@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.3

package/src/features/resolve.js

@@ -0,0 +1,242 @@
+/**
+ * Resolve `.agentsam/features.json` selections against package-local feature
+ * packets (via protocol/features/catalog.json discovery). Protocol holds only
+ * the generic capsule contract + catalog — not identity/provider detail trees.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SDK_ROOT = path.resolve(HERE, '../..');
+const PROTOCOL_ROOT = path.join(SDK_ROOT, 'protocol');
+const OAUTH_PORTAL_DIR = path.join(
+  SDK_ROOT,
+  'packages/identity/.agentsam/features/oauth-login-portal',
+);
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function safeReadJson(filePath) {
+  if (!fs.existsSync(filePath)) return null;
+  return readJson(filePath);
+}
+
+export function protocolRoot(options = {}) {
+  return options.protocolRoot || PROTOCOL_ROOT;
+}
+
+export function oauthPortalDir(options = {}) {
+  return options.oauthPortalDir || OAUTH_PORTAL_DIR;
+}
+
+/** Canonical provider template ids. Legacy `iam` normalizes to `inneranimalmedia`. */
+export function normalizeProviderTemplateId(id) {
+  const key = String(id || '').trim().toLowerCase();
+  if (!key) return '';
+  if (key === 'iam') return 'inneranimalmedia';
+  return key;
+}
+
+export function loadFeatureCatalog(options = {}) {
+  return safeReadJson(path.join(protocolRoot(options), 'features', 'catalog.json'));
+}
+
+/** Load a feature capsule by id via catalog discovery, or absolute/relative manifest path. */
+export function loadFeatureManifest(featureId, options = {}) {
+  const catalog = loadFeatureCatalog(options);
+  const entry = (catalog?.features || []).find((row) => row.id === featureId);
+  if (!entry?.manifest) return null;
+  const manifestPath = path.isAbsolute(entry.manifest)
+    ? entry.manifest
+    : path.join(SDK_ROOT, entry.manifest);
+  return safeReadJson(manifestPath);
+}
+
+export function loadOAuthLoginPortalFeature(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'agentsam.feature.json'));
+}
+
+export function loadIdentityProviders(options = {}) {
+  const doc = safeReadJson(path.join(oauthPortalDir(options), 'providers.json'));
+  return doc?.providers || [];
+}
+
+export function getIdentityProviderTemplate(id, options = {}) {
+  const key = normalizeProviderTemplateId(id);
+  const providers = loadIdentityProviders(options);
+  return (
+    providers.find((row) => row.id === key) ||
+    providers.find((row) => Array.isArray(row.aliases) && row.aliases.includes(String(id || '').trim().toLowerCase())) ||
+    null
+  );
+}
+
+export function loadIdentityResources(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'resources.json'));
+}
+
+export function loadIdentityRoutes(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'routes.json'));
+}
+
+export function loadIdentityUi(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'ui.json'));
+}
+
+/** Compact summary for CLI status lines — real tables + migrations, no fake profile ids. */
+export function formatResourcesSummary(resources) {
+  if (!resources) return 'resources=(missing)';
+  const tables = (resources.tables || []).map((t) => t.name).filter(Boolean);
+  const migrations = resources.migration_sources || [];
+  const engine = resources.engine || 'unknown';
+  return `engine=${engine} tables=${tables.join(',') || '(none)'} migrations=${migrations.join(',') || '(none)'}`;
+}
+
+/**
+ * `agentsam identity schema` — print the package resources packet (migration SSOT).
+ * Optional id filters: d1 | identity | oauth-login-portal | (empty = default packet).
+ */
+export function loadSchemaProfile(id, options = {}) {
+  const key = String(id || '').trim().toLowerCase();
+  if (key === 'better-auth-postgres') {
+    return {
+      id: 'better-auth-postgres',
+      engine: 'postgres',
+      note: 'Owned by apps/local-studio — not part of packages/identity feature packet.',
+      source: 'apps/local-studio/backend/migrations/auth/0001_auth.sql',
+      tables: [],
+      migration_sources: ['apps/local-studio/backend/migrations/auth/0001_auth.sql'],
+    };
+  }
+  if (key && !['d1', 'identity', 'oauth-login-portal', 'resources', ''].includes(key)) {
+    return null;
+  }
+  return loadIdentityResources(options);
+}
+
+export function listSchemaProfiles(options = {}) {
+  const resources = loadIdentityResources(options);
+  const rows = [];
+  if (resources) rows.push(resources);
+  const studio = loadSchemaProfile('better-auth-postgres', options);
+  if (studio) rows.push(studio);
+  return rows;
+}
+
+export function featureStatePath(cwd) {
+  return path.join(cwd, '.agentsam', 'features.json');
+}
+
+export function featuresResolvedPath(cwd) {
+  return path.join(cwd, 'generated', '.agentsam', 'features-resolved.json');
+}
+
+export function readFeatureSelections(cwd) {
+  const file = featureStatePath(cwd);
+  if (!fs.existsSync(file)) {
+    return { schema_version: 2, features: {} };
+  }
+  const state = readJson(file);
+  return {
+    schema_version: Number(state.schema_version) || 1,
+    features: state.features && typeof state.features === 'object' ? state.features : {},
+  };
+}
+
+/**
+ * Resolve auth / identity.oauth-login-portal selection against the package packet.
+ * Resources come from resources.json (real tables + migration_sources) — not a pretend profile id.
+ */
+export function resolveAuthFeature(selection = {}, options = {}) {
+  const feature = loadOAuthLoginPortalFeature(options);
+  if (!feature) throw new Error('identity_oauth_login_portal_feature_missing');
+
+  const catalog = safeReadJson(path.join(oauthPortalDir(options), 'providers.json'));
+  const providerId = normalizeProviderTemplateId(
+    selection.provider_template ||
+    catalog?.default_provider ||
+    'inneranimalmedia',
+  );
+  const provider = getIdentityProviderTemplate(providerId, options);
+  if (!provider) throw new Error(`unknown_provider_template:${providerId}`);
+
+  const resources = loadIdentityResources(options);
+  if (!resources) throw new Error('identity_resources_missing');
+
+  return {
+    id: feature.id,
+    selected: selection.selected !== false,
+    capabilities: selection.capabilities || feature.provides || [],
+    provider_template: providerId,
+    selected_at: selection.selected_at || null,
+    feature: {
+      id: feature.id,
+      name: feature.name,
+      artifacts: feature.artifacts || [],
+      provides: feature.provides || [],
+    },
+    provider,
+    /** Actual portable Identity D1 resources — migration files remain SSOT. */
+    resources,
+    routes: loadIdentityRoutes(options),
+    ui: loadIdentityUi(options),
+  };
+}
+
+export function resolveFeatures(cwd, options = {}) {
+  const selections = options.selections || readFeatureSelections(cwd);
+  const resolved = {
+    schema: 'agentsam.features.resolved.v1',
+    schema_version: 2,
+    generated_at: new Date().toISOString(),
+    cwd: path.resolve(cwd),
+    selections: selections.features,
+    features: {},
+  };
+
+  for (const [id, selection] of Object.entries(selections.features || {})) {
+    if (!selection || selection.selected === false) continue;
+    if (id === 'auth' || id === 'identity.oauth-login-portal') {
+      resolved.features[id] = resolveAuthFeature(selection, options);
+    } else {
+      resolved.features[id] = {
+        id,
+        selected: true,
+        capabilities: selection.capabilities || [],
+        selected_at: selection.selected_at || null,
+        protocol: null,
+      };
+    }
+  }
+
+  return resolved;
+}
+
+export function writeFeaturesResolved(cwd, resolved = null, options = {}) {
+  const snapshot = resolved || resolveFeatures(cwd, options);
+  const outPath = featuresResolvedPath(cwd);
+  fs.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs.writeFileSync(outPath, `${JSON.stringify(snapshot, null, 2)}\n`, 'utf8');
+  return { path: outPath, snapshot };
+}
+
+export function writeFeatureSelections(cwd, state) {
+  const next = {
+    schema_version: 2,
+    features: state.features || {},
+  };
+  const file = featureStatePath(cwd);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
+  const { path: resolvedPath, snapshot } = writeFeaturesResolved(cwd, null, { selections: next });
+  return { state_path: file, resolved_path: resolvedPath, snapshot };
+}
+
+/** Back-compat alias used by older call sites */
+export function loadAuthFeature(options = {}) {
+  return loadOAuthLoginPortalFeature(options);
+}

package/src/go/build.js

@@ -0,0 +1,108 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { gitEvidence } from '../knowledge/config.js';
+import { writeGoBuildReceipt } from './receipts.js';
+
+export function runGoTests(runtimeRoot, { spawn = spawnSync } = {}) {
+  const res = spawn('go', ['test', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
+  return {
+    ok: res.status === 0,
+    status: res.status,
+    stdout: res.stdout || '',
+    stderr: res.stderr || '',
+  };
+}
+
+export function runGoVet(runtimeRoot, { spawn = spawnSync } = {}) {
+  const res = spawn('go', ['vet', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
+  return {
+    ok: res.status === 0,
+    status: res.status,
+    stdout: res.stdout || '',
+    stderr: res.stderr || '',
+  };
+}
+
+export function runGoBuild(runtimeRoot, { outDir = null, spawn = spawnSync } = {}) {
+  const binDir = outDir || path.join(runtimeRoot, '..', '.agentsam', 'go-build');
+  fs.mkdirSync(binDir, { recursive: true });
+  const out = path.join(binDir, 'agentsam-go-worker');
+  const res = spawn('go', ['build', '-o', out, './cmd/server'], { cwd: runtimeRoot, encoding: 'utf8' });
+  return {
+    ok: res.status === 0,
+    status: res.status,
+    binary: res.status === 0 ? out : null,
+    stdout: res.stdout || '',
+    stderr: res.stderr || '',
+  };
+}
+
+/**
+ * Build + test the discovered Go runtime and emit a build receipt.
+ */
+export function buildGoProduct({ productRoot, runtimeRoot, repositoryRoot, dryRun = false } = {}) {
+  if (!runtimeRoot || !fs.existsSync(path.join(runtimeRoot, 'go.mod'))) {
+    throw new Error('go_runtime_missing');
+  }
+  const tests = dryRun ? { ok: true, skipped: true } : runGoTests(runtimeRoot);
+  if (!tests.ok) {
+    const err = new Error('go_test_failed');
+    err.detail = tests;
+    throw err;
+  }
+  const vet = dryRun ? { ok: true, skipped: true } : runGoVet(runtimeRoot);
+  if (!vet.ok) {
+    const err = new Error('go_vet_failed');
+    err.detail = vet;
+    throw err;
+  }
+  const build = dryRun ? { ok: true, skipped: true, binary: null } : runGoBuild(runtimeRoot);
+  if (!build.ok) {
+    const err = new Error('go_build_failed');
+    err.detail = build;
+    throw err;
+  }
+
+  const git = gitEvidence(repositoryRoot || productRoot);
+  let goVersion = null;
+  try {
+    goVersion = spawnSync('go', ['env', 'GOVERSION'], { encoding: 'utf8' }).stdout?.trim() || null;
+  } catch {
+    goVersion = null;
+  }
+
+  const receipt = {
+    schema: 'agentsam.go-build-receipt.v1',
+    product: path.basename(productRoot),
+    runtime: {
+      language: 'go',
+      version: goVersion,
+      module_root: runtimeRoot,
+    },
+    source: {
+      repository_id: path.basename(repositoryRoot || productRoot),
+      commit: git.commit,
+      branch: git.branch,
+      dirty: git.dirty,
+    },
+    artifact: {
+      type: build.binary ? 'binary' : 'none',
+      path: build.binary,
+      digest: null,
+    },
+    tests: {
+      go_test: Boolean(tests.ok),
+      go_vet: Boolean(vet.ok),
+      runtime_probe: false,
+    },
+    target: {
+      provider: 'local',
+      kind: 'build',
+    },
+    built_at: new Date().toISOString(),
+  };
+
+  const receiptPath = writeGoBuildReceipt(productRoot, receipt);
+  return { receipt, receiptPath, tests, vet, build };
+}

package/src/go/cloudflare.js

@@ -0,0 +1,207 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { parseWranglerVersionId } from '../lib/deploy/health.js';
+import { writeDeploymentReceipt, writeProductRegistryLocal, buildProductRow } from './receipts.js';
+import { applyGoProductRegistry } from './registry.js';
+import { gitEvidence } from '../knowledge/config.js';
+import { SDK_ROOT } from './discover.js';
+
+function resolveWranglerInvocation(productRoot) {
+  const js = path.join(productRoot, 'node_modules', 'wrangler', 'bin', 'wrangler.js');
+  if (fs.existsSync(js)) return { command: process.execPath, args: [js] };
+  const bin = path.join(productRoot, 'node_modules', '.bin', 'wrangler');
+  if (fs.existsSync(bin)) return { command: bin, args: [] };
+  return { command: 'npx', args: ['--yes', 'wrangler'] };
+}
+
+/**
+ * Cloudflare adapter for Go products.
+ * Owns Wrangler invocation + live probes. Does not own the Go build itself.
+ */
+export async function deployGoCloudflare({
+  productRoot,
+  product = 'agentsam-go-worker',
+  dryRun = false,
+  skipDeploy = false,
+  skipRegistry = false,
+  spawn = spawnSync,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const wranglerConfig = path.join(productRoot, 'wrangler.jsonc');
+  if (!fs.existsSync(wranglerConfig)) throw new Error(`wrangler_config_missing: ${wranglerConfig}`);
+
+  const docker = spawn('docker', ['info'], { encoding: 'utf8' });
+  const dockerOk = docker.status === 0;
+  if (!dockerOk && !dryRun && !skipDeploy) {
+    const err = new Error('docker_unavailable');
+    err.detail = (docker.stderr || docker.stdout || '').trim().slice(0, 400);
+    err.hint = 'Cloudflare Containers require a local container engine for image build. Start Docker Desktop or pass --skip-deploy / --dry-run.';
+    throw err;
+  }
+
+  const wrangler = resolveWranglerInvocation(productRoot);
+  let deployOutput = '';
+  let versionId = null;
+  let deployed = false;
+
+  if (dryRun || skipDeploy) {
+    deployOutput = dryRun ? 'dry_run' : 'skip_deploy';
+  } else {
+    const res = spawn(wrangler.command, wrangler.args.concat(['deploy', '-c', 'wrangler.jsonc']), {
+      cwd: productRoot,
+      encoding: 'utf8',
+      env: { ...process.env },
+    });
+    deployOutput = `${res.stdout || ''}\n${res.stderr || ''}`.trim();
+    if (res.status !== 0) {
+      const err = new Error('wrangler_deploy_failed');
+      err.detail = deployOutput.slice(0, 2000);
+      throw err;
+    }
+    versionId = parseWranglerVersionId(deployOutput);
+    deployed = true;
+  }
+
+  const url = extractWorkersDevUrl(deployOutput) || guessWorkersDevUrl(product);
+  const probes = url && !dryRun && !skipDeploy
+    ? await probeGoDeployment(url, { fetchImpl })
+    : { skipped: true, ok: Boolean(dryRun || skipDeploy), results: {} };
+
+  const git = gitEvidence(path.resolve(productRoot, '../..'));
+  const health = probes.skipped
+    ? 'pending'
+    : (probes.ok ? 'healthy' : (deployed ? 'degraded' : 'pending'));
+  const receipt = {
+    product,
+    provider: 'cloudflare',
+    kind: 'worker-container',
+    url,
+    health,
+    artifact_digest: null,
+    worker_version_id: versionId,
+    deployed_at: new Date().toISOString(),
+    source_commit: git.commit,
+    probes,
+    dry_run: Boolean(dryRun),
+    skipped_deploy: Boolean(skipDeploy),
+  };
+
+  const receiptPath = writeDeploymentReceipt(productRoot, receipt);
+  const productRow = buildProductRow({
+    product,
+    repositoryId: 'github:samprimeaux/agentsam-sdk',
+    commit: git.commit,
+    url,
+    health,
+  });
+  const productPath = writeProductRegistryLocal(productRoot, productRow);
+
+  const registryStatus = health === 'healthy' ? 'wired' : (deployed ? 'scaffolded' : 'prototype');
+  const registry = applyGoProductRegistry({
+    productRoot,
+    product,
+    cwd: SDK_ROOT,
+    status: registryStatus,
+    url,
+    commit: git.commit,
+    health,
+    dryRun,
+    skipRemote: skipRegistry || skipDeploy,
+    spawn,
+  });
+
+  return {
+    deployed,
+    url,
+    versionId,
+    probes,
+    receipt,
+    receiptPath,
+    productPath,
+    productRow,
+    registry,
+    dockerOk,
+  };
+}
+
+export function extractWorkersDevUrl(output = '') {
+  const m = String(output).match(/https:\/\/[a-z0-9.-]+\.workers\.dev[^\s]*/i);
+  return m ? m[0].replace(/[).,]+$/, '') : null;
+}
+
+export function guessWorkersDevUrl(product) {
+  const account = process.env.CLOUDFLARE_ACCOUNT_SUBDOMAIN || process.env.CF_SUBDOMAIN || '';
+  if (!account) return null;
+  return `https://${product}.${account}.workers.dev`;
+}
+
+export async function probeGoDeployment(origin, { fetchImpl = globalThis.fetch } = {}) {
+  const base = String(origin).replace(/\/+$/, '');
+  const results = {};
+
+  async function get(pathname) {
+    const url = `${base}${pathname}`;
+    try {
+      const res = await fetchImpl(url, { headers: { Accept: 'application/json' } });
+      let body = null;
+      try { body = await res.json(); } catch { body = null; }
+      results[pathname] = { status: res.status, ok: res.status >= 200 && res.status < 300, body };
+      return { res, body };
+    } catch (error) {
+      results[pathname] = { status: 0, ok: false, error: error.message };
+      return { res: null, body: null };
+    }
+  }
+
+  async function post(pathname, payload) {
+    const url = `${base}${pathname}`;
+    try {
+      const res = await fetchImpl(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+        body: JSON.stringify(payload),
+      });
+      let body = null;
+      try { body = await res.json(); } catch { body = null; }
+      results[pathname] = { status: res.status, ok: res.status >= 200 && res.status < 300, body };
+      return { res, body };
+    } catch (error) {
+      results[pathname] = { status: 0, ok: false, error: error.message };
+      return { res: null, body: null };
+    }
+  }
+
+  await get('/health');
+  await get('/v1/runtime');
+  const hash = await post('/v1/hash', { input: 'agentsam', algorithm: 'sha256' });
+  const inspect = await post('/v1/inspect', {
+    files: [{ path: 'demo.css', content: '.button { color: #2563eb; }' }],
+  });
+  // Probe malformed separately so it does not overwrite the successful /v1/inspect result.
+  let malformed;
+  try {
+    const res = await fetchImpl(`${base}/v1/inspect`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify({ not_files: true }),
+    });
+    malformed = { res, body: null };
+    try { malformed.body = await res.json(); } catch { /* ignore */ }
+  } catch (error) {
+    malformed = { res: null, body: null, error: error.message };
+  }
+
+  const hashOk = Boolean(hash.body?.hash && String(hash.body.hash).length === 64);
+  const inspectOk = Array.isArray(inspect.body?.findings)
+    && inspect.body.findings.some((f) => f.kind === 'hardcoded_color' && f.value === '#2563eb');
+  const malformedOk = Boolean(malformed.res && malformed.res.status >= 400);
+
+  results['deterministic_hash'] = { ok: hashOk };
+  results['deterministic_inspect'] = { ok: inspectOk };
+  results['malformed_rejected'] = { ok: malformedOk };
+
+  const required = ['/health', '/v1/runtime', 'deterministic_hash', 'deterministic_inspect', 'malformed_rejected'];
+  const ok = required.every((key) => results[key]?.ok);
+  return { origin: base, ok, results };
+}

package/src/go/contract.js

@@ -0,0 +1,139 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { DEFAULT_PRODUCT } from './discover.js';
+
+const PACKAGE_TEMPLATE = {
+  schema: 'agentsam.package.v1',
+  name: DEFAULT_PRODUCT,
+  type: 'service',
+  runtime: 'go',
+  version: '0.1.0',
+  targets: ['cloudflare-worker', 'cloudflare-container', 'local'],
+  entrypoints: {
+    server: './runtime/cmd/server',
+    worker: './worker/src/index.js',
+  },
+  capabilities: ['hash', 'inspect', 'runtime', 'capabilities'],
+  deployment: {
+    adapter: 'cloudflare',
+    mode: 'worker-container',
+    wrangler_config: './wrangler.jsonc',
+  },
+  product: {
+    slug: DEFAULT_PRODUCT,
+    kind: 'service',
+    registry: 'agentsam_products',
+  },
+};
+
+/**
+ * Ensure product adapter files exist. Never scaffolds a second product directory.
+ * Returns { created: string[], updated: string[], existing: true }.
+ */
+export function ensureProductContract(productRoot, { overwrite = false } = {}) {
+  const created = [];
+  const updated = [];
+  const manifestPath = path.join(productRoot, 'agentsam.package.json');
+
+  if (!fs.existsSync(productRoot)) {
+    throw new Error(`product_root_missing: ${productRoot} — seed apps/${DEFAULT_PRODUCT} first; do not invent a sibling product`);
+  }
+
+  if (!fs.existsSync(manifestPath)) {
+    fs.writeFileSync(manifestPath, `${JSON.stringify(PACKAGE_TEMPLATE, null, 2)}\n`);
+    created.push(rel(productRoot, manifestPath));
+  } else if (overwrite) {
+    const current = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    const merged = { ...PACKAGE_TEMPLATE, ...current, name: DEFAULT_PRODUCT };
+    fs.writeFileSync(manifestPath, `${JSON.stringify(merged, null, 2)}\n`);
+    updated.push(rel(productRoot, manifestPath));
+  }
+
+  const required = [
+    'runtime/go.mod',
+    'runtime/cmd/server/main.go',
+    'worker/src/index.js',
+    'wrangler.jsonc',
+    'Dockerfile',
+  ];
+  const missing = required.filter((relPath) => !fs.existsSync(path.join(productRoot, relPath)));
+  if (missing.length) {
+    throw new Error(`product_incomplete: missing ${missing.join(', ')}`);
+  }
+
+  return {
+    product: DEFAULT_PRODUCT,
+    productRoot,
+    existing: created.length === 0,
+    created,
+    updated,
+    manifest: JSON.parse(fs.readFileSync(manifestPath, 'utf8')),
+  };
+}
+
+export function readProductManifest(productRoot) {
+  const manifestPath = path.join(productRoot, 'agentsam.package.json');
+  if (!fs.existsSync(manifestPath)) return null;
+  return JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+}
+
+function rel(root, file) {
+  return path.relative(root, file).split(path.sep).join('/');
+}
+
+export function preflightToolchain({ requireDocker = false, productRoot = null } = {}) {
+  const checks = [];
+  const push = (id, ok, detail = '') => checks.push({ id, ok, detail });
+
+  try {
+    const v = spawnSync('go', ['version'], { encoding: 'utf8' });
+    push('go', v.status === 0, (v.stdout || v.stderr || '').trim());
+  } catch (e) {
+    push('go', false, e.message);
+  }
+
+  const wranglerBin = resolveWranglerBin(productRoot);
+  try {
+    const v = spawnSync(wranglerBin.command, wranglerBin.args.concat(['--version']), {
+      encoding: 'utf8',
+      cwd: productRoot || process.cwd(),
+    });
+    push('wrangler', v.status === 0, (v.stdout || v.stderr || '').trim().slice(0, 120));
+  } catch (e) {
+    push('wrangler', false, e.message);
+  }
+
+  try {
+    const v = spawnSync('docker', ['info'], { encoding: 'utf8' });
+    push('docker', v.status === 0, v.status === 0 ? 'available' : (v.stderr || 'unavailable').trim().slice(0, 200));
+  } catch (e) {
+    push('docker', false, e.message);
+  }
+
+  const token = Boolean(process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN);
+  push('cloudflare_auth', token || Boolean(process.env.CLOUDFLARE_ACCOUNT_ID), token ? 'token_present' : 'account_or_token_missing');
+
+  const failed = checks.filter((c) => {
+    if (c.ok) return false;
+    if (c.id === 'docker' && !requireDocker) return false;
+    return true;
+  });
+  return { ok: failed.length === 0, checks, failed, wrangler: wranglerBin };
+}
+
+function resolveWranglerBin(productRoot) {
+  const candidates = [];
+  if (productRoot) {
+    candidates.push(path.join(productRoot, 'node_modules', 'wrangler', 'bin', 'wrangler.js'));
+    candidates.push(path.join(productRoot, 'node_modules', '.bin', 'wrangler'));
+  }
+  candidates.push(path.join(process.cwd(), 'node_modules', '.bin', 'wrangler'));
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      if (candidate.endsWith('.js')) return { command: process.execPath, args: [candidate] };
+      return { command: candidate, args: [] };
+    }
+  }
+  return { command: 'npx', args: ['--yes', 'wrangler'] };
+}