@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/src/commands/whoami.js

@@ -1,25 +1,92 @@
 import { getJson } from '../lib/core-client.js';
+import { resolveAccountAuthority } from '../lib/auth.js';
 import {
   describeAccountSession,
   resolveAccountApiKey,
-  resolveAccountAuth,
 } from '../lib/account-session.js';
 import { listProviderCredentialStatus } from '../lib/provider-credentials.js';
 
 function writeLine(write, value = '') { write(`${value}\n`); }
 
+function safeTerminalContext(value = {}) {
+  return {
+    available: value?.available === true,
+    instances: (value?.instances || []).map((row) => ({
+      id: row?.id || null,
+      name: row?.name || null,
+      kind: row?.kind || null,
+      provider: row?.provider || null,
+      status: row?.status || null,
+      platform: row?.platform || null,
+      arch: row?.arch || null,
+      active_connection_count: Number(row?.active_connection_count || 0),
+      default_connection_id: row?.default_connection_id || null,
+      last_seen_at: row?.last_seen_at || null,
+    })),
+    connections: (value?.connections || []).map((row) => ({
+      id: row?.id || null,
+      instance_id: row?.instance_id || null,
+      name: row?.name || null,
+      kind: row?.kind || null,
+      provider: row?.provider || null,
+      transport: row?.transport || null,
+      transport_provider: row?.transport_provider || null,
+      is_active: row?.is_active === true,
+      is_default: row?.is_default === true,
+      health_status: row?.health_status || 'unknown',
+      last_seen_at: row?.last_seen_at || null,
+    })),
+  };
+}
+
+function capabilityProbe(credentials = []) {
+  const has = (provider) => credentials.some((row) => row.provider === provider && row.configured);
+  return {
+    repository: { available: true },
+    database: { available: true, drivers: ['sqlite'] },
+    vectors: { available: true, drivers: ['local_exact'] },
+    models: {
+      available: has('openai') || has('anthropic') || has('gemini') || has('xai') || has('cursor') || has('cloudflare'),
+      configuredProviders: ['openai', 'anthropic', 'gemini', 'xai', 'cursor', 'cloudflare'].filter((p) => has(p)).length,
+    },
+    deploy: { available: has('cloudflare') },
+  };
+}
+
 export async function collectWhoami(options = {}) {
   const env = options.env || process.env;
   const apiKey = resolveAccountApiKey({ env, explicit: options.token || '', home: options.home });
   const browserSession = describeAccountSession({ env, home: options.home });
-  const active = resolveAccountAuth({ env, explicit: options.token || '', home: options.home });
+  const authorityLoader = options.authorityLoader || resolveAccountAuthority;
+  const active = await authorityLoader({
+    env,
+    explicit: options.token || '',
+    home: options.home,
+    nowMs: options.nowMs,
+    skewMs: options.skewMs,
+    refreshImpl: options.refreshImpl,
+    fetchImpl: options.fetchImpl,
+    signal: options.signal,
+  });
   const credentials = listProviderCredentialStatus({ env, home: options.home });
 
   const base = {
-    schema_version: 2,
+    schema_version: 3,
+    ok: false,
+    command_id: 'whoami',
+    risk: 'read',
+    exit_code: 1,
+    format: 'json',
+    loggedIn: false,
     authenticated: false,
-    authority: 'iam',
+    authType: null,
+    authLabel: null,
+    authority: 'inneranimalmedia',
     identity: null,
+    account: null,
+    credential: null,
+    tokenPermissions: [],
+    capabilities: capabilityProbe(credentials),
     active_auth: {
       configured: Boolean(active.value || active.error),
       kind: active.kind || null,
@@ -40,25 +107,76 @@ export async function collectWhoami(options = {}) {
   if (!active.value) return base;
 
   try {
-    const loader = options.contextLoader || ((token) => getJson('/api/sdk/context', token));
+    const loader = options.contextLoader || ((token) => getJson('/api/sdk/context', {
+      env,
+      home: options.home,
+      bearer: token,
+      fetchImpl: options.fetchImpl,
+      refreshImpl: options.refreshImpl,
+      nowMs: options.nowMs,
+      skewMs: options.skewMs,
+      signal: options.signal,
+    }));
     const context = await loader(active.value);
+    const authType = context?.auth_type || (active.kind === 'api_key' ? 'api_key' : 'oauth_session');
+    const tokenPermissions = Array.isArray(context?.tokenPermissions)
+      ? context.tokenPermissions
+      : Array.isArray(context?.credential?.scopes)
+        ? context.credential.scopes
+        : [];
+    const authLabel =
+      authType === 'api_key'
+        ? 'AgentSam API Key'
+        : authType === 'oauth_session'
+          ? 'OAuth Session'
+          : String(authType);
+
     return {
       ...base,
+      ok: true,
+      exit_code: 0,
+      loggedIn: true,
       authenticated: true,
+      authType,
+      authLabel,
       identity: {
         user_id: context?.user_id || null,
         account_id: context?.account_id || null,
         email: context?.email || context?.user?.email || null,
       },
+      account: {
+        id: context?.account_id || context?.user_id || null,
+        display_name: context?.email || context?.user?.email || context?.account_id || null,
+      },
+      credential: context?.credential
+        ? {
+            id: context.credential.id || null,
+            name: context.credential.name || null,
+            prefix: context.credential.prefix || null,
+            environment: context.credential.environment || null,
+            status: context.credential.status || 'active',
+            created_at: context.credential.created_at || null,
+            expires_at: context.credential.expires_at || null,
+            last_used_at: context.credential.last_used_at || null,
+          }
+        : active.kind === 'api_key'
+          ? { id: null, name: null, prefix: null, status: 'active' }
+          : null,
+      tokenPermissions,
+      capabilities: capabilityProbe(credentials),
       active_auth: { ...base.active_auth, valid: true, error: null },
       api_key: active.kind === 'api_key' ? { ...base.api_key, valid: true, error: null } : base.api_key,
       cloudflare_connected: context?.cloudflare?.ok === true,
       byok: context?.byok && typeof context.byok === 'object'
         ? Object.fromEntries(Object.entries(context.byok).map(([key, value]) => [key, { configured: value?.configured === true }]))
         : {},
+      terminal: safeTerminalContext(context?.terminal),
     };
   } catch (error) {
-    const message = error?.message || String(error);
+    const rawMessage = error?.message || String(error);
+    const message = error?.status
+      ? `${rawMessage} (HTTP ${error.status} from ${error.endpoint || 'server'})`
+      : rawMessage;
     return {
       ...base,
       active_auth: { ...base.active_auth, valid: false, error: message },
@@ -69,25 +187,51 @@ export async function collectWhoami(options = {}) {
 
 export function renderWhoami(status) {
   const lines = ['', '  Agent Sam · whoami', ''];
-  if (status.authenticated) {
+  if (status.authenticated || status.loggedIn) {
     lines.push('  authenticated  yes');
-    lines.push(`  authority      ${status.authority}`);
-    if (status.identity?.email) lines.push(`  email          ${status.identity.email}`);
-    if (status.identity?.account_id) lines.push(`  account        ${status.identity.account_id}`);
-    if (status.identity?.user_id) lines.push(`  user           ${status.identity.user_id}`);
+    lines.push(`  authType       ${status.authLabel || status.authType || status.active_auth?.kind || 'unknown'}`);
+    if (status.account?.display_name || status.identity?.email) {
+      lines.push(`  account        ${status.account?.display_name || status.identity?.email}`);
+    }
+    if (status.account?.id || status.identity?.account_id) {
+      lines.push(`  account id     ${status.account?.id || status.identity?.account_id}`);
+    }
+    if (status.credential?.name || status.credential?.prefix) {
+      lines.push(`  credential     ${[status.credential.name, status.credential.prefix].filter(Boolean).join(' · ')}`);
+    }
+    if (status.tokenPermissions?.length) {
+      lines.push(`  permissions    ${status.tokenPermissions.join(', ')}`);
+    }
     lines.push(`  active auth    ${status.active_auth?.kind || 'unknown'} · ${status.active_auth?.source || 'runtime'}`);
   } else {
     lines.push('  authenticated  no');
     lines.push(`  API key        ${status.api_key?.configured ? status.api_key?.valid === false ? 'invalid' : 'configured' : 'not configured'}`);
     lines.push(`  browser login  ${status.browser_session?.configured ? 'stored' : 'not configured'}`);
     if (status.active_auth?.error) lines.push(`  error          ${status.active_auth.error}`);
+    lines.push('');
+    if (status.browser_session?.configured && status.active_auth?.error) {
+      lines.push('  tip            A login session is saved locally, but the server rejected it on this');
+      lines.push('                 request (see error above). Run `agentsam login` again, or');
+      lines.push('                 `agentsam whoami --json` for the full response.');
+    } else if (!status.api_key?.configured) {
+      lines.push('  tip            Run `agentsam login` then `agentsam api-key create --store keychain --activate`.');
+    }
+  }
+  lines.push('');
+  lines.push('  Capabilities');
+  const caps = status.capabilities || {};
+  for (const [key, value] of Object.entries(caps)) {
+    const available = value?.available === true ? 'yes' : 'no';
+    const extra = value?.configuredProviders != null ? ` · providers ${value.configuredProviders}` : '';
+    lines.push(`  ${key.padEnd(14)} ${available}${extra}`);
   }
   lines.push('');
   lines.push('  Provider credentials');
   for (const row of status.provider_credentials || []) {
     const state = row.configured ? 'available' : row.error ? `blocked (${row.error})` : 'not configured';
     const source = row.source ? ` · ${row.source}` : '';
-    lines.push(`  ${String(row.provider).padEnd(16)} ${state}${source}`);
+    const label = row.provider === 'inneranimalmedia' ? 'inneranimalmedia (API key)' : String(row.provider);
+    lines.push(`  ${label.padEnd(28)} ${state}${source}`);
   }
   lines.push('');
   lines.push('  Secret values are never printed by whoami.');

package/src/context/budget.js

@@ -57,6 +57,11 @@ export function createContextBudget(options = {}) {
   }
 
   const pricingThresholdTokens = nullablePositiveInteger(options.pricingThresholdTokens, 'pricingThresholdTokens');
+  const maxCumulativeInputTokens = positiveInteger(
+    options.maxCumulativeInputTokens
+      ?? (pricingThresholdTokens ? pricingThresholdTokens * 2 : maxNormalInputTokens * 4),
+    'maxCumulativeInputTokens',
+  );
   const safetyMarginTokens = Number.isInteger(options.safetyMarginTokens) && options.safetyMarginTokens >= 0
     ? options.safetyMarginTokens
     : pricingThresholdTokens && pricingThresholdTokens > maxNormalInputTokens
@@ -78,6 +83,7 @@ export function createContextBudget(options = {}) {
     maxNormalInputTokens,
     hardInputTokens,
     pricingThresholdTokens,
+    maxCumulativeInputTokens,
     safetyMarginTokens,
     targetInputChars,
     hardInputChars,

package/src/context/index.js

@@ -2,6 +2,7 @@ export { DEFAULT_CONTEXT_RATIOS, createContextBudget, estimateContextTokens, ass
 export { DEFAULT_RESULT_POLICY, RESULT_DETAIL_ORDER, normalizeResultPolicy, truncateResultText, boundResultItems } from './result-policy.js';
 export { CONTEXT_ITEM_KINDS, normalizeContextItem, resolveContext, resolveProjectContext } from './resolve.js';
 export { PROJECT_RULES_FILENAME, DEFAULT_PROJECT_RULES_MAX_CHARS, defaultProjectRules, ensureProjectRules, findProjectRules, loadProjectRules } from '../lib/project-rules.js';
-export { AGENT_RUNTIME_FILENAME, AGENT_INSTRUCTION_PRECEDENCE, findAgentRuntimeContract, compileAgentInstructions } from '../lib/agent-instructions.js';
+export { AGENT_RUNTIME_FILENAME, AGENT_INSTRUCTION_PRECEDENCE, AGENT_INSTRUCTION_COMPAT_SHIMS, findAgentRuntimeContract, compileAgentInstructions } from '../lib/agent-instructions.js';
 export { DEFAULT_CONSUMED_CONTEXT_CHARS, compactContextItem, compactConsumedToolResult } from './compact.js';
 export { rehydrateContextRef } from './rehydrate.js';
+export { buildProjectCard } from './project-card.js';

package/src/context/project-card.js

@@ -0,0 +1,75 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { tryResolveGitContext } from '../../packages/agentsam-repository/src/git-context.js';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+/**
+ * Build a structured, high-signal Project Card for agent turns.
+ */
+export function buildProjectCard(cwd = process.cwd(), options = {}) {
+  const root = path.resolve(cwd);
+  const git = tryResolveGitContext({ cwd: root });
+
+  let pkgName = path.basename(root);
+  let pkgVersion = '0.0.0';
+  let stackSummary = 'node';
+
+  const pkgPath = path.join(root, 'package.json');
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      if (pkg.name) pkgName = pkg.name;
+      if (pkg.version) pkgVersion = pkg.version;
+      const deps = Object.keys(pkg.dependencies || {});
+      const devDeps = Object.keys(pkg.devDependencies || {});
+      const allDeps = [...deps, ...devDeps];
+      const detected = [];
+      if (allDeps.some((d) => d.includes('react'))) detected.push('react');
+      if (allDeps.some((d) => d.includes('vite'))) detected.push('vite');
+      if (allDeps.some((d) => d.includes('wrangler') || d.includes('cloudflare'))) detected.push('cloudflare');
+      if (allDeps.some((d) => d.includes('typescript'))) detected.push('typescript');
+      if (allDeps.some((d) => d.includes('sqlite') || d.includes('better-sqlite3'))) detected.push('sqlite');
+      if (detected.length) stackSummary = detected.join(', ');
+    } catch {}
+  }
+
+  const activeTask = clean(options.activeTaskId || options.taskId || options.beliefs?.current_task_id || options.workspaceState?.current_task_id);
+  const lockedBy = clean(options.lockedBy || options.beliefs?.locked_by || options.workspaceState?.locked_by || 'agentsam_cli');
+  const checkpoint = clean(options.checkpointSha || options.beliefs?.checkpoint_sha || options.workspaceState?.checkpoint_sha || git?.headSha);
+  const branch = clean(git?.branch || 'main');
+  const headSha = clean(git?.headSha ? git.headSha.slice(0, 10) : 'unknown');
+  const dirty = Boolean(git?.dirty);
+  const repoName = clean(git?.repoFullName || pkgName);
+  const remoteUrl = clean(git?.remoteUrl || 'local');
+
+  const lines = [
+    '<!-- agentsam:project-card -->',
+    `# Project Card: ${pkgName} v${pkgVersion}`,
+    `- Repository: ${repoName} (${remoteUrl})`,
+    `- Branch: ${branch} | HEAD: ${headSha} (${dirty ? 'working tree dirty' : 'clean'})`,
+    `- Project Root: ${root}`,
+    `- Active Task: ${activeTask || 'none'}`,
+    `- Locked By: ${lockedBy}`,
+    `- Checkpoint SHA: ${checkpoint ? checkpoint.slice(0, 10) : headSha}`,
+    `- Stack: ${stackSummary}`,
+    '- Constraints: Scoped to repository root. Use terminal.exec for concrete commands without a shell. Never search or output secrets or private keys.',
+  ];
+
+  return Object.freeze({
+    name: pkgName,
+    version: pkgVersion,
+    repo: repoName,
+    branch,
+    headSha,
+    dirty,
+    root,
+    activeTask,
+    lockedBy,
+    checkpoint,
+    stackSummary,
+    content: lines.join('\n'),
+  });
+}

package/src/errors/contract.js

@@ -1,173 +1,36 @@
-export const ERROR_SCHEMA_VERSION = 1;
-
-// Mirrors google.rpc.Code / gRPC canonical status names without importing a Node gRPC runtime.
-export const ERROR_CODE = Object.freeze({
-  OK: 'OK',
-  CANCELLED: 'CANCELLED',
-  UNKNOWN: 'UNKNOWN',
-  INVALID_ARGUMENT: 'INVALID_ARGUMENT',
-  DEADLINE_EXCEEDED: 'DEADLINE_EXCEEDED',
-  NOT_FOUND: 'NOT_FOUND',
-  ALREADY_EXISTS: 'ALREADY_EXISTS',
-  PERMISSION_DENIED: 'PERMISSION_DENIED',
-  RESOURCE_EXHAUSTED: 'RESOURCE_EXHAUSTED',
-  FAILED_PRECONDITION: 'FAILED_PRECONDITION',
-  ABORTED: 'ABORTED',
-  OUT_OF_RANGE: 'OUT_OF_RANGE',
-  UNIMPLEMENTED: 'UNIMPLEMENTED',
-  INTERNAL: 'INTERNAL',
-  UNAVAILABLE: 'UNAVAILABLE',
-  DATA_LOSS: 'DATA_LOSS',
-  UNAUTHENTICATED: 'UNAUTHENTICATED',
-});
-
-export const GRPC_STATUS = Object.freeze({
-  OK: 0,
-  CANCELLED: 1,
-  UNKNOWN: 2,
-  INVALID_ARGUMENT: 3,
-  DEADLINE_EXCEEDED: 4,
-  NOT_FOUND: 5,
-  ALREADY_EXISTS: 6,
-  PERMISSION_DENIED: 7,
-  RESOURCE_EXHAUSTED: 8,
-  FAILED_PRECONDITION: 9,
-  ABORTED: 10,
-  OUT_OF_RANGE: 11,
-  UNIMPLEMENTED: 12,
-  INTERNAL: 13,
-  UNAVAILABLE: 14,
-  DATA_LOSS: 15,
-  UNAUTHENTICATED: 16,
-});
-
-// Stable AgentSam-specific reasons. Add reasons deliberately; callers should not branch on messages.
-export const ERROR_REASON = Object.freeze({
-  UNKNOWN: 'unknown',
-
-  INPUT_INVALID: 'input_invalid',
-  INPUT_OUT_OF_RANGE: 'input_out_of_range',
-  PRECONDITION_FAILED: 'precondition_failed',
-  UNSUPPORTED_OPERATION: 'unsupported_operation',
-
-  AUTH_MISSING: 'auth_missing',
-  AUTH_INVALID: 'auth_invalid',
-  IDENTITY_MISSING: 'identity_missing',
-  PERMISSION_DENIED: 'permission_denied',
-
-  TARGET_NOT_FOUND: 'target_not_found',
-  ALREADY_EXISTS: 'already_exists',
-  CONFLICT: 'conflict',
-  STALE_VERSION: 'stale_version',
-
-  RATE_LIMITED: 'rate_limited',
-  QUOTA_EXHAUSTED: 'quota_exhausted',
-  CAPACITY_EXHAUSTED: 'capacity_exhausted',
-
-  TRANSPORT_UNREACHABLE: 'transport_unreachable',
-  TRANSPORT_REFUSED: 'transport_refused',
-  TRANSPORT_TIMEOUT: 'transport_timeout',
-  UPSTREAM_INVALID_RESPONSE: 'upstream_invalid_response',
-  DNS_UNRESOLVED: 'dns_unresolved',
-  TLS_HANDSHAKE_FAILED: 'tls_handshake_failed',
-  TLS_CERTIFICATE_INVALID: 'tls_certificate_invalid',
-  TUNNEL_CONNECTOR_UNAVAILABLE: 'tunnel_connector_unavailable',
-
-  CANCELLED: 'cancelled',
-  DEADLINE_EXCEEDED: 'deadline_exceeded',
-  EXECUTION_TIMEOUT: 'execution_timeout',
-  EXECUTION_FAILED: 'execution_failed',
-
-  PROVIDER_UNAVAILABLE: 'provider_unavailable',
-  MODEL_NOT_FOUND: 'model_not_found',
-  POLICY_BLOCKED: 'policy_blocked',
-  COPYRIGHT_BLOCKED: 'copyright_blocked',
-
-  PERSISTENCE_FAILED: 'persistence_failed',
-  DATA_CORRUPT: 'data_corrupt',
-  DATA_LOSS: 'data_loss',
-
-  REPOSITORY_SCOPE_VIOLATION: 'repository_scope_violation',
-  REPOSITORY_CHANGED: 'repository_changed',
-  INDEX_STALE: 'index_stale',
-  INDEX_FAILED: 'index_failed',
-  EMBEDDING_FAILED: 'embedding_failed',
-  VECTOR_STORE_FAILED: 'vector_store_failed',
-
-  CAD_CONSTRAINT_UNSATISFIED: 'cad_constraint_unsatisfied',
-  CAD_GEOMETRY_INVALID: 'cad_geometry_invalid',
-  CAD_KERNEL_FAILED: 'cad_kernel_failed',
-  CAD_EXPORT_FAILED: 'cad_export_failed',
-  CAD_RENDER_FAILED: 'cad_render_failed',
-
-  INTERNAL: 'internal',
-});
-
-const DEFAULT_HTTP_STATUS = Object.freeze({
-  [ERROR_CODE.CANCELLED]: 499,
-  [ERROR_CODE.UNKNOWN]: 500,
-  [ERROR_CODE.INVALID_ARGUMENT]: 400,
-  [ERROR_CODE.DEADLINE_EXCEEDED]: 504,
-  [ERROR_CODE.NOT_FOUND]: 404,
-  [ERROR_CODE.ALREADY_EXISTS]: 409,
-  [ERROR_CODE.PERMISSION_DENIED]: 403,
-  [ERROR_CODE.RESOURCE_EXHAUSTED]: 429,
-  [ERROR_CODE.FAILED_PRECONDITION]: 400,
-  [ERROR_CODE.ABORTED]: 409,
-  [ERROR_CODE.OUT_OF_RANGE]: 400,
-  [ERROR_CODE.UNIMPLEMENTED]: 501,
-  [ERROR_CODE.INTERNAL]: 500,
-  [ERROR_CODE.UNAVAILABLE]: 503,
-  [ERROR_CODE.DATA_LOSS]: 500,
-  [ERROR_CODE.UNAUTHENTICATED]: 401,
-});
-
-const HTTP_CODE_OVERRIDES = Object.freeze({
-  400: ERROR_CODE.INVALID_ARGUMENT,
-  401: ERROR_CODE.UNAUTHENTICATED,
-  403: ERROR_CODE.PERMISSION_DENIED,
-  404: ERROR_CODE.NOT_FOUND,
-  408: ERROR_CODE.DEADLINE_EXCEEDED,
-  409: ERROR_CODE.ABORTED,
-  412: ERROR_CODE.FAILED_PRECONDITION,
-  413: ERROR_CODE.RESOURCE_EXHAUSTED,
-  415: ERROR_CODE.INVALID_ARGUMENT,
-  422: ERROR_CODE.INVALID_ARGUMENT,
-  429: ERROR_CODE.RESOURCE_EXHAUSTED,
-  499: ERROR_CODE.CANCELLED,
-  500: ERROR_CODE.INTERNAL,
-  501: ERROR_CODE.UNIMPLEMENTED,
-  502: ERROR_CODE.UNAVAILABLE,
-  503: ERROR_CODE.UNAVAILABLE,
-  504: ERROR_CODE.DEADLINE_EXCEEDED,
-  520: ERROR_CODE.UNAVAILABLE,
-  521: ERROR_CODE.UNAVAILABLE,
-  522: ERROR_CODE.UNAVAILABLE,
-  523: ERROR_CODE.UNAVAILABLE,
-  524: ERROR_CODE.DEADLINE_EXCEEDED,
-  525: ERROR_CODE.UNAVAILABLE,
-  526: ERROR_CODE.UNAVAILABLE,
-  530: ERROR_CODE.UNAVAILABLE,
-});
-
-const GRPC_CODE_BY_NUMBER = new Map(Object.entries(GRPC_STATUS).map(([name, value]) => [value, ERROR_CODE[name]]));
-
-export function canonicalCodeFromHttpStatus(status) {
-  return HTTP_CODE_OVERRIDES[Number(status)] || (Number(status) >= 500 ? ERROR_CODE.INTERNAL : ERROR_CODE.UNKNOWN);
-}
-
-export function canonicalCodeFromGrpcStatus(status) {
-  return GRPC_CODE_BY_NUMBER.get(Number(status)) || ERROR_CODE.UNKNOWN;
-}
-
-export function defaultHttpStatusForCode(code) {
-  return DEFAULT_HTTP_STATUS[code] || 500;
-}
-
-export function grpcStatusForCode(code) {
-  return GRPC_STATUS[code] ?? GRPC_STATUS.UNKNOWN;
-}
-
+// Compatibility facade. Canonical runtime ownership lives in packages/agentsam-errors.
+import {
+  ERROR_CODE,
+  ERROR_REASON,
+} from '../../packages/agentsam-errors/src/vocabulary.js';
+import { canonicalCodeFromHttpStatus } from '../../packages/agentsam-errors/src/envelope.js';
+
+export {
+  ERROR_SCHEMA_VERSION,
+  ERROR_CODE,
+  ERROR_REASON,
+  ERROR_SEVERITY,
+  ERROR_SOURCE_KIND,
+  ERROR_RESOLUTION_OWNER,
+  ERROR_DOMAIN,
+  REMEDIATION_ACTION,
+  GRPC_STATUS,
+} from '../../packages/agentsam-errors/src/vocabulary.js';
+
+export {
+  canonicalCodeFromHttpStatus,
+  canonicalCodeFromGrpcStatus,
+  defaultHttpStatusForCode,
+  grpcStatusForCode,
+  createErrorEnvelope,
+  isErrorEnvelope,
+  assertErrorEnvelope,
+  serializeError,
+  parseError,
+} from '../../packages/agentsam-errors/src/envelope.js';
+
+// Legacy compact classifier shapes remain public here; richer envelope classifiers
+// live in packages/agentsam-errors and are available via the other adapter exports.
 export function classifyCloudflareFailure({ httpStatus, cloudflareCode } = {}) {
   const status = Number(httpStatus || 0) || null;
   const cf = Number(cloudflareCode || 0) || null;
@@ -184,7 +47,7 @@ export function classifyCloudflareFailure({ httpStatus, cloudflareCode } = {}) {
 
 export function classifyOAuthFailure(error) {
   switch (String(error || '').toLowerCase()) {
-    case 'invalid_client': return { code: ERROR_CODE.UNAUTHENTICATED, reason: ERROR_REASON.AUTH_INVALID, retryable: false };
+    case 'invalid_client':
     case 'invalid_grant': return { code: ERROR_CODE.UNAUTHENTICATED, reason: ERROR_REASON.AUTH_INVALID, retryable: false };
     case 'unauthorized_client':
     case 'access_denied': return { code: ERROR_CODE.PERMISSION_DENIED, reason: ERROR_REASON.PERMISSION_DENIED, retryable: false };
@@ -194,43 +57,3 @@ export function classifyOAuthFailure(error) {
     default: return { code: ERROR_CODE.UNKNOWN, reason: ERROR_REASON.UNKNOWN, retryable: false };
   }
 }
-
-export function createErrorEnvelope({
-  code = ERROR_CODE.UNKNOWN,
-  reason = ERROR_REASON.UNKNOWN,
-  message = 'Operation failed',
-  retryable = false,
-  retry_after_ms = null,
-  http_status = null,
-  grpc_status = null,
-  provider = null,
-  provider_code = null,
-  transport = null,
-  request_id = null,
-  trace_id = null,
-  resource = null,
-  details = null,
-} = {}) {
-  if (!Object.values(ERROR_CODE).includes(code)) throw new TypeError(`Unknown AgentSam error code: ${code}`);
-  if (!Object.values(ERROR_REASON).includes(reason)) throw new TypeError(`Unknown AgentSam error reason: ${reason}`);
-  const effectiveHttp = http_status == null ? defaultHttpStatusForCode(code) : Number(http_status);
-  const effectiveGrpc = grpc_status == null ? grpcStatusForCode(code) : Number(grpc_status);
-  return Object.freeze({
-    ok: false,
-    schema_version: ERROR_SCHEMA_VERSION,
-    code,
-    reason,
-    message: String(message || 'Operation failed'),
-    retryable: Boolean(retryable),
-    retry_after_ms: retry_after_ms == null ? null : Math.max(0, Number(retry_after_ms)),
-    http_status: Number.isInteger(effectiveHttp) ? effectiveHttp : null,
-    grpc_status: Number.isInteger(effectiveGrpc) ? effectiveGrpc : null,
-    provider: provider || null,
-    provider_code: provider_code || null,
-    transport: transport || null,
-    request_id: request_id || null,
-    trace_id: trace_id || null,
-    resource: resource || null,
-    details: details || null,
-  });
-}