@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/identity/tests/identity-service.test.mjs

@@ -1,7 +1,29 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+import {
+  createRouteRegistry,
+  defineRouteProjection,
+} from '../src/contracts/route-projection.js';
 import { createIdentityService } from '../src/server/identity-service.js';
 
+function createTestRouting() {
+  const app = { id: 'identity-test-app' };
+  const routeRegistry = createRouteRegistry([
+    defineRouteProjection({
+      appId: app.id,
+      routes: {
+        [IDENTITY_ROUTE_IDS.LOGIN]: '/auth/login',
+        [IDENTITY_ROUTE_IDS.RECOVERY]: '/auth/reset',
+        [IDENTITY_ROUTE_IDS.APP_AUTHENTICATED]: '/agentsam',
+        [IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]: '/api/oauth/:provider/callback',
+        'app.mount./projects': { path: '/projects', auth: 'required' },
+      },
+    }),
+  ]);
+  return { app, routeRegistry };
+}
+
 function createMemoryAdapter() {
   const users = new Map();
   const sessions = new Map();
@@ -66,10 +88,12 @@ function createMemoryAdapter() {
 }
 
 describe('identity service', () => {
-  it('owns its fallback and rejects external OAuth return targets', () => {
+  it('owns its projected fallback and rejects external OAuth return targets', () => {
+    const { app, routeRegistry } = createTestRouting();
     const identity = createIdentityService({
       adapter: createMemoryAdapter(),
-      defaultRedirect: '/agentsam',
+      app,
+      routeRegistry,
     });
 
     assert.equal(identity.resolvePostLoginPath('/projects?tab=recent'), '/projects?tab=recent');
@@ -77,12 +101,19 @@ describe('identity service', () => {
     assert.equal(identity.resolvePostLoginPath('//attacker.example/'), '/agentsam');
     assert.equal(identity.resolvePostLoginPath(null), '/agentsam');
 
-    const neutral = createIdentityService({ adapter: createMemoryAdapter() });
-    assert.equal(neutral.resolvePostLoginPath(null), '/');
+    assert.throws(
+      () => createIdentityService({ adapter: createMemoryAdapter() }),
+      (error) => error?.code === 'AUTH_APP_UNRESOLVED',
+    );
   });
 
   it('signup and login issue session', async () => {
-    const identity = createIdentityService({ adapter: createMemoryAdapter() });
+    const { app, routeRegistry } = createTestRouting();
+    const identity = createIdentityService({
+      adapter: createMemoryAdapter(),
+      app,
+      routeRegistry,
+    });
     const signup = await identity.signup({
       email: 'user@example.com',
       password: 'secret-pass',
@@ -97,6 +128,22 @@ describe('identity service', () => {
     });
     assert.equal(login.ok, true);
 
+    const nativeRequest = new Request('https://example.test/api/auth/login', {
+      headers: { 'X-AgentSam-Native-Client': '1' },
+    });
+    assert.equal(identity.isNativeSessionRequest(nativeRequest), true);
+    const nativeResponse = identity.buildNativeLoginSuccessResponse(login, '/agentsam');
+    const nativeBody = await nativeResponse.json();
+    assert.equal(nativeBody.ok, true);
+    assert.equal(nativeBody.session_id, login.sessionId);
+    assert.equal(nativeBody.user.email, 'user@example.com');
+    assert.equal(nativeResponse.headers.get('set-cookie'), null);
+
+    const bearerCtx = await identity.sessionFromRequest(new Request('https://example.test/api/auth/me', {
+      headers: { Authorization: `Bearer ${login.sessionId}` },
+    }));
+    assert.equal(bearerCtx?.user?.email, 'user@example.com');
+
     const bad = await identity.loginWithPassword({
       email: 'user@example.com',
       password: 'wrong',

package/packages/identity/tests/native-session-worker.test.mjs

@@ -0,0 +1,64 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { handleIdentityWorkerRequest } from '../src/server/worker-router.js';
+
+function fakeDb() {
+  return {
+    prepare() {
+      return {
+        bind() {
+          return {
+            async run() { return { success: true }; },
+            async first() { return null; },
+            async all() { return { results: [] }; },
+          };
+        },
+      };
+    },
+  };
+}
+
+test('native login returns bearer session JSON instead of cookie response', async () => {
+  let nativeBranch = false;
+  const identity = {
+    app: { id: 'local-studio' },
+    routeRegistry: { resolve: () => '/agentsam' },
+    async loginWithPassword() {
+      return {
+        ok: true,
+        user: { id: 'au_test', email: 'user@example.com', display_name: 'User' },
+        sessionId: 'sess_native_123',
+        session: { expires_at: 1234567890 },
+      };
+    },
+    isNativeSessionRequest(request) {
+      return request.headers.get('X-AgentSam-Native-Client') === '1';
+    },
+    buildNativeLoginSuccessResponse(result) {
+      nativeBranch = true;
+      return Response.json({ ok: true, session_id: result.sessionId, user: result.user });
+    },
+    buildLoginSuccessResponse() {
+      throw new Error('cookie_login_response_should_not_run');
+    },
+  };
+
+  const response = await handleIdentityWorkerRequest(
+    new Request('https://example.test/api/auth/login', {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'X-AgentSam-Native-Client': '1',
+      },
+      body: JSON.stringify({ email: 'user@example.com', password: 'secret-pass' }),
+    }),
+    { DB: fakeDb() },
+    { identity },
+  );
+
+  assert.equal(response.status, 200);
+  assert.equal(nativeBranch, true);
+  assert.equal(response.headers.get('set-cookie'), null);
+  const body = await response.json();
+  assert.equal(body.session_id, 'sess_native_123');
+});

package/packages/identity/tests/oauth-consent-view.test.mjs

@@ -0,0 +1,106 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import {
+  buildOAuthConsentView,
+  normalizeOAuthConsentCompany,
+  renderOAuthConsentHtml,
+} from '../src/oauth/consent-view.js';
+
+test('OAuth consent uses company as issuer brand SSOT without product-specific copy', () => {
+  const company = normalizeOAuthConsentCompany({
+    id: 'co_default',
+    name: 'Fuel & Free Time',
+    logo_url: 'https://assets.example.test/logo.png',
+    primary_color: '#f15a24',
+    auth_bg_color: '#101214',
+  });
+  const view = buildOAuthConsentView({
+    company,
+    resource: {
+      id: 'res_fnf_mcp',
+      audience: 'https://fuelnfreetime.com/mcp',
+      display_name: 'Fuel & Free Time MCP',
+      description: 'Store, content, and experience tools.',
+    },
+    client: {
+      client_id: 'chatgpt',
+      display_name: 'ChatGPT',
+    },
+    signed_in_email: 'customer@example.test',
+    scopes: [
+      {
+        scope: 'fnf:store.read',
+        label: 'Store data',
+        description: 'Read published store and CMS data.',
+        sort_order: 20,
+      },
+      {
+        scope: 'fnf:experience.read',
+        label: 'Interactive experiences',
+        description: 'Read published interactive scene metadata.',
+        sort_order: 10,
+      },
+    ],
+  });
+
+  assert.equal(view.issuer.name, 'Fuel & Free Time');
+  assert.equal(view.issuer.primaryColor, '#f15a24');
+  assert.equal(view.copy.headline, 'Fuel & Free Time MCP wants to connect to ChatGPT');
+  assert.equal(view.copy.footer, 'Authorization secured by Fuel & Free Time');
+  assert.deepEqual(view.scopes.map((scope) => scope.scope), [
+    'fnf:experience.read',
+    'fnf:store.read',
+  ]);
+});
+
+test('OAuth consent rejects missing resource audience instead of inventing one', () => {
+  assert.throws(
+    () => buildOAuthConsentView({
+      company: { name: 'Example' },
+      resource: { display_name: 'Example MCP' },
+      client: { client_id: 'client', display_name: 'Client' },
+    }),
+    /oauth_consent_resource_audience_required/,
+  );
+});
+
+
+test('OAuth consent renderer escapes malicious strings in every dynamic field', () => {
+  const evil = '<script>alert(1)</script>"><img src=x onerror=alert(2)>';
+
+  const html = renderOAuthConsentHtml({
+    company: {
+      name: evil,
+      logo_url: 'javascript:alert(3)', // must be dropped (not http/https)
+      primary_color: 'red; } body { background: url(javascript:alert(4)) } .x {',
+    },
+    resource: {
+      audience: 'https://example.test/mcp',
+      display_name: evil,
+      description: evil,
+    },
+    client: {
+      client_id: 'evil-client',
+      display_name: evil,
+    },
+    signed_in_email: evil,
+    scopes: [
+      { scope: 's1', label: evil, description: evil },
+    ],
+  }, { authorizationId: evil, csrfToken: evil });
+
+  // Nothing from any dynamic field should survive as a live tag/attribute.
+  assert.ok(!html.includes('<script>'), 'raw <script> tag leaked unescaped');
+  assert.ok(!html.includes('<img src=x'), 'raw <img> tag leaked unescaped (would fire onerror as a live element)');
+  // The dangerous substring is fine to appear as INERT escaped text -- what matters
+  // is that it never appears as a live, browser-parsed tag (i.e. preceded by a raw '<').
+  assert.ok(!html.includes('javascript:alert'), 'javascript: URL was not rejected by safeHttpUrl');
+  assert.ok(!html.includes('background: url(javascript'), 'invalid color value leaked into <style> unescaped');
+
+  // The escaped form of the payload should be present wherever it was rendered.
+  const escaped = '&lt;script&gt;alert(1)&lt;/script&gt;&quot;&gt;&lt;img src=x onerror=alert(2)&gt;';
+  assert.ok(html.includes(escaped), 'expected HTML-escaped payload not found in output');
+
+  // Invalid color input must fall back to the safe default, not pass through raw.
+  assert.ok(html.includes('#171717') || html.includes('#0b1020'), 'expected safe fallback brand color not found');
+});

package/packages/identity/tests/oauth-credentials.test.mjs

@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import { PLATFORM_ACCOUNT_ISSUER } from '../src/contracts/auth-config.js';
 import {
   requireIamPlatformCredentials,
   resolveIamPlatformCredentials,
@@ -7,11 +8,21 @@ import {
 } from '../src/oauth/credentials.js';
 
 describe('oauth credentials', () => {
-  it('requires IAM_CLIENT_ID and IAM_CLIENT_SECRET together', () => {
+  it('requires IAM client credentials and defaults the issuer to the platform authority', () => {
     assert.equal(resolveIamPlatformCredentials({ IAM_CLIENT_ID: 'x' }), null);
+    const defaults = resolveIamPlatformCredentials({
+      IAM_CLIENT_ID: 'x',
+      IAM_CLIENT_SECRET: 'y',
+    });
+    assert.equal(defaults?.clientId, 'x');
+    assert.equal(defaults?.issuer, PLATFORM_ACCOUNT_ISSUER);
     assert.equal(
-      resolveIamPlatformCredentials({ IAM_CLIENT_ID: 'x', IAM_CLIENT_SECRET: 'y' })?.clientId,
-      'x',
+      resolveIamPlatformCredentials({
+        IAM_CLIENT_ID: 'x',
+        IAM_CLIENT_SECRET: 'y',
+        IAM_OAUTH_ISSUER: 'https://iam.example.test',
+      })?.issuer,
+      'https://iam.example.test',
     );
   });
 
@@ -26,6 +37,7 @@ describe('oauth credentials', () => {
     const env = {
       IAM_CLIENT_ID: 'iam_dcr_legendary',
       IAM_CLIENT_SECRET: 'secret',
+      IAM_OAUTH_ISSUER: 'https://iam.example.test',
     };
     const lane = resolveOAuthCredentialLane(env, 'google');
     assert.equal(lane?.lane, 'iam_platform');
@@ -36,14 +48,17 @@ describe('oauth credentials', () => {
     const env = {
       IAM_CLIENT_ID: 'iam_dcr_legendary',
       IAM_CLIENT_SECRET: 'secret',
+      IAM_OAUTH_ISSUER: 'https://iam.example.test',
       GOOGLE_CLIENT_ID: 'google-byok',
       GOOGLE_CLIENT_SECRET: 'gsecret',
     };
     const lane = resolveOAuthCredentialLane(env, 'google');
     assert.equal(lane?.lane, 'byok_google');
     assert.equal(lane?.clientId, 'google-byok');
-    // IAM start path still resolves IAM
+    // IAM / inneranimalmedia start path still resolves platform lane
     assert.equal(resolveOAuthCredentialLane(env, 'iam')?.lane, 'iam_platform');
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.provider, 'inneranimalmedia');
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.lane, 'iam_platform');
   });
 
   it('prefers IAM_OAUTH_ISSUER and exposes issuer as the canonical authority', () => {
@@ -61,7 +76,7 @@ describe('oauth credentials', () => {
     const creds = resolveIamPlatformCredentials({
       IAM_CLIENT_ID: 'c',
       IAM_CLIENT_SECRET: 's',
-      IAM_OAUTH_ISSUER: 'https://staging.inneranimalmedia.com/',
+      IAM_ORIGIN: 'https://staging.inneranimalmedia.com/',
     });
     assert.equal(creds?.origin, 'https://staging.inneranimalmedia.com');
   });

package/packages/identity/tests/oauth-presets-accounts-ssot.test.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { resolveOAuthCredentialLane } from '../src/oauth/credentials.js';
+import { resolveGoogleExchangeSecret } from '../src/oauth/google-desktop-exchange.js';
+import { IdentityProviders } from '../src/contracts/provider.js';
+import { loadIdentityProviders, normalizeProviderTemplateId } from '../../../src/features/resolve.js';
+
+const PKG = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATION = path.join(PKG, 'src/migrations/0001_identity_core.sql');
+
+describe('identity OAuth presets + accounts SSOT', () => {
+  it('migration declares accounts as SSOT before account_identities', () => {
+    const sql = fs.readFileSync(MIGRATION, 'utf8');
+    assert.match(sql, /CREATE TABLE IF NOT EXISTS accounts/);
+    assert.match(sql, /account_identities[`']?\s+is IdP linkage only/i);
+    assert.match(sql, /never the account SSOT/i);
+    const accountsAt = sql.indexOf('CREATE TABLE IF NOT EXISTS accounts');
+    const identitiesAt = sql.indexOf('CREATE TABLE IF NOT EXISTS account_identities');
+    assert.ok(accountsAt >= 0 && identitiesAt > accountsAt);
+  });
+
+  it('provider catalog includes google_desktop + cloudflare', () => {
+    const providers = loadIdentityProviders();
+    const ids = providers.map((p) => p.id);
+    assert.ok(ids.includes('google_desktop'));
+    assert.ok(ids.includes('cloudflare'));
+    assert.ok(IdentityProviders.includes('google_desktop'));
+    assert.equal(normalizeProviderTemplateId('google-desktop'), 'google_desktop');
+  });
+
+  it('resolves google_desktop and cloudflare credential lanes', () => {
+    const desktop = resolveOAuthCredentialLane(
+      { GOOGLE_DESKTOP_CLIENT_ID: 'desk.apps.googleusercontent.com' },
+      'google_desktop',
+    );
+    assert.equal(desktop?.lane, 'byok_google_desktop');
+    assert.equal(desktop?.provider, 'google_desktop');
+
+    const cf = resolveOAuthCredentialLane(
+      { CLOUDFLARE_OAUTH_CLIENT_ID: 'cf-client' },
+      'cloudflare',
+    );
+    assert.equal(cf?.lane, 'byok_cloudflare');
+    assert.equal(cf?.clientSecret, '');
+  });
+
+  it('desktop exchange secret resolution prefers public PKCE', () => {
+    const resolved = resolveGoogleExchangeSecret(
+      { GOOGLE_DESKTOP_CLIENT_ID: 'desk.apps.googleusercontent.com' },
+      'desk.apps.googleusercontent.com',
+    );
+    assert.equal(resolved.mode, 'desktop_public_pkce');
+    assert.equal(resolved.clientSecret, null);
+  });
+});

package/packages/identity/tests/portable-identity-architecture.test.mjs

@@ -0,0 +1,157 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { createLocalSqliteDatabase } from '../../../src/local/sqlite.js';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+import {
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from '../src/contracts/route-projection.js';
+import { IdentityRoutingError } from '../src/contracts/identity-store.js';
+import { resolvePostAuthDestination } from '../src/server/post-auth.js';
+import {
+  applySqliteIdentityMigrations,
+  createSqliteIdentityAdapter,
+} from '../src/adapters/sqlite/index.js';
+import { createIdentityService } from '../src/server/identity-service.js';
+import { verifyAppPackage, verifyAppAuthContract } from '../src/app/verify-app.js';
+import { SESSION_POLICY } from '../src/core/session-policy.js';
+
+const REPO = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../..');
+const LOCAL_STUDIO = path.join(REPO, 'apps/local-studio');
+
+describe('IDENTITY_ROUTE_IDS (portable semantics)', () => {
+  it('exports semantic IDs only — no host paths', () => {
+    assert.equal(IDENTITY_ROUTE_IDS.LOGIN, 'identity.login');
+    assert.equal(IDENTITY_ROUTE_IDS.APP_AUTHENTICATED, 'app.authenticated');
+    assert.equal(IDENTITY_ROUTE_IDS.OAUTH_CALLBACK, 'identity.oauth.callback');
+    for (const v of Object.values(IDENTITY_ROUTE_IDS)) {
+      assert.equal(v.includes('/'), false, `path leaked into portable ID: ${v}`);
+    }
+  });
+});
+
+describe('route projection + fail-closed post-auth', () => {
+  const manifest = JSON.parse(
+    fs.readFileSync(path.join(LOCAL_STUDIO, 'agentsam.app.json'), 'utf8'),
+  );
+  const projection = projectionFromAppManifest(manifest);
+  const routeRegistry = createRouteRegistry([projection]);
+  const app = { id: 'local-studio' };
+
+  it('host projection maps identity.login → /auth/login', () => {
+    assert.equal(routeRegistry.resolve('local-studio', IDENTITY_ROUTE_IDS.LOGIN), '/auth/login');
+    assert.equal(
+      routeRegistry.resolve('local-studio', IDENTITY_ROUTE_IDS.APP_AUTHENTICATED),
+      '/agentsam',
+    );
+  });
+
+  it('resumes validated return_to', () => {
+    assert.equal(
+      resolvePostAuthDestination({
+        transaction: { app_id: 'local-studio', return_to: '/projects/abc' },
+        app,
+        routeRegistry,
+      }),
+      '/projects/abc',
+    );
+  });
+
+  it('falls back to authenticated entry — never /', () => {
+    assert.equal(
+      resolvePostAuthDestination({ transaction: {}, app, routeRegistry }),
+      '/agentsam',
+    );
+  });
+
+  it('throws AUTH_APP_UNRESOLVED without app', () => {
+    assert.throws(
+      () => resolvePostAuthDestination({ transaction: {}, app: null, routeRegistry }),
+      (err) => err instanceof IdentityRoutingError && err.code === 'AUTH_APP_UNRESOLVED',
+    );
+  });
+
+  it('rejects cross-app return_to then uses authenticated entry', () => {
+    assert.equal(
+      resolvePostAuthDestination({
+        transaction: { return_to: '/admin/orders' },
+        app,
+        routeRegistry,
+      }),
+      '/agentsam',
+    );
+  });
+});
+
+describe('app verification', () => {
+  it('local-studio agentsam.app.json passes auth contract', () => {
+    const result = verifyAppPackage(LOCAL_STUDIO, { requireShellFiles: false });
+    assert.equal(result.ok, true, result.errors?.join('; '));
+  });
+
+  it('fails when authenticated entry missing', () => {
+    const result = verifyAppAuthContract({
+      schema: 'agentsam.app.v1',
+      id: 'broken',
+      name: 'Broken',
+      auth: { entry: { login: 'identity.login' } },
+      routes: { 'identity.login': { path: '/signin' } },
+    }, { requireShellFiles: false });
+    assert.equal(result.ok, false);
+    assert.ok(result.errors.some((e) => /authenticated|missing|AUTH_/i.test(e)));
+  });
+});
+
+describe('local-only SQLite identity (zero cloud)', () => {
+  it('migrates, provisions password user, OAuth transaction with app_id', async () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentsam-id-'));
+    const dbFile = path.join(dir, 'identity.sqlite');
+    const db = await createLocalSqliteDatabase(dbFile);
+    await applySqliteIdentityMigrations(db);
+
+    const adapter = createSqliteIdentityAdapter(db);
+    const manifest = JSON.parse(
+      fs.readFileSync(path.join(LOCAL_STUDIO, 'agentsam.app.json'), 'utf8'),
+    );
+    const routeRegistry = createRouteRegistry([projectionFromAppManifest(manifest)]);
+    const identity = createIdentityService({
+      adapter,
+      app: { id: 'local-studio' },
+      routeRegistry,
+    });
+
+    const signup = await identity.signup({
+      email: 'local@example.test',
+      password: 'test-password-ok',
+      displayName: 'Local',
+    });
+    assert.equal(signup.ok, true);
+    assert.ok(signup.sessionId);
+
+    await adapter.createOAuthTransaction({
+      state: 'st_test',
+      provider: 'cloudflare',
+      codeVerifier: 'verifier',
+      returnTo: '/agentsam',
+      appId: 'local-studio',
+    });
+    const tx = await adapter.consumeOAuthTransaction('st_test');
+    assert.equal(tx.app_id, 'local-studio');
+    assert.equal(tx.return_to, '/agentsam');
+
+    await assert.rejects(
+      () => adapter.createOAuthTransaction({
+        state: 'st_bad',
+        provider: 'cloudflare',
+        codeVerifier: 'v',
+        returnTo: '/agentsam',
+      }),
+    );
+
+    assert.equal(SESSION_POLICY.agent.defaultTtlSeconds, 900);
+  });
+});

package/packages/identity/tests/preview-auth-portal.test.mjs

@@ -13,7 +13,7 @@ describe('auth portal preview server', () => {
     }
   });
 
-  it('serves IAM auth paths and login HTML', async () => {
+  it('serves portable auth paths and login HTML', async () => {
     const started = await createAuthPortalPreviewServer({ port: 0, host: '127.0.0.1' });
     server = started.server;
     baseUrl = started.baseUrl;
@@ -21,7 +21,7 @@ describe('auth portal preview server', () => {
     const loginRes = await fetch(`${baseUrl}/auth/login`);
     assert.equal(loginRes.status, 200);
     const loginHtml = await loginRes.text();
-    assert.match(loginHtml, /Sign in \| Inner Animal Media/);
+    assert.match(loginHtml, /Sign in \| AgentSam/);
 
     const signupRes = await fetch(`${baseUrl}/auth/signup`);
     assert.equal(signupRes.status, 200);
@@ -34,7 +34,7 @@ describe('auth portal preview server', () => {
     const companyRes = await fetch(`${baseUrl}/api/company`);
     const companyJson = await companyRes.json();
     assert.equal(companyJson.ok, true);
-    assert.equal(companyJson.company.supportEmail, 'hey@inneranimalmedia.com');
+    assert.equal(companyJson.company.supportEmail, 'support@agentsam.dev');
 
     const apiRes = await fetch(`${baseUrl}/api/auth/login`, {
       method: 'POST',

package/packages/identity/tests/session-routes-policy.test.mjs

@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { SESSION_POLICY, clampAgentSessionTtl } from '../src/core/session-policy.js';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+
+describe('SESSION_POLICY', () => {
+  it('keeps browser and agent TTLs distinct', () => {
+    assert.equal(SESSION_POLICY.browser.ttlSeconds, 30 * 24 * 60 * 60);
+    assert.equal(SESSION_POLICY.agent.defaultTtlSeconds, 15 * 60);
+    assert.equal(clampAgentSessionTtl(30), 60);
+    assert.equal(clampAgentSessionTtl(900), 900);
+    assert.equal(clampAgentSessionTtl(999999), 24 * 60 * 60);
+  });
+});
+
+describe('IDENTITY_ROUTE_IDS', () => {
+  it('exposes semantic IDs only', () => {
+    assert.equal(IDENTITY_ROUTE_IDS.LOGIN, 'identity.login');
+    assert.ok(!String(IDENTITY_ROUTE_IDS.LOGIN).startsWith('/'));
+  });
+});