@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/src/lib/identity-scaffold.js

@@ -5,9 +5,15 @@ import { fileURLToPath } from 'node:url';
 const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const IDENTITY_PKG = path.join(SDK_ROOT, 'packages', 'identity');
 const AUTH_PAGES_DIR = path.join(IDENTITY_PKG, 'src', 'frontend', 'auth-portal', 'pages');
-const MIGRATION_FILE = path.join(IDENTITY_PKG, 'src', 'migrations', '0001_identity_core.sql');
+const PORTABLE_SQL_DIR = path.join(IDENTITY_PKG, 'migrations', 'sqlite');
 const BRANDING_SCRIPT = path.join(IDENTITY_PKG, 'src', 'frontend', 'auth-portal', 'shared', 'company-branding.js');
 
+const PORTABLE_SCAFFOLD_FILES = [
+  '001_identity_core.sql',
+  '002_identity_oauth_client.sql',
+  '005_identity_company_native.sql',
+];
+
 /**
  * @param {{ projectName: string, brandName?: string, logoUrl?: string, sdkVersion?: string, provider?: string }} config
  * @returns {Record<string, string>}
@@ -17,9 +23,12 @@ export function buildIdentityAppScaffold(config) {
   const brandName = config.brandName || projectName;
   const logoUrl = config.logoUrl || '/brand/logo.svg';
   const sdkVersion = config.sdkVersion || 'alpha';
-  const provider = config.provider || 'inneranimalmedia';
+  const provider = config.provider || 'email';
 
-  const migrationSql = `${fs.readFileSync(MIGRATION_FILE, 'utf8')}\n${buildCompanySeedSql({ brandName, logoUrl })}\n`;
+  const portableSql = PORTABLE_SCAFFOLD_FILES
+    .map((file) => fs.readFileSync(path.join(PORTABLE_SQL_DIR, file), 'utf8'))
+    .join('\n\n');
+  const migrationSql = `${portableSql}\n${buildCompanySeedSql({ brandName, logoUrl })}\n`;
   const loginHtml = injectBrandingScript(applyBrandTokens(fs.readFileSync(path.join(AUTH_PAGES_DIR, 'login.html'), 'utf8'), {
     brandName,
     logoUrl,
@@ -43,8 +52,8 @@ export function buildIdentityAppScaffold(config) {
     scripts: {
       dev: 'wrangler dev',
       deploy: 'wrangler deploy',
-      'db:migrate:local': `wrangler d1 execute ${projectName} --local --file=migrations/0001_identity_core.sql`,
-      'db:migrate': `wrangler d1 execute ${projectName} --remote --file=migrations/0001_identity_core.sql`,
+      'db:migrate:local': `wrangler d1 execute ${projectName} --local --file=migrations/0001_identity_portable.sql`,
+      'db:migrate': `wrangler d1 execute ${projectName} --remote --file=migrations/0001_identity_portable.sql`,
       preview: 'npx agentsam identity preview --open',
     },
     dependencies: {
@@ -61,6 +70,9 @@ export function buildIdentityAppScaffold(config) {
 main = "backend/src/index.js"
 compatibility_date = "2024-06-01"
 
+[vars]
+IDENTITY_ADAPTER_PROFILE = "portable"
+
 [assets]
 directory = "app/frontend"
 binding = "ASSETS"
@@ -76,13 +88,22 @@ migrations_dir = "migrations"
   files['.env.example'] = `# Minted at install/build — secrets via wrangler secret put (never commit)
 # IAM_CLIENT_ID=          # plaintext var (public by OAuth design)
 # IAM_CLIENT_SECRET=      # wrangler secret put only
-# IAM_ORIGIN=https://inneranimalmedia.com
+# IAM_ORIGIN=
 
-# Developer BYOK — takes /api/oauth/{google|github}/start when set
+# Web browser OAuth (BYOK) — takes /api/oauth/{google|github}/start when set
 # GOOGLE_CLIENT_ID=
 # GOOGLE_CLIENT_SECRET=
 # GITHUB_CLIENT_ID=
 # GITHUB_CLIENT_SECRET=
+
+# Google Desktop / CLI PKCE — Console type "Desktop app" (no secret required)
+# GOOGLE_DESKTOP_CLIENT_ID=
+# GOOGLE_DESKTOP_CLIENT_SECRET=   # optional; only if client was mis-typed as Web
+# Broker: POST /api/oauth/google/desktop-exchange (loopback redirect only)
+
+# Cloudflare sign-in — same secrets as the CF resource connector
+# CLOUDFLARE_OAUTH_CLIENT_ID=
+# CLOUDFLARE_OAUTH_CLIENT_SECRET= # optional for PKCE-only clients
 `;
 
   files['.gitignore'] = `node_modules/
@@ -94,10 +115,13 @@ migrations_dir = "migrations"
 
   files['README.md'] = `# ${brandName} — identity app
 
-Boring scaffold: **app/frontend** (auth UI) + **backend** (Worker API) + **migrations** (D1).
+Boring scaffold: **app/frontend** (auth UI) + **backend** (Worker API) + **migrations** (portable \`identity_*\` D1).
 
 Provider template: \`${provider}\` (see \`agentsam identity plan --provider ${provider}\`).
 
+**Schema:** portable \`agentsam.identity\` pack (\`identity_users\`, \`identity_sessions\`, \`identity_companies\`, …).
+Not the hosted IAM \`accounts\` / \`auth_users\` / \`company\` shape.
+
 ## Quick start
 
 \`\`\`bash
@@ -109,20 +133,28 @@ npm run dev
 # open http://localhost:8787/auth/login
 \`\`\`
 
-OAuth: minted \`IAM_CLIENT_ID\` + \`IAM_CLIENT_SECRET\` (default). Developer BYOK: \`GOOGLE_*\` / \`GITHUB_*\` when set.
+### OAuth options (pick what you need)
+
+| Lane | Env | Routes |
+|------|-----|--------|
+| IAM platform (default) | \`IAM_CLIENT_ID\` + \`IAM_CLIENT_SECRET\` | \`/api/oauth/inneranimalmedia/*\` |
+| Google web | \`GOOGLE_CLIENT_ID\` + \`GOOGLE_CLIENT_SECRET\` | \`/api/oauth/google/start\` |
+| Google desktop/CLI | \`GOOGLE_DESKTOP_CLIENT_ID\` | \`POST /api/oauth/google/desktop-exchange\` |
+| GitHub | \`GITHUB_CLIENT_*\` | \`/api/oauth/github/start\` |
+| Cloudflare | \`CLOUDFLARE_OAUTH_CLIENT_ID\` (+ optional secret) | \`/api/oauth/cloudflare/start\` |
 
 ## Layout
 
 \`\`\`
 app/frontend/     Auth portal HTML + dashboard stub
 backend/src/      Cloudflare Worker (identity routes)
-migrations/       D1 schema (+ default \`company\` row)
+migrations/       Portable identity_* schema (+ default identity_companies row)
 
 Branding: \`GET /api/company\` (public). Update with \`PATCH /api/company\` when signed in.
 \`\`\`
 `;
 
-  files['migrations/0001_identity_core.sql'] = migrationSql;
+  files['migrations/0001_identity_portable.sql'] = migrationSql;
 
   files['app/frontend/auth/login.html'] = loginHtml;
   files['app/frontend/auth/signup.html'] = signupHtml;
@@ -171,10 +203,31 @@ Branding: \`GET /api/company\` (public). Update with \`PATCH /api/company\` when
 `;
 
   files['backend/src/index.js'] = `import { handleIdentityWorkerRequest } from '@inneranimalmedia/agentsam-sdk/identity/server/worker-router';
+import { IDENTITY_ROUTE_IDS } from '@inneranimalmedia/agentsam-sdk/identity';
+import { createRouteRegistry, defineRouteProjection } from '@inneranimalmedia/agentsam-sdk/identity';
+
+const app = { id: '${projectName}' };
+const routeRegistry = createRouteRegistry([
+  defineRouteProjection({
+    appId: app.id,
+    routes: {
+      [IDENTITY_ROUTE_IDS.LOGIN]: '/auth/login',
+      [IDENTITY_ROUTE_IDS.SIGNUP]: '/auth/signup',
+      [IDENTITY_ROUTE_IDS.RESET]: '/auth/reset',
+      [IDENTITY_ROUTE_IDS.RECOVERY]: '/auth/reset',
+      [IDENTITY_ROUTE_IDS.APP_AUTHENTICATED]: '/dashboard/',
+      [IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]: '/api/oauth/:provider/callback',
+    },
+  }),
+]);
 
 export default {
   async fetch(request, env, ctx) {
-    return handleIdentityWorkerRequest(request, env);
+    return handleIdentityWorkerRequest(request, env, {
+      app,
+      routeRegistry,
+      identityProfile: 'portable',
+    });
   },
 };
 `;
@@ -183,11 +236,15 @@ export default {
 }
 
 function applyBrandTokens(html, { brandName, logoUrl }) {
+  // Package HTML ships neutral portable defaults; scaffold stamps the app brand.
   return html
     .replace(/Inner Animal Media/g, brandName)
-    .replace(/Sign in \| Inner Animal Media/g, `Sign in | ${brandName}`)
-    .replace(/Sign up \| Inner Animal Media/g, `Sign up | ${brandName}`)
-    .replace(/Reset password \| Inner Animal Media/g, `Reset password | ${brandName}`)
+    .replace(/AgentSam/g, brandName)
+    .replace(/<h1 data-company-tagline>Welcome<\/h1>/g, `<h1 data-company-tagline>${brandName}</h1>`)
+    .replace(/<span data-company-name>App<\/span>/g, `<span data-company-name>${brandName}</span>`)
+    .replace(/alt="Sign in"/g, `alt="${brandName}"`)
+    .replace(/src="\/shared\/agentsam-mark\.svg"/g, `src="${logoUrl}"`)
+    .replace(/src="\/shared\/app-icon\.png"/g, `src="${logoUrl}"`)
     .replace(/src="\/brand\/[^"]*"/g, `src="${logoUrl}"`)
     .replace(/href="\/brand\/[^"]*"/g, `href="${logoUrl}"`);
 }
@@ -203,9 +260,9 @@ function sqlLiteral(value) {
 
 function buildCompanySeedSql({ brandName, logoUrl }) {
   const ts = Math.floor(Date.now() / 1000);
-  return `-- Default company row (branding SSOT for portal + dashboard)
-INSERT OR IGNORE INTO company (
-  id, slug, name, logo_url, auth_bg_color, primary_color, created_at, updated_at
+  return `-- Default company row (branding SSOT for portal + dashboard) — portable identity_companies
+INSERT OR IGNORE INTO identity_companies (
+  id, slug, name, logo_url, auth_bg_color, primary_color, support_email, created_at, updated_at
 ) VALUES (
   'co_default',
   'default',
@@ -213,6 +270,7 @@ INSERT OR IGNORE INTO company (
   ${sqlLiteral(logoUrl)},
   '#050508',
   '#007AFF',
+  ${sqlLiteral('support@example.test')},
   ${ts},
   ${ts}
 );`;

package/src/lib/init-options.js

@@ -0,0 +1,192 @@
+/**
+ * Init / create pickers — real presets, scaffolds, and apps (not aspirational lanes).
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { listPresets } from '../presets/index.js';
+import { listAppManifests } from '../commands/app.js';
+
+const SDK_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../..');
+const INSTALLABLE_PRODUCT_CACHE = path.join('registry', 'cms-rust-machine-20260928', 'installable-products.json');
+
+export const SCAFFOLD_WIZARDS = Object.freeze([
+  {
+    value: 'scaffold:cms',
+    kind: 'scaffold',
+    scaffold: 'cms',
+    label: 'CMS Site (Worker + D1 + R2)',
+    hint: 'Proven Cloudflare CMS scaffold with pages, nav, and templates',
+  },
+  {
+    value: 'scaffold:worker-api',
+    kind: 'scaffold',
+    scaffold: 'worker-api',
+    label: 'Worker API',
+    hint: 'Bare Cloudflare Worker with typed routes and D1',
+  },
+]);
+
+export const RUN_TARGET_OPTIONS = Object.freeze([
+  {
+    value: 'local',
+    label: 'This machine',
+    hint: 'SQLite + local API; no cloud account required',
+  },
+  {
+    value: 'cloudflare',
+    label: 'Cloudflare Workers',
+    hint: 'OAuth via Local Studio / agentsam connections — Workers, D1, R2',
+  },
+  {
+    value: 'tauri',
+    label: 'Local Studio desktop',
+    hint: 'Bundled Tauri app + local SQLite; offline-capable product runtime',
+  },
+  {
+    value: 'gcp',
+    label: 'Google Cloud',
+    hint: 'agentsam google-cloud OAuth / gcloud — VMs, Cloud Run, Workstations',
+  },
+  {
+    value: 'docker',
+    label: 'Docker',
+    hint: 'agentsam dockerize — proven compose/build/run on this host',
+  },
+]);
+
+function appReady(manifest = {}) {
+  const runtime = manifest.runtime || {};
+  return (
+    runtime.source_scaffold === 'ready'
+    || runtime.local_preview === 'ready'
+    || runtime.cloudflare === 'ready'
+  );
+}
+
+export function listInstallableProductCache(root = SDK_ROOT) {
+  const file = path.join(root || SDK_ROOT, INSTALLABLE_PRODUCT_CACHE);
+  try {
+    const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    return Array.isArray(parsed?.products) ? parsed.products : [];
+  } catch {
+    return [];
+  }
+}
+
+function actionChoice(action = {}) {
+  if (action.kind === 'app' && action.id) return `app:${action.id}`;
+  if (action.kind === 'scaffold' && action.id) return `scaffold:${action.id}`;
+  return null;
+}
+
+export function getInstallableProductChoice(id, root = SDK_ROOT) {
+  return listInstallableProductCache(root).find((row) => row.slug === id) || null;
+}
+
+export function listInitProjectTypeOptions(root) {
+  const presets = listPresets().map((preset) => ({
+    value: `preset:${preset.id}`,
+    kind: 'preset',
+    presetId: preset.id,
+    lane: preset.lane || preset.id,
+    label: preset.id === 'cms' ? 'CMS app (local AgentSam)' : preset.id === 'prototype'
+      ? 'Prototype (minimal)'
+      : preset.id === 'data'
+        ? 'Data app'
+        : 'Full Stack app',
+    hint: preset.description || preset.id,
+  }));
+
+  const apps = listAppManifests(root)
+    .filter((row) => appReady(row.manifest || {}))
+    .map((row) => {
+      const runtime = row.manifest?.runtime || {};
+      const cf = runtime.cloudflare === 'ready' ? ' · Cloudflare ready' : '';
+      return {
+        value: `app:${row.id}`,
+        kind: 'app',
+        appId: row.id,
+        label: row.name || row.id,
+        hint: `agentsam app scaffold ${row.id}${cf}`,
+        hasScaffold: Boolean(row.commands?.scaffold || row.manifest?.commands?.scaffold),
+      };
+    });
+
+  const represented = new Set([
+    ...SCAFFOLD_WIZARDS.map((row) => row.value),
+    ...apps.map((row) => row.value),
+  ]);
+  const products = listInstallableProductCache(root || SDK_ROOT)
+    .filter((row) => row?.slug && row?.action)
+    .filter((row) => {
+      const action = actionChoice(row.action);
+      return !action || !represented.has(action);
+    })
+    .map((row) => ({
+      value: `product:${row.slug}`,
+      kind: 'product',
+      productId: row.slug,
+      label: row.label || row.slug,
+      hint: row.hint || `${row.kind || 'product'} · ${row.status || 'unknown'}`,
+      action: row.action,
+    }));
+
+  return [...presets, ...SCAFFOLD_WIZARDS, ...products, ...apps];
+}
+
+export function parseProjectTypeChoice(value) {
+  const raw = String(value || '').trim();
+  if (raw.startsWith('preset:')) {
+    return { kind: 'preset', id: raw.slice('preset:'.length) };
+  }
+  if (raw.startsWith('scaffold:')) {
+    return { kind: 'scaffold', id: raw.slice('scaffold:'.length) };
+  }
+  if (raw.startsWith('app:')) {
+    return { kind: 'app', id: raw.slice('app:'.length) };
+  }
+  if (raw.startsWith('product:')) {
+    return { kind: 'product', id: raw.slice('product:'.length) };
+  }
+  // Back-compat for --lane fullstack|cms|…
+  if (raw) return { kind: 'preset', id: raw };
+  return null;
+}
+
+/** Concrete next commands after init — not "decide later". */
+export function guidanceForRunTarget(runTarget, { projectName } = {}) {
+  const name = projectName || '.';
+  if (runTarget === 'cloudflare') {
+    return [
+      'agentsam connections setup          # Cloudflare OAuth callback + Local Studio connector',
+      'agentsam cloudflare                 # Workers / bindings capabilities',
+      `cd ${name} && npm run deploy        # Graduate this project to a Worker when ready`,
+    ];
+  }
+  if (runTarget === 'tauri') {
+    return [
+      'agentsam app doctor local-studio     # Verify the bundled desktop product contract',
+      `cd ${name} && npm install           # Install the scaffolded app workspace`,
+      'Open AgentSam Local Studio.app       # Desktop authority uses local SQLite when the adapter supports it',
+    ];
+  }
+  if (runTarget === 'gcp') {
+    return [
+      'agentsam google-cloud doctor        # OAuth + gcloud readiness',
+      'agentsam google-cloud auth          # Sign in / refresh Google user OAuth',
+      'agentsam compute                   # List VMs / Cloud Run / Workstations targets',
+    ];
+  }
+  if (runTarget === 'docker') {
+    return [
+      `cd ${name} && npx agentsam dockerize   # Generate Dockerfile + compose from proven templates`,
+      'docker compose up --build',
+    ];
+  }
+  return [
+    'npm install && npm run smoke && npm run dev',
+    'npx agentsam',
+    'Optional: npm run pty · npm run ollama:setup',
+  ];
+}

package/src/lib/local-scaffold.js

@@ -1,6 +1,5 @@
 /**
- * Local-first scaffold — no IAM, no Cloudflare, no OAuth.
- * Prove the project locally; `agentsam deploy` adds cloud adapters only when requested.
+ * Local-first scaffold — prove locally, then graduate with real Cloudflare / GCP / Docker tooling.
  */
 
 import pkg from '../../package.json' with { type: 'json' };
@@ -40,9 +39,11 @@ const RUN_TARGETS = {
   '1': 'local',
   '2': 'cloudflare',
   '3': 'gcp',
+  '4': 'docker',
   local: 'local',
   cloudflare: 'cloudflare',
   gcp: 'gcp',
+  docker: 'docker',
 };
 
 export { LANE_KEYS, LANE_LABELS, RUN_TARGETS };
@@ -184,10 +185,13 @@ npm run ollama:status           # probe local Ollama + models
 
 The local SQLite database lives at \`.agentsam/data/agentsam.sqlite\` and is initialized from \`db/schema.sql\`.
 
-When you're intentionally ready to add cloud infrastructure:
+When you're ready to run on Cloudflare, GCP, or Docker (all supported end-to-end):
 
 \`\`\`bash
-npx agentsam deploy
+npx agentsam connections setup   # Cloudflare OAuth (Local Studio)
+npx agentsam google-cloud doctor # GCP OAuth / gcloud
+npx agentsam dockerize           # Containerize this project
+npx agentsam deploy              # Cloudflare Worker graduation
 \`\`\`
 `,
     },
@@ -416,7 +420,16 @@ No Worker or cloud account is required for local development.
 npm run deploy
 \`\`\`
 
-Selected future deploy target: **${runTarget}**. Cloud-specific adapters and credentials belong to deploy time, not local init.
+Selected run target: **${runTarget}**.
+
+| Target | Proven path |
+| --- | --- |
+| local | SQLite + local API on this host |
+| cloudflare | Local Studio CF OAuth · \`agentsam connections\` · \`agentsam deploy\` |
+| gcp | \`agentsam google-cloud\` OAuth / gcloud |
+| docker | \`agentsam dockerize\` compose/build/run |
+
+Cloud adapters and credentials are configured with those commands — not left as aspirational flags.
 `,
     },
   ];
@@ -432,6 +445,35 @@ export function buildLocalScaffoldMeta(body, sdkVersion = pkg.version) {
   const laneLabel = LANE_LABELS[laneKey] || 'Full Stack';
   const agent = AGENT_FOR_LANE[laneKey] || 'orchestrator';
   const runTarget = normalizeRunTarget(body.runTarget || body.run_target || 'local');
+  const nextByTarget = {
+    local: [
+      'npm install',
+      'npm run smoke',
+      'npm run status',
+      'npm run dev',
+      'npx agentsam',
+      'Optional: npm run pty · npm run ollama:setup',
+    ],
+    cloudflare: [
+      'npm install',
+      'npm run smoke',
+      'agentsam connections setup',
+      'agentsam cloudflare',
+      'npm run deploy',
+    ],
+    gcp: [
+      'npm install',
+      'npm run smoke',
+      'agentsam google-cloud doctor',
+      'agentsam google-cloud auth',
+      'agentsam compute',
+    ],
+    docker: [
+      'npm install',
+      'npx agentsam dockerize',
+      'docker compose up --build',
+    ],
+  };
 
   return {
     projectName,
@@ -440,16 +482,6 @@ export function buildLocalScaffoldMeta(body, sdkVersion = pkg.version) {
     agent,
     runTarget,
     files: buildLocalScaffoldFiles({ projectName, laneKey, laneLabel, agent, runTarget, sdkVersion }),
-    next_steps: [
-      'npm install',
-      'npm run smoke',
-      'npm run status',
-      'npm run dev',
-      'npx agentsam',
-      'npm run db:status',
-      'Optional free/local models: npm run ollama:setup',
-      'Optional: npm run pty',
-      'When ready for cloud: npm run deploy',
-    ],
+    next_steps: nextByTarget[runTarget] || nextByTarget.local,
   };
 }