@inneranimalmedia/agentsam-sdk 1.9.0 → 2.0.0-alpha.identity

package/DEVELOPMENT.md

@@ -1,4 +1,4 @@
-# DEVELOPING AGENTSAM-SDK WITH INNER ANIMAL MEDIA
+# Developing agentsam-sdk with Inner Animal Media
 
 ## Local smoke test
 
@@ -47,9 +47,25 @@ npx agentsam init \
 2. `npm test` passes
 3. Bump version in root `package.json`
 4. Confirm `files` includes consumer surfaces (`src`, `bin`, `python`, `protocol`, …)
-5. `npm publish --access public` (manual; requires `npm login` to org)
-6. Tag: `git tag vX.Y.Z && git push origin vX.Y.Z`
-7. Record pairing in [`docs/RELEASES.md`](./docs/RELEASES.md): `iam@<40-sha> ↔ @inneranimalmedia/agentsam-sdk@X.Y.Z`
+5. `bash scripts/npm-publish-preflight.sh` — must print `npm whoami: inneranimalmedia`
+6. `npm publish --tag alpha --access public` (or `--tag latest` for stable)
+7. Tag: `git tag vX.Y.Z && git push origin vX.Y.Z`
+8. Record pairing in [`docs/RELEASES.md`](./docs/RELEASES.md): `iam@<40-sha> ↔ @inneranimalmedia/agentsam-sdk@X.Y.Z`
+
+### Publish 404 (`PUT … Not found`)
+
+npm returns **404** (not 403) when you are logged in as the **wrong user** for scope `@inneranimalmedia`.
+
+- Registry maintainer for this package: **`inneranimalmedia`** (see `npm view @inneranimalmedia/agentsam-sdk maintainers`)
+- Fix: `npm whoami` must be `inneranimalmedia`
+  ```bash
+  npm logout
+  npm login   # npm user inneranimalmedia (org owner), not personal GitHub-linked account
+  bash scripts/npm-publish-preflight.sh
+  npm publish --tag alpha --access public
+  ```
+- If you use a team org on npmjs.com, invite your daily npm user as **Developer** on the org with publish rights.
+- Always pass `--access public` (already in `package.json` `publishConfig`; flag is harmless).
 
 Workspace packages under `packages/*` (e.g. `@inneranimalmedia/agentsam-shell-kit`) stay
 `private: true` until separately ready — they are **not** the root publish identity.

package/README.md

@@ -6,7 +6,7 @@ Agent Sam is a full-stack autonomous agent SDK built on Cloudflare Workers, D1,
 
 **Repo:** [github.com/SamPrimeaux/agentsam-sdk](https://github.com/SamPrimeaux/agentsam-sdk) · **npm:** `@inneranimalmedia/agentsam-sdk`
 
-**Protocol (dual-home, no drift):** [`protocol/README.md`](./protocol/README.md) — every tool/feature lands in this repo **and** `inneranimalmedia/agentsam-sdk/`; npm publish is manual after mirror. Python lane: [`python/`](./python/).
+**Protocol (dual-home, no drift):** [`protocol/README.md`](./protocol/README.md) — every tool/feature lands in this repo **and** `inneranimalmedia/agentsam-sdk/`; npm publish is manual after mirror. Python lane: [`python/`](./python/) (stdlib-only). Optional network Python package: [`packages/agentsam-site-scrape/`](./packages/agentsam-site-scrape/) (live experimental; does not break the stdlib core).
 
 ---
 
@@ -78,17 +78,25 @@ npx @inneranimalmedia/agentsam-sdk shell
 | Piece | Location |
 |-------|----------|
 | Slash command registry | `src/lib/slash-commands.js` |
-| Phase 0 visual prototype | `examples/gorilla-shell/` |
+| Phase 0 visual prototype | `templates/gorilla-shell/` (canonical; `examples/gorilla-shell/` is a pointer) |
 | Architecture + phases | [docs/CLI_SHELL.md](./docs/CLI_SHELL.md) |
 
 Run the prototype:
 
 ```bash
-cd examples/gorilla-shell && npm install && npm run dev
+cd templates/gorilla-shell && npm install && npm run dev
 ```
 
 ---
 
+## Architecture (CORE default)
+
+`src/lib/core-client.js` defaults to `https://inneranimalmedia.com`. **Correct as designed** for serving many client projects: the npm package is a thin delivery/CLI client; intelligence, tool catalog, and policy live server-side on IAM CORE.
+
+Without an IAM backend (or `IAM_CORE_URL` / `AGENTSAM_CORE_URL` override), strangers who `npm install` get **scaffold + local CLI only** — not a freestanding hosted Agent Sam.
+
+---
+
 ## Installation
 
 ```bash

package/docs/RELEASES.iam-mirror.md

@@ -8,10 +8,10 @@ Canonical npm-side table also lives in the SDK repo: `docs/RELEASES.md`.
 | npm version | Published (UTC) | IAM git SHA (40) | Notes |
 |-------------|-----------------|------------------|-------|
 | 1.7.0 | 2026-07-14 | _(pre-receipt)_ | Prior publish |
-| 1.9.0 | _(pending publish)_ | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `repository.inspect` + `--dupes`; mirrored from IAM agentsam-sdk |
+| 1.9.0 | 2026-08-05T07:12:21.726Z | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `repository.inspect` + `--dupes`; mirrored from IAM agentsam-sdk |
 | 1.8.0 | 2026-08-02T13:57:12.080Z | `580547301e370b77ec26bd72558979d335feedd9` | `python/` + `protocol/` in tarball; `repository.scan_bloat`; shell-kit under `packages/` |
 
-**Latest pairing (ready to publish):** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`
+**Latest pairing :** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`
 
 ### Receipt rules
 

package/docs/RELEASES.md

@@ -3,7 +3,7 @@
 | npm version | Published (UTC) | IAM git SHA (40) | Notes |
 |-------------|-----------------|------------------|-------|
 | 1.7.0 | 2026-07-14 | _(pre-receipt)_ | Prior publish |
-| 1.9.0 | _(pending publish)_ | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `python/agentsam_sdk/repository/inspect.py` (`--dupes`); CLI `agentsam repository inspect` |
+| 1.9.0 | 2026-08-05T07:12:21.726Z | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `python/agentsam_sdk/repository/inspect.py` (`--dupes`); CLI `agentsam repository inspect` |
 | 1.8.0 | 2026-08-02T13:57:12.080Z | `580547301e370b77ec26bd72558979d335feedd9` | `python/` + `protocol/` in npm `files`; `repository.scan_bloat`; shell-kit folded to `packages/agentsam-shell-kit` (private). SDK git at publish: `ac52669b89ddb16fad87c42fe53f2c93ef13bd1a`. |
 
-**Pairing (ready to publish):** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`
+**Pairing :** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`

package/docs/identity/README.md

@@ -0,0 +1,11 @@
+# AgentSam SDK — Identity module
+
+See [`packages/identity/README.md`](../packages/identity/README.md).
+
+Customer import:
+
+```js
+import { createIdentityClient } from '@inneranimalmedia/agentsam-sdk';
+```
+
+Alpha: `@inneranimalmedia/agentsam-sdk@2.0.0-alpha.identity`

package/examples/gorilla-shell/README.md

@@ -1,22 +1,15 @@
-# Gorilla Shell (Phase 0)
+# Gorilla Shell example (superseded)
 
-Game-feel terminal UI prototype — consolidated from [InnerAnimal/gorilla-mode](https://github.com/InnerAnimal/gorilla-mode) into **Agent Sam SDK**.
+**Canonical scaffold:** [`../../templates/gorilla-shell/`](../../templates/gorilla-shell/)
 
-This is the **unique install experience** layer: pixel HUD, themed moods, slash-command demos, deploy/benchmark scenarios. Phase 1 connects real PTY via ExecOS.
-
-## Run locally
+This directory previously mirrored an older demo that hard-coded IAM D1/host
+literals. Run and customize from `templates/gorilla-shell` instead:
 
 ```bash
-cd examples/gorilla-shell
+cd templates/gorilla-shell
 npm install
 npm run dev
 ```
 
-## What you see
-
-- Gorilla launch screen + sprite reactions
-- Themes: NIGHT, DAY, LAVA, VOID
-- Six demo scenarios (deploy, benchmark, D1, tail, samiam, wrangler)
-- Slash command registry lives in `../../src/lib/slash-commands.js`
-
-Full architecture: [docs/CLI_SHELL.md](../../docs/CLI_SHELL.md)
+Demo CLI strings there use `{{PROJECT_NAME}}`, `{{D1_DATABASE_ID}}`,
+`{{DASHBOARD_HOST}}`, and related placeholders — not live platform IDs.

package/package.json

@@ -1,11 +1,13 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk",
-  "version": "1.9.0",
+  "version": "2.0.0-alpha.identity",
   "description": "Agent Sam is a full-stack AI agent SDK for autonomous task execution \u2014 covering data management, creative workflows, design commands, and multi-step agentic pipelines.",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
+    "./identity": "./packages/identity/src/index.js",
+    "./identity/oauth/callback": "./packages/identity/src/oauth/callback.js",
     "./package.json": "./package.json"
   },
   "bin": {
@@ -14,6 +16,7 @@
   },
   "files": [
     "src",
+    "packages/identity",
     "templates",
     "docs",
     "examples",
@@ -26,10 +29,12 @@
     "DEVELOPMENT.md"
   ],
   "workspaces": [
-    "packages/*"
+    "packages/agentsam-shell-kit",
+    "packages/identity"
   ],
   "scripts": {
-    "test": "node test/smoke.mjs",
+    "test": "node test/smoke.mjs && npm --prefix packages/identity test",
+    "test:identity": "npm --prefix packages/identity test",
     "smoke": "node test/smoke.mjs",
     "prepublishOnly": "npm test"
   },

package/packages/identity/README.md

@@ -0,0 +1,68 @@
+# Identity (`packages/identity`)
+
+**Package #1** inside `@inneranimalmedia/agentsam-sdk` — not a separate npm product.
+
+```
+inneranimalmedia (reference) → agentsam-sdk (product) → Legendary-OS (first external proof)
+```
+
+## Customer API
+
+```js
+import { createIdentityClient } from '@inneranimalmedia/agentsam-sdk';
+
+const identity = createIdentityClient({
+  portal: { brand: { name: 'Legendary OS', logoUrl: '/logo.svg' } },
+});
+
+identity.providers.google();
+identity.login(request);   // → Identity Service (server-side)
+identity.session.fromRequest(request);
+```
+
+## Layout
+
+```
+src/
+  core/           identity · sessions · accounts · recovery
+  providers/      google · github · gcp · email
+  oauth/          authorize/callback (extract from IAM — next sprint)
+  adapters/       inneranimalmedia · cloudflare-d1
+  contracts/
+  frontend/auth-portal/pages/   login · signup · reset (verbatim IAM HTML)
+migrations/
+examples/legendary-os/
+```
+
+## SDK philosophy
+
+Ship: contracts, clients, adapters, scaffolding.
+
+Do **not** ship in the client bundle: password DB logic, OAuth secrets, D1 assumptions.
+
+## Publish (alpha)
+
+From `main` after tests pass:
+
+```bash
+npm test
+npm publish --tag alpha
+```
+
+Install in a customer app:
+
+```bash
+npm install @inneranimalmedia/agentsam-sdk@alpha
+# or pin: @inneranimalmedia/agentsam-sdk@2.0.0-alpha.identity
+```
+
+Subpath imports:
+
+```js
+import { createIdentityClient } from '@inneranimalmedia/agentsam-sdk';
+import { finalizeInboundOAuth } from '@inneranimalmedia/agentsam-sdk/identity/oauth/callback';
+```
+
+## IAM design lab
+
+`inneranimalmedia/packages/agentsam-identity/` — contracts experiments only; **not** the package owner.

package/packages/identity/backend/README.md

@@ -0,0 +1,26 @@
+# Backend — identity runtime
+
+Worker-side identity: providers, OAuth finalize, sessions, adapters.
+
+## IAM extraction map (stable production — do not rewrite)
+
+| SDK target | IAM source today | Notes |
+|------------|------------------|-------|
+| `providers/google/*` | `src/core/auth/providers/google.js` | ✅ ported Sprint 2 |
+| `providers/github/*` | `src/core/auth/providers/github.js` | ✅ ported Sprint 2 |
+| `oauth/callback.js` | `src/api/oauth-login-callbacks.js` → `finalizeInboundOAuth` | **bulletproof path** |
+| `oauth/authorize.js` | `src/api/auth.js` OAuth start handlers | PKCE + state |
+| `core/session-service.js` | `src/core/auth.js` | cookie, `createLoginSession`, revoke |
+| `core/account-linking.js` | `ensureIdentityPlaneBeforeSession`, `ensureAppUser` | account_identities |
+| `adapters/inneranimalmedia/*` | D1 writes in auth side-effects | tenant/workspace stays adapter-only |
+
+## Rule
+
+Move files; **do not** change OAuth behavior until IAM runs parallel proof (existing users, Google/GitHub callbacks, session cookie).
+
+## Public entry
+
+```js
+import { createIdentity, GoogleProvider } from '@agentsam/identity';
+// resolves to backend/index.js
+```

package/packages/identity/docs/getting-started.md

@@ -0,0 +1,16 @@
+# Getting started with @agentsam/identity
+
+1. Install: `npm install @agentsam/identity`
+2. Configure providers and storage adapter
+3. Wire Worker routes for OAuth callback + session cookie
+
+Full plan: Phase 1–9 in IAM `plans/active/AGENTSAM-IDENTITY-SDK-PRODUCTIZATION-2026-08.md`
+
+```js
+import { createIdentity, GoogleProvider } from '@agentsam/identity';
+
+const identity = createIdentity({
+  providers: [GoogleProvider],
+  storage: { adapter: 'cloudflare-d1', binding: 'DB' },
+});
+```

package/packages/identity/examples/cloudflare-worker/README.md

@@ -0,0 +1,5 @@
+# Cloudflare Worker + D1 example (Phase 7)
+
+Minimal worker wiring for `@agentsam/identity` with `adapters/cloudflare-d1`.
+
+Scaffold lands in Sprint 5 after IAM adapter proves the storage contract.

package/packages/identity/examples/legendary-os/README.md

@@ -0,0 +1,27 @@
+# Legendary-OS — @agentsam/identity customer proof
+
+Target: fresh install path (Phase 7).
+
+## Day 1
+
+```bash
+npm install @agentsam/identity
+npx agentsam identity init --adapter cloudflare-d1
+```
+
+## Day 2 proof checklist
+
+- [ ] Email signup → session cookie
+- [ ] Email login
+- [ ] Logout clears session
+- [ ] Google OAuth round-trip
+- [ ] GitHub OAuth round-trip
+
+## Day 3
+
+- [ ] Workspace creation on first login
+- [ ] Dashboard requires auth
+
+Record curl transcripts and D1 row counts in `PROOF.md` when complete.
+
+See: `inneranimalmedia/plans/active/AGENTSAM-IDENTITY-SDK-PRODUCTIZATION-2026-08.md`

package/packages/identity/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@inneranimalmedia/agentsam-sdk-identity",
+  "version": "2.0.0-alpha.identity",
+  "private": true,
+  "type": "module",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./provider-contract": "./src/provider-contract.js",
+    "./providers": "./src/providers/index.js",
+    "./providers/google": "./src/providers/google/index.js",
+    "./providers/github": "./src/providers/github/index.js",
+    "./providers/gcp": "./src/providers/gcp/index.js",
+    "./providers/email": "./src/providers/email/index.js",
+    "./contracts/identity": "./src/contracts/identity.js",
+    "./contracts/session": "./src/contracts/session.js",
+    "./contracts/provider": "./src/contracts/provider.js",
+    "./contracts/external-identity": "./src/contracts/external-identity.js",
+    "./oauth/callback": "./src/oauth/callback.js",
+    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*"
+  },
+  "scripts": {
+    "test": "node --test tests/*.test.mjs"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -0,0 +1,4 @@
+/** Cloudflare D1 storage adapter — Sprint 5. */
+export function createCloudflareD1Adapter(_env) {
+  throw new Error('cloudflare_d1_adapter_not_implemented');
+}

package/packages/identity/src/adapters/inneranimalmedia/README.md

@@ -0,0 +1,7 @@
+# InnerAnimalMedia adapter (Sprint 3+)
+
+Maps IAM D1 tables (`auth_users`, `accounts`, `account_identities`, `auth_sessions`, …)
+into portable AgentSam Identity contracts.
+
+IAM-specific behavior (tenant resolution, workspace membership, OAuth callback wiring)
+stays here — not in `providers/`.

package/packages/identity/src/contracts/external-identity.js

@@ -0,0 +1,35 @@
+/**
+ * Portable external identity shape — storage-agnostic.
+ * Adapters map this into application-specific account_identities rows.
+ */
+
+/** @typedef {import('../provider-contract.js').NormalizedExternalIdentity} NormalizedExternalIdentity */
+
+/**
+ * @param {Partial<NormalizedExternalIdentity> & { provider: string; subject: string }} input
+ * @returns {NormalizedExternalIdentity}
+ */
+export function normalizeExternalIdentity(input) {
+  const provider = String(input?.provider || '').trim().toLowerCase();
+  const subject = String(input?.subject || '').trim();
+  if (!provider || !subject) {
+    throw new Error('external_identity_requires_provider_and_subject');
+  }
+
+  const email =
+    typeof input?.email === 'string' && input.email.trim()
+      ? input.email.trim().toLowerCase()
+      : null;
+
+  return {
+    provider,
+    subject,
+    email,
+    emailVerified: input?.emailVerified === true,
+    name: typeof input?.name === 'string' && input.name.trim() ? input.name.trim() : null,
+    avatar: typeof input?.avatar === 'string' && input.avatar.trim() ? input.avatar.trim() : null,
+    username:
+      typeof input?.username === 'string' && input.username.trim() ? input.username.trim() : null,
+    raw: input?.raw && typeof input.raw === 'object' ? input.raw : null,
+  };
+}

package/packages/identity/src/contracts/identity.js

@@ -0,0 +1,17 @@
+/**
+ * AgentSam Identity contracts.
+ *
+ * These are intentionally storage-agnostic. The IAM adapter maps them to
+ * existing D1 tables (auth_users, accounts, memberships, sessions).
+ */
+
+export const IdentityContractVersion = '1.0';
+
+export function normalizeIdentityUser(user) {
+  return {
+    id: user?.id ?? null,
+    email: user?.email ?? null,
+    displayName: user?.displayName ?? user?.name ?? null,
+    type: user?.type ?? 'human',
+  };
+}

package/packages/identity/src/contracts/provider.js

@@ -0,0 +1,8 @@
+/** External identity provider contract. */
+
+export const IdentityProviders = Object.freeze([
+  'email',
+  'google',
+  'github',
+  'gcp',
+]);

package/packages/identity/src/contracts/session.js

@@ -0,0 +1,9 @@
+/** Session contract shared by identity adapters. */
+export function normalizeIdentitySession(session) {
+  return {
+    id: session?.id ?? null,
+    userId: session?.userId ?? session?.user_id ?? null,
+    expiresAt: session?.expiresAt ?? session?.expires_at ?? null,
+    revokedAt: session?.revokedAt ?? session?.revoked_at ?? null,
+  };
+}

package/packages/identity/src/core/accounts.js

@@ -0,0 +1,4 @@
+/** Account linking contract surface — implementation in adapters + Identity Service. */
+export function accountLinkingNotConfigured() {
+  throw new Error('account_linking_requires_identity_service_adapter');
+}

package/packages/identity/src/core/browser-paths.js

@@ -0,0 +1,34 @@
+import { AUTH_LOGIN_PATH, AUTH_SIGNUP_PATH } from './constants.js';
+
+export function sanitizeBrowserNextPath(raw) {
+  if (raw == null) return null;
+  const s = String(raw).trim();
+  if (!s.startsWith('/') || s.startsWith('//')) return null;
+  if (/^[a-zA-Z][a-zA-Z+\-.]*:/.test(s) || s.includes('://')) return null;
+
+  let pathname = s;
+  let search = '';
+  const q = s.indexOf('?');
+  if (q !== -1) {
+    pathname = s.slice(0, q);
+    search = s.slice(q);
+  }
+  const lower = pathname.toLowerCase();
+  if (lower === '/login' || lower === '/auth/signin') pathname = AUTH_LOGIN_PATH;
+  else if (lower === '/signup' || lower === '/auth/register') pathname = AUTH_SIGNUP_PATH;
+
+  return pathname + search;
+}
+
+/** Customer adapter may supply apexDomain override for Set-Cookie. */
+export function getApexDomain(hostname, opts = {}) {
+  const override = opts?.apexDomain != null ? String(opts.apexDomain).trim() : '';
+  if (override) return override;
+  if (!hostname) return '';
+  const parts = hostname.split('.');
+  if (parts.length >= 2) {
+    if (hostname.endsWith('.workers.dev') || hostname.endsWith('.pages.dev')) return '';
+    return parts.slice(-2).join('.');
+  }
+  return hostname;
+}

package/packages/identity/src/core/constants.js

@@ -0,0 +1,9 @@
+/** SDK-portable session/auth path constants. */
+export const AUTH_COOKIE_NAME = 'session';
+export const AUTH_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
+export const MIN_AGENT_SESSION_TTL_SECONDS = 60;
+export const MAX_AGENT_SESSION_TTL_SECONDS = 86400;
+export const DEFAULT_AGENT_SESSION_TTL_SECONDS = 900;
+export const AUTH_LOGIN_PATH = '/auth/login';
+export const AUTH_SIGNUP_PATH = '/auth/signup';
+export const DASHBOARD_AFTER_LOGIN_PATH = '/dashboard/home';

package/packages/identity/src/core/errors.js

@@ -0,0 +1,8 @@
+export class AuthError extends Error {
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = 'AuthError';
+    this.status = opts.status ?? 401;
+    this.code = opts.code ?? 'UNAUTHORIZED';
+  }
+}

package/packages/identity/src/core/http-json.js

@@ -0,0 +1,10 @@
+function jsonStringifySafe(value) {
+  return JSON.stringify(value, (_k, v) => (typeof v === 'bigint' ? v.toString() : v));
+}
+
+export function jsonResponse(body, status = 200) {
+  return new Response(jsonStringifySafe(body), {
+    status: Number(status) || 200,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}

package/packages/identity/src/core/identity.js

@@ -0,0 +1,4 @@
+/**
+ * Identity core — user resolution (client surface).
+ */
+export { normalizeIdentityUser, IdentityContractVersion } from '../contracts/identity.js';

package/packages/identity/src/core/index.js

@@ -0,0 +1,10 @@
+export { AuthError } from './errors.js';
+export { sanitizeBrowserNextPath, getApexDomain } from './browser-paths.js';
+export { verifyPassword, hashPassword } from './password-crypto.js';
+export { jsonResponse } from './http-json.js';
+export {
+  trimSessionField,
+  buildSessionKvPayload,
+  normalizeIdentitySession,
+  isInboundOAuthSuccess,
+} from './sessions.js';

package/packages/identity/src/core/password-crypto.js

@@ -0,0 +1,53 @@
+function hexToBytes(hex) {
+  const arr = [];
+  for (let i = 0; i < hex.length; i += 2) arr.push(parseInt(hex.slice(i, i + 2), 16));
+  return new Uint8Array(arr);
+}
+
+export async function verifyPassword(password, saltHex, hashHex) {
+  try {
+    const salt = hexToBytes(saltHex);
+    const key = await crypto.subtle.importKey(
+      'raw',
+      new TextEncoder().encode(password),
+      { name: 'PBKDF2' },
+      false,
+      ['deriveBits'],
+    );
+    const derived = await crypto.subtle.deriveBits(
+      { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
+      key,
+      256,
+    );
+    const derivedHex = Array.from(new Uint8Array(derived))
+      .map((b) => b.toString(16).padStart(2, '0'))
+      .join('');
+    return derivedHex === hashHex.toLowerCase();
+  } catch (e) {
+    console.warn('[verifyPassword] failed', e.message);
+    return false;
+  }
+}
+
+export async function hashPassword(password) {
+  const salt = crypto.getRandomValues(new Uint8Array(32));
+  const saltHex = Array.from(salt)
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('');
+  const key = await crypto.subtle.importKey(
+    'raw',
+    new TextEncoder().encode(password),
+    { name: 'PBKDF2' },
+    false,
+    ['deriveBits'],
+  );
+  const derived = await crypto.subtle.deriveBits(
+    { name: 'PBKDF2', salt, iterations: 100000, hash: 'SHA-256' },
+    key,
+    256,
+  );
+  const hashHex = Array.from(new Uint8Array(derived))
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('');
+  return { saltHex, hashHex };
+}

package/packages/identity/src/core/recovery.js

@@ -0,0 +1,4 @@
+/** Password reset / recovery — client routes only; tokens verified server-side. */
+export function recoveryNotConfigured() {
+  throw new Error('recovery_requires_identity_service_adapter');
+}