@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/tests/oauth-credentials.test.mjs

@@ -1,5 +1,6 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import { PLATFORM_ACCOUNT_ISSUER } from '../src/contracts/auth-config.js';
 import {
   requireIamPlatformCredentials,
   resolveIamPlatformCredentials,
@@ -7,11 +8,21 @@ import {
 } from '../src/oauth/credentials.js';
 
 describe('oauth credentials', () => {
-  it('requires IAM_CLIENT_ID and IAM_CLIENT_SECRET together', () => {
+  it('requires IAM client credentials and defaults the issuer to the platform authority', () => {
     assert.equal(resolveIamPlatformCredentials({ IAM_CLIENT_ID: 'x' }), null);
+    const defaults = resolveIamPlatformCredentials({
+      IAM_CLIENT_ID: 'x',
+      IAM_CLIENT_SECRET: 'y',
+    });
+    assert.equal(defaults?.clientId, 'x');
+    assert.equal(defaults?.issuer, PLATFORM_ACCOUNT_ISSUER);
     assert.equal(
-      resolveIamPlatformCredentials({ IAM_CLIENT_ID: 'x', IAM_CLIENT_SECRET: 'y' })?.clientId,
-      'x',
+      resolveIamPlatformCredentials({
+        IAM_CLIENT_ID: 'x',
+        IAM_CLIENT_SECRET: 'y',
+        IAM_OAUTH_ISSUER: 'https://iam.example.test',
+      })?.issuer,
+      'https://iam.example.test',
     );
   });
 
@@ -22,20 +33,22 @@ describe('oauth credentials', () => {
     );
   });
 
-  it('defaults Google/GitHub buttons to IAM when minted', () => {
+  it('never silently maps Google/GitHub buttons onto IAM', () => {
     const env = {
       IAM_CLIENT_ID: 'iam_dcr_legendary',
       IAM_CLIENT_SECRET: 'secret',
+      IAM_OAUTH_ISSUER: 'https://iam.example.test',
     };
-    const lane = resolveOAuthCredentialLane(env, 'google');
-    assert.equal(lane?.lane, 'iam_platform');
-    assert.equal(lane?.clientId, 'iam_dcr_legendary');
+    assert.equal(resolveOAuthCredentialLane(env, 'google'), null);
+    assert.equal(resolveOAuthCredentialLane(env, 'github'), null);
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.lane, 'iam_platform');
   });
 
   it('developer BYOK Google takes the Google button when set', () => {
     const env = {
       IAM_CLIENT_ID: 'iam_dcr_legendary',
       IAM_CLIENT_SECRET: 'secret',
+      IAM_OAUTH_ISSUER: 'https://iam.example.test',
       GOOGLE_CLIENT_ID: 'google-byok',
       GOOGLE_CLIENT_SECRET: 'gsecret',
     };
@@ -63,7 +76,7 @@ describe('oauth credentials', () => {
     const creds = resolveIamPlatformCredentials({
       IAM_CLIENT_ID: 'c',
       IAM_CLIENT_SECRET: 's',
-      IAM_OAUTH_ISSUER: 'https://staging.inneranimalmedia.com/',
+      IAM_ORIGIN: 'https://staging.inneranimalmedia.com/',
     });
     assert.equal(creds?.origin, 'https://staging.inneranimalmedia.com');
   });

package/packages/identity/tests/oauth-presets-accounts-ssot.test.mjs

@@ -0,0 +1,58 @@
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+import { resolveOAuthCredentialLane } from '../src/oauth/credentials.js';
+import { resolveGoogleExchangeSecret } from '../src/oauth/google-desktop-exchange.js';
+import { IdentityProviders } from '../src/contracts/provider.js';
+import { loadIdentityProviders, normalizeProviderTemplateId } from '../../../src/features/resolve.js';
+
+const PKG = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const MIGRATION = path.join(PKG, 'src/migrations/0001_identity_core.sql');
+
+describe('identity OAuth presets + accounts SSOT', () => {
+  it('migration declares accounts as SSOT before account_identities', () => {
+    const sql = fs.readFileSync(MIGRATION, 'utf8');
+    assert.match(sql, /CREATE TABLE IF NOT EXISTS accounts/);
+    assert.match(sql, /account_identities[`']?\s+is IdP linkage only/i);
+    assert.match(sql, /never the account SSOT/i);
+    const accountsAt = sql.indexOf('CREATE TABLE IF NOT EXISTS accounts');
+    const identitiesAt = sql.indexOf('CREATE TABLE IF NOT EXISTS account_identities');
+    assert.ok(accountsAt >= 0 && identitiesAt > accountsAt);
+  });
+
+  it('provider catalog includes google_desktop + cloudflare', () => {
+    const providers = loadIdentityProviders();
+    const ids = providers.map((p) => p.id);
+    assert.ok(ids.includes('google_desktop'));
+    assert.ok(ids.includes('cloudflare'));
+    assert.ok(IdentityProviders.includes('google_desktop'));
+    assert.equal(normalizeProviderTemplateId('google-desktop'), 'google_desktop');
+  });
+
+  it('resolves google_desktop and cloudflare credential lanes', () => {
+    const desktop = resolveOAuthCredentialLane(
+      { GOOGLE_DESKTOP_CLIENT_ID: 'desk.apps.googleusercontent.com' },
+      'google_desktop',
+    );
+    assert.equal(desktop?.lane, 'byok_google_desktop');
+    assert.equal(desktop?.provider, 'google_desktop');
+
+    const cf = resolveOAuthCredentialLane(
+      { CLOUDFLARE_OAUTH_CLIENT_ID: 'cf-client' },
+      'cloudflare',
+    );
+    assert.equal(cf?.lane, 'byok_cloudflare');
+    assert.equal(cf?.clientSecret, '');
+  });
+
+  it('desktop exchange secret resolution prefers public PKCE', () => {
+    const resolved = resolveGoogleExchangeSecret(
+      { GOOGLE_DESKTOP_CLIENT_ID: 'desk.apps.googleusercontent.com' },
+      'desk.apps.googleusercontent.com',
+    );
+    assert.equal(resolved.mode, 'desktop_public_pkce');
+    assert.equal(resolved.clientSecret, null);
+  });
+});

package/packages/identity/tests/preview-auth-portal.test.mjs

@@ -13,7 +13,7 @@ describe('auth portal preview server', () => {
     }
   });
 
-  it('serves IAM auth paths and login HTML', async () => {
+  it('serves portable auth paths and login HTML', async () => {
     const started = await createAuthPortalPreviewServer({ port: 0, host: '127.0.0.1' });
     server = started.server;
     baseUrl = started.baseUrl;
@@ -21,7 +21,8 @@ describe('auth portal preview server', () => {
     const loginRes = await fetch(`${baseUrl}/auth/login`);
     assert.equal(loginRes.status, 200);
     const loginHtml = await loginRes.text();
-    assert.match(loginHtml, /Sign in \| Inner Animal Media/);
+    assert.match(loginHtml, /<title>Sign in<\/title>/);
+    assert.match(loginHtml, /data-company-name>App</);
 
     const signupRes = await fetch(`${baseUrl}/auth/signup`);
     assert.equal(signupRes.status, 200);
@@ -34,7 +35,8 @@ describe('auth portal preview server', () => {
     const companyRes = await fetch(`${baseUrl}/api/company`);
     const companyJson = await companyRes.json();
     assert.equal(companyJson.ok, true);
-    assert.equal(companyJson.company.supportEmail, 'hey@inneranimalmedia.com');
+    assert.equal(companyJson.company.supportEmail, 'support@example.com');
+    assert.equal(companyJson.company.name, 'Preview App');
 
     const apiRes = await fetch(`${baseUrl}/api/auth/login`, {
       method: 'POST',

package/packages/identity/tests/session-routes-policy.test.mjs

@@ -1,11 +1,13 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
-import { SESSION_POLICY, clampAgentSessionTtl } from '../src/core/session-policy.js';
+import { SESSION_POLICY, clampAgentSessionTtl, shouldRenewDesktopSession } from '../src/core/session-policy.js';
 import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
 
 describe('SESSION_POLICY', () => {
   it('keeps browser and agent TTLs distinct', () => {
     assert.equal(SESSION_POLICY.browser.ttlSeconds, 30 * 24 * 60 * 60);
+    assert.equal(SESSION_POLICY.desktop.ttlSeconds, 30 * 24 * 60 * 60);
+    assert.equal(SESSION_POLICY.desktop.renewWindowSeconds, 7 * 24 * 60 * 60);
     assert.equal(SESSION_POLICY.agent.defaultTtlSeconds, 15 * 60);
     assert.equal(clampAgentSessionTtl(30), 60);
     assert.equal(clampAgentSessionTtl(900), 900);
@@ -19,3 +21,13 @@ describe('IDENTITY_ROUTE_IDS', () => {
     assert.ok(!String(IDENTITY_ROUTE_IDS.LOGIN).startsWith('/'));
   });
 });
+
+describe('desktop session renewal', () => {
+  it('only renews in the final seven days', () => {
+  const now = 2_000_000;
+  assert.equal(shouldRenewDesktopSession({ type: 'desktop', expires_at: now + 6 * 24 * 60 * 60 }, now), true);
+  assert.equal(shouldRenewDesktopSession({ type: 'desktop', expires_at: now + 8 * 24 * 60 * 60 }, now), false);
+  assert.equal(shouldRenewDesktopSession({ type: 'browser', expires_at: now + 60 }, now), false);
+  assert.equal(shouldRenewDesktopSession({ type: 'desktop', expires_at: now - 1 }, now), false);
+  });
+});

package/packages/identity/tests/worker-runtime-boundary.test.mjs

@@ -0,0 +1,11 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import test from 'node:test';
+
+const runtimeEntry = new URL('../src/adapters/portable-d1/index.js', import.meta.url);
+
+test('portable D1 runtime entry does not pull Node-only migration loaders into Workers', () => {
+  const source = readFileSync(runtimeEntry, 'utf8');
+  assert.doesNotMatch(source, /migrations\/apply-portable/);
+  assert.doesNotMatch(source, /node:(?:fs|path|url)/);
+});

package/packages/providers/completeful/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inneranimalmedia/agentsam-provider-completeful",
-  "version": "0.1.0",
+  "version": "2.6.7",
   "private": false,
   "description": "Portable Completeful provider adapter and AgentSam tool definitions.",
   "type": "module",
@@ -25,5 +25,10 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/providers/completeful"
+  }
 }

package/packages/runtime-protocol/src/index.js

@@ -0,0 +1,154 @@
+/**
+ * agentsam.runtime.v1 — Runtime Registry vocabulary (JS).
+ * Physical D1 tables remain terminal_* ; domain nouns are Runtime*.
+ * Schema SSOT: protocol/runtime/agentsam.runtime.v1.schema.json
+ * Law: docs/architecture/AGENTSAM_RUNTIME_PROTOCOL.md
+ */
+
+export const RUNTIME_PROTOCOL_SCHEMA = 'agentsam.runtime.v1';
+
+/** Compute owner / cloud. Application-validated (no aggressive D1 CHECK). */
+export const RUNTIME_PROVIDERS = Object.freeze([
+  'local',
+  'google_cloud',
+  'cloudflare',
+  'aws',
+  'azure',
+  'fly',
+  'custom',
+]);
+
+/** What kind of computer/environment. */
+export const RUNTIME_SUBSTRATES = Object.freeze([
+  'host',
+  'vm',
+  'container',
+  'sandbox',
+  'workstation',
+  'microvm',
+  'kubernetes',
+]);
+
+export const RUNTIME_LIFECYCLES = Object.freeze([
+  'persistent',
+  'scale_to_zero',
+  'ephemeral',
+  'job',
+]);
+
+/**
+ * What speaks agentsam.runtime.v1 on the instance.
+ * ExecOS is an adapter implementation — never a transport.
+ */
+export const RUNTIME_ADAPTERS = Object.freeze([
+  'agentsamd',
+  'execos_legacy',
+  'cloudflare_sandbox',
+  'docker_engine',
+  'ssh',
+  'provider_native',
+]);
+
+/** How Studio/IAM reaches the adapter. */
+export const RUNTIME_TRANSPORTS = Object.freeze([
+  'direct_https',
+  'direct_wss',
+  'cloudflare_tunnel',
+  'vpc_service',
+  'vpc_network',
+  'service_binding',
+  'local_socket',
+  'provider_api',
+  'ssh',
+]);
+
+export const RUNTIME_AUTH_MODES = Object.freeze([
+  'connection_token',
+  'platform_bridge',
+  'bridge_key',
+  'service_binding',
+]);
+
+/** Capability keys — discovered, never inferred from provider alone. */
+export const RUNTIME_CAPABILITY_KEYS = Object.freeze([
+  'exec',
+  'pty',
+  'filesystem',
+  'persistent_filesystem',
+  'process',
+  'git',
+  'docker',
+  'gpu',
+  'browser',
+  'gui',
+  'ports',
+  'snapshot',
+]);
+
+/** @deprecated use RUNTIME_ADAPTERS */
+export const RUNTIME_KINDS = RUNTIME_ADAPTERS;
+
+/**
+ * Map legacy terminal_instances.kind → substrate.
+ * @param {'local_device'|'vm'|'sandbox'|string} kind
+ */
+export function substrateFromLegacyKind(kind) {
+  const k = String(kind || '').trim().toLowerCase();
+  if (k === 'local_device') return { substrate: 'host', target_lane: 'local', provider_hint: 'local' };
+  if (k === 'vm') return { substrate: 'vm', target_lane: 'remote', provider_hint: 'google_cloud' };
+  if (k === 'sandbox') return { substrate: 'sandbox', target_lane: 'sandbox', provider_hint: 'cloudflare' };
+  return { substrate: null, target_lane: null, provider_hint: null };
+}
+
+/**
+ * Map legacy connection transport + transport_provider → adapter + transport.
+ * @param {{ transport?: string, transport_provider?: string }} row
+ */
+export function normalizeLegacyConnection(row = {}) {
+  const legacyTransport = String(row.transport || '').trim().toLowerCase();
+  const legacyProvider = String(row.transport_provider || '').trim().toLowerCase();
+  let runtime_adapter = 'agentsamd';
+  if (legacyTransport === 'execos') runtime_adapter = 'execos_legacy';
+  else if (legacyTransport === 'container') runtime_adapter = 'cloudflare_sandbox';
+
+  let transport = legacyProvider || null;
+  if (!transport || transport === 'platform_vpc') {
+    transport = transport === 'platform_vpc' ? 'vpc_service' : 'direct_https';
+  }
+  if (legacyTransport === 'container' && !legacyProvider) {
+    transport = 'service_binding';
+  }
+
+  return {
+    protocol: RUNTIME_PROTOCOL_SCHEMA,
+    runtime_adapter,
+    transport,
+  };
+}
+
+/**
+ * Normalize arch vocabulary (live GCP still has x64).
+ * @param {string|null|undefined} arch
+ */
+export function normalizeArch(arch) {
+  const a = String(arch || '').trim().toLowerCase();
+  if (!a) return null;
+  if (a === 'x64' || a === 'amd64' || a === 'x86_64') return 'x86_64';
+  if (a === 'arm64' || a === 'aarch64') return 'arm64';
+  return a;
+}
+
+/**
+ * Hard-constraint check: every required capability must be true on candidate.
+ * @param {Record<string, boolean>} required
+ * @param {Record<string, boolean>} available
+ * @returns {{ ok: boolean, missing: string[] }}
+ */
+export function capabilitiesSatisfy(required = {}, available = {}) {
+  const missing = [];
+  for (const [key, need] of Object.entries(required)) {
+    if (!need) continue;
+    if (available[key] !== true) missing.push(key);
+  }
+  return { ok: missing.length === 0, missing };
+}

package/packages/theme-church-site/package.json

@@ -1,7 +1,7 @@
 {
-  "name": "@inneranimalmedia/theme-church-site",
-  "version": "0.1.0",
-  "description": "Real New Iberia Church of Christ public pages \u2014 visit, groups, mission, and giving.",
+  "name": "@inneranimalmedia/theme-cypress",
+  "version": "2.6.7",
+  "description": "Real New Iberia Church of Christ public pages — visit, groups, mission, and giving.",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
@@ -25,7 +25,18 @@
     "kind": "theme",
     "slug": "church-site",
     "galleryPath": "apps/theme-gallery-preview/themes/church-site",
-    "installable": true,
-    "icon": "theme"
-  }
+    "installable": false,
+    "icon": "theme",
+    "lineage": "nic",
+    "family": "community-faith",
+    "normalization": "canonical_id_assigned",
+    "canonicalId": "cypress",
+    "legacyPackageName": "@inneranimalmedia/theme-church-site"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/theme-church-site"
+  },
+  "private": true
 }

package/packages/theme-church-site/src/harvest.json

@@ -2,7 +2,7 @@
   "harvest_batch": "theme-harvest-20260924",
   "app_path": "apps/church-site",
   "harvest_path": "work/theme-harvest/church-site",
-  "status": "scaffolded",
+  "status": "needs_normalization",
   "source_hash": "0a8ae5de768f874ccdebe92a5e438ad8e4d51b4c5fdae9679c7e09268328fee6",
   "capabilities": [
     "cms.media",
@@ -10,5 +10,7 @@
     "deploy.receipt",
     "forms.leads",
     "theme.storefront.shell"
-  ]
+  ],
+  "lineage": "nic",
+  "family": "community-faith"
 }

package/packages/theme-church-site/src/index.js

@@ -1,7 +1,9 @@
-/** Deterministic installable theme contract for AgentSam gallery/CMS. */
+/** Harvested donor-derived theme wrapper — not installable until remaster gates pass. */
 const THEME = {
   "id": "theme.church-site",
   "slug": "church-site",
+  "lineage": "nic",
+  "family": "community-faith",
   "displayName": "New Iberia Church of Christ",
   "version": "0.1.0",
   "kind": "gallery-theme",
@@ -41,7 +43,7 @@ const THEME = {
     "mobile": "/themes/church-site/demo/",
     "demoUrl": "/themes/church-site/demo/"
   },
-  "installable": true,
+  "installable": false,
   "galleryPath": "apps/theme-gallery-preview/themes/church-site",
   "capabilityHints": [
     "theme.storefront.shell"
@@ -70,7 +72,9 @@ export function createProductRow({ accountId = null, repositoryId = null, status
     package_name: theme.package,
     metadata: {
       origin: "gallery_mount",
-      normalization_state: status === "production" ? "promoted" : "portable-preview",
+      normalization_state: status === "production" ? "promoted" : "needs_normalization",
+      lineage: theme.lineage,
+      family: theme.family,
       package: theme.package,
       gallery_path: theme.galleryPath,
       preview_kind: theme.preview?.kind || "static",

package/packages/theme-church-site/test/theme.test.mjs

@@ -2,10 +2,12 @@ import assert from 'node:assert/strict';
 import test from 'node:test';
 import { createTheme, createProductRow } from '../src/index.js';
 
-test('church-site theme package exports installable contract', () => {
+test('church-site theme package exports harvested (not installable) contract', () => {
   const theme = createTheme();
   assert.equal(theme.slug, "church-site");
-  assert.equal(theme.installable, true);
+  assert.equal(theme.installable, false);
+  assert.equal(theme.lineage, "nic");
+  assert.equal(theme.family, "community-faith");
   assert.equal(theme.package, "@inneranimalmedia/theme-church-site");
   assert.ok(Array.isArray(theme.pages));
 });

package/packages/theme-companions-site/package.json

@@ -1,7 +1,7 @@
 {
-  "name": "@inneranimalmedia/theme-companions-site",
-  "version": "0.1.0",
-  "description": "Real Companions of Caddo public static surface \u2014 mission, campaigns, and involvement paths.",
+  "name": "@inneranimalmedia/theme-violet",
+  "version": "2.6.7",
+  "description": "Real Companions of Caddo public static surface — mission, campaigns, and involvement paths.",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
@@ -25,7 +25,18 @@
     "kind": "theme",
     "slug": "companions-site",
     "galleryPath": "apps/theme-gallery-preview/themes/companions-site",
-    "installable": true,
-    "icon": "theme"
-  }
+    "installable": false,
+    "icon": "theme",
+    "lineage": "coc",
+    "family": "nonprofit-campaign",
+    "normalization": "canonical_id_assigned",
+    "canonicalId": "violet",
+    "legacyPackageName": "@inneranimalmedia/theme-companions-site"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/theme-companions-site"
+  },
+  "private": true
 }

package/packages/theme-companions-site/src/harvest.json

@@ -2,11 +2,13 @@
   "harvest_batch": "theme-harvest-20260924",
   "app_path": "apps/companions-site",
   "harvest_path": "work/theme-harvest/companions-site",
-  "status": "scaffolded",
+  "status": "needs_normalization",
   "source_hash": "cdad95d1a674b05456a6166f9fc70d86dce106d4215395601164ec40ac161f7b",
   "capabilities": [
     "cms.media",
     "cms.pages",
     "theme.storefront.shell"
-  ]
+  ],
+  "lineage": "coc",
+  "family": "nonprofit-campaign"
 }

package/packages/theme-companions-site/src/index.js

@@ -1,7 +1,9 @@
-/** Deterministic installable theme contract for AgentSam gallery/CMS. */
+/** Harvested donor-derived theme wrapper — not installable until remaster gates pass. */
 const THEME = {
   "id": "theme.companions-site",
   "slug": "companions-site",
+  "lineage": "coc",
+  "family": "nonprofit-campaign",
   "displayName": "Companions of Caddo",
   "version": "0.1.0",
   "kind": "gallery-theme",
@@ -39,7 +41,7 @@ const THEME = {
     "mobile": "/themes/companions-site/demo/",
     "demoUrl": "/themes/companions-site/demo/"
   },
-  "installable": true,
+  "installable": false,
   "galleryPath": "apps/theme-gallery-preview/themes/companions-site",
   "capabilityHints": [
     "theme.storefront.shell"
@@ -68,7 +70,9 @@ export function createProductRow({ accountId = null, repositoryId = null, status
     package_name: theme.package,
     metadata: {
       origin: "gallery_mount",
-      normalization_state: status === "production" ? "promoted" : "portable-preview",
+      normalization_state: status === "production" ? "promoted" : "needs_normalization",
+      lineage: theme.lineage,
+      family: theme.family,
       package: theme.package,
       gallery_path: theme.galleryPath,
       preview_kind: theme.preview?.kind || "static",

package/packages/theme-companions-site/test/theme.test.mjs

@@ -2,10 +2,12 @@ import assert from 'node:assert/strict';
 import test from 'node:test';
 import { createTheme, createProductRow } from '../src/index.js';
 
-test('companions-site theme package exports installable contract', () => {
+test('companions-site theme package exports harvested (not installable) contract', () => {
   const theme = createTheme();
   assert.equal(theme.slug, "companions-site");
-  assert.equal(theme.installable, true);
+  assert.equal(theme.installable, false);
+  assert.equal(theme.lineage, "coc");
+  assert.equal(theme.family, "nonprofit-campaign");
   assert.equal(theme.package, "@inneranimalmedia/theme-companions-site");
   assert.ok(Array.isArray(theme.pages));
 });

package/packages/theme-floors-site/package.json

@@ -1,7 +1,7 @@
 {
-  "name": "@inneranimalmedia/theme-floors-site",
-  "version": "0.1.0",
-  "description": "Real Anything Floors & More public site \u2014 services, gallery, process, and contact.",
+  "name": "@inneranimalmedia/theme-grove",
+  "version": "2.6.7",
+  "description": "Real Anything Floors & More public site — services, gallery, process, and contact.",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
@@ -25,7 +25,18 @@
     "kind": "theme",
     "slug": "floors-site",
     "galleryPath": "apps/theme-gallery-preview/themes/floors-site",
-    "installable": true,
-    "icon": "theme"
-  }
+    "installable": false,
+    "icon": "theme",
+    "lineage": "afm",
+    "family": "service-gallery",
+    "normalization": "canonical_id_assigned",
+    "canonicalId": "grove",
+    "legacyPackageName": "@inneranimalmedia/theme-floors-site"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/theme-floors-site"
+  },
+  "private": true
 }

package/packages/theme-floors-site/src/harvest.json

@@ -2,7 +2,7 @@
   "harvest_batch": "theme-harvest-20260924",
   "app_path": "apps/floors-site",
   "harvest_path": "work/theme-harvest/floors-site",
-  "status": "scaffolded",
+  "status": "needs_normalization",
   "source_hash": "2244de43568a0bb08d7d3779971c1fc0c6c832c226a65c7bb4313e8ac039add8",
   "capabilities": [
     "cms.media",
@@ -10,5 +10,7 @@
     "deploy.receipt",
     "forms.leads",
     "theme.storefront.shell"
-  ]
+  ],
+  "lineage": "afm",
+  "family": "service-gallery"
 }

package/packages/theme-floors-site/src/index.js

@@ -1,7 +1,9 @@
-/** Deterministic installable theme contract for AgentSam gallery/CMS. */
+/** Harvested donor-derived theme wrapper — not installable until remaster gates pass. */
 const THEME = {
   "id": "theme.floors-site",
   "slug": "floors-site",
+  "lineage": "afm",
+  "family": "service-gallery",
   "displayName": "Anything Floors & More",
   "version": "0.1.0",
   "kind": "gallery-theme",
@@ -39,7 +41,7 @@ const THEME = {
     "mobile": "/themes/floors-site/demo/",
     "demoUrl": "/themes/floors-site/demo/"
   },
-  "installable": true,
+  "installable": false,
   "galleryPath": "apps/theme-gallery-preview/themes/floors-site",
   "capabilityHints": [
     "theme.storefront.shell"
@@ -68,7 +70,9 @@ export function createProductRow({ accountId = null, repositoryId = null, status
     package_name: theme.package,
     metadata: {
       origin: "gallery_mount",
-      normalization_state: status === "production" ? "promoted" : "portable-preview",
+      normalization_state: status === "production" ? "promoted" : "needs_normalization",
+      lineage: theme.lineage,
+      family: theme.family,
       package: theme.package,
       gallery_path: theme.galleryPath,
       preview_kind: theme.preview?.kind || "static",