@stigmer/cli 3.0.8

package/local/runtime/runner.js

@@ -0,0 +1,154 @@
+// Resolution and on-demand acquisition of the unified runner.
+//
+// The runner is launched as a compiled `node main.js`, never `tsx src/main.ts`:
+// the runner bundles its Temporal workflows on boot and that bundling fails under
+// tsx on the raw-.ts proto stubs, which is exactly why the conformance and e2e
+// harnesses run `node dist/main.js`. Requiring the build is correctness.
+//
+// Two acquisition sources, tried in order:
+//   1. A repo-tree runner (dev) or an explicit STIGMER_RUNNER_DIR — `dist/main.js`.
+//   2. The already-published `@stigmer/runner-slim`, installed on demand into
+//      ~/.stigmer/runtimes/<version>/ — `node_modules/@stigmer/runner-slim/main.js`.
+//
+// (2) deliberately reuses the slim esbuild bundle the desktop already ships
+// (stigmer/stigmer#170): one CJS `main.js` plus the few unbundlable native deps,
+// with the correct `@stigmer/runner-slim-<platform>` package selected by npm via
+// optionalDependencies/os/cpu — ~85 MB instead of the full ~508 MB install. The
+// launch contract (`node main.js`) is identical to the repo-tree runner, so the
+// daemon spawns either the same way.
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CliExitError } from "../../errors/cli-exit-error.js";
+import { ExitCode } from "../../errors/exit-codes.js";
+import { log } from "../../logger.js";
+import { VERSION } from "../../version.js";
+import { runtimesDir } from "../paths.js";
+import { resolveNode } from "./node.js";
+const SLIM_PACKAGE = "@stigmer/runner-slim";
+/**
+ * Ensure a launchable runner, acquiring `@stigmer/runner-slim` on demand if no
+ * repo-tree / STIGMER_RUNNER_DIR runner is present. Throws actionable guidance on
+ * a missing build, an invalid override, or a non-release CLI build.
+ */
+export function ensureRunner(opts = {}) {
+    const node = opts.node ?? resolveNode;
+    const local = resolveRunner(node);
+    if (local !== null)
+        return local;
+    return acquireRunner({ ...opts, node });
+}
+/**
+ * Resolve a repo-tree runner (dev) or an explicit STIGMER_RUNNER_DIR, or null
+ * when neither is present (the caller then acquires the slim package). Throws
+ * when an override is set but invalid, or when a found runner is not built — both
+ * are actionable user-facing conditions, not a reason to silently download.
+ * `node` is injectable for tests.
+ */
+export function resolveRunner(node = resolveNode) {
+    const override = process.env.STIGMER_RUNNER_DIR;
+    if (override !== undefined && override !== "") {
+        if (!hasPackageJson(override)) {
+            throw new CliExitError(`STIGMER_RUNNER_DIR is not a runner package: ${override}`, ExitCode.General, [
+                "Point STIGMER_RUNNER_DIR at the @stigmer/runner package directory (the one with package.json).",
+            ]);
+        }
+        return resolveBuiltRunner(override, node);
+    }
+    const root = repoRoot();
+    if (root !== null) {
+        const candidate = join(root, "backend", "services", "runner");
+        if (hasPackageJson(candidate))
+            return resolveBuiltRunner(candidate, node);
+    }
+    return null;
+}
+/**
+ * Acquire the published `@stigmer/runner-slim@<version>` into
+ * ~/.stigmer/runtimes/<version>/ (idempotent: reuses a prior install) and resolve
+ * its `main.js` entry. The version is pinned to the CLI's own version so the
+ * runner's protos/SDK stay in lockstep with the control plane.
+ */
+export function acquireRunner(opts = {}) {
+    const home = opts.home ?? homedir();
+    const version = opts.version ?? VERSION;
+    if (!isAcquirableRelease(version)) {
+        throw new CliExitError(`cannot acquire ${SLIM_PACKAGE} for a non-release build (${version})`, ExitCode.General, [
+            "Run from the repo with a built runner, or set STIGMER_RUNNER_DIR.",
+            "On-demand acquisition is only available for published releases.",
+        ]);
+    }
+    const node = opts.node ?? resolveNode;
+    const installDir = join(runtimesDir(home), version);
+    const entryPath = join(installDir, "node_modules", "@stigmer", "runner-slim", "main.js");
+    if (!existsSync(entryPath)) {
+        log.info(`acquiring ${SLIM_PACKAGE}`, { version, dir: installDir });
+        mkdirSync(installDir, { recursive: true });
+        // A stable package.json root makes the install deterministic and records the
+        // pinned dependency rather than letting npm synthesize an ad-hoc root.
+        writeFileSync(join(installDir, "package.json"), `${JSON.stringify({ name: "stigmer-runtime", private: true, version: "0.0.0" }, null, 2)}\n`);
+        const install = opts.install ?? installRunnerSlim;
+        install(installDir, `${SLIM_PACKAGE}@${version}`);
+    }
+    if (!existsSync(entryPath)) {
+        throw new CliExitError(`${SLIM_PACKAGE} install did not produce ${entryPath}`, ExitCode.General, [
+            "The install may have skipped the platform-native package for this OS/arch.",
+            `Remove ${installDir} and retry, or set STIGMER_RUNNER_DIR to a built runner.`,
+        ]);
+    }
+    return { nodeBin: node(), entryPath, appDir: dirname(entryPath) };
+}
+// Install the slim package (plus its platform-native optional dependency) into an
+// isolated prefix. `--omit=dev` drops devDependencies while keeping the optional
+// native package npm selects by os/cpu; output is inherited so the user sees the
+// one-time download progress.
+function installRunnerSlim(installDir, spec) {
+    try {
+        execFileSync("npm", ["install", spec, "--prefix", installDir, "--omit=dev", "--no-audit", "--no-fund"], {
+            stdio: "inherit",
+        });
+    }
+    catch (err) {
+        throw new CliExitError(`failed to install ${spec}`, ExitCode.General, [
+            `Command: npm install ${spec} --prefix ${installDir}`,
+            "Ensure npm is on PATH and the network is reachable.",
+            String(err),
+        ]);
+    }
+}
+function resolveBuiltRunner(appDir, node) {
+    const entryPath = join(appDir, "dist", "main.js");
+    if (!existsSync(entryPath)) {
+        throw new CliExitError(`runner not built: ${entryPath} is missing`, ExitCode.General, [
+            "Build it with: npm run build -w @stigmer/protos && npm run build -w @stigmer/runner",
+            "The runner must be compiled — it cannot run from source via tsx (Temporal",
+            "workflow bundling fails on raw-.ts proto stubs).",
+        ]);
+    }
+    return { nodeBin: node(), entryPath, appDir };
+}
+// A source build reports "0.0.0-dev" and the dev npm channel stamps "<v>-dev.<stamp>"
+// versions; neither publishes a matching @stigmer/runner-slim, so they are not
+// acquirable. Release and rc/next versions are.
+function isAcquirableRelease(version) {
+    return !version.includes("-dev");
+}
+function hasPackageJson(dir) {
+    return existsSync(join(dir, "package.json"));
+}
+// Walk up from this module to a repo root containing backend/services/runner.
+function repoRoot() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 10; i += 1) {
+        if (existsSync(join(dir, "backend", "services", "runner", "package.json")))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+//# sourceMappingURL=runner.js.map

package/local/runtime/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/local/runtime/runner.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,yEAAyE;AACzE,EAAE;AACF,2CAA2C;AAC3C,oFAAoF;AACpF,8EAA8E;AAC9E,qFAAqF;AACrF,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,qCAAqC;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,YAAY,GAAG,sBAAsB,CAAC;AAsB5C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4B,EAAE;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,aAAa,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB,WAAW;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,YAAY,CAAC,+CAA+C,QAAQ,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAClG,gGAAgG;aACjG,CAAC,CAAC;QACL,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,cAAc,CAAC,SAAS,CAAC;YAAE,OAAO,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,OAA4B,EAAE;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC,kBAAkB,YAAY,6BAA6B,OAAO,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE;YAC9G,mEAAmE;YACnE,iEAAiE;SAClE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAEzF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,aAAa,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACpE,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,6EAA6E;QAC7E,uEAAuE;QACvE,aAAa,CACX,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAChC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7F,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC;QAClD,OAAO,CAAC,UAAU,EAAE,GAAG,YAAY,IAAI,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CAAC,GAAG,YAAY,4BAA4B,SAAS,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE;YAC/F,4EAA4E;YAC5E,UAAU,UAAU,0DAA0D;SAC/E,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,kFAAkF;AAClF,iFAAiF;AACjF,iFAAiF;AACjF,8BAA8B;AAC9B,SAAS,iBAAiB,CAAC,UAAkB,EAAE,IAAY;IACzD,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE;YACtG,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,qBAAqB,IAAI,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE;YACpE,wBAAwB,IAAI,aAAa,UAAU,EAAE;YACrD,qDAAqD;YACrD,MAAM,CAAC,GAAG,CAAC;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,IAAkB;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,YAAY,CAAC,qBAAqB,SAAS,aAAa,EAAE,QAAQ,CAAC,OAAO,EAAE;YACpF,qFAAqF;YACrF,2EAA2E;YAC3E,kDAAkD;SACnD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,sFAAsF;AACtF,+EAA+E;AAC/E,gDAAgD;AAChD,SAAS,mBAAmB,CAAC,OAAe;IAC1C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,SAAS,QAAQ;IACf,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACvF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/local/runtime/server.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Find an already-present `stigmer-server` binary, or null. Pure: never
+ * downloads. `home` is injectable for tests.
+ */
+export declare function resolveServerBinary(home?: string): string | null;
+export interface EnsureServerOptions {
+    home?: string;
+    /** Release version to download if needed (defaults to the CLI's own version). */
+    version?: string;
+    /** Override the fetch implementation (tests). */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Ensure a `stigmer-server` binary is available, returning its path. Reuses an
+ * existing binary if found; otherwise downloads the pinned release asset into
+ * ~/.stigmer/bin (checksum-verified). Throws actionable guidance when no binary
+ * exists and a download is not possible (a source/dev build, or an unsupported
+ * platform).
+ */
+export declare function ensureServerBinary(opts?: EnsureServerOptions): Promise<string>;
+export interface ServerDownloadTarget {
+    /** Release version, e.g. "0.5.0" or "0.5.0-rc.1" (with or without a leading "v"). */
+    version: string;
+    /** Absolute path to write the extracted `stigmer-server` binary to. */
+    binPath: string;
+    /** Node platform (defaults to process.platform). */
+    platform?: NodeJS.Platform;
+    /** Node arch (defaults to process.arch). */
+    arch?: string;
+    /** Override the fetch implementation (tests). */
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Download, checksum-verify, and install the standalone `stigmer-server` release
+ * asset. Throws a {@link CliExitError} on an unsupported platform or any
+ * network/checksum/extraction failure.
+ */
+export declare function downloadServerBinary(target: ServerDownloadTarget): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/local/runtime/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/local/runtime/server.ts"],"names":[],"mappings":"AAsCA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,GAAG,IAAI,CAK3E;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAaxF;AAED,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBtF"}

package/local/runtime/server.js

@@ -0,0 +1,141 @@
+// Resolution and on-demand acquisition of the `stigmer-server` control plane.
+//
+// DD-003: a TypeScript CLI cannot `go:embed` a Go binary, so it resolves an
+// existing `stigmer-server` (dev build / Homebrew / a prior download) and, when
+// none is present, downloads the standalone release asset into ~/.stigmer/bin and
+// verifies its sha256 before first use. The fetch/extract mechanics are shared
+// with the Temporal downloader (`../artifact.ts`); the one deliberate difference
+// is the checksum step — this is our own executable, and DD-003 makes integrity
+// non-negotiable.
+//
+// Resolution order (first existing hit wins; download is the last resort):
+//   1. STIGMER_SERVER_BIN — explicit override (tests, custom installs)
+//   2. repo `bin/stigmer-server` — the dev build (`make build`)
+//   3. ~/bin/stigmer-server — a common local install location
+//   4. ~/.stigmer/bin/stigmer-server — a previously-downloaded release asset
+//   5. PATH — `stigmer-server`
+//   6. download the pinned release asset into ~/.stigmer/bin (checksum-verified)
+import { existsSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CliExitError } from "../../errors/cli-exit-error.js";
+import { ExitCode } from "../../errors/exit-codes.js";
+import { VERSION } from "../../version.js";
+import { fetchTarballBinary, mapReleaseArch, mapReleaseOs } from "../artifact.js";
+import { binDir } from "../paths.js";
+import { which } from "./which.js";
+const SERVER_BINARY = "stigmer-server";
+const GITHUB_REPO = "stigmer/stigmer";
+// Platform/arch combos for which `release.cli.yaml` publishes a stigmer-server
+// asset. The npm CLI installs on more platforms than this (e.g. linux-arm64,
+// Windows), so an unsupported `stigmer up` must fail with clear guidance rather
+// than a confusing 404.
+const SUPPORTED_PLATFORMS = new Set(["darwin-arm64", "darwin-amd64", "linux-amd64"]);
+/**
+ * Find an already-present `stigmer-server` binary, or null. Pure: never
+ * downloads. `home` is injectable for tests.
+ */
+export function resolveServerBinary(home = homedir()) {
+    for (const candidate of serverCandidates(home)) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return which(SERVER_BINARY);
+}
+/**
+ * Ensure a `stigmer-server` binary is available, returning its path. Reuses an
+ * existing binary if found; otherwise downloads the pinned release asset into
+ * ~/.stigmer/bin (checksum-verified). Throws actionable guidance when no binary
+ * exists and a download is not possible (a source/dev build, or an unsupported
+ * platform).
+ */
+export async function ensureServerBinary(opts = {}) {
+    const home = opts.home ?? homedir();
+    const existing = resolveServerBinary(home);
+    if (existing !== null)
+        return existing;
+    const version = opts.version ?? VERSION;
+    if (!isDownloadableRelease(version)) {
+        throw notFoundError();
+    }
+    const binPath = join(binDir(home), SERVER_BINARY);
+    await downloadServerBinary({ version, binPath, fetchImpl: opts.fetchImpl });
+    return binPath;
+}
+/**
+ * Download, checksum-verify, and install the standalone `stigmer-server` release
+ * asset. Throws a {@link CliExitError} on an unsupported platform or any
+ * network/checksum/extraction failure.
+ */
+export async function downloadServerBinary(target) {
+    const os = mapReleaseOs(target.platform ?? process.platform);
+    const arch = mapReleaseArch(target.arch ?? process.arch);
+    const platformKey = `${os}-${arch}`;
+    if (!SUPPORTED_PLATFORMS.has(platformKey)) {
+        throw unsupportedPlatformError(platformKey);
+    }
+    const tag = releaseTag(target.version);
+    const archive = `${SERVER_BINARY}-${tag}-${platformKey}.tar.gz`;
+    const url = `https://github.com/${GITHUB_REPO}/releases/download/${tag}/${archive}`;
+    await fetchTarballBinary({
+        url,
+        checksumUrl: `${url}.sha256`,
+        entryName: SERVER_BINARY,
+        binPath: target.binPath,
+        label: SERVER_BINARY,
+        fetchImpl: target.fetchImpl,
+    });
+}
+function serverCandidates(home) {
+    const candidates = [];
+    const override = process.env.STIGMER_SERVER_BIN;
+    if (override !== undefined && override !== "")
+        candidates.push(override);
+    const root = repoRoot();
+    if (root !== null)
+        candidates.push(join(root, "bin", SERVER_BINARY));
+    candidates.push(join(home, "bin", SERVER_BINARY));
+    candidates.push(join(binDir(home), SERVER_BINARY)); // a previously-downloaded asset
+    return candidates;
+}
+// Only tagged releases publish a downloadable asset. A source build reports the
+// "0.0.0-dev" sentinel and the dev npm channel stamps "<v>-dev.<stamp>" versions
+// (release.dev.yaml) that never cut a GitHub release — neither is downloadable.
+function isDownloadableRelease(version) {
+    return !version.includes("-dev");
+}
+// The npm package version maps to the GitHub release tag by prefixing "v"
+// (npm 0.5.0 -> tag v0.5.0; npm 0.5.0-rc.1 -> tag v0.5.0-rc.1).
+function releaseTag(version) {
+    return version.startsWith("v") ? version : `v${version}`;
+}
+function notFoundError() {
+    return new CliExitError(`${SERVER_BINARY} binary not found`, ExitCode.General, [
+        "Build it from the repo with `make build` (produces ./bin/stigmer-server),",
+        "or set STIGMER_SERVER_BIN to an existing binary.",
+        "Automatic download is only available for tagged releases.",
+    ]);
+}
+function unsupportedPlatformError(platformKey) {
+    return new CliExitError(`the local stack does not support this platform (${platformKey})`, ExitCode.General, [
+        "`stigmer up` needs a stigmer-server release asset, which is published for",
+        "macOS (arm64/amd64) and Linux (amd64) only.",
+        "Point STIGMER_SERVER_BIN at a server binary you built yourself to proceed.",
+    ]);
+}
+// Walk up from this module to the repo root (the directory containing
+// `bin/stigmer-server` in a dev checkout). Returns null outside a checkout.
+function repoRoot() {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0; i < 8; i += 1) {
+        if (existsSync(join(dir, "bin", SERVER_BINARY)))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return null;
+}
+//# sourceMappingURL=server.js.map

package/local/runtime/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/local/runtime/server.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,gFAAgF;AAChF,kFAAkF;AAClF,+EAA+E;AAC/E,iFAAiF;AACjF,gFAAgF;AAChF,kBAAkB;AAClB,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,gEAAgE;AAChE,8DAA8D;AAC9D,6EAA6E;AAC7E,+BAA+B;AAC/B,iFAAiF;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,wBAAwB;AACxB,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAErF;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,OAAO,EAAE;IAC1D,KAAK,MAAM,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC,aAAa,CAAC,CAAC;AAC9B,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA4B,EAAE;IACrE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IAEvC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IACxC,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,aAAa,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IAClD,MAAM,oBAAoB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,OAAO,OAAO,CAAC;AACjB,CAAC;AAeD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAA4B;IACrE,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1C,MAAM,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,aAAa,IAAI,GAAG,IAAI,WAAW,SAAS,CAAC;IAChE,MAAM,GAAG,GAAG,sBAAsB,WAAW,sBAAsB,GAAG,IAAI,OAAO,EAAE,CAAC;IAEpF,MAAM,kBAAkB,CAAC;QACvB,GAAG;QACH,WAAW,EAAE,GAAG,GAAG,SAAS;QAC5B,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEzE,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IACxB,IAAI,IAAI,KAAK,IAAI;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IACrE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;IAClD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,gCAAgC;IACpF,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,SAAS,qBAAqB,CAAC,OAAe;IAC5C,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED,0EAA0E;AAC1E,gEAAgE;AAChE,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,YAAY,CAAC,GAAG,aAAa,mBAAmB,EAAE,QAAQ,CAAC,OAAO,EAAE;QAC7E,2EAA2E;QAC3E,kDAAkD;QAClD,2DAA2D;KAC5D,CAAC,CAAC;AACL,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACnD,OAAO,IAAI,YAAY,CAAC,mDAAmD,WAAW,GAAG,EAAE,QAAQ,CAAC,OAAO,EAAE;QAC3G,2EAA2E;QAC3E,6CAA6C;QAC7C,4EAA4E;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,4EAA4E;AAC5E,SAAS,QAAQ;IACf,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/local/runtime/which.d.ts

@@ -0,0 +1,3 @@
+/** Resolve an executable by name via PATH, or null if not found. */
+export declare function which(name: string): string | null;
+//# sourceMappingURL=which.d.ts.map

package/local/runtime/which.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"which.d.ts","sourceRoot":"","sources":["../../../src/local/runtime/which.ts"],"names":[],"mappings":"AASA,oEAAoE;AACpE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAUjD"}

package/local/runtime/which.js

@@ -0,0 +1,30 @@
+// Minimal PATH lookup, the Node analogue of Go's exec.LookPath.
+//
+// Scans the PATH entries for an executable file. POSIX-focused (the local stack
+// targets macOS and Linux); on those platforms a name with no separator is
+// resolved against PATH, and an absolute/relative path is checked directly.
+import { accessSync, constants } from "node:fs";
+import { delimiter, isAbsolute, join, sep } from "node:path";
+/** Resolve an executable by name via PATH, or null if not found. */
+export function which(name) {
+    if (name.includes(sep) || isAbsolute(name)) {
+        return isExecutable(name) ? name : null;
+    }
+    const entries = (process.env.PATH ?? "").split(delimiter).filter((e) => e !== "");
+    for (const dir of entries) {
+        const candidate = join(dir, name);
+        if (isExecutable(candidate))
+            return candidate;
+    }
+    return null;
+}
+function isExecutable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=which.js.map

package/local/runtime/which.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"which.js","sourceRoot":"","sources":["../../../src/local/runtime/which.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,2EAA2E;AAC3E,4EAA4E;AAE5E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAE7D,oEAAoE;AACpE,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,YAAY,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAChD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/local/seedpack/apply.d.ts

@@ -0,0 +1,43 @@
+import type { Stigmer } from "@stigmer/sdk";
+import type { ControllerFn } from "../../resources/apply/handlers.js";
+import { type SeedpackContent } from "./content.js";
+export interface SeedpackApplyDeps {
+    /** Raw command-controller accessor (full-proto apply, preserves metadata.id). */
+    readonly controller: ControllerFn;
+    /** High-level client for skill push + post-apply MCP discovery. */
+    readonly stigmer: Stigmer;
+    /** Human progress lines (stderr). */
+    readonly info: (line: string) => void;
+    /** Warnings (stderr). */
+    readonly warn: (line: string) => void;
+}
+export interface SeedpackApplyOptions {
+    /** Directory holding the idempotency marker (data dir for local, config dir for cloud). */
+    readonly markerDir: string;
+    /** Target org slug. Defaults to STIGMER_SEEDPACK_ORG, then "stigmer". */
+    readonly org?: string;
+    /** Re-apply even when the content hash is unchanged. */
+    readonly force?: boolean;
+    /** Pre-resolved content (injectable for tests); resolved on demand otherwise. */
+    readonly content?: SeedpackContent;
+    readonly home?: string;
+}
+export interface SeedpackApplyResult {
+    /** True when the seedpack was applied; false when skipped as up to date. */
+    readonly applied: boolean;
+    /** The current content hash (stored in the marker on a successful apply). */
+    readonly hash: string;
+    /** The resolved target org. */
+    readonly org: string;
+}
+/** Resolve the target org: explicit option > env var > "stigmer". */
+export declare function resolveSeedpackOrg(explicit?: string): string;
+/** Compute the current seedpack content hash without applying (drives `status`). */
+export declare function seedpackContentHash(opts?: Pick<SeedpackApplyOptions, "content" | "home">): string;
+/**
+ * Apply the seedpack to the backend the deps connect to. Returns `applied:false`
+ * (without touching the backend) when the marker already matches the content
+ * hash and `force` is not set.
+ */
+export declare function applySeedpack(deps: SeedpackApplyDeps, opts: SeedpackApplyOptions): Promise<SeedpackApplyResult>;
+//# sourceMappingURL=apply.d.ts.map

package/local/seedpack/apply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.d.ts","sourceRoot":"","sources":["../../../src/local/seedpack/apply.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAKL,KAAK,eAAe,EAErB,MAAM,cAAc,CAAC;AAKtB,MAAM,WAAW,iBAAiB;IAChC,iFAAiF;IACjF,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC;IAClC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,oBAAoB;IACnC,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,GAAG,MAAM,CAAM,GAAG,MAAM,CAGrG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsBrH"}

package/local/seedpack/apply.js

@@ -0,0 +1,94 @@
+// In-process seedpack apply.
+//
+// The TS equivalent of Go's seedpackbootstrap.Apply, with one deliberate
+// improvement: instead of shelling out to `stigmer apply` as a subprocess, this
+// drives the same in-process declarative-apply path that `stigmer apply` uses —
+// one code path, no recursion guard, no second process.
+//
+// Two phases respect the resource hierarchy (mirrors the Go bootstrap):
+//   1. organizations/ via file mode — the org must exist before its members.
+//   2. the project (stigmer.yaml + agents/skills/mcp-servers/workflows) via the
+//      declarative reconciler, under the target org.
+//
+// Idempotent: a content-hash marker skips the apply when nothing changed.
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { applyItem, resolveApplyItems } from "../../resources/apply/apply.js";
+import { applyDeclarative, detectTrack } from "../../resources/apply/declarative.js";
+import { extractSeedpack, hashSeedpackContent, readMarker, resolveSeedpackContent, writeMarker, } from "./content.js";
+const DEFAULT_ORG = "stigmer";
+const ORG_ENV_VAR = "STIGMER_SEEDPACK_ORG";
+/** Resolve the target org: explicit option > env var > "stigmer". */
+export function resolveSeedpackOrg(explicit) {
+    if (explicit !== undefined && explicit !== "")
+        return explicit;
+    const env = process.env[ORG_ENV_VAR];
+    if (env !== undefined && env !== "")
+        return env;
+    return DEFAULT_ORG;
+}
+/** Compute the current seedpack content hash without applying (drives `status`). */
+export function seedpackContentHash(opts = {}) {
+    const content = opts.content ?? resolveSeedpackContent({ home: opts.home });
+    return hashSeedpackContent(content.dir);
+}
+/**
+ * Apply the seedpack to the backend the deps connect to. Returns `applied:false`
+ * (without touching the backend) when the marker already matches the content
+ * hash and `force` is not set.
+ */
+export async function applySeedpack(deps, opts) {
+    const org = resolveSeedpackOrg(opts.org);
+    const content = opts.content ?? resolveSeedpackContent({ home: opts.home });
+    const hash = hashSeedpackContent(content.dir);
+    if (opts.force !== true && readMarker(opts.markerDir) === hash) {
+        return { applied: false, hash, org };
+    }
+    deps.info("Applying system resources (seedpack)…");
+    const stage = mkdtempSync(join(tmpdir(), "stigmer-seedpack-"));
+    try {
+        extractSeedpack(content.dir, stage);
+        await applyOrganizations(deps, stage);
+        await applyProject(deps, stage, org);
+        writeMarker(opts.markerDir, hash);
+    }
+    finally {
+        rmSync(stage, { recursive: true, force: true });
+    }
+    deps.info("System resources applied successfully");
+    return { applied: true, hash, org };
+}
+// Phase 1: organizations via file mode. Organizations sit above the project and
+// carry no org context themselves, so they apply with an empty org.
+async function applyOrganizations(deps, stageDir) {
+    const orgDir = join(stageDir, "organizations");
+    let items;
+    try {
+        items = resolveApplyItems(orgDir);
+    }
+    catch {
+        return; // No organizations to apply.
+    }
+    for (const item of items) {
+        const outcome = await applyItem(deps.controller, item, "", false);
+        if (outcome.warning !== undefined)
+            deps.warn(outcome.warning);
+    }
+}
+// Phase 2: the project (agents, skills, MCP servers, workflows) via the shared
+// declarative reconciler — the same path `stigmer apply` runs for a user project.
+async function applyProject(deps, stageDir, org) {
+    const detect = detectTrack(stageDir);
+    if (detect.track !== "declarative") {
+        throw new Error(`seedpack is not a declarative project (detected '${detect.track}')`);
+    }
+    await applyDeclarative(detect, {
+        controller: deps.controller,
+        stigmer: deps.stigmer,
+        org,
+        info: deps.info,
+        warn: deps.warn,
+    });
+}
+//# sourceMappingURL=apply.js.map

package/local/seedpack/apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/local/seedpack/apply.ts"],"names":[],"mappings":"AAAA,6BAA6B;AAC7B,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,gFAAgF;AAChF,qDAAqD;AACrD,EAAE;AACF,0EAA0E;AAE1E,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAErF,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,UAAU,EACV,sBAAsB,EAEtB,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,MAAM,WAAW,GAAG,SAAS,CAAC;AAC9B,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAkC3C,qEAAqE;AACrE,MAAM,UAAU,kBAAkB,CAAC,QAAiB;IAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC/D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAChD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,OAAuD,EAAE;IAC3F,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,OAAO,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAuB,EAAE,IAA0B;IACrF,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE9C,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC;QACH,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACrC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,oEAAoE;AACpE,KAAK,UAAU,kBAAkB,CAAC,IAAuB,EAAE,QAAgB;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC/C,IAAI,KAA2C,CAAC;IAChD,IAAI,CAAC;QACH,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,6BAA6B;IACvC,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,kFAAkF;AAClF,KAAK,UAAU,YAAY,CAAC,IAAuB,EAAE,QAAgB,EAAE,GAAW;IAChF,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,oDAAoD,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,gBAAgB,CAAC,MAAM,EAAE;QAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG;QACH,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;AACL,CAAC"}

package/local/seedpack/content.d.ts

@@ -0,0 +1,56 @@
+/**
+ * The canonical seedpack entries, in apply-safe order. Kept in sync with
+ * `SEEDPACK_ENTRIES` in `@stigmer/seedpack` and the `//go:embed` set in
+ * `seedpack/embed.go` — `tools/`, `icons/`, and `canary/` (CI canary metadata,
+ * not a resource) are deliberately excluded so the content set (and thus the
+ * idempotency hash) is identical across delivery paths.
+ */
+export declare const SEEDPACK_ENTRIES: readonly ["stigmer.yaml", "organizations", "skills", "agents", "workflows", "mcp-servers"];
+/** Marker file recording the last successfully-applied content hash. */
+export declare const MARKER_FILE = ".seedpack-bootstrapped";
+export interface SeedpackContent {
+    /** Absolute path to the content root (holds stigmer.yaml). */
+    readonly dir: string;
+    /** Where the content came from — surfaced in diagnostics. */
+    readonly source: "repo" | "package";
+}
+export interface ResolveSeedpackOptions {
+    home?: string;
+    /** Release version of @stigmer/seedpack to acquire (defaults to the CLI version). */
+    version?: string;
+    /** npm install implementation (injectable for tests). */
+    install?: (installDir: string, spec: string) => void;
+}
+/**
+ * Resolve the seedpack content directory: a repo-tree checkout in dev, else the
+ * on-demand-acquired `@stigmer/seedpack` package. Throws actionable guidance when
+ * acquisition is not possible (non-release build, or a failed/incomplete install).
+ */
+export declare function resolveSeedpackContent(opts?: ResolveSeedpackOptions): SeedpackContent;
+/**
+ * Acquire the published `@stigmer/seedpack@<version>` into
+ * ~/.stigmer/runtimes/<version>/ (idempotent) and return its package directory.
+ * The version is pinned to the CLI's own version so system content stays in
+ * lockstep with the control plane it bootstraps.
+ */
+export declare function acquireSeedpack(opts?: ResolveSeedpackOptions): string;
+/**
+ * Deterministic SHA-256 over the canonical content, identical to
+ * `@stigmer/seedpack`'s `contentHash` (and the Go algorithm): files walked in
+ * lexical order, each contributing its forward-slash relative path, a NUL, and
+ * its bytes. Used as the idempotency marker.
+ */
+export declare function hashSeedpackContent(dir: string): string;
+/**
+ * Copy the canonical entries from `srcDir` into `destDir`, producing a clean
+ * Stigmer project the declarative-apply path can process directly (never
+ * carrying build tooling or assets that happen to sit beside the content).
+ */
+export declare function extractSeedpack(srcDir: string, destDir: string): void;
+/** Lexically-sorted, forward-slash relative paths of every file under the canonical entries. */
+export declare function listContentFiles(root: string): string[];
+/** The stored marker hash for `markerDir`, or null when never applied. */
+export declare function readMarker(markerDir: string): string | null;
+/** Persist the applied content hash so a future run can skip unchanged content. */
+export declare function writeMarker(markerDir: string, hash: string): void;
+//# sourceMappingURL=content.d.ts.map

package/local/seedpack/content.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../src/local/seedpack/content.ts"],"names":[],"mappings":"AAiCA;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,4FAOnB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,WAAW,2BAA2B,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACtD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,sBAA2B,GAAG,eAAe,CAIzF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,GAAG,MAAM,CAiCzE;AAkBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrE;AAID,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBvD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3D;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGjE"}