@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.4

package/packages/identity/tests/identity-service.test.mjs

@@ -1,7 +1,29 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+import {
+  createRouteRegistry,
+  defineRouteProjection,
+} from '../src/contracts/route-projection.js';
 import { createIdentityService } from '../src/server/identity-service.js';
 
+function createTestRouting() {
+  const app = { id: 'identity-test-app' };
+  const routeRegistry = createRouteRegistry([
+    defineRouteProjection({
+      appId: app.id,
+      routes: {
+        [IDENTITY_ROUTE_IDS.LOGIN]: '/auth/login',
+        [IDENTITY_ROUTE_IDS.RECOVERY]: '/auth/reset',
+        [IDENTITY_ROUTE_IDS.APP_AUTHENTICATED]: '/agentsam',
+        [IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]: '/api/oauth/:provider/callback',
+        'app.mount./projects': { path: '/projects', auth: 'required' },
+      },
+    }),
+  ]);
+  return { app, routeRegistry };
+}
+
 function createMemoryAdapter() {
   const users = new Map();
   const sessions = new Map();
@@ -66,10 +88,12 @@ function createMemoryAdapter() {
 }
 
 describe('identity service', () => {
-  it('owns its fallback and rejects external OAuth return targets', () => {
+  it('owns its projected fallback and rejects external OAuth return targets', () => {
+    const { app, routeRegistry } = createTestRouting();
     const identity = createIdentityService({
       adapter: createMemoryAdapter(),
-      defaultRedirect: '/agentsam',
+      app,
+      routeRegistry,
     });
 
     assert.equal(identity.resolvePostLoginPath('/projects?tab=recent'), '/projects?tab=recent');
@@ -77,12 +101,19 @@ describe('identity service', () => {
     assert.equal(identity.resolvePostLoginPath('//attacker.example/'), '/agentsam');
     assert.equal(identity.resolvePostLoginPath(null), '/agentsam');
 
-    const neutral = createIdentityService({ adapter: createMemoryAdapter() });
-    assert.equal(neutral.resolvePostLoginPath(null), '/');
+    assert.throws(
+      () => createIdentityService({ adapter: createMemoryAdapter() }),
+      (error) => error?.code === 'AUTH_APP_UNRESOLVED',
+    );
   });
 
   it('signup and login issue session', async () => {
-    const identity = createIdentityService({ adapter: createMemoryAdapter() });
+    const { app, routeRegistry } = createTestRouting();
+    const identity = createIdentityService({
+      adapter: createMemoryAdapter(),
+      app,
+      routeRegistry,
+    });
     const signup = await identity.signup({
       email: 'user@example.com',
       password: 'secret-pass',

package/packages/identity/tests/oauth-credentials.test.mjs

@@ -42,8 +42,10 @@ describe('oauth credentials', () => {
     const lane = resolveOAuthCredentialLane(env, 'google');
     assert.equal(lane?.lane, 'byok_google');
     assert.equal(lane?.clientId, 'google-byok');
-    // IAM start path still resolves IAM
+    // IAM / inneranimalmedia start path still resolves platform lane
     assert.equal(resolveOAuthCredentialLane(env, 'iam')?.lane, 'iam_platform');
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.provider, 'inneranimalmedia');
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.lane, 'iam_platform');
   });
 
   it('prefers IAM_OAUTH_ISSUER and exposes issuer as the canonical authority', () => {

package/packages/identity/tests/portable-identity-architecture.test.mjs

@@ -0,0 +1,157 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { createLocalSqliteDatabase } from '../../../src/local/sqlite.js';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+import {
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from '../src/contracts/route-projection.js';
+import { IdentityRoutingError } from '../src/contracts/identity-store.js';
+import { resolvePostAuthDestination } from '../src/server/post-auth.js';
+import {
+  applySqliteIdentityMigrations,
+  createSqliteIdentityAdapter,
+} from '../src/adapters/sqlite/index.js';
+import { createIdentityService } from '../src/server/identity-service.js';
+import { verifyAppPackage, verifyAppAuthContract } from '../src/app/verify-app.js';
+import { SESSION_POLICY } from '../src/core/session-policy.js';
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
+const LOCAL_STUDIO = path.join(REPO, 'apps/local-studio');
+
+describe('IDENTITY_ROUTE_IDS (portable semantics)', () => {
+  it('exports semantic IDs only — no host paths', () => {
+    assert.equal(IDENTITY_ROUTE_IDS.LOGIN, 'identity.login');
+    assert.equal(IDENTITY_ROUTE_IDS.APP_AUTHENTICATED, 'app.authenticated');
+    assert.equal(IDENTITY_ROUTE_IDS.OAUTH_CALLBACK, 'identity.oauth.callback');
+    for (const v of Object.values(IDENTITY_ROUTE_IDS)) {
+      assert.equal(v.includes('/'), false, `path leaked into portable ID: ${v}`);
+    }
+  });
+});
+
+describe('route projection + fail-closed post-auth', () => {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(LOCAL_STUDIO, 'agentsam.app.json'), 'utf8'),
+  );
+  const projection = projectionFromAppManifest(manifest);
+  const routeRegistry = createRouteRegistry([projection]);
+  const app = { id: 'local-studio' };
+
+  it('host projection maps identity.login → /auth/login', () => {
+    assert.equal(routeRegistry.resolve('local-studio', IDENTITY_ROUTE_IDS.LOGIN), '/auth/login');
+    assert.equal(
+      routeRegistry.resolve('local-studio', IDENTITY_ROUTE_IDS.APP_AUTHENTICATED),
+      '/agentsam',
+    );
+  });
+
+  it('resumes validated return_to', () => {
+    assert.equal(
+      resolvePostAuthDestination({
+        transaction: { app_id: 'local-studio', return_to: '/projects/abc' },
+        app,
+        routeRegistry,
+      }),
+      '/projects/abc',
+    );
+  });
+
+  it('falls back to authenticated entry — never /', () => {
+    assert.equal(
+      resolvePostAuthDestination({ transaction: {}, app, routeRegistry }),
+      '/agentsam',
+    );
+  });
+
+  it('throws AUTH_APP_UNRESOLVED without app', () => {
+    assert.throws(
+      () => resolvePostAuthDestination({ transaction: {}, app: null, routeRegistry }),
+      (err) => err instanceof IdentityRoutingError && err.code === 'AUTH_APP_UNRESOLVED',
+    );
+  });
+
+  it('rejects cross-app return_to then uses authenticated entry', () => {
+    assert.equal(
+      resolvePostAuthDestination({
+        transaction: { return_to: '/admin/orders' },
+        app,
+        routeRegistry,
+      }),
+      '/agentsam',
+    );
+  });
+});
+
+describe('app verification', () => {
+  it('local-studio agentsam.app.json passes auth contract', () => {
+    const result = verifyAppPackage(LOCAL_STUDIO, { requireShellFiles: false });
+    assert.equal(result.ok, true, result.errors?.join('; '));
+  });
+
+  it('fails when authenticated entry missing', () => {
+    const result = verifyAppAuthContract({
+      schema: 'agentsam.app.v1',
+      id: 'broken',
+      name: 'Broken',
+      auth: { entry: { login: 'identity.login' } },
+      routes: { 'identity.login': { path: '/signin' } },
+    }, { requireShellFiles: false });
+    assert.equal(result.ok, false);
+    assert.ok(result.errors.some((e) => /authenticated|missing|AUTH_/i.test(e)));
+  });
+});
+
+describe('local-only SQLite identity (zero cloud)', () => {
+  it('migrates, provisions password user, OAuth transaction with app_id', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-id-'));
+    const dbFile = path.join(dir, 'identity.sqlite');
+    const db = await createLocalSqliteDatabase(dbFile);
+    await applySqliteIdentityMigrations(db);
+
+    const adapter = createSqliteIdentityAdapter(db);
+    const manifest = JSON.parse(
+      fs.readFileSync(path.join(LOCAL_STUDIO, 'agentsam.app.json'), 'utf8'),
+    );
+    const routeRegistry = createRouteRegistry([projectionFromAppManifest(manifest)]);
+    const identity = createIdentityService({
+      adapter,
+      app: { id: 'local-studio' },
+      routeRegistry,
+    });
+
+    const signup = await identity.signup({
+      email: 'local@example.test',
+      password: 'test-password-ok',
+      displayName: 'Local',
+    });
+    assert.equal(signup.ok, true);
+    assert.ok(signup.sessionId);
+
+    await adapter.createOAuthTransaction({
+      state: 'st_test',
+      provider: 'cloudflare',
+      codeVerifier: 'verifier',
+      returnTo: '/agentsam',
+      appId: 'local-studio',
+    });
+    const tx = await adapter.consumeOAuthTransaction('st_test');
+    assert.equal(tx.app_id, 'local-studio');
+    assert.equal(tx.return_to, '/agentsam');
+
+    await assert.rejects(
+      () => adapter.createOAuthTransaction({
+        state: 'st_bad',
+        provider: 'cloudflare',
+        codeVerifier: 'v',
+        returnTo: '/agentsam',
+      }),
+    );
+
+    assert.equal(SESSION_POLICY.agent.defaultTtlSeconds, 900);
+  });
+});

package/packages/identity/tests/session-routes-policy.test.mjs

@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { SESSION_POLICY, clampAgentSessionTtl } from '../src/core/session-policy.js';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+
+describe('SESSION_POLICY', () => {
+  it('keeps browser and agent TTLs distinct', () => {
+    assert.equal(SESSION_POLICY.browser.ttlSeconds, 30 * 24 * 60 * 60);
+    assert.equal(SESSION_POLICY.agent.defaultTtlSeconds, 15 * 60);
+    assert.equal(clampAgentSessionTtl(30), 60);
+    assert.equal(clampAgentSessionTtl(900), 900);
+    assert.equal(clampAgentSessionTtl(999999), 24 * 60 * 60);
+  });
+});
+
+describe('IDENTITY_ROUTE_IDS', () => {
+  it('exposes semantic IDs only', () => {
+    assert.equal(IDENTITY_ROUTE_IDS.LOGIN, 'identity.login');
+    assert.ok(!String(IDENTITY_ROUTE_IDS.LOGIN).startsWith('/'));
+  });
+});

package/packages/theme-church-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "church-site",
     "galleryPath": "apps/theme-gallery-preview/themes/church-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-church-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "New Iberia Church of Christ",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-church-site",
   "category": "Community",
   "industries": [

package/packages/theme-companions-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "companions-site",
     "galleryPath": "apps/theme-gallery-preview/themes/companions-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-companions-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "Companions of Caddo",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-companions-site",
   "category": "Community",
   "industries": [

package/packages/theme-floors-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "floors-site",
     "galleryPath": "apps/theme-gallery-preview/themes/floors-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-floors-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "Anything Floors & More",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-floors-site",
   "category": "Services",
   "industries": [

package/packages/theme-fuelnfree-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "fuelnfree-site",
     "galleryPath": "apps/theme-gallery-preview/themes/fuelnfree-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-fuelnfree-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "Fuel & Free Time",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-fuelnfree-site",
   "category": "Commerce",
   "industries": [

package/packages/theme-handyman-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "handyman-site",
     "galleryPath": "apps/theme-gallery-preview/themes/handyman-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-handyman-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "Primeaux Handyman Services",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-handyman-site",
   "category": "Services",
   "industries": [

package/packages/theme-insurance-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "insurance-site",
     "galleryPath": "apps/theme-gallery-preview/themes/insurance-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-insurance-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "Chrystal Clear Insurance",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-insurance-site",
   "category": "Professional",
   "industries": [

package/packages/theme-shinshu-site/package.json

@@ -25,6 +25,7 @@
     "kind": "theme",
     "slug": "shinshu-site",
     "galleryPath": "apps/theme-gallery-preview/themes/shinshu-site",
-    "installable": true
+    "installable": true,
+    "icon": "theme"
   }
 }

package/packages/theme-shinshu-site/src/index.js

@@ -5,6 +5,7 @@ const THEME = {
   "displayName": "Shinshu Solutions",
   "version": "0.1.0",
   "kind": "gallery-theme",
+  "icon": "theme",
   "package": "@inneranimalmedia/theme-shinshu-site",
   "category": "Professional",
   "industries": [

package/protocol/apps/agentsam.app.v1.schema.json

@@ -0,0 +1,51 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentsam.inneranimalmedia.com/protocol/apps/agentsam.app.v1.schema.json",
+  "title": "agentsam.app.v1",
+  "description": "Installable AgentSam product app. Owns its routes/runtime; identity never hardcodes product URLs.",
+  "type": "object",
+  "required": ["schema", "id", "name"],
+  "properties": {
+    "schema": { "const": "agentsam.app.v1" },
+    "id": { "type": "string", "minLength": 1 },
+    "name": { "type": "string", "minLength": 1 },
+    "package": { "type": "string" },
+    "version": { "type": "string" },
+    "routes": {
+      "type": "object",
+      "properties": {
+        "entry": {
+          "type": "string",
+          "description": "Authenticated entry path after login when no return_to exists",
+          "pattern": "^/"
+        },
+        "mounts": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["path"],
+            "properties": {
+              "path": { "type": "string", "pattern": "^/" },
+              "auth": { "enum": ["required", "optional", "public"], "default": "public" },
+              "spa": { "type": "boolean" },
+              "shell": {
+                "type": "string",
+                "description": "Build artifact relative to assetRoot (must exist after build)"
+              }
+            }
+          }
+        }
+      }
+    },
+    "runtime": {
+      "type": "object",
+      "properties": {
+        "type": { "enum": ["spa", "ssr", "static"] },
+        "assetRoot": { "type": "string" },
+        "shell": { "type": "string" }
+      },
+      "additionalProperties": true
+    }
+  },
+  "additionalProperties": true
+}

package/protocol/brand/brandpack.v1.schema.json

@@ -0,0 +1,43 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentsam.inneranimalmedia.com/protocol/brand/brandpack.v1.schema.json",
+  "title": "AgentSamBrandPack",
+  "type": "object",
+  "required": ["schema", "id"],
+  "properties": {
+    "schema": { "const": "agentsam.brandpack.v1" },
+    "id": { "type": "string" },
+    "label": { "type": "string" },
+    "source": {
+      "type": "object",
+      "properties": {
+        "repository_id": { "type": ["string", "null"] },
+        "snapshot_id": { "type": ["string", "null"] },
+        "materials": { "type": "array" }
+      }
+    },
+    "identity": { "type": "object" },
+    "tokens": {
+      "type": "object",
+      "properties": {
+        "palette": { "type": "object" },
+        "semantic": { "type": "object" },
+        "typography": { "type": "object" },
+        "spacing": { "type": "object" },
+        "geometry": { "type": "object" },
+        "effects": { "type": "object" }
+      }
+    },
+    "assets": { "type": "array" },
+    "components": { "type": "array" },
+    "sections": { "type": "array" },
+    "layouts": { "type": "array" },
+    "pages": { "type": "array" },
+    "theme_variants": { "type": "array" },
+    "content_refs": { "type": "array" },
+    "url_refs": { "type": "array" },
+    "evidence": { "type": "array" },
+    "conflicts": { "type": "array" },
+    "provenance": { "type": "array" }
+  }
+}

package/protocol/credentials/issue.v1.schema.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentsam.inneranimalmedia.com/protocol/credentials/issue.v1.schema.json",
+  "title": "credentials.issue",
+  "description": "Mint an AgentSam API credential (aak_*). Host stores hash only; secret returned once.",
+  "type": "object",
+  "required": ["operation", "input", "output"],
+  "properties": {
+    "operation": { "const": "credentials.issue" },
+    "input": {
+      "type": "object",
+      "required": ["account_id", "name"],
+      "properties": {
+        "account_id": { "type": "string", "minLength": 1 },
+        "name": { "type": "string", "minLength": 1 },
+        "scopes": {
+          "type": "array",
+          "items": { "type": "string" },
+          "description": "Semantic capability scopes (e.g. repository:read, models:invoke)"
+        },
+        "environment": { "enum": ["development", "preview", "production"] },
+        "expires_at": { "type": ["string", "null"], "format": "date-time" },
+        "client_type": { "enum": ["cli", "ci", "agent", "integration"] }
+      }
+    },
+    "output": {
+      "type": "object",
+      "required": ["credential_id", "prefix", "secret_once", "created_at"],
+      "properties": {
+        "credential_id": { "type": "string" },
+        "prefix": { "type": "string" },
+        "secret_once": { "type": "string", "description": "Plaintext shown once; never stored by host" },
+        "scopes": { "type": "array", "items": { "type": "string" } },
+        "created_at": { "type": "string", "format": "date-time" }
+      }
+    }
+  }
+}

package/protocol/database/connection.v1.schema.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentsam.database-connection.v1",
+  "title": "AgentSamDatabaseConnection",
+  "type": "object",
+  "required": ["id", "engine", "provider", "connection"],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "agentsam.database-connection.v1" },
+    "id": { "type": "string", "minLength": 1 },
+    "label": { "type": "string" },
+    "engine": { "enum": ["sqlite", "postgres", "mysql"] },
+    "provider": {
+      "enum": ["local", "cloudflare-d1", "supabase", "postgres", "mysql"]
+    },
+    "account_id": { "type": "string", "description": "Optional hosted owner. Never workspace_id." },
+    "connection": { "type": "object" },
+    "accelerator": {
+      "type": "object",
+      "required": ["driver", "configurationId"],
+      "properties": {
+        "driver": { "const": "hyperdrive" },
+        "configurationId": { "type": "string" },
+        "localConnectionStringRef": { "type": "string" }
+      }
+    },
+    "vectors": {
+      "type": "object",
+      "required": ["driver"],
+      "properties": {
+        "driver": {
+          "enum": ["none", "sqlite_exact", "sqlite_vector", "pgvector", "vectorize"]
+        },
+        "profileId": { "type": "string" },
+        "indexName": { "type": "string" },
+        "namespace": { "type": "string" }
+      }
+    },
+    "created_at": { "type": "string" }
+  }
+}

package/protocol/embeddings/embedding-profile.v1.schema.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "agentsam.embedding-profile.v1",
+  "title": "AgentSamEmbeddingProfile",
+  "type": "object",
+  "required": ["schema", "id", "provider", "dimensions", "revision", "fingerprint"],
+  "additionalProperties": false,
+  "properties": {
+    "schema": { "const": "agentsam.embedding-profile.v1" },
+    "id": { "type": "string" },
+    "provider": { "type": "string" },
+    "model": { "type": ["string", "null"] },
+    "dimensions": { "type": "integer", "minimum": 1 },
+    "revision": { "type": "string" },
+    "parameters": { "type": "object" },
+    "fingerprint": { "type": "string" },
+    "experimental": { "type": "boolean" },
+    "locality": { "enum": ["local", "remote", "none"] }
+  }
+}