@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/apps/client-cms-editor/package.json

@@ -1,23 +1,135 @@
 {
   "name": "@inneranimalmedia/client-cms-editor",
-  "version": "0.1.0",
-  "private": true,
+  "version": "2.6.7",
+  "private": false,
+  "description": "Reusable full-stack website + CMS kit with multi-page public sites, a protected authoring dashboard, local SQLite, starter/theme import, and pluggable auth, storage, and deployment adapters.",
   "type": "module",
+  "license": "UNLICENSED",
   "workspaces": [
     "frontend",
     "backend",
     "shared/*"
   ],
+  "bin": {
+    "agentsam-cms": "bin/agentsam-cms.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json",
+    "./acceptance": "./acceptance/cms-parity.v1.json",
+    "./adapter": {
+      "types": "./dist/adapter.d.ts",
+      "import": "./dist/adapter.js"
+    },
+    "./sqlite-adapter": {
+      "types": "./dist/sqlite-adapter.d.ts",
+      "import": "./dist/sqlite-adapter.js"
+    },
+    "./import": {
+      "types": "./dist/import/index.d.ts",
+      "import": "./dist/import/index.js"
+    },
+    "./local": {
+      "types": "./dist/local/index.d.ts",
+      "import": "./dist/local/index.js"
+    },
+    "./shared": {
+      "types": "./dist/shared/index.d.ts",
+      "import": "./dist/shared/index.js"
+    },
+    "./backend": {
+      "types": "./dist/backend/index.d.ts",
+      "import": "./dist/backend/index.js"
+    },
+    "./backend/api": {
+      "types": "./dist/backend/api.d.ts",
+      "import": "./dist/backend/api.js"
+    },
+    "./backend/model": {
+      "types": "./dist/backend/model.d.ts",
+      "import": "./dist/backend/model.js"
+    },
+    "./backend/preview": {
+      "types": "./dist/backend/preview.d.ts",
+      "import": "./dist/backend/preview.js"
+    },
+    "./backend/routing": {
+      "import": "./dist/backend/routing.js"
+    },
+    "./styles/studio.css": "./dist/styles/studio.css"
+  },
+  "files": [
+    "ALPHA.md",
+    "AGENTS.md",
+    "README.md",
+    "IMPORT_PROVENANCE.json",
+    "agentsam.app.json",
+    "acceptance",
+    "bin",
+    "dist"
+  ],
   "scripts": {
     "dev": "npm run dev -w @inneranimalmedia/agentsam-cms-frontend",
-    "build": "npm run build -w @inneranimalmedia/agentsam-cms-frontend",
+    "build": "tsup",
+    "build:app": "npm run build -w @inneranimalmedia/agentsam-cms-frontend",
     "preview": "npm run preview -w @inneranimalmedia/agentsam-cms-frontend",
     "typecheck": "npm run typecheck --workspaces --if-present",
     "test": "npm run test --workspaces --if-present",
-    "clean": "rm -rf frontend/dist coverage",
-    "cf:dry-run": "npm run build && wrangler deploy -c backend/wrangler.jsonc --dry-run"
+    "clean": "rm -rf dist frontend/dist coverage",
+    "cf:dry-run": "npm run build:app && wrangler deploy -c backend/wrangler.jsonc --dry-run",
+    "verify:cms-package": "node scripts/verify-cms-package.mjs",
+    "verify:cms-adapter-smoke": "node scripts/verify-cms-adapter-smoke.mjs",
+    "verify:cms-sqlite-smoke": "node scripts/verify-cms-sqlite-smoke.mjs",
+    "verify:cms-browser-smoke": "node scripts/verify-cms-browser-smoke.mjs",
+    "verify:cms-theme-import": "node scripts/verify-cms-theme-import.mjs",
+    "pack:check": "node scripts/verify-cms-pack.mjs",
+    "verify:cms-release": "node scripts/verify-cms-release.mjs",
+    "verify:cms": "npm run verify:cms-package && npm run verify:cms-adapter-smoke && npm run verify:cms-sqlite-smoke && npm run verify:cms-theme-import && npm run verify:cms-browser-smoke && npm run pack:check",
+    "prepublishOnly": "npm run build && npm run verify:cms-release"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "alpha"
+  },
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "wrangler": "4.142.0"
+    "@types/node": "^26.6.3",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "esbuild": "^0.25.12",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "tsup": "^8.5.0",
+    "typescript": "^5.9.3",
+    "wrangler": "4.145.0"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "apps/client-cms-editor"
+  },
+  "agentsam": {
+    "releaseIgnore": [
+      "adapters",
+      "backend",
+      "frontend",
+      "import",
+      "local",
+      "scripts",
+      "shared",
+      "starter-packs",
+      "tsup.config.ts"
+    ]
   }
 }

package/apps/client-cms-editor/reference/harvest/HARVEST_RECEIPT.json

@@ -0,0 +1,201 @@
+{
+  "schema": "studio-cms-editor.harvest-receipt.v1",
+  "created_at": "2026-09-27T22:47:42.525529+00:00",
+  "source": {
+    "repository": "https://github.com/SamPrimeaux/studio-cms-editor",
+    "branch": "harvest/studio-cms-extraction-kit-20260927",
+    "commit": "2cefa5d9c05f2c3344973403d4a60f4b13320881",
+    "dirty_status": [
+      "M package-lock.json"
+    ]
+  },
+  "output": "/Users/samprimeaux/studio-cms-editor-harvest-export",
+  "lanes": {
+    "cms_editor_donor": [
+      {
+        "path": "app/studio/page.tsx",
+        "status": "copied",
+        "bytes": 75767,
+        "sha256": "85149c5432693c3a03a67f0fc186f1de4548918240661fb9f31a96932feadae2"
+      },
+      {
+        "path": "app/globals.css",
+        "status": "copied",
+        "bytes": 53300,
+        "sha256": "e5899adbcdc989ac1f0d09660aa411120179ffac32647d370b616ea59b9ef07d"
+      }
+    ],
+    "chatgpt_identity_reference": [
+      {
+        "path": "app/chatgpt-auth.ts",
+        "status": "copied",
+        "bytes": 2404,
+        "sha256": "17a965f8948b21510cdf8ecbd70c5fdf58100e10970463f6a8fd2cc4795f8044"
+      }
+    ],
+    "theme_layout_donor": [
+      {
+        "path": "app/page.tsx",
+        "status": "copied",
+        "bytes": 111,
+        "sha256": "183499a04e710c1c8c735979dae7c2ea9c691c33c41ba1cb494d84c0eb1ce1b4"
+      },
+      {
+        "path": "app/components/Storefront.tsx",
+        "status": "copied",
+        "bytes": 9626,
+        "sha256": "87fcdb7007ec3fff5f2bfcbd8f46dfc6d31715b287070932ea418d93c5c8b218"
+      },
+      {
+        "path": "app/storefront-data.ts",
+        "status": "copied",
+        "bytes": 2714,
+        "sha256": "c420e7c3d745140802433183656aec439c585d2d62a9d76c14b14acfdc9b9036"
+      },
+      {
+        "path": "app/storefront.css",
+        "status": "copied",
+        "bytes": 13135,
+        "sha256": "1f6be0aa2845ddea45dbf4f3b41598a731315e971f8b86dfadd8487f60947901"
+      },
+      {
+        "path": "app/layout.tsx",
+        "status": "copied",
+        "bytes": 933,
+        "sha256": "b2123825ba67702367fc30b1fa909e38b0b32f11ae1e6c59082f255c7aaad73c"
+      },
+      {
+        "path": "app/shop/page.tsx",
+        "status": "copied",
+        "bytes": 106,
+        "sha256": "e2db5cdb8e92e9efdf2680501870ab9a20fd3283b3301da54c7b4664f0aa2317"
+      },
+      {
+        "path": "app/collections/[slug]/page.tsx",
+        "status": "copied",
+        "bytes": 1044,
+        "sha256": "dd0906dd747e4d30b6631ddfafba7e0c00866378b0c93a850183c81509818a78"
+      },
+      {
+        "path": "app/product/[slug]/page.tsx",
+        "status": "copied",
+        "bytes": 372,
+        "sha256": "cc574253a9ebada8c32f90b090ebfa2e4a01306d3ebfa9f1aaf98358c4926d38"
+      },
+      {
+        "path": "app/journal/page.tsx",
+        "status": "copied",
+        "bytes": 112,
+        "sha256": "7c6aca788d1eb5bdbbf1dfbf3cd485578f098938a421ceb66fa240f3589c654b"
+      },
+      {
+        "path": "app/journal/[slug]/page.tsx",
+        "status": "copied",
+        "bytes": 955,
+        "sha256": "b83473ce4420b54fc1cdd80f685135d4a1aa31821e22e9ec0924689f0430612f"
+      },
+      {
+        "path": "app/story/page.tsx",
+        "status": "copied",
+        "bytes": 108,
+        "sha256": "2ab17ab34b76191531049c83dc27b77db3e170c50b00dc3bcf582159d7ae2e82"
+      },
+      {
+        "path": "public/favicon.svg",
+        "status": "copied",
+        "bytes": 712,
+        "sha256": "e6d2e59b7b5bbb0342e0fb496dfc262decbfe4426bbb7b047aec8d467d1dc6f7"
+      }
+    ],
+    "content_plan_reference": [
+      {
+        "path": "plans/INNERANIMALS-CONTENT-001.md",
+        "status": "copied",
+        "bytes": 7320,
+        "sha256": "742fe1c21fcbece86ddd9663cc03b4e50e903001ddbb9e34ff706abeb085e4a0"
+      }
+    ],
+    "runtime_reference": [
+      {
+        "path": ".openai/hosting.json",
+        "status": "copied",
+        "bytes": 91,
+        "sha256": "4a2eb4f36976de086c24d2892f0cfdc48c58a85b39fa1f8569821f77f22ac508"
+      },
+      {
+        "path": "package.json",
+        "status": "copied",
+        "bytes": 1470,
+        "sha256": "d897171760d696c0947d43a987825a83f4648c18a12acd6a78da115ec37d14f4"
+      },
+      {
+        "path": "vite.config.ts",
+        "status": "copied",
+        "bytes": 1807,
+        "sha256": "43e5f02f727ca043f08ebf34789f330580a7a0cb90f426c92f4a454d066988fc"
+      },
+      {
+        "path": "next.config.ts",
+        "status": "copied",
+        "bytes": 133,
+        "sha256": "614bce25b089c3f19b1e17a6346c74b858034040154c6621e7d35303004767cc"
+      },
+      {
+        "path": "worker/index.ts",
+        "status": "copied",
+        "bytes": 1839,
+        "sha256": "781e66096fac222fbb58c4f46b096b7e6df729684e213176b00752a371857892"
+      },
+      {
+        "path": "worker/vpc.ts",
+        "status": "copied",
+        "bytes": 934,
+        "sha256": "5833a3fe8bf666d71fd5bfe31137256dd15da1faf99dc60cac1e3561a26bde76"
+      },
+      {
+        "path": "wrangler.production.toml",
+        "status": "copied",
+        "bytes": 2454,
+        "sha256": "8def7d9669d6f2ebc9a50baacb236000c8b7049f9dee3559f0cb9c86a83e28ad"
+      },
+      {
+        "path": "docs/workers-vpc.md",
+        "status": "copied",
+        "bytes": 2777,
+        "sha256": "d0003e81577f34c00d322abff54c6638c141026796fb34f10adda2d3bb3563c0"
+      },
+      {
+        "path": "drizzle.config.ts",
+        "status": "copied",
+        "bytes": 148,
+        "sha256": "af081f7384aaeb0082cf422e29f139d137ca2f6a57c69b2c37b9fb1f8479867b"
+      },
+      {
+        "path": "db/index.ts",
+        "status": "copied",
+        "bytes": 423,
+        "sha256": "dc7610b00b918e0ffff1360a63626f16655ced3064b2eaf96095a4101fb14bcd"
+      },
+      {
+        "path": "db/schema.ts",
+        "status": "copied",
+        "bytes": 169,
+        "sha256": "13ddacbf0be50e054d450a6c642b7fdc1aa943fd6b99084711e07e58b600390d"
+      },
+      {
+        "path": "README.md",
+        "status": "copied",
+        "bytes": 5436,
+        "sha256": "70ef40d45f8c381c87651db8828a2b085bfe3522eebccef2e074fc93a68716d9"
+      }
+    ]
+  },
+  "side_effects": {
+    "network_deploy": false,
+    "site_sync": false,
+    "cms_publish": false,
+    "asset_upload": false,
+    "database_write": false,
+    "active_sdk_package_write": false
+  }
+}

package/apps/client-cms-editor/reference/harvest/PROVENANCE_HISTORY.txt

@@ -0,0 +1,10 @@
+f0547d7 2026-07-22 Restore storefront scrolling and add content implementation plan
+4fa6aab 2026-07-22 Merge pull request #1 from SamPrimeaux/dependabot/npm_and_yarn/npm_and_yarn-601a66c84a
+47ed506 2026-07-21 Build Inner Animals storefront and VPC adoption scaffold
+f76586b 2026-07-21 fix(wrangler): main entry is dist/server/index.js not worker/index.ts (vinext compiled output)
+65685cb 2026-07-21 fix(wrangler): correct assets.directory to dist/client (vinext build output)
+2f2f907 2026-07-21 chore: add deploy:prod script for inneranimals production Worker
+36a7d5d 2026-07-21 chore: add wrangler.production.toml for inneranimals Worker (inneranimals.com)
+04968e3 2026-07-22 Bump the npm_and_yarn group across 1 directory with 4 updates
+b63cba7 2026-07-21 Build professional visual CMS editor
+c0f9923 2026-07-21 Initialize studio CMS editor

package/apps/client-cms-editor/reference/harvest/README.md

@@ -0,0 +1,8 @@
+# Harvest evidence (read-only)
+
+Copied from `~/.agentsam/harvest/studio-cms-editor-20260929` for in-tree acceptance.
+
+- Donor behavioral authority remains `/Users/samprimeaux/studio-cms-editor` (not modified by this lane).
+- Plans under `plans/` define what to keep, adapt, and drop.
+- Do not treat this folder as a runtime dependency of the published editor UI.
+- Forbidden-string scanners skip this directory so historical donor docs can mention deployment names without becoming product code.

package/apps/client-cms-editor/reference/harvest/plans/ARCHIVE-INTAKE.md

@@ -0,0 +1,135 @@
+# Archive Intake / Shopify Salvage
+
+The harvest workflow accepts historical website/theme material as first-class donor input.
+
+Supported intake:
+- directory
+- .zip
+- .tar
+- .tar.gz / .tgz
+- single-file .gz
+- Git .bundle
+
+Primary command:
+
+```bash
+python3 scripts/harvest_archive.py \
+  ~/Downloads/old-shopify-theme.zip \
+  ~/Backups/site-backup.tar.gz \
+  ~/Backups/old-site.bundle
+```
+
+macOS drag/drop into Terminal works because the CLI accepts one or many ordinary filesystem paths.
+
+## Safety
+
+Every source is unpacked into a quarantine directory beneath the harvest export.
+
+The extractor:
+- rejects absolute and parent-traversal archive paths,
+- refuses archive symlinks/hardlinks/special files,
+- limits file count,
+- limits total unpacked bytes,
+- skips build/cache junk by default,
+- never executes code from an archive,
+- never installs dependencies,
+- never deploys/uploads/syncs.
+
+Default limits:
+- 50,000 entries
+- 2 GiB unpacked bytes
+
+Override only deliberately.
+
+## Shopify detection
+
+The scanner looks for the canonical theme directories:
+- layout
+- sections
+- snippets
+- templates
+- config
+- locales
+- assets
+
+It also scores theme markers such as layout/theme.liquid and config/settings_schema.json.
+
+When a theme is detected, it creates:
+
+`packages/shopify-theme.zip`
+
+The canonical Shopify folders are placed directly at the ZIP root instead of nesting the original backup directory.
+
+## Custom HTML salvage
+
+Loose .html/.htm files are recorded as donor candidates.
+
+A separate:
+`packages/custom-html-liquid-salvage.zip`
+
+is emitted when custom HTML/Liquid donor material is found, so favorite historical sections can be repurposed without pretending they are already normalized CMS blocks.
+
+## Compact archival output
+
+Every intake emits:
+`packages/normalized-source.tar.gz`
+
+This is the preferred compact archival artifact for object storage.
+
+Optional:
+`--emit-zip`
+
+also creates:
+`packages/normalized-source.zip`
+
+Avoid creating every format for every artifact by default. Redundant ZIP + TAR + raw image copies are exactly how R2 archives become unnecessarily bloated.
+
+## Git bundle
+
+For a Git .bundle input, or a direct Git repository folder, the workflow can emit:
+`packages/repository.bundle`
+
+A Git bundle is preferred over zipping .git because it preserves repository history in a purpose-built portable format.
+
+## SQLite integration
+
+If:
+`<out>/local/inneranimals-cms.sqlite`
+
+already exists, archive intake records:
+- ingest
+- every extracted file hash/size/category
+- produced package hashes/sizes
+
+into local archive_* tables.
+
+This remains local provenance and does not make the historical archive production authority.
+
+## Expected storage pattern
+
+For R2 later, prefer storing:
+- one compact normalized-source.tar.gz for archival recovery,
+- one ARCHIVE_MANIFEST.json for cheap inspection/search,
+- shopify-theme.zip only when Shopify interoperability matters,
+- repository.bundle only when Git history matters,
+- optimized media once in canonical asset storage instead of repeated inside many packages.
+
+No R2 upload is performed by this script.
+
+## One-shot tooling lab with dragged archives
+
+The full AgentSam acceptance lab now accepts archive paths positionally:
+
+```bash
+python3 scripts/harvest_tooling_lab.py \
+  --sdk /Users/samprimeaux/agentsam-sdk \
+  --replace-export \
+  --replace-db \
+  ~/Downloads/theme-one.zip \
+  ~/Backups/old-site.bundle \
+  ~/Backups/host-backup.tar.gz
+```
+
+This runs donor harvest -> local CMS SQLite -> archive intake -> AgentSam safe probes in one command.
+
+Use `--emit-zip` on `harvest_archive.py` only when a general ZIP is actually useful. Use `--emit-tar` only for tools that specifically require an uncompressed tar. The compact default remains `normalized-source.tar.gz`.

package/apps/client-cms-editor/reference/harvest/plans/CHATGPT-IDENTITY-HARVEST.md

@@ -0,0 +1,83 @@
+# ChatGPT / OpenAI Identity Harvest
+
+## Why this is worth preserving
+
+`app/chatgpt-auth.ts` contains the hosted ChatGPT identity pattern that motivated part of the original CMS experience.
+
+This is valuable as a provider/adapter reference for AgentSam Identity.
+
+It is not an OpenAI inference integration.
+
+## Target package boundary
+
+Primary destination concept:
+
+`packages/identity/src/providers/openai/`
+
+Possible exports:
+
+- `@inneranimalmedia/agentsam-sdk/identity/providers/openai`
+- hosted ChatGPT identity adapter
+- partner-site Sign in with ChatGPT provider when OpenAI onboarding supports it
+
+## Normalized identity
+
+OpenAI/ChatGPT-specific transport details should normalize into the same external identity contract used by other AgentSam providers:
+
+```js
+{
+  provider: "openai",
+  subject: "<stable-provider-subject>",
+  email: "...",
+  emailVerified: true | false,
+  name: "...",
+  avatar: "...",
+  username: null
+}
+```
+
+The CMS should consume AgentSam identity/account context, not OpenAI headers.
+
+## Two integration modes
+
+### 1. ChatGPT-hosted environment
+
+Transport-specific request metadata/headers are interpreted by a hosted adapter.
+
+The old donor currently references:
+
+- `oai-authenticated-user-email`
+- `oai-authenticated-user-full-name`
+- `oai-authenticated-user-full-name-encoding`
+
+Treat those names as historical/reference evidence unless OpenAI documents them as a stable public contract for the target environment.
+
+### 2. External partner website
+
+Desired customer UX:
+
+`Continue with ChatGPT -> OpenAI consent -> callback -> AgentSam identity/account`
+
+Do not invent authorize/token endpoints. Keep the provider fail-closed until supported configuration is available.
+
+## Separate identity from AI provider access
+
+These are different capabilities:
+
+- ChatGPT/OpenAI identity: who the person is
+- OpenAI model provider: which inference credentials/capabilities AgentSam may use
+- delegated OpenAI/ChatGPT capabilities: any future explicit consent for additional user-authorized resources
+
+Signing in with ChatGPT must never be treated as permission to run paid inference or read unrelated ChatGPT data.
+
+## Packaging rule
+
+OpenAI should be optional just like Google, GitHub, Cloudflare, and IAM.
+
+Example future scaffold:
+
+```bash
+agentsam identity init --providers inneranimalmedia,google,openai
+```
+
+No unused provider should be forced into a generated customer app.