@stigmer/server 3.15.3-dev.20260914121148 → 3.16.0

package/src/pipeline/steps/version-archive.ts

@@ -0,0 +1,225 @@
+/**
+ * The write side of content-addressed versioning, shared by every kind
+ * whose version is the SHA-256 of a pushed archive (skills, plugins): the
+ * "archive the head" step a push runs after the head is fully populated,
+ * and the best-effort archive cleanup a delete runs before the row. Skills
+ * carried both alone (#341, adopted for skills in #475; the Go
+ * ArchiveCurrentSkillStep / DeleteSkillArchivesStep port); plugins need the
+ * identical semantics over another schema, so the steps live here and each
+ * kind names its step (`ArchiveCurrentSkill`, `ArchiveCurrentPlugin`), its
+ * context key and where its hash and tag live.
+ *
+ * The load-bearing semantics, all preserved from the skill port:
+ *   - repoint-never-duplicate: re-pushing EVER-archived content repoints the
+ *     head to the existing audit row (an A→B→A re-push must not duplicate
+ *     A's row);
+ *   - snapshots archive TAGLESS; the audit tag COLUMN is the tag's only
+ *     home, assigned through the single-holder setAuditTag primitive —
+ *     assigned even when the content was already archived, because
+ *     re-pushing under a new tag is the only retag path;
+ *   - safe degradation: archive failure clears the version hash from the
+ *     head (the persisted head never references an unresolvable audit
+ *     entry); tag-assignment failure clears the live tag.
+ *
+ * Proven by the skill domain's __tests__/push-degradation.test.ts (the
+ * failing-store arms) and both kinds' conformance suites (the
+ * content-addressed versioning blocks).
+ */
+import type { DescMessage, MessageShape } from "@bufbuild/protobuf";
+
+import type { Logger } from "../../boot/logger.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+import { AuditNotFoundError } from "../../store/interface.js";
+import type { Store } from "../../store/interface.js";
+import { RESOURCE_ID_KEY } from "./delete.js";
+import { metadataOf } from "./shapes.js";
+
+/** What a content-versioned kind must expose for its head to be archived. */
+export interface ArchiveCurrentVersionBinding<Desc extends DescMessage> {
+  /** The step's name in the chain; shared vocabulary, never renamed. */
+  readonly stepName: string;
+  /** The context key the fully populated head rides. */
+  readonly resourceKey: string;
+  readonly schema: Desc;
+  /** The noun in log lines: "skill", "plugin". */
+  readonly noun: string;
+  headHashOf(resource: MessageShape<Desc>): string;
+  /** Degradation arm: the head must never reference an unresolvable audit row. */
+  clearHeadHash(resource: MessageShape<Desc>): void;
+  liveTagOf(resource: MessageShape<Desc>): string;
+  /** Degradation arm: the live tag must agree with the audit column. */
+  clearLiveTag(resource: MessageShape<Desc>): void;
+}
+
+/**
+ * Repoint or archive, then the single-holder tag assignment, each with its
+ * safe degradation. Runs AFTER the populate step so the archived snapshot
+ * is the fully populated head.
+ */
+export function newArchiveCurrentVersionStep<
+  Desc extends DescMessage,
+  RequestDesc extends DescMessage,
+>(
+  store: Store,
+  logger: Logger,
+  binding: ArchiveCurrentVersionBinding<Desc>,
+): PipelineStep<RequestDesc> {
+  return {
+    name: binding.stepName,
+    async execute(ctx: RequestContext<RequestDesc>): Promise<void> {
+      const resource = ctx.get(binding.resourceKey) as MessageShape<Desc>;
+      const versionHash = binding.headHashOf(resource);
+      if (versionHash === "") {
+        return;
+      }
+      const tag = binding.liveTagOf(resource);
+      const resourceId = metadataOf(resource)?.id ?? "";
+      const idField = `${binding.noun}Id`;
+
+      // Repoint, never duplicate: if this content was ever archived, the
+      // head simply repoints to the existing row and only the tag
+      // assignment below still runs. An unexpected lookup failure degrades
+      // to archiving anyway — a possible duplicate row beats a failed push
+      // (readers resolve duplicates newest-wins).
+      let alreadyArchived = false;
+      try {
+        await store.getAuditByHash(
+          ctx.apiResourceKind,
+          resourceId,
+          versionHash,
+          binding.schema,
+        );
+        alreadyArchived = true;
+      } catch (error) {
+        if (!(error instanceof AuditNotFoundError)) {
+          logger.warn(
+            `Could not check for an existing archived ${binding.noun} version — archiving anyway`,
+            {
+              [idField]: resourceId,
+              versionHash,
+              error: error instanceof Error ? error.message : String(error),
+            },
+          );
+        }
+      }
+
+      if (!alreadyArchived) {
+        // Archive the snapshot tagless: the tag lives only in the audit tag
+        // column (the source of truth), assigned below through the
+        // single-holder primitive — a later tag move never rewrites this
+        // immutable content.
+        try {
+          await store.saveAudit(
+            ctx.apiResourceKind,
+            resourceId,
+            binding.schema,
+            resource,
+            versionHash,
+            "",
+          );
+        } catch (error) {
+          logger.error(
+            `Failed to archive ${binding.noun} version — reverting the version hash to maintain the audit-resolvability invariant`,
+            {
+              [idField]: resourceId,
+              versionHash,
+              error: error instanceof Error ? error.message : String(error),
+            },
+          );
+          // Revert: the persisted head must never reference an audit entry
+          // that does not exist. The push still succeeds, but without
+          // version tracking for this apply.
+          binding.clearHeadHash(resource);
+          return;
+        }
+      }
+
+      // Assign the requested tag through setAuditTag — the single-holder
+      // primitive — so the head version (freshly archived or repointed-to)
+      // becomes the tag's sole holder; any prior holder is cleared.
+      if (tag !== "") {
+        try {
+          await store.setAuditTag(
+            ctx.apiResourceKind,
+            resourceId,
+            versionHash,
+            tag,
+          );
+        } catch (error) {
+          logger.error(
+            `Archived ${binding.noun} version but failed to assign its tag — clearing the live tag to stay consistent with the audit column`,
+            {
+              [idField]: resourceId,
+              versionHash,
+              tag,
+              error: error instanceof Error ? error.message : String(error),
+            },
+          );
+          // The audit head is now untagged; keep the live head consistent
+          // so get / getByReference never advertise a tag the store cannot
+          // resolve.
+          binding.clearLiveTag(resource);
+        }
+      }
+
+      if (alreadyArchived) {
+        logger.info(
+          `${capitalize(binding.noun)} version content already archived — repointed head without a new history row`,
+          { [idField]: resourceId, versionHash, tag },
+        );
+      } else {
+        logger.info(`Archived ${binding.noun} version to audit history`, {
+          [idField]: resourceId,
+          versionHash,
+          tag,
+        });
+      }
+    },
+  };
+}
+
+/**
+ * Best-effort audit cleanup BEFORE the resource row (no FK cascade in the
+ * schema, by design): failures log and never block the delete. Reads the
+ * id ExtractResourceId set.
+ */
+export function newDeleteVersionArchivesStep<RequestDesc extends DescMessage>(
+  store: Store,
+  logger: Logger,
+  binding: { readonly stepName: string; readonly noun: string },
+): PipelineStep<RequestDesc> {
+  return {
+    name: binding.stepName,
+    async execute(ctx: RequestContext<RequestDesc>): Promise<void> {
+      const resourceId = ctx.get(RESOURCE_ID_KEY);
+      if (typeof resourceId !== "string") {
+        throw new Error(
+          "resource id not found in context (ExtractResourceIdStep must run first)",
+        );
+      }
+      const idField = `${binding.noun}Id`;
+      try {
+        const deletedCount = await store.deleteAuditByResourceId(
+          ctx.apiResourceKind,
+          resourceId,
+        );
+        if (deletedCount > 0) {
+          logger.info(`Deleted archive records for ${binding.noun}`, {
+            [idField]: resourceId,
+            count: deletedCount,
+          });
+        }
+      } catch (error) {
+        logger.warn(`failed to delete ${binding.noun} archives (best-effort)`, {
+          [idField]: resourceId,
+          error: error instanceof Error ? error.message : String(error),
+        });
+      }
+    },
+  };
+}
+
+function capitalize(word: string): string {
+  return word.charAt(0).toUpperCase() + word.slice(1);
+}

package/src/pipeline/steps/version-history.ts

@@ -0,0 +1,362 @@
+/**
+ * The read side of content-addressed versioning, shared by every kind whose
+ * version is the SHA-256 of a pushed archive (skills, plugins): the
+ * getByReference version ladder and the paginated version history. Skills
+ * carried both alone (the Go LoadSkillByReferenceStep / ListVersions port);
+ * plugins need the identical ladder over another schema, and a second copy
+ * would be the drift the house forbids, so the steps take a
+ * `VersionedResourceBinding` that names what differs per kind (the schema,
+ * the noun in sentences, where the head hash and the live tag live, how a
+ * snapshot maps to an entry) and keep everything else once.
+ *
+ * The ladder: resolve the live head by slug+org; empty/"latest" returns it;
+ * a 64-hex version matches the head's hash or falls to the indexed
+ * audit-by-hash lookup; anything else is a tag, matching the head's live
+ * tag first (honest under the single-holder model: a push reconciles the
+ * live tag with the audit tag column, clearing the live tag when
+ * assignment fails) and then the indexed audit-by-tag lookup.
+ *
+ * listVersions marks is_current by HEAD-HASH match, not recency: under
+ * repoint semantics (#475) re-pushing archived content re-activates its
+ * existing row, so the current version need not be the newest-archived
+ * one. Tags come from the audit COLUMN (the single-holder source of
+ * truth), never from the snapshot.
+ *
+ * Proven by the skill domain's __tests__/skill.test.ts (ladder and
+ * pagination blocks) and the skill and plugin conformance suites'
+ * getByReference/listVersions blocks.
+ */
+import { fromBinary } from "@bufbuild/protobuf";
+import type { DescMessage, Message, MessageShape } from "@bufbuild/protobuf";
+
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { ApiResourceReferenceSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+
+import {
+  internalError,
+  invalidArgumentError,
+  notFoundError,
+} from "../errors.js";
+import type { PipelineStep } from "../pipeline.js";
+import type { RequestContext } from "../request-context.js";
+import { AuditNotFoundError } from "../../store/interface.js";
+import type { Store } from "../../store/interface.js";
+import { findResourceBySlug, requireOrgForReference } from "./helpers.js";
+import { TARGET_RESOURCE_KEY } from "./load-target.js";
+import { metadataOf } from "./shapes.js";
+
+/** A 64-character lowercase-hex string (a SHA-256 content hash). */
+const HASH_PATTERN = /^[a-f0-9]{64}$/;
+
+export function isVersionHash(version: string): boolean {
+  return HASH_PATTERN.test(version);
+}
+
+/** What a content-versioned kind must say about itself for the ladder. */
+export interface VersionedResourceBinding<Desc extends DescMessage> {
+  readonly kind: ApiResourceKind;
+  readonly schema: Desc;
+  /** The noun in sentences: "skill", "plugin". */
+  readonly noun: string;
+  /** The head's content hash (status.version_hash, status.digest). */
+  headHashOf(resource: MessageShape<Desc>): string;
+  /** The tag the live head claims (spec.tag; the plugin's manifest version). */
+  liveTagOf(resource: MessageShape<Desc>): string;
+}
+
+type GetByReferenceDesc = typeof ApiResourceReferenceSchema;
+
+/** The reference + version ladder (Go LoadSkillByReferenceStep, generalised). */
+export function newLoadByReferenceWithVersionStep<Desc extends DescMessage>(
+  store: Store,
+  binding: VersionedResourceBinding<Desc>,
+  stepName: string,
+): PipelineStep<GetByReferenceDesc> {
+  return {
+    name: stepName,
+    async execute(ctx: RequestContext<GetByReferenceDesc>): Promise<void> {
+      const ref = ctx.input;
+
+      if (ref.slug === "") {
+        throw invalidArgumentError("slug is required in reference");
+      }
+
+      // Org-scoped kinds: the slug is unique only within an org, so an
+      // empty-org reference is under-specified.
+      requireOrgForReference(ctx.apiResourceKind, ref.org);
+
+      if (
+        ref.kind !== ApiResourceKind.api_resource_kind_unknown &&
+        ref.kind !== binding.kind
+      ) {
+        throw invalidArgumentError(
+          `kind mismatch: expected ${ApiResourceKind[binding.kind]}, got ${ApiResourceKind[ref.kind]}`,
+        );
+      }
+
+      let head: MessageShape<Desc> | undefined;
+      try {
+        head = await findResourceBySlug(
+          store,
+          ctx.apiResourceKind,
+          binding.schema,
+          ref.slug,
+          ref.org,
+        );
+      } catch (error) {
+        throw internalError(error, `failed to list ${binding.noun}s`);
+      }
+      if (head === undefined) {
+        throw notFoundError(binding.noun, ref.slug);
+      }
+
+      const version = ref.version.trim();
+      if (version === "" || version === "latest") {
+        ctx.set(TARGET_RESOURCE_KEY, head);
+        return;
+      }
+
+      if (headMatchesVersion(binding, head, version)) {
+        ctx.set(TARGET_RESOURCE_KEY, head);
+        return;
+      }
+
+      const archived = await findAuditByVersion(
+        store,
+        ctx.apiResourceKind,
+        binding.schema,
+        idOf(head),
+        version,
+      );
+      if (archived === undefined) {
+        throw notFoundError(
+          `${binding.noun} version`,
+          `${ref.slug}:${version}`,
+        );
+      }
+      ctx.set(TARGET_RESOURCE_KEY, archived);
+    },
+  };
+}
+
+/** Whether the live head IS the requested version — by hash, or by its live tag. */
+function headMatchesVersion<Desc extends DescMessage>(
+  binding: VersionedResourceBinding<Desc>,
+  head: MessageShape<Desc>,
+  version: string,
+): boolean {
+  if (isVersionHash(version)) {
+    return binding.headHashOf(head) === version;
+  }
+  const liveTag = binding.liveTagOf(head);
+  return liveTag !== "" && liveTag === version;
+}
+
+/**
+ * Indexed audit lookup by hash or tag — not-found is a normal outcome
+ * (undefined), storage failures are Internal.
+ */
+async function findAuditByVersion<Desc extends DescMessage>(
+  store: Store,
+  kind: ApiResourceKind,
+  schema: Desc,
+  resourceId: string,
+  version: string,
+): Promise<MessageShape<Desc> | undefined> {
+  if (isVersionHash(version)) {
+    try {
+      return await store.getAuditByHash(kind, resourceId, version, schema);
+    } catch (error) {
+      if (error instanceof AuditNotFoundError) {
+        return undefined;
+      }
+      throw internalError(error, "failed to query audit by hash");
+    }
+  }
+  try {
+    return await store.getAuditByTag(kind, resourceId, version, schema);
+  } catch (error) {
+    if (error instanceof AuditNotFoundError) {
+      return undefined;
+    }
+    throw internalError(error, "failed to query audit by tag");
+  }
+}
+
+// ─── listVersions ────────────────────────────────────────────────────────
+
+const DEFAULT_PAGE_SIZE = 50;
+const MAX_PAGE_SIZE = 100;
+
+export const LIST_VERSIONS_RESOURCE_ID_KEY = "listVersionsResourceId";
+export const LIST_VERSIONS_HEAD_HASH_KEY = "listVersionsHeadHash";
+export const LIST_VERSIONS_RESPONSE_KEY = "listVersionsResponse";
+
+/** The fields every ListVersions input carries; the binding reads them off its own message. */
+export interface ListVersionsInputShape {
+  readonly org: string;
+  readonly slug: string;
+  readonly pageToken: string;
+  readonly pageSize: number;
+}
+
+/** What differs per kind in the version history: the input, the entry, the response. */
+export interface VersionHistoryBinding<
+  Desc extends DescMessage,
+  InputDesc extends DescMessage,
+  Entry extends Message,
+  Response extends Message,
+> extends VersionedResourceBinding<Desc> {
+  input(message: MessageShape<InputDesc>): ListVersionsInputShape;
+  /** An archived snapshot to one entry; `tag` is the audit column's. */
+  mapEntry(
+    snapshot: MessageShape<Desc>,
+    isCurrent: boolean,
+    tag: string,
+  ): Entry;
+  response(
+    entries: Entry[],
+    nextPageToken: string,
+    totalCount: number,
+  ): Response;
+}
+
+/** Resolves the head by slug and captures its id and hash (Go ResolveSkillBySlugStep, generalised). */
+export function newResolveBySlugForVersionsStep<
+  Desc extends DescMessage,
+  InputDesc extends DescMessage,
+  Entry extends Message,
+  Response extends Message,
+>(
+  store: Store,
+  binding: VersionHistoryBinding<Desc, InputDesc, Entry, Response>,
+  stepName: string,
+): PipelineStep<InputDesc> {
+  return {
+    name: stepName,
+    async execute(ctx: RequestContext<InputDesc>): Promise<void> {
+      const req = binding.input(ctx.input);
+      let head: MessageShape<Desc> | undefined;
+      try {
+        head = await findResourceBySlug(
+          store,
+          ctx.apiResourceKind,
+          binding.schema,
+          req.slug,
+          req.org,
+        );
+      } catch (error) {
+        throw internalError(error, `failed to search for ${binding.noun}`);
+      }
+      if (head === undefined) {
+        throw notFoundError(binding.noun, `${req.slug} (org: ${req.org})`);
+      }
+      ctx.set(LIST_VERSIONS_RESOURCE_ID_KEY, idOf(head));
+      // The live head's hash decides is_current downstream. Under repoint
+      // semantics the current version need not be the newest-archived row,
+      // so recency cannot stand in for currency.
+      ctx.set(LIST_VERSIONS_HEAD_HASH_KEY, binding.headHashOf(head));
+    },
+  };
+}
+
+/** Audit records → entries → one page (Go LoadAndMapVersionsStep, generalised). */
+export function newLoadAndMapVersionsStep<
+  Desc extends DescMessage,
+  InputDesc extends DescMessage,
+  Entry extends Message,
+  Response extends Message,
+>(
+  store: Store,
+  binding: VersionHistoryBinding<Desc, InputDesc, Entry, Response>,
+  stepName: string,
+): PipelineStep<InputDesc> {
+  return {
+    name: stepName,
+    async execute(ctx: RequestContext<InputDesc>): Promise<void> {
+      const req = binding.input(ctx.input);
+      const resourceId = ctx.get(LIST_VERSIONS_RESOURCE_ID_KEY) as string;
+
+      let records;
+      try {
+        records = await store.listAuditRecords(ctx.apiResourceKind, resourceId);
+      } catch (error) {
+        throw internalError(error, "failed to load version history");
+      }
+
+      // is_current = the entry whose hash matches the live head, not the
+      // newest row. Legacy data may hold duplicate-hash rows (predating
+      // repoint semantics); marking only the first match keeps
+      // exactly-one-current true for them too.
+      const headHash = ctx.get(LIST_VERSIONS_HEAD_HASH_KEY) as string;
+      let currentMarked = false;
+      const entries: Entry[] = [];
+      for (const record of records) {
+        let snapshot: MessageShape<Desc>;
+        try {
+          snapshot = fromBinary(binding.schema, record.data);
+        } catch {
+          continue;
+        }
+        const isCurrent: boolean =
+          !currentMarked &&
+          headHash !== "" &&
+          binding.headHashOf(snapshot) === headHash;
+        currentMarked = currentMarked || isCurrent;
+        // Tag comes from the audit column (source of truth), not the snapshot.
+        entries.push(binding.mapEntry(snapshot, isCurrent, record.tag));
+      }
+
+      let pageSize = req.pageSize;
+      if (pageSize <= 0) {
+        pageSize = DEFAULT_PAGE_SIZE;
+      }
+      if (pageSize > MAX_PAGE_SIZE) {
+        pageSize = MAX_PAGE_SIZE;
+      }
+
+      let startIndex = 0;
+      if (req.pageToken !== "") {
+        startIndex = decodePageToken(req.pageToken);
+      }
+
+      let pageEntries: Entry[] = [];
+      let nextPageToken = "";
+      if (startIndex < entries.length) {
+        const end = Math.min(startIndex + pageSize, entries.length);
+        pageEntries = entries.slice(startIndex, end);
+        if (end < entries.length) {
+          nextPageToken = Buffer.from(String(end)).toString("base64");
+        }
+      }
+
+      ctx.set(
+        LIST_VERSIONS_RESPONSE_KEY,
+        binding.response(pageEntries, nextPageToken, entries.length),
+      );
+    },
+  };
+}
+
+/**
+ * Decodes the base64 cursor with Go's strictness: base64.StdEncoding
+ * rejects malformed input and strconv.Atoi rejects trailing garbage —
+ * Buffer.from is lenient on both, so validity is checked explicitly.
+ */
+export function decodePageToken(token: string): number {
+  const decoded = Buffer.from(token, "base64");
+  if (decoded.toString("base64") !== token) {
+    throw invalidArgumentError("invalid page_token");
+  }
+  const text = decoded.toString("utf8");
+  const index = Number.parseInt(text, 10);
+  if (!Number.isSafeInteger(index) || String(index) !== text || index < 0) {
+    throw invalidArgumentError("invalid page_token");
+  }
+  return index;
+}
+
+/** metadata.id of a resource message; every versioned kind carries the commons metadata. */
+function idOf(resource: Message): string {
+  return metadataOf(resource)?.id ?? "";
+}

package/src/pipeline/steps/visibility-gates.ts

@@ -46,10 +46,7 @@ import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/
 import type { UpdateVisibilityInput } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import { IamPermission } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 
-import type {
-  Authorizer,
-  AuthzDecision,
-} from "../../extensions/authorizer.js";
+import type { Authorizer, AuthzDecision } from "../../extensions/authorizer.js";
 import type { CallerIdentity } from "../../extensions/identity.js";
 import { internalError } from "../errors.js";
 import type { PipelineStep } from "../pipeline.js";
@@ -92,9 +89,10 @@ export function newGuardPublicVisibilityStep<Desc extends DescMessage>(
  * chain's own context key (every updateVisibility chain stores it —
  * the RecordVisibilityBeforeUpdate pattern).
  */
-export function newAuthorizeVisibilityTransitionStep<
-  Desc extends DescMessage,
->(targetKey: string, authorizer: Authorizer): PipelineStep<Desc> {
+export function newAuthorizeVisibilityTransitionStep<Desc extends DescMessage>(
+  targetKey: string,
+  authorizer: Authorizer,
+): PipelineStep<Desc> {
   return {
     name: "AuthorizeVisibilityTransition",
     async execute(ctx: RequestContext<Desc>): Promise<void> {
@@ -127,8 +125,13 @@ export function newAuthorizeVisibilityTransitionStep<
   };
 }
 
-/** The single owner of "may this caller set public?" — both doors call it. */
-async function requireOperatorMaySetPublic(
+/**
+ * The single owner of "may this caller set public?" — both doors call it,
+ * and so does the plugin push chain, whose requested level rides the
+ * request (the level then flows to every member through the members' own
+ * create and updateVisibility doors, which run this check again).
+ */
+export async function requireOperatorMaySetPublic(
   authorizer: Authorizer,
   caller: CallerIdentity,
 ): Promise<void> {

package/src/query/README.md

@@ -3,7 +3,7 @@
 The two cross-aggregate query services (D4 #14; Go `pkg/query/`):
 
 - `search/` — the SearchService over the store's search index: criteria value object, the
-  searchable-extractor registry (13 kinds, `kind_meta`-derived set), the
+  searchable-extractor registry (14 kinds, `kind_meta`-derived set), the
   query store over `Store.querySearchIndex`, and boot-time RebuildIndex.
 - `activity/` — the ActivityQueryController recents feed: sessions +
   workflow executions merged newest-first (stigmer#461).

package/src/query/search/__tests__/criteria.test.ts

@@ -42,7 +42,7 @@ function criteria(overrides?: {
 }
 
 describe("searchIndexedKinds derivation (kind_meta)", () => {
-  it("derives exactly the 13 searchable kinds, project included", () => {
+  it("derives exactly the 14 searchable kinds, project and plugin included", () => {
     // Go's SearchableKinds map, pinned by its invariant test against the
     // same kind_meta derivation. project rides #14 (DD-D) although its
     // domain ports with #16 — RebuildIndex on an adopted Go database
@@ -62,6 +62,7 @@ describe("searchIndexedKinds derivation (kind_meta)", () => {
         ApiResourceKind.organization,
         ApiResourceKind.workflow_execution,
         ApiResourceKind.workflow_instance,
+        ApiResourceKind.plugin,
       ].sort((a, b) => a - b),
     );
   });
@@ -112,9 +113,7 @@ describe("SearchCriteria normalization (Go NewSearchCriteria)", () => {
   it("rejects a query over the cap with Go's exact message", () => {
     expect(() =>
       criteria({ query: "x".repeat(MAX_QUERY_LENGTH + 1) }),
-    ).toThrowError(
-      "search query exceeds maximum length of 500 characters",
-    );
+    ).toThrowError("search query exceeds maximum length of 500 characters");
   });
 
   it("accepts a query at exactly the cap", () => {
@@ -141,9 +140,9 @@ describe("SearchCriteria normalization (Go NewSearchCriteria)", () => {
 describe("mode selection", () => {
   it("empty kinds is discover mode; requested kinds is not", () => {
     expect(criteria({ kinds: [] }).isDiscoverMode()).toBe(true);
-    expect(
-      criteria({ kinds: [ApiResourceKind.agent] }).isDiscoverMode(),
-    ).toBe(false);
+    expect(criteria({ kinds: [ApiResourceKind.agent] }).isDiscoverMode()).toBe(
+      false,
+    );
   });
 
   it("hasQuery: empty and whitespace-only queries mean list mode", () => {