@inneranimalmedia/agentsam-sdk 2.6.1 → 2.6.3

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -0,0 +1,96 @@
+{
+  "schema": "agentsam.feature.provider-catalog.v1",
+  "feature": "identity.oauth-login-portal",
+  "default_provider": "inneranimalmedia",
+  "providers": [
+    {
+      "id": "inneranimalmedia",
+      "aliases": ["iam"],
+      "oauth_provider_key": "iam",
+      "kind": "oidc",
+      "status": "ready",
+      "title": "Inner Animal Media platform identity",
+      "implementation": "src/providers/iam",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "IAM_CLIENT_ID",
+        "IAM_CLIENT_SECRET"
+      ],
+      "notes": "Protocol/selection id is inneranimalmedia. OAuth/DB provider key remains iam."
+    },
+    {
+      "id": "google",
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/google",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GOOGLE_CLIENT_ID",
+        "GOOGLE_CLIENT_SECRET"
+      ]
+    },
+    {
+      "id": "github",
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/github",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GITHUB_CLIENT_ID",
+        "GITHUB_CLIENT_SECRET"
+      ]
+    },
+    {
+      "id": "gcp",
+      "kind": "oauth",
+      "status": "scaffold",
+      "implementation": "src/providers/gcp",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.profile.resolve"
+      ],
+      "notes": "Contract + authorize URL only — exchange not implemented."
+    },
+    {
+      "id": "email",
+      "kind": "password",
+      "status": "scaffold",
+      "implementation": "src/providers/email",
+      "capabilities": [
+        "identity.profile.resolve"
+      ],
+      "notes": "Password verification not yet implemented by the portable provider."
+    },
+    {
+      "id": "cloudflare",
+      "kind": "oauth",
+      "status": "ready",
+      "registered": true,
+      "implementation": "src/providers/cloudflare",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "CLOUDFLARE_OAUTH_CLIENT_ID"
+      ],
+      "optional_configuration": [
+        "CLOUDFLARE_OAUTH_CLIENT_SECRET"
+      ],
+      "notes": "Registered in identityProviders. Client secret optional for PKCE-only clients."
+    }
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/resources.json

@@ -0,0 +1,47 @@
+{
+  "schema": "agentsam.feature.resources.v1",
+  "feature": "identity.oauth-login-portal",
+  "engine": "d1",
+  "migration_sources": [
+    "src/migrations/0001_identity_core.sql",
+    "src/migrations/0002_company.sql"
+  ],
+  "notes": "Migration files remain the schema authority. This JSON is an index/contract only.",
+  "tables": [
+    {
+      "name": "auth_users",
+      "purpose": "canonical user identity",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "auth_sessions",
+      "purpose": "authenticated browser/session state",
+      "owner_column": "user_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "account_identities",
+      "purpose": "external identity/provider mapping",
+      "owner_column": "account_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "oauth_states",
+      "purpose": "short-lived OAuth/PKCE transaction state",
+      "sensitive": true,
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "password_reset_tokens",
+      "purpose": "password recovery token state",
+      "sensitive": true,
+      "owner_column": "user_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "company",
+      "purpose": "auth portal/company branding",
+      "source": "src/migrations/0002_company.sql"
+    }
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/routes.json

@@ -0,0 +1,74 @@
+{
+  "schema": "agentsam.feature.routes.v1",
+  "feature": "identity.oauth-login-portal",
+  "router": "src/server/worker-router.js",
+  "routes": [
+    {
+      "path": "/auth/login",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/auth/signup",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/auth/reset",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/api/auth/login",
+      "method": "POST",
+      "kind": "api",
+      "access": "public"
+    },
+    {
+      "path": "/api/auth/signup",
+      "method": "POST",
+      "kind": "api",
+      "access": "public"
+    },
+    {
+      "path": "/api/oauth/google/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "google"
+    },
+    {
+      "path": "/api/oauth/github/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "github"
+    },
+    {
+      "path": "/api/oauth/iam/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "inneranimalmedia",
+      "oauth_provider_key": "iam"
+    },
+    {
+      "path": "/api/oauth/cloudflare/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "cloudflare"
+    },
+    {
+      "path": "/api/oauth/cloudflare/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "cloudflare"
+    }
+  ],
+  "sources": [
+    "src/frontend/auth-portal/README.md",
+    "src/oauth/README.md",
+    "src/oauth/redirect-paths.js",
+    "src/server/worker-router.js"
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/ui.json

@@ -0,0 +1,35 @@
+{
+  "schema": "agentsam.feature.ui.v1",
+  "feature": "identity.oauth-login-portal",
+  "surface": "auth-portal",
+  "assets": [
+    "src/frontend/auth-portal/pages/login.html",
+    "src/frontend/auth-portal/pages/signup.html",
+    "src/frontend/auth-portal/pages/reset.html",
+    "src/frontend/auth-portal/shared/company-branding.js"
+  ],
+  "customizable": [
+    "logo",
+    "colors",
+    "support info",
+    "company branding"
+  ],
+  "customizable_fields": [
+    "company.name",
+    "company.logo_url",
+    "company.favicon_url",
+    "company.primary_color",
+    "company.auth_bg_color",
+    "company.support_email",
+    "company.website_url",
+    "company.tagline"
+  ],
+  "behavior": {
+    "implementation": "packages/identity",
+    "host_supplies": "brand/runtime config"
+  },
+  "ownership": {
+    "implementation": "packages/identity",
+    "branding": "host"
+  }
+}

package/packages/identity/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.1",
+  "version": "2.6.3",
   "private": true,
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",
@@ -28,7 +28,8 @@
     "./contracts/external-identity": "./src/contracts/external-identity.js",
     "./contracts/auth-config": "./src/contracts/auth-config.js",
     "./oauth/callback": "./src/oauth/callback.js",
-    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*"
+    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
+    "./providers/cloudflare": "./src/providers/cloudflare/index.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",

package/packages/identity/src/adapters/cloudflare-d1/ids.js

@@ -10,6 +10,10 @@ export function newSessionId() {
   return crypto.randomUUID();
 }
 
+export function newAuthEventId() {
+  return `aev_${crypto.randomUUID().replace(/-/g, '')}`;
+}
+
 export function nowUnix() {
   return Math.floor(Date.now() / 1000);
 }

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -1,4 +1,4 @@
-import { newAccountIdentityId, newAuthUserId, newSessionId, nowUnix } from './ids.js';
+import { newAccountIdentityId, newAuthUserId, newSessionId, newAuthEventId, nowUnix } from './ids.js';
 import { AUTH_SESSION_TTL_SECONDS } from '../../core/constants.js';
 import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '../../contracts/company.js';
 
@@ -12,6 +12,14 @@ import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '.
  * @param {D1Database} db
  * @param {{ sessionTtlSeconds?: number }} [options]
  */
+async function hashValue(value) {
+  const v = String(value || '').trim();
+  if (!v) return null;
+  const bytes = new TextEncoder().encode(v);
+  const digest = await crypto.subtle.digest('SHA-256', bytes);
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
 export function createCloudflareD1Adapter(db, options = {}) {
   if (!db?.prepare) {
     throw new Error('cloudflare_d1_adapter_requires_db_binding');
@@ -21,6 +29,36 @@ export function createCloudflareD1Adapter(db, options = {}) {
   return Object.freeze({
     sessionTtlSeconds,
 
+    /**
+     * Append-only login/logout/failed-attempt audit trail (auth_event_log).
+     * Never throws -- an observability write must not break a real auth flow.
+     * ip/userAgent are hashed (SHA-256) before storage, matching the
+     * ip_hash/user_agent_hash column names -- raw values are never persisted.
+     */
+    async logAuthEvent({ userId, eventType, status = 'ok', provider, metadata, request }) {
+      try {
+        const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
+        const ua = request?.headers?.get?.('user-agent') || '';
+        const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
+        await db.prepare(
+          `INSERT INTO auth_event_log
+           (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+        ).bind(
+          newAuthEventId(),
+          userId || null,
+          eventType,
+          status,
+          provider || null,
+          metadata ? JSON.stringify(metadata) : '{}',
+          ipHash,
+          uaHash,
+        ).run();
+      } catch {
+        // Never let audit logging break a real login/OAuth flow.
+      }
+    },
+
     async findUserByEmail(email) {
       const row = await db.prepare(
         `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at

package/packages/identity/src/contracts/auth-config.js

@@ -1,20 +1,9 @@
 /**
  * Canonical AgentSam identity/auth environment contract.
  *
- * The SDK owns these public names. Host applications consume this contract and
- * may provide storage/verification adapters without inventing competing aliases.
- *
- * Canonical variables:
- *   IAM_OAUTH_ISSUER      public authorization-server authority (issuer)
- *   IAM_CLIENT_ID         OAuth client id
- *   IAM_CLIENT_SECRET     OAuth client secret
- *   IAM_ORIGIN            deprecated alias of IAM_OAUTH_ISSUER (migration window)
- *   AGENTSAM_SDK_KEY      account/delegated sdk_* bearer
- *   AGENTSAM_BRIDGE_KEY   machine/integration credential
- *
- * Migration-only fallbacks:
- *   IAM_ORIGIN            -> IAM_OAUTH_ISSUER
- *   AGENTSAM_SDK_TOKEN    -> AGENTSAM_SDK_KEY
+ * Browser login sessions and reusable API credentials are intentionally
+ * separate: login sessions are opaque, machine-local session state while
+ * AGENTSAM_API_KEY is an explicit delegated account credential.
  */
 
 export const DEFAULT_IAM_OAUTH_ISSUER = 'https://inneranimalmedia.com';
@@ -26,17 +15,12 @@ export const AGENTSAM_AUTH_ENV = Object.freeze({
   iamOrigin: 'IAM_ORIGIN',
   iamClientId: 'IAM_CLIENT_ID',
   iamClientSecret: 'IAM_CLIENT_SECRET',
-  sdkKey: 'AGENTSAM_SDK_KEY',
+  apiKey: 'AGENTSAM_API_KEY',
   bridgeKey: 'AGENTSAM_BRIDGE_KEY',
 });
 
-export const AGENTSAM_AUTH_LEGACY_ENV = Object.freeze({
-  iamOrigin: 'IAM_ORIGIN',
-  sdkKey: 'AGENTSAM_SDK_TOKEN',
-});
-
 export const AGENTSAM_AUTH_CONTRACT = Object.freeze({
-  version: 1,
+  version: 2,
   authority: 'agentsam-sdk',
   iam: Object.freeze({
     issuer: AGENTSAM_AUTH_ENV.iamIssuer,
@@ -44,24 +28,23 @@ export const AGENTSAM_AUTH_CONTRACT = Object.freeze({
     clientId: AGENTSAM_AUTH_ENV.iamClientId,
     clientSecret: AGENTSAM_AUTH_ENV.iamClientSecret,
   }),
-  sdk: Object.freeze({
-    env: AGENTSAM_AUTH_ENV.sdkKey,
-    tokenPrefix: 'sdk_',
+  apiKey: Object.freeze({
+    env: AGENTSAM_AUTH_ENV.apiKey,
+    tokenPrefix: 'aak_',
     authorizationScheme: 'Bearer',
     subject: 'account/delegated',
-    durableStore: 'agentsam_sdk_tokens',
+    durableStore: 'agentsam_api_credentials',
+  }),
+  browserSession: Object.freeze({
+    storage: '~/.agentsam/auth/session.json',
+    subject: 'interactive/user',
+    reusableApiCredential: false,
   }),
   bridge: Object.freeze({
     env: AGENTSAM_AUTH_ENV.bridgeKey,
     subject: 'machine/integration',
-    sdkTokenType: 'integration',
     userAuth: false,
   }),
-  compatibility: Object.freeze({
-    iamOriginFallback: AGENTSAM_AUTH_LEGACY_ENV.iamOrigin,
-    iamIssuerCanonical: AGENTSAM_AUTH_ENV.iamIssuer,
-    sdkKeyFallback: AGENTSAM_AUTH_LEGACY_ENV.sdkKey,
-  }),
 });
 
 function clean(value) {
@@ -84,24 +67,24 @@ export function resolveIamOrigin(env = {}, explicit = '') {
   return resolveIamIssuer(env, explicit);
 }
 
-/** Resolve account/delegated SDK bearer; canonical name wins over legacy. */
-export function resolveSdkKey(env = {}, explicit = '') {
-  return clean(explicit || env?.AGENTSAM_SDK_KEY || env?.AGENTSAM_SDK_TOKEN);
+/** Resolve the reusable delegated account API credential. */
+export function resolveApiKey(env = {}, explicit = '') {
+  return clean(explicit || env?.AGENTSAM_API_KEY);
 }
 
-/** Resolve machine/integration bridge credential. No user-SDK alias is accepted. */
+/** Resolve machine/integration bridge credential. No account API-key alias is accepted. */
 export function resolveBridgeKey(env = {}, explicit = '') {
   return clean(explicit || env?.AGENTSAM_BRIDGE_KEY);
 }
 
-export function isSdkKey(value) {
-  return clean(value).startsWith(AGENTSAM_AUTH_CONTRACT.sdk.tokenPrefix);
+export function isApiKey(value) {
+  return clean(value).startsWith(AGENTSAM_AUTH_CONTRACT.apiKey.tokenPrefix);
 }
 
-/** Build the public bearer header for an SDK key. */
-export function buildSdkAuthorizationHeaders(key, headers = {}) {
+/** Build the public bearer header for an AgentSam account API key. */
+export function buildApiAuthorizationHeaders(key, headers = {}) {
   const resolved = clean(key);
-  if (!isSdkKey(resolved)) throw new Error('AGENTSAM_SDK_KEY_required');
+  if (!isApiKey(resolved)) throw new Error('AGENTSAM_API_KEY_required');
   return {
     ...headers,
     Authorization: `Bearer ${resolved}`,

package/packages/identity/src/contracts/provider.js

@@ -1,9 +1,10 @@
-/** External identity provider contract. */
+/** External identity provider contract — registry order is intentional. */
 
 export const IdentityProviders = Object.freeze([
   'email',
   'google',
   'github',
   'gcp',
-  'iam',
+  'inneranimalmedia',
+  'cloudflare',
 ]);

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -412,6 +412,9 @@
                 <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
                 Sign in with GitHub
             </a>
+            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start?next=/dashboard/agent" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+                Sign in with Cloudflare
+            </a>
         </div>
 
         <p class="signup-prompt">
@@ -479,6 +482,10 @@
     if (githubLink) {
         githubLink.href = '/api/oauth/github/start?next=' + encodeURIComponent(oauthDest);
     }
+    var cloudflareLink = document.getElementById('cloudflareSignIn');
+    if (cloudflareLink) {
+        cloudflareLink.href = '/api/oauth/cloudflare/start?next=' + encodeURIComponent(oauthDest);
+    }
     if (new URLSearchParams(window.location.search).get('cf_connect') === '1') {
         var cfN = document.getElementById('cfConnectNotice');
         if (cfN) cfN.style.display = 'block';

package/packages/identity/src/index.js

@@ -20,6 +20,7 @@ import {
   IamProvider,
   GcpProvider,
   EmailProvider,
+  CloudflareProvider,
 } from './providers/index.js';
 
 export {
@@ -38,6 +39,7 @@ export {
   IamProvider,
   GcpProvider,
   EmailProvider,
+  CloudflareProvider,
 };
 
 export * from './core/index.js';

package/packages/identity/src/oauth/credentials.js

@@ -82,6 +82,19 @@ export function resolveOAuthCredentialLane(env, provider) {
     }
   }
 
+  if (provider === 'cloudflare') {
+    // Reuses the same Worker secrets as the Local Studio Cloudflare resource
+    // connector (packages/connectors/cloudflare). clientSecret may be empty
+    // if that client is configured as PKCE-only (Token Authentication
+    // Method = None) — exchangeCloudflareCode() omits it in that case.
+    const clientId = String(env?.CLOUDFLARE_OAUTH_CLIENT_ID || '').trim();
+    const clientSecret = String(env?.CLOUDFLARE_OAUTH_CLIENT_SECRET || '').trim();
+    if (clientId) {
+      return { lane: 'byok_cloudflare', clientId, clientSecret, provider };
+    }
+    return null;
+  }
+
   // Default: Google/GitHub buttons route through IAM platform when minted.
   const iam = resolveIamPlatformCredentials(env);
   if (iam) {

package/packages/identity/src/oauth/iam-platform.js

@@ -19,7 +19,7 @@ import { normalizeIamIdentity } from '../providers/iam/mapper.js';
  * @param {Record<string, unknown>} env
  * @param {import('../adapters/cloudflare-d1/index.js').CloudflareD1Adapter} adapter
  */
-export async function iamPlatformOAuthStart(request, env, adapter) {
+export async function iamPlatformOAuthStart(request, env, adapter, identity) {
   const creds = resolveIamPlatformCredentials(env);
   if (!creds) {
     return Response.json({ ok: false, error: 'iam_oauth_not_configured' }, 503);
@@ -29,9 +29,9 @@ export async function iamPlatformOAuthStart(request, env, adapter) {
   const state = randomOAuthState();
   const codeVerifier = pkceVerifier();
   const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = url.searchParams.get('next')
-    || url.searchParams.get('return_to')
-    || '/dashboard/cms';
+  const redirectTo = identity?.resolvePostLoginPath(
+    url.searchParams.get('next') || url.searchParams.get('return_to'),
+  ) || '/';
 
   await adapter.saveOAuthState({
     state,
@@ -107,7 +107,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     displayName: normalized.name || normalized.email.split('@')[0] || 'User',
   });
 
-  const redirectTo = saved.redirect_to || '/dashboard/cms';
+  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
   const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {

package/packages/identity/src/providers/cloudflare/index.js

@@ -0,0 +1,19 @@
+import { createIdentityProvider } from '../../provider-contract.js';
+import { exchangeCloudflareCode, getCloudflareAuthUrl } from './oauth.js';
+import { fetchCloudflareProfile } from './profile.js';
+import { normalizeCloudflareIdentity } from './mapper.js';
+
+export const CloudflareProvider = createIdentityProvider({
+  id: 'cloudflare',
+  authorizeUrl: getCloudflareAuthUrl,
+  exchangeCode: exchangeCloudflareCode,
+  getProfile: fetchCloudflareProfile,
+  normalizeIdentity: normalizeCloudflareIdentity,
+});
+
+export {
+  getCloudflareAuthUrl,
+  exchangeCloudflareCode,
+  fetchCloudflareProfile,
+  normalizeCloudflareIdentity,
+};

package/packages/identity/src/providers/cloudflare/mapper.js

@@ -0,0 +1,21 @@
+import { normalizeExternalIdentity } from '../../contracts/external-identity.js';
+
+/**
+ * @param {Record<string, unknown>|null|undefined} profile
+ */
+export function normalizeCloudflareIdentity(profile) {
+  const raw = profile && typeof profile === 'object' ? profile : {};
+  const subject = String(raw.sub || raw.id || raw.user_id || raw.account_id || '').trim();
+  if (!subject) {
+    throw new Error('cloudflare_identity_requires_subject');
+  }
+  return normalizeExternalIdentity({
+    provider: 'cloudflare',
+    subject,
+    email: typeof raw.email === 'string' ? raw.email : null,
+    emailVerified: Boolean(raw.email),
+    name: typeof raw.name === 'string' ? raw.name : (typeof raw.display_name === 'string' ? raw.display_name : null),
+    avatar: null,
+    raw,
+  });
+}

package/packages/identity/src/providers/cloudflare/oauth.js

@@ -0,0 +1,48 @@
+const CLOUDFLARE_AUTH_URL = 'https://dash.cloudflare.com/oauth2/auth';
+const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
+
+// Identity-only login should not request the full resource-access scope set
+// used elsewhere for the Local Studio Cloudflare *connection* (deploy/d1/r2/etc).
+// account-settings.read is enough to resolve the account for userinfo.
+const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read offline_access';
+
+/** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
+export function getCloudflareAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {
+  const url = new URL(CLOUDFLARE_AUTH_URL);
+  url.searchParams.set('client_id', clientId || '');
+  url.searchParams.set('redirect_uri', redirectUri || '');
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('scope', scope || CLOUDFLARE_LOGIN_SCOPE);
+  url.searchParams.set('state', state || '');
+  if (codeChallenge) {
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+  }
+  return url.toString();
+}
+
+/** @param {import('../../provider-contract.js').OAuthExchangeInput} input */
+export async function exchangeCloudflareCode({ code, codeVerifier, clientId, clientSecret, redirectUri }) {
+  try {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('code', code || '');
+    body.set('code_verifier', codeVerifier || '');
+    body.set('client_id', clientId || '');
+    // client_secret is only sent when configured — the client may be a
+    // PKCE-only public client (Token Authentication Method = None), same
+    // pattern as the Local Studio resource connector.
+    if (clientSecret) body.set('client_secret', clientSecret);
+    body.set('redirect_uri', redirectUri || '');
+
+    const res = await fetch(CLOUDFLARE_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body,
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}