@stigmer/react 3.14.0 → 3.15.0

package/src/identity-account/__tests__/useIdentityAccountGate.test.tsx

@@ -0,0 +1,236 @@
+/**
+ * Pins the behaviour of `useIdentityAccountGate` — the console's first-sign-in
+ * gate — so the hook can delegate its whoAmI → NOT_FOUND → provisionMyAccount
+ * machine to `@stigmer/sdk`'s `ensureMyIdentityAccount` (20260911.11 A3)
+ * without changing what any consumer observes. Written green against the
+ * hook as it stood before the delegation; it must stay green after.
+ *
+ * The states and transitions it holds to:
+ *
+ *   checking ─ whoAmI answers ────────────────────────────▶ ready(account)
+ *   checking ─ whoAmI NOT_FOUND ─▶ provisioning ─ answers ─▶ ready(account)
+ *   checking ─ whoAmI other error ────────────────────────▶ error(message)
+ *   provisioning ─ provisionMyAccount fails ──────────────▶ error(message)
+ *   error ─ retry() ──────────────────────────────────────▶ checking (again)
+ *   isEnabled: false ─────────────────────────────────────▶ ready (bypassed)
+ *
+ * and one invariant a delegation could silently break: a `retry()` issued
+ * while an earlier attempt is in flight discards that attempt's outcome,
+ * whichever RPC it was waiting on.
+ */
+import { Code } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+import {
+  IdentityAccountSchema,
+  type IdentityAccount,
+} from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
+import { StigmerError } from "@stigmer/sdk";
+import {
+  act,
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { StigmerContext } from "../../context";
+import { useIdentityAccountGate } from "../useIdentityAccountGate";
+
+const EXISTING: IdentityAccount = create(IdentityAccountSchema, {
+  metadata: { id: "ida_existing" },
+  spec: { idpId: "auth0|existing" },
+});
+const CREATED: IdentityAccount = create(IdentityAccountSchema, {
+  metadata: { id: "ida_created" },
+  spec: { idpId: "auth0|created" },
+});
+
+const notFound = () =>
+  new StigmerError(
+    "not-found",
+    "Identity account not found for the authenticated user",
+    Code.NotFound,
+  );
+
+/** A promise whose settlement the test controls. */
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+/** Renders the gate and exposes its state via data attributes; click = retry. */
+function GateProbe({ isEnabled }: { isEnabled: boolean }) {
+  const { state, retry } = useIdentityAccountGate({ isEnabled });
+  return (
+    <button
+      type="button"
+      data-testid="probe"
+      data-status={state.status}
+      data-account={
+        state.status === "ready" ? (state.account?.metadata?.id ?? "") : ""
+      }
+      data-message={state.status === "error" ? state.message : ""}
+      onClick={retry}
+    />
+  );
+}
+
+function withClient(client: unknown, isEnabled = true) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      <GateProbe isEnabled={isEnabled} />
+    </StigmerContext.Provider>,
+  );
+}
+
+const probe = () => screen.getByTestId("probe");
+const status = () => probe().getAttribute("data-status");
+
+afterEach(cleanup);
+
+describe("useIdentityAccountGate", () => {
+  it("checking → ready when whoAmI answers; provisionMyAccount is never called", async () => {
+    const whoAmI = vi.fn(async () => EXISTING);
+    const provisionMyAccount = vi.fn();
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    expect(status()).toBe("checking");
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+    expect(whoAmI).toHaveBeenCalledTimes(1);
+    expect(provisionMyAccount).not.toHaveBeenCalled();
+  });
+
+  it("checking → provisioning → ready on NOT_FOUND (the first sign-in)", async () => {
+    const provision = deferred<IdentityAccount>();
+    const whoAmI = vi.fn(async () => {
+      throw notFound();
+    });
+    const provisionMyAccount = vi.fn(() => provision.promise);
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("provisioning"));
+    expect(provisionMyAccount).toHaveBeenCalledTimes(1);
+
+    provision.resolve(CREATED);
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_created");
+  });
+
+  it("any other whoAmI error is the error state with its message; no provisioning", async () => {
+    const whoAmI = vi.fn(async () => {
+      throw new StigmerError(
+        "unauthenticated",
+        "token expired",
+        Code.Unauthenticated,
+      );
+    });
+    const provisionMyAccount = vi.fn();
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("error"));
+    expect(probe().getAttribute("data-message")).toBe("token expired");
+    expect(provisionMyAccount).not.toHaveBeenCalled();
+  });
+
+  it("a provisioning failure is the error state with the provisioner's message", async () => {
+    const whoAmI = vi.fn(async () => {
+      throw notFound();
+    });
+    const provisionMyAccount = vi.fn(async () => {
+      throw new StigmerError(
+        "unavailable",
+        "userinfo answered 503",
+        Code.Unavailable,
+      );
+    });
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("error"));
+    expect(probe().getAttribute("data-message")).toBe("userinfo answered 503");
+  });
+
+  it("retry() from error restarts at checking and can reach ready", async () => {
+    let calls = 0;
+    const whoAmI = vi.fn(async () => {
+      calls += 1;
+      if (calls === 1)
+        throw new StigmerError("unavailable", "warming up", Code.Unavailable);
+      return EXISTING;
+    });
+    withClient({ identityAccount: { whoAmI } });
+
+    await waitFor(() => expect(status()).toBe("error"));
+    fireEvent.click(probe());
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+    expect(whoAmI).toHaveBeenCalledTimes(2);
+  });
+
+  it("a retry while whoAmI is in flight discards the earlier attempt's answer", async () => {
+    const first = deferred<IdentityAccount>();
+    const second = deferred<IdentityAccount>();
+    const answers = [first.promise, second.promise];
+    const whoAmI = vi.fn(() => answers.shift()!);
+    withClient({ identityAccount: { whoAmI } });
+
+    await waitFor(() => expect(whoAmI).toHaveBeenCalledTimes(1));
+    fireEvent.click(probe());
+    await waitFor(() => expect(whoAmI).toHaveBeenCalledTimes(2));
+
+    // `act` flushes React's work, so a stale setState would be visible here.
+    await act(async () => {
+      first.resolve(EXISTING);
+    });
+    expect(status(), "the stale attempt must not settle the gate").toBe(
+      "checking",
+    );
+
+    second.resolve(CREATED);
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_created");
+  });
+
+  it("a retry while provisioning is in flight discards the earlier attempt's outcome", async () => {
+    const provision = deferred<IdentityAccount>();
+    let whoAmICalls = 0;
+    const whoAmI = vi.fn(async () => {
+      whoAmICalls += 1;
+      if (whoAmICalls === 1) throw notFound();
+      return EXISTING;
+    });
+    const provisionMyAccount = vi.fn(() => provision.promise);
+    withClient({ identityAccount: { whoAmI, provisionMyAccount } });
+
+    await waitFor(() => expect(status()).toBe("provisioning"));
+    fireEvent.click(probe());
+    await waitFor(() => expect(status()).toBe("ready"));
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+
+    // The abandoned provisioning settles late; the gate keeps the second
+    // attempt's answer.
+    await act(async () => {
+      provision.reject(
+        new StigmerError("unavailable", "late failure", Code.Unavailable),
+      );
+    });
+    expect(status()).toBe("ready");
+    expect(probe().getAttribute("data-account")).toBe("ida_existing");
+  });
+
+  it("isEnabled: false bypasses the gate — ready at once, no RPC", async () => {
+    const whoAmI = vi.fn(async () => EXISTING);
+    withClient({ identityAccount: { whoAmI } }, false);
+
+    expect(status()).toBe("ready");
+    await act(async () => {});
+    expect(whoAmI).not.toHaveBeenCalled();
+  });
+});

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -2,7 +2,6 @@
 
 import { useMemo } from "react";
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
-import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
 import type { HarnessOption } from "../models/harness.js";
 
 /**
@@ -30,10 +29,12 @@ export interface AccountExecutionDefaults {
  * (`IdentityAccountSpec.preferences.default_*`) for seeding new-session
  * composers.
  *
- * Returns `undefined` in local mode (no IdentityAccount), while loading,
- * on error, and when no default is declared — every one of those cases
- * degrades to the platform's existing defaults, so consumers wire the
- * result straight through:
+ * Returns `undefined` while loading, on error (including a server that
+ * cannot answer `whoAmI`), and when no default is declared — every one of
+ * those cases degrades to the platform's existing defaults, so consumers
+ * wire the result straight through. Served in every edition: a
+ * trusted-local server answers with the operator account it creates at
+ * boot, so a laptop's saved defaults seed the composer too.
  *
  * @example
  * ```tsx
@@ -47,8 +48,7 @@ export interface AccountExecutionDefaults {
  * synchronously on every visit after the first.
  */
 export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefined {
-  const available = useResourceAvailable(ApiResourceKind.identity_account);
-  const { account } = useMyIdentityAccount({ enabled: available });
+  const { account } = useMyIdentityAccount();
 
   return useMemo(() => {
     const prefs = account?.spec?.preferences;

package/src/identity-account/useIdentityAccountGate.ts

@@ -2,7 +2,7 @@
 
 import { useCallback, useEffect, useRef, useState } from "react";
 import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityaccount/v1/api_pb";
-import { isNotFound } from "@stigmer/sdk";
+import { ensureMyIdentityAccount } from "@stigmer/sdk";
 import { useStigmer } from "../hooks.js";
 import { toError } from "../internal/toError.js";
 
@@ -65,12 +65,18 @@ export interface UseIdentityAccountGateReturn {
  * Headless behavior hook that ensures the authenticated caller has an
  * identity account before the application renders.
  *
+ * The flow itself is `@stigmer/sdk`'s {@link ensureMyIdentityAccount} — the
+ * same one the `stigmer` CLI runs on `auth login` and `auth whoami`, and the
+ * one a platform builder without React calls directly. This hook adds the
+ * React lifecycle around it: a state machine, a `retry`, and the discipline
+ * that a retry issued mid-flight discards the earlier attempt's outcome.
+ *
  * The hook drives the following lifecycle:
  *
- * 1. **`checking`** — calls `whoAmI()` to look up the caller's account.
+ * 1. **`checking`** — `whoAmI()` looks up the caller's account.
  * 2. **`provisioning`** — `whoAmI` returned NOT_FOUND (first login after
- *    signup); the hook calls `provisionMyAccount()` to create the account
- *    and personal organization.
+ *    signup); `provisionMyAccount()` creates the account (and, on Stigmer
+ *    Cloud, the personal organization).
  * 3. **`ready`** — an identity account is available (either pre-existing
  *    or freshly provisioned).
  * 4. **`error`** — a non-recoverable failure occurred; `message` carries
@@ -109,31 +115,24 @@ export function useIdentityAccountGate(options: {
   const attemptRef = useRef(0);
 
   const resolve = useCallback(async () => {
+    // Every setState below is guarded by `attempt`: a retry() issued while
+    // this attempt is in flight bumps the counter, and this attempt's
+    // outcome — whichever RPC it was waiting on — is discarded.
     const attempt = ++attemptRef.current;
     setState({ status: "checking" });
 
     try {
-      const account = await stigmer.identityAccount.whoAmI();
+      const { account } = await ensureMyIdentityAccount(stigmer, {
+        onProvisioning: () => {
+          if (attempt === attemptRef.current)
+            setState({ status: "provisioning" });
+        },
+      });
       if (attempt !== attemptRef.current) return;
       setState({ status: "ready", account });
-    } catch (whoAmIErr: unknown) {
+    } catch (err: unknown) {
       if (attempt !== attemptRef.current) return;
-
-      if (!isNotFound(whoAmIErr)) {
-        setState({ status: "error", message: toError(whoAmIErr).message });
-        return;
-      }
-
-      setState({ status: "provisioning" });
-
-      try {
-        const account = await stigmer.identityAccount.provisionMyAccount();
-        if (attempt !== attemptRef.current) return;
-        setState({ status: "ready", account });
-      } catch (provisionErr: unknown) {
-        if (attempt !== attemptRef.current) return;
-        setState({ status: "error", message: toError(provisionErr).message });
-      }
+      setState({ status: "error", message: toError(err).message });
     }
   }, [stigmer]);
 

package/src/identity-account/useMyIdentityAccount.ts

@@ -8,9 +8,9 @@ import { useFetch } from "../internal/useFetch.js";
 export interface UseMyIdentityAccountOptions {
   /**
    * When `false`, the hook is idle: no RPC is issued and `account` stays
-   * `null`. Lets always-called hooks (React's rules) skip the doomed
-   * whoAmI against a local server — pass
-   * `useResourceAvailable(ApiResourceKind.identity_account)` here.
+   * `null`. Lets always-called hooks (React's rules) stay silent on a
+   * surface that must not fetch identity — the guest and embed audiences,
+   * or a caller who has not signed in yet.
    *
    * @default true
    */
@@ -41,10 +41,11 @@ export interface UseMyIdentityAccountReturn {
  * `whoAmI()` returns the complete resource, so no follow-up `get()` is
  * needed.
  *
- * Cloud-only by nature: the OSS local server does not implement
- * IdentityAccount. Gate consumers with
- * `useResourceAvailable(ApiResourceKind.identity_account)` — either by
- * conditional mounting or via {@link UseMyIdentityAccountOptions.enabled}.
+ * Served by every edition: on Stigmer Cloud and an authenticated self-host
+ * the account is the signed-in user's; on a trusted-local server it is the
+ * operator account the server creates at boot. A caller with no account yet
+ * gets NOT_FOUND — the first-sign-in flow (`ensureMyIdentityAccount`, run by
+ * {@link useIdentityAccountGate} and the CLI) is what creates one.
  *
  * Cached across mounts under a {@link FetchCacheProvider} (DD-014): a
  * revisit renders the previous result immediately and refetches in the

package/src/index.ts

@@ -29,8 +29,15 @@ export {
   useDeploymentMode,
   useResourceAvailable,
 } from "./deployment-mode.js";
-export { type DeploymentMode, isResourceAvailable, ApiResourceKind } from "@stigmer/sdk";
-export { CloudFeatureNotice, type CloudFeatureNoticeProps } from "./internal/CloudFeatureNotice.js";
+export {
+  type DeploymentMode,
+  isResourceAvailable,
+  ApiResourceKind,
+} from "@stigmer/sdk";
+export {
+  CloudFeatureNotice,
+  type CloudFeatureNoticeProps,
+} from "./internal/CloudFeatureNotice.js";
 
 // Models — data hook, styled components, and registry data
 export {
@@ -864,6 +871,14 @@ export type {
   UseUpdateIdentityAccountReturn,
   AccountPreferencesPanelProps,
 } from "./identity-account/index.js";
+// The first-sign-in flow the gate hook delegates to, for consumers who want
+// it without the hook (the `isResourceAvailable` re-export is the precedent).
+export {
+  ensureMyIdentityAccount,
+  type EnsuredIdentityAccount,
+  type EnsureMyIdentityAccountOptions,
+  type IdentityAccountLane,
+} from "@stigmer/sdk";
 
 // Memory — agent-proposed, user-confirmed facts: data hook, decision
 // hooks (confirm/reject/delete/edit), grouping helpers, and the list panel
@@ -1454,8 +1469,15 @@ export type {
 } from "@stigmer/protos/ai/stigmer/agentic/agentchannel/v1/conversation_io_pb";
 
 // Error — structured error display with classification, retry, and contextual guidance
-export { ErrorMessage, SecretFlowErrorGuide, isSecretFlowError } from "./error/index.js";
-export type { ErrorMessageProps, SecretFlowErrorGuideProps } from "./error/index.js";
+export {
+  ErrorMessage,
+  SecretFlowErrorGuide,
+  isSecretFlowError,
+} from "./error/index.js";
+export type {
+  ErrorMessageProps,
+  SecretFlowErrorGuideProps,
+} from "./error/index.js";
 
 // Library — cross-resource UI components, resource detection, apply flow, browsing, and visibility management
 export {
@@ -1695,7 +1717,10 @@ export type {
 } from "./resource-creation/index.js";
 
 // Dependency Graph — visual tree of agent dependencies (MCP servers, skills, sub-agents)
-export { DependencyGraph, useDependencyGraph } from "./dependency-graph/index.js";
+export {
+  DependencyGraph,
+  useDependencyGraph,
+} from "./dependency-graph/index.js";
 export type {
   NodeKind,
   DependencyNode,

package/src/library/ResourceVisibilityControl.tsx

@@ -114,10 +114,12 @@ export function ResourceVisibilityControl({
 
   const isInstance = INSTANCE_KINDS.has(kind);
   const isEnvironment = kind === "environment";
-  // The IdP lookup only matters for blueprints in cloud mode; passing null
-  // makes the hook a stable no-op everywhere else.
+  // The IdP lookup only matters for blueprints where org/platform
+  // visibility is enforced — every edition but the open-source one, which
+  // has no IdP resources (editions program, DD-001). Passing null makes the
+  // hook a stable no-op everywhere else.
   const idpLookupOrg =
-    !isInstance && !isEnvironment && deploymentMode === "cloud"
+    !isInstance && !isEnvironment && deploymentMode !== "local"
       ? (org ?? null)
       : null;
   const { ssoProvider } = useSsoProvider(idpLookupOrg);

package/src/library/__tests__/useCanSetPublicVisibility.test.tsx

@@ -0,0 +1,85 @@
+/**
+ * Pins useCanSetPublicVisibility's edition shape (editions program,
+ * sp.edition-contract §3d): the hook asks whether the server has an
+ * operator seat (the `platform` kind is served), not which deployment mode
+ * it is in. Without a seat the answer is always allowed and no RPC is made
+ * (the self-hosted operator owns the store). With a seat — Enterprise and
+ * Cloud alike — the fail-closed permission check decides. Before this
+ * shape, two independent mode compares left an "enterprise" server with
+ * neither arm and a permanent `allowed: false`.
+ */
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import type { DeploymentMode } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { useCanSetPublicVisibility } from "../useCanSetPublicVisibility";
+
+function wrapper(
+  mode: DeploymentMode,
+  checkMyPermission: ReturnType<typeof vi.fn>,
+) {
+  const client = { iamPolicy: { checkMyPermission } } as never;
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <StigmerContext.Provider value={client}>
+        <DeploymentModeContext.Provider value={mode}>
+          {children}
+        </DeploymentModeContext.Provider>
+      </StigmerContext.Provider>
+    );
+  };
+}
+
+function Probe() {
+  const { allowed, isLoading } = useCanSetPublicVisibility();
+  return (
+    <div
+      data-testid="probe"
+      data-allowed={String(allowed)}
+      data-loading={String(isLoading)}
+    />
+  );
+}
+
+afterEach(cleanup);
+
+describe("useCanSetPublicVisibility", () => {
+  it("local: always allowed, no permission RPC (no operator seat to ask)", () => {
+    const check = vi.fn();
+    render(<Probe />, { wrapper: wrapper("local", check) });
+    const probe = screen.getByTestId("probe");
+    expect(probe.dataset.allowed).toBe("true");
+    expect(probe.dataset.loading).toBe("false");
+    expect(check).not.toHaveBeenCalled();
+  });
+
+  it.each(["enterprise", "cloud"] as const)(
+    "%s: the fail-closed check on platform:stigmer decides",
+    async (mode) => {
+      const check = vi.fn().mockResolvedValue({ isAuthorized: true });
+      render(<Probe />, { wrapper: wrapper(mode, check) });
+      await waitFor(() =>
+        expect(screen.getByTestId("probe").dataset.allowed).toBe("true"),
+      );
+      expect(check).toHaveBeenCalledTimes(1);
+      const input = check.mock.calls[0]?.[0] as {
+        resource?: { kind: string; id: string };
+        relation: string;
+      };
+      expect(input.resource).toMatchObject({ kind: "platform", id: "stigmer" });
+      expect(input.relation).toBe("can_set_public_visibility");
+    },
+  );
+
+  it("enterprise: denied when the seat says no — never the accidental always-false of a missed arm", async () => {
+    const check = vi.fn().mockResolvedValue({ isAuthorized: false });
+    render(<Probe />, { wrapper: wrapper("enterprise", check) });
+    await waitFor(() =>
+      expect(screen.getByTestId("probe").dataset.loading).toBe("false"),
+    );
+    expect(screen.getByTestId("probe").dataset.allowed).toBe("false");
+    expect(check).toHaveBeenCalledTimes(1);
+  });
+});

package/src/library/__tests__/visibilityLevels.test.ts

@@ -36,6 +36,34 @@ describe("environmentVisibilityLevels", () => {
   it("collapses to a single read-only level in local mode", () => {
     expect(environmentVisibilityLevels("local")).toHaveLength(1);
   });
+
+  it("offers the cloud shape in enterprise mode — org sharing is an FGA-model question, not a facility", () => {
+    expect(environmentVisibilityLevels("enterprise").map((l) => l.value)).toEqual(
+      environmentVisibilityLevels("cloud").map((l) => l.value),
+    );
+  });
+});
+
+describe("blueprintVisibilityLevels across the three editions", () => {
+  const valuesFor = (deploymentMode: "local" | "enterprise" | "cloud") =>
+    blueprintVisibilityLevels({
+      deploymentMode,
+      hasIdentityProvider: true,
+      canSetPublicVisibility: true,
+    }).map((l) => l.value);
+
+  it("collapses to Private/Public only in local mode", () => {
+    expect(valuesFor("local")).toEqual([
+      ApiResourceVisibility.visibility_private,
+      ApiResourceVisibility.visibility_public,
+    ]);
+  });
+
+  it("enterprise offers exactly what cloud offers — the org, platform and public levels", () => {
+    expect(valuesFor("enterprise")).toEqual(valuesFor("cloud"));
+    expect(valuesFor("enterprise")).toContain(ApiResourceVisibility.visibility_org);
+    expect(valuesFor("enterprise")).toContain(ApiResourceVisibility.visibility_platform);
+  });
 });
 
 describe("operator-gated PUBLIC level", () => {

package/src/library/useCanSetPublicVisibility.ts

@@ -1,6 +1,6 @@
 "use client";
 
-import { useDeploymentMode } from "../deployment-mode.js";
+import { ApiResourceKind, useResourceAvailable } from "../deployment-mode.js";
 import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
 
 /**
@@ -23,33 +23,36 @@ export interface UseCanSetPublicVisibilityReturn {
  * only level that crosses every org boundary (the cross-org "explore"
  * catalog).
  *
- * In the cloud edition, publishing is a curation decision: the backend
- * gates both write doors (updateVisibility escalation and
- * create-with-public) on `can_set_public_visibility` on `platform:stigmer`,
- * an explicit platform-operator capability. This hook runs the same check
- * so selectors can present the Public option as locked instead of letting
- * the request fail.
+ * Where the server has an operator seat — the `platform` kind is served,
+ * which is Enterprise and Cloud (editions program, DD-001) — publishing is
+ * a curation decision: the backend gates both write doors (updateVisibility
+ * escalation and create-with-public) on `can_set_public_visibility` on
+ * `platform:stigmer`, an explicit platform-operator capability. This hook
+ * runs the same check so selectors can present the Public option as locked
+ * instead of letting the request fail.
  *
  * Fail-closed, deliberately the opposite of the `useCheckPermission`
  * default: an escalation gate must not open while the check is loading or
  * when it errors — a locked option that unlocks a moment later is a far
  * better failure than an unlocked option the server then rejects.
  *
- * In `local` deployment mode (OSS Go backend) the answer is always `true`:
- * the self-hosted operator owns the store, the same scoping cloud#320
- * applied to reserved labels.
+ * Where there is no operator seat (the open-source edition) the answer is
+ * always `true`: the self-hosted operator owns the store, the same scoping
+ * cloud#320 applied to reserved labels. The question is asked of the kind
+ * registry, not of the deployment mode, so a new edition answers it by its
+ * tier table and never by falling between two mode compares.
  */
 export function useCanSetPublicVisibility(): UseCanSetPublicVisibilityReturn {
-  const deploymentMode = useDeploymentMode();
-  // Hooks run unconditionally; in local mode the null resource skips the
+  const hasOperatorSeat = useResourceAvailable(ApiResourceKind.platform);
+  // Hooks run unconditionally; without a seat the null resource skips the
   // RPC entirely and the fail mode's answer is discarded below.
   const { allowed, isLoading } = useCheckPermission(
-    deploymentMode === "cloud" ? PLATFORM_RESOURCE : null,
+    hasOperatorSeat ? PLATFORM_RESOURCE : null,
     "can_set_public_visibility",
     { fail: "closed" },
   );
 
-  if (deploymentMode === "local") {
+  if (!hasOperatorSeat) {
     return { allowed: true, isLoading: false };
   }
   return { allowed, isLoading };