@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/src/indexing/ingest/materials.js

@@ -0,0 +1,204 @@
+/**
+ * Material intake for codebaseindex.ingest — paths pasted/dropped into the CLI.
+ * Handles archives (tar/zip), sites/builds, HTML, images, GLB, and mixed trees.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { isCodeSourceExtension, isDocumentSourceExtension } from '../../../packages/agentsam-repository/src/source-types.js';
+
+const ARCHIVE_EXT = new Set(['.zip', '.tar', '.tgz', '.gz', '.tar.gz', '.tbz2', '.tar.bz2']);
+const IMAGE_EXT = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg', '.ico', '.bmp', '.avif']);
+const MODEL_3D_EXT = new Set(['.glb', '.gltf', '.obj', '.fbx', '.stl', '.usdz']);
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function extOf(filePath) {
+  const lower = filePath.toLowerCase();
+  if (lower.endsWith('.tar.gz')) return '.tar.gz';
+  if (lower.endsWith('.tar.bz2')) return '.tar.bz2';
+  return path.extname(lower);
+}
+
+/**
+ * Parse pasted CLI text into filesystem paths (one per line / whitespace-separated quoted).
+ * Terminal drag-drop typically pastes absolute paths; multi-line paste is supported.
+ * @param {string} text
+ * @returns {string[]}
+ */
+export function parsePastedPaths(text) {
+  const raw = clean(text);
+  if (!raw) return [];
+  const paths = [];
+  const re = /"([^"]+)"|'([^']+)'|(`([^`]+)`)|(\S+)/g;
+  let match;
+  while ((match = re.exec(raw))) {
+    const candidate = match[1] || match[2] || match[4] || match[5];
+    if (!candidate || candidate.startsWith('-')) continue;
+    paths.push(candidate.replace(/\\ /g, ' '));
+  }
+  return [...new Set(paths)];
+}
+
+/**
+ * @param {string} filePath
+ */
+export function classifyMaterial(filePath) {
+  const resolved = path.resolve(filePath);
+  const ext = extOf(resolved);
+  const exists = fs.existsSync(resolved);
+  const stat = exists ? fs.statSync(resolved) : null;
+  let kind = 'unknown';
+  if (stat?.isDirectory()) kind = 'directory';
+  else if (ARCHIVE_EXT.has(ext) || resolved.toLowerCase().endsWith('.tar.gz')) kind = 'archive';
+  else if (IMAGE_EXT.has(ext)) kind = 'image';
+  else if (MODEL_3D_EXT.has(ext)) kind = 'model3d';
+  else if (isDocumentSourceExtension(ext)) kind = 'document';
+  else if (isCodeSourceExtension(ext)) kind = 'code';
+  else if (stat?.isFile()) kind = 'file';
+  return {
+    path: resolved,
+    exists,
+    kind,
+    ext,
+    bytes: stat?.isFile() ? stat.size : null,
+    sha256: stat?.isFile() && stat.size <= 32 * 1024 * 1024 ? hashFile(resolved) : null,
+  };
+}
+
+function hashFile(filePath) {
+  try {
+    return createHash('sha256').update(fs.readFileSync(filePath)).digest('hex');
+  } catch {
+    return null;
+  }
+}
+
+function hasBin(name) {
+  const result = spawnSync(name, ['--help'], { stdio: 'ignore' });
+  // Some tools exit non-zero on --help; presence of spawn failure matters more.
+  return result.error == null;
+}
+
+/**
+ * Extract archive into destDir. Uses host tar/unzip (no extra npm deps).
+ * @param {string} archivePath
+ * @param {string} destDir
+ */
+export function extractArchive(archivePath, destDir) {
+  fs.mkdirSync(destDir, { recursive: true });
+  const lower = archivePath.toLowerCase();
+  if (lower.endsWith('.zip')) {
+    if (!hasBin('unzip')) throw new Error('unzip_unavailable: install unzip to extract .zip materials');
+    execFileSync('unzip', ['-q', '-o', archivePath, '-d', destDir], { stdio: ['ignore', 'pipe', 'pipe'] });
+    return { tool: 'unzip', dest: destDir };
+  }
+  if (lower.endsWith('.tar') || lower.endsWith('.tar.gz') || lower.endsWith('.tgz')
+    || lower.endsWith('.tar.bz2') || lower.endsWith('.tbz2') || lower.endsWith('.gz')) {
+    if (!hasBin('tar')) throw new Error('tar_unavailable: install tar to extract archive materials');
+    execFileSync('tar', ['-xf', archivePath, '-C', destDir], { stdio: ['ignore', 'pipe', 'pipe'] });
+    return { tool: 'tar', dest: destDir };
+  }
+  throw new Error(`unsupported_archive:${path.basename(archivePath)}`);
+}
+
+/**
+ * Stage pasted/dropped materials under `.agentsam/ingest/<id>/`.
+ * Archives are extracted; files/dirs are copied or linked by relative include paths.
+ *
+ * @param {{ root: string, materials: string[], ingestId?: string }} opts
+ */
+export function stageMaterials(opts) {
+  const root = path.resolve(opts.root);
+  const ingestId = opts.ingestId || `ing_${randomUUID().replace(/-/g, '').slice(0, 12)}`;
+  const stageRoot = path.join(root, '.agentsam', 'ingest', ingestId);
+  fs.mkdirSync(stageRoot, { recursive: true });
+
+  /** @type {object[]} */
+  const items = [];
+  /** @type {string[]} */
+  const include = [];
+  /** @type {object[]} */
+  const assets = [];
+
+  for (const raw of opts.materials) {
+    const classified = classifyMaterial(raw);
+    if (!classified.exists) {
+      items.push({ ...classified, status: 'missing' });
+      continue;
+    }
+
+    if (classified.kind === 'archive') {
+      const dest = path.join(stageRoot, 'archives', path.basename(classified.path, classified.ext) || 'archive');
+      fs.mkdirSync(dest, { recursive: true });
+      const extracted = extractArchive(classified.path, dest);
+      const rel = path.relative(root, dest);
+      include.push(rel);
+      items.push({ ...classified, status: 'extracted', stage: dest, extract: extracted });
+      continue;
+    }
+
+    if (classified.kind === 'directory') {
+      const relInside = classified.path.startsWith(`${root}${path.sep}`) || classified.path === root
+        ? path.relative(root, classified.path) || '.'
+        : null;
+      if (relInside != null) {
+        include.push(relInside === '' ? '.' : relInside);
+        items.push({ ...classified, status: 'included', include: relInside || '.' });
+      } else {
+        const dest = path.join(stageRoot, 'trees', path.basename(classified.path) || 'tree');
+        copyTree(classified.path, dest);
+        const rel = path.relative(root, dest);
+        include.push(rel);
+        items.push({ ...classified, status: 'copied', stage: dest });
+      }
+      continue;
+    }
+
+    // Single file
+    const destDir = path.join(stageRoot, classified.kind === 'image' ? 'images'
+      : classified.kind === 'model3d' ? 'models3d'
+        : classified.kind === 'document' ? 'documents'
+          : 'files');
+    fs.mkdirSync(destDir, { recursive: true });
+    const dest = path.join(destDir, path.basename(classified.path));
+    fs.copyFileSync(classified.path, dest);
+    const rel = path.relative(root, dest);
+    include.push(path.dirname(rel));
+    assets.push({
+      kind: classified.kind,
+      path: rel,
+      bytes: classified.bytes,
+      sha256: classified.sha256,
+      ext: classified.ext,
+    });
+    items.push({ ...classified, status: 'staged', stage: dest, include: path.dirname(rel) });
+  }
+
+  const uniqueInclude = [...new Set(include.map((p) => p.replace(/\\/g, '/').replace(/\/$/, '') || '.'))].sort();
+  const manifest = {
+    schema: 'agentsam.ingest.materials.v1',
+    ingest_id: ingestId,
+    staged_at: new Date().toISOString(),
+    stage_root: path.relative(root, stageRoot),
+    items,
+    assets,
+    include: uniqueInclude,
+  };
+  fs.writeFileSync(path.join(stageRoot, 'manifest.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+  return manifest;
+}
+
+function copyTree(src, dest) {
+  fs.mkdirSync(dest, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    if (entry.name === '.git' || entry.name === 'node_modules' || entry.name === '.agentsam') continue;
+    const from = path.join(src, entry.name);
+    const to = path.join(dest, entry.name);
+    if (entry.isDirectory()) copyTree(from, to);
+    else if (entry.isFile()) fs.copyFileSync(from, to);
+  }
+}

package/src/indexing/ingest/style-evidence.js

@@ -0,0 +1,181 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+const TEXT_EXT = new Set([
+  '.html', '.htm', '.css', '.scss',
+  '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx',
+  '.vue', '.svelte',
+]);
+
+function bump(map, key, amount = 1) {
+  if (!key) return;
+  map.set(key, (map.get(key) || 0) + amount);
+}
+
+function namespaceOf(token) {
+  const match = /^([a-z][a-z0-9]{1,15})[-_][a-z0-9]/i.exec(token);
+  return match?.[1]?.toLowerCase() || null;
+}
+
+export function extractStyleEvidence(text) {
+  const source = String(text || '');
+  const namespaces = new Map();
+  const namespaceSignals = new Map();
+  const themePresets = new Map();
+  const headerPresets = new Map();
+  const dataAttributes = new Map();
+  const stylesheets = new Map();
+  const customProperties = new Map();
+
+  const signal = (prefix, kind) => {
+    if (!prefix || prefix.length < 2) return;
+    bump(namespaces, prefix);
+    const row = namespaceSignals.get(prefix) || {};
+    row[kind] = (row[kind] || 0) + 1;
+    namespaceSignals.set(prefix, row);
+  };
+
+  for (const match of source.matchAll(/\bclass\s*=\s*["']([^"']+)["']/gi)) {
+    for (const token of match[1].split(/\s+/).filter(Boolean)) {
+      signal(namespaceOf(token), 'class_tokens');
+    }
+  }
+
+  for (const match of source.matchAll(/\.([a-zA-Z][\w-]*)/g)) {
+    signal(namespaceOf(match[1]), 'css_selectors');
+  }
+
+  for (const match of source.matchAll(/--([a-zA-Z][a-zA-Z0-9_-]*)\s*:/g)) {
+    const token = match[1].toLowerCase();
+    bump(customProperties, '--' + token);
+    signal(namespaceOf(token), 'custom_properties');
+  }
+
+  const literalAttributeValue = (value) => {
+    const trimmed = String(value || '').trim();
+    if (!trimmed || trimmed.includes('${') || trimmed.includes('{{') || trimmed.includes('<%')) return null;
+    return trimmed;
+  };
+
+  for (const match of source.matchAll(/\bdata-theme-preset\s*=\s*["']([^"']+)["']/gi)) {
+    bump(themePresets, literalAttributeValue(match[1]));
+  }
+  for (const match of source.matchAll(/\bdata-header-preset\s*=\s*["']([^"']+)["']/gi)) {
+    bump(headerPresets, literalAttributeValue(match[1]));
+  }
+  for (const match of source.matchAll(/\b(data-[a-z0-9_-]+)(?:\s*=|\s|>)/gi)) {
+    bump(dataAttributes, match[1].toLowerCase());
+  }
+  for (const match of source.matchAll(/<link\b[^>]*\brel\s*=\s*["']stylesheet["'][^>]*\bhref\s*=\s*["']([^"']+)["'][^>]*>/gi)) {
+    bump(stylesheets, match[1]);
+  }
+  for (const match of source.matchAll(/<link\b[^>]*\bhref\s*=\s*["']([^"']+)["'][^>]*\brel\s*=\s*["']stylesheet["'][^>]*>/gi)) {
+    bump(stylesheets, match[1]);
+  }
+
+  const namespaceRows = [...namespaces.entries()]
+    .map(([prefix, occurrences]) => {
+      const signals = namespaceSignals.get(prefix) || {};
+      const signalKinds = Object.keys(signals).length;
+      const score = occurrences + (signalKinds * 3);
+      return { prefix, occurrences, signal_kinds: signalKinds, signals, score };
+    })
+    .filter((row) => row.occurrences >= 2 || row.signal_kinds >= 2)
+    .sort((a, b) => b.score - a.score || a.prefix.localeCompare(b.prefix));
+
+  return {
+    theme_presets: Object.fromEntries([...themePresets.entries()].sort()),
+    header_presets: Object.fromEntries([...headerPresets.entries()].sort()),
+    namespaces: namespaceRows,
+    data_attributes: Object.fromEntries([...dataAttributes.entries()].sort()),
+    stylesheets: Object.fromEntries([...stylesheets.entries()].sort()),
+    custom_properties: Object.fromEntries([...customProperties.entries()].sort()),
+  };
+}
+
+export function mergeStyleEvidence(target, incoming) {
+  const merged = target || {
+    theme_presets: {},
+    header_presets: {},
+    namespaces: {},
+    data_attributes: {},
+    stylesheets: {},
+    custom_properties: {},
+    files_scanned: 0,
+  };
+  merged.files_scanned += 1;
+
+  for (const key of ['theme_presets', 'header_presets', 'data_attributes', 'stylesheets', 'custom_properties']) {
+    for (const [name, count] of Object.entries(incoming[key] || {})) {
+      merged[key][name] = (merged[key][name] || 0) + count;
+    }
+  }
+
+  for (const row of incoming.namespaces || []) {
+    const current = merged.namespaces[row.prefix] || {
+      occurrences: 0,
+      signal_kinds: new Set(),
+      signals: {},
+      score: 0,
+    };
+    current.occurrences += row.occurrences;
+    for (const [kind, count] of Object.entries(row.signals || {})) {
+      current.signals[kind] = (current.signals[kind] || 0) + count;
+      current.signal_kinds.add(kind);
+    }
+    merged.namespaces[row.prefix] = current;
+  }
+  return merged;
+}
+
+export function finalizeStyleEvidence(merged) {
+  const namespaces = Object.entries(merged?.namespaces || {})
+    .map(([prefix, row]) => {
+      const signalKinds = row.signal_kinds instanceof Set
+        ? row.signal_kinds.size
+        : Number(row.signal_kinds || 0);
+      const score = row.occurrences + (signalKinds * 3);
+      const classTokens = row.signals?.class_tokens || 0;
+      const cssSelectors = row.signals?.css_selectors || 0;
+      const customProperties = row.signals?.custom_properties || 0;
+      return {
+        prefix,
+        occurrences: row.occurrences,
+        signal_kinds: signalKinds,
+        signals: row.signals,
+        score,
+        candidate: prefix.length >= 3
+          && classTokens >= 2
+          && cssSelectors >= 2
+          && customProperties >= 2,
+      };
+    })
+    .sort((a, b) => b.score - a.score || a.prefix.localeCompare(b.prefix));
+
+  const explicitPresets = Object.keys(merged?.theme_presets || {});
+  return {
+    files_scanned: merged?.files_scanned || 0,
+    theme_presets: merged?.theme_presets || {},
+    header_presets: merged?.header_presets || {},
+    namespaces,
+    data_attributes: merged?.data_attributes || {},
+    stylesheets: merged?.stylesheets || {},
+    custom_properties: merged?.custom_properties || {},
+    theme_candidate: explicitPresets.length > 0 || namespaces.some((row) => row.candidate),
+  };
+}
+
+export function inspectStyleEvidenceFile(root, filePath, maxBytes = 512_000) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (!TEXT_EXT.has(ext)) return null;
+  const full = path.join(root, filePath);
+  try {
+    const stat = fs.statSync(full);
+    if (!stat.isFile() || stat.size > maxBytes) return null;
+    const text = fs.readFileSync(full, 'utf8');
+    if (text.includes('\0')) return null;
+    return extractStyleEvidence(text);
+  } catch {
+    return null;
+  }
+}

package/src/knowledge/source.js

@@ -3,11 +3,11 @@ import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import ts from 'typescript';
 import { fileHasher } from '../../packages/agentsam-repository/src/merkle/hash.js';
+import { isKnowledgeSourcePath } from '../../packages/agentsam-repository/src/source-types.js';
 import { fingerprint } from './config.js';
 
 export const PARSER = `typescript:${ts.version}:agentsam-1`;
-const EXTENSIONS = /\.(?:[cm]?[jt]sx?|md|mdx|sql|json)$/i;
-const OMIT = /(^|\/)(?:\.git|\.agentsam|node_modules|dist|build|coverage|vendor|\.next|\.wrangler|\.venv|__pycache__)(\/|$)|(^|\/)(?:\.env[^/]*|\.dev\.vars[^/]*|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|[^/]*\.(?:min\.js|map))$/i;
+const OMIT = /(^|\/)(?:\.git|\.agentsam|node_modules|dist|build|coverage|vendor|\.next|\.wrangler|\.venv|__pycache__)(\/|$)|(^|\/)(?:\.env[^/]*|\.dev\.vars[^/]*|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|Cargo\.lock|poetry\.lock|uv\.lock|[^/]*\.(?:pem|key|p12|pfx|min\.js|map))$/i;
 const under = (file, scope) => scope === '.' || file === scope || file.startsWith(scope + '/');
 export function inventory(root, scope) {
   let files;
@@ -24,7 +24,7 @@ export function inventory(root, scope) {
     };
     walk();
   }
-  return [...new Set(files)].filter(file => EXTENSIONS.test(file) && !OMIT.test(file) && scope.include.some(s => under(file, s)) && !scope.exclude.some(s => under(file, s))).sort();
+  return [...new Set(files)].filter(file => isKnowledgeSourcePath(file) && !OMIT.test(file) && scope.include.some(s => under(file, s)) && !scope.exclude.some(s => under(file, s))).sort();
 }
 export function readSource(root, file) {
   // Refuse all symlink components, including tracked links into another repository.

package/src/lib/account-session.js

@@ -122,8 +122,15 @@ export function resolveAccountApiKey(options = {}) {
   const explicit = clean(options.explicit);
   const value = resolveApiKey(env, explicit);
   if (!value) return { value: '', source: null, kind: null };
-  if (!isApiKey(value)) return { value: '', source: explicit ? 'explicit' : 'environment', kind: 'api_key', error: 'invalid_api_key_prefix' };
-  return { value, source: explicit ? 'explicit' : 'environment', kind: 'api_key' };
+  if (!isApiKey(value)) {
+    return {
+      value: '',
+      source: explicit ? 'explicit' : 'environment',
+      kind: 'agentsam_api_key',
+      error: 'invalid_api_key_prefix',
+    };
+  }
+  return { value, source: explicit ? 'explicit' : 'environment', kind: 'agentsam_api_key' };
 }
 
 export function resolveBrowserSessionCredential(options = {}) {
@@ -133,7 +140,7 @@ export function resolveBrowserSessionCredential(options = {}) {
   return {
     value: expired ? '' : session.access_token,
     source: 'agentsam_browser_oauth',
-    kind: 'browser_oauth',
+    kind: 'agentsam_browser_oauth',
     session,
     expired,
     error: expired ? 'browser_oauth_session_expired' : null,
@@ -162,7 +169,7 @@ export function describeAccountSession(options = {}) {
   return {
     configured: Boolean(session?.access_token),
     source: session?.access_token ? 'agentsam_browser_oauth' : null,
-    kind: session?.access_token ? 'browser_oauth' : null,
+    kind: session?.access_token ? 'agentsam_browser_oauth' : null,
     refreshable: Boolean(session?.refresh_token),
     expires_at: session?.expires_at || null,
     expired: session ? isBrowserSessionExpired(session, options) : false,

package/src/lib/app-authority.js

@@ -0,0 +1,172 @@
+/**
+ * APP / HOST / PLATFORM authority resolution.
+ *
+ * One canonical identifier per namespace — no alias env vars.
+ *   APP.id     → agentsam.app.json
+ *   HOST       → agentsam.app.json hosts[] (host_id + origin)
+ *   PLATFORM   → IAM_OAUTH_ISSUER (account API / OAuth issuer)
+ *
+ * Relationships are explicit pointers, never collapsed aliases like
+ * AGENTSAM_STUDIO_ORIGIN ≈ AGENTSAM_LOCAL_STUDIO_ORIGIN ≈ IAM_OAUTH_ISSUER.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  PLATFORM_ACCOUNT_ISSUER,
+  resolveIamIssuer,
+} from '../../packages/identity/src/contracts/auth-config.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = path.resolve(HERE, '../..');
+
+/** PLATFORM account-authority issuer — re-export from identity contract. */
+export { PLATFORM_ACCOUNT_ISSUER };
+
+/** APP.id for the Local Studio host product. */
+export const LOCAL_STUDIO_APP_ID = 'local-studio';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function normalizeOrigin(value) {
+  return clean(value).replace(/\/+$/, '');
+}
+
+function readManifestFile(manifestPath) {
+  if (!fs.existsSync(manifestPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function readAppManifest(appId, root = REPO_ROOT) {
+  const id = clean(appId);
+  if (!id) return null;
+  for (const parent of ['apps', 'packages']) {
+    const manifestPath = path.join(root, parent, id, 'agentsam.app.json');
+    const manifest = readManifestFile(manifestPath);
+    if (manifest) return manifest;
+  }
+  return null;
+}
+
+/**
+ * HOST namespace entries declared on an APP manifest.
+ * @returns {Array<{ host_id: string, origin: string, role?: string }>}
+ */
+export function listAppHosts(appId, options = {}) {
+  const manifest = readAppManifest(appId, options.root || REPO_ROOT);
+  const hosts = manifest?.hosts;
+  if (!Array.isArray(hosts)) return [];
+  return hosts
+    .map((row) => ({
+      host_id: clean(row?.host_id || row?.id),
+      origin: normalizeOrigin(row?.origin),
+      role: clean(row?.role) || null,
+    }))
+    .filter((row) => row.host_id && row.origin);
+}
+
+/**
+ * Resolve one HOST origin for an APP.
+ * Prefers role=production, then first declared host.
+ */
+export function resolveAppHostOrigin(appId, options = {}) {
+  const hosts = listAppHosts(appId, options);
+  if (!hosts.length) return '';
+  if (options.hostId) {
+    const hit = hosts.find((h) => h.host_id === options.hostId);
+    return hit?.origin || '';
+  }
+  const role = clean(options.role) || 'production';
+  const byRole = hosts.find((h) => h.role === role);
+  return (byRole || hosts[0]).origin;
+}
+
+
+/**
+ * Resolve APP/HOST context from the actual execution directory.
+ * Generic repo-root commands intentionally return null APP/HOST values.
+ * The nearest agentsam.app.json is authoritative when inside an app/package.
+ */
+export function resolveCurrentAppContext(options = {}) {
+  const root = path.resolve(options.root || REPO_ROOT);
+  const explicitAppId = clean(options.appId);
+  if (explicitAppId) {
+    const manifest = readAppManifest(explicitAppId, root);
+    if (!manifest) {
+      return { app_id: null, host_origin: null, source: null };
+    }
+    const appId = clean(manifest.id) || explicitAppId;
+    return {
+      app_id: appId,
+      host_origin: resolveAppHostOrigin(explicitAppId, {
+        root,
+        role: options.role || 'production',
+        hostId: options.hostId,
+      }) || null,
+      source: 'explicit-app-id',
+    };
+  }
+
+  let current = path.resolve(options.cwd || process.cwd());
+  const relative = path.relative(root, current);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    return { app_id: null, host_origin: null, source: null };
+  }
+
+  while (current === root || current.startsWith(root + path.sep)) {
+    const manifestPath = path.join(current, 'agentsam.app.json');
+    const manifest = readManifestFile(manifestPath);
+    if (manifest) {
+      const appId = clean(manifest.id);
+      const hosts = Array.isArray(manifest.hosts) ? manifest.hosts : [];
+      const hostRows = hosts
+        .map((row) => ({
+          host_id: clean(row?.host_id || row?.id),
+          origin: normalizeOrigin(row?.origin),
+          role: clean(row?.role) || null,
+        }))
+        .filter((row) => row.host_id && row.origin);
+      const role = clean(options.role) || 'production';
+      const host = options.hostId
+        ? hostRows.find((row) => row.host_id === options.hostId)
+        : (hostRows.find((row) => row.role === role) || hostRows[0]);
+      return {
+        app_id: appId || null,
+        host_origin: host?.origin || null,
+        source: manifestPath,
+      };
+    }
+    if (current === root) break;
+    current = path.dirname(current);
+  }
+
+  return { app_id: null, host_origin: null, source: null };
+}
+
+/**
+ * PLATFORM issuer for account API / whoami / aak_* calls.
+ * Delegates to identity resolveIamIssuer (never APP host).
+ */
+export function resolvePlatformAccountIssuer(env = process.env, explicit = '') {
+  return resolveIamIssuer(env, explicit);
+}
+
+/**
+ * Origin for Google / Cloudflare identity + CF connection OAuth owned by local-studio.
+ * HOST namespace from APP.hosts — never aliased to IAM_OAUTH_ISSUER.
+ */
+export function resolveLocalStudioHostOrigin(options = {}) {
+  const fromManifest = resolveAppHostOrigin(LOCAL_STUDIO_APP_ID, {
+    root: options.root,
+    role: options.role || 'production',
+    hostId: options.hostId,
+  });
+  if (fromManifest) return fromManifest;
+  return 'https://agentsam.inneranimalmedia.com';
+}