@stigmer/cli 3.12.8 → 3.13.0

package/src/local/runtime/server.test.ts

@@ -1,51 +1,36 @@
-import { createHash } from "node:crypto";
-import { chmodSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
+// Pins the server resolution: exactly like the runner's (explicit dir →
+// repo tree → acquired slim package).
+
+import {
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { gzipSync } from "fflate";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { downloadServerBinary, ensureServerBinary } from "./server.js";
-
-// Build a minimal ustar archive with a single regular-file entry.
-function makeTar(name: string, content: Buffer): Buffer {
-  const header = Buffer.alloc(512);
-  header.write(name, 0, "utf8");
-  header.write(content.length.toString(8).padStart(11, "0"), 124, "ascii");
-  header.write("0", 156, "ascii");
-  const data = Buffer.alloc(Math.ceil(content.length / 512) * 512);
-  content.copy(data);
-  const trailer = Buffer.alloc(1024);
-  return Buffer.concat([header, data, trailer]);
-}
+import { acquireServer, ensureServer, resolveServerTs } from "./server.js";
 
-function sha256(bytes: Uint8Array): string {
-  return createHash("sha256").update(bytes).digest("hex");
+function tempDir(prefix: string): string {
+  return mkdtempSync(join(tmpdir(), prefix));
 }
 
-// A fetch double that serves a gzipped tar for the archive URL and a
-// shasum-format checksum for the `.sha256` URL. `corruptChecksum` flips the
-// returned hash to exercise the verification failure path.
-function fakeFetch(archiveGz: Uint8Array, opts: { corruptChecksum?: boolean; capturedUrls?: string[] } = {}): typeof fetch {
-  const checksum = opts.corruptChecksum === true ? "0".repeat(64) : sha256(archiveGz);
-  return (async (url: string) => {
-    opts.capturedUrls?.push(url);
-    if (url.endsWith(".sha256")) {
-      return { ok: true, status: 200, text: async () => `${checksum}  archive.tar.gz\n` };
-    }
-    return {
-      ok: true,
-      status: 200,
-      arrayBuffer: async () => archiveGz.buffer.slice(archiveGz.byteOffset, archiveGz.byteOffset + archiveGz.byteLength),
-    };
-  }) as unknown as typeof fetch;
-}
+const fakeNode = (): string => "/usr/bin/node";
 
-const TOUCHED = ["STIGMER_SERVER_BIN"] as const;
+// Snapshot and restore the env vars the resolution reads, so tests don't leak.
+const TOUCHED = [
+  "STIGMER_SERVER_DIR",
+  "STIGMER_NODE_BIN",
+] as const;
 let saved: Record<string, string | undefined>;
 
 beforeEach(() => {
   saved = {};
-  for (const key of TOUCHED) saved[key] = process.env[key];
+  for (const key of TOUCHED) {
+    saved[key] = process.env[key];
+    delete process.env[key];
+  }
 });
 
 afterEach(() => {
@@ -55,98 +40,177 @@ afterEach(() => {
   }
 });
 
-describe("downloadServerBinary", () => {
-  it("downloads, verifies the checksum, extracts, and writes an executable", async () => {
-    const payload = Buffer.from("the-stigmer-server-binary");
-    const gz = gzipSync(new Uint8Array(makeTar("stigmer-server", payload)));
-    const capturedUrls: string[] = [];
-    const binPath = join(mkdtempSync(join(tmpdir(), "stigmer-server-")), "bin", "stigmer-server");
+function builtServerDir(): string {
+  const dir = tempDir("stigmer-server-");
+  writeFileSync(join(dir, "package.json"), "{}");
+  mkdirSync(join(dir, "dist"));
+  writeFileSync(join(dir, "dist", "main.js"), "//");
+  return dir;
+}
 
-    await downloadServerBinary({
-      version: "0.5.0",
-      binPath,
-      platform: "darwin",
-      arch: "arm64",
-      fetchImpl: fakeFetch(gz, { capturedUrls }),
-    });
+describe("ensureServer", () => {
+  it("resolves the server from STIGMER_SERVER_DIR", () => {
+    const dir = builtServerDir();
+    process.env.STIGMER_SERVER_DIR = dir;
 
-    expect(readFileSync(binPath, "utf8")).toBe("the-stigmer-server-binary");
-    expect(statSync(binPath).mode & 0o111).not.toBe(0); // executable
-    expect(capturedUrls).toContain(
-      "https://github.com/stigmer/stigmer/releases/download/v0.5.0/stigmer-server-v0.5.0-darwin-arm64.tar.gz",
-    );
-    expect(capturedUrls).toContain(
-      "https://github.com/stigmer/stigmer/releases/download/v0.5.0/stigmer-server-v0.5.0-darwin-arm64.tar.gz.sha256",
-    );
+    expect(ensureServer({ node: fakeNode })).toEqual({
+      nodeBin: "/usr/bin/node",
+      entryPath: join(dir, "dist", "main.js"),
+      appDir: dir,
+    });
   });
+});
+
+describe("resolveServerTs", () => {
+  it("resolves a built server from STIGMER_SERVER_DIR", () => {
+    const dir = builtServerDir();
+    process.env.STIGMER_SERVER_DIR = dir;
 
-  it("maps a prerelease version to its v-prefixed release tag", async () => {
-    const gz = gzipSync(new Uint8Array(makeTar("stigmer-server", Buffer.from("x"))));
-    const capturedUrls: string[] = [];
-    const binPath = join(mkdtempSync(join(tmpdir(), "stigmer-server-")), "stigmer-server");
-
-    await downloadServerBinary({
-      version: "0.5.0-rc.1",
-      binPath,
-      platform: "linux",
-      arch: "x64",
-      fetchImpl: fakeFetch(gz, { capturedUrls }),
+    expect(resolveServerTs(fakeNode)).toEqual({
+      nodeBin: "/usr/bin/node",
+      entryPath: join(dir, "dist", "main.js"),
+      appDir: dir,
     });
+  });
 
-    expect(capturedUrls[0]).toBe(
-      "https://github.com/stigmer/stigmer/releases/download/v0.5.0-rc.1/stigmer-server-v0.5.0-rc.1-linux-amd64.tar.gz",
-    );
+  it("errors with build guidance when dist/main.js is missing", () => {
+    const dir = tempDir("stigmer-server-");
+    writeFileSync(join(dir, "package.json"), "{}");
+    process.env.STIGMER_SERVER_DIR = dir;
+
+    expect(() => resolveServerTs(fakeNode)).toThrow(/not built/);
+    // Remediation rides in hints, not the message.
+    const hints = captureHints(() => resolveServerTs(fakeNode));
+    expect(hints.join("\n")).toMatch(/make build-server/);
   });
 
-  it("refuses a mismatched checksum", async () => {
-    const gz = gzipSync(new Uint8Array(makeTar("stigmer-server", Buffer.from("x"))));
-    const binPath = join(mkdtempSync(join(tmpdir(), "stigmer-server-")), "stigmer-server");
-    await expect(
-      downloadServerBinary({
-        version: "0.5.0",
-        binPath,
-        platform: "darwin",
-        arch: "arm64",
-        fetchImpl: fakeFetch(gz, { corruptChecksum: true }),
-      }),
-    ).rejects.toThrow(/checksum mismatch/);
+  it("rejects an override that is not a server package", () => {
+    const dir = tempDir("stigmer-server-");
+    process.env.STIGMER_SERVER_DIR = join(dir, "no-package-here"); // no package.json
+    expect(() => resolveServerTs(fakeNode)).toThrow(/not a server package/);
   });
+});
 
-  it("fails clearly on a non-OK archive response", async () => {
-    const fetchImpl = (async (url: string) => ({
-      ok: false,
-      status: 404,
-      arrayBuffer: async () => new ArrayBuffer(0),
-      text: async () => "",
-    })) as unknown as typeof fetch;
-    const binPath = join(mkdtempSync(join(tmpdir(), "stigmer-server-")), "stigmer-server");
-    await expect(
-      downloadServerBinary({ version: "9.9.9", binPath, platform: "darwin", arch: "arm64", fetchImpl }),
-    ).rejects.toThrow(/HTTP 404/);
+describe("acquireServer", () => {
+  it("installs the slim package and resolves its main.js entry", () => {
+    const home = tempDir("stigmer-home-");
+    const installed: Array<{ dir: string; spec: string }> = [];
+    const install = (dir: string, spec: string): void => {
+      installed.push({ dir, spec });
+      // Simulate the npm install laying down the slim package.
+      const pkgDir = join(dir, "node_modules", "@stigmer", "server-slim");
+      mkdirSync(pkgDir, { recursive: true });
+      writeFileSync(join(pkgDir, "main.js"), "// slim bundle");
+    };
+
+    const launch = acquireServer({
+      home,
+      version: "0.5.0",
+      node: fakeNode,
+      install,
+    });
+
+    const installDir = join(home, ".stigmer", "runtimes", "0.5.0");
+    expect(launch).toEqual({
+      nodeBin: "/usr/bin/node",
+      entryPath: join(
+        installDir,
+        "node_modules",
+        "@stigmer",
+        "server-slim",
+        "main.js",
+      ),
+      appDir: join(installDir, "node_modules", "@stigmer", "server-slim"),
+    });
+    expect(installed).toEqual([
+      { dir: installDir, spec: "@stigmer/server-slim@0.5.0" },
+    ]);
   });
 
-  it("refuses an unsupported platform with actionable guidance", async () => {
-    const binPath = join(mkdtempSync(join(tmpdir(), "stigmer-server-")), "stigmer-server");
-    const fetchImpl = vi.fn() as unknown as typeof fetch;
-    await expect(
-      downloadServerBinary({ version: "0.5.0", binPath, platform: "win32", arch: "x64", fetchImpl }),
-    ).rejects.toThrow(/does not support this platform/);
-    expect(fetchImpl).not.toHaveBeenCalled();
+  it("reuses a prior install without reinstalling", () => {
+    const home = tempDir("stigmer-home-");
+    const pkgDir = join(
+      home,
+      ".stigmer",
+      "runtimes",
+      "0.5.0",
+      "node_modules",
+      "@stigmer",
+      "server-slim",
+    );
+    mkdirSync(pkgDir, { recursive: true });
+    writeFileSync(join(pkgDir, "main.js"), "// slim bundle");
+
+    const install = vi.fn();
+    const launch = acquireServer({
+      home,
+      version: "0.5.0",
+      node: fakeNode,
+      install,
+    });
+
+    expect(launch.nodeBin).toBe("/usr/bin/node");
+    expect(install).not.toHaveBeenCalled();
   });
-});
 
-describe("ensureServerBinary", () => {
-  it("returns an existing override binary without downloading", async () => {
-    const dir = mkdtempSync(join(tmpdir(), "stigmer-server-"));
-    const bin = join(dir, "stigmer-server");
-    writeFileSync(bin, "#!/bin/sh\n");
-    chmodSync(bin, 0o755);
-    process.env.STIGMER_SERVER_BIN = bin;
+  // The runner and the server share one per-version install root; acquiring
+  // the server after the runner must ADD to it, never clobber the root
+  // manifest the runner's install already wrote.
+  it("shares the runtimes install root with the runner without clobbering it", () => {
+    const home = tempDir("stigmer-home-");
+    const installDir = join(home, ".stigmer", "runtimes", "0.5.0");
+    mkdirSync(installDir, { recursive: true });
+    writeFileSync(
+      join(installDir, "package.json"),
+      '{"name":"stigmer-runtime","marker":"pre-existing"}\n',
+    );
 
-    const fetchImpl = vi.fn() as unknown as typeof fetch;
-    const resolved = await ensureServerBinary({ home: dir, version: "0.5.0", fetchImpl });
+    const install = (dir: string): void => {
+      const pkgDir = join(dir, "node_modules", "@stigmer", "server-slim");
+      mkdirSync(pkgDir, { recursive: true });
+      writeFileSync(join(pkgDir, "main.js"), "// slim bundle");
+    };
+    acquireServer({ home, version: "0.5.0", node: fakeNode, install });
 
-    expect(resolved).toBe(bin);
-    expect(fetchImpl).not.toHaveBeenCalled();
+    expect(readFileSync(join(installDir, "package.json"), "utf8")).toContain(
+      "pre-existing",
+    );
+  });
+
+  // The hunted npm failure shape: the install runs but the platform-native
+  // package was skipped (unsupported OS/arch), so the entry never appears.
+  it("errors actionably when the install produces no entry", () => {
+    const home = tempDir("stigmer-home-");
+    const install = vi.fn(); // runs, lays down nothing
+    const attempt = (): unknown => acquireServer({ home, version: "0.5.0", node: fakeNode, install });
+    expect(attempt).toThrow(/install did not produce/);
+    expect(install).toHaveBeenCalledOnce();
+    const hints = captureHints(attempt).join("\n");
+    expect(hints).toMatch(/platform-native/);
+    expect(hints).toMatch(/Remove .* and retry/);
+  });
+
+  it("refuses to acquire for a non-release (dev) build, naming the fallback", () => {
+    const home = tempDir("stigmer-home-");
+    const attempt = (): unknown =>
+      acquireServer({
+        home,
+        version: "0.0.0-dev",
+        node: fakeNode,
+        install: vi.fn(),
+      });
+    expect(attempt).toThrow(/non-release build/);
+    // The escape hatch rides in the hints: the explicit server dir.
+    const hints = captureHints(attempt);
+    expect(hints.join("\n")).toMatch(/STIGMER_SERVER_DIR/);
   });
 });
+
+function captureHints(attempt: () => unknown): readonly string[] {
+  try {
+    attempt();
+  } catch (err) {
+    return (err as { hints?: readonly string[] }).hints ?? [];
+  }
+  throw new Error("expected the attempt to throw");
+}

package/src/local/runtime/server.ts

@@ -1,20 +1,20 @@
-// Resolution and on-demand acquisition of the `stigmer-server` control plane.
+// Resolution and on-demand acquisition of the stigmer server — the
+// TypeScript implementation serving since the DD-006 cutover (D4 #24; the Go
+// binary ladder that backed rollback retired with #25).
 //
-// DD-003: a TypeScript CLI cannot `go:embed` a Go binary, so it resolves an
-// existing `stigmer-server` (dev build / Homebrew / a prior download) and, when
-// none is present, downloads the standalone release asset into ~/.stigmer/bin and
-// verifies its sha256 before first use. The fetch/extract mechanics are shared
-// with the Temporal downloader (`../artifact.ts`); the one deliberate difference
-// is the checksum step — this is our own executable, and DD-003 makes integrity
-// non-negotiable.
+// The server is launched exactly like the runner: a compiled `node main.js`,
+// never `tsx src/main.ts` (the workers bundle Temporal workflows on boot in
+// dev shape, and the slim artifact ships pre-built bundles — either way the
+// entry must be compiled; see the server package's workflow-source.ts).
 //
-// Resolution order (first existing hit wins; download is the last resort):
-//   1. STIGMER_SERVER_BIN — explicit override (tests, custom installs)
-//   2. repo `bin/stigmer-server` — the dev build (`make build`)
-//   3. ~/bin/stigmer-server — a common local install location
-//   4. ~/.stigmer/bin/stigmer-server — a previously-downloaded release asset
-//   5. PATH — `stigmer-server`
-//   6. download the pinned release asset into ~/.stigmer/bin (checksum-verified)
+// Resolution order (the D2 §6 switch semantics):
+//   1. STIGMER_SERVER_DIR — an explicit server package dir (dist/main.js
+//      required), the STIGMER_RUNNER_DIR mirror.
+//   2. The repo-tree server package (dev; build required).
+//   3. The published `@stigmer/server-slim`, installed on demand into
+//      ~/.stigmer/runtimes/<version>/ alongside the runner's package — one
+//      CJS main.js, pre-built workflow bundles, and the per-platform
+//      Temporal native bridge selected by npm via optionalDependencies.
 
 import { existsSync } from "node:fs";
 import { homedir } from "node:os";
@@ -22,148 +22,168 @@ import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { CliExitError } from "../../errors/cli-exit-error.js";
 import { ExitCode } from "../../errors/exit-codes.js";
+import { log } from "../../logger.js";
 import { VERSION } from "../../version.js";
-import { fetchTarballBinary, mapReleaseArch, mapReleaseOs } from "../artifact.js";
-import { binDir } from "../paths.js";
-import { which } from "./which.js";
-
-const SERVER_BINARY = "stigmer-server";
-const GITHUB_REPO = "stigmer/stigmer";
-
-// Platform/arch combos for which `release.cli.yaml` publishes a stigmer-server
-// asset. The npm CLI installs on more platforms than this (e.g. linux-arm64,
-// Windows), so an unsupported `stigmer up` must fail with clear guidance rather
-// than a confusing 404.
-const SUPPORTED_PLATFORMS = new Set(["darwin-arm64", "darwin-amd64", "linux-amd64"]);
-
-/**
- * Find an already-present `stigmer-server` binary, or null. Pure: never
- * downloads. `home` is injectable for tests.
- */
-export function resolveServerBinary(home: string = homedir()): string | null {
-  for (const candidate of serverCandidates(home)) {
-    if (existsSync(candidate)) return candidate;
-  }
-  return which(SERVER_BINARY);
-}
+import { runtimesDir } from "../paths.js";
+import type { ServerLaunch } from "../daemon/env.js";
+import { resolveServerNode } from "./node.js";
+import {
+  ensureRuntimesRoot,
+  isAcquirableRelease,
+  npmInstallIntoRuntimes,
+  type NpmInstall,
+} from "./runtimes-install.js";
+
+const SLIM_PACKAGE = "@stigmer/server-slim";
 
 export interface EnsureServerOptions {
   home?: string;
-  /** Release version to download if needed (defaults to the CLI's own version). */
+  /** Release version of the slim server to acquire (defaults to the CLI version). */
   version?: string;
-  /** Override the fetch implementation (tests). */
-  fetchImpl?: typeof fetch;
+  /** Node resolver (injectable for tests). */
+  node?: () => string;
+  /** npm install implementation (injectable for tests). */
+  install?: NpmInstall;
 }
 
 /**
- * Ensure a `stigmer-server` binary is available, returning its path. Reuses an
- * existing binary if found; otherwise downloads the pinned release asset into
- * ~/.stigmer/bin (checksum-verified). Throws actionable guidance when no binary
- * exists and a download is not possible (a source/dev build, or an unsupported
- * platform).
+ * Resolve what the daemon launches as `stigmer-server`: the explicit
+ * STIGMER_SERVER_DIR override, then the repo tree, then acquiring the
+ * published slim package. Throws actionable guidance on a missing build, an
+ * invalid override, or a non-release CLI build with nothing local.
  */
-export async function ensureServerBinary(opts: EnsureServerOptions = {}): Promise<string> {
-  const home = opts.home ?? homedir();
-  const existing = resolveServerBinary(home);
-  if (existing !== null) return existing;
-
-  const version = opts.version ?? VERSION;
-  if (!isDownloadableRelease(version)) {
-    throw notFoundError();
-  }
-
-  const binPath = join(binDir(home), SERVER_BINARY);
-  await downloadServerBinary({ version, binPath, fetchImpl: opts.fetchImpl });
-  return binPath;
-}
-
-export interface ServerDownloadTarget {
-  /** Release version, e.g. "0.5.0" or "0.5.0-rc.1" (with or without a leading "v"). */
-  version: string;
-  /** Absolute path to write the extracted `stigmer-server` binary to. */
-  binPath: string;
-  /** Node platform (defaults to process.platform). */
-  platform?: NodeJS.Platform;
-  /** Node arch (defaults to process.arch). */
-  arch?: string;
-  /** Override the fetch implementation (tests). */
-  fetchImpl?: typeof fetch;
+export function ensureServer(opts: EnsureServerOptions = {}): ServerLaunch {
+  const node = opts.node ?? resolveServerNode;
+  const local = resolveServerTs(node);
+  if (local !== null) return local;
+  return acquireServer({ ...opts, node });
 }
 
 /**
- * Download, checksum-verify, and install the standalone `stigmer-server` release
- * asset. Throws a {@link CliExitError} on an unsupported platform or any
- * network/checksum/extraction failure.
+ * Resolve a repo-tree TS server (dev) or an explicit STIGMER_SERVER_DIR, or
+ * null when neither is present (the caller then acquires the slim package).
+ * Throws when an override is set but invalid, or when a found server is not
+ * built — both are actionable user-facing conditions, not a reason to
+ * silently download. `node` is injectable for tests.
  */
-export async function downloadServerBinary(target: ServerDownloadTarget): Promise<void> {
-  const os = mapReleaseOs(target.platform ?? process.platform);
-  const arch = mapReleaseArch(target.arch ?? process.arch);
-  const platformKey = `${os}-${arch}`;
-  if (!SUPPORTED_PLATFORMS.has(platformKey)) {
-    throw unsupportedPlatformError(platformKey);
+export function resolveServerTs(
+  node: () => string = resolveServerNode,
+): ServerLaunch | null {
+  const override = process.env.STIGMER_SERVER_DIR;
+  if (override !== undefined && override !== "") {
+    if (!hasPackageJson(override)) {
+      throw new CliExitError(
+        `STIGMER_SERVER_DIR is not a server package: ${override}`,
+        ExitCode.General,
+        [
+          "Point STIGMER_SERVER_DIR at the @stigmer/server package directory (the one with package.json).",
+        ],
+      );
+    }
+    return resolveBuiltServer(override, node);
   }
 
-  const tag = releaseTag(target.version);
-  const archive = `${SERVER_BINARY}-${tag}-${platformKey}.tar.gz`;
-  const url = `https://github.com/${GITHUB_REPO}/releases/download/${tag}/${archive}`;
-
-  await fetchTarballBinary({
-    url,
-    checksumUrl: `${url}.sha256`,
-    entryName: SERVER_BINARY,
-    binPath: target.binPath,
-    label: SERVER_BINARY,
-    fetchImpl: target.fetchImpl,
-  });
+  const root = repoRoot();
+  if (root !== null) {
+    const candidate = join(root, "backend", "services", "stigmer-server");
+    if (hasPackageJson(candidate)) return resolveBuiltServer(candidate, node);
+  }
+  return null;
 }
 
-function serverCandidates(home: string): string[] {
-  const candidates: string[] = [];
-  const override = process.env.STIGMER_SERVER_BIN;
-  if (override !== undefined && override !== "") candidates.push(override);
+/**
+ * Acquire the published `@stigmer/server-slim@<version>` into
+ * ~/.stigmer/runtimes/<version>/ (idempotent: reuses a prior install; shares
+ * the install root with the runner's package) and resolve its `main.js`
+ * entry. The version is pinned to the CLI's own version so the server's
+ * protos and behavior stay in lockstep with the CLI and the runner.
+ */
+export function acquireServer(opts: EnsureServerOptions = {}): ServerLaunch {
+  const home = opts.home ?? homedir();
+  const version = opts.version ?? VERSION;
+  if (!isAcquirableRelease(version)) {
+    throw new CliExitError(
+      `cannot acquire ${SLIM_PACKAGE} for a non-release build (${version})`,
+      ExitCode.General,
+      [
+        "Run from the repo with a built server (make build-server), or set",
+        "STIGMER_SERVER_DIR to a built server package.",
+        "On-demand acquisition is only available for published releases.",
+      ],
+    );
+  }
 
-  const root = repoRoot();
-  if (root !== null) candidates.push(join(root, "bin", SERVER_BINARY));
-  candidates.push(join(home, "bin", SERVER_BINARY));
-  candidates.push(join(binDir(home), SERVER_BINARY)); // a previously-downloaded asset
-  return candidates;
-}
+  // Probe the Node capability BEFORE the download: a user on an FTS5-less
+  // Node must not fetch the full slim artifact only to be rejected after.
+  const node = opts.node ?? resolveServerNode;
+  const nodeBin = node();
+  const installDir = join(runtimesDir(home), version);
+  const entryPath = join(
+    installDir,
+    "node_modules",
+    "@stigmer",
+    "server-slim",
+    "main.js",
+  );
+
+  if (!existsSync(entryPath)) {
+    log.info(`acquiring ${SLIM_PACKAGE}`, { version, dir: installDir });
+    ensureRuntimesRoot(installDir);
+    const install = opts.install ?? npmInstallIntoRuntimes;
+    install(installDir, `${SLIM_PACKAGE}@${version}`);
+  }
 
-// Only tagged releases publish a downloadable asset. A source build reports the
-// "0.0.0-dev" sentinel and the dev npm channel stamps "<v>-dev.<stamp>" versions
-// (release.dev.yaml) that never cut a GitHub release — neither is downloadable.
-function isDownloadableRelease(version: string): boolean {
-  return !version.includes("-dev");
-}
+  if (!existsSync(entryPath)) {
+    throw new CliExitError(
+      `${SLIM_PACKAGE} install did not produce ${entryPath}`,
+      ExitCode.General,
+      [
+        "The install may have skipped the platform-native package for this OS/arch.",
+        `Remove ${installDir} and retry, or set STIGMER_SERVER_DIR to a built server.`,
+      ],
+    );
+  }
 
-// The npm package version maps to the GitHub release tag by prefixing "v"
-// (npm 0.5.0 -> tag v0.5.0; npm 0.5.0-rc.1 -> tag v0.5.0-rc.1).
-function releaseTag(version: string): string {
-  return version.startsWith("v") ? version : `v${version}`;
+  return {
+    nodeBin,
+    entryPath,
+    appDir: dirname(entryPath),
+  };
 }
 
-function notFoundError(): CliExitError {
-  return new CliExitError(`${SERVER_BINARY} binary not found`, ExitCode.General, [
-    "Build it from the repo with `make build` (produces ./bin/stigmer-server),",
-    "or set STIGMER_SERVER_BIN to an existing binary.",
-    "Automatic download is only available for tagged releases.",
-  ]);
+function resolveBuiltServer(appDir: string, node: () => string): ServerLaunch {
+  const entryPath = join(appDir, "dist", "main.js");
+  if (!existsSync(entryPath)) {
+    throw new CliExitError(
+      `TS server not built: ${entryPath} is missing`,
+      ExitCode.General,
+      [
+        "Build it with: make build-server",
+        "The server must be compiled — it cannot run from source via tsx (its",
+        "Temporal workers bundle workflow code from the compiled dist).",
+        "STIGMER_SERVER_DIR expects the source package (dist/main.js); to run an",
+        "acquired @stigmer/server-slim install, unset it — the CLI resolves that",
+        "shape itself.",
+      ],
+    );
+  }
+  return { nodeBin: node(), entryPath, appDir };
 }
 
-function unsupportedPlatformError(platformKey: string): CliExitError {
-  return new CliExitError(`the local stack does not support this platform (${platformKey})`, ExitCode.General, [
-    "`stigmer up` needs a stigmer-server release asset, which is published for",
-    "macOS (arm64/amd64) and Linux (amd64) only.",
-    "Point STIGMER_SERVER_BIN at a server binary you built yourself to proceed.",
-  ]);
+function hasPackageJson(dir: string): boolean {
+  return existsSync(join(dir, "package.json"));
 }
 
-// Walk up from this module to the repo root (the directory containing
-// `bin/stigmer-server` in a dev checkout). Returns null outside a checkout.
+// Walk up from this module to a repo root containing the TS server package.
 function repoRoot(): string | null {
   let dir = dirname(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 8; i += 1) {
-    if (existsSync(join(dir, "bin", SERVER_BINARY))) return dir;
+  for (let i = 0; i < 10; i += 1) {
+    if (
+      existsSync(
+        join(dir, "backend", "services", "stigmer-server", "package.json"),
+      )
+    )
+      return dir;
     const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;