@inneranimalmedia/agentsam-sdk 2.6.9 → 2.6.11

package/src/models/inventory-core.js

@@ -24,6 +24,75 @@ export const WORKERS_AI_CURATED_MODEL_IDS = Object.freeze([
 ]);
 
 const CURATED = new Set(WORKERS_AI_CURATED_MODEL_IDS);
+export const PROVIDER_MODEL_SNAPSHOT_SCHEMA = 'agentsam.provider-model-snapshot.v1';
+
+function modelSnapshotHash(modelIds) {
+  const source = modelIds.join('\n');
+  let hash = 2166136261;
+  for (let index = 0; index < source.length; index += 1) {
+    hash ^= source.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return `fnv1a32:${(hash >>> 0).toString(16).padStart(8, '0')}`;
+}
+
+/**
+ * Compact credential-scoped availability evidence for an existing
+ * `agentsam_plugins` AI installation. The global catalog remains curated
+ * reference data; discovery never creates one model row per user.
+ */
+export function createProviderModelSnapshot(provider, models = [], options = {}) {
+  const providerId = String(provider || '').trim().toLowerCase();
+  if (!providerId) throw new TypeError('provider_required');
+  const modelIds = [...new Set(models.map((row) => String(
+    typeof row === 'string' ? row : row?.provider_model_id || row?.model_id || '',
+  ).trim()).filter(Boolean))].sort();
+  const fetchedAtUnix = Number.isFinite(Number(options.fetchedAtUnix))
+    ? Math.max(0, Math.floor(Number(options.fetchedAtUnix)))
+    : Math.floor(Date.now() / 1000);
+  return Object.freeze({
+    schema: PROVIDER_MODEL_SNAPSHOT_SCHEMA,
+    provider: providerId,
+    model_ids: Object.freeze(modelIds),
+    model_count: modelIds.length,
+    models_hash: modelSnapshotHash(modelIds),
+    fetched_at_unix: fetchedAtUnix,
+    authority: 'credential_scoped_provider_discovery',
+  });
+}
+
+/**
+ * Produce fields for the existing `agentsam_plugins` row. Failed probes keep
+ * the last good snapshot while updating health evidence; no secret or model
+ * catalog rows are written.
+ */
+export function createAiPluginProbePatch(previousMetadata = {}, discovery = {}, options = {}) {
+  const now = Number.isFinite(Number(options.fetchedAtUnix))
+    ? Math.max(0, Math.floor(Number(options.fetchedAtUnix)))
+    : Math.floor(Date.now() / 1000);
+  const metadata = previousMetadata && typeof previousMetadata === 'object' && !Array.isArray(previousMetadata)
+    ? { ...previousMetadata }
+    : {};
+  if (discovery.ok === true) {
+    metadata.model_snapshot = createProviderModelSnapshot(
+      options.provider || discovery.provider,
+      discovery.models || [],
+      { fetchedAtUnix: now },
+    );
+  }
+  const error = String(discovery.error || '').trim();
+  const authFailure = /\b(?:401|403)\b|unauthoriz|forbidden|invalid[_ -]?(?:api[_ -]?)?key|credential.*reject/i.test(error);
+  return Object.freeze({
+    metadata,
+    health_status: discovery.ok === true ? 'healthy' : authFailure ? 'auth_error' : 'unreachable',
+    last_health_at: now,
+    ...(discovery.ok === true ? { last_healthy_at: now, consecutive_failures: 0, last_error_code: null, last_error_message: null } : {
+      consecutive_failures_delta: 1,
+      last_error_code: authFailure ? 'provider_credential_rejected' : 'provider_discovery_failed',
+      last_error_message: authFailure ? 'Provider credential rejected' : 'Provider model discovery failed',
+    }),
+  });
+}
 
 const SERVICE_TO_PROVIDER = Object.freeze({
   openai: 'openai',

package/src/plugins/index.js

@@ -5,7 +5,15 @@ export {
   INNERANIMALMEDIA_CLOUDFLARE_OAUTH_PLUGIN_MANIFEST,
 } from './cloudflare.js';
 export { COMPLETEFUL_PLUGIN_MANIFEST } from './completeful.js';
-export { installPlugin, listPlugins, listPluginTools, recordPluginHealthCheck, recordToolCall } from './registry.js';
+export {
+  installPlugin,
+  listPlugins,
+  listPluginTools,
+  updatePluginPreferences,
+  recordPluginHealthCheck,
+  recordAiPluginModelDiscovery,
+  recordToolCall,
+} from './registry.js';
 export { createPluginRuntime, createPluginCapabilityAdapter, executeAgentSamTool } from './runtime.js';
 export { resolveProjectPluginScope, resolveProjectPluginResources, resolveProjectRuntimeResources, resolveProjectVectorizeScope } from './resource-scope.js';
 export { resolveVectorizeConfig, executeVectorizeTool } from './vectorize.js';

package/src/plugins/registry.js

@@ -1,4 +1,5 @@
 import { normalizePluginManifest } from './contracts.js';
+import { createAiPluginProbePatch } from '../models/inventory-core.js';
 
 function clean(value) { return value == null ? '' : String(value).trim(); }
 function json(value, fallback) { try { return JSON.parse(String(value ?? '')); } catch { return fallback; } }
@@ -41,9 +42,11 @@ export async function installPlugin(db, options = {}) {
         provider_key=?, plugin_kind=?, category=?, display_name=?, short_name=?, description=?, mention_aliases_json=?,
         endpoint_url=?, transport=?, auth_type=?, secret_ref=?, oauth_connect_url=?, capabilities_json=?, tool_lanes_json=?,
         resource_scope_json=?, config_json=?, metadata_json=?, icon_url=?, icon_dark_url=?, icon_alt=?, icon_fit=?,
-        composer_visible=?, settings_visible=?, sort_priority=?, health_strategy=?, is_enabled=1, updated_at=unixepoch()
+        composer_visible=?, settings_visible=?, sort_priority=?, health_strategy=?,
+        is_enabled=CASE WHEN ? THEN is_enabled ELSE 1 END,
+        updated_at=unixepoch()
       WHERE id=?
-    `, [...values, pluginId]);
+    `, [...values, options.preserveEnabled === true ? 1 : 0, pluginId]);
   } else {
     await runMutation(db, `
       INSERT INTO agentsam_plugins (
@@ -121,11 +124,13 @@ export async function installPlugin(db, options = {}) {
 export async function listPlugins(db, options = {}) {
   const accountId = clean(options.accountId);
   const environment = clean(options.environment || 'production');
+  const includeDisabled = options.includeDisabled === true;
   const result = await db.prepare(`
     SELECT * FROM agentsam_plugins
-    WHERE account_id = ? AND environment = ? AND is_enabled = 1
+    WHERE account_id = ? AND environment = ?
+      AND (? = 1 OR is_enabled = 1)
     ORDER BY sort_priority, display_name
-  `).bind(accountId, environment).all();
+  `).bind(accountId, environment, includeDisabled ? 1 : 0).all();
   return (result?.results || []).map((row) => ({
     ...row,
     mention_aliases: json(row.mention_aliases_json, []), capabilities: json(row.capabilities_json, []),
@@ -136,18 +141,67 @@ export async function listPlugins(db, options = {}) {
 
 export async function listPluginTools(db, options = {}) {
   const accountId = clean(options.accountId);
+  const includeDisabledPlugins = options.includeDisabledPlugins === true;
   const result = await db.prepare(`
     SELECT t.* FROM agentsam_tools t
     JOIN agentsam_plugins p ON p.id = t.plugin_id
-    WHERE t.account_id = ? AND t.is_active = 1 AND p.is_enabled = 1
+    WHERE t.account_id = ? AND t.is_active = 1
+      AND (? = 1 OR p.is_enabled = 1)
     ORDER BY t.connector_priority, t.sort_priority, t.tool_name
-  `).bind(accountId).all();
+  `).bind(accountId, includeDisabledPlugins ? 1 : 0).all();
   return (result?.results || []).map((row) => ({
     ...row, input_schema: json(row.input_schema, {}), output_schema: json(row.output_schema, null),
     handler_config: json(row.handler_config, {}), intent_tags: json(row.intent_tags, []),
   }));
 }
 
+
+export async function updatePluginPreferences(db, options = {}) {
+  if (!db?.prepare) throw new TypeError('D1-compatible database binding required');
+  const accountId = clean(options.accountId);
+  const pluginId = clean(options.pluginId);
+  if (!accountId) throw new Error('plugin_account_id_required');
+  if (!pluginId) throw new Error('plugin_id_required');
+
+  const fields = [];
+  const values = [];
+  if (typeof options.enabled === 'boolean') {
+    fields.push('is_enabled=?');
+    values.push(options.enabled ? 1 : 0);
+  }
+  if (typeof options.composerVisible === 'boolean') {
+    fields.push('composer_visible=?');
+    values.push(options.composerVisible ? 1 : 0);
+  }
+  if (typeof options.settingsVisible === 'boolean') {
+    fields.push('settings_visible=?');
+    values.push(options.settingsVisible ? 1 : 0);
+  }
+  if (!fields.length) throw new Error('plugin_preferences_empty');
+
+  await runMutation(db, `
+    UPDATE agentsam_plugins
+    SET ${fields.join(', ')}, updated_at=unixepoch()
+    WHERE id=? AND account_id=?
+  `, [...values, pluginId, accountId]);
+
+  const row = await db.prepare(`
+    SELECT * FROM agentsam_plugins
+    WHERE id=? AND account_id=?
+    LIMIT 1
+  `).bind(pluginId, accountId).first();
+  if (!row) throw new Error('plugin_not_found');
+  return {
+    ...row,
+    mention_aliases: json(row.mention_aliases_json, []),
+    capabilities: json(row.capabilities_json, []),
+    tool_lanes: json(row.tool_lanes_json, []),
+    resource_scope: json(row.resource_scope_json, {}),
+    config: json(row.config_json, {}),
+    metadata: json(row.metadata_json, {}),
+  };
+}
+
 export async function recordPluginHealthCheck(db, value = {}) {
   const startedAt = Number(value.startedAt || Math.floor(Date.now() / 1000));
   const completedAt = Number(value.completedAt || Math.floor(Date.now() / 1000));
@@ -188,6 +242,61 @@ export async function recordPluginHealthCheck(db, value = {}) {
   return { id: checkId, status: value.status };
 }
 
+/**
+ * Persist credential-verified AI model availability in the existing plugin
+ * installation metadata. A failed probe records health evidence but preserves
+ * the last successful model snapshot.
+ */
+export async function recordAiPluginModelDiscovery(db, value = {}) {
+  if (!db?.prepare) throw new TypeError('D1-compatible database binding required');
+  const pluginId = clean(value.pluginId);
+  const accountId = clean(value.accountId);
+  if (!pluginId) throw new Error('plugin_id_required');
+  if (!accountId) throw new Error('plugin_account_id_required');
+  const plugin = await db.prepare(`
+    SELECT id, plugin_key, provider_key, environment, plugin_kind, metadata_json
+    FROM agentsam_plugins WHERE id = ? AND account_id = ? LIMIT 1
+  `).bind(pluginId, accountId).first();
+  if (!plugin) throw new Error(`plugin_not_found:${pluginId}`);
+  if (clean(plugin.plugin_kind) !== 'ai') throw new Error(`plugin_not_ai:${pluginId}`);
+
+  const probe = createAiPluginProbePatch(json(plugin.metadata_json, {}), value.discovery || {}, {
+    provider: value.provider || plugin.provider_key,
+    fetchedAtUnix: value.completedAt,
+  });
+  await runMutation(db, `
+    UPDATE agentsam_plugins SET metadata_json = ?, updated_at = unixepoch()
+    WHERE id = ? AND account_id = ?
+  `, [JSON.stringify(probe.metadata), pluginId, accountId]);
+
+  const snapshot = probe.metadata.model_snapshot || null;
+  const health = await recordPluginHealthCheck(db, {
+    pluginId,
+    pluginKey: plugin.plugin_key,
+    accountId,
+    environment: plugin.environment,
+    checkKind: 'model_inventory',
+    checkSource: value.checkSource || 'provider_discovery',
+    status: probe.health_status,
+    startedAt: value.startedAt,
+    completedAt: probe.last_health_at,
+    latencyMs: value.latencyMs,
+    httpStatus: value.httpStatus,
+    providerRequestId: value.providerRequestId,
+    errorCode: probe.last_error_code,
+    errorMessage: probe.last_error_message,
+    details: snapshot ? {
+      schema: snapshot.schema,
+      provider: snapshot.provider,
+      model_count: snapshot.model_count,
+      models_hash: snapshot.models_hash,
+      fetched_at_unix: snapshot.fetched_at_unix,
+      ...(value.discovery?.ok === true ? {} : { snapshot_preserved: true }),
+    } : { provider: clean(value.provider || plugin.provider_key), snapshot_preserved: true },
+  });
+  return Object.freeze({ ...health, plugin_id: pluginId, health_status: probe.health_status, model_snapshot: snapshot });
+}
+
 export async function recordToolCall(db, value = {}) {
   const callId = clean(value.id) || id('atcl');
   await runMutation(db, `

package/src/receipts/contract.js

@@ -0,0 +1,68 @@
+export const RECEIPT_ENVELOPE_SCHEMA = "agentsam.receipt.v1";
+export const SCHEMA_BASE_URL = "https://schemas.inneranimalmedia.com";
+export const SCHEMAS_BUCKET_NAME = "inneranimalmedia-schemas";
+export const RECEIPT_SCHEMA_URL =
+  `${SCHEMA_BASE_URL}/agentsam/schemas/agentsam.receipt.v1.json`;
+export const RECEIPT_R2_PREFIX = "agentsam/runtime/receipts/v1";
+export const BLOB_R2_PREFIX = "agentsam/runtime/blobs/sha256";
+
+export function validateReceiptEnvelope(receipt) {
+  const errors = [];
+  if (!receipt || typeof receipt !== "object") {
+    return { ok: false, errors: ["receipt must be an object"] };
+  }
+  if (receipt.schema !== RECEIPT_ENVELOPE_SCHEMA) {
+    errors.push(`schema must be ${RECEIPT_ENVELOPE_SCHEMA}`);
+  }
+  if (!receipt.receipt_id) errors.push("receipt_id is required");
+  if (!receipt.kind) errors.push("kind is required");
+  if (!["passed", "failed", "skipped"].includes(receipt.status)) {
+    errors.push("status must be passed, failed, or skipped");
+  }
+  if (
+    !["ephemeral_success", "failure_bundle", "release_proof"].includes(
+      receipt.retention_class,
+    )
+  ) {
+    errors.push("retention_class is invalid");
+  }
+  if (!receipt.identity?.account_id) {
+    errors.push("identity.account_id is required");
+  }
+  if (!Number.isFinite(Number(receipt.metrics?.created_at_unix))) {
+    errors.push("metrics.created_at_unix is required");
+  }
+  for (const artifact of receipt.evidence?.artifacts || []) {
+    if (
+      artifact.r2_key &&
+      !String(artifact.r2_key).startsWith(`${BLOB_R2_PREFIX}/`)
+    ) {
+      errors.push(
+        `artifact r2_key must start with ${BLOB_R2_PREFIX}/`,
+      );
+    }
+  }
+  return Object.freeze({ ok: errors.length === 0, errors: Object.freeze(errors) });
+}
+
+export function receiptDatePrefix(receipt) {
+  const unix = Number(receipt?.metrics?.created_at_unix);
+  if (!Number.isFinite(unix) || unix < 0) {
+    throw new TypeError("receipt.metrics.created_at_unix is required");
+  }
+  return new Date(unix * 1000).toISOString().slice(0, 10).replace(/-/g, "/");
+}
+
+export function receiptR2Key(receipt) {
+  return `${RECEIPT_R2_PREFIX}/${receiptDatePrefix(receipt)}/${receipt.receipt_id}.json`;
+}
+
+export function retentionExpiresAt(receipt, nowUnix = Math.floor(Date.now() / 1000)) {
+  if (receipt.retention_class === "ephemeral_success") {
+    return nowUnix + 7 * 86400;
+  }
+  if (receipt.retention_class === "failure_bundle") {
+    return nowUnix + 60 * 86400;
+  }
+  return null;
+}

package/src/receipts/index.js

@@ -0,0 +1,20 @@
+export {
+  BLOB_R2_PREFIX,
+  RECEIPT_ENVELOPE_SCHEMA,
+  RECEIPT_R2_PREFIX,
+  RECEIPT_SCHEMA_URL,
+  SCHEMA_BASE_URL,
+  SCHEMAS_BUCKET_NAME,
+  receiptDatePrefix,
+  receiptR2Key,
+  retentionExpiresAt,
+  validateReceiptEnvelope,
+} from "./contract.js";
+export {
+  CompositeReceiptSink,
+  D1ReceiptCatalog,
+  LocalReceiptSink,
+  R2ReceiptSink,
+  ReceiptCatalogReader,
+} from "./sinks.js";
+export { pruneLocalWorkspaces } from "./prune.js";

package/src/receipts/prune.js

@@ -0,0 +1,64 @@
+import { readdir, rm, stat } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
+async function directorySize(root) {
+  let total = 0;
+  const entries = await readdir(root, { withFileTypes: true }).catch(() => []);
+  for (const entry of entries) {
+    const full = path.join(root, entry.name);
+    if (entry.isDirectory()) total += await directorySize(full);
+    else if (entry.isFile()) total += (await stat(full)).size;
+  }
+  return total;
+}
+
+export async function pruneLocalWorkspaces({
+  maxTmpGb = 1,
+  tmpDir = os.tmpdir(),
+  prefix = "agentsam-",
+  dryRun = false,
+  detailLimit = 100,
+} = {}) {
+  const maxBytes = Math.max(0, Number(maxTmpGb)) * 1024 * 1024 * 1024;
+  const entries = await readdir(tmpDir, { withFileTypes: true });
+  const targets = [];
+
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !entry.name.startsWith(prefix)) continue;
+    const fullPath = path.join(tmpDir, entry.name);
+    const info = await stat(fullPath);
+    const byteSize = await directorySize(fullPath);
+    targets.push({ path: fullPath, mtime: info.mtimeMs, byteSize });
+  }
+
+  targets.sort((a, b) => a.mtime - b.mtime);
+  let remainingBytes = targets.reduce((sum, target) => sum + target.byteSize, 0);
+  const purged = [];
+
+  for (const target of targets) {
+    if (remainingBytes <= maxBytes) break;
+    if (!dryRun) {
+      await rm(target.path, { recursive: true, force: true });
+    }
+    remainingBytes -= target.byteSize;
+    purged.push(target);
+  }
+
+  const boundedDetailLimit = Math.max(0, Math.min(1000, Number(detailLimit) || 0));
+  const purgeDetails = purged
+    .slice(0, boundedDetailLimit)
+    .map((item) => Object.freeze({ ...item }));
+
+  return Object.freeze({
+    maxBytes,
+    scannedCount: targets.length,
+    purgedCount: purged.length,
+    purgedBytes: purged.reduce((sum, item) => sum + item.byteSize, 0),
+    remainingBytes: Math.max(0, remainingBytes),
+    dryRun,
+    purged: Object.freeze(purgeDetails),
+    purgedDetailLimit: boundedDetailLimit,
+    purgedDetailsTruncated: purged.length > purgeDetails.length,
+  });
+}