@stigmer/cli 3.23.0 → 3.24.0

package/src/resources/apply/apply.test.ts

@@ -51,20 +51,20 @@ function handlerWith(opts: HandlerOptions): { handler: ApplyHandler; calls: Upda
 
 describe("applyMessage declared-visibility follow-up", () => {
   it("lands a declared level the update preserved away, and reflects it on the outcome", async () => {
-    // Server preserved stored org; manifest declares public.
+    // Server preserved stored org; manifest declares platform.
     const { handler, calls } = handlerWith({
       applyReturns: agent(ApiResourceVisibility.visibility_org),
-      updateVisibility: () => Promise.resolve(agent(ApiResourceVisibility.visibility_public)),
+      updateVisibility: () => Promise.resolve(agent(ApiResourceVisibility.visibility_platform)),
     });
 
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false);
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false);
 
     expect(calls).toHaveLength(1);
     expect(calls[0].resourceId).toBe("agent-1");
-    expect(calls[0].visibility).toBe(ApiResourceVisibility.visibility_public);
+    expect(calls[0].visibility).toBe(ApiResourceVisibility.visibility_platform);
     expect(outcome.warning).toBeUndefined();
     const appliedMeta = (outcome.applied as { metadata?: { visibility?: ApiResourceVisibility } })?.metadata;
-    expect(appliedMeta?.visibility).toBe(ApiResourceVisibility.visibility_public);
+    expect(appliedMeta?.visibility).toBe(ApiResourceVisibility.visibility_platform);
   });
 
   it("skips the follow-up when the manifest omits visibility", async () => {
@@ -87,11 +87,11 @@ describe("applyMessage declared-visibility follow-up", () => {
 
   it("skips the follow-up when the server already matches (idempotent re-apply)", async () => {
     const { handler, calls } = handlerWith({
-      applyReturns: agent(ApiResourceVisibility.visibility_public),
+      applyReturns: agent(ApiResourceVisibility.visibility_platform),
       updateVisibility: () => Promise.reject(new Error("must not be called")),
     });
 
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false);
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false);
 
     expect(calls).toHaveLength(0);
     expect(outcome.warning).toBeUndefined();
@@ -102,7 +102,7 @@ describe("applyMessage declared-visibility follow-up", () => {
       applyReturns: agent(ApiResourceVisibility.visibility_private),
     });
 
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false);
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false);
 
     expect(outcome.warning).toMatch(/visibility cannot be changed declaratively/);
     expect(outcome.warning).toMatch(/stored value is kept/);
@@ -116,7 +116,7 @@ describe("applyMessage declared-visibility follow-up", () => {
     });
 
     await expect(
-      applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", false),
+      applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", false),
     ).rejects.toThrow(/spec applied, but the manifest's visibility change was rejected/);
   });
 
@@ -126,7 +126,7 @@ describe("applyMessage declared-visibility follow-up", () => {
       updateVisibility: () => Promise.reject(new Error("must not be called")),
     });
 
-    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_public), "acme", true);
+    const outcome = await applyMessage(controller, handler, agent(ApiResourceVisibility.visibility_platform), "acme", true);
 
     expect(calls).toHaveLength(0);
     expect(outcome.applied).toBeUndefined();

package/src/resources/read-completion.integration.test.ts

@@ -100,7 +100,6 @@ describe("search integration", () => {
   it("queries the SearchService and renders entries as protojson", async () => {
     const outcome = await searchResources(client, ApiResourceKind.workflow, "deploy", {
       org: "acme",
-      excludePublic: false,
       page: 1,
       pageSize: 20,
     }, "json");
@@ -113,7 +112,6 @@ describe("search integration", () => {
   it("renders a human table for search results", async () => {
     const outcome = await searchResources(client, ApiResourceKind.workflow, "deploy", {
       org: "acme",
-      excludePublic: false,
       page: 1,
       pageSize: 20,
     }, "table");

package/src/resources/search.ts

@@ -11,10 +11,8 @@ import { SEARCH_TABLE } from "./list.js";
 import { renderCollection } from "./render.js";
 
 export interface SearchParams {
-  /** Organization scope. Empty searches across all accessible orgs (incl. public). */
+  /** Organization scope. Empty searches across every org the caller can access. */
   readonly org: string;
-  /** Exclude public/platform resources, restricting to the caller's own. */
-  readonly excludePublic: boolean;
   /** 1-indexed page number. */
   readonly page: number;
   /** Results per page. */
@@ -40,7 +38,6 @@ export async function searchResources(
     kinds: [kind],
     query,
     org: params.org,
-    excludePublic: params.excludePublic,
     page: { num: params.page, size: params.pageSize },
   });
 

package/src/resources/share.test.ts

@@ -472,77 +472,24 @@ describe("shareAgent --reset-link (rotatable share token)", () => {
   });
 });
 
-describe("shareAgent cross-org (decision 013)", () => {
-  it("lands the share in the CALLER's org, agent_ref keeps the provider's", async () => {
-    const { client, applies } = fakeClient(makeAgent(), null);
-
-    const result = await shareAgent(client, "acme/support-agent", "consumer-org", {
-      enabled: true,
-      ...CLOUD,
-    });
-
-    expect(applies).toHaveLength(1);
-    // The share is the caller org's channel: its URL, billing, and
-    // credentials — while the blueprint reference stays the provider's.
-    expect(applies[0].org).toBe("consumer-org");
-    expect(applies[0].slug).toBe("support-agent");
-    expect(applies[0].agentRef).toEqual({ org: "acme", slug: "support-agent" });
-
-    const link = result.sections.find((s) => s.title === "Public chat link");
-    expect(link?.items).toEqual(["https://app.stigmer.ai/chat/consumer-org/support-agent"]);
-    expect(result.hints.some((h) => h.includes("consumer-org's credits"))).toBe(true);
-  });
-
-  it("never edits the provider org's own share (canonical resolution is org-scoped)", async () => {
-    // The provider already shares this agent with its own config; the
-    // caller's toggle must create the CALLER org's share, not flip (or
-    // inherit the config of) the provider's row.
-    const providerShare = makeShare({
-      enabled: true,
-      allowedOrigins: ["https://provider.example.com"],
-    });
-    const { client, applies } = fakeClient(makeAgent(), providerShare);
-
-    await shareAgent(client, "acme/support-agent", "consumer-org", {
-      enabled: true,
-      ...CLOUD,
-    });
-
-    expect(applies).toHaveLength(1);
-    expect(applies[0].org).toBe("consumer-org");
-    // Fresh channel, fresh config: the provider's origins must not leak
-    // into the caller org's share.
-    expect(applies[0].allowedOrigins).toEqual([]);
-  });
-
-  it("refuses --audience org with guidance (cross-org shares are public only)", async () => {
+describe("shareAgent from another organization's context", () => {
+  it("refuses before any write, naming where the share lives and the plugin remedy", async () => {
+    // The server would refuse the agent_ref too; the CLI refuses first so
+    // the caller reads the remedy rather than a bare FAILED_PRECONDITION.
     const { client, applies } = fakeClient(makeAgent(), null);
 
     const err = await shareAgent(client, "acme/support-agent", "consumer-org", {
       enabled: true,
-      audience: "org",
       ...CLOUD,
     }).catch((e: unknown) => e);
 
     expect(err).toBeInstanceOf(UsageError);
-    expect((err as Error).message).toContain("agent's own organization");
+    expect((err as Error).message).toContain("lives in acme, not consumer-org");
+    expect((err as Error).message).toContain("install the plugin that carries it");
+    expect((err as Error).message).toContain("--org acme");
     expect(classify(err)?.exitCode).toBe(ExitCode.Usage);
     expect(applies).toHaveLength(0);
   });
-
-  it("passes the server's fail-loud dependency refusal through unchanged", async () => {
-    // The D5 sweep names every non-public dependency; the CLI must
-    // surface that message verbatim — it tells the caller exactly what
-    // to ask the provider org to publish.
-    const refusal = new Error(
-      "cannot share acme/support-agent across organizations: it references resources that are not public: skill acme/private-skill",
-    );
-    const { client } = fakeClient(makeAgent(), null, { failWith: refusal });
-
-    await expect(
-      shareAgent(client, "acme/support-agent", "consumer-org", { enabled: true, ...CLOUD }),
-    ).rejects.toThrow(/skill acme\/private-skill/);
-  });
 });
 
 describe("shareAgent errors", () => {

package/src/resources/share.ts

@@ -94,32 +94,28 @@ export async function shareAgent(
 
   const agent = await resolveAgentRef(client, ref, org);
   const agentOrg = agent.metadata?.org ?? "";
-  // The share lands in the CALLER's resolved org (decision 013 D8): when
-  // it differs from the agent's, this is a cross-org share — the caller
-  // org's own channel (URL, billing, credentials) of another org's
-  // marketplace-public agent. An empty org (ID ref without context)
-  // falls back to the agent's own — the Phase A same-org form.
-  const shareOrg = org || agentOrg;
-  const isCrossOrg = shareOrg !== agentOrg;
+  // A share lives in its agent's organization: its URL, billing and
+  // credential bindings belong to the organization that owns the agent.
+  // The server refuses an agent_ref in any other organization; refusing
+  // here names the remedy instead of surfacing a bare FAILED_PRECONDITION,
+  // and mirrors the share dialog, which never offers another org's agent.
+  // An empty org (an ID ref without context) is the agent's own.
+  if (org !== "" && org !== agentOrg) {
+    throw new UsageError(
+      `a share of ${agentOrg}/${agent.metadata?.slug ?? ""} lives in ${agentOrg}, not ${org}\n\n` +
+        "A share is the agent's own organization's channel. To share another\n" +
+        "organization's agent from yours, install the plugin that carries it and\n" +
+        "share the installed copy. To manage this agent's own share:\n" +
+        `  stigmer share agent ${ref} --org ${agentOrg}`,
+    );
+  }
+  const shareOrg = agentOrg;
   let share = await resolveCanonicalShare(client, agent, shareOrg);
   const current = share?.spec;
 
   const currentAudience = audienceFromProto(current?.audience);
   const targetAudience = options.audience ?? currentAudience;
 
-  // Cross-org shares are public-audience only (decision 013 D3). The
-  // server refuses this too; refusing here names the remedy instead of
-  // surfacing a bare FAILED_PRECONDITION — and mirrors the share dialog,
-  // which hides the audience selector in cross-org mode.
-  if (isCrossOrg && targetAudience === "org") {
-    throw new UsageError(
-      "--audience org is not available for another organization's agent\n\n" +
-        `A share of ${agentOrg}/${agent.metadata?.slug ?? ""} in your organization\n` +
-        "(" + shareOrg + ") serves anyone with the link. Org-members-only sharing\n" +
-        "is limited to the agent's own organization.",
-    );
-  }
-
   // Resetting the link is meaningless for org-members-only shares: their
   // access is gated by live membership, and the member link never carries
   // the token. Refuse rather than silently rotating an unused secret —
@@ -179,10 +175,10 @@ export async function shareAgent(
  * slug equals the agent's (the server's default on create), else the
  * first entry in that org, else null when the agent has never been shared
  * there. Mirrors the web dialog's selection so both surfaces manage the
- * same row. The org scope is what keeps each org on its own channel
- * (decision 013): an agent may be shared in N orgs, and toggling here
- * must never edit another org's share. The server applies the scope via
- * the request's org field.
+ * same row. The org scope is the agent's organization, where every share
+ * of it lives; the server applies the scope via the request's org field,
+ * so a share written in another organization before sharing across
+ * organizations was retired is never the row this command edits.
  */
 async function resolveCanonicalShare(
   client: Stigmer,
@@ -214,9 +210,8 @@ function audienceFromProto(audience: AgentShareAudience | undefined): ShareAudie
 // was never shared before). Identity comes from the existing share when one
 // exists — a manifest-created share may carry a non-default slug, and
 // applying with the agent's slug would create a SECOND share — and from the
-// sharing org + the agent's slug otherwise (the server's own D2 default,
-// made explicit; for a cross-org share the org is the CALLER's, not the
-// agent's — decision 013). The audience is written explicitly — never left
+// agent's org + the agent's slug otherwise (the server's own D2 default,
+// made explicit). The audience is written explicitly — never left
 // unspecified — so a console-managed org share can't drift back to public.
 function preservingShareInput(
   agent: Agent,

package/src/resources/skill.test.ts

@@ -71,10 +71,10 @@ describe("parseSkillMetadata", () => {
   });
 
   it("parses a declared visibility from frontmatter", () => {
-    writeFileSync(join(dir, "SKILL.md"), "---\nname: my-skill\nvisibility: public\n---\n");
+    writeFileSync(join(dir, "SKILL.md"), "---\nname: my-skill\nvisibility: org\n---\n");
     expect(parseSkillMetadata(dir)).toEqual({
       name: "my-skill",
-      visibility: ApiResourceVisibility.visibility_public,
+      visibility: ApiResourceVisibility.visibility_org,
     });
   });
 
@@ -85,16 +85,23 @@ describe("parseSkillMetadata", () => {
 });
 
 describe("parseVisibility", () => {
-  it("maps the four short forms", () => {
+  it("maps the three short forms", () => {
     expect(parseVisibility("private")).toBe(ApiResourceVisibility.visibility_private);
-    expect(parseVisibility("public")).toBe(ApiResourceVisibility.visibility_public);
     expect(parseVisibility("org")).toBe(ApiResourceVisibility.visibility_org);
     expect(parseVisibility("platform")).toBe(ApiResourceVisibility.visibility_platform);
   });
 
   it("accepts canonical enum names and is case/whitespace insensitive", () => {
-    expect(parseVisibility(" Visibility_Public ")).toBe(ApiResourceVisibility.visibility_public);
-    expect(parseVisibility("PUBLIC")).toBe(ApiResourceVisibility.visibility_public);
+    expect(parseVisibility(" Visibility_Platform ")).toBe(ApiResourceVisibility.visibility_platform);
+    expect(parseVisibility("ORG")).toBe(ApiResourceVisibility.visibility_org);
+  });
+
+  it("refuses the retired public level by name, with the remedy and the valid values", () => {
+    for (const spelling of ["public", "visibility_public", " PUBLIC "]) {
+      expect(() => parseVisibility(spelling, "--visibility")).toThrow(
+        /invalid 'visibility' value '.*' in --visibility: the public level is retired[\s\S]*plugins[\s\S]*Valid values: private, org, platform\./,
+      );
+    }
   });
 
   it("treats omitted/unspecified as not declared (undefined)", () => {
@@ -141,16 +148,16 @@ const NO_IGNORE = { respectGitignore: true, extraIgnore: [], extraInclude: [] };
 
 describe("pushSkill visibility propagation", () => {
   it("issues an UpdateVisibility RPC when the SKILL.md declares a non-matching visibility", async () => {
-    writeFileSync(join(dir, "SKILL.md"), "---\nname: my-skill\nvisibility: public\n---\n");
+    writeFileSync(join(dir, "SKILL.md"), "---\nname: my-skill\nvisibility: org\n---\n");
     const { client, calls } = fakeClient({ id: "skill-123", visibility: ApiResourceVisibility.visibility_private });
 
     const result = await pushSkill(client, dir, "stigmer", "latest", "", NO_IGNORE);
 
     expect(calls.push).toBe(1);
     expect(calls.updateVisibility).toEqual([
-      { resourceId: "skill-123", visibility: ApiResourceVisibility.visibility_public },
+      { resourceId: "skill-123", visibility: ApiResourceVisibility.visibility_org },
     ]);
-    expect(result.visibility).toBe(ApiResourceVisibility.visibility_public);
+    expect(result.visibility).toBe(ApiResourceVisibility.visibility_org);
   });
 
   it("does not touch visibility when the SKILL.md omits it", async () => {
@@ -163,8 +170,8 @@ describe("pushSkill visibility propagation", () => {
   });
 
   it("skips the RPC when the server already matches the declared visibility", async () => {
-    writeFileSync(join(dir, "SKILL.md"), "---\nname: my-skill\nvisibility: public\n---\n");
-    const { client, calls } = fakeClient({ id: "skill-123", visibility: ApiResourceVisibility.visibility_public });
+    writeFileSync(join(dir, "SKILL.md"), "---\nname: my-skill\nvisibility: org\n---\n");
+    const { client, calls } = fakeClient({ id: "skill-123", visibility: ApiResourceVisibility.visibility_org });
 
     await pushSkill(client, dir, "stigmer", "latest", "", NO_IGNORE);
 
@@ -296,7 +303,7 @@ describe("readSkillArchive", () => {
 describe("pushSkillFromArchive", () => {
   it("uploads the archive bytes untouched (checksum parity) and applies declared visibility", async () => {
     const zipped = zipSync({
-      "SKILL.md": new TextEncoder().encode("---\nname: my-skill\nvisibility: public\n---\n# S\n"),
+      "SKILL.md": new TextEncoder().encode("---\nname: my-skill\nvisibility: org\n---\n# S\n"),
     });
     const archivePath = join(dir, "skill.zip");
     writeFileSync(archivePath, zipped);
@@ -307,7 +314,7 @@ describe("pushSkillFromArchive", () => {
     expect(calls.push).toBe(1);
     expect(Buffer.from(calls.pushedArtifacts[0]).equals(Buffer.from(zipped))).toBe(true);
     expect(calls.updateVisibility).toEqual([
-      { resourceId: "skill-123", visibility: ApiResourceVisibility.visibility_public },
+      { resourceId: "skill-123", visibility: ApiResourceVisibility.visibility_org },
     ]);
     expect(result.skillName).toBe("my-skill");
   });

package/src/resources/skill.ts

@@ -95,8 +95,8 @@ interface SkillMetadata {
   /**
    * Declared access level, parsed from the optional `visibility:` frontmatter
    * key. `undefined` when omitted — the skill keeps whatever the server already
-   * has (default PRIVATE for new skills). This is the declarative replacement
-   * for the Go CLI's `--public-skills` flag.
+   * has (the kind's default for new skills). The level is declared with the
+   * skill so a push carries it, rather than a second command after.
    */
   readonly visibility?: ApiResourceVisibility;
 }
@@ -143,21 +143,29 @@ export function parseSkillMetadataContent(content: string): SkillMetadata {
   return { name, visibility: parseVisibility(parsed.visibility, SKILL_FILE) };
 }
 
-// Friendly frontmatter spellings → proto enum. Both the short form (`public`)
-// and the canonical enum name (`visibility_public`) are accepted so authors can
+// Friendly frontmatter spellings → proto enum. Both the short form (`org`)
+// and the canonical enum name (`visibility_org`) are accepted so authors can
 // copy either from docs or from generated YAML. `unspecified`/empty is treated
 // as "not declared" (returns undefined) so we never emit a no-op update.
 const VISIBILITY_ALIASES: ReadonlyMap<string, ApiResourceVisibility> = new Map([
   ["private", ApiResourceVisibility.visibility_private],
   ["visibility_private", ApiResourceVisibility.visibility_private],
-  ["public", ApiResourceVisibility.visibility_public],
-  ["visibility_public", ApiResourceVisibility.visibility_public],
   ["org", ApiResourceVisibility.visibility_org],
   ["visibility_org", ApiResourceVisibility.visibility_org],
   ["platform", ApiResourceVisibility.visibility_platform],
   ["visibility_platform", ApiResourceVisibility.visibility_platform],
 ]);
 
+/**
+ * The spellings of the retired public level. They are refused like any
+ * unknown value, with one extra clause: an author who wrote `public` meant
+ * something the platform no longer offers, and the error should say so
+ * rather than read as a typo.
+ */
+const RETIRED_VISIBILITY_SPELLINGS: ReadonlySet<string> = new Set(["public", "visibility_public"]);
+
+const VALID_VISIBILITY_VALUES = "Valid values: private, org, platform.";
+
 /**
  * Map an optional `visibility` frontmatter value to the proto enum. Returns
  * undefined when omitted or explicitly unspecified; throws on an unknown value
@@ -170,13 +178,17 @@ export function parseVisibility(value: unknown, source = SKILL_FILE): ApiResourc
   }
   const key = value.trim().toLowerCase();
   if (key === "" || key === "unspecified" || key === "api_resource_visibility_unspecified") return undefined;
-  const mapped = VISIBILITY_ALIASES.get(key);
-  if (mapped === undefined) {
+  if (RETIRED_VISIBILITY_SPELLINGS.has(key)) {
     throw new UsageError(
-      `invalid 'visibility' value '${value}' in ${source}\n\n` +
-        "Valid values: private, public, org, platform.",
+      `invalid 'visibility' value '${value}' in ${source}: the public level is retired\n\n` +
+        "Resources are shared across organizations through plugins, or through the\n" +
+        `platform level between organizations linked by one identity provider. ${VALID_VISIBILITY_VALUES}`,
     );
   }
+  const mapped = VISIBILITY_ALIASES.get(key);
+  if (mapped === undefined) {
+    throw new UsageError(`invalid 'visibility' value '${value}' in ${source}\n\n${VALID_VISIBILITY_VALUES}`);
+  }
   return mapped;
 }
 
@@ -485,10 +497,9 @@ export async function pushSkillFromArchive(
 /**
  * Apply the SKILL.md-declared visibility after a push. The push RPC carries
  * artifact + provenance but not access level (visibility is metadata, not part
- * of the versioned content), so we follow it with a single UpdateVisibility RPC
- * — the declarative equivalent of the Go CLI's post-push `--public-skills`
- * sweep. No-ops (undefined visibility, or the server already matching) are
- * skipped so an unchanged skill costs nothing extra.
+ * of the versioned content), so we follow it with a single UpdateVisibility RPC.
+ * No-ops (undefined visibility, or the server already matching) are skipped
+ * so an unchanged skill costs nothing extra.
  */
 async function applyDeclaredVisibility(
   client: Stigmer,

package/local/plugins/defaults.d.ts

@@ -1,55 +0,0 @@
-import { type Stigmer } from "@stigmer/sdk";
-import { type ResolveOfficialOptions } from "../../marketplace/official.js";
-import { type PreparedPluginPush } from "../../resources/plugin.js";
-/**
- * The command that ran the install, as the plugin's stored version message
- * names it. Two verbs share the one bootstrap function, and a platform
- * operator reading the row a year later must see which one wrote it.
- */
-export type InstallingVerb = "stigmer up" | "stigmer bootstrap";
-export interface DefaultPluginsDeps {
-    /** The client bound to the backend being bootstrapped. */
-    readonly stigmer: Stigmer;
-    /** Human progress lines (stderr). */
-    readonly info: (line: string) => void;
-    /** Stamped into each installed plugin's version message. */
-    readonly verb: InstallingVerb;
-}
-/** One default, ready to push: its marketplace name and the prepared archive. */
-export interface PreparedDefault {
-    readonly name: string;
-    readonly push: PreparedPluginPush;
-}
-export type DefaultPluginOutcome = {
-    readonly name: string;
-    readonly action: "installed";
-    readonly digest: string;
-} | {
-    readonly name: string;
-    readonly action: "up-to-date";
-    readonly digest: string;
-} | {
-    readonly name: string;
-    readonly action: "failed";
-    readonly error: string;
-};
-export interface DefaultPluginsResult {
-    readonly outcomes: readonly DefaultPluginOutcome[];
-    /** The names that did not land, for the caller's warning. */
-    readonly failed: readonly string[];
-}
-/**
- * Phase 1: every default the official marketplace names, prepared in the
- * marketplace's order. Throws when the tree cannot be resolved, offers less
- * than it lists (the library drops an entry it cannot install with a
- * warning, which for a user's marketplace is `show`'s business and for ours
- * is a broken release), or any default cannot be prepared; nothing is
- * returned half-ready.
- */
-export declare function prepareDefaultPlugins(official?: ResolveOfficialOptions): Promise<readonly PreparedDefault[]>;
-/**
- * Phase 2: install the prepared defaults into `org`, skipping what the
- * backend already holds. Best-effort per entry.
- */
-export declare function installPreparedDefaults(deps: DefaultPluginsDeps, prepared: readonly PreparedDefault[], org: string): Promise<DefaultPluginsResult>;
-//# sourceMappingURL=defaults.d.ts.map

package/local/plugins/defaults.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../src/local/plugins/defaults.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,OAAO,EAAc,MAAM,cAAc,CAAC;AAOxD,OAAO,EACL,KAAK,sBAAsB,EAE5B,MAAM,+BAA+B,CAAC;AAGvC,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,mBAAmB,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;CAC/B;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,MAAM,oBAAoB,GAC5B;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;AAEN,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACnD,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,QAAQ,CAAC,EAAE,sBAAsB,GAChC,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAerC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,kBAAkB,EACxB,QAAQ,EAAE,SAAS,eAAe,EAAE,EACpC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,oBAAoB,CAAC,CA2B/B"}

package/local/plugins/defaults.js

@@ -1,111 +0,0 @@
-// The default plugins a backend is bootstrapped with: the `defaults` list of
-// the official marketplace, installed in order into the system org as
-// public. The official list is empty today (a session with no agent runs
-// the built-in assistant, so a fresh install needs no default content);
-// the mechanism stays until the bootstrap is re-scoped.
-//
-// Two phases, deliberately separate. Preparing (resolve the official tree,
-// which may acquire `@stigmer/plugins` at the CLI's version; walk, zip and
-// hash every default) needs no backend and is all-or-nothing: the catalogue
-// is ours and validated on CI, so a default that cannot be prepared is a
-// release defect, not a condition to install around. Installing pushes the
-// prepared archives and is best-effort per entry: one default failing to
-// land does not stop the next, and the caller decides how to surface the
-// failures. The split keeps every network read (the catalogue, the
-// archives) ahead of the first write to the backend (local/bootstrap.ts).
-//
-// Idempotent by the server's own identity, not a marker file: before each
-// push the org's plugin of that name is read back; when its digest equals the
-// prepared archive's, it is READY and it is public, there is nothing to do
-// and nothing is sent. A second `stigmer up` therefore pushes nothing, and a
-// `stigmer up` after an upgrade pushes exactly the entries whose content
-// changed. The record is the server, so any machine that reaches the same
-// backend sees the same answer.
-import { isNotFound } from "@stigmer/sdk";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { PluginState } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/status_pb";
-import { CliExitError } from "../../errors/cli-exit-error.js";
-import { ExitCode } from "../../errors/exit-codes.js";
-import { log } from "../../logger.js";
-import { VERSION } from "../../version.js";
-import { resolveOfficialMarketplace, } from "../../marketplace/official.js";
-import { readMarketplaceTree } from "../../marketplace/read.js";
-import { prepareEntry } from "../../marketplace/install.js";
-import { count, pushPrepared, } from "../../resources/plugin.js";
-/**
- * Phase 1: every default the official marketplace names, prepared in the
- * marketplace's order. Throws when the tree cannot be resolved, offers less
- * than it lists (the library drops an entry it cannot install with a
- * warning, which for a user's marketplace is `show`'s business and for ours
- * is a broken release), or any default cannot be prepared; nothing is
- * returned half-ready.
- */
-export async function prepareDefaultPlugins(official) {
-    const resolved = resolveOfficialMarketplace(official);
-    const tree = readMarketplaceTree(resolved.dir, "the official marketplace");
-    if (tree.warnings.length > 0) {
-        throw new CliExitError(`the official marketplace at ${resolved.dir} lists ${count(tree.warnings.length, "plugin")} this CLI cannot install`, ExitCode.General, tree.warnings.map((finding) => finding.message));
-    }
-    const prepared = [];
-    for (const name of tree.marketplace.defaults) {
-        prepared.push({ name, push: await prepareEntry(tree, name) });
-    }
-    return prepared;
-}
-/**
- * Phase 2: install the prepared defaults into `org`, skipping what the
- * backend already holds. Best-effort per entry.
- */
-export async function installPreparedDefaults(deps, prepared, org) {
-    const outcomes = [];
-    for (const { name, push } of prepared) {
-        try {
-            if (await isAlreadyInstalled(deps.stigmer, org, push)) {
-                outcomes.push({ name, action: "up-to-date", digest: push.digest });
-                continue;
-            }
-            deps.info(`Installing default plugin '${name}'…`);
-            await pushPrepared(deps.stigmer, push, {
-                org,
-                visibility: ApiResourceVisibility.visibility_public,
-                message: `default plugin, installed by ${deps.verb} (${VERSION})`,
-            });
-            outcomes.push({ name, action: "installed", digest: push.digest });
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            log.warn("default plugin install failed", { name, error: message });
-            outcomes.push({ name, action: "failed", error: message });
-        }
-    }
-    return {
-        outcomes,
-        failed: outcomes
-            .filter((outcome) => outcome.action === "failed")
-            .map((outcome) => outcome.name),
-    };
-}
-/**
- * True when the org already holds this exact archive, materialised and
- * public. A plugin that is absent (NOT_FOUND) installs; one that is present
- * with another digest, still installing, failed, or not public is pushed
- * again, which the server treats as an upgrade or a convergence.
- */
-async function isAlreadyInstalled(stigmer, org, prepared) {
-    let existing;
-    try {
-        existing = await stigmer.plugin.getByReference({
-            org,
-            slug: prepared.plugin.name,
-        });
-    }
-    catch (error) {
-        if (isNotFound(error))
-            return false;
-        throw error;
-    }
-    return (existing.status?.digest === prepared.digest &&
-        existing.status.state === PluginState.READY &&
-        existing.metadata?.visibility === ApiResourceVisibility.visibility_public);
-}
-//# sourceMappingURL=defaults.js.map

package/local/plugins/defaults.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../src/local/plugins/defaults.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,wDAAwD;AACxD,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,yEAAyE;AACzE,mEAAmE;AACnE,0EAA0E;AAC1E,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,0EAA0E;AAC1E,gCAAgC;AAEhC,OAAO,EAAgB,UAAU,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,MAAM,wDAAwD,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAEL,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,OAAO,EAEL,KAAK,EACL,YAAY,GACb,MAAM,2BAA2B,CAAC;AA+CnC;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAiC;IAEjC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CACpB,+BAA+B,QAAQ,CAAC,GAAG,UAAU,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,0BAA0B,EACpH,QAAQ,CAAC,OAAO,EAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAwB,EACxB,QAAoC,EACpC,GAAW;IAEX,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC;YACH,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;gBACtD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,8BAA8B,IAAI,IAAI,CAAC,CAAC;YAClD,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;gBACrC,GAAG;gBACH,UAAU,EAAE,qBAAqB,CAAC,iBAAiB;gBACnD,OAAO,EAAE,gCAAgC,IAAI,CAAC,IAAI,KAAK,OAAO,GAAG;aAClE,CAAC,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,QAAQ;aACb,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC;aAChD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAC/B,OAAgB,EAChB,GAAW,EACX,QAA4B;IAE5B,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;YAC7C,GAAG;YACH,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACL,QAAQ,CAAC,MAAM,EAAE,MAAM,KAAK,QAAQ,CAAC,MAAM;QAC3C,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,WAAW,CAAC,KAAK;QAC3C,QAAQ,CAAC,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,CAC1E,CAAC;AACJ,CAAC"}

package/local/system-org.d.ts

@@ -1,15 +0,0 @@
-import { type Stigmer } from "@stigmer/sdk";
-/** The system organization's slug, identical across editions. */
-export declare const SYSTEM_ORG = "stigmer";
-/**
- * Marks the system org so an operator can tell it from a user's own org in
- * any listing. Informational: no server or client code path reads it.
- */
-export declare const SYSTEM_ORG_LABEL = "stigmer.ai/system";
-export type EnsureSystemOrgOutcome = "present" | "created";
-/**
- * Make sure the system organization exists on the backend `stigmer` is bound
- * to. Idempotent; a lost create race counts as `present`.
- */
-export declare function ensureSystemOrg(stigmer: Stigmer): Promise<EnsureSystemOrgOutcome>;
-//# sourceMappingURL=system-org.d.ts.map

package/local/system-org.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"system-org.d.ts","sourceRoot":"","sources":["../../src/local/system-org.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,KAAK,OAAO,EAAgB,MAAM,cAAc,CAAC;AAE1D,iEAAiE;AACjE,eAAO,MAAM,UAAU,YAAY,CAAC;AAEpC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AAEpD,MAAM,MAAM,sBAAsB,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3D;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,sBAAsB,CAAC,CAuBjC"}