@stigmer/cli 3.11.1-dev.20260812192248 → 3.12.1

package/src/resources/apply/apply.test.ts

@@ -0,0 +1,134 @@
+// Unit tests for the shared apply core's declared-visibility follow-up
+// (oss#573). Plain updates preserve stored visibility on both editions, so
+// the apply RPC's response carries the STORED level; when a manifest
+// declares a different one, the core must land it through the guarded
+// updateVisibility RPC — or warn when the kind has no such door.
+
+import { create, type Message } from "@bufbuild/protobuf";
+import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import type { UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { describe, expect, it } from "vitest";
+import { applyMessage } from "./apply.js";
+import type { ApplyHandler, ControllerFn } from "./handlers.js";
+
+// The controller accessor is only ever forwarded to handler methods, which
+// these tests stub out — a throwing dummy proves nothing else touches it.
+const controller: ControllerFn = () => {
+  throw new Error("unexpected controller access");
+};
+
+function agent(visibility: ApiResourceVisibility, id = "agent-1") {
+  return create(AgentSchema, {
+    metadata: { id, name: "a", org: "acme", visibility },
+    spec: { instructions: "i" },
+  });
+}
+
+interface HandlerOptions {
+  applyReturns: Message;
+  updateVisibility?: (input: UpdateVisibilityInput) => Promise<Message>;
+}
+
+function handlerWith(opts: HandlerOptions): { handler: ApplyHandler; calls: UpdateVisibilityInput[] } {
+  const calls: UpdateVisibilityInput[] = [];
+  const handler: ApplyHandler = {
+    kind: ApiResourceKind.agent,
+    displayName: "Agent",
+    schema: AgentSchema,
+    applyOrder: 3,
+    apply: () => Promise.resolve(opts.applyReturns),
+    ...(opts.updateVisibility !== undefined && {
+      updateVisibility: (_c: ControllerFn, input: UpdateVisibilityInput) => {
+        calls.push(input);
+        return opts.updateVisibility!(input);
+      },
+    }),
+  };
+  return { handler, calls };
+}
+
+describe("applyMessage declared-visibility follow-up", () => {
+  it("lands a declared level the update preserved away, and reflects it on the outcome", async () => {
+    // Server preserved stored org; manifest declares public.
+    const { handler, calls } = handlerWith({
+      applyReturns: agent(ApiResourceVisibility.visibility_org),
+      updateVisibility: () => Promise.resolve(agent(ApiResourceVisibility.visibility_public)),
+    });
+
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false);
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0].resourceId).toBe("agent-1");
+    expect(calls[0].visibility).toBe(ApiResourceVisibility.visibility_public);
+    expect(outcome.warning).toBeUndefined();
+    const appliedMeta = (outcome.applied as { metadata?: { visibility?: ApiResourceVisibility } })?.metadata;
+    expect(appliedMeta?.visibility).toBe(ApiResourceVisibility.visibility_public);
+  });
+
+  it("skips the follow-up when the manifest omits visibility", async () => {
+    const { handler, calls } = handlerWith({
+      applyReturns: agent(ApiResourceVisibility.visibility_org),
+      updateVisibility: () => Promise.reject(new Error("must not be called")),
+    });
+
+    const outcome = await applyMessage(
+      controller,
+      handler,
+      agent(ApiResourceVisibility.api_resource_visibility_unspecified),
+      "acme",
+      false,
+    );
+
+    expect(calls).toHaveLength(0);
+    expect(outcome.warning).toBeUndefined();
+  });
+
+  it("skips the follow-up when the server already matches (idempotent re-apply)", async () => {
+    const { handler, calls } = handlerWith({
+      applyReturns: agent(ApiResourceVisibility.visibility_public),
+      updateVisibility: () => Promise.reject(new Error("must not be called")),
+    });
+
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false);
+
+    expect(calls).toHaveLength(0);
+    expect(outcome.warning).toBeUndefined();
+  });
+
+  it("warns instead of silently swallowing a diff on kinds without the RPC", async () => {
+    const { handler } = handlerWith({
+      applyReturns: agent(ApiResourceVisibility.visibility_private),
+    });
+
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false);
+
+    expect(outcome.warning).toMatch(/visibility cannot be changed declaratively/);
+    expect(outcome.warning).toMatch(/stored value is kept/);
+  });
+
+  it("fails loudly when the guarded door rejects, naming the partial state", async () => {
+    // e.g. the default-instance FAILED_PRECONDITION or an unsupported level.
+    const { handler } = handlerWith({
+      applyReturns: agent(ApiResourceVisibility.visibility_org),
+      updateVisibility: () => Promise.reject(new Error("default instances do not have their own visibility")),
+    });
+
+    await expect(
+      applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false),
+    ).rejects.toThrow(/spec applied, but the manifest's visibility change was rejected/);
+  });
+
+  it("does not follow up in dry-run mode", async () => {
+    const { handler, calls } = handlerWith({
+      applyReturns: agent(ApiResourceVisibility.visibility_org),
+      updateVisibility: () => Promise.reject(new Error("must not be called")),
+    });
+
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", true);
+
+    expect(calls).toHaveLength(0);
+    expect(outcome.applied).toBeUndefined();
+  });
+});

package/src/resources/apply/apply.ts

@@ -9,6 +9,8 @@
 import { create, fromJson, type JsonValue, type Message } from "@bufbuild/protobuf";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import {
   type ApiResourceMetadata,
   ApiResourceMetadataSchema,
@@ -131,14 +133,16 @@ export async function applyMessage(
   org: string,
   dryRun: boolean,
 ): Promise<ApplyOutcome> {
-  const warning = injectOrg(message, org);
+  const orgWarning = injectOrg(message, org);
   const created = (metaOf(message)?.id ?? "") === "";
 
   if (dryRun) {
-    return { result: buildDryRunResult(handler, message), warning };
+    return { result: buildDryRunResult(handler, message), warning: orgWarning };
   }
 
   const applied = await handler.apply(controller, message);
+  const visibilityWarning = await applyDeclaredVisibility(controller, handler, message, applied);
+  const warning = combineWarnings(orgWarning, visibilityWarning);
   const result = buildApplyResult(handler, applied, created);
   if (handler.kind === ApiResourceKind.mcp_server) {
     return { result, appliedMcpServer: applied as McpServer, warning, applied };
@@ -146,6 +150,63 @@ export async function applyMessage(
   return { result, warning, applied };
 }
 
+/**
+ * Land a manifest-declared visibility through the guarded door. Plain
+ * updates preserve the stored visibility on both editions (oss#573) — the
+ * `updateVisibility` RPC is the only mutation path, so when the applied
+ * resource comes back with a different level than the manifest declared,
+ * follow up with one RPC (the skill-push precedent: no-ops are skipped, an
+ * unchanged manifest costs nothing extra). Server-side guard rejections
+ * (unsupported level, default-instance) propagate as command failures —
+ * the spec update has landed at that point, and the error says so.
+ *
+ * Returns a warning (instead of following up) for kinds without the RPC:
+ * their manifests can only carry a level the create path already rejected,
+ * so a diff here means a pre-existing resource and an unsupported ask.
+ */
+async function applyDeclaredVisibility(
+  controller: ControllerFn,
+  handler: ApplyHandler,
+  message: Message,
+  applied: Message,
+): Promise<string | undefined> {
+  const declared = metaOf(message)?.visibility ?? ApiResourceVisibility.api_resource_visibility_unspecified;
+  if (declared === ApiResourceVisibility.api_resource_visibility_unspecified) return undefined;
+
+  const appliedMeta = metaOf(applied);
+  const resourceId = appliedMeta?.id ?? "";
+  if (resourceId === "" || appliedMeta?.visibility === declared) return undefined;
+
+  if (handler.updateVisibility === undefined) {
+    return (
+      `${handler.displayName} visibility cannot be changed declaratively — ` +
+      "the manifest's metadata.visibility was ignored (the stored value is kept)"
+    );
+  }
+
+  try {
+    const updated = await handler.updateVisibility(
+      controller,
+      create(UpdateVisibilityInputSchema, { resourceId, visibility: declared }),
+    );
+    // Reflect the landed level on the outcome the caller already holds.
+    const updatedMeta = metaOf(updated);
+    if (appliedMeta !== undefined && updatedMeta !== undefined) {
+      appliedMeta.visibility = updatedMeta.visibility;
+    }
+    return undefined;
+  } catch (err) {
+    throw new UsageError(
+      `${handler.displayName} spec applied, but the manifest's visibility change was rejected: ${(err as Error).message}`,
+    );
+  }
+}
+
+function combineWarnings(...warnings: (string | undefined)[]): string | undefined {
+  const present = warnings.filter((w): w is string => w !== undefined);
+  return present.length > 0 ? present.join("; ") : undefined;
+}
+
 /** Read a resource message's metadata (id/name/slug/org), if present. */
 export function resourceMetadata(message: Message): ApiResourceMetadata | undefined {
   return metaOf(message);

package/src/resources/apply/declarative.integration.test.ts

@@ -16,6 +16,7 @@ import { create } from "@bufbuild/protobuf";
 import { type ConnectRouter, createClient } from "@connectrpc/connect";
 import { connectNodeAdapter } from "@connectrpc/connect-node";
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
 import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import { SkillCommandController } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/command_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -34,8 +35,12 @@ const openSessions = new Set<ServerHttp2Session>();
 
 let appliedProject: Project | undefined;
 
+// Ordered log of backend calls, for the discovery-before-dependents contract.
+let events: string[] = [];
+
 beforeEach(() => {
   appliedProject = undefined;
+  events = [];
 });
 
 function makeProject(dir: string): void {
@@ -53,7 +58,22 @@ function makeProject(dir: string): void {
 
 beforeAll(async () => {
   const routes = (router: ConnectRouter) => {
-    router.service(AgentCommandController, { apply: (req) => req });
+    router.service(AgentCommandController, {
+      apply: (req) => {
+        events.push("agent.apply");
+        return req;
+      },
+    });
+    router.service(McpServerCommandController, {
+      apply: (req) => {
+        events.push("mcpserver.apply");
+        return req;
+      },
+      connect: () => {
+        events.push("mcpserver.connect");
+        return {};
+      },
+    });
     router.service(SkillCommandController, {
       push: (req) =>
         create(SkillSchema, {
@@ -123,4 +143,62 @@ describe("applyDeclarative", () => {
       rmSync(dir, { recursive: true, force: true });
     }
   });
+
+  it("discovers MCP capabilities before applying dependent resources", async () => {
+    // Pins the ordering contract behind apply-time enabled_tools validation
+    // (stigmer/stigmer#402): the server rejects agent enabled_tools against
+    // STORED capabilities, so discovery must refresh them between the MCP
+    // server applies and the applies that depend on them. Regressing to
+    // discovery-at-the-end resurrects the stale-capabilities race (a seedpack
+    // upgrade adding a tool + enabling it in an agent would fail bootstrap).
+    const dir = mkdtempSync(join(tmpdir(), "decl-it-order-"));
+    try {
+      writeFileSync(
+        join(dir, "stigmer.yaml"),
+        ["kind: Project", "metadata:", "  name: Ordered", "  slug: ordered", "spec:", "  description: d", ""].join("\n"),
+      );
+      // Named so a naive filename sort would apply the agent first — the
+      // reconciler must order by dependency, not by scan order.
+      writeFileSync(
+        join(dir, "a-agent.yaml"),
+        [
+          "kind: Agent",
+          "metadata:",
+          "  name: Consumer",
+          "  slug: consumer",
+          "spec:",
+          "  description: c",
+          "",
+        ].join("\n"),
+      );
+      writeFileSync(
+        join(dir, "z-server.yaml"),
+        [
+          "kind: McpServer",
+          "metadata:",
+          "  name: Tools",
+          "  slug: tools",
+          "spec:",
+          "  description: t",
+          "  stdio:",
+          "    command: npx",
+          "",
+        ].join("\n"),
+      );
+
+      const detect = detectTrack(dir);
+      const result = await applyDeclarative(detect, {
+        controller: controllerFn,
+        stigmer,
+        org: "acme",
+        info: () => {},
+        warn: () => {},
+      });
+
+      expect(result.status).toBe("success");
+      expect(events).toEqual(["mcpserver.apply", "mcpserver.connect", "agent.apply"]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
 });

package/src/resources/apply/declarative.ts

@@ -276,9 +276,9 @@ const DEFAULT_IGNORE_OPTIONS = { respectGitignore: true, extraIgnore: [] as stri
 
 /**
  * Reconcile a project's membership: push skills first (agents may reference
- * them), apply each resource through the shared apply core, collect references
- * to the member-eligible ones, run post-apply MCP discovery, then apply the
- * project with that exact member set so the server can reconcile by
+ * them), apply MCP servers and run capability discovery on them, apply the
+ * remaining resources, collect references to the member-eligible ones, then
+ * apply the project with that exact member set so the server can reconcile by
  * set-difference (orphan pruning is server-side; see S1 in commands/apply.ts).
  */
 export async function reconcileProjectMembers(
@@ -295,13 +295,14 @@ export async function reconcileProjectMembers(
     members.push(reference(deps.org, ApiResourceKind.skill, pushed.slug));
   }
 
-  // Then each resource, collecting member references from the APPLIED result so
-  // membership carries the server's authoritative slug. (This is the unified
-  // policy: the declarative track used to read the pre-apply YAML slug, the Go
-  // synthesis track read the applied result — converging on the applied result
-  // is correct for both and matches what the backend actually stored.)
+  // Each resource is applied through the shared apply core, collecting member
+  // references from the APPLIED result so membership carries the server's
+  // authoritative slug. (This is the unified policy: the declarative track
+  // used to read the pre-apply YAML slug, the Go synthesis track read the
+  // applied result — converging on the applied result is correct for both and
+  // matches what the backend actually stored.)
   const appliedMcpServers: McpServer[] = [];
-  for (const res of resources) {
+  const applyOne = async (res: ReconcileResource): Promise<void> => {
     const outcome = await applyMessage(deps.controller, res.handler, res.message, deps.org, false);
     if (outcome.warning !== undefined) deps.warn(outcome.warning);
     if (outcome.appliedMcpServer !== undefined) appliedMcpServers.push(outcome.appliedMcpServer);
@@ -309,9 +310,25 @@ export async function reconcileProjectMembers(
       const slug = memberSlugOf(outcome.applied);
       if (slug) members.push(reference(deps.org, res.handler.kind, slug));
     }
-  }
+  };
 
+  // MCP servers first, then capability discovery, then everything else — the
+  // dependency principle applied to capabilities, not just existence. The
+  // server validates agent enabled_tools against discovered capabilities at
+  // apply time (stigmer/stigmer#402), and the backend's own post-apply
+  // connect is asynchronous; discovering here means agents in this apply
+  // validate against the toolset this apply just shipped, not the previous
+  // generation's (which would falsely reject e.g. a seedpack upgrade that
+  // adds a tool and enables it in the same pass). Discovery stays
+  // best-effort: a failed connect warns, capabilities stay stale, and the
+  // dependent apply surfaces an actionable error listing last-known tools.
+  for (const res of resources) {
+    if (res.handler.kind === ApiResourceKind.mcp_server) await applyOne(res);
+  }
   await discoverAppliedMcpServers(deps.stigmer, appliedMcpServers, deps.org, deps.info);
+  for (const res of resources) {
+    if (res.handler.kind !== ApiResourceKind.mcp_server) await applyOne(res);
+  }
 
   injectOrg(project, deps.org);
   if (project.spec === undefined) project.spec = create(ProjectSpecSchema, {});

package/src/resources/apply/handlers.ts

@@ -24,6 +24,7 @@
 
 import type { DescMessage, DescService, Message } from "@bufbuild/protobuf";
 import type { Client } from "@connectrpc/connect";
+import type { UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { type Session, SessionSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
 import {
@@ -54,6 +55,14 @@ export interface ApplyHandler {
   readonly applyOrder: number;
   /** Drive the controller's `apply` RPC with the full resource message. */
   apply(controller: ControllerFn, message: Message): Promise<Message>;
+  /**
+   * Drive the controller's `updateVisibility` RPC — the only door for
+   * visibility changes (plain updates preserve stored visibility, oss#573).
+   * Present exactly when the kind has the RPC; the apply core follows up
+   * through it when a manifest-declared level differs from the stored one.
+   * Manifest kinds inherit the binding from the SDK registry.
+   */
+  updateVisibility?(controller: ControllerFn, input: UpdateVisibilityInput): Promise<Message>;
 }
 
 // The SDK registry's applyOrder values end at schedule = 12; the extras slot
@@ -72,6 +81,7 @@ const CLI_EXTRA_HANDLERS: readonly ApplyHandler[] = [
     schema: WorkflowInstanceSchema,
     applyOrder: 13,
     apply: (c, m) => c(WorkflowInstanceCommandController).apply(m as WorkflowInstance),
+    updateVisibility: (c, i) => c(WorkflowInstanceCommandController).updateVisibility(i),
   },
   {
     kind: ApiResourceKind.session,

package/src/resources/delete.ts

@@ -45,9 +45,8 @@ interface HasMetadata {
   readonly metadata?: { readonly id?: string; readonly name?: string; readonly slug?: string; readonly org?: string };
 }
 
-// `force` is the RPC-level acknowledgment of destructive side effects (e.g. a
-// datastore's held records) — distinct from, but carried by, the CLI's
-// `-f/--force` flag. Kinds whose delete RPC takes a plain typed ID have no
+// `force` is the RPC-level acknowledgment of destructive side effects —
+// distinct from, but carried by, the CLI's `-f/--force` flag. Kinds whose delete RPC takes a plain typed ID have no
 // force field and simply ignore the argument.
 type DeleteFn = (client: Stigmer, id: string, force: boolean) => Promise<HasMetadata>;
 
@@ -56,8 +55,7 @@ type DeleteFn = (client: Stigmer, id: string, force: boolean) => Promise<HasMeta
 // documented special case) — the conformance test in registry/registry.test.ts
 // enforces it, so the two cannot drift.
 // Kinds whose delete takes a DeleteResourceInput (not an ID) thread the force
-// acknowledgment through; today only the datastore server honors it (the
-// non-empty guard), but force is the contract's generic ack carrier.
+// acknowledgment through — force is the contract's generic ack carrier.
 export const DELETE_HANDLERS: ReadonlyMap<ApiResourceKind, DeleteFn> = new Map<ApiResourceKind, DeleteFn>([
   [ApiResourceKind.agent, (c, id) => c.agent.delete(id)],
   [ApiResourceKind.agent_instance, (c, id) => c.agentInstance.delete(id)],
@@ -65,7 +63,6 @@ export const DELETE_HANDLERS: ReadonlyMap<ApiResourceKind, DeleteFn> = new Map<A
   [ApiResourceKind.workflow_instance, (c, id) => c.workflowInstance.delete(id)],
   [ApiResourceKind.mcp_server, (c, id, force) => c.mcpServer.delete({ resourceId: id, force })],
   [ApiResourceKind.project, (c, id) => c.project.delete(id)],
-  [ApiResourceKind.datastore, (c, id, force) => c.datastore.delete({ resourceId: id, force })],
   [ApiResourceKind.environment, (c, id, force) => c.environment.delete({ resourceId: id, force })],
   [ApiResourceKind.agent_channel, (c, id) => c.agentChannel.delete(id)],
   [ApiResourceKind.channel_app, (c, id, force) => c.channelapp.delete({ resourceId: id, force })],
@@ -230,13 +227,6 @@ function buildDeleteWarning(info: TypeInfo, message: HasMetadata): CommandResult
     warning.hint("This will delete the skill and all its versions.");
   }
 
-  if (info.kind === ApiResourceKind.datastore) {
-    // Mirrors the server's non-empty guard (GuardNonEmptyStep): the delete of
-    // a datastore holding records is refused unless force acknowledges it.
-    warning.hint("All records held by this datastore will be destroyed.");
-    warning.hint("A datastore holding records is refused unless --force acknowledges destroying them.");
-  }
-
   if (info.kind === ApiResourceKind.agent_channel) {
     // The server's documented distinction: delete is the connection's full
     // teardown; disabling is the config-preserving pause.

package/src/resources/get-bindings.ts

@@ -8,7 +8,6 @@ import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb"
 import { AgentChannelSchema } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/api_pb";
 import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
 import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
 import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
@@ -39,7 +38,6 @@ export const GET_BINDINGS: ReadonlyMap<ApiResourceKind, Getter> = new Map([
   [ApiResourceKind.workflow_instance, refGetter(ApiResourceKind.workflow_instance, WorkflowInstanceSchema, (c) => c.workflowInstance)],
   [ApiResourceKind.mcp_server, refGetter(ApiResourceKind.mcp_server, McpServerSchema, (c) => c.mcpServer)],
   [ApiResourceKind.project, refGetter(ApiResourceKind.project, ProjectSchema, (c) => c.project)],
-  [ApiResourceKind.datastore, refGetter(ApiResourceKind.datastore, DatastoreSchema, (c) => c.datastore)],
   [ApiResourceKind.environment, refGetter(ApiResourceKind.environment, EnvironmentSchema, (c) => c.environment)],
   [ApiResourceKind.agent_channel, refGetter(ApiResourceKind.agent_channel, AgentChannelSchema, (c) => c.agentChannel)],
   [ApiResourceKind.channel_app, refGetter(ApiResourceKind.channel_app, ChannelAppSchema, (c) => c.channelapp)],

package/src/resources/list.ts

@@ -45,7 +45,6 @@ export const SEARCH_KINDS: ReadonlySet<ApiResourceKind> = new Set<ApiResourceKin
   ApiResourceKind.mcp_server,
   ApiResourceKind.project,
   ApiResourceKind.skill,
-  ApiResourceKind.datastore,
   ApiResourceKind.environment,
 ]);
 

package/src/resources/mutate-verbs.integration.test.ts

@@ -25,9 +25,6 @@ import { AgentInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic
 import { ChannelAppSchema } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
 import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
 import { ChannelAppQueryController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/query_pb";
-import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
-import { DatastoreCommandController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/command_pb";
-import { DatastoreQueryController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/query_pb";
 import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
 import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
 import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
@@ -69,16 +66,6 @@ const knownWorkflow = create(WorkflowSchema, {
   metadata: { name: "Deploy", slug: "deploy", org: "acme", id: "wfl_1" },
 });
 
-// The mock treats this datastore as NON-EMPTY: delete refuses without the
-// force acknowledgment, mirroring the server's GuardNonEmptyStep contract.
-const knownDatastore = create(DatastoreSchema, {
-  metadata: { name: "clinic-records", slug: "clinic-records", org: "acme", id: "dst_1" },
-});
-
-// Byte-shaped like the Go server's GuardNonEmptyStep refusal (delete_guards.go).
-const nonEmptyGuardMessage =
-  'datastore "clinic-records" holds 12 records across 3 collections; deleting destroys them — pass force to acknowledge';
-
 const knownEnvironment = create(EnvironmentSchema, {
   metadata: { name: "clinic-patient-db", slug: "clinic-patient-db", org: "acme", id: "env_1" },
 });
@@ -121,7 +108,6 @@ const openSessions = new Set<ServerHttp2Session>();
 let cancelCalls: string[] = [];
 let tagCalls: { workflowId: string; versionHash: string; tag: string }[] = [];
 // Force-carrying deletes record what actually rode the RPC.
-let datastoreDeletes: { resourceId: string; force: boolean }[] = [];
 let environmentDeletes: { resourceId: string; force: boolean }[] = [];
 let channelAppDeletes: { resourceId: string; force: boolean }[] = [];
 // agent_channel, schedule, and workflow_instance delete by typed ID — no
@@ -133,7 +119,6 @@ let workflowInstanceDeleteIds: string[] = [];
 beforeEach(() => {
   cancelCalls = [];
   tagCalls = [];
-  datastoreDeletes = [];
   environmentDeletes = [];
   channelAppDeletes = [];
   channelDeleteIds = [];
@@ -181,21 +166,6 @@ beforeAll(async () => {
       },
     });
 
-    router.service(DatastoreQueryController, {
-      getByReference: (req) => {
-        if (req.slug !== "clinic-records") throw new ConnectError("datastore not found", Code.NotFound);
-        return knownDatastore;
-      },
-    });
-    router.service(DatastoreCommandController, {
-      delete: (req) => {
-        datastoreDeletes.push({ resourceId: req.resourceId, force: req.force });
-        // Mirrors GuardNonEmptyStep: a non-empty datastore refuses without force.
-        if (!req.force) throw new ConnectError(nonEmptyGuardMessage, Code.FailedPrecondition);
-        return knownDatastore;
-      },
-    });
-
     router.service(EnvironmentQueryController, {
       getByReference: (req) => {
         if (req.slug !== "clinic-patient-db") throw new ConnectError("environment not found", Code.NotFound);
@@ -374,7 +344,6 @@ describe("delete (standard kinds)", () => {
     // it must name the wired kinds and never the narrowed ones (#354).
     const message = String(err.message);
     for (const wired of [
-      "datastore",
       "environment",
       "agentchannel",
       "channelapp",
@@ -399,37 +368,6 @@ describe("delete (standard kinds)", () => {
   });
 });
 
-describe("delete (force acknowledgment)", () => {
-  it("threads --force to the datastore delete RPC as the destroy-records ack", async () => {
-    const plan = await planDelete(client, "datastore", "clinic-records", "acme", true);
-    const result = await plan.perform();
-
-    expect(result.status).toBe("success");
-    expect(result.message).toBe("Datastore deleted successfully");
-    expect(datastoreDeletes).toEqual([{ resourceId: "dst_1", force: true }]);
-  });
-
-  it("surfaces the non-empty guard refusal verbatim when force is absent", async () => {
-    const plan = await planDelete(client, "datastore", "clinic-records", "acme");
-    const err = await plan.perform().catch((e) => e);
-
-    // A confirmed-but-unforced delete must NOT bypass the server guard: the
-    // RPC carries force=false and the refusal reaches the user verbatim.
-    expect(datastoreDeletes).toEqual([{ resourceId: "dst_1", force: false }]);
-    const classified = classify(err);
-    expect(classified?.exitCode).toBe(ExitCode.Usage);
-    expect(classified?.message).toBe(`Precondition failed: ${nonEmptyGuardMessage}`);
-  });
-
-  it("warns up front that datastore records are destroyed and force-guarded", async () => {
-    const plan = await planDelete(client, "datastore", "clinic-records", "acme");
-    expect(plan.warning.hints).toContain("All records held by this datastore will be destroyed.");
-    expect(plan.warning.hints).toContain(
-      "A datastore holding records is refused unless --force acknowledges destroying them.",
-    );
-  });
-});
-
 describe("delete (cutover kinds: environment, agent channel, channel app)", () => {
   it("deletes an environment via the DeleteResourceInput shape", async () => {
     const plan = await planDelete(client, "environment", "clinic-patient-db", "acme");

package/src/resources/validate.ts

@@ -7,7 +7,6 @@
 
 import { type DescMessage, fromJson, type JsonValue } from "@bufbuild/protobuf";
 import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
 import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
@@ -22,7 +21,6 @@ export const VALIDATE_SCHEMAS: ReadonlyMap<ApiResourceKind, DescMessage> = new M
   [ApiResourceKind.workflow, WorkflowSchema],
   [ApiResourceKind.mcp_server, McpServerSchema],
   [ApiResourceKind.project, ProjectSchema],
-  [ApiResourceKind.datastore, DatastoreSchema],
 ]);
 
 export function schemaForValidate(kind: ApiResourceKind): DescMessage | undefined {