@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/src/features/resolve.js

@@ -0,0 +1,242 @@
+/**
+ * Resolve `.agentsam/features.json` selections against package-local feature
+ * packets (via protocol/features/catalog.json discovery). Protocol holds only
+ * the generic capsule contract + catalog — not identity/provider detail trees.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const SDK_ROOT = path.resolve(HERE, '../..');
+const PROTOCOL_ROOT = path.join(SDK_ROOT, 'protocol');
+const OAUTH_PORTAL_DIR = path.join(
+  SDK_ROOT,
+  'packages/identity/.agentsam/features/oauth-login-portal',
+);
+
+function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+}
+
+function safeReadJson(filePath) {
+  if (!fs.existsSync(filePath)) return null;
+  return readJson(filePath);
+}
+
+export function protocolRoot(options = {}) {
+  return options.protocolRoot || PROTOCOL_ROOT;
+}
+
+export function oauthPortalDir(options = {}) {
+  return options.oauthPortalDir || OAUTH_PORTAL_DIR;
+}
+
+/** Canonical provider template ids. Legacy `iam` normalizes to `inneranimalmedia`. */
+export function normalizeProviderTemplateId(id) {
+  const key = String(id || '').trim().toLowerCase();
+  if (!key) return '';
+  if (key === 'iam') return 'inneranimalmedia';
+  return key;
+}
+
+export function loadFeatureCatalog(options = {}) {
+  return safeReadJson(path.join(protocolRoot(options), 'features', 'catalog.json'));
+}
+
+/** Load a feature capsule by id via catalog discovery, or absolute/relative manifest path. */
+export function loadFeatureManifest(featureId, options = {}) {
+  const catalog = loadFeatureCatalog(options);
+  const entry = (catalog?.features || []).find((row) => row.id === featureId);
+  if (!entry?.manifest) return null;
+  const manifestPath = path.isAbsolute(entry.manifest)
+    ? entry.manifest
+    : path.join(SDK_ROOT, entry.manifest);
+  return safeReadJson(manifestPath);
+}
+
+export function loadOAuthLoginPortalFeature(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'agentsam.feature.json'));
+}
+
+export function loadIdentityProviders(options = {}) {
+  const doc = safeReadJson(path.join(oauthPortalDir(options), 'providers.json'));
+  return doc?.providers || [];
+}
+
+export function getIdentityProviderTemplate(id, options = {}) {
+  const key = normalizeProviderTemplateId(id);
+  const providers = loadIdentityProviders(options);
+  return (
+    providers.find((row) => row.id === key) ||
+    providers.find((row) => Array.isArray(row.aliases) && row.aliases.includes(String(id || '').trim().toLowerCase())) ||
+    null
+  );
+}
+
+export function loadIdentityResources(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'resources.json'));
+}
+
+export function loadIdentityRoutes(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'routes.json'));
+}
+
+export function loadIdentityUi(options = {}) {
+  return safeReadJson(path.join(oauthPortalDir(options), 'ui.json'));
+}
+
+/** Compact summary for CLI status lines — real tables + migrations, no fake profile ids. */
+export function formatResourcesSummary(resources) {
+  if (!resources) return 'resources=(missing)';
+  const tables = (resources.tables || []).map((t) => t.name).filter(Boolean);
+  const migrations = resources.migration_sources || [];
+  const engine = resources.engine || 'unknown';
+  return `engine=${engine} tables=${tables.join(',') || '(none)'} migrations=${migrations.join(',') || '(none)'}`;
+}
+
+/**
+ * `agentsam identity schema` — print the package resources packet (migration SSOT).
+ * Optional id filters: d1 | identity | oauth-login-portal | (empty = default packet).
+ */
+export function loadSchemaProfile(id, options = {}) {
+  const key = String(id || '').trim().toLowerCase();
+  if (key === 'better-auth-postgres') {
+    return {
+      id: 'better-auth-postgres',
+      engine: 'postgres',
+      note: 'Owned by apps/local-studio — not part of packages/identity feature packet.',
+      source: 'apps/local-studio/backend/migrations/auth/0001_auth.sql',
+      tables: [],
+      migration_sources: ['apps/local-studio/backend/migrations/auth/0001_auth.sql'],
+    };
+  }
+  if (key && !['d1', 'identity', 'oauth-login-portal', 'resources', ''].includes(key)) {
+    return null;
+  }
+  return loadIdentityResources(options);
+}
+
+export function listSchemaProfiles(options = {}) {
+  const resources = loadIdentityResources(options);
+  const rows = [];
+  if (resources) rows.push(resources);
+  const studio = loadSchemaProfile('better-auth-postgres', options);
+  if (studio) rows.push(studio);
+  return rows;
+}
+
+export function featureStatePath(cwd) {
+  return path.join(cwd, '.agentsam', 'features.json');
+}
+
+export function featuresResolvedPath(cwd) {
+  return path.join(cwd, 'generated', '.agentsam', 'features-resolved.json');
+}
+
+export function readFeatureSelections(cwd) {
+  const file = featureStatePath(cwd);
+  if (!fs.existsSync(file)) {
+    return { schema_version: 2, features: {} };
+  }
+  const state = readJson(file);
+  return {
+    schema_version: Number(state.schema_version) || 1,
+    features: state.features && typeof state.features === 'object' ? state.features : {},
+  };
+}
+
+/**
+ * Resolve auth / identity.oauth-login-portal selection against the package packet.
+ * Resources come from resources.json (real tables + migration_sources) — not a pretend profile id.
+ */
+export function resolveAuthFeature(selection = {}, options = {}) {
+  const feature = loadOAuthLoginPortalFeature(options);
+  if (!feature) throw new Error('identity_oauth_login_portal_feature_missing');
+
+  const catalog = safeReadJson(path.join(oauthPortalDir(options), 'providers.json'));
+  const providerId = normalizeProviderTemplateId(
+    selection.provider_template ||
+    catalog?.default_provider ||
+    'inneranimalmedia',
+  );
+  const provider = getIdentityProviderTemplate(providerId, options);
+  if (!provider) throw new Error(`unknown_provider_template:${providerId}`);
+
+  const resources = loadIdentityResources(options);
+  if (!resources) throw new Error('identity_resources_missing');
+
+  return {
+    id: feature.id,
+    selected: selection.selected !== false,
+    capabilities: selection.capabilities || feature.provides || [],
+    provider_template: providerId,
+    selected_at: selection.selected_at || null,
+    feature: {
+      id: feature.id,
+      name: feature.name,
+      artifacts: feature.artifacts || [],
+      provides: feature.provides || [],
+    },
+    provider,
+    /** Actual portable Identity D1 resources — migration files remain SSOT. */
+    resources,
+    routes: loadIdentityRoutes(options),
+    ui: loadIdentityUi(options),
+  };
+}
+
+export function resolveFeatures(cwd, options = {}) {
+  const selections = options.selections || readFeatureSelections(cwd);
+  const resolved = {
+    schema: 'agentsam.features.resolved.v1',
+    schema_version: 2,
+    generated_at: new Date().toISOString(),
+    cwd: path.resolve(cwd),
+    selections: selections.features,
+    features: {},
+  };
+
+  for (const [id, selection] of Object.entries(selections.features || {})) {
+    if (!selection || selection.selected === false) continue;
+    if (id === 'auth' || id === 'identity.oauth-login-portal') {
+      resolved.features[id] = resolveAuthFeature(selection, options);
+    } else {
+      resolved.features[id] = {
+        id,
+        selected: true,
+        capabilities: selection.capabilities || [],
+        selected_at: selection.selected_at || null,
+        protocol: null,
+      };
+    }
+  }
+
+  return resolved;
+}
+
+export function writeFeaturesResolved(cwd, resolved = null, options = {}) {
+  const snapshot = resolved || resolveFeatures(cwd, options);
+  const outPath = featuresResolvedPath(cwd);
+  fs.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs.writeFileSync(outPath, `${JSON.stringify(snapshot, null, 2)}\n`, 'utf8');
+  return { path: outPath, snapshot };
+}
+
+export function writeFeatureSelections(cwd, state) {
+  const next = {
+    schema_version: 2,
+    features: state.features || {},
+  };
+  const file = featureStatePath(cwd);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
+  const { path: resolvedPath, snapshot } = writeFeaturesResolved(cwd, null, { selections: next });
+  return { state_path: file, resolved_path: resolvedPath, snapshot };
+}
+
+/** Back-compat alias used by older call sites */
+export function loadAuthFeature(options = {}) {
+  return loadOAuthLoginPortalFeature(options);
+}

package/src/go/build.js

@@ -0,0 +1,298 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gitEvidence } from '../knowledge/config.js';
+import { tryResolveGitContext } from '../repository/index.js';
+import { writeGoBuildReceipt } from './receipts.js';
+
+const NATIVE_PROBE_RUNNER = fileURLToPath(new URL('./native-probe-runner.mjs', import.meta.url));
+
+function ldflags(commit, source, builtAt) {
+  return [
+    '-s',
+    '-w',
+    '-X github.com/inneranimalmedia/agentsam-go-worker/internal/health.BuildCommit=' + (commit || ''),
+    '-X github.com/inneranimalmedia/agentsam-go-worker/internal/health.BuildSource=' + (source || ''),
+    '-X github.com/inneranimalmedia/agentsam-go-worker/internal/health.BuildTime=' + (builtAt || ''),
+  ].join(' ');
+}
+
+function readPackage(productRoot) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(productRoot, 'package.json'), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function sourceTreeDigest(runtimeRoot) {
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (entry.name.startsWith('.agentsam-build') || entry.name === '.agentsam-built-at') continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else if (entry.name === 'go.mod' || entry.name.endsWith('.go')) files.push(full);
+    }
+  };
+  walk(runtimeRoot);
+  files.sort();
+  const hash = createHash('sha256');
+  for (const file of files) {
+    hash.update(path.relative(runtimeRoot, file));
+    hash.update('\0');
+    hash.update(fs.readFileSync(file));
+    hash.update('\0');
+  }
+  return 'sha256:' + hash.digest('hex');
+}
+
+export function repositoryIdFromGitContext(context = null) {
+  if (!context?.repoFullName) return null;
+
+  const host = String(context.remoteHost || '').trim().toLowerCase();
+  const repoFullName = String(context.repoFullName).trim();
+
+  if (!repoFullName) return null;
+
+  // GitHub repository identity is canonical and case-insensitive.
+  if (host === 'github.com') {
+    return `github:${repoFullName.toLowerCase()}`;
+  }
+
+  // Preserve provider-qualified identity for non-GitHub remotes.
+  return host ? `${host}:${repoFullName}` : `git:${repoFullName}`;
+}
+
+export function resolveBuildSource({ productRoot, runtimeRoot, repositoryRoot } = {}) {
+  const git = gitEvidence(repositoryRoot || productRoot);
+  const pkg = readPackage(productRoot);
+  const treeDigest = sourceTreeDigest(runtimeRoot);
+  const repositoryContext = tryResolveGitContext({
+    cwd: repositoryRoot || productRoot,
+  });
+  let identity = null;
+  if (git.commit) identity = 'git:' + git.commit;
+  else if (pkg?.name && pkg?.version) identity = 'npm:' + pkg.name + '@' + pkg.version;
+  else identity = 'tree:' + treeDigest;
+
+  return {
+    identity,
+    commit: git.commit || null,
+    branch: git.branch || null,
+    dirty: Boolean(git.dirty),
+    package_name: pkg?.name || null,
+    package_version: pkg?.version || null,
+    tree_digest: treeDigest,
+    repository_id: git.commit ? repositoryIdFromGitContext(repositoryContext) : null,
+  };
+}
+
+export function portableReceiptPath(value, {
+  repositoryRoot = null,
+  stateRoot = null,
+  productRoot = null,
+  packageName = null,
+} = {}) {
+  if (!value) return null;
+
+  const absolute = path.resolve(value);
+
+  const candidate = (root) => {
+    if (!root) return null;
+    const rel = path.relative(path.resolve(root), absolute);
+    if (!rel || rel === '.') return '.';
+    if (rel.startsWith('..' + path.sep) || rel === '..' || path.isAbsolute(rel)) {
+      return null;
+    }
+    return rel.split(path.sep).join('/');
+  };
+
+  const repoRelative = candidate(repositoryRoot);
+  if (repoRelative) return repoRelative;
+
+  const stateRelative = candidate(stateRoot);
+  if (stateRelative) return stateRelative;
+
+  const productRelative = candidate(productRoot);
+  if (productRelative) {
+    const prefix = packageName
+      ? `package:${packageName}`
+      : 'package';
+    return `${prefix}/${productRelative}`;
+  }
+
+  // Never put an arbitrary absolute user path into a portable receipt.
+  return path.basename(absolute);
+}
+
+export function runGoTests(runtimeRoot, { spawn = spawnSync } = {}) {
+  const res = spawn('go', ['test', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
+  return { ok: res.status === 0, status: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
+}
+
+export function runGoVet(runtimeRoot, { spawn = spawnSync } = {}) {
+  const res = spawn('go', ['vet', './...'], { cwd: runtimeRoot, encoding: 'utf8' });
+  return { ok: res.status === 0, status: res.status, stdout: res.stdout || '', stderr: res.stderr || '' };
+}
+
+export function runGoBuild(runtimeRoot, {
+  outDir = null,
+  commit = '',
+  source = '',
+  builtAt = '',
+  spawn = spawnSync,
+} = {}) {
+  const binDir = outDir || path.join(runtimeRoot, '..', '.agentsam', 'go-build');
+  fs.mkdirSync(binDir, { recursive: true });
+  const identityHash = createHash('sha256').update(source || commit || 'dev').digest('hex').slice(0, 12);
+  const suffix = identityHash + '-' + process.pid + '-' + randomBytes(3).toString('hex');
+  const out = path.join(binDir, 'agentsam-go-worker-' + suffix);
+  const res = spawn('go', [
+    'build',
+    '-trimpath',
+    '-ldflags',
+    ldflags(commit, source, builtAt),
+    '-o',
+    out,
+    './cmd/server',
+  ], { cwd: runtimeRoot, encoding: 'utf8' });
+  return {
+    ok: res.status === 0,
+    status: res.status,
+    binary: res.status === 0 ? out : null,
+    stdout: res.stdout || '',
+    stderr: res.stderr || '',
+  };
+}
+
+export function sha256File(file) {
+  const hash = createHash('sha256');
+  hash.update(fs.readFileSync(file));
+  return 'sha256:' + hash.digest('hex');
+}
+
+export function runNativeRuntimeProbe(binary, {
+  expectedSource = '',
+  expectedCommit = '',
+  spawn = spawnSync,
+} = {}) {
+  if (!binary || !fs.existsSync(binary)) return { ok: false, error: 'binary_missing', results: {} };
+  const res = spawn(process.execPath, [NATIVE_PROBE_RUNNER, binary, expectedSource || '', expectedCommit || ''], {
+    encoding: 'utf8',
+    maxBuffer: 4 * 1024 * 1024,
+  });
+  let parsed = null;
+  try { parsed = JSON.parse(res.stdout || '{}'); } catch {}
+  return {
+    ok: res.status === 0 && parsed?.ok === true,
+    status: res.status,
+    ...(parsed || {}),
+    stdout: parsed ? '' : (res.stdout || ''),
+    stderr: ((parsed?.stderr || '') + (res.stderr || '')).trim(),
+  };
+}
+
+/**
+ * Build + test + boot the discovered Go runtime and emit deployment-grade
+ * source/artifact evidence. Git is authoritative in a maintainer checkout;
+ * an immutable npm package name/version is authoritative in distribution mode.
+ */
+export function buildGoProduct({
+  productRoot,
+  runtimeRoot,
+  repositoryRoot,
+  stateRoot = productRoot,
+  dryRun = false,
+} = {}) {
+  if (!runtimeRoot || !fs.existsSync(path.join(runtimeRoot, 'go.mod'))) {
+    throw new Error('go_runtime_missing');
+  }
+
+  const source = resolveBuildSource({ productRoot, runtimeRoot, repositoryRoot });
+  const builtAt = new Date().toISOString();
+
+  const tests = dryRun ? { ok: true, skipped: true } : runGoTests(runtimeRoot);
+  if (!tests.ok) {
+    const err = new Error('go_test_failed');
+    err.detail = tests;
+    throw err;
+  }
+
+  const vet = dryRun ? { ok: true, skipped: true } : runGoVet(runtimeRoot);
+  if (!vet.ok) {
+    const err = new Error('go_vet_failed');
+    err.detail = vet;
+    throw err;
+  }
+
+  const build = dryRun
+    ? { ok: true, skipped: true, binary: null }
+    : runGoBuild(runtimeRoot, {
+        outDir: path.join(stateRoot, '.agentsam', 'go-build'),
+        commit: source.commit,
+        source: source.identity,
+        builtAt,
+      });
+  if (!build.ok) {
+    const err = new Error('go_build_failed');
+    err.detail = build;
+    throw err;
+  }
+
+  const probe = dryRun
+    ? { ok: true, skipped: true, results: {} }
+    : runNativeRuntimeProbe(build.binary, {
+        expectedSource: source.identity,
+        expectedCommit: source.commit,
+      });
+  if (!probe.ok) {
+    const err = new Error('go_runtime_probe_failed');
+    err.detail = probe;
+    throw err;
+  }
+
+  let goVersion = null;
+  try {
+    goVersion = spawnSync('go', ['env', 'GOVERSION'], { encoding: 'utf8' }).stdout?.trim() || null;
+  } catch {}
+
+  const receipt = {
+    schema: 'agentsam.go-build-receipt.v1',
+    product: path.basename(productRoot),
+    runtime: {
+      language: 'go',
+      version: goVersion,
+      module_root: portableReceiptPath(runtimeRoot, {
+        repositoryRoot,
+        stateRoot,
+        productRoot,
+        packageName: source.package_name,
+      }),
+    },
+    source,
+    artifact: {
+      type: build.binary ? 'binary' : 'none',
+      path: portableReceiptPath(build.binary, {
+        repositoryRoot,
+        stateRoot,
+        productRoot,
+        packageName: source.package_name,
+      }),
+      digest: build.binary ? sha256File(build.binary) : null,
+    },
+    tests: {
+      go_test: Boolean(tests.ok),
+      go_vet: Boolean(vet.ok),
+      runtime_probe: Boolean(probe.ok),
+    },
+    probe,
+    target: { provider: 'local', kind: 'build' },
+    built_at: builtAt,
+  };
+
+  const receiptPath = writeGoBuildReceipt(stateRoot, receipt);
+  return { receipt, receiptPath, tests, vet, build, probe, source };
+}