@inneranimalmedia/agentsam-sdk 1.9.0 → 2.0.0-alpha.identity.1

package/DEVELOPMENT.md

@@ -1,10 +1,11 @@
-# DEVELOPING AGENTSAM-SDK WITH INNER ANIMAL MEDIA
+# Developing agentsam-sdk with Inner Animal Media
 
 ## Local smoke test
 
 ```bash
 cd agentsam-sdk
 npm test
+npm run preview:auth-portal   # opens /auth/login at http://127.0.0.1:8791
 ```
 
 ## Link into a scaffolded project
@@ -47,9 +48,25 @@ npx agentsam init \
 2. `npm test` passes
 3. Bump version in root `package.json`
 4. Confirm `files` includes consumer surfaces (`src`, `bin`, `python`, `protocol`, …)
-5. `npm publish --access public` (manual; requires `npm login` to org)
-6. Tag: `git tag vX.Y.Z && git push origin vX.Y.Z`
-7. Record pairing in [`docs/RELEASES.md`](./docs/RELEASES.md): `iam@<40-sha> ↔ @inneranimalmedia/agentsam-sdk@X.Y.Z`
+5. `bash scripts/npm-publish-preflight.sh` — must print `npm whoami: inneranimalmedia`
+6. `npm publish --tag alpha --access public` (or `--tag latest` for stable)
+7. Tag: `git tag vX.Y.Z && git push origin vX.Y.Z`
+8. Record pairing in [`docs/RELEASES.md`](./docs/RELEASES.md): `iam@<40-sha> ↔ @inneranimalmedia/agentsam-sdk@X.Y.Z`
+
+### Publish 404 (`PUT … Not found`)
+
+npm returns **404** (not 403) when you are logged in as the **wrong user** for scope `@inneranimalmedia`.
+
+- Registry maintainer for this package: **`inneranimalmedia`** (see `npm view @inneranimalmedia/agentsam-sdk maintainers`)
+- Fix: `npm whoami` must be `inneranimalmedia`
+  ```bash
+  npm logout
+  npm login   # npm user inneranimalmedia (org owner), not personal GitHub-linked account
+  bash scripts/npm-publish-preflight.sh
+  npm publish --tag alpha --access public
+  ```
+- If you use a team org on npmjs.com, invite your daily npm user as **Developer** on the org with publish rights.
+- Always pass `--access public` (already in `package.json` `publishConfig`; flag is harmless).
 
 Workspace packages under `packages/*` (e.g. `@inneranimalmedia/agentsam-shell-kit`) stay
 `private: true` until separately ready — they are **not** the root publish identity.

package/README.md

@@ -6,7 +6,7 @@ Agent Sam is a full-stack autonomous agent SDK built on Cloudflare Workers, D1,
 
 **Repo:** [github.com/SamPrimeaux/agentsam-sdk](https://github.com/SamPrimeaux/agentsam-sdk) · **npm:** `@inneranimalmedia/agentsam-sdk`
 
-**Protocol (dual-home, no drift):** [`protocol/README.md`](./protocol/README.md) — every tool/feature lands in this repo **and** `inneranimalmedia/agentsam-sdk/`; npm publish is manual after mirror. Python lane: [`python/`](./python/).
+**Protocol (dual-home, no drift):** [`protocol/README.md`](./protocol/README.md) — every tool/feature lands in this repo **and** `inneranimalmedia/agentsam-sdk/`; npm publish is manual after mirror. Python lane: [`python/`](./python/) (stdlib-only). Optional network Python package: [`packages/agentsam-site-scrape/`](./packages/agentsam-site-scrape/) (live experimental; does not break the stdlib core).
 
 ---
 
@@ -78,17 +78,25 @@ npx @inneranimalmedia/agentsam-sdk shell
 | Piece | Location |
 |-------|----------|
 | Slash command registry | `src/lib/slash-commands.js` |
-| Phase 0 visual prototype | `examples/gorilla-shell/` |
+| Phase 0 visual prototype | `templates/gorilla-shell/` (canonical; `examples/gorilla-shell/` is a pointer) |
 | Architecture + phases | [docs/CLI_SHELL.md](./docs/CLI_SHELL.md) |
 
 Run the prototype:
 
 ```bash
-cd examples/gorilla-shell && npm install && npm run dev
+cd templates/gorilla-shell && npm install && npm run dev
 ```
 
 ---
 
+## Architecture (CORE default)
+
+`src/lib/core-client.js` defaults to `https://inneranimalmedia.com`. **Correct as designed** for serving many client projects: the npm package is a thin delivery/CLI client; intelligence, tool catalog, and policy live server-side on IAM CORE.
+
+Without an IAM backend (or `IAM_CORE_URL` / `AGENTSAM_CORE_URL` override), strangers who `npm install` get **scaffold + local CLI only** — not a freestanding hosted Agent Sam.
+
+---
+
 ## Installation
 
 ```bash

package/docs/RELEASES.iam-mirror.md

@@ -8,10 +8,10 @@ Canonical npm-side table also lives in the SDK repo: `docs/RELEASES.md`.
 | npm version | Published (UTC) | IAM git SHA (40) | Notes |
 |-------------|-----------------|------------------|-------|
 | 1.7.0 | 2026-07-14 | _(pre-receipt)_ | Prior publish |
-| 1.9.0 | _(pending publish)_ | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `repository.inspect` + `--dupes`; mirrored from IAM agentsam-sdk |
+| 1.9.0 | 2026-08-05T07:12:21.726Z | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `repository.inspect` + `--dupes`; mirrored from IAM agentsam-sdk |
 | 1.8.0 | 2026-08-02T13:57:12.080Z | `580547301e370b77ec26bd72558979d335feedd9` | `python/` + `protocol/` in tarball; `repository.scan_bloat`; shell-kit under `packages/` |
 
-**Latest pairing (ready to publish):** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`
+**Latest pairing :** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`
 
 ### Receipt rules
 

package/docs/RELEASES.md

@@ -2,8 +2,12 @@
 
 | npm version | Published (UTC) | IAM git SHA (40) | Notes |
 |-------------|-----------------|------------------|-------|
+| 2.0.0-alpha.identity | 2026-08-22 | `559bc37267f76790136004f5fa94a2bb3cd6a721` | Identity subpath (`./identity`); auth portal HTML from IAM peel; SDK git `c3a59d3`. |
+| 2.0.0-alpha.identity.1 | _(pending)_ | `559bc37267f76790136004f5fa94a2bb3cd6a721` | `agentsam identity preview` + `preview:auth-portal` local 1:1 auth shell preview. |
 | 1.7.0 | 2026-07-14 | _(pre-receipt)_ | Prior publish |
-| 1.9.0 | _(pending publish)_ | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `python/agentsam_sdk/repository/inspect.py` (`--dupes`); CLI `agentsam repository inspect` |
+| 1.9.0 | 2026-08-05T07:12:21.726Z | `fc1628505cb3c9946c149e4c468c2e264d6f381e` | `python/agentsam_sdk/repository/inspect.py` (`--dupes`); CLI `agentsam repository inspect` |
 | 1.8.0 | 2026-08-02T13:57:12.080Z | `580547301e370b77ec26bd72558979d335feedd9` | `python/` + `protocol/` in npm `files`; `repository.scan_bloat`; shell-kit folded to `packages/agentsam-shell-kit` (private). SDK git at publish: `ac52669b89ddb16fad87c42fe53f2c93ef13bd1a`. |
 
-**Pairing (ready to publish):** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`
+**Pairing (identity alpha):** `iam@559bc37267f76790136004f5fa94a2bb3cd6a721` ↔ `@inneranimalmedia/agentsam-sdk@2.0.0-alpha.identity`
+
+**Pairing (1.9):** `iam@fc1628505cb3c9946c149e4c468c2e264d6f381e` ↔ `@inneranimalmedia/agentsam-sdk@1.9.0`

package/docs/identity/README.md

@@ -0,0 +1,11 @@
+# AgentSam SDK — Identity module
+
+See [`packages/identity/README.md`](../packages/identity/README.md).
+
+Customer import:
+
+```js
+import { createIdentityClient } from '@inneranimalmedia/agentsam-sdk';
+```
+
+Alpha: `@inneranimalmedia/agentsam-sdk@2.0.0-alpha.identity`

package/examples/gorilla-shell/README.md

@@ -1,22 +1,15 @@
-# Gorilla Shell (Phase 0)
+# Gorilla Shell example (superseded)
 
-Game-feel terminal UI prototype — consolidated from [InnerAnimal/gorilla-mode](https://github.com/InnerAnimal/gorilla-mode) into **Agent Sam SDK**.
+**Canonical scaffold:** [`../../templates/gorilla-shell/`](../../templates/gorilla-shell/)
 
-This is the **unique install experience** layer: pixel HUD, themed moods, slash-command demos, deploy/benchmark scenarios. Phase 1 connects real PTY via ExecOS.
-
-## Run locally
+This directory previously mirrored an older demo that hard-coded IAM D1/host
+literals. Run and customize from `templates/gorilla-shell` instead:
 
 ```bash
-cd examples/gorilla-shell
+cd templates/gorilla-shell
 npm install
 npm run dev
 ```
 
-## What you see
-
-- Gorilla launch screen + sprite reactions
-- Themes: NIGHT, DAY, LAVA, VOID
-- Six demo scenarios (deploy, benchmark, D1, tail, samiam, wrangler)
-- Slash command registry lives in `../../src/lib/slash-commands.js`
-
-Full architecture: [docs/CLI_SHELL.md](../../docs/CLI_SHELL.md)
+Demo CLI strings there use `{{PROJECT_NAME}}`, `{{D1_DATABASE_ID}}`,
+`{{DASHBOARD_HOST}}`, and related placeholders — not live platform IDs.

package/package.json

@@ -1,19 +1,24 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk",
-  "version": "1.9.0",
-  "description": "Agent Sam is a full-stack AI agent SDK for autonomous task execution \u2014 covering data management, creative workflows, design commands, and multi-step agentic pipelines.",
+  "version": "2.0.0-alpha.identity.1",
+  "description": "Agent Sam is a full-stack AI agent SDK for autonomous task execution — covering data management, creative workflows, design commands, and multi-step agentic pipelines.",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
+    "./identity": "./packages/identity/src/index.js",
+    "./identity/oauth/callback": "./packages/identity/src/oauth/callback.js",
+    "./identity/auth-portal/preview": "./packages/identity/scripts/preview-auth-portal.mjs",
     "./package.json": "./package.json"
   },
   "bin": {
     "agentsam": "src/cli.js",
-    "agentsam-scaffold": "bin/scaffold.mjs"
+    "agentsam-scaffold": "bin/scaffold.mjs",
+    "agentsam-auth-portal": "packages/identity/scripts/preview-auth-portal.mjs"
   },
   "files": [
     "src",
+    "packages/identity",
     "templates",
     "docs",
     "examples",
@@ -26,11 +31,15 @@
     "DEVELOPMENT.md"
   ],
   "workspaces": [
-    "packages/*"
+    "packages/agentsam-shell-kit",
+    "packages/identity"
   ],
   "scripts": {
-    "test": "node test/smoke.mjs",
+    "test": "node test/smoke.mjs && npm --prefix packages/identity test",
+    "test:identity": "npm --prefix packages/identity test",
     "smoke": "node test/smoke.mjs",
+    "preview:auth-portal": "node packages/identity/scripts/preview-auth-portal.mjs --open",
+    "postinstall": "node packages/identity/scripts/postinstall-hint.mjs",
     "prepublishOnly": "npm test"
   },
   "engines": {

package/packages/identity/README.md

@@ -0,0 +1,68 @@
+# Identity (`packages/identity`)
+
+**Package #1** inside `@inneranimalmedia/agentsam-sdk` — not a separate npm product.
+
+```
+inneranimalmedia (reference) → agentsam-sdk (product) → Legendary-OS (first external proof)
+```
+
+## Customer API
+
+```js
+import { createIdentityClient } from '@inneranimalmedia/agentsam-sdk';
+
+const identity = createIdentityClient({
+  portal: { brand: { name: 'Legendary OS', logoUrl: '/logo.svg' } },
+});
+
+identity.providers.google();
+identity.login(request);   // → Identity Service (server-side)
+identity.session.fromRequest(request);
+```
+
+## Layout
+
+```
+src/
+  core/           identity · sessions · accounts · recovery
+  providers/      google · github · gcp · email
+  oauth/          authorize/callback (extract from IAM — next sprint)
+  adapters/       inneranimalmedia · cloudflare-d1
+  contracts/
+  frontend/auth-portal/pages/   login · signup · reset (verbatim IAM HTML)
+migrations/
+examples/legendary-os/
+```
+
+## SDK philosophy
+
+Ship: contracts, clients, adapters, scaffolding.
+
+Do **not** ship in the client bundle: password DB logic, OAuth secrets, D1 assumptions.
+
+## Publish (alpha)
+
+From `main` after tests pass:
+
+```bash
+npm test
+npm publish --tag alpha
+```
+
+Install in a customer app:
+
+```bash
+npm install @inneranimalmedia/agentsam-sdk@alpha
+# or pin: @inneranimalmedia/agentsam-sdk@2.0.0-alpha.identity
+```
+
+Subpath imports:
+
+```js
+import { createIdentityClient } from '@inneranimalmedia/agentsam-sdk';
+import { finalizeInboundOAuth } from '@inneranimalmedia/agentsam-sdk/identity/oauth/callback';
+```
+
+## IAM design lab
+
+`inneranimalmedia/packages/agentsam-identity/` — contracts experiments only; **not** the package owner.

package/packages/identity/backend/README.md

@@ -0,0 +1,26 @@
+# Backend — identity runtime
+
+Worker-side identity: providers, OAuth finalize, sessions, adapters.
+
+## IAM extraction map (stable production — do not rewrite)
+
+| SDK target | IAM source today | Notes |
+|------------|------------------|-------|
+| `providers/google/*` | `src/core/auth/providers/google.js` | ✅ ported Sprint 2 |
+| `providers/github/*` | `src/core/auth/providers/github.js` | ✅ ported Sprint 2 |
+| `oauth/callback.js` | `src/api/oauth-login-callbacks.js` → `finalizeInboundOAuth` | **bulletproof path** |
+| `oauth/authorize.js` | `src/api/auth.js` OAuth start handlers | PKCE + state |
+| `core/session-service.js` | `src/core/auth.js` | cookie, `createLoginSession`, revoke |
+| `core/account-linking.js` | `ensureIdentityPlaneBeforeSession`, `ensureAppUser` | account_identities |
+| `adapters/inneranimalmedia/*` | D1 writes in auth side-effects | tenant/workspace stays adapter-only |
+
+## Rule
+
+Move files; **do not** change OAuth behavior until IAM runs parallel proof (existing users, Google/GitHub callbacks, session cookie).
+
+## Public entry
+
+```js
+import { createIdentity, GoogleProvider } from '@agentsam/identity';
+// resolves to backend/index.js
+```

package/packages/identity/docs/getting-started.md

@@ -0,0 +1,16 @@
+# Getting started with @agentsam/identity
+
+1. Install: `npm install @agentsam/identity`
+2. Configure providers and storage adapter
+3. Wire Worker routes for OAuth callback + session cookie
+
+Full plan: Phase 1–9 in IAM `plans/active/AGENTSAM-IDENTITY-SDK-PRODUCTIZATION-2026-08.md`
+
+```js
+import { createIdentity, GoogleProvider } from '@agentsam/identity';
+
+const identity = createIdentity({
+  providers: [GoogleProvider],
+  storage: { adapter: 'cloudflare-d1', binding: 'DB' },
+});
+```

package/packages/identity/examples/cloudflare-worker/README.md

@@ -0,0 +1,5 @@
+# Cloudflare Worker + D1 example (Phase 7)
+
+Minimal worker wiring for `@agentsam/identity` with `adapters/cloudflare-d1`.
+
+Scaffold lands in Sprint 5 after IAM adapter proves the storage contract.

package/packages/identity/examples/legendary-os/README.md

@@ -0,0 +1,27 @@
+# Legendary-OS — @agentsam/identity customer proof
+
+Target: fresh install path (Phase 7).
+
+## Day 1
+
+```bash
+npm install @agentsam/identity
+npx agentsam identity init --adapter cloudflare-d1
+```
+
+## Day 2 proof checklist
+
+- [ ] Email signup → session cookie
+- [ ] Email login
+- [ ] Logout clears session
+- [ ] Google OAuth round-trip
+- [ ] GitHub OAuth round-trip
+
+## Day 3
+
+- [ ] Workspace creation on first login
+- [ ] Dashboard requires auth
+
+Record curl transcripts and D1 row counts in `PROOF.md` when complete.
+
+See: `inneranimalmedia/plans/active/AGENTSAM-IDENTITY-SDK-PRODUCTIZATION-2026-08.md`

package/packages/identity/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@inneranimalmedia/agentsam-sdk-identity",
+  "version": "2.0.0-alpha.identity.1",
+  "private": true,
+  "type": "module",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
+  "main": "./src/index.js",
+  "exports": {
+    ".": "./src/index.js",
+    "./provider-contract": "./src/provider-contract.js",
+    "./providers": "./src/providers/index.js",
+    "./providers/google": "./src/providers/google/index.js",
+    "./providers/github": "./src/providers/github/index.js",
+    "./providers/gcp": "./src/providers/gcp/index.js",
+    "./providers/email": "./src/providers/email/index.js",
+    "./contracts/identity": "./src/contracts/identity.js",
+    "./contracts/session": "./src/contracts/session.js",
+    "./contracts/provider": "./src/contracts/provider.js",
+    "./contracts/external-identity": "./src/contracts/external-identity.js",
+    "./oauth/callback": "./src/oauth/callback.js",
+    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*"
+  },
+  "scripts": {
+    "test": "node --test tests/*.test.mjs",
+    "preview:auth-portal": "node scripts/preview-auth-portal.mjs --open"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/packages/identity/scripts/postinstall-hint.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+if (process.env.CI || process.env.AGENTSAM_SDK_SKIP_POSTINSTALL) process.exit(0);
+
+console.log(`
+  @inneranimalmedia/agentsam-sdk — auth portal preview (local, 1:1 IAM HTML):
+    npx agentsam identity preview --open
+    npm run preview:auth-portal
+`);

package/packages/identity/scripts/preview-auth-portal.mjs

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+/**
+ * Local static preview for IAM auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
+ * API routes are stubbed so forms and globe-exit transitions work without a Worker.
+ */
+import http from 'node:http';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { spawn } from 'node:child_process';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+export const AUTH_PORTAL_PAGES_DIR = path.resolve(__dirname, '../src/frontend/auth-portal/pages');
+const PREVIEW_DIR = path.resolve(__dirname, '../src/frontend/auth-portal/preview');
+
+const PAGE_ROUTES = {
+  '/auth/login': 'login.html',
+  '/auth/signup': 'signup.html',
+  '/auth/reset': 'reset.html',
+};
+
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.js': 'application/javascript; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.webp': 'image/webp',
+};
+
+function parseArgs(argv) {
+  const opts = { port: 8791, host: '127.0.0.1', open: false };
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--open' || arg === '-o') opts.open = true;
+    else if (arg === '--port' || arg === '-p') opts.port = Number(argv[++i]) || opts.port;
+    else if (arg === '--host' || arg === '-H') opts.host = argv[++i] || opts.host;
+    else if (arg === '--help' || arg === '-h') {
+      console.log(`
+  Auth portal preview — same routes as IAM production HTML shells
+
+  Usage:
+    agentsam identity preview [--port 8791] [--open]
+    npm run preview:auth-portal
+
+  Pages:
+    /auth/login   /auth/signup   /auth/reset
+
+  Preview credentials (any host): email preview@example.com · password preview
+  OAuth buttons → stub page with link to globe-exit demo
+`);
+      process.exit(0);
+    }
+  }
+  return opts;
+}
+
+function json(res, status, body) {
+  const payload = JSON.stringify(body);
+  res.writeHead(status, {
+    'Content-Type': 'application/json; charset=utf-8',
+    'Content-Length': Buffer.byteLength(payload),
+  });
+  res.end(payload);
+  return true;
+}
+
+async function readText(filePath) {
+  return fs.readFile(filePath, 'utf8');
+}
+
+async function serveFile(res, filePath) {
+  const ext = path.extname(filePath);
+  const body = await fs.readFile(filePath);
+  res.writeHead(200, { 'Content-Type': MIME[ext] || 'application/octet-stream' });
+  res.end(body);
+}
+
+function hubHtml(baseUrl) {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+  <title>Auth portal preview | Agent Sam SDK</title>
+  <style>
+    body { font-family: Inter, system-ui, sans-serif; background: #050508; color: #e2e8f0; margin: 0; padding: 32px; line-height: 1.5; }
+    main { max-width: 640px; margin: 0 auto; }
+    h1 { font-size: 1.35rem; margin-bottom: 0.25rem; }
+    p.muted { color: #94a3b8; font-size: 0.95rem; }
+    ul { padding-left: 1.2rem; }
+    a { color: #38bdf8; }
+    code { background: rgba(255,255,255,0.08); padding: 2px 6px; border-radius: 4px; }
+    .card { margin-top: 24px; padding: 20px; border: 1px solid rgba(255,255,255,0.12); border-radius: 12px; background: rgba(255,255,255,0.04); }
+  </style>
+</head>
+<body>
+  <main>
+    <h1>Auth portal preview</h1>
+    <p class="muted">Static HTML copied from IAM <code>static/pages/auth/*</code> — paths match production.</p>
+    <div class="card">
+      <strong>Pages</strong>
+      <ul>
+        <li><a href="${baseUrl}/auth/login">/auth/login</a></li>
+        <li><a href="${baseUrl}/auth/signup">/auth/signup</a></li>
+        <li><a href="${baseUrl}/auth/reset">/auth/reset</a></li>
+        <li><a href="${baseUrl}/auth/login?globe_exit=1&amp;next=/preview/dashboard">Globe exit demo</a></li>
+      </ul>
+      <p><strong>Preview login:</strong> <code>preview@example.com</code> / <code>preview</code> (triggers success + globe transition)</p>
+      <p class="muted">OAuth buttons open a stub — use the globe-exit link to verify the post-login animation.</p>
+    </div>
+  </main>
+</body>
+</html>`;
+}
+
+function oauthStubHtml(provider, baseUrl) {
+  const label = provider === 'github' ? 'GitHub' : 'Google';
+  return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="UTF-8" /><title>OAuth preview (${label})</title>
+<style>body{font-family:system-ui;background:#050508;color:#e2e8f0;padding:32px;max-width:520px;margin:auto;line-height:1.5}a{color:#38bdf8}</style>
+</head><body>
+<h1>OAuth preview — ${label}</h1>
+<p>In production this redirects to the provider. In preview mode, use the link below to simulate a successful return and globe exit.</p>
+<p><a href="${baseUrl}/auth/login?globe_exit=1&amp;next=/preview/dashboard">Simulate OAuth success (globe exit)</a></p>
+<p><a href="${baseUrl}/auth/login">Back to sign in</a></p>
+</body></html>`;
+}
+
+async function handleApi(req, res, url) {
+  const { pathname } = url;
+  if (req.method === 'POST' && pathname === '/api/auth/login') {
+    let body = '';
+    for await (const chunk of req) body += chunk;
+    let parsed = {};
+    try { parsed = JSON.parse(body || '{}'); } catch { /* preview */ }
+    const email = String(parsed.email || '').trim().toLowerCase();
+    const password = String(parsed.password || '');
+    if (email === 'preview@example.com' && password === 'preview') {
+      return json(res, 200, {
+        ok: true,
+        redirect: parsed.next && String(parsed.next).startsWith('/') ? parsed.next : '/preview/dashboard',
+      });
+    }
+    return json(res, 401, { ok: false, error: 'Invalid Identity or Access Key (preview: preview@example.com / preview)' });
+  }
+  if (req.method === 'POST' && pathname === '/api/auth/backup-code') {
+    return json(res, 200, { ok: true, redirect: '/preview/dashboard' });
+  }
+  if (req.method === 'POST' && pathname === '/api/auth/password-reset/request') {
+    return json(res, 200, { ok: true, message: 'If an account exists, a reset link was sent (preview stub).' });
+  }
+  if (req.method === 'POST' && pathname === '/api/auth/password-reset/confirm') {
+    return json(res, 200, { ok: true, redirect: '/auth/login?reset=success' });
+  }
+  if (req.method === 'GET' && pathname.startsWith('/api/oauth/')) {
+    const provider = pathname.includes('github') ? 'github' : 'google';
+    const baseUrl = `${url.protocol}//${url.host}`;
+    res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+    res.end(oauthStubHtml(provider, baseUrl));
+    return true;
+  }
+  return false;
+}
+
+export async function createAuthPortalPreviewServer(opts = {}) {
+  const host = opts.host ?? '127.0.0.1';
+  const port = opts.port ?? 8791;
+
+  const server = http.createServer(async (req, res) => {
+    try {
+      const url = new URL(req.url || '/', `http://${req.headers.host || `${host}:${port}`}`);
+
+      if (await handleApi(req, res, url)) return;
+
+      if (req.method !== 'GET' && req.method !== 'HEAD') {
+        res.writeHead(405);
+        res.end('Method not allowed');
+        return;
+      }
+
+      if (url.pathname === '/' || url.pathname === '/preview') {
+        const baseUrl = `${url.protocol}//${url.host}`;
+        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        res.end(hubHtml(baseUrl));
+        return;
+      }
+
+      const pageFile = PAGE_ROUTES[url.pathname];
+      if (pageFile) {
+        await serveFile(res, path.join(AUTH_PORTAL_PAGES_DIR, pageFile));
+        return;
+      }
+
+      if (url.pathname === '/preview/dashboard') {
+        const file = path.join(PREVIEW_DIR, 'dashboard-stub.html');
+        await serveFile(res, file);
+        return;
+      }
+
+      res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end('Not found');
+    } catch (err) {
+      res.writeHead(500, { 'Content-Type': 'text/plain; charset=utf-8' });
+      res.end(err?.message || 'Server error');
+    }
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(port, host, resolve);
+  });
+
+  const address = server.address();
+  const boundPort = typeof address === 'object' && address ? address.port : port;
+  const baseUrl = `http://${host}:${boundPort}`;
+
+  return { server, host, port: boundPort, baseUrl };
+}
+
+function openBrowser(url) {
+  const platform = process.platform;
+  const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start' : 'xdg-open';
+  const child = spawn(cmd, [url], { stdio: 'ignore', detached: true });
+  child.unref();
+}
+
+async function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  const { server, baseUrl } = await createAuthPortalPreviewServer(opts);
+
+  console.log(`
+  Auth portal preview
+  ───────────────────
+  Hub:    ${baseUrl}/
+  Login:  ${baseUrl}/auth/login
+  Signup: ${baseUrl}/auth/signup
+  Reset:  ${baseUrl}/auth/reset
+
+  Preview login: preview@example.com / preview
+  Ctrl+C to stop
+`);
+
+  if (opts.open) openBrowser(`${baseUrl}/auth/login`);
+
+  const shutdown = () => {
+    server.close(() => process.exit(0));
+  };
+  process.on('SIGINT', shutdown);
+  process.on('SIGTERM', shutdown);
+}
+
+const isMain = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1]);
+if (isMain) {
+  main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
+}

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -0,0 +1,4 @@
+/** Cloudflare D1 storage adapter — Sprint 5. */
+export function createCloudflareD1Adapter(_env) {
+  throw new Error('cloudflare_d1_adapter_not_implemented');
+}

package/packages/identity/src/adapters/inneranimalmedia/README.md

@@ -0,0 +1,7 @@
+# InnerAnimalMedia adapter (Sprint 3+)
+
+Maps IAM D1 tables (`auth_users`, `accounts`, `account_identities`, `auth_sessions`, …)
+into portable AgentSam Identity contracts.
+
+IAM-specific behavior (tenant resolution, workspace membership, OAuth callback wiring)
+stays here — not in `providers/`.