, "a project may change or replace it", is narrowed.** For now a project may change and tune the Bongos Standard Credit System's settings. It may not switch credits off, and there is no plug-in formula.
 - **The credit reward stays required by default.** [ADR 0096](0096-require-reward-before-workable.md)'s rule stays on for every new project, not only for projects that pick the standard system.
 - **Decision 3: a project's pay policy lives in the database.** It is changed on the project's settings page, and every change is kept in an audit trail (who, when, what). It does not live in the branding pack. [Task 1004990](https://cloudbongos.com/builders#/task/1004990) builds to this.
-- **Modules already priced in credits are not hidden.** Each author is asked to set a cash price, and the listing stays up meanwhile. [Task 1004989](https://cloudbongos.com/builders#/task/1004989) builds to this. One question is still open. Decision 2 says credits are not spendable as money, so whether an interim listing may still be bought *with credits* (rather than only shown) needs the owner's word before that task ships.
+- **Modules already priced in credits are not hidden.** Each author is asked to set a cash price, and the listing stays up meanwhile. The owner answered the follow-up question on 2026-10-29: an interim credit-priced module stays **visible with a "price coming" note, and it can NOT be bought with credits**. Credits are never spent like money. [Task 1004989](https://cloudbongos.com/builders#/task/1004989) built this: new prices are cash only (the database refuses a credit price on a new row), and old credit prices show as "price coming".
 - **"Verro" is Verro Labs**, the planned holding company of Cloud Bongos LLC and related entities, as now named in the EU labour row above.
 - **ADR 0054's "credits are equity" framing is formally superseded**, as recorded in ADR 0054 itself ([task 1004967](https://cloudbongos.com/builders#/task/1004967)).
 

package/docs/api/openapi.json

@@ -14269,6 +14269,160 @@
         ]
       }
     },
+    "/market-watch/settings": {
+      "get": {
+        "operationId": "get_market_watch_settings",
+        "tags": [
+          "market-watch"
+        ],
+        "summary": "GET /market-watch/settings",
+        "description": "**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/market-watch/routes/settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "patch": {
+        "operationId": "patch_market_watch_settings",
+        "tags": [
+          "market-watch"
+        ],
+        "summary": "PATCH /market-watch/settings",
+        "description": "**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/market-watch/routes/settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PatchMarketWatchSettingsRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/market-watch/settings/key": {
+      "put": {
+        "operationId": "put_market_watch_settings_key",
+        "tags": [
+          "market-watch"
+        ],
+        "summary": "PUT /market-watch/settings/key",
+        "description": "**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/market-watch/routes/settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PutMarketWatchSettingsKeyRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      },
+      "delete": {
+        "operationId": "delete_market_watch_settings_key",
+        "tags": [
+          "market-watch"
+        ],
+        "summary": "DELETE /market-watch/settings/key",
+        "description": "**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `project.settings.manage` (all required).",
+        "x-rank": "metic+archon",
+        "x-source": "modules/market-watch/routes/settings.js",
+        "x-permissions": [
+          "project.settings.manage"
+        ],
+        "responses": {
+          "200": {
+            "description": "Success."
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/me": {
       "get": {
         "operationId": "get_me",
@@ -26132,7 +26286,7 @@
           "store"
         ],
         "summary": "GET /store/modules",
-        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. `?sort=<part>` orders the listed modules by the part a buyer cares about (task 1003800, sortByPart); the parts it accepts come back as sort_parts. Without it the listed modules are ranked quality first, price breaking ties (task 1003808, rankListed); `?max_cents=` / `?max_credits=` leave out modules that cost more. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "description": "The store catalog under the quality floor (task 1003807, ADR 0343 D2/D5): each listed module's newest version, if it passed the Security gate and scores at or above the floor, or under \"new\" if it has no real-world data yet. Below the bar is not listed at all. The floor is fixed in module-listing.js and returned here. `?sort=<part>` orders the listed modules by the part a buyer cares about (task 1003800, sortByPart); the parts it accepts come back as sort_parts. Without it the listed modules are ranked quality first, price breaking ties (task 1003808, rankListed); `?max_cents=` leaves out modules that cost more. rank: any-builder — a read of public store metadata, like /store/modules/latest: no entitlement taken, nothing changed.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
         "x-rank": "any-builder",
         "x-source": "src/bongos/routes/modules.js",
         "responses": {
@@ -26483,7 +26637,7 @@
           "store"
         ],
         "summary": "POST /store/modules/:key/price",
-        "description": "POST /api/bongos/store/modules/:key/price — the module's author sets its price (task 1004894, criterion wa5-module-economy). Body: { cents?, credits? }, each a whole number of 0 or more, or null for \"not offered in that currency\"; at least one is given, and 0 in either is free. Appends a row to the price history; the newest is what the catalog shows and what acquire charges. A paid price may be set before buying exists (owner, 2026-10-26): the catalog marks it not yet buyable. Price never moves the score (ADR 0343 D6). The audit middleware records who changed it and to what. rank: metic+archon — the same gate as publishing (module.submit), plus the author check inside setPrice: only the person who published the module prices it.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
+        "description": "POST /api/bongos/store/modules/:key/price — the module's author sets its price (task 1004894, criterion wa5-module-economy). Body: { cents }, a whole number of 0 or more; 0 is free. A credit price is refused (task 1004989, ADR 0385 decision 2: credits never price or buy a module). Appends a row to the price history; the newest is what the catalog shows and what acquire charges. A paid price may be set before buying exists (owner, 2026-10-26): the catalog marks it not yet buyable. Price never moves the score (ADR 0343 D6). The audit middleware records who changed it and to what. rank: metic+archon — the same gate as publishing (module.submit), plus the author check inside setPrice: only the person who published the module prices it.\n\n**Rank:** `metic+archon` — Metic or Archon rank (review/triage powers).\n\n**Permissions:** `module.submit` (all required).",
         "x-rank": "metic+archon",
         "x-source": "src/bongos/routes/modules.js",
         "x-permissions": [
@@ -33196,6 +33350,15 @@
           "idea"
         ]
       },
+      "PatchMarketWatchSettingsRequest": {
+        "type": "object",
+        "properties": {
+          "enabled": {},
+          "monthly_cap_usd": {},
+          "cadence": {}
+        },
+        "additionalProperties": false
+      },
       "PatchMeCoreMoveSeenRequest": {
         "type": "object",
         "properties": {
@@ -39520,8 +39683,11 @@
       "PostStoreModulesKeyPriceRequest": {
         "type": "object",
         "properties": {
-          "cents": {},
-          "credits": {}
+          "cents": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 100000000
+          }
         },
         "additionalProperties": false
       },
@@ -40500,6 +40666,19 @@
         },
         "additionalProperties": false
       },
+      "PutMarketWatchSettingsKeyRequest": {
+        "type": "object",
+        "properties": {
+          "key": {
+            "type": "string",
+            "maxLength": 512
+          }
+        },
+        "required": [
+          "key"
+        ],
+        "additionalProperties": false
+      },
       "PutMingleOptInRequest": {
         "type": "object",
         "properties": {
@@ -40801,8 +40980,8 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 643,
-  "x-schema-count": 691,
+  "x-endpoint-count": 647,
+  "x-schema-count": 693,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 444,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 643 endpoints across 107 route files.
+> **Generated from the live route files** — the route file is authoritative. 647 endpoints across 108 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust-boundary-server-enforced-permissions.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -520,7 +520,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/llm-cache/lookup` | `metic+archon` | `cache_key`, `tokens_saved_est` | POST /llm-cache/lookup — hit/miss + atomic hit_count bump. |
 | POST | `/api/bongos/llm-cache/store` | `metic+archon` | `spec`, `result_stdout`, `result_cost_usd` | POST /llm-cache/store — upsert a freshly-produced result. |
 
-## `market-watch` (6)
+## `market-watch` (10)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
@@ -530,6 +530,10 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/market-watch/proposals/:id/vote` | `metic+archon` | — | PUT TO A VOTE. |
 | GET | `/api/bongos/market-watch/rules` | `any-builder` | — | every member reads the rules (the task); the read grants nothing. |
 | POST | `/api/bongos/market-watch/rules/proposals` | `any-builder` | `step`, `change`, `reason` | Any signed-in member may propose (the task: "every member can read the page and can propose"). |
+| GET | `/api/bongos/market-watch/settings` | `metic+archon` | — |  |
+| PATCH | `/api/bongos/market-watch/settings` | `metic+archon` | `enabled`, `monthly_cap_usd`, `cadence` |  |
+| PUT | `/api/bongos/market-watch/settings/key` | `metic+archon` | `key` |  |
+| DELETE | `/api/bongos/market-watch/settings/key` | `metic+archon` | — |  |
 
 ## `me` (55)
 
@@ -953,7 +957,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/store/modules/:key/delist` | `metic+archon` | `reason` | POST /api/bongos/store/modules/:key/delist — a Metic+ person takes a module out of the store (task 1003797, ADR 0338 D2). |
 | GET | `/api/bongos/store/modules/:key/entitlement` | `any-builder` | — |  |
 | GET | `/api/bongos/store/modules/:key/listing` | `any-builder` | — | GET /api/bongos/store/modules/:key/listing — whether one module is in the catalog and why (task 1003810): the reason in a sentence, what … |
-| POST | `/api/bongos/store/modules/:key/price` | `metic+archon` | `cents`, `credits` | POST /api/bongos/store/modules/:key/price — the module's author sets its price (task 1004894, criterion wa5-module-economy). |
+| POST | `/api/bongos/store/modules/:key/price` | `metic+archon` | `cents` | POST /api/bongos/store/modules/:key/price — the module's author sets its price (task 1004894, criterion wa5-module-economy). |
 | POST | `/api/bongos/store/modules/:key/versions` | `metic+archon` | _undocumented_ | POST /api/bongos/store/modules/:key/versions — publish one module version to the store (task 1004271, ADR 0338 D1). |
 | GET | `/api/bongos/store/modules/:key/versions/:version/channel` | `any-builder` | — | GET /api/bongos/store/modules/:key/versions/:version/channel — where a version stands on the promotion gate (task 1003804, ADR 0344 D3): … |
 | POST | `/api/bongos/store/modules/:key/versions/:version/error-count` | `any-builder` | `day`, `count` |  |

package/docs/architecture.md

@@ -253,8 +253,8 @@ store_module_versions(id, module_key, version exact X.Y.Z, core_version, manifes
               tree_sha256, tarball_sha256, tarball_bytes, artifact_path, published_by,
               published_at, UNIQUE(module_key, version))  -- immutable; a fix is a new version
 store_module_prices(id, module_key, price_cents, price_credits, set_by, set_at)
-              -- history; newest row per module is current. 0 = free, NULL = not offered
-              -- in that currency, at least one must be set.
+              -- history; newest row per module is current. Cash only since core_287 (task 1004989):
+              -- price_credits is historical, a credit-only newest row reads "price coming". 0 cents = free.
 ```
 
 Passkey foundation (migration `core_277`, task 1004750, [ADR 0382](adr/0382-a-hardware-card-is-a-passkey-step-up-an-archon-switches-on-per-builder.md) D1/D6 — storage only; the ceremonies and routes are their own tasks; code in `src/bongos/passkeys.js`):