@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/packages/identity/.agentsam/features/oauth-login-portal/agentsam.feature.json

@@ -0,0 +1,64 @@
+{
+  "schema": "agentsam.feature.v1",
+  "id": "identity.oauth-login-portal",
+  "name": "OAuth Login Portal",
+  "kind": "integration",
+  "status": "extracted",
+  "package": {
+    "name": "@inneranimalmedia/agentsam-sdk-identity",
+    "version": "2.6.3",
+    "directory": "packages/identity"
+  },
+  "provides": [
+    "identity.init",
+    "identity.login",
+    "identity.session",
+    "identity.oauth",
+    "identity.password-reset",
+    "identity.portal-ui"
+  ],
+  "runtime": [
+    "worker",
+    "browser"
+  ],
+  "contributes": {
+    "ui": [
+      "auth-portal"
+    ],
+    "migrations": [
+      "src/migrations/0001_identity_core.sql",
+      "src/migrations/0002_company.sql"
+    ]
+  },
+  "artifacts": [
+    {
+      "kind": "provider-catalog",
+      "path": "./providers.json"
+    },
+    {
+      "kind": "resources",
+      "path": "./resources.json"
+    },
+    {
+      "kind": "routes",
+      "path": "./routes.json"
+    },
+    {
+      "kind": "ui",
+      "path": "./ui.json"
+    }
+  ],
+  "activation": {
+    "steps": [
+      "validate_manifest",
+      "check_runtime",
+      "resolve_requires",
+      "plan_migrations",
+      "plan_routes",
+      "operator_approval",
+      "activate",
+      "verify",
+      "write_install_receipt"
+    ]
+  }
+}

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -0,0 +1,96 @@
+{
+  "schema": "agentsam.feature.provider-catalog.v1",
+  "feature": "identity.oauth-login-portal",
+  "default_provider": "inneranimalmedia",
+  "providers": [
+    {
+      "id": "inneranimalmedia",
+      "aliases": ["iam"],
+      "oauth_provider_key": "iam",
+      "kind": "oidc",
+      "status": "ready",
+      "title": "Inner Animal Media platform identity",
+      "implementation": "src/providers/iam",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "IAM_CLIENT_ID",
+        "IAM_CLIENT_SECRET"
+      ],
+      "notes": "Protocol/selection id is inneranimalmedia. OAuth/DB provider key remains iam."
+    },
+    {
+      "id": "google",
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/google",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GOOGLE_CLIENT_ID",
+        "GOOGLE_CLIENT_SECRET"
+      ]
+    },
+    {
+      "id": "github",
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/github",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GITHUB_CLIENT_ID",
+        "GITHUB_CLIENT_SECRET"
+      ]
+    },
+    {
+      "id": "gcp",
+      "kind": "oauth",
+      "status": "scaffold",
+      "implementation": "src/providers/gcp",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.profile.resolve"
+      ],
+      "notes": "Contract + authorize URL only — exchange not implemented."
+    },
+    {
+      "id": "email",
+      "kind": "password",
+      "status": "scaffold",
+      "implementation": "src/providers/email",
+      "capabilities": [
+        "identity.profile.resolve"
+      ],
+      "notes": "Password verification not yet implemented by the portable provider."
+    },
+    {
+      "id": "cloudflare",
+      "kind": "oauth",
+      "status": "ready",
+      "registered": true,
+      "implementation": "src/providers/cloudflare",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.callback",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "CLOUDFLARE_OAUTH_CLIENT_ID"
+      ],
+      "optional_configuration": [
+        "CLOUDFLARE_OAUTH_CLIENT_SECRET"
+      ],
+      "notes": "Registered in identityProviders. Client secret optional for PKCE-only clients."
+    }
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/resources.json

@@ -0,0 +1,47 @@
+{
+  "schema": "agentsam.feature.resources.v1",
+  "feature": "identity.oauth-login-portal",
+  "engine": "d1",
+  "migration_sources": [
+    "src/migrations/0001_identity_core.sql",
+    "src/migrations/0002_company.sql"
+  ],
+  "notes": "Migration files remain the schema authority. This JSON is an index/contract only.",
+  "tables": [
+    {
+      "name": "auth_users",
+      "purpose": "canonical user identity",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "auth_sessions",
+      "purpose": "authenticated browser/session state",
+      "owner_column": "user_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "account_identities",
+      "purpose": "external identity/provider mapping",
+      "owner_column": "account_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "oauth_states",
+      "purpose": "short-lived OAuth/PKCE transaction state",
+      "sensitive": true,
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "password_reset_tokens",
+      "purpose": "password recovery token state",
+      "sensitive": true,
+      "owner_column": "user_id",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
+    {
+      "name": "company",
+      "purpose": "auth portal/company branding",
+      "source": "src/migrations/0002_company.sql"
+    }
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/routes.json

@@ -0,0 +1,83 @@
+{
+  "schema": "agentsam.feature.routes.v1",
+  "feature": "identity.oauth-login-portal",
+  "router": "src/server/worker-router.js",
+  "routes": [
+    {
+      "path": "/auth/login",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/auth/signup",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/auth/reset",
+      "kind": "page",
+      "access": "public",
+      "surface": "auth-portal"
+    },
+    {
+      "path": "/api/auth/login",
+      "method": "POST",
+      "kind": "api",
+      "access": "public"
+    },
+    {
+      "path": "/api/auth/signup",
+      "method": "POST",
+      "kind": "api",
+      "access": "public"
+    },
+    {
+      "path": "/api/oauth/google/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "google"
+    },
+    {
+      "path": "/api/oauth/github/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "github"
+    },
+    {
+      "path": "/api/oauth/inneranimalmedia/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "inneranimalmedia",
+      "oauth_provider_key": "iam",
+      "aliases": ["/api/oauth/iam/start"]
+    },
+    {
+      "path": "/api/oauth/inneranimalmedia/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "inneranimalmedia",
+      "oauth_provider_key": "iam",
+      "aliases": ["/api/oauth/iam/callback"]
+    },
+    {
+      "path": "/api/oauth/cloudflare/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "cloudflare"
+    },
+    {
+      "path": "/api/oauth/cloudflare/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "cloudflare"
+    }
+  ],
+  "sources": [
+    "src/frontend/auth-portal/README.md",
+    "src/oauth/README.md",
+    "src/oauth/redirect-paths.js",
+    "src/server/worker-router.js"
+  ]
+}

package/packages/identity/.agentsam/features/oauth-login-portal/ui.json

@@ -0,0 +1,35 @@
+{
+  "schema": "agentsam.feature.ui.v1",
+  "feature": "identity.oauth-login-portal",
+  "surface": "auth-portal",
+  "assets": [
+    "src/frontend/auth-portal/pages/login.html",
+    "src/frontend/auth-portal/pages/signup.html",
+    "src/frontend/auth-portal/pages/reset.html",
+    "src/frontend/auth-portal/shared/company-branding.js"
+  ],
+  "customizable": [
+    "logo",
+    "colors",
+    "support info",
+    "company branding"
+  ],
+  "customizable_fields": [
+    "company.name",
+    "company.logo_url",
+    "company.favicon_url",
+    "company.primary_color",
+    "company.auth_bg_color",
+    "company.support_email",
+    "company.website_url",
+    "company.tagline"
+  ],
+  "behavior": {
+    "implementation": "packages/identity",
+    "host_supplies": "brand/runtime config"
+  },
+  "ownership": {
+    "implementation": "packages/identity",
+    "branding": "host"
+  }
+}

package/packages/identity/docs/PORTABLE_IDENTITY_ARCHITECTURE.md

@@ -0,0 +1,50 @@
+# Portable Identity Architecture (pre-commit return)
+
+## Invariants
+
+1. Portable SDK owns **semantic route IDs** (`identity.login`), never host paths.
+2. App manifests own **HTTP projections**.
+3. Auth-capable apps MUST declare authenticated / login / recovery / OAuth callback.
+4. OAuth **transactions** persist `app_id` + `return_to` (required).
+5. Post-login: valid `return_to` → authenticated entry → recovery+error → **throw** (never `/`).
+6. No `DASHBOARD_AFTER_LOGIN_PATH`, no `LOCAL_STUDIO_APP` in identity, no `APP_HOME_PATH` env.
+7. Missing shell/route → package verification failure.
+
+## Artifacts delivered
+
+| Deliverable | Location |
+|---|---|
+| IdentityStore + errors | `packages/identity/src/contracts/identity-store.js` |
+| Semantic IDs | `packages/identity/src/contracts/route-ids.js` |
+| Route projection | `packages/identity/src/contracts/route-projection.js` |
+| Fail-closed post-auth | `packages/identity/src/server/post-auth.js` |
+| SESSION_POLICY | `packages/identity/src/core/session-policy.js` |
+| SQLite core pack | `packages/identity/migrations/sqlite/001_identity_core.sql` |
+| SQLite oauth-client | `packages/identity/migrations/sqlite/002_identity_oauth_client.sql` |
+| SQLite oauth-server (optional) | `packages/identity/migrations/sqlite/003_identity_oauth_server.sql` |
+| D1 mapping | `packages/identity/migrations/D1_SCHEMA_MAPPING.md` |
+| createSqliteIdentityAdapter | `packages/identity/src/adapters/sqlite/index.js` |
+| App verify | `packages/identity/src/app/verify-app.js` |
+| App auth contract (Local Studio) | `apps/local-studio/agentsam.app.json` |
+| Tests | `packages/identity/tests/portable-identity-architecture.test.mjs` |
+
+## Redirect resolution
+
+```
+transaction.return_to  →  owned by app?
+        yes → use
+        no  → app.authenticated
+        missing → identity.recovery?error=…
+        none → IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED')
+```
+
+## Local-only path
+
+```
+applySqliteIdentityMigrations(db)  // core + oauth-client
+createSqliteIdentityAdapter(db)
+createIdentityService({ adapter, app, routeRegistry })
+```
+
+Zero Cloudflare / IAM / D1 required for password + session + OAuth transaction store.
+Provider secrets → encrypted vault via `credential_ref` on `identity_provider_connections`.

package/packages/identity/migrations/D1_SCHEMA_MAPPING.md

@@ -0,0 +1,31 @@
+# Identity schema mapping — portable ↔ Cloudflare D1
+
+Portable SQLite (`packages/identity/migrations/sqlite/`) is the product schema.
+The D1 adapter maps existing hosted table names without requiring a big-bang rename.
+
+| Portable (SQLite) | Hosted D1 (current) | Notes |
+|---|---|---|
+| `identity_users` | `auth_users` | Same columns |
+| `identity_external_accounts` | `account_identities` | `user_id` ↔ `account_id` |
+| `identity_sessions` | `auth_sessions` | Same columns |
+| `identity_auth_events` | `auth_event_log` | Same columns |
+| `identity_oauth_transactions` | `identity_oauth_states` → migrate to `identity_oauth_transactions` | Requires `app_id NOT NULL`; no silent pre-app_id fallback |
+| `identity_provider_connections` | (new / connector tables) | `credential_ref` → vault/KMS; never store raw tokens in D1 rows |
+| `identity_app_registry` | cache of `agentsam.app.json` | Disk manifests remain SSOT |
+| `identity_route_registry` | projection cache | Disk manifests remain SSOT |
+| `identity_oauth_clients` … | optional `identity.oauth-server` pack | Only if product is an AS |
+
+## Schema version
+
+Both adapters read `identity_schema_meta.schema_version` (SQLite) or
+`PRAGMA`/meta row. Missing `app_id` on OAuth transactions is an
+`IdentitySchemaError('IDENTITY_SCHEMA_MIGRATION_REQUIRED')`, not a soft
+downgrade.
+
+## Packs
+
+| Pack | Apply when |
+|---|---|
+| `identity.core` | Always (local + hosted) |
+| `identity.oauth-client` | Signing into external IdPs |
+| `identity.oauth-server` | Product issues its own codes/tokens |

package/packages/identity/migrations/sqlite/001_identity_core.sql

@@ -0,0 +1,99 @@
+-- identity.core — portable local SQLite (no Cloudflare / IAM required)
+-- Timestamps: INTEGER unixepoch seconds
+
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS identity_schema_meta (
+  key TEXT PRIMARY KEY NOT NULL,
+  value TEXT NOT NULL
+);
+
+INSERT OR REPLACE INTO identity_schema_meta (key, value)
+VALUES ('schema_version', '1');
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_core', '1');
+
+CREATE TABLE IF NOT EXISTS identity_users (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  password_hash TEXT,
+  salt TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_users_email
+  ON identity_users(email);
+
+CREATE TABLE IF NOT EXISTS identity_external_accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  provider_subject TEXT NOT NULL,
+  email TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_external_provider_subject
+  ON identity_external_accounts(provider, provider_subject);
+
+CREATE TABLE IF NOT EXISTS identity_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  email TEXT,
+  provider TEXT,
+  provider_subject TEXT,
+  display_name TEXT,
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  last_active_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_sessions_user_expires
+  ON identity_sessions(user_id, expires_at);
+
+CREATE TABLE IF NOT EXISTS identity_auth_events (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT,
+  event_type TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'ok',
+  provider TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  ip_hash TEXT,
+  user_agent_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_auth_events_user_created
+  ON identity_auth_events(user_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS identity_app_registry (
+  id TEXT PRIMARY KEY NOT NULL,
+  package_name TEXT,
+  manifest_version TEXT,
+  display_name TEXT,
+  authenticated_route_id TEXT NOT NULL,
+  login_route_id TEXT NOT NULL,
+  recovery_route_id TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  installed_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_route_registry (
+  app_id TEXT NOT NULL,
+  route_id TEXT NOT NULL,
+  path_pattern TEXT NOT NULL,
+  runtime TEXT,
+  auth_policy TEXT,
+  shell_ref TEXT,
+  PRIMARY KEY (app_id, route_id),
+  FOREIGN KEY (app_id) REFERENCES identity_app_registry(id)
+);

package/packages/identity/migrations/sqlite/002_identity_oauth_client.sql

@@ -0,0 +1,38 @@
+-- identity.oauth-client — outbound OAuth (sign in with Google/CF/GitHub/IAM)
+-- Secrets/tokens live in the local encrypted vault; this pack stores refs + metadata.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_client', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_transactions (
+  state TEXT PRIMARY KEY NOT NULL,
+  provider TEXT NOT NULL,
+  code_verifier TEXT NOT NULL,
+  return_to TEXT,
+  app_id TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_transactions_expires
+  ON identity_oauth_transactions(expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_transactions_app
+  ON identity_oauth_transactions(app_id);
+
+CREATE TABLE IF NOT EXISTS identity_provider_connections (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  granted_scopes_json TEXT NOT NULL DEFAULT '[]',
+  credential_ref TEXT NOT NULL,
+  expires_at INTEGER,
+  refreshable INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_provider_connections_user_provider
+  ON identity_provider_connections(user_id, provider);

package/packages/identity/migrations/sqlite/003_identity_oauth_server.sql

@@ -0,0 +1,64 @@
+-- identity.oauth-server — OPTIONAL pack for products that issue their own
+-- client IDs, authorization codes, access tokens, and refresh tokens.
+-- Do not apply unless the installed product is an OAuth authorization server.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_server', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_clients (
+  id TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL UNIQUE,
+  client_secret_hash TEXT,
+  name TEXT NOT NULL,
+  redirect_uris_json TEXT NOT NULL DEFAULT '[]',
+  grant_types_json TEXT NOT NULL DEFAULT '["authorization_code"]',
+  token_endpoint_auth_method TEXT NOT NULL DEFAULT 'none',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_authorization_codes (
+  code_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_access_tokens (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_refresh_tokens (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_grants (
+  id TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  created_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);

package/packages/identity/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.2",
+  "version": "2.6.4",
   "private": true,
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",
@@ -28,7 +28,8 @@
     "./contracts/external-identity": "./src/contracts/external-identity.js",
     "./contracts/auth-config": "./src/contracts/auth-config.js",
     "./oauth/callback": "./src/oauth/callback.js",
-    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*"
+    "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
+    "./providers/cloudflare": "./src/providers/cloudflare/index.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",

package/packages/identity/src/adapters/cloudflare-d1/ids.js

@@ -10,6 +10,10 @@ export function newSessionId() {
   return crypto.randomUUID();
 }
 
+export function newAuthEventId() {
+  return `aev_${crypto.randomUUID().replace(/-/g, '')}`;
+}
+
 export function nowUnix() {
   return Math.floor(Date.now() / 1000);
 }