@stigmer/server 3.18.1-dev.20260919070736 → 3.19.1-dev.20260920100552

package/dist/store/postgres/migrations.js

@@ -1,8 +1,10 @@
 export const SCHEMA_VERSION_1 = 1;
 export const SCHEMA_VERSION_2 = 2;
 export const SCHEMA_VERSION_3 = 3;
+/** v4: the rows of the removed Project kind deleted. */
+export const SCHEMA_VERSION_4 = 4;
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_3;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_4;
 /**
  * Advisory lock key for the migration chain. Arbitrary but stable 64-bit
  * value, derived from ASCII "STGMR1" — collisions with other advisory-lock
@@ -29,6 +31,7 @@ export async function runMigrations(client) {
             [SCHEMA_VERSION_1, migrateToV1],
             [SCHEMA_VERSION_2, migrateToV2],
             [SCHEMA_VERSION_3, migrateToV3],
+            [SCHEMA_VERSION_4, migrateToV4],
         ];
         for (const [version, migrate] of chain) {
             if (currentVersion < version) {
@@ -239,4 +242,19 @@ async function migrateToV3(client) {
     CREATE INDEX idx_oauth_grant_resource ON oauth_grant (resource_id, org_id);
   `);
 }
+/**
+ * v4: the Project kind (kind 60, id prefix "prj") was removed from the
+ * contract, so a database seeded by an earlier release may hold rows no
+ * code can read, list or delete any more. The chain's first data
+ * migration, and the same shape as the sqlite driver's v9: rows deleted,
+ * not archived (the audit table is the version history of kinds the
+ * server serves), keyed on the enum NAME the kind column holds
+ * (proto-fields.ts apiResourceKindName), the search index left to boot's
+ * RebuildIndex. Member rows the Project once listed are ordinary
+ * resources of their own kinds and stay.
+ */
+async function migrateToV4(client) {
+    await client.query(`DELETE FROM resources WHERE kind = 'project'`);
+    await client.query(`DELETE FROM resource_audit WHERE kind = 'project'`);
+}
 //# sourceMappingURL=migrations.js.map

package/dist/store/postgres/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/store/postgres/migrations.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,wCAAwC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,MAAM,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;KAKlB,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,KAAK,GAEP;YACF,CAAC,gBAAgB,EAAE,WAAW,CAAC;YAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;YAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;SAChC,CAAC;QAEF,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;YACvC,IAAI,cAAc,GAAG,OAAO,EAAE,CAAC;gBAC7B,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,iEAAiE,CAClE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAkB,EAClB,OAAe,EACf,OAA8C;IAE9C,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YACrE,OAAO;SACR,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyIlB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC;;GAElB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC;;GAElB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/store/postgres/migrations.ts"],"names":[],"mappings":"AAwCA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,wCAAwC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAElD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAkB;IACpD,MAAM,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;KAKlB,CAAC,CAAC;QAEH,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAEtD,MAAM,KAAK,GAEP;YACF,CAAC,gBAAgB,EAAE,WAAW,CAAC;YAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;YAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;YAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;SAChC,CAAC;QAEF,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;YACvC,IAAI,cAAc,GAAG,OAAO,EAAE,CAAC;gBAC7B,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,CAAC,+BAA+B,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,iEAAiE,CAClE,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAkB,EAClB,OAAe,EACf,OAA8C;IAE9C,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACtB,MAAM,MAAM,CAAC,KAAK,CAAC,kDAAkD,EAAE;YACrE,OAAO;SACR,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyIlB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC;;GAElB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC;;GAElB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,WAAW,CAAC,MAAkB;IAC3C,MAAM,MAAM,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACnE,MAAM,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;AAC1E,CAAC"}

package/dist/store/sqlite/migrations.d.ts

@@ -41,8 +41,10 @@ export declare const SCHEMA_VERSION_6 = 6;
 export declare const SCHEMA_VERSION_7 = 7;
 /** v8: the by-resource grant-teardown index (the C3 channel installer). */
 export declare const SCHEMA_VERSION_8 = 8;
+/** v9: the rows of the removed Project kind deleted. */
+export declare const SCHEMA_VERSION_9 = 9;
 /** Target version for new databases. */
-export declare const CURRENT_SCHEMA_VERSION = 8;
+export declare const CURRENT_SCHEMA_VERSION = 9;
 /** Applies all pending migrations in order. */
 export declare function runMigrations(db: DatabaseSync): void;
 /** Current schema version; 0 when none has been recorded yet. */

package/dist/store/sqlite/migrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/store/sqlite/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wCAAwC;AACxC,eAAO,MAAM,sBAAsB,IAAmB,CAAC;AAEvD,+CAA+C;AAC/C,wBAAgB,aAAa,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CA0BpD;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,CAKzD"}
+{"version":3,"file":"migrations.d.ts","sourceRoot":"","sources":["../../../src/store/sqlite/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,2EAA2E;AAC3E,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAClC,wDAAwD;AACxD,eAAO,MAAM,gBAAgB,IAAI,CAAC;AAElC,wCAAwC;AACxC,eAAO,MAAM,sBAAsB,IAAmB,CAAC;AAEvD,+CAA+C;AAC/C,wBAAgB,aAAa,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CA2BpD;AAED,iEAAiE;AACjE,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,YAAY,GAAG,MAAM,CAKzD"}

package/dist/store/sqlite/migrations.js

@@ -8,8 +8,10 @@ export const SCHEMA_VERSION_6 = 6;
 export const SCHEMA_VERSION_7 = 7;
 /** v8: the by-resource grant-teardown index (the C3 channel installer). */
 export const SCHEMA_VERSION_8 = 8;
+/** v9: the rows of the removed Project kind deleted. */
+export const SCHEMA_VERSION_9 = 9;
 /** Target version for new databases. */
-export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_8;
+export const CURRENT_SCHEMA_VERSION = SCHEMA_VERSION_9;
 /** Applies all pending migrations in order. */
 export function runMigrations(db) {
     db.exec(`
@@ -28,6 +30,7 @@ export function runMigrations(db) {
         [SCHEMA_VERSION_6, migrateToV6],
         [SCHEMA_VERSION_7, migrateToV7],
         [SCHEMA_VERSION_8, migrateToV8],
+        [SCHEMA_VERSION_9, migrateToV9],
     ];
     for (const [version, migrate] of chain) {
         if (currentVersion < version) {
@@ -288,4 +291,22 @@ function migrateToV8(db) {
     CREATE INDEX IF NOT EXISTS idx_oauth_grant_resource ON oauth_grant(resource_id, org_id);
   `);
 }
+/**
+ * v9: the Project kind (kind 60, id prefix "prj") was removed from the
+ * contract, so a database seeded by an earlier release may hold rows no
+ * code can read, list or delete any more. Rows are deleted, not archived:
+ * the audit table is the version history of kinds the server serves, and
+ * bytes of a kind nothing will ever decode are not history. The kind
+ * column holds the enum NAME (proto-fields.ts apiResourceKindName), which
+ * is why the literal string works after the enum value is gone. The search
+ * index is not touched here: boot's RebuildIndex clears it and re-indexes
+ * only the registered kinds. Member rows the Project once listed are
+ * ordinary resources of their own kinds and stay.
+ */
+function migrateToV9(db) {
+    db.exec(`
+    DELETE FROM resources WHERE kind = 'project';
+    DELETE FROM resource_audit WHERE kind = 'project';
+  `);
+}
 //# sourceMappingURL=migrations.js.map

package/dist/store/sqlite/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/store/sqlite/migrations.ts"],"names":[],"mappings":"AAkCA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,wCAAwC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,UAAU,aAAa,CAAC,EAAgB;IAC5C,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAiE;QAC1E,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,IAAI,cAAc,GAAG,OAAO,EAAE,CAAC;YAC7B,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAAC,EAAgB;IAC/C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,iEAAiE,CAAC;SAC1E,GAAG,EAAqC,CAAC;IAC5C,OAAO,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAgB,EAChB,OAAe,EACf,OAAmC;IAEnC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3E,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,EAAgB;IACnC,6EAA6E;IAC7E,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;GAUP,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;IAEH,yBAAyB,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,EAAgB;IACjD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN,4EAA4E,CAC7E;SACA,GAAG,EAKJ,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;+BAC2B,CAC5B,CAAC;IACF,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAClE,SAAS,CAAC,qCAAqC;QACjD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,EAAE,CAAC,OAAO,CAAC,sCAAsC,YAAY,GAAG,CAAC,CAAC,GAAG,CACnE,GAAG,WAAW,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;GAYP,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;GAMP,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDP,CAAC,CAAC;IAEH,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,KAAK,MAAM,KAAK,IAAI;QAClB,yEAAyE;QACzE,uFAAuF;KACxF,EAAE,CAAC;QACF,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;GAEP,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../src/store/sqlite/migrations.ts"],"names":[],"mappings":"AAkCA,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAClC,wDAAwD;AACxD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAElC,wCAAwC;AACxC,MAAM,CAAC,MAAM,sBAAsB,GAAG,gBAAgB,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,UAAU,aAAa,CAAC,EAAgB;IAC5C,EAAE,CAAC,IAAI,CAAC;;;;;GAKP,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAiE;QAC1E,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;QAC/B,CAAC,gBAAgB,EAAE,WAAW,CAAC;KAChC,CAAC;IAEF,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACvC,IAAI,cAAc,GAAG,OAAO,EAAE,CAAC;YAC7B,kBAAkB,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAAC,EAAgB;IAC/C,MAAM,GAAG,GAAG,EAAE;SACX,OAAO,CAAC,iEAAiE,CAAC;SAC1E,GAAG,EAAqC,CAAC;IAC5C,OAAO,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,kBAAkB,CACzB,EAAgB,EAChB,OAAe,EACf,OAAmC;IAEnC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3E,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE;YAC1D,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,EAAgB;IACnC,6EAA6E;IAC7E,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;GAUP,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;IAEH,yBAAyB,CAAC,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,EAAgB;IACjD,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CACN,4EAA4E,CAC7E;SACA,GAAG,EAKJ,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CACvB;+BAC2B,CAC5B,CAAC;IACF,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,8DAA8D;QAC9D,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YAClE,SAAS,CAAC,qCAAqC;QACjD,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1D,EAAE,CAAC,OAAO,CAAC,sCAAsC,YAAY,GAAG,CAAC,CAAC,GAAG,CACnE,GAAG,WAAW,CACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;GAYP,CAAC,CAAC;AACL,CAAC;AAED,4DAA4D;AAC5D,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;GAMP,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;GAgBP,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDP,CAAC,CAAC;IAEH,sEAAsE;IACtE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,KAAK,MAAM,KAAK,IAAI;QAClB,yEAAyE;QACzE,uFAAuF;KACxF,EAAE,CAAC;QACF,IAAI,CAAC;YACH,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;GAEP,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,EAAgB;IACnC,EAAE,CAAC,IAAI,CAAC;;;GAGP,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/server",
-  "version": "3.18.1-dev.20260919070736",
+  "version": "3.19.1-dev.20260920100552",
   "description": "The Stigmer OSS control plane as a composable library: composeServer, the extension registry and the driver seams a composition builds on. The self-contained deployable of the same server is @stigmer/server-slim.",
   "license": "Apache-2.0",
   "type": "module",
@@ -62,11 +62,11 @@
     "@connectrpc/connect-node": "^2.0.0",
     "@kubernetes/client-node": "2.0.0",
     "@opentelemetry/api": "^1.9.0",
-    "@stigmer/outbound": "3.18.1-dev.20260919070736",
-    "@stigmer/plugin-package": "3.18.1-dev.20260919070736",
-    "@stigmer/protos": "3.18.1-dev.20260919070736",
-    "@stigmer/temporal-codecs": "3.18.1-dev.20260919070736",
-    "@stigmer/zip-structure": "3.18.1-dev.20260919070736",
+    "@stigmer/outbound": "3.19.1-dev.20260920100552",
+    "@stigmer/plugin-package": "3.19.1-dev.20260920100552",
+    "@stigmer/protos": "3.19.1-dev.20260920100552",
+    "@stigmer/temporal-codecs": "3.19.1-dev.20260920100552",
+    "@stigmer/zip-structure": "3.19.1-dev.20260920100552",
     "@temporalio/activity": "1.16.2",
     "@temporalio/client": "1.16.2",
     "@temporalio/common": "1.16.2",

package/src/authorization/__tests__/derived-tuples.test.ts

@@ -189,7 +189,7 @@ describe("deriveTuples — the cloud driver's shapes, from the row", () => {
   });
 
   it("kinds with no visibility axis derive no viewer tuple at any level — their audience is the model's own line", () => {
-    for (const type of ["artifact", "schedule", "project", "session"]) {
+    for (const type of ["artifact", "schedule", "session"]) {
       expect(
         derivedFor(type, {
           visibility: ApiResourceVisibility.visibility_org,

package/src/authorization/__tests__/fixtures/fga/org-admin-owner-inheritance.fga.yaml

@@ -5,7 +5,7 @@
 # Store tests for org-admin owner inheritance (T08).
 #
 # Blueprint kinds — agent, agent_share, agent_channel, channel_app,
-# schedule, skill, workflow, project — compose org admins into `owner`:
+# schedule, skill, workflow, plugin — compose org admins into `owner`:
 #
 #   define owner: [identity_account] or admin from organization
 #
@@ -94,10 +94,10 @@ tuples:
     object: workflow:carols-flow
   - user: organization:acme
     relation: organization
-    object: project:carols-project
+    object: plugin:carols-plugin
   - user: identity_account:carol
     relation: owner
-    object: project:carols-project
+    object: plugin:carols-plugin
 
   # --- carol's personal resources (organization tuple present, so a
   #     wrongly-added inheritance WOULD resolve — these must stay denied) ---
@@ -186,7 +186,7 @@ tests:
           can_delete: true
           can_grant_access: true
       - user: identity_account:ana
-        object: project:carols-project
+        object: plugin:carols-plugin
         assertions:
           can_view: true
           can_edit: true
@@ -257,7 +257,7 @@ tests:
           can_edit: false
           can_delete: false
       - user: identity_account:zara
-        object: project:carols-project
+        object: plugin:carols-plugin
         assertions:
           can_view: false
           can_edit: false

package/src/authorization/__tests__/wire-permissions.test.ts

@@ -141,7 +141,6 @@ describe("every static (kind, permission) the served RPCs ask about is a declare
         "oauth_app",
         "organization",
         "plugin",
-        "project",
         "schedule",
         "session",
         "skill",

package/src/authorization/model/__tests__/registry.test.ts

@@ -35,7 +35,6 @@ const DECLARED_KINDS = [
   ApiResourceKind.api_key,
   ApiResourceKind.oauth_app,
   ApiResourceKind.organization,
-  ApiResourceKind.project,
   ApiResourceKind.agent,
   ApiResourceKind.agent_channel,
   ApiResourceKind.agent_share,
@@ -99,7 +98,6 @@ const WIRE_PERMISSIONS_BY_TYPE: Readonly<
     "can_view",
     "can_edit",
     "can_delete",
-    "can_create_project",
     "can_create_agent",
     "can_create_workflow",
     "can_create_session",
@@ -118,13 +116,6 @@ const WIRE_PERMISSIONS_BY_TYPE: Readonly<
     "can_view_billing",
     "can_manage_billing",
   ],
-  project: [
-    "can_view",
-    "can_edit",
-    "can_delete",
-    "can_grant_access",
-    "can_view_access",
-  ],
   agent: [
     "can_view",
     "can_edit",

package/src/authorization/model/index.ts

@@ -12,7 +12,7 @@
  * chain past the depth bound) and for the cloud's drift test, which
  * builds a model from the live `.fga` files and compares.
  *
- * Registered: every kind of the open-source tier — the twenty-four
+ * Registered: every kind of the open-source tier — the twenty-three
  * `kind_meta.tier: open_source` members — and nothing else. The four
  * files `fga.mod` lists that have no declaration here (`platform`,
  * `identity_provider`, `platform_client`, `invitation`) are kinds this
@@ -39,7 +39,6 @@ import { memoryDeclaration } from "./memory.js";
 import { oauthAppDeclaration } from "./oauth_app.js";
 import { organizationDeclaration } from "./organization.js";
 import { pluginDeclaration } from "./plugin.js";
-import { projectDeclaration } from "./project.js";
 import type { KindDeclaration } from "./rewrite.js";
 import { scheduleDeclaration } from "./schedule.js";
 import { sessionDeclaration } from "./session.js";
@@ -79,7 +78,6 @@ export const builtInModel: Model = newModel([
   apiKeyDeclaration,
   oauthAppDeclaration,
   organizationDeclaration,
-  projectDeclaration,
   agentDeclaration,
   agentChannelDeclaration,
   agentShareDeclaration,

package/src/authorization/model/organization.ts

@@ -33,7 +33,6 @@ export const organizationDeclaration = declareKind({
     ["can_delete", computed("owner")],
     ["can_manage_members", computed("admin")],
     ["can_assign_roles", computed("owner")],
-    ["can_create_project", computed("admin")],
     ["can_create_agent", computed("admin")],
     ["can_create_workflow", computed("admin")],
     ["can_create_session", union(computed("member"), computed("guest"))],

package/src/boot/compose.ts

@@ -112,7 +112,6 @@ import { registerOrganizationServices } from "../domain/organization/controller.
 import { registerMcpServerServices } from "../domain/mcpserver/controller.js";
 import { registerPlatformServices } from "../domain/platform/controller.js";
 import { SERVER_VERSION } from "../domain/platform/version.js";
-import { registerProjectServices } from "../domain/project/controller.js";
 import { registerSessionServices } from "../domain/session/controller.js";
 import { registerPluginServices } from "../domain/plugin/controller.js";
 import { PLUGIN_ARTIFACT_KEY_PREFIX } from "../domain/plugin/constants.js";
@@ -1494,22 +1493,10 @@ export async function composeServer(
       logger,
       authorizer,
     });
-    // Project registers after all four reconciled kinds (agent, workflow,
-    // mcpserver, skill) — the last Class A domain. The lazy deleter
-    // provider replaces Go's SetReconciliationService late-bind
-    // (server.go 478 registration + 635–648 injection): orphan deletes
-    // route through the in-process command clients' FULL pipelines.
-    registerProjectServices(router, {
-      store,
-      logger,
-      authorizer,
-      authorizationLifecycle,
-      orphanDeleter: () => requireInProcess().projectOrphanDeleter,
-    });
     // The two CQRS query services register between the domains and the
     // github/platform tail, mirroring Go's registration order
-    // (server.go: project 478 → organization 487 → search 493 →
-    // activity 513 → github 524 → platform 530).
+    // (server.go: organization 487 → search 493 → activity 513 →
+    // github 524 → platform 530).
     registerSearchServices(router, { handler: searchHandler, logger });
     registerActivityServices(router, { handler: activityHandler, logger });
     // GitHub broker: config-only, no store (Go server.go 524–528).

package/src/boot/inprocess.ts

@@ -74,7 +74,6 @@ import type { PluginMaterializer } from "../domain/plugin/materialize/ports.js";
 import { UpdateVisibilityInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
 import type { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
-import type { OrphanDeleter } from "../domain/project/reconcile.js";
 import type { ExecutionStatusWriter } from "../temporal/agentexecution/activities.js";
 import type { ScheduleExecutionCreator } from "../temporal/schedule/run-starter.js";
 import { buildInterceptorChain } from "../pipeline/chain.js";
@@ -126,15 +125,6 @@ export interface InProcessClients {
   readonly workflowExecutionContextCreator: WorkflowExecutionContextCreator;
   readonly workflowExecutionApprovalForwarder: AgentExecutionApprovalForwarder;
   readonly workflowExecutionFileDecisionForwarder: AgentExecutionFileDecisionForwarder;
-  /**
-   * The project reconciler's orphan-delete edge (server.go 635-648: Go's
-   * DownstreamClients + ResourceDeleterAdapter). Go retains the four full
-   * CRUD client interfaces; the reconciler uses ONLY Delete, so this
-   * surface exposes only the delete routing — every orphan delete runs the
-   * owning domain's FULL pipeline (referential blocks included) through
-   * the same interceptor chain as an external delete.
-   */
-  readonly projectOrphanDeleter: OrphanDeleter;
   /**
    * The schedule clock's fire edge (server.go 581: the RunStarter's
    * in-process agentexecution client): every fire — cron tick or manual
@@ -153,7 +143,7 @@ export interface InProcessClients {
    * broadcast) and carry the internal caller class this transport's
    * position 1 stamps. The worker builds no identity of its own: server
    * code acting on its own behalf rides this lane, where the class is
-   * minted — exactly like the schedule clock and the reconciler above.
+   * minted — exactly like the schedule clock above.
    */
   readonly executionStatusWriter: ExecutionStatusWriter;
   /**
@@ -163,8 +153,7 @@ export interface InProcessClients {
    * delete) AS THE INSTALLING CALLER (the asCaller call options), so a
    * materialised skill is attributed to the user who installed it and
    * carries the plugin's reserved labels by the in-process origin the
-   * guards pass structurally. The delete routing is the reconciler's
-   * switch, shared.
+   * guards pass structurally.
    */
   readonly pluginMaterializer: PluginMaterializer;
 }
@@ -391,15 +380,6 @@ export function createInProcessClients(
     executionStatusWriter: {
       updateStatus: (input) => agentExecutionCommand.updateStatus(input),
     },
-    // The project reconciler's delete routing — Go's
-    // ResourceDeleterAdapter.Delete switch (execution_engine.go:75-92).
-    // The unsupported-kind default is defense-in-depth kept for Go parity:
-    // the reconciler's slug resolver rejects unsupported kinds before any
-    // delete is attempted, in both editions. Log-only surface: reconcile
-    // failures never reach the wire.
-    projectOrphanDeleter: {
-      delete: (kind, resourceId) => deleteByKind(kind, resourceId),
-    },
     pluginMaterializer: {
       pushSkill: (request, caller) =>
         skillCommand.push(request, asCaller(caller)),
@@ -417,13 +397,12 @@ export function createInProcessClients(
   };
 
   /**
-   * Delete routing for the four reconciled kinds — Go's
-   * ResourceDeleterAdapter.Delete switch (execution_engine.go:75-92),
-   * shared by the project reconciler (internal class, no caller) and the
-   * plugin controller (as the installing caller). Every orphan or member
-   * delete runs the owning domain's FULL pipeline. The unsupported-kind
-   * default is defense-in-depth: both callers refuse unsupported kinds
-   * before any delete is attempted.
+   * Delete routing for the four member kinds a plugin materialises, used
+   * by the plugin controller as the installing caller. Every member delete
+   * runs the owning domain's FULL pipeline (referential blocks included)
+   * through the same interceptor chain as an external delete. The
+   * unsupported-kind default is defense-in-depth: the plugin's member
+   * reader refuses unsupported kinds before any delete is attempted.
    */
   async function deleteByKind(
     kind: ApiResourceKind,

package/src/domain/agentexecution/lifecycle.ts

@@ -720,7 +720,7 @@ export async function recoverExecution(
               temporalConfig: deps.temporalConfig,
             },
             loadedExecution(ctx),
-            ctx.callerIdentity.identityId,
+            ctx.callerIdentity,
           );
         },
       },

package/src/domain/iampolicy/__tests__/role-lifecycle.test.ts

@@ -208,7 +208,6 @@ describe("onResourceCreated: the creator owns the organization", () => {
     ApiResourceKind.workflow,
     ApiResourceKind.session,
     ApiResourceKind.identity_account,
-    ApiResourceKind.project,
   ])(
     "writes nothing for kind %s even under DIRECT attribution — a per-resource owner row is the grant the scope keeps Enterprise",
     async (kind) => {

package/src/domain/mcpserver/__tests__/oauth-handshake.test.ts

@@ -343,7 +343,7 @@ describe("initiateOAuthConnect", () => {
     await expectCode(
       command.initiateOAuthConnect({ mcpServerId: id, org: ORG }),
       Code.FailedPrecondition,
-      "does not advertise a registration_endpoint for DCR",
+      "does not advertise a registration_endpoint for DCR: 127.0.0.1:",
     );
     mockAs.reset();
   });

package/src/domain/mcpserver/initiate-oauth-connect.ts

@@ -201,8 +201,15 @@ async function initiateDcr(
   }
 
   if (metadata.registrationEndpoint === "") {
+    // A login server without RFC 7591 registration cannot take a client
+    // Stigmer mints on the spot; the sentence keeps its opening (the
+    // conformance suite's pin before this clause joined it) and tells the
+    // user the one thing that helps: an OAuth app registered with the
+    // vendor, referenced from the server's definition.
     throw failedPreconditionError(
-      `MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR`,
+      `MCP server at ${serverUrl} does not advertise a registration_endpoint for DCR: ` +
+        `${loginServerHost(metadata, serverUrl)} does not allow automatic client registration, so this server needs ` +
+        "an OAuth app registered with the vendor and referenced from its definition (auth.oauth_app_ref)",
     );
   }
 
@@ -280,6 +287,19 @@ async function initiateDcr(
   };
 }
 
+/** The login server a user must register with: its metadata's issuer, else its authorization endpoint, else the URL we asked. */
+function loginServerHost(metadata: { issuer: string; authorizationEndpoint: string }, serverUrl: string): string {
+  for (const candidate of [metadata.issuer, metadata.authorizationEndpoint, serverUrl]) {
+    try {
+      const host = new URL(candidate).host;
+      if (host !== "") return host;
+    } catch {
+      // Not a URL; try the next candidate.
+    }
+  }
+  return serverUrl;
+}
+
 async function initiateVendorOAuth(
   deps: McpServerConnectDeps,
   mcpServer: McpServer,

package/src/domain/workflow/registry/data/task-kind-registry.json

@@ -1518,7 +1518,6 @@
                     "schedule",
                     "memory",
                     "plugin",
-                    "project",
                     "plan",
                     "subscription",
                     "license"

package/src/domain/workflowexecution/lifecycle.ts

@@ -934,7 +934,7 @@ export async function recoverExecution(
               temporalConfig: deps.temporalConfig,
             },
             loadedExecution(ctx),
-            ctx.callerIdentity.identityId,
+            ctx.callerIdentity,
           );
         },
       },

package/src/pipeline/__tests__/router-transport.test.ts

@@ -2,7 +2,7 @@
  * Spike SP-B (D2 spike register): `createRouterTransport` traverses the
  * FULL interceptor chain on in-process calls.
  *
- * Why this matters: Go serves internal calls (project reconcile deletes,
+ * Why this matters: Go serves internal calls (plugin member deletes,
  * cascades, schedule RunStarter creates) through the same *grpc.Server over
  * an in-memory bufconn precisely so validation parity holds — an internal
  * call is validated exactly like an external one. The TS equivalent is

package/src/pipeline/interceptors/auth.ts

@@ -346,7 +346,7 @@ export function encodeInProcessCaller(caller: CallerIdentity): string {
  *     while transport-trust arms (the reserved-label guard) still see
  *     the server-composed origin.
  *   - MINTED: no propagated identity — the daemon-origin default (the
- *     schedule clock, the project reconciler): the internal caller class
+ *     schedule clock): the internal caller class
  *     carrying the operator's identity fields, so audit stamps on
  *     daemon writes stay byte-identical to the pre-R5 posture. The
  *     Authorize step treats the internal class as the in-process

package/src/query/__tests__/query-services.test.ts

@@ -5,8 +5,7 @@
  * historically returned UNIMPLEMENTED for activity), synchronous
  * index-on-write feeds search over the wire, the protovalidate
  * interceptor answers the two InvalidArgument arms, and BOOT-TIME
- * RebuildIndex makes pre-existing rows — including a project row on an
- * adopted database, whose domain is not yet ported (#16) — searchable
+ * RebuildIndex makes pre-existing rows on an adopted database searchable
  * with zero pipeline writes (DD-D/DD-F).
  */
 import { mkdtempSync, rmSync } from "node:fs";
@@ -21,11 +20,11 @@ import { createGrpcTransport } from "@connectrpc/connect-node";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 
 import { ActivityQueryController } from "@stigmer/protos/ai/stigmer/activity/v1/query_pb";
+import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
 import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
 import { SearchService } from "@stigmer/protos/ai/stigmer/search/v1/query_pb";
 import { OrganizationSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
 import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
-import { ProjectSchema } from "@stigmer/protos/ai/stigmer/tenancy/project/v1/api_pb";
 
 import { loadConfig } from "../../boot/config.js";
 import { composeServer } from "../../boot/compose.js";
@@ -146,9 +145,8 @@ describe("boot-time RebuildIndex (DD-D/DD-F)", () => {
     dir = mkdtempSync(path.join(tmpdir(), "query-rebuild-test-"));
     // Pre-seed the database DIRECTLY — resource rows only, no index
     // writes — the adopted-database shape: rows exist, the FTS index
-    // knows nothing about them. The project row's domain is not even
-    // ported yet (#16 in flight); only the boot rebuild through the
-    // 13-kind registry can make it searchable.
+    // knows nothing about them. Only the boot rebuild through the
+    // registry can make such a row searchable.
     const dbPath = path.join(dir, "stigmer.db");
     const seedStore = SqliteStore.open(dbPath);
     await seedStore.saveResource(
@@ -163,17 +161,17 @@ describe("boot-time RebuildIndex (DD-D/DD-F)", () => {
       }),
     );
     await seedStore.saveResource(
-      ApiResourceKind.project,
-      "prj_adopted",
-      ProjectSchema,
-      create(ProjectSchema, {
+      ApiResourceKind.skill,
+      "skl_adopted",
+      SkillSchema,
+      create(SkillSchema, {
         metadata: {
-          id: "prj_adopted",
-          name: "adopted-project",
-          slug: "adopted-project",
+          id: "skl_adopted",
+          name: "adopted-skill",
+          slug: "adopted-skill",
           org: "preboot",
         },
-        spec: { description: "a project from the Go era" },
+        spec: { description: "a skill from the Go era" },
         status: {
           audit: { specAudit: { createdAt: { seconds: 1_700_000_000n } } },
         },
@@ -201,11 +199,11 @@ describe("boot-time RebuildIndex (DD-D/DD-F)", () => {
     });
     expect(orgs.entries.map((entry) => entry.id)).toContain("preboot");
 
-    const projects = await search.search({
-      kinds: [ApiResourceKind.project],
+    const skills = await search.search({
+      kinds: [ApiResourceKind.skill],
       org: "preboot",
     });
-    expect(projects.entries.map((entry) => entry.id)).toEqual(["prj_adopted"]);
-    expect(projects.entries[0]?.description).toBe("a project from the Go era");
+    expect(skills.entries.map((entry) => entry.id)).toEqual(["skl_adopted"]);
+    expect(skills.entries[0]?.description).toBe("a skill from the Go era");
   });
 });

package/src/query/search/__tests__/criteria.test.ts

@@ -3,7 +3,7 @@
  * normalization (trimming, clamps), the 500-char boundary, the three-mode
  * contract, and the #440 arm — named-but-unsearchable kinds yield an EMPTY
  * effective set, never a discover fallback. The kind_meta derivation is
- * pinned here too: 13 searchable kinds, project included (DD-D).
+ * pinned here too: the 13 searchable kinds.
  */
 import { describe, expect, it } from "vitest";
 
@@ -42,18 +42,15 @@ function criteria(overrides?: {
 }
 
 describe("searchIndexedKinds derivation (kind_meta)", () => {
-  it("derives exactly the 14 searchable kinds, project and plugin included", () => {
+  it("derives exactly the 13 searchable kinds, plugin included", () => {
     // Go's SearchableKinds map, pinned by its invariant test against the
-    // same kind_meta derivation. project rides #14 (DD-D) although its
-    // domain ports with #16 — RebuildIndex on an adopted Go database
-    // must be able to re-index existing project rows.
+    // same kind_meta derivation.
     expect([...searchIndexedKinds()].sort((a, b) => a - b)).toEqual(
       [
         ApiResourceKind.agent,
         ApiResourceKind.skill,
         ApiResourceKind.mcp_server,
         ApiResourceKind.workflow,
-        ApiResourceKind.project,
         ApiResourceKind.environment,
         ApiResourceKind.session,
         ApiResourceKind.agent_execution,