@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.4

package/src/go/container.js

@@ -0,0 +1,120 @@
+import { spawnSync } from 'node:child_process';
+import { probeGoDeploymentWithRetry } from './cloudflare.js';
+
+function runDocker(args, { productRoot, spawn = spawnSync } = {}) {
+  const res = spawn('docker', args, {
+    cwd: productRoot,
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+  });
+  return {
+    status: res.status,
+    stdout: res.stdout || '',
+    stderr: res.stderr || '',
+    output: ((res.stdout || '') + '\n' + (res.stderr || '')).trim(),
+  };
+}
+
+export async function verifyGoContainer({
+  productRoot,
+  product = 'agentsam-go-worker',
+  expectedSource,
+  expectedSourceCommit,
+  expectedBuiltAt = '',
+  spawn = spawnSync,
+  fetchImpl = globalThis.fetch,
+} = {}) {
+  const tag = product + ':agentsam-verify';
+  const build = runDocker(['build', '--platform', 'linux/amd64', '-t', tag, '.'], { productRoot, spawn });
+  if (build.status !== 0) {
+    const err = new Error('go_container_build_failed');
+    err.detail = build.output.slice(-4000);
+    throw err;
+  }
+
+  const inspected = runDocker(['image', 'inspect', tag], { productRoot, spawn });
+  if (inspected.status !== 0) throw new Error('go_container_inspect_failed');
+  let image = null;
+  try { image = JSON.parse(inspected.stdout)?.[0] || null; } catch {}
+  if (!image) throw new Error('go_container_inspect_invalid');
+  if (image.Architecture !== 'amd64') throw new Error('go_container_architecture_invalid');
+  const imageUser = String(image.Config?.User || '');
+  if (!imageUser || imageUser === '0' || imageUser === 'root' || imageUser.startsWith('0:')) {
+    throw new Error('go_container_root_user_forbidden');
+  }
+
+  const name = product + '-verify-' + process.pid + '-' + Date.now();
+  const start = runDocker([
+    'run', '-d', '--name', name,
+    '-p', '127.0.0.1::8080',
+    '-e', 'AGENTSAM_TARGET=container',
+    '-e', 'AGENTSAM_BUILD_SOURCE=' + (expectedSource || ''),
+    '-e', 'AGENTSAM_BUILD_COMMIT=' + (expectedSourceCommit || ''),
+    '-e', 'AGENTSAM_BUILT_AT=' + expectedBuiltAt,
+    tag,
+  ], { productRoot, spawn });
+  if (start.status !== 0) {
+    const err = new Error('go_container_start_failed');
+    err.detail = start.output.slice(-3000);
+    throw err;
+  }
+
+  const containerId = start.stdout.trim();
+  let stopped = false;
+  let cleaned = false;
+  try {
+    let port = null;
+    for (let attempt = 0; attempt < 30; attempt += 1) {
+      const mapped = runDocker(['port', containerId, '8080/tcp'], { productRoot, spawn });
+      const match = mapped.stdout.match(/:(\d+)\s*$/m);
+      if (mapped.status === 0 && match) {
+        port = Number(match[1]);
+        break;
+      }
+      await new Promise((resolve) => setTimeout(resolve, 100));
+    }
+    if (!port) throw new Error('go_container_port_missing');
+
+    const origin = 'http://127.0.0.1:' + port;
+    const probe = await probeGoDeploymentWithRetry(origin, {
+      fetchImpl,
+      expectedSource,
+      expectedSourceCommit,
+      expectedTarget: 'container',
+      edge: false,
+      attempts: 20,
+      delayMs: 250,
+    });
+    if (!probe.ok) {
+      const err = new Error('go_container_probe_failed');
+      err.detail = probe;
+      throw err;
+    }
+
+    const stop = runDocker(['stop', '-t', '5', containerId], { productRoot, spawn });
+    stopped = stop.status === 0;
+    if (!stopped) throw new Error('go_container_stop_failed');
+    const cleanup = runDocker(['container', 'rm', containerId], { productRoot, spawn });
+    cleaned = cleanup.status === 0;
+    if (!cleaned) throw new Error('go_container_cleanup_failed');
+
+    return {
+      ok: true,
+      tag,
+      name,
+      image_digest: image.Id || null,
+      architecture: image.Architecture,
+      os: image.Os || null,
+      user: imageUser,
+      container_id: containerId,
+      clean_shutdown: true,
+      clean_cleanup: true,
+      probe,
+      retained_stopped_container: false,
+      build_output: build.output.slice(-2000),
+    };
+  } finally {
+    if (!stopped) runDocker(['stop', '-t', '1', containerId], { productRoot, spawn });
+    if (!cleaned) runDocker(['container', 'rm', containerId], { productRoot, spawn });
+  }
+}

package/src/go/contract.js

@@ -15,15 +15,23 @@ const PACKAGE_TEMPLATE = {
     worker: './worker/src/index.js',
   },
   capabilities: ['hash', 'inspect', 'runtime', 'capabilities'],
+  distribution: {
+    package: '@inneranimalmedia/agentsam-go-worker',
+    normal_user: 'official-hosted-service',
+    self_host: 'advanced-opt-in',
+  },
   deployment: {
     adapter: 'cloudflare',
     mode: 'worker-container',
     wrangler_config: './wrangler.jsonc',
+    authority: 'explicit-cloudflare-account',
   },
   product: {
     slug: DEFAULT_PRODUCT,
     kind: 'service',
-    registry: 'agentsam_products',
+    registry: 'local-by-default',
+    official_registry: 'agentsam_products',
+    official_registry_only: true,
   },
 };
 
@@ -111,9 +119,6 @@ export function preflightToolchain({ requireDocker = false, productRoot = null }
     push('docker', false, e.message);
   }
 
-  const token = Boolean(process.env.CLOUDFLARE_API_TOKEN || process.env.CF_API_TOKEN);
-  push('cloudflare_auth', token || Boolean(process.env.CLOUDFLARE_ACCOUNT_ID), token ? 'token_present' : 'account_or_token_missing');
-
   const failed = checks.filter((c) => {
     if (c.ok) return false;
     if (c.id === 'docker' && !requireDocker) return false;

package/src/go/discover.js

@@ -1,45 +1,132 @@
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
 import { fileURLToPath } from 'node:url';
 import { execFileSync } from 'node:child_process';
 import { repositoryRoot, gitEvidence } from '../knowledge/config.js';
 
 const HERE = path.dirname(fileURLToPath(import.meta.url));
+const MODULE_REQUIRE = createRequire(import.meta.url);
 export const SDK_ROOT = path.resolve(HERE, '../..');
 export const DEFAULT_PRODUCT = 'agentsam-go-worker';
 export const DEFAULT_PRODUCT_REL = path.join('apps', DEFAULT_PRODUCT);
+export const GO_WORKER_PACKAGE = '@inneranimalmedia/agentsam-go-worker';
+
+function readJSON(file) {
+  try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+}
+
+function normalizeExplicitProductRoot(value) {
+  if (!value) return null;
+  const resolved = path.resolve(value);
+  if (!fs.existsSync(resolved)) return null;
+  if (path.basename(resolved) === 'runtime' && fs.existsSync(path.join(resolved, 'go.mod'))) {
+    return path.dirname(resolved);
+  }
+  return resolved;
+}
+
+function packageRootFrom(requireFn) {
+  try {
+    return path.dirname(requireFn.resolve(GO_WORKER_PACKAGE + '/package.json'));
+  } catch {
+    return null;
+  }
+}
+
+function cwdRequire(cwd) {
+  try {
+    return createRequire(path.join(path.resolve(cwd), 'package.json'));
+  } catch {
+    return null;
+  }
+}
+
+function runtimeCandidate(productRoot, origin) {
+  if (!productRoot) return null;
+  const runtimeRoot = path.join(productRoot, 'runtime');
+  const modPath = path.join(runtimeRoot, 'go.mod');
+  if (!fs.existsSync(modPath)) return null;
+  const mod = fs.readFileSync(modPath, 'utf8');
+  const moduleMatch = mod.match(/^module\s+(\S+)/m);
+  const serverMain = path.join(runtimeRoot, 'cmd', 'server', 'main.go');
+  const packageJson = path.join(productRoot, 'package.json');
+  return {
+    origin,
+    runtimeRoot,
+    module: moduleMatch?.[1] || null,
+    goMod: modPath,
+    entry: fs.existsSync(serverMain) ? serverMain : findFirstGoMain(runtimeRoot),
+    productRoot,
+    packageManifest: path.join(productRoot, 'agentsam.package.json'),
+    packageJson,
+    package: readJSON(packageJson),
+  };
+}
+
+function legacyRuntimeCandidate(runtimeRoot, origin) {
+  const modPath = path.join(runtimeRoot, 'go.mod');
+  if (!fs.existsSync(modPath)) return null;
+  const mod = fs.readFileSync(modPath, 'utf8');
+  const moduleMatch = mod.match(/^module\s+(\S+)/m);
+  const productRoot = path.basename(runtimeRoot) === 'runtime' ? path.dirname(runtimeRoot) : runtimeRoot;
+  return {
+    origin,
+    runtimeRoot,
+    module: moduleMatch?.[1] || null,
+    goMod: modPath,
+    entry: findFirstGoMain(runtimeRoot),
+    productRoot,
+    packageManifest: path.join(productRoot, 'agentsam.package.json'),
+    packageJson: path.join(productRoot, 'package.json'),
+    package: readJSON(path.join(productRoot, 'package.json')),
+  };
+}
 
 /**
- * Locate AgentSam Go runtime source without inventing a second implementation.
- * Prefers apps/agentsam-go-worker/runtime; otherwise any go.mod that declares agentsam-go-worker.
+ * Locate the one AgentSam Go service implementation without assuming the SDK
+ * development checkout ships inside the root npm package.
+ *
+ * Resolution order:
+ *   1. explicit AGENTSAM_GO_WORKER_ROOT
+ *   2. current repository apps/agentsam-go-worker (maintainer/contributor mode)
+ *   3. installed @inneranimalmedia/agentsam-go-worker package (distribution mode)
+ *   4. SDK development tree when present
+ *   5. narrow legacy runtime candidates
  */
 export function discoverGoRuntime(cwd = process.cwd()) {
   const root = repositoryRoot(cwd);
-  const candidates = [
-    path.join(root, DEFAULT_PRODUCT_REL, 'runtime'),
-    path.join(SDK_ROOT, DEFAULT_PRODUCT_REL, 'runtime'),
-    path.join(root, 'runtime'),
-    path.join(root, 'cmd', 'agentsam'),
+  const req = cwdRequire(cwd);
+  const productCandidates = [
+    [normalizeExplicitProductRoot(process.env.AGENTSAM_GO_WORKER_ROOT), 'explicit'],
+    [path.join(root, DEFAULT_PRODUCT_REL), 'repository'],
+    [req ? packageRootFrom(req) : null, 'installed_package'],
+    [packageRootFrom(MODULE_REQUIRE), 'installed_package'],
+    [path.join(SDK_ROOT, DEFAULT_PRODUCT_REL), 'sdk_development_tree'],
   ];
 
   const found = [];
-  for (const runtimeRoot of candidates) {
-    const modPath = path.join(runtimeRoot, 'go.mod');
-    if (!fs.existsSync(modPath)) continue;
-    const mod = fs.readFileSync(modPath, 'utf8');
-    const moduleMatch = mod.match(/^module\s+(\S+)/m);
-    const serverMain = path.join(runtimeRoot, 'cmd', 'server', 'main.go');
-    const entry = fs.existsSync(serverMain)
-      ? serverMain
-      : findFirstGoMain(runtimeRoot);
-    found.push({
-      runtimeRoot,
-      module: moduleMatch?.[1] || null,
-      goMod: modPath,
-      entry,
-      productRoot: path.dirname(runtimeRoot),
-      packageManifest: path.join(path.dirname(runtimeRoot), 'agentsam.package.json'),
-    });
+  const seen = new Set();
+  for (const [productRoot, origin] of productCandidates) {
+    if (!productRoot) continue;
+    let real;
+    try { real = fs.realpathSync(productRoot); } catch { continue; }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    const candidate = runtimeCandidate(real, origin);
+    if (candidate) found.push(candidate);
+  }
+
+  for (const [runtimeRoot, origin] of [
+    [path.join(root, 'runtime'), 'legacy_repository_runtime'],
+    [path.join(root, 'cmd', 'agentsam'), 'legacy_repository_cmd'],
+  ]) {
+    let real;
+    try { real = fs.realpathSync(runtimeRoot); } catch { continue; }
+    if (seen.has(real)) continue;
+    seen.add(real);
+    const candidate = legacyRuntimeCandidate(real, origin);
+    if (candidate) found.push(candidate);
   }
 
   const preferred = found.find((row) => row.module?.includes('agentsam-go-worker')) || found[0] || null;
@@ -47,7 +134,7 @@ export function discoverGoRuntime(cwd = process.cwd()) {
   const git = gitEvidence(root);
 
   return {
-    schema: 'agentsam.go-discovery.v1',
+    schema: 'agentsam.go-discovery.v2',
     repository_root: root,
     sdk_root: SDK_ROOT,
     go: goTool,
@@ -55,6 +142,14 @@ export function discoverGoRuntime(cwd = process.cwd()) {
     runtime: preferred,
     candidates: found,
     product_exists: Boolean(preferred && fs.existsSync(preferred.packageManifest)),
+    distribution: preferred
+      ? {
+          origin: preferred.origin,
+          package_name: preferred.package?.name || null,
+          package_version: preferred.package?.version || null,
+          product_root: preferred.productRoot,
+        }
+      : null,
   };
 }
 
@@ -65,7 +160,7 @@ function findFirstGoMain(dir) {
     let ents;
     try { ents = fs.readdirSync(cur, { withFileTypes: true }); } catch { continue; }
     for (const ent of ents) {
-      if (ent.name === 'vendor' || ent.name === '.git') continue;
+      if (ent.name === 'vendor' || ent.name === '.git' || ent.name === 'node_modules') continue;
       const full = path.join(cur, ent.name);
       if (ent.isDirectory()) stack.push(full);
       else if (ent.name === 'main.go') return full;
@@ -84,13 +179,34 @@ export function probeGoToolchain() {
   }
 }
 
-export function resolveProductRoot(discovery, productName = DEFAULT_PRODUCT) {
-  if (discovery?.runtime?.productRoot && path.basename(discovery.runtime.productRoot) === productName) {
+export function resolveGoStateRoot(discovery, cwd = process.cwd()) {
+  const origin = discovery?.runtime?.origin || null;
+  if (origin === 'repository' || origin === 'sdk_development_tree') {
     return discovery.runtime.productRoot;
   }
-  const fromSdk = path.join(SDK_ROOT, 'apps', productName);
-  if (fs.existsSync(fromSdk)) return fromSdk;
-  const fromRepo = path.join(discovery.repository_root, 'apps', productName);
-  if (fs.existsSync(fromRepo)) return fromRepo;
-  return fromSdk;
+  return repositoryRoot(cwd);
+}
+
+export function resolveProductRoot(discovery, productName = DEFAULT_PRODUCT) {
+  const runtime = discovery?.runtime;
+  if (
+    runtime?.productRoot
+    && (
+      path.basename(runtime.productRoot) === productName
+      || runtime.package?.name === GO_WORKER_PACKAGE
+    )
+  ) {
+    return runtime.productRoot;
+  }
+
+  const fromCandidates = discovery?.candidates?.find((row) => (
+    path.basename(row.productRoot || '') === productName
+    || row.package?.name === GO_WORKER_PACKAGE
+  ));
+  if (fromCandidates?.productRoot) return fromCandidates.productRoot;
+
+  const err = new Error('go_product_not_discovered:' + productName);
+  err.code = 'go_product_not_discovered';
+  err.hint = 'Install ' + GO_WORKER_PACKAGE + ' for self-host deployment or run from the AgentSam SDK maintainer checkout.';
+  throw err;
 }

package/src/go/index.js

@@ -1,13 +1,25 @@
-export { discoverGoRuntime, resolveProductRoot, probeGoToolchain, DEFAULT_PRODUCT, SDK_ROOT } from './discover.js';
+export { discoverGoRuntime, resolveProductRoot, resolveGoStateRoot, probeGoToolchain, DEFAULT_PRODUCT, SDK_ROOT } from './discover.js';
 export { ensureProductContract, readProductManifest, preflightToolchain } from './contract.js';
 export { buildGoProduct, runGoBuild, runGoTests, runGoVet } from './build.js';
-export { deployGoCloudflare, probeGoDeployment } from './cloudflare.js';
+export { deployGoCloudflare, resolveWranglerIdentity, probeGoDeployment, probeGoDeploymentWithRetry, readLatestWranglerDeployment } from './cloudflare.js';
+export { verifyGoContainer } from './container.js';
 export { verifyGoProduct } from './verify.js';
-export { applyGoProductRegistry, buildGoProductRegistrySql } from './registry.js';
+export {
+  applyInnerAnimalMediaOfficialGoProductRegistry,
+  applyIamOfficialGoProductRegistry,
+  buildGoProductRegistrySql,
+} from './official-registry.js';
+export {
+  INNERANIMALMEDIA_OFFICIAL_RELEASE_ENV,
+  LEGACY_IAM_OFFICIAL_RELEASE_ENV,
+  innerAnimalMediaOfficialReleaseEnabled,
+} from './official-release.js';
 export {
   writeGoBuildReceipt,
   writeDeploymentReceipt,
+  writeDeploymentValidationReceipt,
   writeProductRegistryLocal,
+  writeProductValidationLocal,
   readLatestStatus,
   buildProductRow,
 } from './receipts.js';

package/src/go/native-probe-runner.mjs

@@ -0,0 +1,119 @@
+import { spawn } from 'node:child_process';
+import net from 'node:net';
+
+const binary = process.argv[2];
+const expectedSource = process.argv[3] || '';
+const expectedCommit = process.argv[4] || '';
+const expectedHash = '2e60bba13dc2bc37d75dd2ce5deb25466f19cb2994e20889388948879875eae9';
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+const port = await new Promise((resolve, reject) => {
+  const server = net.createServer();
+  server.unref();
+  server.on('error', reject);
+  server.listen(0, '127.0.0.1', () => {
+    const value = server.address().port;
+    server.close(() => resolve(value));
+  });
+});
+
+const child = spawn(binary, [], {
+  env: { ...process.env, PORT: String(port), AGENTSAM_TARGET: 'local' },
+  stdio: ['ignore', 'ignore', 'pipe'],
+});
+let stderr = '';
+child.stderr.on('data', (chunk) => { stderr += String(chunk); });
+const base = 'http://127.0.0.1:' + port;
+const results = {};
+
+async function request(name, pathname, init = {}) {
+  const res = await fetch(base + pathname, init);
+  let body = null;
+  try { body = await res.json(); } catch {}
+  results[name] = { status: res.status, ok: res.ok, body };
+  return results[name];
+}
+
+let ready = false;
+for (let attempt = 0; attempt < 100 && child.exitCode == null; attempt += 1) {
+  try {
+    const health = await request('health', '/health', { headers: { Accept: 'application/json' } });
+    if (health.ok) { ready = true; break; }
+  } catch {}
+  await sleep(50);
+}
+
+let error = null;
+if (!ready) {
+  error = 'runtime_not_ready';
+} else {
+  try {
+    await request('runtime', '/v1/runtime');
+    await request('capabilities', '/v1/capabilities');
+    await request('hash', '/v1/hash', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ input: 'agentsam', algorithm: 'sha256' }),
+    });
+    await request('inspect', '/v1/inspect', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ files: [{ path: 'demo.css', content: '.button { color: #2563eb; }' }] }),
+    });
+    await request('malformed', '/v1/inspect', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ not_files: true }),
+    });
+  } catch (cause) {
+    error = cause.message;
+  }
+}
+
+const health = results.health?.body;
+const runtime = results.runtime?.body;
+const capabilities = results.capabilities?.body;
+const malformed = results.malformed?.body;
+const checks = {
+  health: results.health?.status === 200 && health?.ok === true && health?.target === 'local',
+  source_identity: Boolean(expectedSource) && health?.build?.source === expectedSource,
+  source_commit: expectedCommit ? health?.build?.commit === expectedCommit : true,
+  runtime: results.runtime?.status === 200 && runtime?.schema === 'agentsam.go-runtime.v1',
+  capabilities: results.capabilities?.status === 200
+    && capabilities?.schema === 'agentsam.go-capabilities.v1'
+    && ['hash', 'inspect', 'runtime', 'capabilities'].every((name) => capabilities?.capabilities?.includes(name)),
+  hash: results.hash?.status === 200 && results.hash?.body?.hash === expectedHash,
+  inspect: results.inspect?.status === 200
+    && results.inspect?.body?.findings?.some((finding) => finding.kind === 'hardcoded_color' && finding.value === '#2563eb'),
+  error_envelope: results.malformed?.status === 400
+    && malformed?.ok === false
+    && malformed?.schema_version === 1
+    && malformed?.reason === 'input_invalid'
+    && malformed?.code === 'INVALID_ARGUMENT',
+};
+
+const exitPromise = new Promise((resolve) => {
+  const timer = setTimeout(() => {
+    child.kill('SIGKILL');
+    resolve({ code: child.exitCode, signal: 'SIGKILL', timeout: true });
+  }, 5000);
+  child.once('exit', (code, signal) => {
+    clearTimeout(timer);
+    resolve({ code, signal, timeout: false });
+  });
+});
+child.kill('SIGTERM');
+const exit = await exitPromise;
+checks.clean_shutdown = exit.code === 0 && !exit.timeout;
+
+const ok = !error && Object.values(checks).every(Boolean);
+process.stdout.write(JSON.stringify({
+  ok,
+  origin: base,
+  checks,
+  results,
+  exit,
+  stderr: stderr.slice(-2000),
+  error,
+}));
+process.exit(ok ? 0 : 1);

package/src/go/{registry.js → official-registry.js}

@@ -5,6 +5,7 @@ import { spawnSync } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
 import { SDK_ROOT } from './discover.js';
 import { writeProductRegistryLocal } from './receipts.js';
+import { innerAnimalMediaOfficialReleaseEnabled } from './official-release.js';
 
 const DEFAULT_DB = 'inneranimalmedia-business';
 const DEFAULT_WRANGLER = 'apps/local-studio/backend/wrangler.jsonc';
@@ -22,7 +23,7 @@ function json(value) {
 
 export function buildGoProductRegistrySql({
   product = 'agentsam-go-worker',
-  status = 'wired',
+  status = 'deployed',
   version = '0.1.0',
   repositoryId = DEFAULT_REPOSITORY_ID,
   canonicalPath = 'apps/agentsam-go-worker',
@@ -30,6 +31,10 @@ export function buildGoProductRegistrySql({
   url = null,
   commit = null,
   health = null,
+  workerDeploymentId = null,
+  workerVersionId = null,
+  artifactDigest = null,
+  containerDigest = null,
   description = 'AgentSam Go runtime (Worker edge + native Cloudflare Container)',
 } = {}) {
   const metadata = {
@@ -40,6 +45,10 @@ export function buildGoProductRegistrySql({
       mode: 'worker-container',
       url: url || null,
       health: health || null,
+      worker_deployment_id: workerDeploymentId,
+      worker_version_id: workerVersionId,
+      artifact_digest: artifactDigest,
+      container_image_digest: containerDigest,
     },
     source: { commit: commit || null },
     capabilities: ['hash', 'inspect', 'runtime', 'capabilities'],
@@ -101,7 +110,12 @@ ON CONFLICT(slug) DO UPDATE SET
       target_type: 'cloudflare_worker',
       target_id: product,
       relationship_type: 'deployed_as',
-      metadata: { origin: 'agentsam.go.cloudflare', url: url || null },
+      metadata: {
+        origin: 'agentsam.go.cloudflare',
+        url: url || null,
+        worker_deployment_id: workerDeploymentId,
+        worker_version_id: workerVersionId,
+      },
     },
     {
       target_type: 'cli_command',
@@ -127,25 +141,52 @@ DO UPDATE SET metadata = excluded.metadata;`,
   return statements.join('\n');
 }
 
-export function applyGoProductRegistry({
+export function applyInnerAnimalMediaOfficialGoProductRegistry({
   productRoot,
   product = 'agentsam-go-worker',
+  officialRelease = false,
   cwd = SDK_ROOT,
-  status = 'wired',
+  status = 'deployed',
   url = null,
   commit = null,
   health = null,
+  workerDeploymentId = null,
+  workerVersionId = null,
+  artifactDigest = null,
+  containerDigest = null,
   dryRun = false,
   skipRemote = false,
   spawn = spawnSync,
   repositoryId = DEFAULT_REPOSITORY_ID,
 } = {}) {
+  if (!officialRelease || !innerAnimalMediaOfficialReleaseEnabled()) {
+    const err = new Error('inneranimalmedia_registry_official_release_required');
+    err.code = 'inneranimalmedia_registry_official_release_required';
+    err.legacy_code = 'iam_registry_official_release_required';
+    err.hint = 'InnerAnimalMedia D1 registration is restricted to the explicit official release path.';
+    throw err;
+  }
+
+  const officialStatus = status === 'deployed' ? 'production' : status;
+  const allowedStatuses = new Set(['prototype', 'scaffolded', 'wired', 'production', 'deprecated']);
+  if (!allowedStatuses.has(officialStatus)) {
+    const err = new Error('inneranimalmedia_registry_status_invalid');
+    err.code = 'inneranimalmedia_registry_status_invalid';
+    err.legacy_code = 'iam_registry_status_invalid';
+    err.detail = { received: status, normalized: officialStatus };
+    throw err;
+  }
+
   const sql = buildGoProductRegistrySql({
     product,
-    status,
+    status: officialStatus,
     url,
     commit,
     health,
+    workerDeploymentId,
+    workerVersionId,
+    artifactDigest,
+    containerDigest,
     repositoryId,
   });
 
@@ -153,13 +194,22 @@ export function applyGoProductRegistry({
     slug: product,
     kind: 'service',
     name: product,
-    status,
+    status: officialStatus,
     repository_id: repositoryId,
     canonical_path: 'apps/agentsam-go-worker',
     package_name: '@inneranimalmedia/agentsam-go-worker',
     metadata: {
       runtime: 'go',
-      deployment: { provider: 'cloudflare', mode: 'worker-container', url, health },
+      deployment: {
+        provider: 'cloudflare',
+        mode: 'worker-container',
+        url,
+        health,
+        worker_deployment_id: workerDeploymentId,
+        worker_version_id: workerVersionId,
+        artifact_digest: artifactDigest,
+        container_image_digest: containerDigest,
+      },
       source: { commit },
     },
   };
@@ -221,3 +271,10 @@ export function applyGoProductRegistry({
     try { fs.unlinkSync(tmpFile); } catch { /* ignore */ }
   }
 }
+
+/**
+ * Backward-compatible SDK export. New code should use
+ * applyInnerAnimalMediaOfficialGoProductRegistry.
+ */
+export const applyIamOfficialGoProductRegistry =
+  applyInnerAnimalMediaOfficialGoProductRegistry;