@stigmer/cli 3.5.2 → 3.6.0

package/src/registry/registry.test.ts

@@ -1,6 +1,9 @@
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { describe, expect, it } from "vitest";
 import { APPLY_HANDLERS } from "../resources/apply/handlers.js";
+import { DELETE_HANDLERS } from "../resources/delete.js";
+import { GET_BINDINGS } from "../resources/get-bindings.js";
+import { LIST_HANDLERS, SEARCH_KINDS } from "../resources/list.js";
 import { defaultRegistry } from "./registry.js";
 import { Verb } from "./verbs.js";
 
@@ -72,7 +75,7 @@ describe("registry — verb support matrix", () => {
     expect(registry.supportsVerb(ApiResourceKind.workflow_instance, Verb.List)).toBe(false);
   });
 
-  it("agent_channel supports the declarative verbs, matching agent_share", () => {
+  it("agent_channel supports the full declarative verb set", () => {
     for (const v of [Verb.Apply, Verb.Get, Verb.List, Verb.Delete]) {
       expect(registry.supportsVerb(ApiResourceKind.agent_channel, v)).toBe(true);
     }
@@ -81,6 +84,23 @@ describe("registry — verb support matrix", () => {
     expect(registry.supportsVerb(ApiResourceKind.agent_channel, Verb.Search)).toBe(false);
   });
 
+  it("schedule supports the full declarative verb set", () => {
+    for (const v of [Verb.Apply, Verb.Get, Verb.List, Verb.Delete]) {
+      expect(registry.supportsVerb(ApiResourceKind.schedule, v)).toBe(true);
+    }
+    // Firing rides `stigmer schedule trigger`, never the generic run verb.
+    expect(registry.supportsVerb(ApiResourceKind.schedule, Verb.Run)).toBe(false);
+  });
+
+  it("session and agent_share promise only apply (narrowed — stigmer/stigmer#354)", () => {
+    for (const kind of [ApiResourceKind.session, ApiResourceKind.agent_share]) {
+      expect(registry.supportsVerb(kind, Verb.Apply)).toBe(true);
+      for (const v of [Verb.Get, Verb.List, Verb.Delete]) {
+        expect(registry.supportsVerb(kind, v)).toBe(false);
+      }
+    }
+  });
+
   it("typesForVerb(get) includes the core read kinds", () => {
     const kinds = new Set(registry.typesForVerb(Verb.Get).map((t) => t.kind));
     expect(kinds).toContain(ApiResourceKind.agent);
@@ -98,13 +118,98 @@ describe("registry — completeness", () => {
     }
   });
 
-  // The apply verb dispatches through an explicit handler registry, not
-  // the kind registry — a kind can advertise Apply in the verb matrix yet
-  // fail at dispatch if its handler entry is missing. Pin the wiring for
-  // the kinds whose apply path the declarative flow depends on.
-  it("every declarative kind with an Apply verb intent has an apply handler", () => {
-    for (const kind of [ApiResourceKind.agent_share, ApiResourceKind.agent_channel]) {
-      expect(APPLY_HANDLERS.get(kind), `apply handler missing for kind ${kind}`).toBeDefined();
+});
+
+// The verb matrix is a PROMISE (`list types` prints it; the command layer
+// gates on it), but each verb actually runs through its own dispatch
+// registry. A pair present in the matrix but absent from its registry fails
+// at the point of use with "not implemented" — the stigmer/stigmer#353 bug
+// class. This suite holds the two to strict bidirectional equality so the
+// drift is a red test instead of a runtime surprise. Verbs deliberately
+// withheld are narrowed out of the matrix (recorded in stigmer/stigmer#354),
+// never exempted here — an exemption category would legitimize exactly the
+// state this suite exists to reject.
+describe("registry — verb/dispatch conformance", () => {
+  // Special cases are kind/verb pairs that genuinely work through bespoke
+  // code instead of a registry entry; each names its dispatch site.
+  const DISPATCH: ReadonlyArray<{
+    label: string;
+    verb: Verb;
+    wired: ReadonlySet<ApiResourceKind>;
+    specialCases: ReadonlyMap<ApiResourceKind, string>;
+  }> = [
+    {
+      label: "apply",
+      verb: Verb.Apply,
+      wired: new Set(APPLY_HANDLERS.keys()),
+      specialCases: new Map([
+        [
+          ApiResourceKind.project,
+          "the stigmer.yaml declarative/synthesis track (resources/apply/declarative.ts); " +
+            "file mode refuses with a pointer there (resolveHandlerForKind)",
+        ],
+      ]),
+    },
+    {
+      label: "get",
+      verb: Verb.Get,
+      wired: new Set(GET_BINDINGS.keys()),
+      specialCases: new Map([
+        [
+          ApiResourceKind.organization,
+          "fetchOrganization in resources/get.ts (not org-scoped; a slug resolves via findMyOrganizations)",
+        ],
+      ]),
+    },
+    {
+      label: "list",
+      verb: Verb.List,
+      wired: new Set([...LIST_HANDLERS.keys(), ...SEARCH_KINDS]),
+      specialCases: new Map(),
+    },
+    {
+      label: "delete",
+      verb: Verb.Delete,
+      wired: new Set(DELETE_HANDLERS.keys()),
+      specialCases: new Map([
+        [
+          ApiResourceKind.organization,
+          "planOrganizationDelete in resources/delete.ts (not org-scoped; resolved via memberships)",
+        ],
+      ]),
+    },
+  ];
+
+  it.each(DISPATCH)("every kind promising '$label' has a dispatch entry", ({ verb, wired, specialCases }) => {
+    for (const info of registry.all()) {
+      if (!info.supportedVerbs.has(verb)) continue;
+      if (specialCases.has(info.kind)) continue;
+      expect(
+        wired.has(info.kind),
+        `${info.name} promises '${verb}' in the verb matrix but has no dispatch entry — ` +
+          "wire it or narrow the matrix (stigmer/stigmer#353, #354)",
+      ).toBe(true);
+    }
+  });
+
+  it.each(DISPATCH)("every '$label' dispatch entry is promised in the matrix", ({ verb, wired }) => {
+    for (const kind of wired) {
+      expect(
+        registry.supportsVerb(kind, verb),
+        `${ApiResourceKind[kind]} is wired for '${verb}' but the verb matrix does not promise it — ` +
+          "dead dispatch the command-layer gate blocks",
+      ).toBe(true);
+    }
+  });
+
+  it("special cases do not shadow a real dispatch entry", () => {
+    for (const { label, wired, specialCases } of DISPATCH) {
+      for (const kind of specialCases.keys()) {
+        expect(
+          wired.has(kind),
+          `${ApiResourceKind[kind]} '${label}' is documented as a special case yet also has a registry entry — drop one`,
+        ).toBe(false);
+      }
     }
   });
 });

package/src/registry/verb-support.ts

@@ -1,20 +1,14 @@
 // Verb-support matrix — which verbs each resource kind supports.
 //
-// This is CLI-specific policy (not stored in proto), ported verbatim from Go's
-// types.verbSupport so both CLIs expose the same surface. Keep in lockstep.
-//
-//   | Kind         | apply | validate | get | list | delete | run | push | search | download |
-//   |--------------|-------|----------|-----|------|--------|-----|------|--------|----------|
-//   | Organization | Y     | -        | Y   | Y    | Y      | -   | -    | -      | -        |
-//   | Agent        | Y     | Y        | Y   | Y    | Y      | Y   | -    | Y      | -        |
-//   | Workflow     | Y     | Y        | Y   | Y    | Y      | Y   | -    | Y      | -        |
-//   | Skill        | -     | -        | Y   | Y    | Y      | -   | Y    | -      | -        |
-//   | McpServer    | Y     | Y        | Y   | Y    | Y      | -   | -    | -      | -        |
-//   | Project      | Y*    | Y        | Y   | Y    | Y      | -   | -    | -      | -        |
-//   | Execution    | -     | -        | Y   | Y    | Y**    | -   | -    | -      | Y        |
-//
-//   *  Project "apply" triggers SDK synthesis mode.
-//   ** Execution "delete" maps to a cancel operation.
+// This is CLI-specific policy (not stored in proto), and it is a PROMISE:
+// `stigmer list types` prints it, the docs type tables are written from it,
+// and the command layer gates on it before dispatch. The conformance test in
+// registry.test.ts holds every promised apply/get/list/delete verb to an
+// actual dispatch entry — and every dispatch entry back to a promise — so a
+// verb listed here either works or fails CI. "Advertised but not
+// implemented" (stigmer/stigmer#353) is a rejected state, not a backlog;
+// verbs deliberately withheld pending a real ops story are recorded in
+// stigmer/stigmer#354, not here.
 
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { Verb } from "./verbs.js";
@@ -31,17 +25,24 @@ export const VERB_SUPPORT: ReadonlyMap<ApiResourceKind, ReadonlySet<Verb>> = new
   ],
   [ApiResourceKind.skill, new Set<Verb>([Verb.Get, Verb.List, Verb.Delete, Verb.Push])],
   [ApiResourceKind.mcp_server, new Set<Verb>([Verb.Apply, Verb.Validate, Verb.Get, Verb.List, Verb.Delete])],
+  // Project apply is the stigmer.yaml declarative/synthesis track, not
+  // `apply -f project.yaml` — resolveHandlerForKind carries the teaching
+  // refusal, and the conformance test documents it as a special case.
   [ApiResourceKind.project, new Set<Verb>([Verb.Apply, Verb.Validate, Verb.Get, Verb.List, Verb.Delete])],
   [ApiResourceKind.api_key, new Set<Verb>([Verb.Get, Verb.List, Verb.Delete])],
   // agent_execution is special — uses dedicated AgentExecutionQueryController
   // RPCs, not the unified SearchService. delete maps to cancel.
   [ApiResourceKind.agent_execution, new Set<Verb>([Verb.Get, Verb.List, Verb.Delete, Verb.Download])],
-  [ApiResourceKind.identity_provider, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
-  [ApiResourceKind.oauth_app, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
+  // IAM apps are configured declaratively; read/ops verbs are deliberately
+  // not promised (never wired, no demand — stigmer/stigmer#354). To add one:
+  // dispatch entry + this line, in the same change.
+  [ApiResourceKind.identity_provider, new Set<Verb>([Verb.Apply])],
+  [ApiResourceKind.oauth_app, new Set<Verb>([Verb.Apply])],
   [ApiResourceKind.environment, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
-  // Enable/disable flows through `stigmer share agent`; the generic verbs
-  // cover the declarative path (apply a manifest, inspect, tear down).
-  [ApiResourceKind.agent_share, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
+  // Enable/disable flows through `stigmer share agent`, which is the whole
+  // read/ops surface today; only the declarative apply path is promised
+  // (stigmer/stigmer#354 records the narrowing).
+  [ApiResourceKind.agent_share, new Set<Verb>([Verb.Apply])],
   // The provider install flow is console-driven and cloud-only; the generic
   // verbs cover the declarative path (apply a manifest, inspect, tear down).
   [ApiResourceKind.agent_channel, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
@@ -52,10 +53,17 @@ export const VERB_SUPPORT: ReadonlyMap<ApiResourceKind, ReadonlySet<Verb>> = new
   // generic verbs cover the declarative path (apply a manifest, inspect,
   // tear down — delete is guarded server-side for non-empty datastores).
   [ApiResourceKind.datastore, new Set<Verb>([Verb.Apply, Verb.Validate, Verb.Get, Verb.List, Verb.Delete])],
+  // Firing is the platform's job (Temporal Schedules); the generic verbs
+  // cover the declarative path, and get/list surface the state the dedicated
+  // `stigmer schedule` commands act on — spec.enabled (the owner's switch)
+  // versus status.paused_reason (the platform's failure latch).
+  [ApiResourceKind.schedule, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
   [ApiResourceKind.agent_instance, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
   // No list: proto exposes getByWorkflow (requires workflow_id), not a generic list.
   [ApiResourceKind.workflow_instance, new Set<Verb>([Verb.Apply, Verb.Get, Verb.Delete])],
-  [ApiResourceKind.session, new Set<Verb>([Verb.Apply, Verb.Get, Verb.List, Verb.Delete])],
+  // Sessions are runtime conversation state with no CLI read/ops story yet;
+  // get/list/delete are deliberately not promised (stigmer/stigmer#354).
+  [ApiResourceKind.session, new Set<Verb>([Verb.Apply])],
 ]);
 
 export function verbsForKind(kind: ApiResourceKind): ReadonlySet<Verb> {

package/src/registry/verbs.ts

@@ -1,5 +1,4 @@
 // CLI verbs — operations that can be performed on a resource.
-// Mirrors the Go types.Verb set so the two CLIs stay behaviorally identical.
 
 export const Verb = {
   Apply: "apply",

package/src/resources/apply/apply.integration.test.ts

@@ -17,6 +17,8 @@ import { type ConnectRouter, createClient } from "@connectrpc/connect";
 import { connectNodeAdapter } from "@connectrpc/connect-node";
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
 import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import type { ChannelApp } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
+import { ChannelAppCommandController } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/command_pb";
 import type { Datastore } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
 import { DatastoreCommandController } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/command_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
@@ -33,11 +35,13 @@ const openSessions = new Set<ServerHttp2Session>();
 let appliedAgents: Agent[] = [];
 let appliedMcps: McpServer[] = [];
 let appliedDatastores: Datastore[] = [];
+let appliedChannelApps: ChannelApp[] = [];
 
 beforeEach(() => {
   appliedAgents = [];
   appliedMcps = [];
   appliedDatastores = [];
+  appliedChannelApps = [];
 });
 
 function writeYaml(dir: string, name: string, body: string): string {
@@ -66,6 +70,12 @@ beforeAll(async () => {
         return req;
       },
     });
+    router.service(ChannelAppCommandController, {
+      apply: (req) => {
+        appliedChannelApps.push(req);
+        return req;
+      },
+    });
   };
 
   backend = createHttp2Server(connectNodeAdapter({ routes }));
@@ -215,6 +225,128 @@ describe("file-mode apply — datastore", () => {
   });
 });
 
+// The stigmer/stigmer#353 regression block: ChannelApp apply used to fail
+// with "apply not implemented for Channel App" because the CLI's handler
+// table was a drifted copy of the SDK manifest registry. The handlers now
+// COME FROM that registry, so this suite pins the whole class: the kind
+// applies, secrets round-trip verbatim, and the ordering the registry
+// encodes (app before the channel that references it) is honored.
+const CHANNEL_APP_YAML = [
+  "apiVersion: agentic.stigmer.ai/v1",
+  "kind: ChannelApp",
+  "metadata:",
+  "  name: demo-whatsapp",
+  "  slug: demo-whatsapp",
+  "spec:",
+  "  whatsapp:",
+  "    app_id: '108954'",
+  "    app_secret: '***REDACTED***'",
+  "    access_token: '***REDACTED***'",
+  "    verify_token: '***REDACTED***'",
+  "",
+].join("\n");
+
+const AGENT_CHANNEL_YAML = [
+  "apiVersion: agentic.stigmer.ai/v1",
+  "kind: AgentChannel",
+  "metadata:",
+  "  name: isc-whatsapp",
+  "  slug: isc-whatsapp",
+  "spec:",
+  "  enabled: true",
+  "  agent_ref: { kind: 40, org: acme, slug: clinic-assistant }",
+  "  whatsapp: { phone_number_id: '106540352242922' }",
+  "",
+].join("\n");
+
+const SCHEDULE_YAML = [
+  "apiVersion: agentic.stigmer.ai/v1",
+  "kind: Schedule",
+  "metadata:",
+  "  name: daily-fee-reminders",
+  "  slug: daily-fee-reminders",
+  "spec:",
+  "  cron: '0 9 * * *'",
+  "  time_zone: Asia/Kolkata",
+  "  enabled: false",
+  "  agent:",
+  "    agent_ref: { kind: 40, org: acme, slug: clinic-assistant }",
+  "    message: run the reminders",
+  "",
+].join("\n");
+
+describe("file-mode apply — channel app (#353)", () => {
+  it("applies a ChannelApp through the raw controller with the redaction markers intact", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      writeYaml(dir, "chapp.yaml", CHANNEL_APP_YAML);
+      const items = resolveApplyItems(dir);
+      expect(items).toHaveLength(1);
+
+      const outcome = await applyItem(controllerFn, items[0], "acme", false);
+      expect(outcome.result.message).toBe("Channel App created successfully");
+
+      expect(appliedChannelApps).toHaveLength(1);
+      const spec = appliedChannelApps[0].spec;
+      expect(spec?.providerConfig.case).toBe("whatsapp");
+      if (spec?.providerConfig.case !== "whatsapp") throw new Error("unreachable");
+      expect(spec.providerConfig.value.appId).toBe("108954");
+      // The redaction markers must reach the server verbatim — that is the
+      // convention by which applying a fetched manifest preserves stored
+      // secrets (verb-support's OAuthApp marker note).
+      expect(spec.providerConfig.value.appSecret).toBe("***REDACTED***");
+      expect(spec.providerConfig.value.accessToken).toBe("***REDACTED***");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("treats a ChannelApp carrying metadata.id as an update", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      writeYaml(
+        dir,
+        "chapp.yaml",
+        CHANNEL_APP_YAML.replace("metadata:", "metadata:\n  id: chapp_existing"),
+      );
+      const items = resolveApplyItems(dir);
+      const outcome = await applyItem(controllerFn, items[0], "acme", false);
+      expect(outcome.result.message).toBe("Channel App updated successfully");
+      expect(appliedChannelApps[0].metadata?.id).toBe("chapp_existing");
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("orders one bundle app → channel → schedule regardless of file order", () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      // File names chosen so lexical file order is exactly WRONG — before
+      // the registry unification all three kinds fell to a shared default
+      // priority and applied in this (broken) file order.
+      writeYaml(dir, "a-schedule.yaml", SCHEDULE_YAML);
+      writeYaml(dir, "b-channel.yaml", AGENT_CHANNEL_YAML);
+      writeYaml(dir, "c-chapp.yaml", CHANNEL_APP_YAML);
+      const items = resolveApplyItems(dir);
+      expect(items.map((i) => i.handler.displayName)).toEqual(["Channel App", "Agent Channel", "Schedule"]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe("file-mode apply — project special case", () => {
+  it("refuses a Project manifest with a pointer to the stigmer.yaml flow", () => {
+    const dir = mkdtempSync(join(tmpdir(), "apply-it-"));
+    try {
+      writeYaml(dir, "project.yaml", ["kind: Project", "metadata:", "  name: Demo", "  slug: demo", ""].join("\n"));
+      expect(() => resolveApplyItems(dir)).toThrow(/stigmer\.yaml/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});
+
 describe("file-mode apply — orchestration", () => {
   it("sorts items into dependency order (mcp_server before agent)", () => {
     const dir = mkdtempSync(join(tmpdir(), "apply-it-"));

package/src/resources/apply/apply.ts

@@ -39,26 +39,6 @@ export interface ApplyOutcome {
   readonly applied?: Message;
 }
 
-// Dependency apply order (ascending priority); kinds absent get 99 (applied
-// last). Mirrors Go's applier.DefaultApplyOrder.
-const APPLY_ORDER: ReadonlyMap<ApiResourceKind, number> = new Map([
-  [ApiResourceKind.organization, 0],
-  [ApiResourceKind.mcp_server, 1],
-  // Before agent: an Agent references a Datastore via datastore_usages
-  // (the McpServer-before-Agent pattern; mirrors the SDK manifest registry).
-  [ApiResourceKind.datastore, 2],
-  [ApiResourceKind.agent, 3],
-  [ApiResourceKind.workflow, 4],
-  [ApiResourceKind.environment, 5],
-  [ApiResourceKind.identity_provider, 6],
-  [ApiResourceKind.oauth_app, 7],
-  [ApiResourceKind.agent_instance, 8],
-  [ApiResourceKind.workflow_instance, 9],
-  [ApiResourceKind.session, 10],
-  // After agent and environment: a share references both.
-  [ApiResourceKind.agent_share, 11],
-]);
-
 /** Expand a path into ordered, kind-resolved apply items (strict YAML parse). */
 export function resolveApplyItems(path: string): ApplyItem[] {
   const files = resolveYamlFiles(path);
@@ -83,14 +63,28 @@ export function resolveHandlerForKind(kind: string, where: string): ApplyHandler
   const info = defaultRegistry().getByYamlKind(kind);
   if (info === undefined) throw new UsageError(`unknown resource kind '${kind}' in ${where}`);
   if (!info.supportedVerbs.has(Verb.Apply)) throw new UsageError(`${info.displayName} does not support 'apply'`);
+  if (info.kind === ApiResourceKind.project) {
+    // Project's Apply verb is the stigmer.yaml track, deliberately not a
+    // manifest handler: a file-mode apply would create a second, member-less
+    // way to apply a project, bypassing the membership reconciler.
+    throw new UsageError(
+      `a Project is not applied from a resource manifest (${where}): ` +
+        "run `stigmer apply` in the directory containing stigmer.yaml and the project is reconciled from its members",
+    );
+  }
   const handler = APPLY_HANDLERS.get(info.kind);
   if (handler === undefined) throw new UsageError(`apply not implemented for ${info.displayName}`);
   return handler;
 }
 
-/** Stable sort by dependency priority (Array.prototype.sort is stable in V8). */
+/**
+ * Stable sort by dependency priority (Array.prototype.sort is stable in V8).
+ * The priority rides each handler (`applyOrder`, sourced from the SDK
+ * manifest registry) — there is deliberately no local ordering table to
+ * drift from it.
+ */
 export function sortApplyItems(items: ApplyItem[]): ApplyItem[] {
-  items.sort((a, b) => priorityOf(a.handler.kind) - priorityOf(b.handler.kind));
+  items.sort((a, b) => a.handler.applyOrder - b.handler.applyOrder);
   return items;
 }
 
@@ -202,6 +196,3 @@ function buildDryRunResult(handler: ApplyHandler, message: Message): CommandResu
   return result;
 }
 
-function priorityOf(kind: ApiResourceKind): number {
-  return APPLY_ORDER.get(kind) ?? 99;
-}