@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/test/integration/cms-site-tenancy-contract.test.mjs

@@ -0,0 +1,256 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { assertProjectSlug, createCmsDbClient } from '../../apps/local-studio/backend/worker/cms-db.js';
+import { injectSitePartials, fetchSitePartial, putSitePartial } from '../../apps/local-studio/backend/worker/site-partials.js';
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const at = (...parts) => path.join(root, ...parts);
+const read = (...parts) => fs.readFileSync(at(...parts), 'utf8');
+
+test('CMS D1 query helper strictly enforces projectSlug tenancy invariant', () => {
+  // Empty or invalid projectSlug must throw immediately
+  assert.throws(() => assertProjectSlug(''), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => assertProjectSlug('   '), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => assertProjectSlug(null), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => assertProjectSlug(undefined), /CMS Tenancy Invariant Violation/);
+  assert.throws(() => createCmsDbClient({}, ''), /CMS Tenancy Invariant Violation/);
+
+  assert.equal(assertProjectSlug('agentsam-sdk'), 'agentsam-sdk');
+});
+
+test('CMS D1 queries all enforce project-scoped tenancy without cross-tenant leaks', async () => {
+  const capturedQueries = [];
+  const mockDb = {
+    prepare(query) {
+      return {
+        bind(...args) {
+          capturedQueries.push({ query, args });
+          return {
+            async all() {
+              if (query.includes('FROM cms_pages WHERE project_slug = ?')) {
+                return { results: [{ id: 'page_test', project_slug: 'agentsam-sdk', title: 'Test' }] };
+              }
+              if (query.includes('FROM cms_pages WHERE id = ? AND project_slug = ?')) {
+                return { results: [{ id: args[0], project_slug: 'agentsam-sdk', title: 'Test' }] };
+              }
+              if (query.includes('SELECT s.id FROM cms_page_sections s')) {
+                return { results: [{ id: 'sec_test' }] };
+              }
+              if (query.includes('SELECT b.* FROM cms_section_components b')) {
+                return { results: [{ id: 'blk_test', component_type: 'card', component_data: '{}' }] };
+              }
+              if (query.includes('SELECT s.* FROM cms_page_sections s')) {
+                return { results: [{ id: 'sec_test', section_name: 'Test', section_data: '{}' }] };
+              }
+              return { results: [] };
+            },
+            async run() {
+              return { success: true };
+            },
+          };
+        },
+      };
+    },
+  };
+
+  const client = createCmsDbClient(mockDb, 'agentsam-sdk');
+
+  await client.getProject();
+  await client.getPages();
+  await client.getPageById('page_123');
+  await client.getSectionsForPage('page_123');
+  await client.getAllSectionsForSite();
+  await client.getAllBlocksForSite();
+  await client.getBlocksForSection('sec_123');
+  await client.getThemeOverrides();
+  await client.getLiquidImports();
+  await client.getActivity();
+  await client.getTemplates();
+
+  // Audit every captured query
+  for (const { query, args } of capturedQueries) {
+    const hasProjectSlugConstraint =
+      query.includes('project_slug') ||
+      query.includes('iam_project_slug') ||
+      query.includes('project_id') ||
+      query.includes('projects WHERE id = ?');
+    assert.ok(
+      hasProjectSlugConstraint,
+      `Query must enforce project scoping: ${query}`,
+    );
+    assert.ok(
+      args.some((arg) => typeof arg === 'string' && (arg.includes('agentsam-sdk') || arg.includes('agentsam_sdk'))),
+      `Args must bind project slug: ${JSON.stringify(args)} for ${query}`,
+    );
+  }
+});
+
+test('Local Studio package.json explicitly declares client-cms-editor dependencies', () => {
+  const pkgPath = at('apps', 'local-studio', 'frontend', 'package.json');
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+
+  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'missing @inneranimalmedia/agentsam-cms-frontend');
+  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'missing @inneranimalmedia/agentsam-cms-backend');
+  assert.ok(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'missing @inneranimalmedia/agentsam-cms-shared');
+
+  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-frontend'], 'file:../../client-cms-editor/frontend');
+  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-backend'], 'file:../../client-cms-editor/backend');
+  assert.equal(pkg.dependencies['@inneranimalmedia/agentsam-cms-shared'], 'file:../../client-cms-editor/shared/cms');
+});
+
+test('Local Studio mounts CMS route with default site agentsam-sdk', () => {
+  assert.ok(fs.existsSync(at('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx')));
+  const routeContent = read('apps', 'local-studio', 'frontend', 'src', 'routes', '_app', 'cms.tsx');
+
+  // Must default to agentsam-sdk
+  assert.match(routeContent, /"agentsam-sdk"/);
+  assert.doesNotMatch(routeContent, /default\s*:\s*["']inneranimalmedia["']/);
+
+  // Must use same-origin relative basePath
+  assert.match(routeContent, /basePath="\/cms"/);
+
+  // NavRail must include CMS entry
+  const navRail = read('apps', 'local-studio', 'frontend', 'src', 'components', 'shell', 'nav-rail.tsx');
+  assert.match(navRail, /to:\s*"\/cms"/);
+  assert.match(navRail, /label:\s*"CMS"/);
+});
+
+test('Local Studio Worker dispatches /api/cms/* with strict tenant isolation', () => {
+  const workerContent = read('apps', 'local-studio', 'backend', 'worker', 'index.js');
+  assert.match(workerContent, /url\.pathname\.startsWith\("\/api\/cms\/"\)/);
+  assert.match(workerContent, /handleCmsWorkerRequest/);
+
+  const cmsService = read('apps', 'local-studio', 'backend', 'worker', 'cms-service.js');
+  // Default fallback must be agentsam-sdk, never inneranimalmedia
+  assert.match(cmsService, /'agentsam-sdk'/);
+  assert.match(cmsService, /createCmsDbClient\(env\.DB,\s*siteSlug\)/);
+});
+
+test('homepage.html is decomposed into reusable site partials with relative links and edge injection markers', () => {
+  assert.ok(fs.existsSync(at('sites', 'agentsam-sdk', 'partials', 'header.html')));
+  assert.ok(fs.existsSync(at('sites', 'agentsam-sdk', 'partials', 'footer.html')));
+  assert.ok(fs.existsSync(at('apps', 'frontend', 'public', 'site', 'global', 'asbd-header.html')));
+  assert.ok(fs.existsSync(at('apps', 'frontend', 'public', 'site', 'global', 'asbd-footer.html')));
+
+  const header = read('sites', 'agentsam-sdk', 'partials', 'header.html');
+  const footer = read('sites', 'agentsam-sdk', 'partials', 'footer.html');
+  const homepage = read('apps', 'frontend', 'public', 'site', 'homepage.html');
+
+  // Header and footer are non-empty
+  assert.ok(header.length > 500, 'header.html must contain full header content');
+  assert.ok(footer.length > 500, 'footer.html must contain full footer content');
+
+  // AgentSam public header navigation is relative and product-specific (R2 partial SSOT).
+  assert.match(header, /href="\/"/);
+  assert.match(header, /href="\/learn\/"/);
+  assert.match(header, /href="\/themes\/"/);
+  assert.match(header, /href="\/packages\/sdk\/help\/"/);
+  assert.match(header, /href="\/auth\/login\?next=\/agentsam"/);
+  assert.doesNotMatch(header, /href="https:\/\/inneranimalmedia\.com\/(learn|themes|packages\/sdk|agentsam)"/);
+
+  assert.match(footer, /href="\/work"/);
+  assert.match(footer, /href="\/about"/);
+  assert.match(footer, /href="\/services"/);
+  assert.match(footer, /href="\/contact"/);
+  assert.match(footer, /href="\/privacy"/);
+  assert.match(footer, /href="\/terms"/);
+  assert.match(footer, /href="\/sitemap"/);
+  assert.doesNotMatch(footer, /href="https:\/\/inneranimalmedia\.com\/(work|about|services|contact|privacy|terms|sitemap)"/);
+
+  // Public homepage shell uses ASBD mounts + client inject of global partials
+  // (R2 sites/{site}/partials remain the publish/edge SSOT via publish-website-assets).
+  assert.match(homepage, /id="asbd-header-mount"/);
+  assert.match(homepage, /id="asbd-footer-mount"/);
+  assert.match(homepage, /inject\('asbd-header-mount',\s*'\/site\/global\/asbd-header\.html'\)/);
+  assert.match(homepage, /inject\('asbd-footer-mount',\s*'\/site\/global\/asbd-footer\.html'\)/);
+  assert.doesNotMatch(homepage, /<nav class="iam-sidenav" id="iamSidenav"/, 'inline sidenav should be in partials');
+});
+
+function r2Stub(store = new Map()) {
+  return {
+    async get(key) {
+      if (!store.has(key)) return null;
+      return { text: async () => store.get(key) };
+    },
+    async put(key, content) {
+      store.set(key, typeof content === 'string' ? content : String(content));
+      return { key };
+    },
+    async head() {
+      return null;
+    },
+    async list() {
+      return { objects: [] };
+    },
+  };
+}
+
+test('site-partials service injects header and footer from R2 into HTML response', async () => {
+  const store = new Map();
+  store.set('sites/agentsam-sdk/partials/header.html', '<header id="injected-header">Header Content</header>');
+  store.set('sites/agentsam-sdk/partials/footer.html', '<footer id="injected-footer">Footer Content</footer>');
+
+  const env = { WEBSITE_ASSETS: r2Stub(store) };
+
+  // Fetch and put partials
+  const fetchedHeader = await fetchSitePartial(env, 'agentsam-sdk', 'header');
+  assert.equal(fetchedHeader, '<header id="injected-header">Header Content</header>');
+
+  await putSitePartial(env, 'agentsam-sdk', 'header', '<header id="updated">Updated</header>');
+  const updatedHeader = await fetchSitePartial(env, 'agentsam-sdk', 'header');
+  assert.equal(updatedHeader, '<header id="updated">Updated</header>');
+
+  // Test HTML injection
+  const baseHtml = '<!DOCTYPE html><html><head><title>Test</title></head><body><main>Main Content</main></body></html>';
+  const initialResponse = new Response(baseHtml, {
+    headers: { 'content-type': 'text/html; charset=utf-8' },
+  });
+
+  const injectedResponse = await injectSitePartials(initialResponse, env, 'agentsam-sdk');
+  const transformedText = await injectedResponse.text();
+
+  assert.ok(transformedText.includes('<header id="updated">Updated</header>'), 'Response must contain injected header');
+  assert.ok(transformedText.includes('<footer id="injected-footer">Footer Content</footer>'), 'Response must contain injected footer');
+  assert.ok(transformedText.includes('<main>Main Content</main>'), 'Response must preserve main content');
+
+  // Verify non-text/html responses are guarded and untouched
+  const jsonResponse = new Response(JSON.stringify({ ok: true }), {
+    headers: { 'content-type': 'application/json' },
+  });
+  const unedited = await injectSitePartials(jsonResponse, env, 'agentsam-sdk');
+  assert.equal(await unedited.text(), JSON.stringify({ ok: true }));
+});
+
+test('Local Studio canonical homepage serves with edge HTMLRewriter partial injection and text/html', async () => {
+  const { serveCanonicalHomepage } = await import('../../apps/local-studio/backend/worker/canonical-homepage.js');
+
+  const store = new Map([
+    ['sites/agentsam-sdk/partials/header.html', '<header id="live-header">SDK Header</header>'],
+    ['sites/agentsam-sdk/partials/footer.html', '<footer id="live-footer">SDK Footer</footer>'],
+  ]);
+  const env = { WEBSITE_ASSETS: r2Stub(store) };
+
+  const rootReq = new Request('https://agentsam.inneranimalmedia.com/', { method: 'GET' });
+  const rootRes = await serveCanonicalHomepage(rootReq, env, 'agentsam-sdk');
+  assert.equal(rootRes.status, 200);
+  assert.ok(rootRes.headers.get('content-type')?.includes('text/html'), 'Content type must be text/html');
+  const rootText = await rootRes.text();
+  assert.ok(rootText.includes('<header id="live-header">SDK Header</header>'), 'Edge injection must inject header at /');
+  assert.ok(rootText.includes('<footer id="live-footer">SDK Footer</footer>'), 'Edge injection must inject footer at /');
+  assert.ok(rootText.includes('@inneranimalmedia/agentsam-sdk'), 'Canonical homepage content must be present');
+
+  // Verify index.js routes / and /index.html to serveCanonicalHomepage
+  const indexJsContent = fs.readFileSync(at('apps/local-studio/backend/worker/index.js'), 'utf8');
+  assert.ok(
+    indexJsContent.includes('serveCanonicalHomepage(request, env)'),
+    'index.js must call serveCanonicalHomepage for root route'
+  );
+  assert.ok(
+    indexJsContent.includes('url.pathname === "/" || url.pathname === "/index.html"'),
+    'index.js must match both / and /index.html'
+  );
+});
+

package/test/integration/codebaseindex-ingest.test.mjs

@@ -0,0 +1,166 @@
+import assert from 'node:assert/strict';
+import { describe, it, before } from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import {
+  getCliCommand,
+  listCliCommands,
+  printAssistTip,
+  suggestCliCommands,
+} from '../../src/cli/command-catalog.js';
+import { parsePastedPaths, classifyMaterial, stageMaterials } from '../../src/indexing/ingest/materials.js';
+import { ensureSeedOperations, getSamOperation, AgentSamClient } from '../../src/sam/index.js';
+import { getSkill, loadSkill } from '../../src/skills/index.js';
+import { resolveHelpTopic, renderHelpOverview } from '../../src/ui/cli/help.js';
+import { runCodebaseindexIngest } from '../../src/commands/codebaseindex.js';
+
+describe('CLI command catalog assist', () => {
+  it('maps ingest alias to codebaseindex with skill tip', () => {
+    const entry = getCliCommand('ingest');
+    assert.equal(entry?.id, 'codebaseindex');
+    assert.equal(entry?.skill, 'agentsam-codebaseindex');
+    assert.equal(entry?.operation, 'codebaseindex.ingest');
+  });
+
+  it('prints tip: use skill for every catalogued command', () => {
+    const chunks = [];
+    for (const entry of listCliCommands()) {
+      if (!entry.skill) continue;
+      printAssistTip(entry, { write: (s) => chunks.push(s) });
+    }
+    const text = chunks.join('');
+    assert.match(text, /tip: use skill agentsam-codebaseindex/);
+    assert.match(text, /tip: use skill agentsam-app-fundamentals/);
+  });
+
+  it('suggests commands for typos', () => {
+    const hits = suggestCliCommands('codebase');
+    assert.ok(hits.some((h) => h.id === 'codebaseindex'));
+  });
+});
+
+describe('material paste/drop intake', () => {
+  it('parses pasted multi-path text', () => {
+    const paths = parsePastedPaths('/tmp/a.tar.gz\n"./site build"/index.html  screenshot.png');
+    assert.ok(paths.includes('/tmp/a.tar.gz'));
+    assert.ok(paths.some((p) => p.includes('index.html') || p.endsWith('screenshot.png')));
+  });
+
+  it('stages html and classifies archives', () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-ingest-'));
+    const html = path.join(root, 'page.html');
+    fs.writeFileSync(html, '<html><body>hi</body></html>');
+    const classified = classifyMaterial(html);
+    assert.equal(classified.kind, 'document');
+
+    const tarPath = path.join(root, 'site.tar');
+    const bundle = path.join(root, 'bundle');
+    fs.mkdirSync(bundle);
+    fs.writeFileSync(path.join(bundle, 'index.html'), '<html>build</html>');
+    execFileSync('tar', ['-cf', tarPath, '-C', bundle, '.']);
+
+    const staged = stageMaterials({ root, materials: [html, tarPath] });
+    assert.equal(staged.schema, 'agentsam.ingest.materials.v1');
+    assert.ok(staged.include.length >= 1);
+    assert.ok(staged.assets.some((a) => a.kind === 'document') || staged.items.some((i) => i.kind === 'archive'));
+    assert.ok(fs.existsSync(path.join(root, staged.stage_root, 'manifest.json')));
+  });
+});
+
+describe('codebaseindex SAM primitive', () => {
+  before(() => ensureSeedOperations());
+
+  it('registers codebaseindex.ingest', () => {
+    const op = getSamOperation('codebaseindex.ingest');
+    assert.ok(op);
+    assert.equal(op.execution.model, 'optional');
+    assert.deepEqual(op.cli.command[0], ['codebaseindex']);
+  });
+
+  it('skill agentsam-codebaseindex loads', () => {
+    assert.ok(getSkill('ingest'));
+    const loaded = loadSkill('agentsam-codebaseindex');
+    assert.match(loaded.instructions, /codebaseindex\.ingest/);
+    assert.match(loaded.instructions, /sam\.codebaseindex\.index\.run/);
+  });
+
+  it('describe + discover surface ingest', async () => {
+    const sam = new AgentSamClient();
+    const info = await sam.describe('codebaseindex.ingest');
+    assert.equal(info.ok, true);
+    const found = await sam.discover({ query: 'ingest archive embedding' });
+    assert.ok(found.operations.some((c) => c.id === 'codebaseindex.ingest'));
+  });
+
+  it('plan-only ingest via invoke (repo allowlist)', async () => {
+    const sam = new AgentSamClient();
+    const result = await sam.invoke('codebaseindex.ingest', {
+      root: process.cwd(),
+      include: ['src/sam'],
+      exclude: ['node_modules', '.git'],
+      embeddingChoice: 'none',
+      planOnly: true,
+    });
+    assert.equal(result.ok, true);
+    assert.equal(result.data?.pipeline, 'sam.codebaseindex.index.run');
+    assert.equal(result.data?.mode, 'plan');
+  });
+});
+
+describe('codebaseindex real execution', () => {
+  it('publishes, smoke-searches, completes the graph, and returns portable paths', async () => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-codebaseindex-run-'));
+    fs.mkdirSync(path.join(root, 'src'), { recursive: true });
+    fs.writeFileSync(
+      path.join(root, 'src', 'demo.js'),
+      'export function hello() { return "hello AgentSam"; }\n',
+    );
+
+    const result = await runCodebaseindexIngest({
+      root,
+      include: ['src'],
+      exclude: [],
+      embeddingChoice: 'none',
+      embed: false,
+      planOnly: false,
+    });
+
+    assert.equal(result.mode, 'run');
+    assert.equal(result.root, '.');
+    assert.equal(result.inventory.root, '.');
+
+    assert.equal(result.index.published, true);
+    assert.equal(result.job_graph.status, 'completed');
+    assert.equal(result.job_graph.current, null);
+    assert.equal(
+      result.job_graph.nodes.find((node) => node.id === 'embedding.generate')?.status,
+      'skipped',
+    );
+    assert.equal(
+      result.job_graph.nodes.find((node) => node.id === 'search.smoke')?.status,
+      'done',
+    );
+
+    assert.equal(
+      result.search_smoke.generation_id,
+      result.index.generation_id,
+    );
+    assert.ok(result.search_smoke.sources_included >= 1);
+  });
+});
+
+describe('catalog-driven help', () => {
+  it('resolves ingest topic from catalog', () => {
+    const topic = resolveHelpTopic('ingest');
+    assert.ok(topic);
+    assert.ok(topic.rows.some(([cmd]) => cmd.includes('codebaseindex')));
+  });
+
+  it('overview mentions skill baseline', () => {
+    const text = renderHelpOverview('2.6.3');
+    assert.match(text, /tip: use skill/);
+    assert.match(text, /command catalog/i);
+  });
+});

package/test/integration/core-client.integration.test.mjs

@@ -0,0 +1,55 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { getJson } from '../../src/lib/core-client.js';
+import { saveAccountSession } from '../../src/lib/account-session.js';
+
+test('core client accepts an already-resolved browser OAuth bearer without reclassifying it as an API key', async () => {
+  let authorization = '';
+  const result = await getJson('/api/sdk/context', {
+    bearer: 'browser_oauth_access_token',
+    env: { IAM_OAUTH_ISSUER: 'https://iam.example.test' },
+    fetchImpl: async (_url, options) => {
+      authorization = options.headers.Authorization;
+      return { ok: true, async json() { return { ok: true }; } };
+    },
+  });
+  assert.equal(result.ok, true);
+  assert.equal(authorization, 'Bearer browser_oauth_access_token');
+});
+
+test('legacy string credential form is treated as a resolved bearer for both API keys and OAuth tokens', async () => {
+  const original = globalThis.fetch;
+  let authorization = '';
+  globalThis.fetch = async (_url, options) => {
+    authorization = options.headers.Authorization;
+    return { ok: true, async json() { return { ok: true }; } };
+  };
+  try {
+    await getJson('/api/sdk/context', 'browser_oauth_access_token');
+    assert.equal(authorization, 'Bearer browser_oauth_access_token');
+  } finally {
+    globalThis.fetch = original;
+  }
+});
+
+test('core client refreshes browser OAuth once when IAM returns 401 before local expiry', async t => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-core-client-'));
+  t.after(() => fs.rmSync(home, { recursive: true, force: true }));
+  saveAccountSession({ access_token: 'stale_browser_token', refresh_token: 'refresh_token', expires_in: 3600 }, { home });
+  const seen = [];
+  const result = await getJson('/api/sdk/context', {
+    home,
+    env: { IAM_OAUTH_ISSUER: 'https://iam.example.test' },
+    refreshImpl: async () => ({ access_token: 'fresh_browser_token', refresh_token: 'refresh_token' }),
+    fetchImpl: async (_url, options) => {
+      seen.push(options.headers.Authorization);
+      const ok = seen.length > 1;
+      return { ok, status: ok ? 200 : 401, async json() { return ok ? { ok: true } : { error: 'Unauthorized' }; } };
+    },
+  });
+  assert.equal(result.ok, true);
+  assert.deepEqual(seen, ['Bearer stale_browser_token', 'Bearer fresh_browser_token']);
+});

package/test/integration/error-runtime-rpc.test.mjs

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import {
+  AgentSamError,
+  createErrorEnvelope,
+} from '../../packages/agentsam-errors/src/index.js';
+import {
+  decodeErrorDetail,
+  decodeJob,
+  encodeErrorDetail,
+  encodeJob,
+  fromGrpcError,
+  toGrpcError,
+} from '../../src/knowledge/service/grpc-codec.js';
+
+function sampleEnvelope() {
+  return createErrorEnvelope({
+    reason: 'provider_budget_exhausted',
+    message: 'Provider account budget is exhausted.',
+    source: { kind: 'provider', name: 'openai', service: 'responses' },
+    resolution_owner: 'agentsam',
+    severity: 'blocking_internal',
+    remediation: { action: 'inspect_platform', message: 'AgentSam must inspect its platform-owned OpenAI account.' },
+    domain: 'provider',
+    tool: 'openai',
+    stage: 'request',
+    provider: 'openai',
+    provider_code: 'project_spend_limit_exceeded',
+    request_id: 'req_123',
+    trace_id: 'trace_123',
+    transport: 'grpc',
+    resource: { type: 'provider_account', id: 'platform', name: 'OpenAI' },
+    native: { code: 'project_spend_limit_exceeded', exception_type: 'insufficient_quota' },
+    environment: { component: 'responses', runtime: 'node', platform: 'linux' },
+    details: { tier: 'default' },
+  });
+}
+
+test('protobuf ErrorDetail preserves the canonical AgentSam envelope', () => {
+  const source = sampleEnvelope();
+  const roundTrip = decodeErrorDetail(encodeErrorDetail(source));
+  assert.deepEqual(roundTrip, source);
+});
+
+test('gRPC exception metadata round-trips one canonical AgentSamError', () => {
+  const source = sampleEnvelope();
+  const wireError = toGrpcError(new AgentSamError(source));
+  const decoded = fromGrpcError(wireError);
+  assert.ok(decoded instanceof AgentSamError);
+  assert.deepEqual(decoded.envelope, source);
+  assert.equal(decoded.grpcCode, 8);
+  assert.equal(decoded.rpcCode, 'RESOURCE_EXHAUSTED');
+});
+
+test('durable job protobuf retains structured failure and compatibility message', () => {
+  const failure = sampleEnvelope();
+  const message = encodeJob({
+    id: '11111111-1111-1111-1111-111111111111',
+    status: 'failed',
+    attempts: 2,
+    created_at: '2026-09-17T00:00:00.000Z',
+    updated_at: '2026-09-17T00:01:00.000Z',
+    result: null,
+    failure,
+  });
+  const decoded = decodeJob(message);
+  assert.equal(decoded.status, 'failed');
+  assert.deepEqual(decoded.failure, failure);
+  assert.equal(decoded.error, failure.message);
+});

package/test/integration/features-resolve.test.mjs

@@ -0,0 +1,128 @@
+/**
+ * Feature-packet resolver tests — package-local oauth-login-portal compartment.
+ */
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import test from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import {
+  formatResourcesSummary,
+  getIdentityProviderTemplate,
+  loadIdentityResources,
+  loadOAuthLoginPortalFeature,
+  resolveAuthFeature,
+  writeFeatureSelections,
+  writeFeaturesResolved,
+} from '../../src/features/resolve.js';
+
+const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+
+test('oauth-login-portal feature packet loads with artifacts', () => {
+  const feature = loadOAuthLoginPortalFeature();
+  assert.equal(feature.id, 'identity.oauth-login-portal');
+  assert.ok(Array.isArray(feature.artifacts));
+  assert.ok(feature.artifacts.some((a) => a.kind === 'provider-catalog'));
+  assert.ok(!fs.existsSync(path.join(SDK_ROOT, 'protocol/identity')));
+  assert.ok(!fs.existsSync(path.join(SDK_ROOT, 'protocol/features/auth.json')));
+});
+
+test('auth feature resolves real D1 resources, not a pretend iam-d1 profile', () => {
+  const resolved = resolveAuthFeature({
+    selected: true,
+    capabilities: ['identity.init'],
+    provider_template: 'google',
+    selected_at: '2026-09-24T04:25:12.860Z',
+  });
+  assert.equal(resolved.provider_template, 'google');
+  assert.equal(resolved.provider.id, 'google');
+  assert.equal(resolved.provider.status, 'ready');
+  assert.equal(resolved.schema_profile, undefined);
+  assert.equal(resolved.resources.engine, 'd1');
+  assert.deepEqual(resolved.resources.migration_sources, [
+    'src/migrations/0001_identity_core.sql',
+    'src/migrations/0002_company.sql',
+  ]);
+  const names = resolved.resources.tables.map((t) => t.name);
+  assert.deepEqual(names, [
+    'auth_users',
+    'auth_sessions',
+    'account_identities',
+    'oauth_states',
+    'password_reset_tokens',
+    'company',
+  ]);
+  assert.match(formatResourcesSummary(resolved.resources), /tables=auth_users,/);
+  assert.doesNotMatch(formatResourcesSummary(resolved.resources), /iam-d1/);
+});
+
+test('legacy iam provider_template normalizes to inneranimalmedia', () => {
+  const resolved = resolveAuthFeature({
+    selected: true,
+    capabilities: ['identity.init'],
+    provider_template: 'iam',
+  });
+  assert.equal(resolved.provider_template, 'inneranimalmedia');
+  assert.equal(resolved.provider.id, 'inneranimalmedia');
+  assert.equal(resolved.provider.oauth_provider_key, 'iam');
+  assert.equal(resolved.provider.status, 'ready');
+});
+
+test('cloudflare is registered ready in provider catalog', () => {
+  const provider = getIdentityProviderTemplate('cloudflare');
+  assert.equal(provider?.status, 'ready');
+  assert.equal(provider?.registered, true);
+});
+
+test('resources.json indexes D1 tables without owning DDL', () => {
+  const resources = loadIdentityResources();
+  assert.equal(resources.engine, 'd1');
+  assert.deepEqual(resources.migration_sources, [
+    'src/migrations/0001_identity_core.sql',
+    'src/migrations/0002_company.sql',
+  ]);
+  const names = resources.tables.map((t) => t.name);
+  assert.ok(names.includes('auth_users'));
+  assert.ok(names.includes('company'));
+});
+
+test('writeFeatureSelections emits schema_version 2 and resolved snapshot', () => {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-features-'));
+  try {
+    fs.mkdirSync(path.join(cwd, '.agentsam'), { recursive: true });
+    const { state_path, resolved_path, snapshot } = writeFeatureSelections(cwd, {
+      schema_version: 2,
+      features: {
+        auth: {
+          selected: true,
+          capabilities: ['identity.init'],
+          provider_template: 'inneranimalmedia',
+          selected_at: '2026-09-24T04:25:12.860Z',
+        },
+      },
+    });
+    const state = JSON.parse(fs.readFileSync(state_path, 'utf8'));
+    assert.equal(state.schema_version, 2);
+    assert.equal(state.features.auth.provider_template, 'inneranimalmedia');
+    assert.equal(snapshot.features.auth.resources.engine, 'd1');
+    assert.ok(snapshot.features.auth.resources.tables.some((t) => t.name === 'auth_users'));
+    assert.equal(snapshot.features.auth.schema_profile, undefined);
+    assert.ok(fs.existsSync(resolved_path));
+  } finally {
+    fs.rmSync(cwd, { recursive: true, force: true });
+  }
+});
+
+test('sdk project selections resolve against package packet', () => {
+  const { snapshot } = writeFeaturesResolved(SDK_ROOT);
+  assert.equal(snapshot.schema, 'agentsam.features.resolved.v1');
+  assert.equal(snapshot.features.auth.provider_template, 'inneranimalmedia');
+  assert.equal(snapshot.features.auth.feature.id, 'identity.oauth-login-portal');
+  assert.equal(snapshot.features.auth.resources.engine, 'd1');
+  assert.match(
+    formatResourcesSummary(snapshot.features.auth.resources),
+    /auth_users,auth_sessions,account_identities/,
+  );
+});