@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/migrations/d1/0009_normalize_cloudflare_plugin_installations.sql

@@ -0,0 +1,137 @@
+-- Cloudflare OAuth is represented by two distinct account-scoped plugin
+-- installations. Preserve the row IDs so historic health evidence remains
+-- attached while normalizing the public plugin contract.
+
+ALTER TABLE agentsam_cloudflare_oauth_state ADD COLUMN return_to TEXT;
+
+-- Local Studio's public PKCE client is the executable AgentSam MCP plugin.
+UPDATE agentsam_plugins
+SET plugin_key = 'agentsam-mcp',
+    provider_key = 'cloudflare',
+    plugin_kind = 'oauth',
+    category = 'developer_platform',
+    display_name = 'AgentSam MCP',
+    short_name = 'AgentSam MCP',
+    description = 'Connect a Cloudflare account to AgentSam through the Local Studio PKCE approval flow.',
+    mention_aliases_json = '["@agentsam-mcp","agentsam mcp"]',
+    endpoint_url = 'https://api.cloudflare.com/client/v4',
+    transport = 'http_rest',
+    auth_type = 'oauth',
+    oauth_connect_url = '/api/connections/cloudflare/start',
+    capabilities_json = '["cloudflare.api.docs","cloudflare.api.search","cloudflare.api.execute"]',
+    tool_lanes_json = '["typed","mcp","api","codemode"]',
+    resource_scope_json = '{"owner":"account","oauth_connection_table":"agentsam_cloudflare_connections"}',
+    config_json = '{"oauth_authority":"cloudflare","oauth_client_id":"c0704bd7a7aab7216b362603e1985499","authorization_endpoint":"https://dash.cloudflare.com/oauth2/auth","token_endpoint":"https://dash.cloudflare.com/oauth2/token","revoke_endpoint":"https://dash.cloudflare.com/oauth2/revoke","userinfo_endpoint":"https://dash.cloudflare.com/oauth2/userinfo","callback_url":"https://agentsam.inneranimalmedia.com/api/connections/cloudflare/callback","token_auth_method":"none_pkce"}',
+    metadata_json = '{"execution_strategy":"runtime_selected","client_name":"AgentSam Local Studio","client_uri":"https://agentsam.inneranimalmedia.com"}',
+    health_strategy = 'oauth_probe',
+    updated_at = unixepoch()
+WHERE plugin_key = 'cloudflare'
+  AND provider_key = 'cloudflare'
+  AND installation_key = 'local-studio-pkce'
+  AND auth_type = 'oauth';
+
+-- Inner Animal Media Platform uses its own confidential Cloudflare client and
+-- host-owned token resolver. It is intentionally distinct from AgentSam MCP.
+UPDATE agentsam_plugins
+SET plugin_key = 'inneranimalmedia-cf-oauth',
+    installation_key = 'default',
+    provider_key = 'cloudflare',
+    plugin_kind = 'oauth',
+    category = 'developer_platform',
+    display_name = 'Inner Animal Media Cloudflare OAuth',
+    short_name = 'IAM Cloudflare',
+    description = 'Inner Animal Media Platform confidential Cloudflare OAuth connection.',
+    mention_aliases_json = '["@inneranimalmedia-cf-oauth"]',
+    endpoint_url = 'https://dash.cloudflare.com/oauth2/auth',
+    transport = 'http_rest',
+    auth_type = 'oauth_via_iam',
+    oauth_connect_url = 'https://inneranimalmedia.com/api/oauth/cloudflare/start',
+    resource_scope_json = '{"owner":"account","token_authority":"inneranimalmedia_platform"}',
+    config_json = '{"oauth_client_id":"0f2f3c826d800118b70863d8d59e12cc","client_name":"Inner Animal Media Platform","client_uri":"https://inneranimalmedia.com","callback_url":"https://inneranimalmedia.com/api/oauth/cloudflare/callback","authorization_endpoint":"https://dash.cloudflare.com/oauth2/auth","token_endpoint":"https://dash.cloudflare.com/oauth2/token","token_auth_method":"client_secret_basic","secret_authority":"inneranimalmedia_platform_vault"}',
+    metadata_json = '{"execution_strategy":"host_owned","client_visibility":"public"}',
+    health_strategy = 'oauth_probe',
+    updated_at = unixepoch()
+WHERE plugin_key = 'cloudflare'
+  AND provider_key = 'cloudflare'
+  AND installation_key = 'iam-oauth'
+  AND auth_type = 'oauth_via_iam';
+
+INSERT INTO agentsam_capabilities (capability_key, domain, verb, description, is_mutating, is_active, created_at, updated_at)
+VALUES
+  ('cloudflare.api.docs', 'cloudflare', 'read', 'Search Cloudflare developer documentation.', 0, 1, unixepoch(), unixepoch()),
+  ('cloudflare.api.search', 'cloudflare', 'search', 'Search Cloudflare OpenAPI operations.', 0, 1, unixepoch(), unixepoch()),
+  ('cloudflare.api.execute', 'cloudflare', 'execute', 'Execute an approved Cloudflare API program.', 1, 1, unixepoch(), unixepoch())
+ON CONFLICT(capability_key) DO UPDATE SET
+  domain=excluded.domain, verb=excluded.verb, description=excluded.description,
+  is_mutating=excluded.is_mutating, is_active=1, updated_at=unixepoch();
+
+INSERT INTO agentsam_tools (
+  id, tool_name, display_name, tool_category, handler_type, description,
+  input_schema, handler_config, intent_tags, risk_level, requires_approval,
+  requires_confirmation, is_active, tool_key, capability_key, handler_key,
+  domain, oauth_visible, dispatch_target, connector_visible, connector_priority,
+  connector_access_class, account_id, plugin_key, plugin_id, created_at, updated_at
+)
+SELECT
+  'ast_' || lower(hex(randomblob(8))),
+  'agentsam_mcp_docs__' || p.id,
+  'Cloudflare docs', 'integrations', 'cf', 'Search Cloudflare developer documentation.',
+  '{"type":"object","properties":{"query":{"type":"string"}},"required":["query"],"additionalProperties":false}',
+  '{"server_url":"https://mcp.cloudflare.com/mcp","remote_tool":"docs"}',
+  '["cloudflare","docs","search"]', 'low', 0, 0, 1,
+  'agentsam-mcp.docs', 'cloudflare.api.docs', 'agentsam-mcp.docs',
+  'cloudflare', 1, 'mcp', 1, 50, 'read', p.account_id, p.plugin_key, p.id, unixepoch(), unixepoch()
+FROM agentsam_plugins p
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND NOT EXISTS (SELECT 1 FROM agentsam_tools t WHERE t.plugin_id = p.id AND t.tool_key = 'agentsam-mcp.docs');
+
+INSERT INTO agentsam_tools (
+  id, tool_name, display_name, tool_category, handler_type, description,
+  input_schema, handler_config, intent_tags, risk_level, requires_approval,
+  requires_confirmation, is_active, tool_key, capability_key, handler_key,
+  domain, oauth_visible, dispatch_target, connector_visible, connector_priority,
+  connector_access_class, account_id, plugin_key, plugin_id, created_at, updated_at
+)
+SELECT
+  'ast_' || lower(hex(randomblob(8))),
+  'agentsam_mcp_search__' || p.id,
+  'Search Cloudflare API', 'integrations', 'cf', 'Search Cloudflare OpenAPI operations before executing code.',
+  '{"type":"object","properties":{"query":{"type":"string"}},"required":["query"],"additionalProperties":false}',
+  '{"server_url":"https://mcp.cloudflare.com/mcp","remote_tool":"search","network":"none"}',
+  '["cloudflare","openapi","search"]', 'low', 0, 0, 1,
+  'agentsam-mcp.search', 'cloudflare.api.search', 'agentsam-mcp.search',
+  'cloudflare', 1, 'plugin', 1, 50, 'read', p.account_id, p.plugin_key, p.id, unixepoch(), unixepoch()
+FROM agentsam_plugins p
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND NOT EXISTS (SELECT 1 FROM agentsam_tools t WHERE t.plugin_id = p.id AND t.tool_key = 'agentsam-mcp.search');
+
+INSERT INTO agentsam_tools (
+  id, tool_name, display_name, tool_category, handler_type, description,
+  input_schema, handler_config, intent_tags, risk_level, requires_approval,
+  requires_confirmation, is_active, tool_key, capability_key, handler_key,
+  domain, oauth_visible, dispatch_target, connector_visible, connector_priority,
+  connector_access_class, account_id, plugin_key, plugin_id, created_at, updated_at
+)
+SELECT
+  'ast_' || lower(hex(randomblob(8))),
+  'agentsam_mcp_execute__' || p.id,
+  'Execute Cloudflare API', 'integrations', 'cf', 'Run an approved AgentSam Cloudflare API program.',
+  '{"type":"object","properties":{"code":{"type":"string"},"account_id":{"type":"string"}},"required":["code"],"additionalProperties":false}',
+  '{"server_url":"https://mcp.cloudflare.com/mcp","remote_tool":"execute","network":"cloudflare_api_only"}',
+  '["cloudflare","api","execute"]', 'high', 1, 1, 1,
+  'agentsam-mcp.execute', 'cloudflare.api.execute', 'agentsam-mcp.execute',
+  'cloudflare', 1, 'codemode', 1, 50, 'write', p.account_id, p.plugin_key, p.id, unixepoch(), unixepoch()
+FROM agentsam_plugins p
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND NOT EXISTS (SELECT 1 FROM agentsam_tools t WHERE t.plugin_id = p.id AND t.tool_key = 'agentsam-mcp.execute');
+
+INSERT INTO agentsam_tool_capabilities (tool_id, capability_key, requirement_type, is_primary, operations_json, created_at)
+SELECT t.id, t.capability_key, 'required', 1, json_array(t.handler_key), unixepoch()
+FROM agentsam_tools t
+JOIN agentsam_plugins p ON p.id = t.plugin_id
+WHERE p.plugin_key = 'agentsam-mcp' AND p.installation_key = 'local-studio-pkce'
+  AND t.tool_key IN ('agentsam-mcp.docs', 'agentsam-mcp.search', 'agentsam-mcp.execute')
+  AND NOT EXISTS (
+    SELECT 1 FROM agentsam_tool_capabilities c
+    WHERE c.tool_id = t.id AND c.capability_key = t.capability_key
+  );

package/migrations/runtime/0001_cli_runtime.sql

@@ -191,6 +191,48 @@ CREATE TABLE IF NOT EXISTS agentsam_plans (
   updated_at_unix INTEGER NOT NULL DEFAULT (unixepoch())
 );
 
+-- GOAP ticket authority. Existing hosted deployments may already own this
+-- table; these columns mirror the live contract and let fresh SDK installs
+-- create portable, repository-scoped goals without a singleton fallback.
+CREATE TABLE IF NOT EXISTS agentsam_tickets (
+  id TEXT PRIMARY KEY,
+  title TEXT NOT NULL,
+  description TEXT,
+  status TEXT NOT NULL DEFAULT 'backlog'
+    CHECK(status IN ('backlog','active','blocked','shipped','abandoned')),
+  status_reason TEXT,
+  project TEXT,
+  subsystem TEXT,
+  tags TEXT,
+  priority TEXT NOT NULL DEFAULT 'P2',
+  doc_path TEXT,
+  blocks TEXT,
+  blocked_by TEXT,
+  supersedes TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+  closed_at INTEGER,
+  dedup_key TEXT,
+  description_json TEXT,
+  surface TEXT NOT NULL DEFAULT 'platform',
+  owner_kind TEXT NOT NULL DEFAULT 'unassigned',
+  owner_ref TEXT,
+  account_id TEXT,
+  repository_id TEXT,
+  parent_ticket_id TEXT,
+  agent_run_id TEXT REFERENCES agentsam_agent_run(id) ON DELETE SET NULL,
+  worktree TEXT,
+  linked_commit TEXT,
+  source TEXT NOT NULL DEFAULT 'manual'
+);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_tickets_owner_updated
+  ON agentsam_tickets(owner_ref, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_agentsam_tickets_account_repository
+  ON agentsam_tickets(account_id, repository_id, updated_at DESC);
+CREATE INDEX IF NOT EXISTS idx_agentsam_tickets_status_priority
+  ON agentsam_tickets(status, priority, updated_at DESC);
+
 CREATE TABLE IF NOT EXISTS agentsam_todo (
   id TEXT PRIMARY KEY,
   account_id TEXT,
@@ -296,3 +338,28 @@ CREATE TABLE IF NOT EXISTS agentsam_cron_runs (
 
 CREATE INDEX IF NOT EXISTS idx_agentsam_cron_runs_job_started
   ON agentsam_cron_runs(job_name, started_at DESC);
+
+CREATE TABLE IF NOT EXISTS agentsam_workspace_state (
+  id                TEXT PRIMARY KEY DEFAULT ('wss_' || lower(hex(randomblob(8)))),
+  repository_id     TEXT UNIQUE,
+  workspace_id      TEXT,
+  conversation_id   TEXT,
+  workspace_type    TEXT NOT NULL DEFAULT 'ide',
+  active_file       TEXT,
+  files_open        TEXT NOT NULL DEFAULT '[]',
+  state_json        TEXT NOT NULL DEFAULT '{}',
+  locked_by         TEXT,
+  lock_expires_at   INTEGER,
+  lock_reason       TEXT,
+  agent_session_id  TEXT,
+  current_task_id   TEXT,
+  last_agent_action TEXT,
+  agent_id          TEXT,
+  checkpoint_label  TEXT,
+  checkpoint_sha    TEXT,
+  created_at        INTEGER NOT NULL DEFAULT (unixepoch()),
+  updated_at        INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_agentsam_workspace_state_repo
+  ON agentsam_workspace_state(repository_id);

package/migrations/runtime/0002_project_sessions.sql

@@ -0,0 +1,15 @@
+-- Resumable local ProjectSession state shares the canonical project database.
+-- Session JSON is bounded operational state, not a transcript or credential vault.
+CREATE TABLE IF NOT EXISTS agentsam_project_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  project_root TEXT NOT NULL,
+  cwd TEXT NOT NULL,
+  status TEXT NOT NULL CHECK (status IN ('active','paused','interrupted','completed')),
+  title TEXT NOT NULL DEFAULT 'Agent Sam session',
+  state_json TEXT NOT NULL,
+  lifecycle TEXT NOT NULL DEFAULT 'session' CHECK (lifecycle = 'session'),
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_agentsam_project_sessions_updated
+  ON agentsam_project_sessions(updated_at DESC);

package/migrations/runtime/0003_provider_continuations.sql

@@ -0,0 +1,8 @@
+-- Session-scoped provider continuation, separate from generic state and knowledge.
+-- Replaced by each compaction and deleted after a successful provider continuation.
+CREATE TABLE IF NOT EXISTS agentsam_provider_continuations (
+  session_id TEXT PRIMARY KEY REFERENCES agentsam_project_sessions(id) ON DELETE CASCADE,
+  provider TEXT NOT NULL,
+  output_json TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "description": "Portable AgentSam SDK and CLI kits for local scaffolding, repository intelligence, incremental indexing, identity adapters, and verified dependency maintenance.",
   "type": "module",
   "main": "./src/index.js",
@@ -14,6 +14,7 @@
     "./merkle": "./packages/agentsam-repository/src/merkle/index.js",
     "./deploy-receipt": "./src/lib/deploy-receipt/index.js",
     "./knowledge": "./src/knowledge/index.js",
+    "./autorag": "./packages/agentsam-knowledge/src/autorag/index.js",
     "./knowledge-service-client": "./src/knowledge/service/client.js",
     "./knowledge-service-grpc-client": "./src/knowledge/service/grpc-client.js",
     "./capabilities": "./src/capabilities/index.js",
@@ -26,11 +27,14 @@
     "./agent": "./src/agent/index.js",
     "./presets": "./src/presets/index.js",
     "./preset-catalog": "./protocol/presets/catalog.json",
+    "./brand": "./packages/agentsam-brand/src/index.js",
+    "./progression": "./src/progression/index.js",
     "./identity": "./packages/identity/src/index.js",
     "./identity/providers": "./packages/identity/src/providers/index.js",
     "./identity/providers/google": "./packages/identity/src/providers/google/index.js",
     "./identity/providers/github": "./packages/identity/src/providers/github/index.js",
     "./identity/providers/iam": "./packages/identity/src/providers/iam/index.js",
+    "./identity/providers/cloudflare": "./packages/identity/src/providers/cloudflare/index.js",
     "./identity/providers/gcp": "./packages/identity/src/providers/gcp/index.js",
     "./identity/providers/email": "./packages/identity/src/providers/email/index.js",
     "./identity/contracts/identity": "./packages/identity/src/contracts/identity.js",
@@ -55,17 +59,38 @@
     "./context": "./src/context/index.js",
     "./indexing": "./src/indexing/index.js",
     "./tools": "./src/tools/index.js",
+    "./plugins": "./src/plugins/index.js",
     "./models": "./src/models/index.js",
     "./telemetry": "./src/telemetry/index.js",
     "./providers": "./src/providers/index.js",
+    "./work-graph": "./packages/work-graph/src/index.js",
+    "./queue-control": "./packages/agentsam-queue-control/src/index.js",
+    "./work-graph/renderers/timeline": "./packages/work-graph/src/renderers/timeline.js",
+    "./work-graph/renderers/gantt-model": "./packages/work-graph/src/renderers/gantt-model.js",
+    "./work-graph/adapters/engineering/git": "./packages/work-graph/src/adapters/engineering/git.js",
+    "./work-graph/adapters/engineering/mcp": "./packages/work-graph/src/adapters/engineering/mcp.js",
+    "./work-graph/adapters/business/projects": "./packages/work-graph/src/adapters/business/projects.js",
     "./errors": "./src/errors/index.js",
+    "./errors/schema": "./protocol/errors/error-envelope.schema.json",
+    "./errors/catalog": "./protocol/errors/error-catalog.json",
     "./cloudflare": "./src/cloudflare/index.js",
     "./eval": "./src/eval/index.js",
+    "./mcp": "./src/mcp/index.js",
     "./context/result-policy-schema": "./protocol/context/result-policy.schema.json",
     "./context/budget-schema": "./protocol/context/context-budget.schema.json",
     "./context/pack-schema": "./protocol/context/resolved-context-pack.schema.json",
     "./skills": "./src/skills/index.js",
-    "./skills/catalog": "./skills/catalog.json"
+    "./skills/catalog": "./skills/catalog.json",
+    "./cad-project": "./src/lib/cad/project-cli.js",
+    "./providers/completeful": "./packages/providers/completeful/src/index.js",
+    "./theme/heuristic": "./packages/heuristic-theme/src/index.js",
+    "./theme/church-site": "./packages/theme-church-site/src/index.js",
+    "./theme/companions-site": "./packages/theme-companions-site/src/index.js",
+    "./theme/floors-site": "./packages/theme-floors-site/src/index.js",
+    "./theme/fuelnfree-site": "./packages/theme-fuelnfree-site/src/index.js",
+    "./theme/handyman-site": "./packages/theme-handyman-site/src/index.js",
+    "./theme/insurance-site": "./packages/theme-insurance-site/src/index.js",
+    "./theme/shinshu-site": "./packages/theme-shinshu-site/src/index.js"
   },
   "bin": {
     "agentsam": "bin/agentsam",
@@ -76,8 +101,18 @@
   "files": [
     "src",
     "packages/identity",
+    "packages/agentsam-brand",
+    "packages/agentsam-contracts",
+    "packages/agentsam-errors",
     "packages/agentsam-repository",
+    "packages/agentsam-knowledge",
+    "packages/agentsam-nav/package.json",
+    "packages/agentsam-nav/README.md",
+    "packages/agentsam-nav/dist",
+    "packages/work-graph",
+    "packages/agentsam-queue-control",
     "packages/connectors/cloudflare",
+    "packages/providers/completeful",
     "templates",
     "docs",
     "examples",
@@ -94,17 +129,43 @@
     "README.md",
     "LICENSE",
     "DEVELOPMENT.md",
-    "AGENTSAM.md"
+    "AGENTSAM.md",
+    "apps/cad-creator/shared/cad",
+    "packages/heuristic-theme",
+    "packages/theme-church-site",
+    "packages/theme-companions-site",
+    "packages/theme-floors-site",
+    "packages/theme-fuelnfree-site",
+    "packages/theme-handyman-site",
+    "packages/theme-insurance-site",
+    "packages/theme-shinshu-site"
   ],
   "workspaces": [
     "packages/agentsam-shell-kit",
     "packages/identity",
+    "packages/agentsam-brand",
     "packages/agentsam-contracts",
+    "packages/agentsam-errors",
     "packages/agentsam-repository",
-    "packages/agentsam-workbench"
+    "packages/agentsam-knowledge",
+    "packages/agentsam-nav",
+    "packages/work-graph",
+    "packages/agentsam-queue-control",
+    "packages/agentsam-workbench",
+    "packages/providers/completeful",
+    "packages/agentsam-desktop-shell",
+    "packages/heuristic-theme",
+    "packages/theme-church-site",
+    "packages/theme-companions-site",
+    "packages/theme-floors-site",
+    "packages/theme-fuelnfree-site",
+    "packages/theme-handyman-site",
+    "packages/theme-insurance-site",
+    "packages/theme-shinshu-site"
   ],
   "scripts": {
-    "test": "npm run test:standard && npm --prefix packages/identity test && npm run test:connectors",
+    "test": "npm run test:standard && npm --prefix packages/identity test && npm --prefix packages/agentsam-brand test && npm run test:connectors && npm run test:providers",
+    "test:brand": "npm --prefix packages/agentsam-brand test",
     "test:standard": "node test/smoke.mjs && npm run test:unit && npm run test:cli && npm run test:integration:mock && npm run test:terminal:mock",
     "test:unit": "node --test test/*.test.mjs",
     "test:cli": "node --test test/cli/*.test.mjs",
@@ -112,28 +173,38 @@
     "test:terminal:mock": "node --test test/terminal/*.test.mjs",
     "test:live:terminal": "node --test test/live/*.live.test.mjs",
     "test:identity": "npm --prefix packages/identity test",
-    "test:workspaces": "npm --prefix packages/agentsam-contracts test && npm --prefix packages/agentsam-contracts run typecheck && npm --prefix packages/agentsam-repository test && npm --prefix packages/agentsam-workbench test && npm --prefix packages/agentsam-workbench run typecheck && npm --prefix packages/agentsam-shell-kit run typecheck",
+    "test:workspaces": "npm --prefix packages/agentsam-contracts test && npm --prefix packages/agentsam-contracts run typecheck && npm --prefix packages/agentsam-errors test && npm --prefix packages/agentsam-repository test && npm --prefix packages/agentsam-workbench test && npm --prefix packages/agentsam-workbench run typecheck && npm --prefix packages/agentsam-nav run typecheck && npm --prefix packages/agentsam-shell-kit run typecheck && npm --prefix packages/work-graph test && npm --prefix packages/agentsam-queue-control test",
+    "test:autorag": "npm --prefix packages/agentsam-knowledge test",
     "smoke": "node test/smoke.mjs",
     "verify:package": "node scripts/verify-package.mjs",
     "verify:boundaries": "node scripts/verify-source-boundaries.mjs",
     "verify:bootstrap": "node scripts/verify-bootstrap.mjs",
-    "verify:knowledge-package": "node scripts/verify-knowledge-package.mjs",
+    "verify:knowledge-package": "node scripts/verify-knowledge-package.mjs && npm run test:autorag",
     "test:python": "node scripts/verify-python.mjs",
     "verify:release": "npm run verify && npm run verify:knowledge-package && npm run test:python && npm run security:check",
-    "pack:check": "npm pack --dry-run --json",
-    "verify": "npm run proto:check && npm test && npm run test:workspaces && npm run verify:boundaries && npm run verify:package && npm run verify:bootstrap && npm run pack:check",
+    "pack:check": "node scripts/verify-pack.mjs",
+    "verify": "npm run errors:check && npm run proto:check && npm test && npm run test:workspaces && npm run cad:registry:check && npm run verify:boundaries && npm run verify:package && npm run verify:bootstrap && npm run pack:check",
     "publish:identity-alpha": "bash scripts/publish-identity-alpha.sh",
     "publish:identity-alpha:dry-run": "bash scripts/publish-identity-alpha.sh --dry-run",
     "publish:identity-alpha:publish-only": "bash scripts/publish-identity-alpha.sh --publish-only",
     "preview:auth-portal": "node packages/identity/scripts/preview-auth-portal.mjs --open",
-    "prepublishOnly": "npm run verify:release",
+    "prepublishOnly": "npm run site:sync && npm run verify:release",
+    "site:sync": "node scripts/sync-public-site.mjs",
+    "site:learn": "node scripts/build-learn-site.mjs",
+    "site:publish": "node scripts/publish-website-assets.mjs",
     "security:check": "node src/security/cli.mjs scan",
     "security:repair": "node src/security/cli.mjs repair",
     "ui:preview": "node scripts/ui-preview.mjs",
     "test:connectors": "node --test packages/connectors/cloudflare/tests/**/*.test.mjs",
     "verify:npm10-lock": "node apps/local-studio/scripts/verify-npm10-lock.mjs",
     "proto:generate": "node scripts/generate-proto.mjs",
-    "proto:check": "node scripts/verify-proto.mjs"
+    "proto:check": "node scripts/verify-proto.mjs",
+    "errors:generate": "node scripts/generate-error-contracts.mjs",
+    "errors:check": "node scripts/verify-error-contracts.mjs",
+    "cad:registry:check": "node scripts/cad-registry.mjs --check",
+    "test:providers": "node --test packages/providers/completeful/test/*.test.mjs",
+    "test:themes": "npm --prefix packages/heuristic-theme test && npm --prefix packages/theme-church-site test && npm --prefix packages/theme-companions-site test && npm --prefix packages/theme-floors-site test && npm --prefix packages/theme-fuelnfree-site test && npm --prefix packages/theme-handyman-site test && npm --prefix packages/theme-insurance-site test && npm --prefix packages/theme-shinshu-site test",
+    "theme:harvest": "python3 scripts/theme-refinery/harvest.py"
   },
   "engines": {
     "node": ">=22 <25",
@@ -142,11 +213,13 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@grpc/grpc-js": "^1.14.4",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "google-protobuf": "^3.21.4",
     "node-pty": "^1.0.0",
     "pg": "8.16.3",
     "picocolors": "^1.1.1",
     "typescript": "5.9.3",
+    "wrangler": "4.137.0",
     "ws": "^8.18.0"
   },
   "publishConfig": {
@@ -172,9 +245,16 @@
   },
   "homepage": "https://github.com/SamPrimeaux/agentsam-sdk#readme",
   "allowScripts": {
-    "node-pty@1.1.0": true
+    "node-pty@1.1.0": true,
+    "grpc-tools@1.13.1": true,
+    "protobufjs@7.6.6": true,
+    "esbuild@0.28.1": true,
+    "fsevents@2.3.3": true,
+    "workerd@1.20260921.1": true
   },
   "devDependencies": {
+    "@changesets/changelog-github": "^1.0.1",
+    "@changesets/cli": "^3.0.3",
     "@electric-sql/pglite": "0.5.8",
     "@electric-sql/pglite-pgvector": "0.0.9",
     "grpc-tools": "^1.13.1"

package/packages/agentsam-brand/README.md

@@ -0,0 +1,21 @@
+# @inneranimalmedia/agentsam-sdk-brand
+
+Deterministic **Brand Intelligence** for AgentSam.
+
+```text
+repository.snapshot  →  brand.scan  →  brand.resolve  →  brand.plan  →  (apply/verify)
+```
+
+- **Brand ≠ Theme.** Theme is a projection; Brand is authority.
+- **No LLM required** for scan/resolve/plan skeleton.
+- **Same file authority** as security/knowledge (Merkle + gitignore via snapshot).
+- States stay separated: `observed` → `inferred` → `declared` → `resolved`.
+
+```bash
+agentsam brand scan --json
+agentsam brand resolve
+agentsam plan brand --goap
+agentsam brand --write   # writes .agentsam/brand/{evidence,resolved,contract}.json
+```
+
+Progression (generic, not brand-only): `@inneranimalmedia/agentsam-sdk/progression`

package/packages/agentsam-brand/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@inneranimalmedia/agentsam-sdk-brand",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "description": "Deterministic Brand Intelligence for AgentSam — scan/resolve/contract evidence on shared repository.snapshot authority",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./scan": "./src/scan.js",
+    "./resolve": "./src/resolve.js",
+    "./contract": "./src/contract.js",
+    "./plan": "./src/plan.js",
+    "./goap-actions": "./src/goap-actions.js"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "engines": {
+    "node": ">=22 <25"
+  }
+}

package/packages/agentsam-brand/src/contract.js

@@ -0,0 +1,59 @@
+/**
+ * Draft Brand Contract from scan + resolve (observed/inferred; declared empty until user answers).
+ */
+export function buildBrandContractDraft({ scan, resolved, brandId = 'brand:inferred' } = {}) {
+  if (!scan || scan.capability !== 'brand.scan') throw new Error('contract_requires_scan');
+  if (!resolved || resolved.capability !== 'brand.resolve') throw new Error('contract_requires_resolve');
+
+  return {
+    schema: 'agentsam.contract/v1',
+    kind: 'brand',
+    id: brandId,
+    version: '0.1.0',
+    status: 'draft',
+    extends: [],
+    origin: {
+      mode: 'inferred',
+      repository_snapshot: scan.repository?.snapshot_id || null,
+      scan_content_hash: scan.content_hash,
+      resolve_from: resolved.scan_content_hash,
+    },
+    confidence: resolved.confidence,
+    preservation: resolved.preservation,
+    visual_system: {
+      colors: {
+        observed: resolved.observed.colors,
+        inferred: resolved.inferred.colors,
+        declared: resolved.declared,
+        resolved: resolved.resolved.colors,
+      },
+      typography: {
+        observed: resolved.observed.typography,
+        inferred: resolved.inferred.typography,
+      },
+    },
+    components: {
+      patterns: scan.patterns,
+      inventory: Object.keys(scan.components || {}),
+    },
+    assets: scan.assets,
+    ambiguities: resolved.ambiguities,
+    metadata: {
+      generated_by: 'brand.scan+brand.resolve',
+      deterministic: true,
+    },
+  };
+}
+
+export function writeBrandArtifacts(rootFs, rootPath, { evidence, resolved, contract }) {
+  const path = rootFs.path || null;
+  // caller passes node:fs + path — keep pure write helper
+  const fs = rootFs.fs || rootFs;
+  const join = rootFs.join || ((...parts) => parts.join('/'));
+  const dir = join(rootPath, '.agentsam', 'brand');
+  fs.mkdirSync(dir, { recursive: true });
+  if (evidence) fs.writeFileSync(join(dir, 'evidence.json'), `${JSON.stringify(evidence, null, 2)}\n`);
+  if (resolved) fs.writeFileSync(join(dir, 'resolved.json'), `${JSON.stringify(resolved, null, 2)}\n`);
+  if (contract) fs.writeFileSync(join(dir, 'contract.json'), `${JSON.stringify(contract, null, 2)}\n`);
+  return { dir, files: ['evidence.json', 'resolved.json', 'contract.json'].filter(Boolean) };
+}