@stigmer/sdk 3.35.0 → 3.37.0

package/__tests__/guest-auth.test.js

@@ -1,223 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { create } from "@bufbuild/protobuf";
-import { MintGuestTokenResponseSchema } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/token_pb";
-import { ConnectError, Code } from "@connectrpc/connect";
-// Intercept the token client so no transport is exercised. The mock
-// preserves the real module (create/Code/ConnectError) and only stubs
-// createClient, which GuestAuth uses to build its RPC client.
-const mintGuestToken = vi.fn();
-vi.mock("@connectrpc/connect", async (importOriginal) => {
-    const actual = await importOriginal();
-    return {
-        ...actual,
-        createClient: () => ({ mintGuestToken }),
-    };
-});
-import { createGuestAuth, GuestAuth } from "../guest-auth";
-const CONFIG = {
-    baseUrl: "https://api.stigmer.ai",
-    org: "acme",
-    slug: "support-agent",
-};
-function createMemoryStorage() {
-    const store = new Map();
-    return {
-        store,
-        getItem: (key) => store.get(key) ?? null,
-        setItem: (key, value) => {
-            store.set(key, value);
-        },
-    };
-}
-function mintResponse(overrides) {
-    return create(MintGuestTokenResponseSchema, {
-        accessToken: overrides?.accessToken ?? "guest-jwt-1",
-        tokenType: "Bearer",
-        expiresIn: overrides?.expiresIn ?? 900,
-        guestCookieId: overrides?.guestCookieId ?? "cookie-abc",
-    });
-}
-beforeEach(() => {
-    mintGuestToken.mockReset();
-    vi.useFakeTimers();
-});
-afterEach(() => {
-    vi.useRealTimers();
-});
-describe("createGuestAuth", () => {
-    it("throws when baseUrl is missing", () => {
-        expect(() => createGuestAuth({ ...CONFIG, baseUrl: "" })).toThrow("baseUrl is required");
-    });
-    it("throws when org is missing", () => {
-        expect(() => createGuestAuth({ ...CONFIG, org: "" })).toThrow("org is required");
-    });
-    it("throws when slug is missing", () => {
-        expect(() => createGuestAuth({ ...CONFIG, slug: "" })).toThrow("slug is required");
-    });
-    it("returns a GuestAuth instance with valid config", () => {
-        expect(createGuestAuth(CONFIG)).toBeInstanceOf(GuestAuth);
-    });
-});
-describe("GuestAuth.getAccessToken", () => {
-    it("mints on first call and sends an empty guest id", async () => {
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        const token = await auth.getAccessToken();
-        expect(token).toBe("guest-jwt-1");
-        expect(mintGuestToken).toHaveBeenCalledTimes(1);
-        expect(mintGuestToken.mock.calls[0][0]).toMatchObject({
-            org: "acme",
-            slug: "support-agent",
-            guestCookieId: "",
-            // No embedOrigin configured (the unframed hosted page): the field
-            // must stay empty so the server's absence-means-exempt rule applies.
-            embedOrigin: "",
-        });
-    });
-    it("passes the configured embedOrigin through to every mint", async () => {
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({
-            ...CONFIG,
-            storage: createMemoryStorage(),
-            embedOrigin: "https://docs.example.com",
-        });
-        await auth.getAccessToken();
-        // Expire the cached token, forcing a re-mint — the origin must persist.
-        vi.advanceTimersByTime(900_000);
-        await auth.getAccessToken();
-        expect(mintGuestToken).toHaveBeenCalledTimes(2);
-        for (const call of mintGuestToken.mock.calls) {
-            expect(call[0]).toMatchObject({ embedOrigin: "https://docs.example.com" });
-        }
-    });
-    it("passes the configured linkToken through to every mint", async () => {
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({
-            ...CONFIG,
-            storage: createMemoryStorage(),
-            linkToken: "tok123",
-        });
-        await auth.getAccessToken();
-        // Expire the cached token, forcing a re-mint — the token must persist
-        // so a locked link keeps working across silent re-mints.
-        vi.advanceTimersByTime(900_000);
-        await auth.getAccessToken();
-        expect(mintGuestToken).toHaveBeenCalledTimes(2);
-        for (const call of mintGuestToken.mock.calls) {
-            expect(call[0]).toMatchObject({ linkToken: "tok123" });
-        }
-    });
-    it("sends an empty linkToken when none is configured (plain link)", async () => {
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        await auth.getAccessToken();
-        expect(mintGuestToken.mock.calls[0][0]).toMatchObject({ linkToken: "" });
-    });
-    it("rejects with permission-denied when the embed origin is refused", async () => {
-        mintGuestToken.mockRejectedValue(new ConnectError("This agent can\u2019t be embedded on this site.", Code.PermissionDenied));
-        const auth = createGuestAuth({
-            ...CONFIG,
-            storage: createMemoryStorage(),
-            embedOrigin: "https://evil.example.com",
-        });
-        await expect(auth.getAccessToken()).rejects.toMatchObject({
-            code: "permission-denied",
-        });
-    });
-    it("persists the server-issued guest id and presents it on re-mint", async () => {
-        const storage = createMemoryStorage();
-        mintGuestToken.mockResolvedValue(mintResponse({ guestCookieId: "cookie-abc" }));
-        const auth = createGuestAuth({ ...CONFIG, storage });
-        await auth.getAccessToken();
-        expect(storage.store.get("stigmer:guest-id:acme")).toBe("cookie-abc");
-        expect(auth.guestCookieId).toBe("cookie-abc");
-        // Expire the cached token, forcing a second mint.
-        vi.advanceTimersByTime(900_000);
-        await auth.getAccessToken();
-        expect(mintGuestToken).toHaveBeenCalledTimes(2);
-        expect(mintGuestToken.mock.calls[1][0]).toMatchObject({
-            guestCookieId: "cookie-abc",
-        });
-    });
-    it("restores a persisted guest id from a prior visit", async () => {
-        const storage = createMemoryStorage();
-        storage.setItem("stigmer:guest-id:acme", "cookie-from-last-visit");
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({ ...CONFIG, storage });
-        await auth.getAccessToken();
-        expect(mintGuestToken.mock.calls[0][0]).toMatchObject({
-            guestCookieId: "cookie-from-last-visit",
-        });
-    });
-    it("returns the cached token while it is fresh", async () => {
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        await auth.getAccessToken();
-        // 13 minutes into a 15-minute token: still beyond the 60s skew.
-        vi.advanceTimersByTime(13 * 60_000);
-        const token = await auth.getAccessToken();
-        expect(token).toBe("guest-jwt-1");
-        expect(mintGuestToken).toHaveBeenCalledTimes(1);
-    });
-    it("re-mints when the cached token is within the expiry skew", async () => {
-        mintGuestToken
-            .mockResolvedValueOnce(mintResponse({ accessToken: "guest-jwt-1" }))
-            .mockResolvedValueOnce(mintResponse({ accessToken: "guest-jwt-2" }));
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        await auth.getAccessToken();
-        // 30 seconds of life left — inside the 60s skew window.
-        vi.advanceTimersByTime(900_000 - 30_000);
-        const token = await auth.getAccessToken();
-        expect(token).toBe("guest-jwt-2");
-        expect(mintGuestToken).toHaveBeenCalledTimes(2);
-    });
-    it("collapses concurrent callers into a single mint", async () => {
-        let release;
-        mintGuestToken.mockImplementation(() => new Promise((resolve) => { release = resolve; }));
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        const first = auth.getAccessToken();
-        const second = auth.getAccessToken();
-        release(mintResponse());
-        await expect(first).resolves.toBe("guest-jwt-1");
-        await expect(second).resolves.toBe("guest-jwt-1");
-        expect(mintGuestToken).toHaveBeenCalledTimes(1);
-    });
-    it("rejects with a wrapped StigmerError when sharing is revoked", async () => {
-        mintGuestToken.mockRejectedValue(new ConnectError("agent not found", Code.NotFound));
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        try {
-            await auth.getAccessToken();
-            expect.fail("should have thrown");
-        }
-        catch (e) {
-            expect(e).toHaveProperty("name", "StigmerError");
-            expect(e).toHaveProperty("code", "not-found");
-        }
-    });
-    it("recovers after a failed mint instead of caching the failure", async () => {
-        mintGuestToken
-            .mockRejectedValueOnce(new ConnectError("unavailable", Code.Unavailable))
-            .mockResolvedValueOnce(mintResponse());
-        const auth = createGuestAuth({ ...CONFIG, storage: createMemoryStorage() });
-        await expect(auth.getAccessToken()).rejects.toMatchObject({
-            code: "unavailable",
-        });
-        await expect(auth.getAccessToken()).resolves.toBe("guest-jwt-1");
-        expect(mintGuestToken).toHaveBeenCalledTimes(2);
-    });
-    it("still mints when storage throws", async () => {
-        const brokenStorage = {
-            getItem: () => {
-                throw new Error("storage disabled");
-            },
-            setItem: () => {
-                throw new Error("storage disabled");
-            },
-        };
-        mintGuestToken.mockResolvedValue(mintResponse());
-        const auth = createGuestAuth({ ...CONFIG, storage: brokenStorage });
-        await expect(auth.getAccessToken()).resolves.toBe("guest-jwt-1");
-        expect(auth.guestCookieId).toBeNull();
-    });
-});
-//# sourceMappingURL=guest-auth.test.js.map

package/__tests__/guest-auth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guest-auth.test.js","sourceRoot":"","sources":["../../src/__tests__/guest-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,4BAA4B,EAAE,MAAM,2DAA2D,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAEzD,oEAAoE;AACpE,sEAAsE;AACtE,8DAA8D;AAC9D,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC/B,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IACtD,MAAM,MAAM,GAAG,MAAM,cAAc,EAAwC,CAAC;IAC5E,OAAO;QACL,GAAG,MAAM;QACT,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAuB,MAAM,eAAe,CAAC;AAEhF,MAAM,MAAM,GAAG;IACb,OAAO,EAAE,wBAAwB;IACjC,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,eAAe;CACtB,CAAC;AAEF,SAAS,mBAAmB;IAC1B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,OAAO;QACL,KAAK;QACL,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI;QACxC,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,SAIrB;IACC,OAAO,MAAM,CAAC,4BAA4B,EAAE;QAC1C,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI,aAAa;QACpD,SAAS,EAAE,QAAQ;QACnB,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,GAAG;QACtC,aAAa,EAAE,SAAS,EAAE,aAAa,IAAI,YAAY;KACxD,CAAC,CAAC;AACL,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,cAAc,CAAC,SAAS,EAAE,CAAC;IAC3B,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,aAAa,EAAE,CAAC;AACrB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,GAAG,EAAE,CACV,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAC5C,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAC3D,iBAAiB,CAClB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAC5D,kBAAkB,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACpD,GAAG,EAAE,MAAM;YACX,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,EAAE;YACjB,kEAAkE;YAClE,qEAAqE;YACrE,WAAW,EAAE,EAAE;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC;YAC3B,GAAG,MAAM;YACT,OAAO,EAAE,mBAAmB,EAAE;YAC9B,WAAW,EAAE,0BAA0B;SACxC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,wEAAwE;QACxE,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC;YAC3B,GAAG,MAAM;YACT,OAAO,EAAE,mBAAmB,EAAE;YAC9B,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,sEAAsE;QACtE,yDAAyD;QACzD,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,cAAc,CAAC,iBAAiB,CAC9B,IAAI,YAAY,CACd,iDAAiD,EACjD,IAAI,CAAC,gBAAgB,CACtB,CACF,CAAC;QACF,MAAM,IAAI,GAAG,eAAe,CAAC;YAC3B,GAAG,MAAM;YACT,OAAO,EAAE,mBAAmB,EAAE;YAC9B,WAAW,EAAE,0BAA0B;SACxC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACxD,IAAI,EAAE,mBAAmB;SAC1B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,cAAc,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9C,kDAAkD;QAClD,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACpD,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;QACtC,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAAC;QACnE,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAErD,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE5B,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACpD,aAAa,EAAE,wBAAwB;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,gEAAgE;QAChE,EAAE,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,cAAc;aACX,qBAAqB,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC;aACnE,qBAAqB,CAAC,YAAY,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,wDAAwD;QACxD,EAAE,CAAC,mBAAmB,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,IAAI,OAA0D,CAAC;QAC/D,cAAc,CAAC,kBAAkB,CAC/B,GAAG,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACrC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAExB,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,cAAc,CAAC,iBAAiB,CAC9B,IAAI,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,CACnD,CAAC;QACF,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACjD,MAAM,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,cAAc;aACX,qBAAqB,CAAC,IAAI,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;aACxE,qBAAqB,CAAC,YAAY,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAE5E,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACxD,IAAI,EAAE,aAAa;SACpB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,CAAC,cAAc,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,aAAa,GAAmB;YACpC,OAAO,EAAE,GAAG,EAAE;gBACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;YACD,OAAO,EAAE,GAAG,EAAE;gBACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;YACtC,CAAC;SACF,CAAC;QACF,cAAc,CAAC,iBAAiB,CAAC,YAAY,EAAE,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAEpE,MAAM,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/__tests__/iam-principal.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=iam-principal.test.d.ts.map

package/__tests__/iam-principal.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"iam-principal.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/iam-principal.test.ts"],"names":[],"mappings":""}

package/__tests__/iam-principal.test.js

@@ -1,65 +0,0 @@
-/**
- * Pins the grantee vocabulary (`iam-principal.ts`) and the team half of the
- * authorization config (`authorization-config.ts`):
- *
- *   - a team is always granted as `team:<id>#member` and a person always
- *     unqualified, because the server's revoke matches the qualifier
- *     exactly and a dropped `#member` revokes nothing while reporting
- *     success;
- *   - reading an access-list entry back is the inverse of building one,
- *     and anything else (a structural principal, another team qualifier)
- *     is refused rather than guessed at;
- *   - a team may only ever be offered a subset of a person's roles, never
- *     `owner`, and nothing on `organization` (the circular grant the
- *     model's membership bound forbids).
- */
-import { describe, expect, it } from "vitest";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
-import { getGrantableRoles, getTeamGrantableRoles, hasTeamGrantableRoles, isRoleTeamGrantable, } from "../authorization-config";
-import { TEAM_GRANTABLE_ROLES } from "../gen/authorization-config";
-import { granteeFromView, granteeRef, personGrantee, teamGrantee, } from "../iam-principal";
-describe("granteeRef — the one spelling of a grantee on the wire", () => {
-    it("names a team as its members", () => {
-        const ref = granteeRef(teamGrantee("tm_sre"));
-        expect([ref.kind, ref.id, ref.relation]).toEqual(["team", "tm_sre", "member"]);
-    });
-    it("names a person with no relation qualifier", () => {
-        const ref = granteeRef(personGrantee("ida_alice"));
-        expect([ref.kind, ref.id, ref.relation]).toEqual(["identity_account", "ida_alice", ""]);
-    });
-});
-describe("granteeFromView — reading an access-list entry back", () => {
-    it("round-trips both grantees through their wire reference", () => {
-        for (const grantee of [teamGrantee("tm_sre"), personGrantee("ida_alice")]) {
-            expect(granteeFromView(granteeRef(grantee))).toEqual(grantee);
-        }
-    });
-    it("refuses what it would misname: a team without its members qualifier, a qualified person, a structural principal, an empty id", () => {
-        expect(granteeFromView({ kind: "team", id: "tm_sre", relation: "" })).toBeUndefined();
-        expect(granteeFromView({ kind: "team", id: "tm_sre", relation: "maintainer" })).toBeUndefined();
-        expect(granteeFromView({ kind: "identity_account", id: "ida_alice", relation: "member" })).toBeUndefined();
-        expect(granteeFromView({ kind: "organization", id: "acme", relation: "" })).toBeUndefined();
-        expect(granteeFromView({ kind: "identity_account", id: "", relation: "" })).toBeUndefined();
-    });
-});
-describe("team grantable roles", () => {
-    it("are, for every kind, a subset of the person's roles and never owner", () => {
-        for (const [kind, teamRoles] of TEAM_GRANTABLE_ROLES) {
-            const personRoles = getGrantableRoles(kind);
-            for (const role of teamRoles) {
-                expect(personRoles).toContain(role);
-                expect(role).not.toBe(IamRole.owner);
-            }
-        }
-    });
-    it("list nothing on organization, so an organization is never shared with a team", () => {
-        expect(hasTeamGrantableRoles(ApiResourceKind.organization)).toBe(false);
-        expect(getTeamGrantableRoles(ApiResourceKind.organization)).toEqual([]);
-    });
-    it("answer per role on a kind a team may be shared", () => {
-        expect(isRoleTeamGrantable(ApiResourceKind.agent, IamRole.viewer)).toBe(true);
-        expect(isRoleTeamGrantable(ApiResourceKind.agent, IamRole.owner)).toBe(false);
-    });
-});
-//# sourceMappingURL=iam-principal.test.js.map

package/__tests__/iam-principal.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"iam-principal.test.js","sourceRoot":"","sources":["../../src/__tests__/iam-principal.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,qFAAqF,CAAC;AACtH,OAAO,EAAE,OAAO,EAAE,MAAM,2CAA2C,CAAC;AAEpE,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,eAAe,EACf,UAAU,EACV,aAAa,EACb,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAE1B,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,UAAU,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,kBAAkB,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qDAAqD,EAAE,GAAG,EAAE;IACnE,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,KAAK,MAAM,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8HAA8H,EAAE,GAAG,EAAE;QACtI,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtF,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAChG,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC3G,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC5F,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,oBAAoB,EAAE,CAAC;YACrD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;gBAC7B,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,CAAC,mBAAmB,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/__tests__/manifest.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=manifest.test.d.ts.map

package/__tests__/manifest.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manifest.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/manifest.test.ts"],"names":[],"mappings":""}

package/__tests__/manifest.test.js

@@ -1,306 +0,0 @@
-import { describe, it, expect } from "vitest";
-import { clone, create, equals } from "@bufbuild/protobuf";
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { EnvironmentSchema } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/api_pb";
-import { ScheduleSchema } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
-import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
-import { parse as parseYaml } from "yaml";
-import { parseManifest } from "../manifest/parse";
-import { serializeManifest } from "../manifest/serialize";
-import { manifestDocumentForResource } from "../manifest/document";
-import { manifestKinds, manifestHandlerForYamlKind } from "../manifest/registry";
-/**
- * Manifest engine contract tests.
- *
- * The engine's core promise is *round-trip fidelity against the generated
- * proto schemas*: any resource the server returns serializes to YAML that
- * parses back to the same proto (minus system-managed state), and any
- * repo-authored manifest (snake_case fields, `apiVersion` spelling) parses
- * to a proto the `apply` RPC accepts. Fixtures mirror the real manifests
- * in the whatsapp-doctor-assistant dogfooding repo.
- */
-// ---------------------------------------------------------------------------
-// Fixtures — shaped like the whatsapp-doctor-assistant repo manifests
-// ---------------------------------------------------------------------------
-const AGENT_YAML = `
-apiVersion: agentic.stigmer.ai/v1
-kind: Agent
-metadata:
-  name: clinic-patient-assistant
-  org: rakeshreddi098
-spec:
-  description: Patient-facing WhatsApp assistant for the clinic.
-  instructions: |
-    You are the appointment assistant for the clinic.
-    Short messages. One question at a time.
-`;
-const ENVIRONMENT_YAML = `
-apiVersion: agentic.stigmer.ai/v1
-kind: Environment
-metadata:
-  name: clinic-patient-db
-  org: rakeshreddi098
-spec:
-  description: "Clinic records access for the patient assistant"
-  data:
-    POSTGRES_CONNECTION_URL:
-      value: "postgresql://patient_role:secret@host:5432/postgres"
-      is_secret: true
-      description: "Supabase Postgres connection URL for patient_role"
-`;
-const AGENT_CHANNEL_YAML = `
-apiVersion: agentic.stigmer.ai/v1
-kind: AgentChannel
-metadata:
-  name: clinic-patient-whatsapp
-  org: rakeshreddi098
-spec:
-  agent_ref:
-    kind: agent
-    org: rakeshreddi098
-    slug: clinic-patient-assistant
-  enabled: true
-  whatsapp:
-    phone_number_id: "1234567890"
-  app_ref:
-    kind: channel_app
-    org: rakeshreddi098
-    slug: hosipital
-  environment_refs:
-    - kind: environment
-      org: rakeshreddi098
-      slug: clinic-patient-db
-`;
-// ---------------------------------------------------------------------------
-// parseManifest
-// ---------------------------------------------------------------------------
-describe("parseManifest", () => {
-    it("parses a snake_case Agent manifest into a full Agent proto", () => {
-        const docs = parseManifest(AGENT_YAML);
-        expect(docs).toHaveLength(1);
-        const doc = docs[0];
-        expect(doc.handler.yamlKind).toBe("Agent");
-        expect(doc.name).toBe("clinic-patient-assistant");
-        expect(doc.org).toBe("rakeshreddi098");
-        const agent = doc.message;
-        expect(agent.spec?.description).toBe("Patient-facing WhatsApp assistant for the clinic.");
-        expect(agent.spec?.instructions).toContain("appointment assistant");
-    });
-    it("parses an AgentChannel manifest with enum-valued resource refs", () => {
-        const docs = parseManifest(AGENT_CHANNEL_YAML);
-        expect(docs).toHaveLength(1);
-        expect(docs[0].handler.yamlKind).toBe("AgentChannel");
-        expect(docs[0].slug).toBe("clinic-patient-whatsapp");
-    });
-    it("sorts multi-document manifests into dependency apply order", () => {
-        // Authored channel-first; the Environment must still apply first.
-        const docs = parseManifest(`${AGENT_CHANNEL_YAML}\n---\n${ENVIRONMENT_YAML}`);
-        expect(docs.map((d) => d.handler.yamlKind)).toEqual([
-            "Environment",
-            "AgentChannel",
-        ]);
-    });
-    it("injects the target org when the document omits it", () => {
-        const yaml = AGENT_YAML.replace("  org: rakeshreddi098\n", "");
-        const docs = parseManifest(yaml, { org: "acme" });
-        expect(docs[0].org).toBe("acme");
-        expect(docs[0].warning).toBeUndefined();
-    });
-    it("honors the document org and warns when it differs from the target", () => {
-        const docs = parseManifest(AGENT_YAML, { org: "acme" });
-        expect(docs[0].org).toBe("rakeshreddi098");
-        expect(docs[0].warning).toContain('"rakeshreddi098"');
-        expect(docs[0].warning).toContain('"acme"');
-    });
-    it("rejects unknown fields loudly (strict schema contract)", () => {
-        const yaml = AGENT_YAML.replace("spec:", "spec:\n  instrctions: typo");
-        expect(() => parseManifest(yaml)).toThrow(/Invalid Agent/);
-    });
-    it("rejects a document without a kind", () => {
-        expect(() => parseManifest("metadata:\n  name: x\n")).toThrow(/'kind'/);
-    });
-    it("rejects unsupported kinds with the supported list", () => {
-        expect(() => parseManifest("kind: Skill\nmetadata:\n  name: x\n")).toThrow(/Unsupported resource kind "Skill".*Agent/s);
-    });
-    it("rejects empty input with actionable guidance", () => {
-        expect(() => parseManifest("   \n")).toThrow(/empty/i);
-    });
-    it("rejects malformed YAML", () => {
-        expect(() => parseManifest("kind: Agent\n  bad indent: [")).toThrow(/Invalid YAML/);
-    });
-});
-// ---------------------------------------------------------------------------
-// serializeManifest
-// ---------------------------------------------------------------------------
-describe("serializeManifest", () => {
-    const agent = create(AgentSchema, {
-        apiVersion: "agentic.stigmer.ai/v1",
-        kind: "Agent",
-        metadata: {
-            id: "agt_01example",
-            name: "clinic-patient-assistant",
-            slug: "clinic-patient-assistant",
-            org: "rakeshreddi098",
-            version: { id: "ver_01", message: "server-managed" },
-        },
-        spec: {
-            description: "Patient-facing WhatsApp assistant.",
-            instructions: "Short messages.\nOne question at a time.\n",
-        },
-        status: { defaultInstanceId: "agi_01example" },
-    });
-    it("emits the canonical envelope: apiVersion spelling, no status", () => {
-        const yaml = serializeManifest(agent);
-        const doc = parseYaml(yaml);
-        expect(Object.keys(doc)[0]).toBe("apiVersion");
-        expect(doc.apiVersion).toBe("agentic.stigmer.ai/v1");
-        expect(doc.kind).toBe("Agent");
-        expect(doc.status).toBeUndefined();
-        expect(yaml).not.toContain("api_version:");
-    });
-    it("keeps metadata.id but strips server-managed metadata.version", () => {
-        const doc = parseYaml(serializeManifest(agent));
-        expect(doc.metadata.id).toBe("agt_01example");
-        expect(doc.metadata.version).toBeUndefined();
-    });
-    it("fills apiVersion and kind from the registry when the proto omits them", () => {
-        const bare = create(AgentSchema, {
-            metadata: { name: "x", org: "acme" },
-        });
-        const doc = parseYaml(serializeManifest(bare));
-        expect(doc.apiVersion).toBe("agentic.stigmer.ai/v1");
-        expect(doc.kind).toBe("Agent");
-    });
-    it("round-trips through parseManifest to an equal proto", () => {
-        const docs = parseManifest(serializeManifest(agent));
-        expect(docs).toHaveLength(1);
-        // The round-tripped proto matches the original minus system-managed
-        // state (status, metadata.version) — exactly what apply consumes.
-        const expected = create(AgentSchema, {
-            ...agent,
-            status: undefined,
-            metadata: { ...agent.metadata, version: undefined },
-        });
-        expect(equals(AgentSchema, docs[0].message, expected)).toBe(true);
-    });
-    it("round-trips Environment secret values byte-identically", () => {
-        const env = create(EnvironmentSchema, {
-            metadata: { name: "clinic-patient-db", org: "rakeshreddi098" },
-            spec: {
-                data: {
-                    POSTGRES_CONNECTION_URL: {
-                        value: "***REDACTED***",
-                        isSecret: true,
-                        description: "Supabase Postgres connection URL",
-                    },
-                },
-            },
-        });
-        const docs = parseManifest(serializeManifest(env));
-        const roundTripped = docs[0].message;
-        expect(roundTripped.spec?.data.POSTGRES_CONNECTION_URL?.value).toBe("***REDACTED***");
-        expect(roundTripped.spec?.data.POSTGRES_CONNECTION_URL?.isSecret).toBe(true);
-    });
-    it("rejects messages of kinds outside the registry", () => {
-        // ApiResourceMetadata is a real proto message but not a manifest kind.
-        const notAResource = create(ApiResourceMetadataSchema, { name: "x" });
-        expect(() => serializeManifest(notAResource)).toThrow(/not.*registry/i);
-    });
-});
-// ---------------------------------------------------------------------------
-// manifestDocumentForResource
-// ---------------------------------------------------------------------------
-describe("manifestDocumentForResource", () => {
-    // Shaped like a server-returned schedule: full metadata (including
-    // fields the curated ScheduleInput cannot express, like tags) and a
-    // populated status — the exact input of a lossless partial edit.
-    const schedule = create(ScheduleSchema, {
-        apiVersion: "agentic.stigmer.ai/v1",
-        kind: "Schedule",
-        metadata: {
-            id: "sch_01example",
-            name: "daily-fee-reminders",
-            slug: "daily-fee-reminders",
-            org: "isc",
-            tags: ["billing"],
-            labels: { team: "ops" },
-        },
-        spec: {
-            cron: "0 9 * * *",
-            timeZone: "Asia/Kolkata",
-            enabled: true,
-            target: {
-                case: "agent",
-                value: {
-                    agentRef: { kind: ApiResourceKind.agent, org: "isc", slug: "fee-reminder" },
-                    message: "Send today's fee reminders.",
-                },
-            },
-        },
-        status: { consecutiveFailures: 2, pausedReason: "" },
-    });
-    it("wraps a fetched proto untouched — the lossless edit contract", () => {
-        const flipped = clone(ScheduleSchema, schedule);
-        flipped.spec.enabled = false;
-        const doc = manifestDocumentForResource(flipped);
-        expect(doc.handler.yamlKind).toBe("Schedule");
-        expect(doc.name).toBe("daily-fee-reminders");
-        expect(doc.slug).toBe("daily-fee-reminders");
-        expect(doc.org).toBe("isc");
-        // Identity, not a copy: nothing is re-serialized or down-converted,
-        // so every field survives (the ScheduleInput path would drop tags).
-        expect(doc.message).toBe(flipped);
-        const expected = clone(ScheduleSchema, schedule);
-        expected.spec.enabled = false;
-        expect(equals(ScheduleSchema, doc.message, expected)).toBe(true);
-    });
-    it("falls back to name when the proto has no slug", () => {
-        const bare = create(AgentSchema, { metadata: { name: "x", org: "acme" } });
-        const doc = manifestDocumentForResource(bare);
-        expect(doc.slug).toBe("x");
-    });
-    it("rejects messages of kinds outside the registry", () => {
-        const notAResource = create(ApiResourceMetadataSchema, { name: "x" });
-        expect(() => manifestDocumentForResource(notAResource)).toThrow(/not.*registry/i);
-    });
-    it("rejects a resource without metadata.name", () => {
-        const nameless = create(ScheduleSchema, { metadata: { org: "acme" } });
-        expect(() => manifestDocumentForResource(nameless)).toThrow(/metadata\.name/);
-    });
-});
-// ---------------------------------------------------------------------------
-// Registry invariants
-// ---------------------------------------------------------------------------
-describe("manifest registry", () => {
-    it("every handler resolves by its own YAML kind", () => {
-        for (const handler of manifestKinds()) {
-            expect(manifestHandlerForYamlKind(handler.yamlKind)).toBe(handler);
-        }
-    });
-    it("apply order is strictly increasing (no accidental ties)", () => {
-        const orders = manifestKinds().map((h) => h.applyOrder);
-        for (let i = 1; i < orders.length; i++) {
-            expect(orders[i]).toBeGreaterThan(orders[i - 1]);
-        }
-    });
-    it("covers the kinds the console flows depend on", () => {
-        for (const kind of ["Agent", "McpServer", "Workflow", "Environment", "AgentChannel", "ChannelApp"]) {
-            expect(manifestHandlerForYamlKind(kind), `missing handler for ${kind}`).toBeDefined();
-        }
-    });
-    it("declares the updateVisibility binding on exactly the guarded-RPC kinds (oss#573)", () => {
-        // Visibility changes go through the updateVisibility RPC only (plain
-        // updates preserve stored visibility on both editions). The binding set
-        // mirrors the kinds whose proto VisibilityConfig grants non-private
-        // levels, minus Skill (push flow, not a manifest kind) — a kind added
-        // here without the RPC fails at compile time, one dropped from here
-        // silently strands manifest-declared visibility, which this pins.
-        const withBinding = manifestKinds()
-            .filter((h) => h.updateVisibility !== undefined)
-            .map((h) => h.yamlKind)
-            .sort();
-        expect(withBinding).toEqual(["Agent", "AgentInstance", "Environment", "McpServer", "Workflow"]);
-    });
-});
-//# sourceMappingURL=manifest.test.js.map