@siglume/api-sdk 2.0.5 → 3.1.0

package/README.md

@@ -66,9 +66,8 @@ siglume validate .
 siglume score . --remote
 siglume preflight .         # checks blockers without creating a draft
 siglume register .          # preflight + auto-register + confirm/publish
+siglume register . --private-confirm # confirm release, keep listing hidden for production testing
 siglume register . --draft-only # review-only draft staging
-siglume companies           # list company publishers available to this key
-siglume register . --company company_123
 ```
 
 `siglume register` reads `tool_manual.json`, the local Git-ignored
@@ -77,12 +76,18 @@ Git-ignored because they hold the runtime auth header shared secret. SDK / HTTP
 `source_url`, `source_context`, and `input_form_spec` directly to
 `auto-register`. The CLI runs preflight by default, then calls the same
 `auto-register` route used by SDK / automation clients and confirms publication
-unless `--draft-only` is set. Re-run the same `capability_key` to publish a
-non-material upgrade when checks pass. The server-side publish gate
+unless `--draft-only` is set. Use `--private-confirm` to create the executable
+release while keeping the listing hidden for seller-owned production testing.
+Re-run the same `capability_key` to publish a non-material upgrade when checks pass. The server-side publish gate
 includes runtime checks, contract checks, external OAuth declaration checks, pricing / payout
 rules, and a mandatory fail-closed LLM legal review for law compliance plus
 public-order / morals compliance.
 
+At production runtime, verify your configured runtime auth header first
+(commonly `X-Siglume-Auth`). Then map `X-Siglume-Platform-User-Id` to the
+buyer / agent-owner tenant or token record and use `X-Siglume-Agent-Id` for
+agent-scoped audit. `X-Siglume-Owner-Id` is not a supported runtime header.
+
 ## Usage-Based And Per-Action Billing
 
 For the canonical pricing reference, see
@@ -167,12 +172,6 @@ After live or sandbox execution, inspect receipts with `siglume dev tail`,
 publisher listing view is privacy-redacted. See
 [`../docs/developer-observability.md`](../docs/developer-observability.md).
 
-Company-name publishing is founder-only in the Phase 2 MVP. Use
-`publisher_type: "company"` with `company_id` in `app_manifest.yaml`, or pass
-`--company <company_id>` to the CLI. Paid company listings require the
-company's verified settlement wallet; Siglume does not fall back to the
-registrant's personal payout wallet.
-
 Game APIs use the same publishing flow. To make a listing eligible for the
 dedicated Game API Store entry point, include explicit game-oriented
 `compatibility_tags` in the manifest, for example `["game", "unity",

package/dist/bin/siglume.cjs

@@ -1527,12 +1527,6 @@ function parseListing(data) {
     seller_display_name: stringOrNull(data.seller_display_name),
     seller_homepage_url: stringOrNull(data.seller_homepage_url),
     seller_social_url: stringOrNull(data.seller_social_url),
-    publisher_type: stringOrNull(data.publisher_type),
-    publisher_company_id: stringOrNull(data.publisher_company_id),
-    company_id: stringOrNull(data.company_id),
-    company_name: stringOrNull(data.company_name),
-    company_publish_status: stringOrNull(data.company_publish_status),
-    company_terms_version: stringOrNull(data.company_terms_version),
     review_status: stringOrNull(data.review_status),
     review_note: stringOrNull(data.review_note),
     submission_blockers: Array.isArray(data.submission_blockers) ? data.submission_blockers.filter((item) => typeof item === "string") : [],
@@ -1542,29 +1536,6 @@ function parseListing(data) {
     raw: { ...data }
   };
 }
-function parseCompanyPublisher(data) {
-  const wallets = Array.isArray(data.settlement_wallets) ? data.settlement_wallets.filter((item) => isRecord(item)) : [];
-  return {
-    company_id: String(data.company_id ?? data.id ?? ""),
-    name: String(data.name ?? ""),
-    status: String(data.status ?? ""),
-    description: stringOrNull(data.description),
-    is_founder: Boolean(data.is_founder ?? false),
-    membership_role: stringOrNull(data.membership_role),
-    membership_status: stringOrNull(data.membership_status),
-    can_publish: Boolean(data.can_publish ?? true),
-    can_approve: Boolean(data.can_approve ?? false),
-    approval_required: Boolean(data.approval_required ?? false),
-    paid_listing_allowed: Boolean(data.paid_listing_allowed ?? false),
-    disabled_reasons: Array.isArray(data.disabled_reasons) ? data.disabled_reasons.filter((item) => typeof item === "string") : [],
-    company_terms_version: stringOrNull(data.company_terms_version),
-    active_listing_count: Number(data.active_listing_count ?? 0),
-    pending_approval_count: Number(data.pending_approval_count ?? 0),
-    settlement_wallet_ready: Boolean(data.settlement_wallet_ready ?? false),
-    settlement_wallets: wallets.map((item) => ({ ...item })),
-    raw: { ...data }
-  };
-}
 function parseCapabilitySaveState(data) {
   return {
     capability_key: String(data.capability_key ?? ""),
@@ -2479,9 +2450,6 @@ var init_client = __esm({
           "support_contact",
           "seller_homepage_url",
           "seller_social_url",
-          "publisher_type",
-          "company_id",
-          "publisher_company_id",
           "store_vertical",
           "jurisdiction",
           "price_model",
@@ -2555,25 +2523,6 @@ var init_client = __esm({
             );
           }
         }
-        const explicitPublisherType = payload.publisher_type !== void 0 && payload.publisher_type !== null;
-        const companyId = String(payload.company_id ?? "").trim() || String(payload.publisher_company_id ?? "").trim();
-        const publisherType = String(payload.publisher_type ?? "user").trim().toLowerCase();
-        if (publisherType !== "user" && publisherType !== "company") {
-          throw new SiglumeClientError("AppManifest.publisher_type must be 'user' or 'company'.");
-        }
-        if (publisherType === "company" && !companyId) {
-          throw new SiglumeClientError("AppManifest.company_id is required when publisher_type='company'.");
-        }
-        if (publisherType === "user" && companyId) {
-          throw new SiglumeClientError("AppManifest.company_id cannot be combined with publisher_type='user'.");
-        }
-        if (explicitPublisherType || companyId) {
-          payload.publisher_type = publisherType;
-        }
-        if (companyId) {
-          payload.company_id = companyId;
-          payload.publisher_company_id = companyId;
-        }
         validateManifestPersistenceContract(payload);
         if (payload.manifest && typeof payload.manifest === "object") {
           delete payload.manifest.version;
@@ -2616,8 +2565,12 @@ var init_client = __esm({
         };
       }
       async confirm_registration(listing_id, options = {}) {
-        const { version_bump: versionBump } = options;
+        const { version_bump: versionBump, visibility = "public" } = options;
         const payload = { approved: true };
+        if (visibility !== "public" && visibility !== "private") {
+          throw new Error(`visibility must be one of ["public","private"], got ${JSON.stringify(visibility)}`);
+        }
+        payload.visibility = visibility;
         if (versionBump !== void 0) {
           const allowed = ["patch", "minor", "major"];
           if (!allowed.includes(versionBump)) {
@@ -2635,6 +2588,7 @@ var init_client = __esm({
         return {
           listing_id: String(data.listing_id ?? listing_id),
           status: String(data.status ?? ""),
+          visibility: stringOrNull(data.visibility),
           message: stringOrNull(data.message),
           checklist,
           release: toRecord(data.release),
@@ -2681,25 +2635,6 @@ var init_client = __esm({
         const [data] = await this.request("GET", `/market/capabilities/${listing_id}`);
         return parseListing(data);
       }
-      async list_company_publishers() {
-        const [data] = await this.request("GET", "/market/company-publishers");
-        return Array.isArray(data.items) ? data.items.filter((item) => isRecord(item)).map(parseCompanyPublisher) : [];
-      }
-      async request_company_publish_approval(listing_id, note) {
-        const [data] = await this.request("POST", `/market/capabilities/${listing_id}/company-publish-approval`, {
-          json_body: note ? { note } : {}
-        });
-        return parseListing(data);
-      }
-      async decide_company_publish_approval(listing_id, options) {
-        const [data] = await this.request("POST", `/market/capabilities/${listing_id}/company-publish-approval/decision`, {
-          json_body: {
-            decision: options.decision,
-            ...options.reason ? { reason: options.reason } : {}
-          }
-        });
-        return parseListing(data);
-      }
       async get_capability_state(capability_key, save_key = "default") {
         const [data] = await this.request("GET", `/market/capability-state/${capability_key}/${save_key}`);
         return parseCapabilitySaveState(data);
@@ -6958,12 +6893,7 @@ function ensureManifestPublisherIdentity(project) {
   const sellerHomepageUrl = String(manifestPayload.seller_homepage_url ?? "").trim();
   const sellerSocialUrl = String(manifestPayload.seller_social_url ?? "").trim();
   const jurisdiction = String(manifestPayload.jurisdiction ?? "").trim();
-  const companyId = String(manifestPayload.company_id ?? "").trim() || String(manifestPayload.publisher_company_id ?? "").trim();
-  const publisherType = String(manifestPayload.publisher_type ?? "user").trim().toLowerCase();
   const issues = [];
-  if (companyId && publisherType !== "company") {
-    issues.push('manifest.company_id requires manifest.publisher_type to be "company"');
-  }
   if (!docsUrl) {
     issues.push("manifest.docs_url is required");
   } else if (looksLikePlaceholder(docsUrl)) {
@@ -7123,108 +7053,23 @@ ${errors.map((error) => `- ${error}`).join("\n")}`
   }
   return preflight;
 }
-function companyNameSlug(value) {
-  return value.normalize("NFKD").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-}
 async function runRegistration(path = ".", options = {}, deps = {}) {
   const project = await loadProject(path);
-  let requestedCompanyId = String(options.company_id ?? "").trim();
-  const requestedCompanySlug = String(options.company_slug ?? "").trim();
-  let companyPublisherCandidates = null;
-  if (requestedCompanySlug) {
-    if (requestedCompanyId) {
-      throw new SiglumeProjectError("--company and --company-slug cannot be combined.");
-    }
-    const slug = companyNameSlug(requestedCompanySlug);
-    if (!slug && requestedCompanySlug !== requestedCompanyId) {
-      throw new SiglumeProjectError(`Company slug ${requestedCompanySlug} is not slug-compatible; use --company <company_id> instead.`);
-    }
-  }
-  if (requestedCompanyId) {
-    project.manifest = {
-      ...project.manifest,
-      publisher_type: "company",
-      company_id: requestedCompanyId,
-      publisher_company_id: requestedCompanyId
-    };
-  }
   ensureExplicitToolManual(project);
   ensureManifestPublisherIdentity(project);
   ensureRuntimeValidationReady(project);
   const client = await createClient(deps);
-  if (requestedCompanySlug) {
-    const slug = companyNameSlug(requestedCompanySlug);
-    companyPublisherCandidates = await client.list_company_publishers();
-    const matches = companyPublisherCandidates.filter(
-      (item) => companyNameSlug(item.name || item.company_id) === slug || item.company_id === requestedCompanySlug
-    );
-    if (matches.length === 0) {
-      throw new SiglumeProjectError(`Company slug ${requestedCompanySlug} is not available to this API key.`);
-    }
-    if (matches.length > 1) {
-      throw new SiglumeProjectError(`Company slug ${requestedCompanySlug} is ambiguous; use --company <company_id> instead.`);
-    }
-    const match = matches[0];
-    if (!match) {
-      throw new SiglumeProjectError(`Company slug ${requestedCompanySlug} is not available to this API key.`);
-    }
-    if (match.can_publish === false) {
-      const disabledReasons = match.disabled_reasons ?? [];
-      const reasons = disabledReasons.length > 0 ? disabledReasons.join(", ") : "company publisher is disabled";
-      throw new SiglumeProjectError(`Company ${match.company_id} cannot publish: ${reasons}.`);
-    }
-    requestedCompanyId = match.company_id;
-    project.manifest = {
-      ...project.manifest,
-      publisher_type: "company",
-      company_id: requestedCompanyId,
-      publisher_company_id: requestedCompanyId
-    };
-  }
   const preflight = await registrationPreflight(project, client);
-  let companyPublisherPreflight = null;
-  const companyId = String(project.manifest.company_id ?? "").trim() || String(project.manifest.publisher_company_id ?? "").trim();
-  const publisherType = String(project.manifest.publisher_type ?? "user").toLowerCase();
-  if (publisherType === "company") {
-    if (!companyId) {
-      throw new SiglumeProjectError("Company registration requires --company <company_id> or manifest.company_id.");
-    }
-    const companies = companyPublisherCandidates ?? await client.list_company_publishers();
-    companyPublisherCandidates = companies;
-    const company = companies.find((item) => item.company_id === companyId);
-    if (!company) {
-      throw new SiglumeProjectError(`Company ${companyId} is not available to this API key.`);
-    }
-    if (company.can_publish === false) {
-      const disabledReasons = company.disabled_reasons ?? [];
-      const reasons = disabledReasons.length > 0 ? disabledReasons.join(", ") : "company publisher is disabled";
-      throw new SiglumeProjectError(`Company ${companyId} cannot publish: ${reasons}.`);
-    }
-    companyPublisherPreflight = company;
-  }
   let developerPortalPreflight = null;
   if (String(project.manifest.price_model ?? "free").toLowerCase() !== "free") {
-    if (publisherType === "company") {
-      const company = companyPublisherPreflight;
-      if (!company) {
-        throw new SiglumeProjectError(`Company ${companyId} is not available to this API key.`);
-      }
-      if (company.settlement_wallet_ready !== true) {
-        throw new SiglumeProjectError(
-          `Paid company registration requires a verified company settlement wallet for ${company.name}. Open the company settings and complete settlement readiness before registering.`
-        );
-      }
-      developerPortalPreflight = { company_publisher: toJsonable(company) };
-    } else {
-      const portal = await client.get_developer_portal();
-      const verifiedDestination = portal.payout_readiness?.verified_destination;
-      if (verifiedDestination !== true) {
-        throw new SiglumeProjectError(
-          "Paid API registration requires a verified Polygon payout destination. Open https://siglume.com/owner/credits/payout and confirm the embedded-wallet payout token, or call GET /v1/market/developer/portal until payout_readiness.verified_destination is true."
-        );
-      }
-      developerPortalPreflight = toJsonable(portal);
+    const portal = await client.get_developer_portal();
+    const verifiedDestination = portal.payout_readiness?.verified_destination;
+    if (verifiedDestination !== true) {
+      throw new SiglumeProjectError(
+        "Paid API registration requires a verified Polygon payout destination. Open https://siglume.com/owner/credits/payout and confirm the embedded-wallet payout token, or call GET /v1/market/developer/portal until payout_readiness.verified_destination is true."
+      );
     }
+    developerPortalPreflight = toJsonable(portal);
   }
   const receipt = await client.auto_register(project.manifest, project.tool_manual, {
     runtime_validation: project.runtime_validation
@@ -7239,7 +7084,9 @@ async function runRegistration(path = ".", options = {}, deps = {}) {
   }
   const shouldConfirm = Boolean(options.confirm) || options.confirm === void 0 && !options.draft_only && !options.submit_review;
   if (shouldConfirm) {
-    result.confirmation = toJsonable(await client.confirm_registration(receipt.listing_id));
+    result.confirmation = toJsonable(await client.confirm_registration(receipt.listing_id, {
+      visibility: options.confirm_visibility ?? "public"
+    }));
     if (options.submit_review) {
       result.submit_review_skipped = true;
     }
@@ -7293,14 +7140,6 @@ async function getUsageReport(options, deps = {}) {
     count: items.length
   };
 }
-async function listCompanyPublishersReport(deps = {}) {
-  const client = await createClient(deps);
-  const companies = await client.list_company_publishers();
-  return {
-    companies: companies.map((item) => toJsonable(item)),
-    count: companies.length
-  };
-}
 async function diffJsonFiles(oldPath, newPath) {
   const oldPayload = await loadJsonDocument(oldPath);
   const newPayload = await loadJsonDocument(newPath);
@@ -8369,24 +8208,6 @@ function renderOperationTable(operations) {
     ...rows.map((row) => row.map((cell, index) => cell.padEnd(widths[index] ?? cell.length)).join("  "))
   ];
 }
-function renderCompanyTable(companies) {
-  const rows = companies.map((item) => [
-    String(item.company_id ?? item.id ?? ""),
-    String(item.name ?? ""),
-    String(item.membership_role ?? (item.is_founder ? "founder" : "")),
-    String(item.settlement_wallet_ready === true ? "ready" : "not_ready"),
-    String(item.pending_approval_count ?? 0)
-  ]);
-  const headers = ["company_id", "name", "role", "settlement", "pending"];
-  const widths = headers.map(
-    (header, index) => Math.max(header.length, ...rows.map((row) => row[index]?.length ?? 0))
-  );
-  return [
-    headers.map((header, index) => header.padEnd(widths[index] ?? header.length)).join("  "),
-    widths.map((width) => "-".repeat(width)).join("  "),
-    ...rows.map((row) => row.map((cell, index) => cell.padEnd(widths[index] ?? cell.length)).join("  "))
-  ];
-}
 async function runCli(argv, deps = {}) {
   const stdout = deps.stdout;
   const stderr = deps.stderr ?? console.error;
@@ -8542,42 +8363,44 @@ async function runCli(argv, deps = {}) {
     }
     if (report.runtime_validation_path) emit(stdout, `runtime_validation_path: ${String(report.runtime_validation_path)}`);
   });
-  program.command("companies").description("List Siglume companies available for company-name publishing.").option("--json", "emit machine-readable JSON", false).action(async (options) => {
-    const report = await listCompanyPublishersReport(deps);
-    if (options.json) {
-      emit(stdout, renderJson(report));
-      return;
-    }
-    const companies = Array.isArray(report.companies) ? report.companies.filter((item) => Boolean(item && typeof item === "object")) : [];
-    if (companies.length === 0) {
-      emit(stdout, "No company publishers available for this API key.");
-      return;
-    }
-    emit(stdout, "Company publishers");
-    renderCompanyTable(companies).forEach((line) => emit(stdout, line));
-  });
-  program.command("register").option("--confirm", "explicitly confirm the registration; this is the default unless --draft-only is set", false).option("--draft-only", "create or refresh the draft without confirming publication", false).option("--submit-review", "legacy alias: publish immediately if your environment still routes through submit-review", false).option("--company <companyId>", "publish under a Siglume company name; revenue is split equally among active members", "").option("--company-slug <slug>", "publish under a Siglume company by matching the slugified company name", "").option("--json", "emit machine-readable JSON", false).argument("[path]", ".", "project path").action(async (path, options) => {
+  program.command("register").option("--confirm", "explicitly confirm the registration; this is the default unless --draft-only is set", false).option("--private-confirm", "confirm the registration for private production testing without publishing it", false).option("--draft-only", "create or refresh the draft without confirming publication", false).option("--submit-review", "legacy alias: publish immediately if your environment still routes through submit-review", false).option("--json", "emit machine-readable JSON", false).argument("[path]", ".", "project path").action(async (path, options) => {
     const draftOnly = Boolean(options.draftOnly);
+    const privateConfirm = Boolean(options.privateConfirm);
     if (draftOnly && options.confirm) {
       throw new SiglumeProjectError("--draft-only cannot be combined with --confirm.");
     }
+    if (draftOnly && privateConfirm) {
+      throw new SiglumeProjectError("--draft-only cannot be combined with --private-confirm.");
+    }
+    if (options.confirm && privateConfirm) {
+      throw new SiglumeProjectError("--confirm cannot be combined with --private-confirm.");
+    }
     if (draftOnly && options.submitReview) {
       throw new SiglumeProjectError("--draft-only cannot be combined with --submit-review.");
     }
-    const shouldConfirm = Boolean(options.confirm) || !draftOnly && !options.submitReview;
+    if (privateConfirm && options.submitReview) {
+      throw new SiglumeProjectError("--private-confirm cannot be combined with --submit-review.");
+    }
+    const shouldConfirm = Boolean(options.confirm) || privateConfirm || !draftOnly && !options.submitReview;
     const report = await runRegistration(path, {
       confirm: shouldConfirm,
+      confirm_visibility: privateConfirm ? "private" : "public",
       draft_only: draftOnly,
-      submit_review: options.submitReview,
-      company_id: options.company,
-      company_slug: options.companySlug
+      submit_review: options.submitReview
     }, deps);
+    if (privateConfirm && report.confirmation && !report.confirmation.visibility) {
+      report.confirmation.visibility = "private";
+    }
     if (options.json) {
       emit(stdout, renderJson(report));
     } else {
       const receipt = report.receipt;
-      const published = Boolean(report.confirmation || report.review);
-      if (published && receipt.registration_mode === "upgrade") {
+      const confirmationSummary = report.confirmation;
+      const privatelyConfirmed = confirmationSummary?.visibility === "private";
+      const published = !privatelyConfirmed && Boolean(report.confirmation || report.review);
+      if (privatelyConfirmed) {
+        emit(stdout, "Registration privately confirmed.");
+      } else if (published && receipt.registration_mode === "upgrade") {
         emit(stdout, "Upgrade registered.");
       } else if (published) {
         emit(stdout, "Registration accepted.");
@@ -8596,8 +8419,9 @@ async function runCli(argv, deps = {}) {
       if (receipt.request_id) emit(stdout, `request_id: ${receipt.request_id}`);
       if (report.confirmation) {
         const confirmation = report.confirmation;
-        emit(stdout, "Listing published.");
+        emit(stdout, confirmation.visibility === "private" ? "Listing confirmed privately for production testing." : "Listing published.");
         if (confirmation.status) emit(stdout, `confirmation_status: ${confirmation.status}`);
+        if (confirmation.visibility) emit(stdout, `confirmation_visibility: ${confirmation.visibility}`);
         if (confirmation.release?.release_status) emit(stdout, `release_status: ${confirmation.release.release_status}`);
       } else if (report.review) {
         const review = report.review;