@inneranimalmedia/agentsam-sdk 2.6.0 → 2.6.2

package/package.json

@@ -1,23 +1,28 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk",
-  "version": "2.6.0",
+  "version": "2.6.2",
   "description": "Portable AgentSam SDK and CLI kits for local scaffolding, repository intelligence, incremental indexing, identity adapters, and verified dependency maintenance.",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
-    "./git-context": "./src/lib/git-context.js",
+    "./git-context": "./packages/agentsam-repository/src/git-context.js",
     "./bridge-client": "./src/lib/bridge-client.js",
     "./local/sqlite": "./src/local/sqlite.js",
     "./dockerize": "./src/lib/dockerize.js",
     "./mini": "./src/lib/mini/index.js",
-    "./merkle": "./src/lib/merkle/index.js",
+    "./merkle": "./packages/agentsam-repository/src/merkle/index.js",
     "./deploy-receipt": "./src/lib/deploy-receipt/index.js",
     "./knowledge": "./src/knowledge/index.js",
     "./knowledge-service-client": "./src/knowledge/service/client.js",
+    "./knowledge-service-grpc-client": "./src/knowledge/service/grpc-client.js",
     "./capabilities": "./src/capabilities/index.js",
     "./capability-manifest": "./protocol/capabilities/manifest.json",
     "./repository": "./src/repository/index.js",
+    "./repository/contracts": "./packages/agentsam-repository/src/contracts.js",
+    "./repository/identity-schema": "./protocol/repository/repository-identity.schema.json",
+    "./repository/contract-schema": "./protocol/repository/repository-contract.schema.json",
+    "./repository/dependency-schema": "./protocol/repository/repository-dependency.schema.json",
     "./agent": "./src/agent/index.js",
     "./presets": "./src/presets/index.js",
     "./preset-catalog": "./protocol/presets/catalog.json",
@@ -71,6 +76,7 @@
   "files": [
     "src",
     "packages/identity",
+    "packages/agentsam-repository",
     "packages/connectors/cloudflare",
     "templates",
     "docs",
@@ -78,6 +84,7 @@
     "test",
     "python",
     "protocol",
+    "migrations",
     "skills",
     "services/knowledge/package.json",
     "services/knowledge/package-lock.json",
@@ -93,19 +100,28 @@
     "packages/agentsam-shell-kit",
     "packages/identity",
     "packages/agentsam-contracts",
+    "packages/agentsam-repository",
     "packages/agentsam-workbench"
   ],
   "scripts": {
-    "test": "node test/smoke.mjs && node --test test/*.test.mjs && npm --prefix packages/identity test && npm run test:connectors",
+    "test": "npm run test:standard && npm --prefix packages/identity test && npm run test:connectors",
+    "test:standard": "node test/smoke.mjs && npm run test:unit && npm run test:cli && npm run test:integration:mock && npm run test:terminal:mock",
+    "test:unit": "node --test test/*.test.mjs",
+    "test:cli": "node --test test/cli/*.test.mjs",
+    "test:integration:mock": "node --test test/integration/*.test.mjs",
+    "test:terminal:mock": "node --test test/terminal/*.test.mjs",
+    "test:live:terminal": "node --test test/live/*.live.test.mjs",
     "test:identity": "npm --prefix packages/identity test",
+    "test:workspaces": "npm --prefix packages/agentsam-contracts test && npm --prefix packages/agentsam-contracts run typecheck && npm --prefix packages/agentsam-repository test && npm --prefix packages/agentsam-workbench test && npm --prefix packages/agentsam-workbench run typecheck && npm --prefix packages/agentsam-shell-kit run typecheck",
     "smoke": "node test/smoke.mjs",
     "verify:package": "node scripts/verify-package.mjs",
+    "verify:boundaries": "node scripts/verify-source-boundaries.mjs",
     "verify:bootstrap": "node scripts/verify-bootstrap.mjs",
     "verify:knowledge-package": "node scripts/verify-knowledge-package.mjs",
     "test:python": "node scripts/verify-python.mjs",
     "verify:release": "npm run verify && npm run verify:knowledge-package && npm run test:python && npm run security:check",
     "pack:check": "npm pack --dry-run --json",
-    "verify": "npm test && npm run verify:package && npm run verify:bootstrap && npm run pack:check",
+    "verify": "npm run proto:check && npm test && npm run test:workspaces && npm run verify:boundaries && npm run verify:package && npm run verify:bootstrap && npm run pack:check",
     "publish:identity-alpha": "bash scripts/publish-identity-alpha.sh",
     "publish:identity-alpha:dry-run": "bash scripts/publish-identity-alpha.sh --dry-run",
     "publish:identity-alpha:publish-only": "bash scripts/publish-identity-alpha.sh --publish-only",
@@ -115,7 +131,9 @@
     "security:repair": "node src/security/cli.mjs repair",
     "ui:preview": "node scripts/ui-preview.mjs",
     "test:connectors": "node --test packages/connectors/cloudflare/tests/**/*.test.mjs",
-    "verify:npm10-lock": "node apps/local-studio/scripts/verify-npm10-lock.mjs"
+    "verify:npm10-lock": "node apps/local-studio/scripts/verify-npm10-lock.mjs",
+    "proto:generate": "node scripts/generate-proto.mjs",
+    "proto:check": "node scripts/verify-proto.mjs"
   },
   "engines": {
     "node": ">=22 <25",
@@ -123,6 +141,8 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
+    "@grpc/grpc-js": "^1.14.4",
+    "google-protobuf": "^3.21.4",
     "node-pty": "^1.0.0",
     "pg": "8.16.3",
     "picocolors": "^1.1.1",
@@ -156,7 +176,8 @@
   },
   "devDependencies": {
     "@electric-sql/pglite": "0.5.8",
-    "@electric-sql/pglite-pgvector": "0.0.9"
+    "@electric-sql/pglite-pgvector": "0.0.9",
+    "grpc-tools": "^1.13.1"
   },
   "packageManager": "npm@10.9.2"
 }

package/packages/agentsam-repository/README.md

@@ -0,0 +1,15 @@
+# @inneranimalmedia/agentsam-repository
+
+Owned repository/runtime package for AgentSam.
+
+It owns deterministic repository identity and Merkle behavior that must be reusable independently of the CLI surface:
+
+- Git remote/context normalization
+- Merkle content trees and snapshots
+- semantic/file metadata classification
+- Merkle persistence contracts and Cloudflare binding adapters
+- repository graph runtime normalization
+
+It does **not** own authenticated account sessions, CLI commands, UI rendering, knowledge retrieval, deployment orchestration, or product application state. Those layers consume this package through explicit imports.
+
+The workspace is private while the extraction stabilizes. Cross-repository consumers should continue using the published `@inneranimalmedia/agentsam-sdk` facade until this package receives its own release policy.

package/packages/agentsam-repository/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@inneranimalmedia/agentsam-repository",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Portable AgentSam repository identity, Merkle, semantic file metadata, persistence, and repository graph runtime contracts.",
+  "type": "module",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./git-context": "./src/git-context.js",
+    "./contracts": "./src/contracts.js",
+    "./merkle": "./src/merkle/index.js",
+    "./merkle/persistence": "./src/merkle/persistence.js",
+    "./merkle/cloudflare-persistence": "./src/merkle/cloudflare-persistence.js"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "dependencies": {
+    "typescript": "5.9.3"
+  },
+  "engines": {
+    "node": ">=22 <25"
+  }
+}

package/packages/agentsam-repository/src/contracts.js

@@ -0,0 +1,113 @@
+export const COMPANY_REPOSITORY_GRAPH_SCHEMA_VERSION = 1;
+
+export const REPOSITORY_STATUSES = Object.freeze(['active', 'archived', 'disabled']);
+export const REPOSITORY_CONTRACT_TYPES = Object.freeze(['api', 'schema', 'runtime', 'cli', 'event', 'receipt', 'package']);
+export const REPOSITORY_CONTRACT_STATUSES = Object.freeze(['active', 'deprecated', 'retired']);
+export const REPOSITORY_DEPENDENCY_TYPES = Object.freeze(['runtime', 'build', 'contract', 'package', 'deploy', 'tool', 'data']);
+export const REPOSITORY_DEPENDENCY_CRITICALITIES = Object.freeze(['informational', 'compatible', 'strict', 'critical']);
+export const REPOSITORY_FAILURE_POLICIES = Object.freeze(['warn', 'block_certification', 'block_deploy', 'degrade']);
+
+const LEGACY_OWNERSHIP_KEYS = Object.freeze([
+  'tenant_id', 'tenantId',
+  'workspace_id', 'workspaceId',
+  'user_id', 'userId',
+  'owner_user_id', 'ownerUserId',
+]);
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function required(value, label) {
+  const text = clean(value);
+  if (!text) throw new TypeError(`${label} is required`);
+  return text;
+}
+
+function optional(value) {
+  const text = clean(value);
+  return text || null;
+}
+
+function enumValue(value, allowed, label) {
+  const text = required(value, label).toLowerCase();
+  if (!allowed.includes(text)) throw new RangeError(`unsupported ${label}: ${text}`);
+  return text;
+}
+
+function optionalUnix(value, label) {
+  if (value == null || value === '') return null;
+  const number = Number(value);
+  if (!Number.isInteger(number) || number < 0) throw new RangeError(`${label} must be a non-negative integer`);
+  return number;
+}
+
+function rejectLegacyOwnership(value) {
+  for (const key of LEGACY_OWNERSHIP_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(value, key)) {
+      throw new TypeError(`legacy ownership field is not supported: ${key}`);
+    }
+  }
+}
+
+/**
+ * Portable repository identity. Ownership is intentionally not embedded here;
+ * the authenticated host binds repository_id to account_id in its registry.
+ */
+export function createRepositoryIdentity(value = {}) {
+  rejectLegacyOwnership(value);
+  if (Object.prototype.hasOwnProperty.call(value, 'account_id') || Object.prototype.hasOwnProperty.call(value, 'accountId')) {
+    throw new TypeError('repository identity must not embed account_id');
+  }
+  return Object.freeze({
+    schema_version: COMPANY_REPOSITORY_GRAPH_SCHEMA_VERSION,
+    repository_id: required(value.repository_id ?? value.repositoryId, 'repository_id'),
+    full_name: required(value.full_name ?? value.fullName, 'full_name'),
+    role: required(value.role, 'role'),
+    default_branch: optional(value.default_branch ?? value.defaultBranch) || 'main',
+    canonical_url: optional(value.canonical_url ?? value.canonicalUrl),
+    status: enumValue(value.status || 'active', REPOSITORY_STATUSES, 'repository status'),
+  });
+}
+
+/** Account-bound declaration of one public repository contract. */
+export function createRepositoryContract(value = {}) {
+  rejectLegacyOwnership(value);
+  return Object.freeze({
+    schema_version: COMPANY_REPOSITORY_GRAPH_SCHEMA_VERSION,
+    id: required(value.id, 'id'),
+    account_id: required(value.account_id ?? value.accountId, 'account_id'),
+    repository_id: required(value.repository_id ?? value.repositoryId, 'repository_id'),
+    contract_key: required(value.contract_key ?? value.contractKey, 'contract_key'),
+    contract_version: required(value.contract_version ?? value.contractVersion, 'contract_version'),
+    contract_type: enumValue(value.contract_type ?? value.contractType, REPOSITORY_CONTRACT_TYPES, 'contract_type'),
+    name: optional(value.name) || required(value.contract_key ?? value.contractKey, 'contract_key'),
+    description: optional(value.description),
+    manifest_path: optional(value.manifest_path ?? value.manifestPath),
+    contract_hash: required(value.contract_hash ?? value.contractHash, 'contract_hash'),
+    status: enumValue(value.status || 'active', REPOSITORY_CONTRACT_STATUSES, 'contract status'),
+    created_at: optionalUnix(value.created_at ?? value.createdAt, 'created_at'),
+    updated_at: optionalUnix(value.updated_at ?? value.updatedAt, 'updated_at'),
+  });
+}
+
+/** Account-bound cross-repository dependency edge. */
+export function createRepositoryDependency(value = {}) {
+  rejectLegacyOwnership(value);
+  return Object.freeze({
+    schema_version: COMPANY_REPOSITORY_GRAPH_SCHEMA_VERSION,
+    id: required(value.id, 'id'),
+    account_id: required(value.account_id ?? value.accountId, 'account_id'),
+    source_repository_id: required(value.source_repository_id ?? value.sourceRepositoryId, 'source_repository_id'),
+    target_repository_id: required(value.target_repository_id ?? value.targetRepositoryId, 'target_repository_id'),
+    dependency_type: enumValue(value.dependency_type ?? value.dependencyType, REPOSITORY_DEPENDENCY_TYPES, 'dependency_type'),
+    contract_id: optional(value.contract_id ?? value.contractId),
+    criticality: enumValue(value.criticality, REPOSITORY_DEPENDENCY_CRITICALITIES, 'criticality'),
+    required_version: optional(value.required_version ?? value.requiredVersion),
+    required_contract_hash: optional(value.required_contract_hash ?? value.requiredContractHash),
+    failure_policy: enumValue(value.failure_policy ?? value.failurePolicy, REPOSITORY_FAILURE_POLICIES, 'failure_policy'),
+    description: optional(value.description),
+    created_at: optionalUnix(value.created_at ?? value.createdAt, 'created_at'),
+    updated_at: optionalUnix(value.updated_at ?? value.updatedAt, 'updated_at'),
+  });
+}

package/packages/agentsam-repository/src/index.js

@@ -0,0 +1,3 @@
+export { resolveGitContext, tryResolveGitContext, normalizeGitRemote } from './git-context.js';
+export * from './contracts.js';
+export * from './merkle/index.js';

package/{src/lib → packages/agentsam-repository/src}/merkle/cloudflare-persistence.js

@@ -129,25 +129,15 @@ export function resolveWranglerMerklePersistence({
   };
 }
 
-function providerRepoId(git) {
-  const host = clean(git?.remoteHost).toLowerCase();
-  const fullName = clean(git?.repoFullName);
-  if (!fullName) return null;
-  if (host === 'github.com') return `github:${fullName}`;
-  if (host === 'gitlab.com') return `gitlab:${fullName}`;
-  if (host === 'bitbucket.org') return `bitbucket:${fullName}`;
-  return null;
-}
-
 function safeId(value) {
   return clean(value).replace(/[^A-Za-z0-9._-]+/g, '').slice(0, 96);
 }
 
-function snapshotIdFor({ snapshot, repoId, captureKind, deploymentId }) {
+function snapshotIdFor({ snapshot, repositoryId, captureKind, deploymentId }) {
   const deployment = safeId(deploymentId);
   if (captureKind === 'deploy' && deployment) return `mrs_dep_${deployment.toLowerCase()}`;
   const digest = createHash('sha256')
-    .update([repoId, snapshot.rootHash, snapshot.semantic?.rootHash || '', captureKind].join('\0'))
+    .update([repositoryId, snapshot.rootHash, snapshot.semantic?.rootHash || '', captureKind].join('\0'))
     .digest('hex');
   return `mrs_${digest.slice(0, 24)}`;
 }
@@ -167,8 +157,8 @@ function sqlInt(value) {
 export function buildMerklePersistencePlan({
   snapshot,
   root = process.cwd(),
-  ownerUserId,
-  repoId,
+  accountId,
+  repositoryId,
   source = 'local',
   captureKind = 'manual',
   connectionId = null,
@@ -180,24 +170,24 @@ export function buildMerklePersistencePlan({
   wrangler,
 } = {}) {
   if (!snapshot?.rootHash || !Array.isArray(snapshot?.entries)) throw new Error('merkle_snapshot_required');
-  const owner = clean(ownerUserId);
-  if (!owner) throw new Error('owner_user_id_required');
+  const account = clean(accountId);
+  const repository = clean(repositoryId);
+  if (!account) throw new Error('account_id_required');
+  if (!repository) throw new Error('repository_id_required');
   if (!CAPTURE_KINDS.has(captureKind)) throw new Error(`capture_kind_invalid:${captureKind}`);
   if (!SOURCES.has(source)) throw new Error(`source_invalid:${source}`);
   if (captureKind !== 'deploy' && !clean(connectionId) && !clean(runtimeLeaseId)) throw new Error('execution_provenance_required');
   let git = null;
   try { git = resolveGitContext({ cwd: root }); } catch { git = null; }
-  const resolvedRepoId = clean(repoId) || providerRepoId(git);
-  if (!resolvedRepoId) throw new Error('repo_id_required');
-  const snapshotId = snapshotIdFor({ snapshot, repoId: resolvedRepoId, captureKind, deploymentId });
+  const snapshotId = snapshotIdFor({ snapshot, repositoryId: repository, captureKind, deploymentId });
   const prefix = normalizeMerkleStoragePrefix(storagePrefix);
-  const storageKey = merkleSnapshotStorageKey({ ownerUserId: owner, repoId: resolvedRepoId, snapshotId, prefix });
+  const storageKey = merkleSnapshotStorageKey({ accountId: account, repositoryId: repository, snapshotId, prefix });
   const createdAt = Math.floor(Date.now() / 1000);
   const classifier = snapshot.semantic?.classifier || null;
   const row = {
     snapshot_id: snapshotId,
-    owner_user_id: owner,
-    repo_id: resolvedRepoId,
+    account_id: account,
+    repository_id: repository,
     repository: git?.remoteUrl || null,
     source,
     manifest_format: snapshot.format || 'agentsam-merkle',
@@ -235,7 +225,7 @@ export function buildMerklePersistencePlan({
 
 export function merklePersistenceUpsertSql(row) {
   return `INSERT INTO ${MERKLE_SNAPSHOT_TABLE} (
-  snapshot_id, owner_user_id, repo_id, repository, source,
+  snapshot_id, account_id, repository_id, repository, source,
   manifest_format, manifest_version, hash_algorithm, root_hash, policy_hash,
   resolved_commit_sha, resolved_tree_sha, git_branch, working_tree_dirty,
   connection_id, runtime_lease_id, storage_backend, storage_bucket, storage_key,
@@ -243,7 +233,7 @@ export function merklePersistenceUpsertSql(row) {
   capture_kind, deployment_id, worker_version_id, reference_label,
   created_at, persisted_at, metadata_root, classifier_format, classifier_version, classifier_source
 ) VALUES (
-  ${sqlText(row.snapshot_id)}, ${sqlText(row.owner_user_id)}, ${sqlText(row.repo_id)}, ${sqlText(row.repository)}, ${sqlText(row.source)},
+  ${sqlText(row.snapshot_id)}, ${sqlText(row.account_id)}, ${sqlText(row.repository_id)}, ${sqlText(row.repository)}, ${sqlText(row.source)},
   ${sqlText(row.manifest_format)}, ${sqlInt(row.manifest_version)}, ${sqlText(row.hash_algorithm)}, ${sqlText(row.root_hash)}, ${sqlText(row.policy_hash)},
   ${sqlText(row.resolved_commit_sha)}, ${sqlText(row.resolved_tree_sha)}, ${sqlText(row.git_branch)}, ${sqlInt(row.working_tree_dirty)},
   ${sqlText(row.connection_id)}, ${sqlText(row.runtime_lease_id)}, ${sqlText(row.storage_backend)}, ${sqlText(row.storage_bucket)}, ${sqlText(row.storage_key)},

package/{src/lib → packages/agentsam-repository/src}/merkle/index.js

@@ -10,6 +10,7 @@ export async function buildSemanticMetadata(...args) {
 export { validateSemanticMetadata, metadataRoot, FILEMETA_FORMAT, FILEMETA_VERSION } from './filemeta.js';
 
 export {
+  MERKLE_PERSISTENCE_SCHEMA_VERSION,
   MERKLE_SNAPSHOT_SCHEMA_SQL,
   MERKLE_SNAPSHOT_STORAGE_PREFIX,
   MERKLE_SNAPSHOT_TABLE,

package/{src/lib → packages/agentsam-repository/src}/merkle/persistence.js

@@ -27,15 +27,17 @@ export function normalizeMerkleStoragePrefix(value = MERKLE_SNAPSHOT_STORAGE_PRE
  * Provider-neutral object key. The host chooses which physical bucket is bound
  * to the logical WEBSITE_ASSETS role; the SDK never owns cloud credentials.
  */
-export function merkleSnapshotStorageKey({ ownerUserId, repoId, snapshotId, prefix = MERKLE_SNAPSHOT_STORAGE_PREFIX } = {}) {
-  return `${normalizeMerkleStoragePrefix(prefix)}/${safeSegment(ownerUserId, 'owner_user_id')}/${safeSegment(repoId, 'repo_id')}/${safeSegment(snapshotId, 'snapshot_id')}.json`;
+export const MERKLE_PERSISTENCE_SCHEMA_VERSION = 2;
+
+export function merkleSnapshotStorageKey({ accountId, repositoryId, snapshotId, prefix = MERKLE_SNAPSHOT_STORAGE_PREFIX } = {}) {
+  return `${normalizeMerkleStoragePrefix(prefix)}/${safeSegment(accountId, 'account_id')}/${safeSegment(repositoryId, 'repository_id')}/${safeSegment(snapshotId, 'snapshot_id')}.json`;
 }
 
 /** Portable D1/SQLite schema for hosts that opt into persisted Merkle snapshots. */
 export const MERKLE_SNAPSHOT_SCHEMA_SQL = `CREATE TABLE IF NOT EXISTS ${MERKLE_SNAPSHOT_TABLE} (
   snapshot_id TEXT PRIMARY KEY NOT NULL,
-  owner_user_id TEXT NOT NULL,
-  repo_id TEXT NOT NULL,
+  account_id TEXT NOT NULL,
+  repository_id TEXT NOT NULL,
   repository TEXT,
   source TEXT NOT NULL CHECK (source IN ('github','gitlab','bitbucket','local','upload')),
   manifest_format TEXT NOT NULL DEFAULT 'agentsam-merkle',

package/{src/lib → packages/agentsam-repository/src}/merkle/policy.js

@@ -2,6 +2,7 @@ import { comparePaths } from './hash.js';
 
 export const DEFAULT_IGNORES = Object.freeze([
   '.git', 'node_modules', 'dist', '.DS_Store', '.agentsam/cache', '.agentsam/merkle', '.agentsam/merkle.json',
+  '.agentsam/backups', '.agentsam/intelligence/archive',
 ]);
 export function validPath(value, allowRoot = false) {
   return typeof value === 'string' && ((allowRoot && value === '') || (value.length > 0 &&

package/packages/agentsam-repository/test/contracts.test.mjs

@@ -0,0 +1,40 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  createRepositoryContract,
+  createRepositoryDependency,
+  createRepositoryIdentity,
+} from '../src/contracts.js';
+
+test('repository package owns account/repository graph normalization', () => {
+  const identity = createRepositoryIdentity({
+    repository_id: 'github:owner/repo',
+    full_name: 'owner/repo',
+    role: 'runtime',
+  });
+  assert.equal(identity.repository_id, 'github:owner/repo');
+  assert.equal(Object.hasOwn(identity, 'account_id'), false);
+
+  const contract = createRepositoryContract({
+    id: 'contract:runtime:v1',
+    account_id: 'au_test',
+    repository_id: identity.repository_id,
+    contract_key: 'runtime',
+    contract_version: '1',
+    contract_type: 'runtime',
+    contract_hash: `sha256:${'1'.repeat(64)}`,
+  });
+  assert.equal(contract.account_id, 'au_test');
+
+  const dependency = createRepositoryDependency({
+    id: 'dep:a:b',
+    account_id: 'au_test',
+    source_repository_id: 'github:owner/a',
+    target_repository_id: 'github:owner/b',
+    dependency_type: 'contract',
+    criticality: 'strict',
+    failure_policy: 'block_certification',
+  });
+  assert.equal(dependency.failure_policy, 'block_certification');
+  assert.throws(() => createRepositoryContract({ ...contract, workspace_id: 'ws_legacy' }), /legacy ownership field/);
+});

package/packages/agentsam-repository/test/git-context.test.mjs

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import test from 'node:test';
+import { normalizeGitRemote, resolveGitContext } from '../src/git-context.js';
+
+test('repository package derives resource identity from Git, not account environment', t => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-repository-git-'));
+  t.after(() => fs.rmSync(root, { recursive: true, force: true }));
+  execFileSync('git', ['init', '-q', root]);
+  execFileSync('git', ['-C', root, 'remote', 'add', 'origin', 'git@github.com:ExampleOrg/DemoRepo.git']);
+  const context = resolveGitContext({ cwd: root });
+  assert.equal(context.repoFullName, 'ExampleOrg/DemoRepo');
+  assert.equal(context.owner, 'ExampleOrg');
+  assert.equal(context.repo, 'DemoRepo');
+  assert.equal(context.revisionSha, null);
+});
+
+test('remote normalization supports HTTPS and SSH without ownership fields', () => {
+  assert.equal(normalizeGitRemote('https://github.com/Owner/Repo.git').repoFullName, 'Owner/Repo');
+  assert.equal(normalizeGitRemote('git@github.com:Owner/Repo.git').repoFullName, 'Owner/Repo');
+});

package/{test/merkle.test.mjs → packages/agentsam-repository/test/merkle-core.test.mjs}

@@ -3,11 +3,7 @@ import { test } from 'node:test';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { buildMerkleTree, saveSnapshot, readSnapshot, validateSnapshot, diffTrees, metadataRoot } from '../src/lib/merkle/index.js';
-
-const cli = fileURLToPath(new URL('../src/cli.js', import.meta.url));
+import { buildMerkleTree, saveSnapshot, readSnapshot, validateSnapshot, diffTrees, metadataRoot } from '../src/merkle/index.js';
 async function fixture(t) {
   const root = await fs.mkdtemp(path.join(os.tmpdir(), 'agentsam-merkle-test-'));
   t.after(() => fs.rm(root, { recursive: true, force: true }));
@@ -17,8 +13,6 @@ async function write(root, name, content = name) {
   await fs.mkdir(path.dirname(path.join(root, name)), { recursive: true });
   await fs.writeFile(path.join(root, name), content);
 }
-function run(args, cwd) { return spawnSync(process.execPath, [cli, 'merkle', ...args], { cwd, encoding: 'utf8', timeout: 15000 }); }
-
 test('version 1 hashes match independent SHA-256 protocol vectors', async (t) => {
   const root = await fixture(t);
   assert.equal((await buildMerkleTree(root)).rootHash, 'sha256:6ce8ca443f3cf6c719c5cb9acc121403addf3f499eefa3db25edacf2c7fe0f94');
@@ -49,7 +43,7 @@ test('default ignores, explicit dist inclusion, literal exclusions, and empty-di
   const root = await fixture(t);
   await write(root, 'src/app.js');
   const first = await buildMerkleTree(root);
-  for (const name of ['.git/config', 'node_modules/pkg/file', 'dist/app.js', '.DS_Store', '.agentsam/cache/data', '.agentsam/merkle/old.json']) await write(root, name);
+  for (const name of ['.git/config', 'node_modules/pkg/file', 'dist/app.js', '.DS_Store', '.agentsam/cache/data', '.agentsam/merkle/old.json', '.agentsam/backups/pre-cleanup.bak', '.agentsam/intelligence/archive/20260912/repo_intelligence.json']) await write(root, name);
   await fs.mkdir(path.join(root, 'empty'));
   assert.equal(first.rootHash, (await buildMerkleTree(root)).rootHash);
   const withDist = await buildMerkleTree(root, { include: ['dist'] });
@@ -172,30 +166,6 @@ test('scan fails when a file disappears and honors cancellation', async (t) => {
   await assert.rejects(buildMerkleTree(root, { signal: controller.signal }), { name: 'AbortError' });
 });
 
-test('CLI snapshot/verify/diff supports JSON, moved roots, and distinct mismatch/error exit codes', async (t) => {
-  const root = await fixture(t), moved = await fixture(t);
-  await write(root, 'a.txt', 'hello'); await write(moved, 'a.txt', 'hello');
-  const saved = run(['snapshot', '.', '--json'], root);
-  assert.equal(saved.status, 0, saved.stderr);
-  const manifest = JSON.parse(saved.stdout);
-  assert.ok(manifest.output.endsWith('merkle.json'));
-  const matching = run(['verify', manifest.output, '--root', moved, '--json'], root);
-  assert.equal(matching.status, 0, matching.stderr);
-  assert.equal(JSON.parse(matching.stdout).equal, true);
-  await write(moved, 'a.txt', 'changed'); await write(moved, 'b.txt', 'new');
-  const changed = run(['verify', manifest.output, '--root', moved, '--json'], root);
-  assert.equal(changed.status, 1, changed.stderr);
-  assert.deepEqual(JSON.parse(changed.stdout).stats, { unchanged: 0, modified: 1, added: 1, removed: 0 });
-  const diff = run(['diff', root, moved, '--json'], root);
-  assert.equal(diff.status, 1, diff.stderr);
-  const invalid = run(['root', '.', '--typo', '--json'], root);
-  assert.equal(invalid.status, 2); assert.equal(invalid.stdout, '');
-  assert.match(JSON.parse(invalid.stderr).error, /Unknown option/);
-  const piped = run(['inspect', '.', '--tui'], root);
-  assert.equal(piped.status, 0, piped.stderr);
-  assert.ok(!piped.stdout.includes('\x1b'));
-});
-
 test('semantic index records execution domains, environment access, and resolved local imports as Merkle-bound evidence', async (t) => {
   const root = await fixture(t);
   await write(root, 'package.json', JSON.stringify({ name: 'boundary-fixture', version: '1.0.0' }));

package/{test → packages/agentsam-repository/test}/merkle-persistence.test.mjs

@@ -1,6 +1,7 @@
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
+  MERKLE_PERSISTENCE_SCHEMA_VERSION,
   MERKLE_SNAPSHOT_SCHEMA_SQL,
   MERKLE_SNAPSHOT_STORAGE_PREFIX,
   MERKLE_SNAPSHOT_TABLE,
@@ -9,15 +10,19 @@ import {
   merklePersistenceUpsertSql,
   merkleSnapshotStorageKey,
   resolveWranglerMerklePersistence,
-} from '../src/lib/merkle/index.js';
+} from '../src/merkle/index.js';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
 test('portable Merkle persistence names one table, prefix, and logical asset role', () => {
+  assert.equal(MERKLE_PERSISTENCE_SCHEMA_VERSION, 2);
   assert.equal(MERKLE_SNAPSHOT_TABLE, 'agentsam_fs_merkle_snapshots');
   assert.equal(MERKLE_SNAPSHOT_STORAGE_PREFIX, 'agentsam_fs_merkle_snapshots');
   assert.equal(MERKLE_WEBSITE_ASSETS_BINDING, 'WEBSITE_ASSETS');
+  assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /account_id TEXT NOT NULL/);
+  assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /repository_id TEXT NOT NULL/);
+  assert.doesNotMatch(MERKLE_SNAPSHOT_SCHEMA_SQL, /owner_user_id|\brepo_id\b/);
   assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /metadata_root TEXT/);
   assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /classifier_format TEXT/);
   assert.match(MERKLE_SNAPSHOT_SCHEMA_SQL, /storage_bucket TEXT/);
@@ -25,12 +30,12 @@ test('portable Merkle persistence names one table, prefix, and logical asset rol
 
 test('snapshot storage keys stay beneath the canonical prefix and encode repo identity', () => {
   const key = merkleSnapshotStorageKey({
-    ownerUserId: 'au_example',
-    repoId: 'github:owner/repo',
+    accountId: 'au_example',
+    repositoryId: 'github:owner/repo',
     snapshotId: 'mrs_example',
   });
   assert.equal(key, 'agentsam_fs_merkle_snapshots/au_example/github%3Aowner%2Frepo/mrs_example.json');
-  const escaped = merkleSnapshotStorageKey({ ownerUserId: '../oops', repoId: 'repo', snapshotId: 'snap' });
+  const escaped = merkleSnapshotStorageKey({ accountId: '../oops', repositoryId: 'repo', snapshotId: 'snap' });
   assert.ok(!escaped.includes('/../'));
   assert.ok(escaped.includes('..%2Foops'));
 });
@@ -63,7 +68,7 @@ test('persistence plan keeps content, policy, and metadata identities separate',
     },
   };
   const plan = buildMerklePersistencePlan({
-    snapshot, root: process.cwd(), ownerUserId: 'au_test', repoId: 'github:owner/repo', source: 'github',
+    snapshot, root: process.cwd(), accountId: 'au_test', repositoryId: 'github:owner/repo', source: 'github',
     captureKind: 'agent', connectionId: 'conn_test',
     wrangler: { storage_bucket: 'customer-assets', r2_binding: 'WEBSITE_ASSETS', database_name: 'customer-db', d1_binding: 'DB' },
   });
@@ -85,7 +90,7 @@ test('non-deploy persistence requires execution provenance', () => {
     policyHash: `sha256:${'2'.repeat(64)}`, entries: [], stats: { files: 0, directories: 0, symlinks: 0, bytes: 0 },
   };
   assert.throws(() => buildMerklePersistencePlan({
-    snapshot, root: process.cwd(), ownerUserId: 'au_test', repoId: 'github:owner/repo', captureKind: 'agent',
+    snapshot, root: process.cwd(), accountId: 'au_test', repositoryId: 'github:owner/repo', captureKind: 'agent',
     wrangler: { storage_bucket: 'customer-assets', r2_binding: 'WEBSITE_ASSETS', database_name: 'customer-db', d1_binding: 'DB' },
   }), /execution_provenance_required/);
 });

package/packages/identity/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.0",
+  "version": "2.6.2",
   "private": true,
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",