@stigmer/cli 3.18.0-dev.20260918103812 → 3.18.1-dev.20260919070736

package/local/seedpack/content.d.ts

@@ -1,61 +0,0 @@
-import { type NpmInstall } from "../runtime/runtimes-install.js";
-/**
- * The canonical seedpack entries, in apply-safe order. Kept in sync with
- * `SEEDPACK_ENTRIES` in `@stigmer/seedpack` (`seedpack/src/index.ts`, the one
- * definition) — `tools/`, `icons/`, and `canary/` (CI canary metadata, not a
- * resource) are deliberately excluded so the content set (and thus the
- * idempotency hash) is identical across delivery paths.
- */
-export declare const SEEDPACK_ENTRIES: readonly ["stigmer.yaml", "organizations", "skills", "agents", "workflows", "mcp-servers"];
-/** Marker file recording the last successfully-applied content hash. */
-export declare const MARKER_FILE = ".seedpack-bootstrapped";
-export interface SeedpackContent {
-    /** Absolute path to the content root (holds stigmer.yaml). */
-    readonly dir: string;
-    /** Where the content came from — surfaced in diagnostics. */
-    readonly source: "repo" | "package";
-}
-export interface ResolveSeedpackOptions {
-    home?: string;
-    /** Release version of @stigmer/seedpack to acquire (defaults to the CLI version). */
-    version?: string;
-    /** npm install implementation (injectable for tests). */
-    install?: NpmInstall;
-}
-/**
- * Resolve the seedpack content directory: a repo-tree checkout in dev, else the
- * on-demand-acquired `@stigmer/seedpack` package. Throws actionable guidance when
- * acquisition is not possible (non-release build, or a failed/incomplete install).
- */
-export declare function resolveSeedpackContent(opts?: ResolveSeedpackOptions): SeedpackContent;
-/**
- * Acquire the published `@stigmer/seedpack@<version>` into
- * ~/.stigmer/runtimes/<version>/ (idempotent) and return its package directory.
- * The version is pinned to the CLI's own version so system content stays in
- * lockstep with the control plane it bootstraps.
- *
- * Presence beats acquirability (the server acquirer's rule, stated in
- * runtime/server.ts): installed content is used whatever its version string;
- * only an install we would have to perform is refused for a non-release build.
- */
-export declare function acquireSeedpack(opts?: ResolveSeedpackOptions): string;
-/**
- * Deterministic SHA-256 over the canonical content, identical to
- * `@stigmer/seedpack`'s `contentHash` (and the Go algorithm): files walked in
- * lexical order, each contributing its forward-slash relative path, a NUL, and
- * its bytes. Used as the idempotency marker.
- */
-export declare function hashSeedpackContent(dir: string): string;
-/**
- * Copy the canonical entries from `srcDir` into `destDir`, producing a clean
- * Stigmer project the declarative-apply path can process directly (never
- * carrying build tooling or assets that happen to sit beside the content).
- */
-export declare function extractSeedpack(srcDir: string, destDir: string): void;
-/** Lexically-sorted, forward-slash relative paths of every file under the canonical entries. */
-export declare function listContentFiles(root: string): string[];
-/** The stored marker hash for `markerDir`, or null when never applied. */
-export declare function readMarker(markerDir: string): string | null;
-/** Persist the applied content hash so a future run can skip unchanged content. */
-export declare function writeMarker(markerDir: string, hash: string): void;
-//# sourceMappingURL=content.d.ts.map

package/local/seedpack/content.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../../src/local/seedpack/content.ts"],"names":[],"mappings":"AAqCA,OAAO,EAIL,KAAK,UAAU,EAChB,MAAM,gCAAgC,CAAC;AAIxC;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,4FAOnB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,WAAW,2BAA2B,CAAC;AAEpD,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,GAAE,sBAA2B,GAChC,eAAe,CAIjB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,GAAE,sBAA2B,GAAG,MAAM,CAmCzE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAOrE;AAID,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBvD;AAED,0EAA0E;AAC1E,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM3D;AAED,mFAAmF;AACnF,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGjE"}

package/local/seedpack/content.js

@@ -1,178 +0,0 @@
-// Resolution and on-demand acquisition of the seedpack content.
-//
-// The seedpack (system agents, skills, MCP servers, workflows under the
-// "stigmer" org) is the system content every backend is bootstrapped with.
-// A lean `npx @stigmer/cli` must not carry ~300 content files (DD-002), so the
-// content ships as `@stigmer/seedpack` and is acquired on demand — the same
-// pattern as `@stigmer/runner-slim` and the managed Temporal binary.
-//
-// Two sources, tried in order (mirrors runtime/runner.ts):
-//   1. A repo-tree checkout (dev): `<repo>/seedpack`.
-//   2. The published `@stigmer/seedpack@<cli-version>`, installed on demand into
-//      ~/.stigmer/runtimes/<version>/ and read from
-//      node_modules/@stigmer/seedpack.
-//
-// The content-hash and extract logic mirror `@stigmer/seedpack` exactly; the CLI
-// reimplements them over a resolved directory so it stays decoupled from the
-// package in the lean install (where the package is not a dependency, only an
-// on-demand artifact). `seedpack/src/index.ts` is the one definition both follow.
-import { createHash } from "node:crypto";
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync, } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join, posix, relative, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-import { CliExitError } from "../../errors/cli-exit-error.js";
-import { ExitCode } from "../../errors/exit-codes.js";
-import { log } from "../../logger.js";
-import { VERSION } from "../../version.js";
-import { runtimesDir } from "../paths.js";
-import { ensureRuntimesRoot, isAcquirableRelease, npmInstallIntoRuntimes, } from "../runtime/runtimes-install.js";
-const SEEDPACK_PACKAGE = "@stigmer/seedpack";
-/**
- * The canonical seedpack entries, in apply-safe order. Kept in sync with
- * `SEEDPACK_ENTRIES` in `@stigmer/seedpack` (`seedpack/src/index.ts`, the one
- * definition) — `tools/`, `icons/`, and `canary/` (CI canary metadata, not a
- * resource) are deliberately excluded so the content set (and thus the
- * idempotency hash) is identical across delivery paths.
- */
-export const SEEDPACK_ENTRIES = [
-    "stigmer.yaml",
-    "organizations",
-    "skills",
-    "agents",
-    "workflows",
-    "mcp-servers",
-];
-/** Marker file recording the last successfully-applied content hash. */
-export const MARKER_FILE = ".seedpack-bootstrapped";
-/**
- * Resolve the seedpack content directory: a repo-tree checkout in dev, else the
- * on-demand-acquired `@stigmer/seedpack` package. Throws actionable guidance when
- * acquisition is not possible (non-release build, or a failed/incomplete install).
- */
-export function resolveSeedpackContent(opts = {}) {
-    const repo = repoSeedpackDir();
-    if (repo !== null)
-        return { dir: repo, source: "repo" };
-    return { dir: acquireSeedpack(opts), source: "package" };
-}
-/**
- * Acquire the published `@stigmer/seedpack@<version>` into
- * ~/.stigmer/runtimes/<version>/ (idempotent) and return its package directory.
- * The version is pinned to the CLI's own version so system content stays in
- * lockstep with the control plane it bootstraps.
- *
- * Presence beats acquirability (the server acquirer's rule, stated in
- * runtime/server.ts): installed content is used whatever its version string;
- * only an install we would have to perform is refused for a non-release build.
- */
-export function acquireSeedpack(opts = {}) {
-    const home = opts.home ?? homedir();
-    const version = opts.version ?? VERSION;
-    const installDir = join(runtimesDir(home), version);
-    const pkgDir = join(installDir, "node_modules", "@stigmer", "seedpack");
-    const marker = join(pkgDir, "stigmer.yaml");
-    if (!existsSync(marker)) {
-        if (!isAcquirableRelease(version)) {
-            throw new CliExitError(`cannot acquire ${SEEDPACK_PACKAGE} for a non-release build (${version})`, ExitCode.General, [
-                "Run from the repo (the seedpack/ tree is used directly in dev).",
-                "On-demand acquisition is only available for published releases.",
-            ]);
-        }
-        log.info(`acquiring ${SEEDPACK_PACKAGE}`, { version, dir: installDir });
-        // The same per-version root the server and runner packages install into;
-        // npm install is additive and non-pruning, so the prefix is safely shared.
-        ensureRuntimesRoot(installDir);
-        const install = opts.install ?? npmInstallIntoRuntimes;
-        install(installDir, `${SEEDPACK_PACKAGE}@${version}`);
-    }
-    if (!existsSync(marker)) {
-        throw new CliExitError(`${SEEDPACK_PACKAGE} install did not produce ${marker}`, ExitCode.General, [`Remove ${installDir} and retry.`]);
-    }
-    return pkgDir;
-}
-/**
- * Deterministic SHA-256 over the canonical content, identical to
- * `@stigmer/seedpack`'s `contentHash` (and the Go algorithm): files walked in
- * lexical order, each contributing its forward-slash relative path, a NUL, and
- * its bytes. Used as the idempotency marker.
- */
-export function hashSeedpackContent(dir) {
-    const hash = createHash("sha256");
-    for (const rel of listContentFiles(dir)) {
-        hash.update(rel);
-        hash.update(NUL);
-        hash.update(readFileSync(join(dir, rel)));
-    }
-    return `sha256:${hash.digest("hex").slice(0, 16)}`;
-}
-/**
- * Copy the canonical entries from `srcDir` into `destDir`, producing a clean
- * Stigmer project the declarative-apply path can process directly (never
- * carrying build tooling or assets that happen to sit beside the content).
- */
-export function extractSeedpack(srcDir, destDir) {
-    mkdirSync(destDir, { recursive: true });
-    for (const entry of SEEDPACK_ENTRIES) {
-        const src = join(srcDir, entry);
-        if (!existsSync(src))
-            continue;
-        cpSync(src, join(destDir, entry), { recursive: true });
-    }
-}
-const NUL = Uint8Array.of(0);
-/** Lexically-sorted, forward-slash relative paths of every file under the canonical entries. */
-export function listContentFiles(root) {
-    const files = [];
-    const walk = (abs) => {
-        for (const dirent of readdirSync(abs, { withFileTypes: true })) {
-            const full = join(abs, dirent.name);
-            if (dirent.isDirectory())
-                walk(full);
-            else if (dirent.isFile())
-                files.push(toPosix(relative(root, full)));
-        }
-    };
-    for (const entry of SEEDPACK_ENTRIES) {
-        const abs = join(root, entry);
-        if (!existsSync(abs))
-            continue;
-        if (statSync(abs).isDirectory())
-            walk(abs);
-        else
-            files.push(entry);
-    }
-    return files.sort();
-}
-/** The stored marker hash for `markerDir`, or null when never applied. */
-export function readMarker(markerDir) {
-    try {
-        return readFileSync(join(markerDir, MARKER_FILE), "utf8").trim() || null;
-    }
-    catch {
-        return null;
-    }
-}
-/** Persist the applied content hash so a future run can skip unchanged content. */
-export function writeMarker(markerDir, hash) {
-    mkdirSync(markerDir, { recursive: true });
-    writeFileSync(join(markerDir, MARKER_FILE), `${hash}\n`);
-}
-function toPosix(p) {
-    return sep === posix.sep ? p : p.split(sep).join(posix.sep);
-}
-// Walk up from this module to a repo root containing seedpack/stigmer.yaml.
-function repoSeedpackDir() {
-    let dir = dirname(fileURLToPath(import.meta.url));
-    for (let i = 0; i < 10; i += 1) {
-        const candidate = join(dir, "seedpack");
-        if (existsSync(join(candidate, "stigmer.yaml")))
-            return candidate;
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return null;
-}
-//# sourceMappingURL=content.js.map

package/local/seedpack/content.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../../src/local/seedpack/content.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,wEAAwE;AACxE,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,qEAAqE;AACrE,EAAE;AACF,2DAA2D;AAC3D,sDAAsD;AACtD,iFAAiF;AACjF,oDAAoD;AACpD,uCAAuC;AACvC,EAAE;AACF,iFAAiF;AACjF,6EAA6E;AAC7E,8EAA8E;AAC9E,kFAAkF;AAElF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,GAEvB,MAAM,gCAAgC,CAAC;AAExC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,cAAc;IACd,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,aAAa;CACL,CAAC;AAEX,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAiBpD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,OAA+B,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC;IAExC,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAE5C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,YAAY,CACpB,kBAAkB,gBAAgB,6BAA6B,OAAO,GAAG,EACzE,QAAQ,CAAC,OAAO,EAChB;gBACE,iEAAiE;gBACjE,iEAAiE;aAClE,CACF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,aAAa,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACxE,yEAAyE;QACzE,2EAA2E;QAC3E,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC;QACvD,OAAO,CAAC,UAAU,EAAE,GAAG,gBAAgB,IAAI,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,GAAG,gBAAgB,4BAA4B,MAAM,EAAE,EACvD,QAAQ,CAAC,OAAO,EAChB,CAAC,UAAU,UAAU,aAAa,CAAC,CACpC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAe;IAC7D,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7B,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAChC,IAAI,MAAM,CAAC,MAAM,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,gBAAgB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC;;YACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,IAAY;IACzD,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,4EAA4E;AAC5E,SAAS,eAAe;IACtB,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QAClE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/src/commands/seedpack.ts

@@ -1,116 +0,0 @@
-// `stigmer seedpack apply|status` — manage the embedded system seedpack.
-//
-// The seedpack (system agents, skills, MCP servers, workflows under the
-// "stigmer" org) is applied automatically on `stigmer up` in local mode; these
-// commands bootstrap it explicitly against whatever backend is configured
-// (local or cloud). Apply is content-hash idempotent: in cloud mode the truth
-// is the stigmer.ai/seedpack-hash label on the server's seedpack Project (any
-// machine sees the same applied state — cloud#429); in local mode it is a
-// marker file in the data dir, which lives and dies with the local backend.
-//
-// Heavy modules load lazily inside the action so `--help` stays fast (DD-001).
-
-import type { Command } from "commander";
-import { configDir, dataDir, isCloudMode, load } from "../config/index.js";
-import { CommandResult, type OutputFlags, renderResult } from "../output/index.js";
-import { addResultFlags, resultFormat } from "./shared.js";
-
-interface ApplyFlags extends OutputFlags {
-  force?: boolean;
-}
-
-export function registerSeedpack(program: Command): void {
-  const seedpack = program.command("seedpack").description("manage the embedded system seedpack");
-
-  const apply = seedpack
-    .command("apply")
-    .description("apply the seedpack to the configured backend")
-    .option("--force", "re-apply even if the seedpack has not changed", false)
-    .action((options: ApplyFlags) => runApply(options));
-  addResultFlags(apply);
-
-  const status = seedpack
-    .command("status")
-    .description("show seedpack bootstrap status")
-    .action((options: OutputFlags) => runStatus(options));
-  addResultFlags(status);
-}
-
-async function runApply(flags: ApplyFlags): Promise<void> {
-  const [{ connectBackend }, { ensureAuthenticated }, { applySeedpack }] = await Promise.all([
-    import("../backend.js"),
-    import("../config/index.js"),
-    import("../local/seedpack/apply.js"),
-  ]);
-
-  const client = connectBackend();
-  ensureAuthenticated(client.config);
-
-  const result = await applySeedpack(
-    {
-      controller: client.controller,
-      stigmer: client.stigmer,
-      info: (line) => process.stderr.write(`${line}\n`),
-      warn: (line) => process.stderr.write(`${line}\n`),
-    },
-    {
-      markerDir: markerDir(),
-      force: flags.force === true,
-      useServerHash: isCloudMode(load()),
-    },
-  );
-
-  const label = backendLabel();
-  const message = result.applied
-    ? `Seedpack applied to ${label} backend`
-    : `Seedpack already up to date on ${label} backend (use --force to re-apply)`;
-  renderResult(CommandResult.success(message), resultFormat(flags));
-}
-
-async function runStatus(flags: OutputFlags): Promise<void> {
-  const { readServerSeedpackHash, resolveSeedpackOrg, seedpackContentHash } = await import("../local/seedpack/apply.js");
-  const { readMarker } = await import("../local/seedpack/content.js");
-
-  const hash = seedpackContentHash();
-
-  // Cloud mode asks the server (the label on the seedpack Project) so status
-  // is truthful from ANY machine, not just the one that last ran apply.
-  let stored: string | null;
-  let storedLabel: string;
-  if (isCloudMode(load())) {
-    const { connectBackend } = await import("../backend.js");
-    const { ensureAuthenticated } = await import("../config/index.js");
-    const client = connectBackend();
-    ensureAuthenticated(client.config);
-    stored = await readServerSeedpackHash(client.stigmer, resolveSeedpackOrg());
-    storedLabel = "Applied Hash (server)";
-  } else {
-    stored = readMarker(markerDir());
-    storedLabel = "Applied Hash";
-  }
-
-  const result = CommandResult.success("Seedpack status");
-  const section = result.addSection("");
-  section.field("Backend", backendLabel());
-  section.field("Embedded Hash", hash);
-  if (stored === null) {
-    section.field("Status", "Not applied (run 'stigmer seedpack apply')");
-  } else {
-    section.field(storedLabel, stored);
-    section.field("Status", stored === hash ? "Up to date" : "Outdated (run 'stigmer seedpack apply' to update)");
-  }
-  renderResult(result, resultFormat(flags));
-}
-
-// Marker lives with the backend's state: the data dir for local, the config dir
-// for cloud (mirrors the Go CLI's resolveMarkerDir).
-function markerDir(): string {
-  return isCloudMode(load()) ? configDir() : dataDir();
-}
-
-function backendLabel(): string {
-  const config = load();
-  if (!isCloudMode(config)) return "local";
-  const endpoint = config.backend.cloud?.endpoint ?? "api.stigmer.ai:443";
-  return `cloud (${endpoint})`;
-}

package/src/local/seedpack/apply.test.ts

@@ -1,287 +0,0 @@
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import type { Message } from "@bufbuild/protobuf";
-import type { Stigmer } from "@stigmer/sdk";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { buildDeclarativeItems, scanResourceFiles } from "../../resources/apply/declarative.js";
-import type { ControllerFn } from "../../resources/apply/handlers.js";
-import {
-  applySeedpack,
-  readServerSeedpackHash,
-  resolveSeedpackOrg,
-  SEEDPACK_HASH_LABEL,
-  SEEDPACK_PROJECT_SLUG,
-  seedpackContentHash,
-} from "./apply.js";
-import type { SeedpackContent } from "./content.js";
-import { extractSeedpack, readMarker, resolveSeedpackContent } from "./content.js";
-
-const ORG_YAML = [
-  "apiVersion: tenancy.stigmer.ai/v1",
-  "kind: Organization",
-  "metadata:",
-  "  name: Stigmer",
-  "  slug: stigmer",
-  "spec:",
-  '  description: "System org"',
-  "  management_mode: self_managed",
-  "",
-].join("\n");
-
-const PROJECT_YAML = [
-  "apiVersion: tenancy.stigmer.ai/v1",
-  "kind: Project",
-  "metadata:",
-  "  name: stigmer-seedpack",
-  "  org: stigmer",
-  "spec:",
-  "  description: System seedpack",
-  "",
-].join("\n");
-
-// A seedpack fixture with just an org + the project manifest — enough to exercise
-// both apply phases (organizations via file mode, the project via the declarative
-// reconciler) without pulling in skill-push or MCP discovery.
-function makeContent(): SeedpackContent {
-  const dir = mkdtempSync(join(tmpdir(), "seedpack-apply-"));
-  writeFileSync(join(dir, "stigmer.yaml"), PROJECT_YAML);
-  mkdirSync(join(dir, "organizations"), { recursive: true });
-  writeFileSync(join(dir, "organizations", "stigmer.yaml"), ORG_YAML);
-  return { dir, source: "repo" };
-}
-
-// Records each applied message (and its proto type name); every controller
-// resolves to the same stub apply (the handlers only call `.apply`).
-function recordingDeps(stigmer?: unknown) {
-  const applied: string[] = [];
-  const appliedMessages: Message[] = [];
-  const controller = (() => ({
-    apply: async (m: Message) => {
-      applied.push((m as { $typeName: string }).$typeName);
-      appliedMessages.push(m);
-      return m;
-    },
-  })) as unknown as ControllerFn;
-  return {
-    applied,
-    appliedMessages,
-    deps: {
-      controller,
-      stigmer: (stigmer ?? {}) as never,
-      info: () => {},
-      warn: () => {},
-    },
-  };
-}
-
-// A Stigmer stub whose project.getByReference reports the given stored hash
-// (null → the label is absent; "absent" → the project itself does not exist).
-function stigmerWithServerHash(stored: string | null | "absent"): Stigmer {
-  return {
-    project: {
-      getByReference: async () => {
-        if (stored === "absent") throw new Error("not found");
-        return { metadata: { labels: stored === null ? {} : { [SEEDPACK_HASH_LABEL]: stored } } };
-      },
-    },
-  } as unknown as Stigmer;
-}
-
-let content: SeedpackContent;
-let markerDir: string;
-beforeEach(() => {
-  content = makeContent();
-  markerDir = mkdtempSync(join(tmpdir(), "seedpack-marker-"));
-});
-afterEach(() => {
-  rmSync(content.dir, { recursive: true, force: true });
-  rmSync(markerDir, { recursive: true, force: true });
-});
-
-describe("resolveSeedpackOrg", () => {
-  const saved = process.env.STIGMER_SEEDPACK_ORG;
-  afterEach(() => {
-    if (saved === undefined) delete process.env.STIGMER_SEEDPACK_ORG;
-    else process.env.STIGMER_SEEDPACK_ORG = saved;
-  });
-
-  it("prefers explicit, then env var, then the default", () => {
-    delete process.env.STIGMER_SEEDPACK_ORG;
-    expect(resolveSeedpackOrg("acme")).toBe("acme");
-    expect(resolveSeedpackOrg()).toBe("stigmer");
-    process.env.STIGMER_SEEDPACK_ORG = "from-env";
-    expect(resolveSeedpackOrg()).toBe("from-env");
-    expect(resolveSeedpackOrg("explicit")).toBe("explicit");
-  });
-});
-
-describe("applySeedpack", () => {
-  it("applies the org and project, then writes the marker", async () => {
-    const { applied, deps } = recordingDeps();
-    const result = await applySeedpack(deps, { markerDir, content });
-
-    expect(result.applied).toBe(true);
-    expect(result.org).toBe("stigmer");
-    expect(applied.some((t) => t.endsWith("Organization"))).toBe(true);
-    expect(applied.some((t) => t.endsWith("Project"))).toBe(true);
-    expect(readMarker(markerDir)).toBe(result.hash);
-  });
-
-  it("is idempotent: a matching marker skips the backend entirely", async () => {
-    const { applied, deps } = recordingDeps();
-    await applySeedpack(deps, { markerDir, content });
-
-    const second = recordingDeps();
-    const result = await applySeedpack(second.deps, { markerDir, content });
-    expect(result.applied).toBe(false);
-    expect(second.applied).toHaveLength(0);
-    // The first run did touch the backend.
-    expect(applied.length).toBeGreaterThan(0);
-  });
-
-  it("re-applies when forced even if the marker matches", async () => {
-    const first = recordingDeps();
-    await applySeedpack(first.deps, { markerDir, content });
-
-    const forced = recordingDeps();
-    const result = await applySeedpack(forced.deps, { markerDir, content, force: true });
-    expect(result.applied).toBe(true);
-    expect(forced.applied.length).toBeGreaterThan(0);
-  });
-
-  it("stamps the content hash as a reserved label on the applied Project", async () => {
-    const { appliedMessages, deps } = recordingDeps();
-    const result = await applySeedpack(deps, { markerDir, content });
-
-    const project = appliedMessages.find((m) => (m as { $typeName: string }).$typeName.endsWith("Project")) as
-      | { metadata?: { labels: Record<string, string> } }
-      | undefined;
-    expect(project).toBeDefined();
-    expect(project?.metadata?.labels[SEEDPACK_HASH_LABEL]).toBe(result.hash);
-  });
-});
-
-describe("applySeedpack — cloud mode (useServerHash)", () => {
-  it("skips when the server's recorded hash matches, without touching the marker", async () => {
-    const hash = seedpackContentHash({ content });
-    const { applied, deps } = recordingDeps(stigmerWithServerHash(hash));
-
-    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
-
-    expect(result.applied).toBe(false);
-    expect(applied).toHaveLength(0);
-    expect(readMarker(markerDir)).toBeNull();
-  });
-
-  it("applies when the server records a different hash — and never writes the marker", async () => {
-    const { applied, deps } = recordingDeps(stigmerWithServerHash("sha256:0000000000000000"));
-
-    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
-
-    expect(result.applied).toBe(true);
-    expect(applied.length).toBeGreaterThan(0);
-    // Cloud mode's record is the Project label; a marker here would be a
-    // second record of the same fact, free to drift.
-    expect(readMarker(markerDir)).toBeNull();
-  });
-
-  it("applies when the seedpack Project does not exist yet (first bootstrap)", async () => {
-    const { applied, deps } = recordingDeps(stigmerWithServerHash("absent"));
-
-    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
-
-    expect(result.applied).toBe(true);
-    expect(applied.length).toBeGreaterThan(0);
-  });
-
-  it("ignores a stale local marker: the server is the only truth consulted", async () => {
-    const hash = seedpackContentHash({ content });
-    // A leftover marker from the pre-cloud#429 era says "up to date"…
-    const { deps: first } = recordingDeps();
-    await applySeedpack(first, { markerDir, content });
-    // …but the server has never seen this content.
-    const { applied, deps } = recordingDeps(stigmerWithServerHash(null));
-
-    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true });
-
-    expect(result.applied).toBe(true);
-    expect(applied.length).toBeGreaterThan(0);
-    expect(hash).toBe(result.hash);
-  });
-
-  it("re-applies when forced even if the server hash matches", async () => {
-    const hash = seedpackContentHash({ content });
-    const { applied, deps } = recordingDeps(stigmerWithServerHash(hash));
-
-    const result = await applySeedpack(deps, { markerDir, content, useServerHash: true, force: true });
-
-    expect(result.applied).toBe(true);
-    expect(applied.length).toBeGreaterThan(0);
-  });
-});
-
-describe("readServerSeedpackHash", () => {
-  it("returns the recorded label", async () => {
-    const hash = await readServerSeedpackHash(stigmerWithServerHash("sha256:abcdef0123456789"), "stigmer");
-    expect(hash).toBe("sha256:abcdef0123456789");
-  });
-
-  it("returns null when the label is absent", async () => {
-    expect(await readServerSeedpackHash(stigmerWithServerHash(null), "stigmer")).toBeNull();
-  });
-
-  it("returns null when the project cannot be read (never applied / transient failure)", async () => {
-    expect(await readServerSeedpackHash(stigmerWithServerHash("absent"), "stigmer")).toBeNull();
-  });
-});
-
-describe("seedpackContentHash", () => {
-  it("hashes the provided content", () => {
-    expect(seedpackContentHash({ content })).toMatch(/^sha256:[0-9a-f]{16}$/);
-  });
-});
-
-// Regression guard for the credential-manifest bootstrap blocker: the *real*
-// seedpack content must pass cleanly through the declarative scanner. Every
-// staged file is a resource (carries a `kind`); any non-resource file (e.g. the
-// CI canary manifest) must live outside the content set, never beside the
-// McpServer YAMLs where `loadDocuments(strict)` would reject it for missing a
-// `kind`. The synthetic fixtures above can't catch this — only real content can.
-// The cloud-mode hash read addresses the seedpack Project by a pinned slug.
-// The server derives the slug from the manifest's metadata.name, so this pin
-// holds exactly as long as the real seedpack keeps that name — verify against
-// the real content so a rename there fails here, not silently in prod.
-describe("SEEDPACK_PROJECT_SLUG pins the real manifest name", () => {
-  it("matches seedpack/stigmer.yaml metadata.name", () => {
-    const real = resolveSeedpackContent();
-    const manifest = readFileSync(join(real.dir, "stigmer.yaml"), "utf8");
-    expect(manifest).toMatch(new RegExp(`name:\\s*${SEEDPACK_PROJECT_SLUG}\\s*$`, "m"));
-  });
-});
-
-describe("real seedpack content loads through the declarative scanner", () => {
-  it("scans + builds apply items without a missing-kind error", () => {
-    const real = resolveSeedpackContent();
-    const stage = mkdtempSync(join(tmpdir(), "seedpack-real-"));
-    try {
-      extractSeedpack(real.dir, stage);
-
-      const files = scanResourceFiles(stage);
-      // The scan must reach mcp-servers/ — the directory that historically held
-      // the kind-less credential-manifest.yaml.
-      expect(files.some((f) => f.includes("mcp-servers"))).toBe(true);
-
-      // The throw site. Before the fix this raises "missing 'kind' field".
-      const items = buildDeclarativeItems(files, () => {});
-      expect(items.length).toBeGreaterThan(0);
-
-      const kinds = new Set(items.map((i) => (i.document as { kind?: string }).kind));
-      expect(kinds).toContain("McpServer");
-      expect(kinds).toContain("Agent");
-      expect(kinds).toContain("Workflow");
-    } finally {
-      rmSync(stage, { recursive: true, force: true });
-    }
-  });
-});