@stigmer/server 3.22.1-dev.20260922095755 → 3.22.1

package/src/store/__tests__/public-visibility-retired.test.ts

@@ -1,127 +0,0 @@
-/**
- * Pins the driver-neutral half of the public-visibility data migration
- * (public-visibility-retired.ts): the frozen kind table is exactly the
- * seven kinds that could hold the level, a public row is moved to org with
- * every other byte it carried intact (an unknown field a newer release
- * wrote included), a row at any other level is left alone (undefined, so
- * the driver never rewrites bytes it did not change; a row with no
- * metadata holds no level and is one of these), and bytes that do not
- * decode are a thrown fault, never a skipped row.
- * The drivers' replay tests pin the SQL around this function.
- */
-import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
-import { BinaryWriter, WireType } from "@bufbuild/protobuf/wire";
-import { describe, expect, it } from "vitest";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-
-import {
-  LEVEL_AFTER_RETIREMENT,
-  PUBLIC_ROW_KINDS_AT_RETIREMENT,
-  movePublicRowToOrg,
-} from "../public-visibility-retired.js";
-
-const AGENT = PUBLIC_ROW_KINDS_AT_RETIREMENT[0]!;
-
-function agentBytes(visibility: ApiResourceVisibility): Uint8Array {
-  return toBinary(
-    AgentSchema,
-    create(AgentSchema, {
-      apiVersion: "agentic.stigmer.ai/v1",
-      kind: "Agent",
-      metadata: {
-        id: "agt_1",
-        name: "Public Agent",
-        slug: "public-agent",
-        org: "acme",
-        visibility,
-        labels: { team: "platform" },
-      },
-      spec: { instructions: "a conformant instruction body" },
-    }),
-  );
-}
-
-/** `bytes` followed by one field this schema does not declare (a newer release's). */
-function withUnknownField(bytes: Uint8Array): Uint8Array {
-  const trailer = new BinaryWriter()
-    .tag(4093, WireType.LengthDelimited)
-    .string("written by a release this one does not know")
-    .finish();
-  const joined = new Uint8Array(bytes.length + trailer.length);
-  joined.set(bytes, 0);
-  joined.set(trailer, bytes.length);
-  return joined;
-}
-
-describe("the frozen kind table", () => {
-  it("is exactly the seven kinds that could hold the level, by the enum names the drivers store", () => {
-    expect(PUBLIC_ROW_KINDS_AT_RETIREMENT.map((entry) => entry.kind)).toEqual([
-      "agent",
-      "skill",
-      "mcp_server",
-      "agent_instance",
-      "workflow",
-      "workflow_instance",
-      "plugin",
-    ]);
-    expect(AGENT.schema).toBe(AgentSchema);
-    expect(PUBLIC_ROW_KINDS_AT_RETIREMENT[1]!.schema).toBe(SkillSchema);
-  });
-});
-
-describe("movePublicRowToOrg", () => {
-  it("moves a public row to org and changes nothing else", () => {
-    const moved = movePublicRowToOrg(
-      AGENT,
-      agentBytes(ApiResourceVisibility.visibility_public),
-    );
-    expect(moved).toBeDefined();
-    const after = fromBinary(AgentSchema, moved!);
-    expect(after.metadata?.visibility).toBe(LEVEL_AFTER_RETIREMENT);
-    expect(after.metadata?.visibility).toBe(
-      ApiResourceVisibility.visibility_org,
-    );
-    // Every other byte: the moved row re-encodes to exactly the bytes an
-    // org row with the same content encodes to.
-    expect(moved).toEqual(agentBytes(ApiResourceVisibility.visibility_org));
-  });
-
-  it("keeps an unknown field a newer release wrote through the round trip", () => {
-    const moved = movePublicRowToOrg(
-      AGENT,
-      withUnknownField(agentBytes(ApiResourceVisibility.visibility_public)),
-    );
-    expect(moved).toEqual(
-      withUnknownField(agentBytes(ApiResourceVisibility.visibility_org)),
-    );
-  });
-
-  it("leaves a row at any other level alone", () => {
-    for (const level of [
-      ApiResourceVisibility.api_resource_visibility_unspecified,
-      ApiResourceVisibility.visibility_private,
-      ApiResourceVisibility.visibility_org,
-      ApiResourceVisibility.visibility_platform,
-    ]) {
-      expect(movePublicRowToOrg(AGENT, agentBytes(level))).toBeUndefined();
-    }
-  });
-
-  it("leaves a message with no metadata alone — it holds no level", () => {
-    expect(
-      movePublicRowToOrg(
-        AGENT,
-        toBinary(AgentSchema, create(AgentSchema, { kind: "Agent" })),
-      ),
-    ).toBeUndefined();
-  });
-
-  it("refuses bytes that do not decode as the kind", () => {
-    expect(() =>
-      movePublicRowToOrg(AGENT, new Uint8Array([0xff, 0xff, 0xff])),
-    ).toThrow();
-  });
-});

package/src/store/public-visibility-retired.ts

@@ -1,119 +0,0 @@
-/**
- * The one data migration both store drivers run when the public visibility
- * level is retired: every stored row that holds `visibility_public` is moved
- * to `visibility_org`, once, in place. The drivers own the SQL (which rows
- * to read, how to write them back, the transaction); this module owns what
- * is edition- and driver-neutral: WHICH kinds could hold the level and HOW
- * one row's bytes are moved.
- *
- * Why a migration and not a sweep. The migration chain is the one place
- * that runs exactly once per database, before any request is served. A
- * public row nobody can set again would otherwise stay readable by every
- * account on a self-hosted install forever, because the level's grant was
- * derived from the row itself; on the hosted edition the rows are moved
- * through the API before this release deploys (the tuple lifecycle is
- * row-driven, and only that path deletes the grant's stored tuple), so the
- * migration there finds none and is the safety net, never the mechanism.
- *
- * Why the kind table is frozen here and not read from the live kind
- * configuration. A migration is a statement about the store AS IT WAS when
- * the level was retired: the seven kinds whose VisibilityConfig declared
- * `supports_public` at that moment are the only kinds a public row can
- * exist under, and a later release that adds or removes a kind must not
- * change what this step does. The list is spelled out with its schemas, the
- * per-consumer kind-to-schema idiom the tree already uses; nothing here
- * reads `kind_meta`. The `kind` strings are the enum NAMES the drivers'
- * `kind` column holds (proto-fields.ts `apiResourceKindName`).
- *
- * Why decode and re-encode rather than patch bytes. `resources.data` is the
- * marshaled proto message; the level is one enum field on the metadata
- * message, and only a decode knows where it is. protobuf-es keeps unknown
- * fields through `fromBinary` and writes them back in `toBinary`, so a row
- * written by a newer or older release than this one loses nothing it
- * carried; every other field is re-encoded from the same values. A row this
- * step cannot decode is a fault that fails the whole transaction (the
- * driver's `applyInTransaction` rolls back and the boot stops): skipping it
- * would leave the one row the migration exists for readable by everyone,
- * silently.
- *
- * `resource_audit` is deliberately untouched: it is the version history,
- * and a snapshot that said "public" at the time is true history. The search
- * index is left to boot's rebuild, which re-derives it from the rows.
- */
-import type { DescMessage } from "@bufbuild/protobuf";
-import { fromBinary, toBinary } from "@bufbuild/protobuf";
-import { reflect } from "@bufbuild/protobuf/reflect";
-
-import { AgentSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import { AgentInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/api_pb";
-import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import { PluginSchema } from "@stigmer/protos/ai/stigmer/agentic/plugin/v1/api_pb";
-import { SkillSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/api_pb";
-import { WorkflowSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
-import { WorkflowInstanceSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/api_pb";
-import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-
-/** One kind that could hold the public level, with the schema its rows decode through. */
-export interface PublicRowKind {
-  /** The enum NAME the drivers' `kind` column holds. */
-  readonly kind: string;
-  readonly schema: DescMessage;
-}
-
-/**
- * The seven kinds whose VisibilityConfig declared `supports_public` when the
- * level was retired — frozen (the module header). Order is the order the
- * drivers walk the kinds; it has no other meaning.
- */
-export const PUBLIC_ROW_KINDS_AT_RETIREMENT: ReadonlyArray<PublicRowKind> = [
-  { kind: "agent", schema: AgentSchema },
-  { kind: "skill", schema: SkillSchema },
-  { kind: "mcp_server", schema: McpServerSchema },
-  { kind: "agent_instance", schema: AgentInstanceSchema },
-  { kind: "workflow", schema: WorkflowSchema },
-  { kind: "workflow_instance", schema: WorkflowInstanceSchema },
-  { kind: "plugin", schema: PluginSchema },
-];
-
-/** The level every moved row takes: the widest level that stays inside the owning organization. */
-export const LEVEL_AFTER_RETIREMENT = ApiResourceVisibility.visibility_org;
-
-/**
- * The moved bytes of one row when it holds the public level, or undefined
- * when it does not (the driver then leaves the row's bytes exactly as they
- * are; a row with no metadata holds no level and is one of these). Throws
- * when the bytes do not decode as the kind's message: a row this migration
- * cannot read is a row it must not pass over (the module header).
- */
-export function movePublicRowToOrg(
-  entry: PublicRowKind,
-  data: Uint8Array,
-): Uint8Array | undefined {
-  const message = fromBinary(entry.schema, data);
-  const root = reflect(entry.schema, message);
-  const metadataField = root.fields.find((field) => field.name === "metadata");
-  if (metadataField === undefined || metadataField.fieldKind !== "message") {
-    throw new Error(
-      `${entry.kind}: the schema declares no metadata message field`,
-    );
-  }
-  if (!root.isSet(metadataField)) {
-    return undefined;
-  }
-  const metadata = root.get(metadataField);
-  const visibilityField = metadata.fields.find(
-    (field) => field.name === "visibility",
-  );
-  if (visibilityField === undefined || visibilityField.fieldKind !== "enum") {
-    throw new Error(
-      `${entry.kind}: the metadata message declares no visibility enum field`,
-    );
-  }
-  if (
-    metadata.get(visibilityField) !== ApiResourceVisibility.visibility_public
-  ) {
-    return undefined;
-  }
-  metadata.set(visibilityField, LEVEL_AFTER_RETIREMENT);
-  return toBinary(entry.schema, message);
-}