@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/packages/identity/src/contracts/identity-store.js

@@ -0,0 +1,115 @@
+/**
+ * Portable IdentityStore contract.
+ * Adapters (SQLite, D1, Postgres) implement this — the identity service never
+ * imports Cloudflare/D1 APIs directly for product logic.
+ */
+
+/**
+ * @typedef {object} IdentityUser
+ * @property {string} id
+ * @property {string} email
+ * @property {string|null} [display_name]
+ * @property {string|null} [password_hash]
+ * @property {string|null} [salt]
+ * @property {string} [status]
+ * @property {number} created_at
+ * @property {number} updated_at
+ */
+
+/**
+ * @typedef {object} IdentitySession
+ * @property {string} id
+ * @property {string} user_id
+ * @property {string|null} [email]
+ * @property {string|null} [provider]
+ * @property {string|null} [provider_subject]
+ * @property {string|null} [display_name]
+ * @property {number} expires_at
+ * @property {number|null} [revoked_at]
+ * @property {number} created_at
+ * @property {number|null} [last_active_at]
+ */
+
+/**
+ * @typedef {object} OAuthTransaction
+ * @property {string} state
+ * @property {string} provider
+ * @property {string} code_verifier
+ * @property {string|null} [return_to]
+ * @property {string} app_id
+ * @property {number} expires_at
+ * @property {number} created_at
+ * @property {number|null} [consumed_at]
+ */
+
+/**
+ * @typedef {object} AuthEventInput
+ * @property {string} [userId]
+ * @property {string} [accountId]
+ * @property {string} eventType
+ * @property {string} [status]
+ * @property {string} [provider]
+ * @property {object} [session]
+ * @property {object} [capabilities]
+ * @property {object} [activity]
+ * @property {object} [client]
+ * @property {object} [metadata]
+ * @property {Request} [request]
+ */
+
+/**
+ * @typedef {object} IdentityStore
+ * @property {number} schemaVersion
+ * @property {(email: string) => Promise<IdentityUser|null>} findUserByEmail
+ * @property {(userId: string) => Promise<IdentityUser|null>} findUserById
+ * @property {(input: { email: string, passwordHash?: string|null, salt?: string|null, displayName?: string|null }) => Promise<IdentityUser>} createUser
+ * @property {(userId: string, passwordHash: string, salt: string) => Promise<void>} updateUserPassword
+ * @property {(provider: string, providerSubject: string) => Promise<IdentityUser|null>} findUserByProvider
+ * @property {(input: { accountId: string, provider: string, providerSubject: string, email?: string|null }) => Promise<string>} upsertProviderIdentity
+ * @property {(input: { userId: string, email?: string|null, provider?: string, providerSubject?: string|null, displayName?: string|null }) => Promise<IdentitySession>} createSession
+ * @property {(sessionId: string) => Promise<IdentitySession|null>} getSession
+ * @property {(sessionId: string, reason?: string) => Promise<{ ok: true, reason: string }>} revokeSession
+ * @property {(input: { state: string, provider: string, codeVerifier: string, returnTo?: string|null, appId: string, ttlSeconds?: number }) => Promise<void>} createOAuthTransaction
+ * @property {(state: string) => Promise<OAuthTransaction|null>} consumeOAuthTransaction
+ * @property {(input: AuthEventInput) => Promise<void>} logAuthEvent
+ * @property {(userId: string) => Promise<{ loginCount: number, activeSessionCount: number, lastLoginAt: number|null }>} [countAuthActivity]
+ */
+
+export const IDENTITY_STORE_SCHEMA_VERSION = 1;
+
+export const IDENTITY_PACKS = Object.freeze({
+  CORE: 'identity.core',
+  OAUTH_CLIENT: 'identity.oauth-client',
+  OAUTH_SERVER: 'identity.oauth-server',
+});
+
+/**
+ * Structured routing / schema failures — never silently redirect to "/".
+ */
+export class IdentityRoutingError extends Error {
+  /**
+   * @param {string} code
+   * @param {string} [message]
+   * @param {Record<string, unknown>} [details]
+   */
+  constructor(code, message, details = {}) {
+    super(message || code);
+    this.name = 'IdentityRoutingError';
+    this.code = code;
+    this.details = details;
+  }
+}
+
+export class IdentitySchemaError extends Error {
+  /**
+   * @param {string} code
+   * @param {string} [message]
+   * @param {Record<string, unknown>} [details]
+   */
+  constructor(code, message, details = {}) {
+    super(message || code);
+    this.name = 'IdentitySchemaError';
+    this.code = code;
+    this.details = details;
+  }
+}

package/packages/identity/src/contracts/provider.js

@@ -1,9 +1,10 @@
-/** External identity provider contract. */
+/** External identity provider contract — registry order is intentional. */
 
 export const IdentityProviders = Object.freeze([
   'email',
   'google',
   'github',
   'gcp',
-  'iam',
+  'inneranimalmedia',
+  'cloudflare',
 ]);

package/packages/identity/src/contracts/route-ids.js

@@ -0,0 +1,30 @@
+/**
+ * Portable identity semantics — IDs only.
+ * Concrete HTTP paths are host/app projections (defineRouteProjection).
+ */
+
+export const IDENTITY_ROUTE_IDS = Object.freeze({
+  LOGIN: 'identity.login',
+  SIGNUP: 'identity.signup',
+  RESET: 'identity.reset',
+  RECOVERY: 'identity.recovery',
+
+  AUTH_LOGIN: 'identity.api.login',
+  AUTH_SIGNUP: 'identity.api.signup',
+  AUTH_LOGOUT: 'identity.api.logout',
+  AUTH_ME: 'identity.api.me',
+
+  OAUTH_START: 'identity.oauth.start',
+  OAUTH_CALLBACK: 'identity.oauth.callback',
+
+  APP_AUTHENTICATED: 'app.authenticated',
+  APP_HOME: 'app.home',
+});
+
+/** Required semantic routes for any auth-capable AgentSam app. */
+export const REQUIRED_AUTH_ROUTE_IDS = Object.freeze([
+  IDENTITY_ROUTE_IDS.LOGIN,
+  IDENTITY_ROUTE_IDS.RECOVERY,
+  IDENTITY_ROUTE_IDS.APP_AUTHENTICATED,
+  IDENTITY_ROUTE_IDS.OAUTH_CALLBACK,
+]);

package/packages/identity/src/contracts/route-projection.js

@@ -0,0 +1,218 @@
+/**
+ * Host/app HTTP projection of semantic identity route IDs.
+ * Identity core never hardcodes /auth/login, /agentsam, etc.
+ */
+
+import { IDENTITY_ROUTE_IDS, REQUIRED_AUTH_ROUTE_IDS } from './route-ids.js';
+import { IdentityRoutingError } from './identity-store.js';
+import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+
+/**
+ * @typedef {{ path: string, auth?: 'required'|'optional'|'public', spa?: boolean, shell?: string, pattern?: string }} RouteProjection
+ * @typedef {Record<string, string|RouteProjection>} RouteProjectionMap
+ */
+
+/**
+ * @param {{ appId: string, routes: RouteProjectionMap }} input
+ */
+export function defineRouteProjection(input) {
+  const appId = String(input?.appId || '').trim();
+  if (!appId) throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', 'defineRouteProjection requires appId');
+  /** @type {Map<string, RouteProjection>} */
+  const routes = new Map();
+  for (const [routeId, value] of Object.entries(input.routes || {})) {
+    const path = typeof value === 'string' ? value : value?.path;
+    if (!path || !String(path).startsWith('/')) {
+      throw new IdentityRoutingError('AUTH_ROUTE_PROJECTION_INVALID', `Invalid path for ${routeId}`, { appId, routeId });
+    }
+    routes.set(routeId, Object.freeze({
+      path: String(path),
+      auth: typeof value === 'object' ? value.auth : undefined,
+      spa: typeof value === 'object' ? value.spa : undefined,
+      shell: typeof value === 'object' ? value.shell : undefined,
+      pattern: typeof value === 'object' ? value.pattern : undefined,
+    }));
+  }
+  return Object.freeze({ appId, routes });
+}
+
+/**
+ * @param {ReturnType<typeof defineRouteProjection>[]} projections
+ */
+export function createRouteRegistry(projections = []) {
+  /** @type {Map<string, ReturnType<typeof defineRouteProjection>>} */
+  const byApp = new Map();
+  for (const p of projections) {
+    if (!p?.appId) continue;
+    byApp.set(p.appId, p);
+  }
+
+  return Object.freeze({
+    get(appId) {
+      return byApp.get(String(appId || '')) || null;
+    },
+
+    /**
+     * @param {string} appId
+     * @param {string} routeId
+     * @returns {string|null}
+     */
+    resolve(appId, routeId) {
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) return null;
+      const entry = proj.routes.get(routeId);
+      return entry?.path || null;
+    },
+
+    /**
+     * Expand parameterized patterns, e.g. /api/oauth/:provider/callback
+     * @param {string} appId
+     * @param {string} routeId
+     * @param {Record<string, string>} params
+     */
+    resolvePath(appId, routeId, params = {}) {
+      const pattern = this.resolve(appId, routeId);
+      if (!pattern) return null;
+      return pattern.replace(/:([A-Za-z_][A-Za-z0-9_]*)/g, (_, key) => {
+        const v = params[key];
+        if (v == null || v === '') {
+          throw new IdentityRoutingError('AUTH_ROUTE_PARAM_MISSING', `Missing :${key} for ${routeId}`, { appId, routeId });
+        }
+        return encodeURIComponent(String(v));
+      });
+    },
+
+    /**
+     * return_to must be same-origin relative and owned by this app's projected mounts/paths.
+     * @param {{ appId: string, value?: string|null }} opts
+     */
+    resolveReturnTo({ appId, value }) {
+      const cleaned = sanitizeBrowserNextPath(value);
+      if (!cleaned) return null;
+      const pathname = cleaned.split('?')[0];
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) return null;
+
+      const authenticated = proj.routes.get(IDENTITY_ROUTE_IDS.APP_AUTHENTICATED)?.path
+        || proj.routes.get(IDENTITY_ROUTE_IDS.APP_HOME)?.path;
+      if (authenticated && (pathname === authenticated || pathname.startsWith(`${authenticated}/`))) {
+        return cleaned;
+      }
+
+      for (const [routeId, entry] of proj.routes) {
+        if (routeId.startsWith('identity.')) continue;
+        const base = entry.path.replace(/:[^/]+/g, ''); // strip params for prefix mounts
+        const mount = base.replace(/\/$/, '') || entry.path;
+        if (pathname === mount || pathname.startsWith(`${mount}/`)) return cleaned;
+        // Explicit mount keys: app.mount./projects style — also accept path values with auth required
+        if (entry.auth === 'required' && (pathname === entry.path || pathname.startsWith(`${entry.path}/`))) {
+          return cleaned;
+        }
+      }
+      return null;
+    },
+
+    /**
+     * Fail closed if auth-capable app is missing required semantic projections.
+     * @param {string} appId
+     */
+    assertAuthCapable(appId) {
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) {
+        throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', `No route projection for app ${appId}`, { appId });
+      }
+      for (const routeId of REQUIRED_AUTH_ROUTE_IDS) {
+        if (!proj.routes.has(routeId)) {
+          throw new IdentityRoutingError(
+            'AUTH_ROUTE_MISSING',
+            `App ${appId} missing required route projection ${routeId}`,
+            { appId, routeId },
+          );
+        }
+      }
+      return proj;
+    },
+  });
+}
+
+/**
+ * Build a projection map from an agentsam.app.v1 auth+routes manifest section.
+ * @param {object} manifest
+ */
+export function projectionFromAppManifest(manifest) {
+  const appId = String(manifest?.id || '').trim();
+  if (!appId) throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', 'manifest.id required');
+
+  /** @type {RouteProjectionMap} */
+  const routes = {};
+
+  const rawRoutes = manifest.routes || {};
+  for (const [routeId, value] of Object.entries(rawRoutes)) {
+    if (routeId === 'entry' || routeId === 'mounts' || routeId === 'paths') continue;
+    routes[routeId] = value;
+  }
+  for (const [routeId, value] of Object.entries(rawRoutes.paths || {})) {
+    routes[routeId] = value;
+  }
+
+  const auth = manifest.auth || {};
+  const entry = auth.entry || {};
+
+  function pathFor(ref, legacyPath) {
+    if (legacyPath) return legacyPath;
+    if (!ref) return null;
+    if (typeof ref === 'string' && ref.startsWith('/')) return ref;
+    if (typeof ref === 'string' && routes[ref]) {
+      const v = routes[ref];
+      return typeof v === 'string' ? v : v.path;
+    }
+    return null;
+  }
+
+  const authenticatedPath = pathFor(
+    entry.authenticated || IDENTITY_ROUTE_IDS.APP_AUTHENTICATED,
+    typeof rawRoutes.entry === 'string' ? rawRoutes.entry : null,
+  );
+  const loginPath = pathFor(entry.login || IDENTITY_ROUTE_IDS.LOGIN, null);
+  const failurePath = pathFor(
+    entry.failure || IDENTITY_ROUTE_IDS.RECOVERY || IDENTITY_ROUTE_IDS.LOGIN,
+    loginPath,
+  );
+
+  if (authenticatedPath) {
+    routes[IDENTITY_ROUTE_IDS.APP_AUTHENTICATED] = {
+      path: authenticatedPath,
+      auth: 'required',
+      spa: true,
+      shell: manifest.runtime?.shell
+        ? `${manifest.runtime.assetRoot || 'dist'}/${manifest.runtime.shell}`.replace(/\/{2,}/g, '/')
+        : undefined,
+    };
+    routes[IDENTITY_ROUTE_IDS.APP_HOME] = authenticatedPath;
+  }
+  if (loginPath) routes[IDENTITY_ROUTE_IDS.LOGIN] = loginPath;
+  if (failurePath) routes[IDENTITY_ROUTE_IDS.RECOVERY] = failurePath;
+
+  for (const mount of rawRoutes.mounts || []) {
+    if (!mount?.path) continue;
+    routes[`app.mount.${mount.path}`] = {
+      path: mount.path,
+      auth: mount.auth || 'required',
+      spa: mount.spa,
+      shell: mount.shell,
+    };
+  }
+
+  if (auth.oauth?.callbackPattern) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK] = auth.oauth.callbackPattern;
+  } else if (!routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK] = '/api/oauth/:provider/callback';
+  }
+  if (auth.oauth?.startPattern) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_START] = auth.oauth.startPattern;
+  } else if (!routes[IDENTITY_ROUTE_IDS.OAUTH_START]) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_START] = '/api/oauth/:provider/start';
+  }
+
+  return defineRouteProjection({ appId, routes });
+}

package/packages/identity/src/contracts/routes.js

@@ -0,0 +1,11 @@
+/**
+ * Portable identity = semantic route IDs only.
+ * Concrete paths live in host defineRouteProjection / agentsam.app.json.
+ */
+
+export { IDENTITY_ROUTE_IDS, REQUIRED_AUTH_ROUTE_IDS } from './route-ids.js';
+export {
+  defineRouteProjection,
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from './route-projection.js';

package/packages/identity/src/core/browser-paths.js

@@ -1,4 +1,7 @@
-import { AUTH_LOGIN_PATH, AUTH_SIGNUP_PATH } from './constants.js';
+/**
+ * Same-origin relative path sanitizer — no product-path rewriting.
+ * Alias normalization (/login → identity.login projection) is a host concern.
+ */
 
 export function sanitizeBrowserNextPath(raw) {
   if (raw == null) return null;
@@ -13,10 +16,6 @@ export function sanitizeBrowserNextPath(raw) {
     pathname = s.slice(0, q);
     search = s.slice(q);
   }
-  const lower = pathname.toLowerCase();
-  if (lower === '/login' || lower === '/auth/signin') pathname = AUTH_LOGIN_PATH;
-  else if (lower === '/signup' || lower === '/auth/register') pathname = AUTH_SIGNUP_PATH;
-
   return pathname + search;
 }
 

package/packages/identity/src/core/constants.js

@@ -1,9 +1,14 @@
-/** SDK-portable session/auth path constants. */
+/**
+ * Cookie name + session policy re-exports.
+ * Route vocabulary → contracts/routes.js (identity endpoints only).
+ * Product homes / mounts → each app's agentsam.app.json (not this package).
+ */
+
+import { SESSION_POLICY } from './session-policy.js';
+
+export { SESSION_POLICY, clampAgentSessionTtl } from './session-policy.js';
+
 export const AUTH_COOKIE_NAME = 'session';
-export const AUTH_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
-export const MIN_AGENT_SESSION_TTL_SECONDS = 60;
-export const MAX_AGENT_SESSION_TTL_SECONDS = 86400;
-export const DEFAULT_AGENT_SESSION_TTL_SECONDS = 900;
-export const AUTH_LOGIN_PATH = '/auth/login';
-export const AUTH_SIGNUP_PATH = '/auth/signup';
-export const DASHBOARD_AFTER_LOGIN_PATH = '/dashboard/cms';
+
+/** @deprecated Prefer SESSION_POLICY.browser.ttlSeconds */
+export const AUTH_SESSION_TTL_SECONDS = SESSION_POLICY.browser.ttlSeconds;

package/packages/identity/src/core/session-policy.js

@@ -0,0 +1,32 @@
+/**
+ * Session policy — three concerns stay separate:
+ *   browser  = normal logged-in account session (cookie / auth_sessions)
+ *   agent    = short-lived delegated/runtime grant (execution, terminal, sandbox)
+ *
+ * Product routing does not live here.
+ */
+
+export const SESSION_POLICY = Object.freeze({
+  browser: Object.freeze({
+    ttlSeconds: 30 * 24 * 60 * 60,
+  }),
+  /** Temporary execution authority — not the user's Local Studio login. */
+  agent: Object.freeze({
+    minTtlSeconds: 60,
+    defaultTtlSeconds: 15 * 60,
+    maxTtlSeconds: 24 * 60 * 60,
+  }),
+});
+
+/**
+ * Clamp a requested agent/runtime grant TTL into policy bounds.
+ * @param {number|null|undefined} requestedSeconds
+ */
+export function clampAgentSessionTtl(requestedSeconds) {
+  const n = Number(requestedSeconds);
+  if (!Number.isFinite(n) || n <= 0) return SESSION_POLICY.agent.defaultTtlSeconds;
+  return Math.min(
+    SESSION_POLICY.agent.maxTtlSeconds,
+    Math.max(SESSION_POLICY.agent.minTtlSeconds, Math.floor(n)),
+  );
+}

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -404,14 +404,17 @@
         <button type="submit" id="submitBtn" class="btn-primary">Connect</button>
 
         <div class="oauth-stack">
-            <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/dashboard/agent" class="btn-primary" style="background: #ffffff; color: #1E293B; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/" class="btn-primary" style="background: #ffffff; color: #1E293B; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
                 Sign in with Google
             </a>
-            <a id="githubSignIn" href="/api/oauth/github/start?next=/dashboard/agent" class="btn-primary" style="background: rgba(255,255,255,0.1); color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="githubSignIn" href="/api/oauth/github/start?next=/" class="btn-primary" style="background: rgba(255,255,255,0.1); color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
                 Sign in with GitHub
             </a>
+            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+                Sign in with Cloudflare
+            </a>
         </div>
 
         <p class="signup-prompt">
@@ -463,13 +466,13 @@
     var flow = qs.get('flow');
     var challenge = qs.get('challenge');
     var nextParam = qs.get('next');
-    var oauthDest = '/dashboard/agent';
+    // No product-home default here — host bounce supplies ?next=; otherwise
+    // the Worker resolves against the app manifest entry after auth.
+    var oauthDest = '/';
     if (flow === 'oauth' && challenge && challenge.indexOf('olc_') === 0) {
         oauthDest = '/api/oauth/login-challenge/resume?challenge=' + encodeURIComponent(challenge);
     } else if (nextParam && nextParam.startsWith('/') && !nextParam.startsWith('//')) {
-        if (nextParam.indexOf('/dashboard/settings/integrations') !== 0) {
-            oauthDest = nextParam;
-        }
+        oauthDest = nextParam;
     }
     var googleLink = document.getElementById('googleSignIn');
     if (googleLink) {
@@ -479,6 +482,10 @@
     if (githubLink) {
         githubLink.href = '/api/oauth/github/start?next=' + encodeURIComponent(oauthDest);
     }
+    var cloudflareLink = document.getElementById('cloudflareSignIn');
+    if (cloudflareLink) {
+        cloudflareLink.href = '/api/oauth/cloudflare/start?next=' + encodeURIComponent(oauthDest);
+    }
     if (new URLSearchParams(window.location.search).get('cf_connect') === '1') {
         var cfN = document.getElementById('cfConnectNotice');
         if (cfN) cfN.style.display = 'block';
@@ -564,7 +571,7 @@
             if (res.ok && data.ok) {
                 btn.textContent = 'Success';
                 btn.style.background = '#10B981';
-                var redirectUrl = data.redirect || '/dashboard/agent';
+                var redirectUrl = data.redirect || '/';
                 if (typeof window.runGlobeExitTransition === 'function') {
                     window.runGlobeExitTransition(redirectUrl);
                 } else {
@@ -796,8 +803,8 @@
 (function() {
     var params = new URLSearchParams(window.location.search);
     if (params.get('globe_exit') !== '1') return;
-    var next = params.get('next') || '/dashboard/agent';
-    if (!next.startsWith('/') || next.startsWith('//')) next = '/dashboard/agent';
+    var next = params.get('next') || '/';
+    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
     document.body.classList.add('oauth-globe-exit');
     var tries = 0;
     var maxFrames = 180;

package/packages/identity/src/frontend/auth-portal/pages/reset.html

@@ -346,11 +346,11 @@
     </form>
 
     <div style="margin: 20px 0 0; width: 100%; text-align: center; display: flex; flex-direction: column; gap: 12px;">
-        <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/dashboard/agent" class="oauth-btn oauth-google">
+        <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/" class="oauth-btn oauth-google">
             <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
             Sign in with Google
         </a>
-        <a id="githubSignIn" href="/api/oauth/github/start?next=/dashboard/agent" class="oauth-btn oauth-github">
+        <a id="githubSignIn" href="/api/oauth/github/start?next=/" class="oauth-btn oauth-github">
             <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
             Sign in with GitHub
         </a>
@@ -385,7 +385,7 @@
     var backLink = document.getElementById('backToLogin');
     if (backLink) backLink.href = loginHref;
 
-    var oauthDest = '/dashboard/agent';
+    var oauthDest = '/';
     if (nextParam && nextParam.startsWith('/') && !nextParam.startsWith('//')) {
         oauthDest = nextParam;
     }

package/packages/identity/src/frontend/auth-portal/pages/signup.html

@@ -582,7 +582,7 @@
                 }
                 btn.textContent = 'Success';
                 btn.style.background = '#10B981';
-                var redirectUrl = data.redirect || '/dashboard/overview';
+                var redirectUrl = data.redirect || '/';
                 if (typeof window.runGlobeExitTransition === 'function') {
                     window.runGlobeExitTransition(redirectUrl);
                 } else {
@@ -814,8 +814,8 @@
 (function() {
     var params = new URLSearchParams(window.location.search);
     if (params.get('globe_exit') !== '1') return;
-    var next = params.get('next') || '/dashboard/overview';
-    if (!next.startsWith('/') || next.startsWith('//')) next = '/dashboard/overview';
+    var next = params.get('next') || '/';
+    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
     document.body.classList.add('oauth-globe-exit');
     var tries = 0;
     var maxFrames = 180;

package/packages/identity/src/frontend/auth-portal/preview/dashboard-stub.html

@@ -15,7 +15,7 @@
 <body>
   <main>
     <h1>Post-login (preview stub)</h1>
-    <p>In production you would land on <code>/dashboard/agent</code> (or your <code>next</code> URL) after OAuth or password sign-in.</p>
+    <p>In production you would land on <code>/</code> (or your <code>next</code> URL) after OAuth or password sign-in.</p>
     <p><a href="/auth/login">Back to sign in</a> · <a href="/">Preview hub</a></p>
   </main>
 </body>

package/packages/identity/src/index.js

@@ -20,6 +20,7 @@ import {
   IamProvider,
   GcpProvider,
   EmailProvider,
+  CloudflareProvider,
 } from './providers/index.js';
 
 export {
@@ -38,10 +39,32 @@ export {
   IamProvider,
   GcpProvider,
   EmailProvider,
+  CloudflareProvider,
 };
 
 export * from './core/index.js';
 export * from './core/constants.js';
+export {
+  IDENTITY_ROUTE_IDS,
+  REQUIRED_AUTH_ROUTE_IDS,
+  defineRouteProjection,
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from './contracts/routes.js';
+export {
+  IDENTITY_STORE_SCHEMA_VERSION,
+  IDENTITY_PACKS,
+  IdentityRoutingError,
+  IdentitySchemaError,
+} from './contracts/identity-store.js';
+export {
+  resolvePostAuthDestination,
+  beginLoginRedirect,
+  resolveMountForPath,
+  mountRequiresAuth,
+  pathMatchesMount,
+} from './server/post-auth.js';
+export { verifyAppAuthContract, verifyAppPackage } from './app/verify-app.js';
 export { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from './contracts/company.js';
 export * from './contracts/auth-config.js';
 export { createPasswordResetService } from './recovery/password-reset.js';
@@ -50,6 +73,10 @@ export {
   registerFinalizeInboundOAuth,
 } from './oauth/callback.js';
 export { createCloudflareD1Adapter } from './adapters/cloudflare-d1/index.js';
+export {
+  createSqliteIdentityAdapter,
+  applySqliteIdentityMigrations,
+} from './adapters/sqlite/index.js';
 export { createIdentityService } from './server/identity-service.js';
 export { handleIdentityWorkerRequest } from './server/worker-router.js';