@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/packages/identity/src/oauth/README.md

@@ -21,12 +21,18 @@ npx wrangler secret put IAM_CLIENT_SECRET
 
 These routes live in the **customer** worker (`handleIdentityWorkerRequest`):
 
-1. `/api/oauth/iam/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
-2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else IAM if minted, else 503
+1. `/api/oauth/inneranimalmedia/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
+   - Legacy alias: `/api/oauth/iam/start`
+2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else platform lane if minted, else 503
 3. `/api/oauth/github/start` → same for GitHub
-4. Callback: `/api/oauth/iam/callback` (IAM lane) or `/api/oauth/{google|github}/callback` (BYOK)
+4. Callback: `/api/oauth/inneranimalmedia/callback` (platform lane) or `/api/oauth/{google|github|cloudflare}/callback` (BYOK)
+   - Legacy alias: `/api/oauth/iam/callback`
 
-Register IAM redirect URI: `https://<customer-host>/api/oauth/iam/callback`
+Register platform redirect URI on the IAM client:
+
+`https://<customer-host>/api/oauth/inneranimalmedia/callback`
+
+(Keep the legacy `/api/oauth/iam/callback` registered during migration.)
 
 ## IAM authorization server endpoints (issuer)
 

package/packages/identity/src/oauth/credentials.js

@@ -8,13 +8,17 @@ import { DEFAULT_IAM_ORIGIN, resolveIamOrigin } from '../contracts/auth-config.j
  *   — SECRET is wrangler secret put only (encryption is law, not luxury).
  *
  * Developer BYOK: GOOGLE_CLIENT_* / GITHUB_CLIENT_* when set for that provider
- * take the /api/oauth/{provider}/start button; otherwise the button uses IAM.
+ * take the /api/oauth/{provider}/start button; otherwise the button uses the
+ * Inner Animal Media platform lane (`inneranimalmedia`).
  */
 
 /** @deprecated Use DEFAULT_IAM_ORIGIN from the auth configuration contract. */
 export const DEFAULT_IAM_OAUTH_ISSUER = DEFAULT_IAM_ORIGIN;
 export const IAM_PLATFORM_STATE_PROVIDER = 'iam_platform';
-export const IAM_PLATFORM_CALLBACK_PATH = '/api/oauth/iam/callback';
+/** Canonical platform OAuth callback (protocol id = inneranimalmedia). */
+export const IAM_PLATFORM_CALLBACK_PATH = '/api/oauth/inneranimalmedia/callback';
+/** @deprecated Legacy path — still accepted; prefer IAM_PLATFORM_CALLBACK_PATH. */
+export const IAM_PLATFORM_CALLBACK_PATH_LEGACY = '/api/oauth/iam/callback';
 
 /**
  * @param {Record<string, unknown> | null | undefined} env
@@ -42,9 +46,9 @@ export function requireIamPlatformCredentials(env) {
 
 /**
  * @param {Record<string, unknown> | null | undefined} env
- * @param {'google' | 'github' | 'iam'} provider
+ * @param {'google' | 'github' | 'cloudflare' | 'inneranimalmedia' | 'iam'} provider
  * @returns {{
- *   lane: 'iam_platform' | 'byok_google' | 'byok_github',
+ *   lane: 'iam_platform' | 'byok_google' | 'byok_github' | 'byok_cloudflare',
  *   clientId: string,
  *   clientSecret: string,
  *   origin?: string,
@@ -53,7 +57,10 @@ export function requireIamPlatformCredentials(env) {
  * } | null}
  */
 export function resolveOAuthCredentialLane(env, provider) {
-  if (provider === 'iam') {
+  const key = String(provider || '').trim().toLowerCase();
+
+  // Protocol/selection id is inneranimalmedia; `iam` remains a legacy alias.
+  if (key === 'inneranimalmedia' || key === 'iam') {
     const iam = resolveIamPlatformCredentials(env);
     if (!iam) return null;
     return {
@@ -62,24 +69,37 @@ export function resolveOAuthCredentialLane(env, provider) {
       clientSecret: iam.clientSecret,
       origin: iam.origin,
       issuer: iam.issuer,
-      provider: 'iam',
+      provider: 'inneranimalmedia',
     };
   }
 
-  if (provider === 'google') {
+  if (key === 'google') {
     const clientId = String(env?.GOOGLE_CLIENT_ID || '').trim();
     const clientSecret = String(env?.GOOGLE_CLIENT_SECRET || '').trim();
     if (clientId && clientSecret) {
-      return { lane: 'byok_google', clientId, clientSecret, provider };
+      return { lane: 'byok_google', clientId, clientSecret, provider: 'google' };
     }
   }
 
-  if (provider === 'github') {
+  if (key === 'github') {
     const clientId = String(env?.GITHUB_CLIENT_ID || '').trim();
     const clientSecret = String(env?.GITHUB_CLIENT_SECRET || '').trim();
     if (clientId && clientSecret) {
-      return { lane: 'byok_github', clientId, clientSecret, provider };
+      return { lane: 'byok_github', clientId, clientSecret, provider: 'github' };
+    }
+  }
+
+  if (key === 'cloudflare') {
+    // Reuses the same Worker secrets as the Local Studio Cloudflare resource
+    // connector (packages/connectors/cloudflare). clientSecret may be empty
+    // if that client is configured as PKCE-only (Token Authentication
+    // Method = None) — exchangeCloudflareCode() omits it in that case.
+    const clientId = String(env?.CLOUDFLARE_OAUTH_CLIENT_ID || '').trim();
+    const clientSecret = String(env?.CLOUDFLARE_OAUTH_CLIENT_SECRET || '').trim();
+    if (clientId) {
+      return { lane: 'byok_cloudflare', clientId, clientSecret, provider: 'cloudflare' };
     }
+    return null;
   }
 
   // Default: Google/GitHub buttons route through IAM platform when minted.
@@ -91,7 +111,7 @@ export function resolveOAuthCredentialLane(env, provider) {
       clientSecret: iam.clientSecret,
       origin: iam.origin,
       issuer: iam.issuer,
-      provider,
+      provider: 'inneranimalmedia',
     };
   }
 

package/packages/identity/src/oauth/finalize-inbound.js

@@ -51,7 +51,7 @@ export function createFinalizeInboundOAuth(ports) {
         ? String(input.supabaseUserId).trim()
         : null;
     const source = String(input?.source || `${provider}_oauth`).trim();
-    const pageContext = String(input?.pageContext || '/dashboard/agent').trim();
+    const pageContext = String(input?.pageContext || '/').trim();
 
     if (!ports.hasDatabase(env) || !oauthEmail || !provider || !providerUid) {
       return /** @type {InboundOAuthFailure} */ ({ ok: false, error: 'provision_failed' });

package/packages/identity/src/oauth/iam-platform.js

@@ -1,4 +1,4 @@
-import { AUTH_LOGIN_PATH } from '../core/constants.js';
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
 import {
   IAM_PLATFORM_CALLBACK_PATH,
   IAM_PLATFORM_STATE_PROVIDER,
@@ -19,7 +19,7 @@ import { normalizeIamIdentity } from '../providers/iam/mapper.js';
  * @param {Record<string, unknown>} env
  * @param {import('../adapters/cloudflare-d1/index.js').CloudflareD1Adapter} adapter
  */
-export async function iamPlatformOAuthStart(request, env, adapter) {
+export async function iamPlatformOAuthStart(request, env, adapter, identity) {
   const creds = resolveIamPlatformCredentials(env);
   if (!creds) {
     return Response.json({ ok: false, error: 'iam_oauth_not_configured' }, 503);
@@ -29,15 +29,16 @@ export async function iamPlatformOAuthStart(request, env, adapter) {
   const state = randomOAuthState();
   const codeVerifier = pkceVerifier();
   const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = url.searchParams.get('next')
-    || url.searchParams.get('return_to')
-    || '/dashboard/cms';
+  const redirectTo = identity?.resolvePostLoginPath(
+    url.searchParams.get('next') || url.searchParams.get('return_to'),
+  ) || '/';
 
   await adapter.saveOAuthState({
     state,
     provider: IAM_PLATFORM_STATE_PROVIDER,
     codeVerifier,
     redirectTo,
+    appId: identity?.app?.id || null,
   });
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -67,15 +68,15 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
   const err = url.searchParams.get('error');
 
   if (err || !code || !state) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=oauth_failed`, 302);
   }
   if (!creds) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=iam_oauth_not_configured`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=iam_oauth_not_configured`, 302);
   }
 
   const saved = await adapter.consumeOAuthState(state);
   if (!saved || saved.provider !== IAM_PLATFORM_STATE_PROVIDER) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=state_mismatch`, 302);
   }
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -88,7 +89,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     redirectUri,
   });
   if (!token?.access_token) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=token_exchange_failed`, 302);
   }
 
   const profile = await fetchIamProfile({
@@ -97,7 +98,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
   });
   const normalized = profile ? normalizeIamIdentity(profile) : null;
   if (!normalized?.subject || !normalized?.email) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=userinfo_failed`, 302);
   }
 
   const result = await identity.provisionOAuthUser({
@@ -107,9 +108,9 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     displayName: normalized.name || normalized.email.split('@')[0] || 'User',
   });
 
-  const redirectTo = saved.redirect_to || '/dashboard/cms';
+  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  const globeUrl = `${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {
     status: 302,
     headers: {

package/packages/identity/src/oauth/redirect-paths.js

@@ -1,29 +1,35 @@
 /**
  * Post-OAuth redirect helpers — portable path policy with host injectables.
+ * Hosts MUST pass loginPath from their route projection (never hardcode).
  */
 
-const DEFAULT_DASHBOARD_FALLBACK = '/dashboard/agent';
+import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 
 /**
  * @typedef {object} OAuthRedirectPathOptions
  * @property {string} [authCookieName]
- * @property {string} [dashboardFallback]
+ * @property {string} loginPath concrete projection of identity.login
+ * @property {string} [fallback] only used when isAllowedLoginResumePath rejects; prefer omit
  * @property {(path: string) => boolean} [isAllowedLoginResumePath]
  * @property {(env: unknown, rawCookie: string) => Promise<string|null>} [resolveSessionIdFromCookie]
  * @property {(env: unknown, sessionId: string, reason: string, userId: string|null) => Promise<void>} [revokeAuthSession]
  */
 
-/**
- * @param {OAuthRedirectPathOptions} options
- */
 export function createOAuthRedirectHelpers(options = {}) {
   const authCookieName = options.authCookieName ?? 'iam_session';
-  const dashboardFallback = options.dashboardFallback ?? DEFAULT_DASHBOARD_FALLBACK;
-  const isAllowedLoginResumePath = options.isAllowedLoginResumePath ?? (() => false);
+  const loginPath = options.loginPath;
+  if (!loginPath || !String(loginPath).startsWith('/')) {
+    throw new IdentityRoutingError(
+      'AUTH_ROUTE_MISSING',
+      'createOAuthRedirectHelpers requires loginPath from route projection',
+    );
+  }
+  const isAllowedLoginResumePath = options.isAllowedLoginResumePath
+    ?? ((path) => Boolean(sanitizeBrowserNextPath(path)));
   const resolveSessionIdFromCookie = options.resolveSessionIdFromCookie;
   const revokeAuthSession = options.revokeAuthSession;
 
-  /** Revoke browser cookie session before issuing a new login session. */
   async function revokeIncomingCookieSession(request, env, reason = 'oauth_login_replaced') {
     const cookie = request.headers.get('Cookie') || '';
     const match = cookie.match(new RegExp(`(?:^|;\\s*)${authCookieName}=([^;]+)`));
@@ -45,48 +51,33 @@ export function createOAuthRedirectHelpers(options = {}) {
     }
   }
 
-  function safeDashboardLoginRedirectPath(originBase, returnTo) {
-    if (!returnTo || typeof returnTo !== 'string') return dashboardFallback;
-    const t = returnTo.trim();
-    if (!t) return dashboardFallback;
-    if (t.startsWith('/') && !t.startsWith('//') && !t.includes('://')) {
-      if (isAllowedLoginResumePath(t)) return t;
-      if (t.startsWith('/dashboard/settings/integrations')) return dashboardFallback;
-      if (!t.startsWith('/dashboard')) return dashboardFallback;
-      return t;
+  function safeLoginRedirectPath(_originBase, returnTo) {
+    const cleaned = sanitizeBrowserNextPath(returnTo);
+    if (!cleaned) {
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'return_to missing/invalid');
     }
-    try {
-      const u = new URL(t);
-      const ob = new URL(originBase);
-      if (u.origin !== ob.origin) return dashboardFallback;
-      const p = u.pathname + (u.search || '');
-      if (p.startsWith('/dashboard/settings/integrations')) return dashboardFallback;
-      if (!p.startsWith('/dashboard')) return dashboardFallback;
-      return p;
-    } catch {
-      return dashboardFallback;
+    if (!isAllowedLoginResumePath(cleaned)) {
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'return_to not allowed', { returnTo: cleaned });
     }
+    return cleaned;
   }
 
   function oauthPostLoginGlobeRedirectUrl(originBase, returnToFullUrl) {
-    let path = dashboardFallback;
+    let path;
     try {
       const u = new URL(returnToFullUrl);
       path = u.pathname + (u.search || '');
     } catch {
-      /* keep default */
-    }
-    if (!path.startsWith('/') || path.startsWith('//')) path = dashboardFallback;
-    if (path.startsWith('/dashboard/settings/integrations')) path = dashboardFallback;
-    if (!isAllowedLoginResumePath(path) && !path.startsWith('/dashboard')) {
-      path = dashboardFallback;
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'invalid returnToFullUrl');
     }
-    return `${originBase}/auth/login?globe_exit=1&next=${encodeURIComponent(path)}`;
+    path = safeLoginRedirectPath(originBase, path);
+    return `${originBase}${loginPath}?globe_exit=1&next=${encodeURIComponent(path)}`;
   }
 
   return {
     revokeIncomingCookieSession,
-    safeDashboardLoginRedirectPath,
+    safeDashboardLoginRedirectPath: safeLoginRedirectPath,
+    safeLoginRedirectPath,
     oauthPostLoginGlobeRedirectUrl,
   };
 }

package/packages/identity/src/providers/cloudflare/index.js

@@ -0,0 +1,19 @@
+import { createIdentityProvider } from '../../provider-contract.js';
+import { exchangeCloudflareCode, getCloudflareAuthUrl } from './oauth.js';
+import { fetchCloudflareProfile } from './profile.js';
+import { normalizeCloudflareIdentity } from './mapper.js';
+
+export const CloudflareProvider = createIdentityProvider({
+  id: 'cloudflare',
+  authorizeUrl: getCloudflareAuthUrl,
+  exchangeCode: exchangeCloudflareCode,
+  getProfile: fetchCloudflareProfile,
+  normalizeIdentity: normalizeCloudflareIdentity,
+});
+
+export {
+  getCloudflareAuthUrl,
+  exchangeCloudflareCode,
+  fetchCloudflareProfile,
+  normalizeCloudflareIdentity,
+};

package/packages/identity/src/providers/cloudflare/mapper.js

@@ -0,0 +1,21 @@
+import { normalizeExternalIdentity } from '../../contracts/external-identity.js';
+
+/**
+ * @param {Record<string, unknown>|null|undefined} profile
+ */
+export function normalizeCloudflareIdentity(profile) {
+  const raw = profile && typeof profile === 'object' ? profile : {};
+  const subject = String(raw.sub || raw.id || raw.user_id || raw.account_id || '').trim();
+  if (!subject) {
+    throw new Error('cloudflare_identity_requires_subject');
+  }
+  return normalizeExternalIdentity({
+    provider: 'cloudflare',
+    subject,
+    email: typeof raw.email === 'string' ? raw.email : null,
+    emailVerified: Boolean(raw.email),
+    name: typeof raw.name === 'string' ? raw.name : (typeof raw.display_name === 'string' ? raw.display_name : null),
+    avatar: null,
+    raw,
+  });
+}

package/packages/identity/src/providers/cloudflare/oauth.js

@@ -0,0 +1,48 @@
+const CLOUDFLARE_AUTH_URL = 'https://dash.cloudflare.com/oauth2/auth';
+const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
+
+// Identity-only login should not request the full resource-access scope set
+// used elsewhere for the Local Studio Cloudflare *connection* (deploy/d1/r2/etc).
+// account-settings.read is enough to resolve the account for userinfo.
+const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read offline_access';
+
+/** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
+export function getCloudflareAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {
+  const url = new URL(CLOUDFLARE_AUTH_URL);
+  url.searchParams.set('client_id', clientId || '');
+  url.searchParams.set('redirect_uri', redirectUri || '');
+  url.searchParams.set('response_type', 'code');
+  url.searchParams.set('scope', scope || CLOUDFLARE_LOGIN_SCOPE);
+  url.searchParams.set('state', state || '');
+  if (codeChallenge) {
+    url.searchParams.set('code_challenge', codeChallenge);
+    url.searchParams.set('code_challenge_method', 'S256');
+  }
+  return url.toString();
+}
+
+/** @param {import('../../provider-contract.js').OAuthExchangeInput} input */
+export async function exchangeCloudflareCode({ code, codeVerifier, clientId, clientSecret, redirectUri }) {
+  try {
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('code', code || '');
+    body.set('code_verifier', codeVerifier || '');
+    body.set('client_id', clientId || '');
+    // client_secret is only sent when configured — the client may be a
+    // PKCE-only public client (Token Authentication Method = None), same
+    // pattern as the Local Studio resource connector.
+    if (clientSecret) body.set('client_secret', clientSecret);
+    body.set('redirect_uri', redirectUri || '');
+
+    const res = await fetch(CLOUDFLARE_TOKEN_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body,
+    });
+    if (!res.ok) return null;
+    return await res.json();
+  } catch {
+    return null;
+  }
+}

package/packages/identity/src/providers/cloudflare/profile.js

@@ -0,0 +1,28 @@
+const CLOUDFLARE_USERINFO_URL = 'https://dash.cloudflare.com/oauth2/userinfo';
+
+/**
+ * Fetch the authenticated Cloudflare user's identity.
+ * Response shape not fully verified against a live token yet — this reads
+ * defensively (sub/id/user_id, email, name) rather than assuming Cloudflare's
+ * exact OIDC field names. Confirm the real shape on first live login and
+ * tighten this if fields differ.
+ * @param {string} accessToken
+ */
+export async function fetchCloudflareProfile(accessToken) {
+  try {
+    const res = await fetch(CLOUDFLARE_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (!data) return null;
+    return {
+      sub: data.sub || data.id || data.user_id || data.account_id || null,
+      email: data.email || null,
+      name: data.name || data.display_name || null,
+      raw: data,
+    };
+  } catch {
+    return null;
+  }
+}

package/packages/identity/src/providers/index.js

@@ -4,19 +4,28 @@ import { GithubProvider } from './github/index.js';
 import { GcpProvider } from './gcp/index.js';
 import { EmailProvider } from './email/index.js';
 import { IamProvider } from './iam/index.js';
+import { CloudflareProvider } from './cloudflare/index.js';
 
-/** @type {Record<string, import('../provider-contract.js').IdentityProvider>} */
+/**
+ * Active identity provider registry.
+ * `inneranimalmedia` is the canonical platform template id; `iam` remains a
+ * legacy lookup alias (OAuth/DB provider key on platform identities).
+ * @type {Record<string, import('../provider-contract.js').IdentityProvider>}
+ */
 export const identityProviders = Object.freeze({
   google: GoogleProvider,
   github: GithubProvider,
   gcp: GcpProvider,
   email: EmailProvider,
+  inneranimalmedia: IamProvider,
   iam: IamProvider,
+  cloudflare: CloudflareProvider,
 });
 
 /** @param {string} id */
 export function getIdentityProvider(id) {
   const key = String(id || '').trim().toLowerCase();
+  if (key === 'iam') return identityProviders.inneranimalmedia || identityProviders.iam || null;
   return identityProviders[key] || null;
 }
 
@@ -24,4 +33,11 @@ export function listIdentityProviders() {
   return IdentityProviders.map((id) => identityProviders[id]).filter(Boolean);
 }
 
-export { GoogleProvider, GithubProvider, GcpProvider, EmailProvider, IamProvider };
+export {
+  GoogleProvider,
+  GithubProvider,
+  GcpProvider,
+  EmailProvider,
+  IamProvider,
+  CloudflareProvider,
+};

package/packages/identity/src/server/identity-service.js

@@ -1,24 +1,48 @@
-import { AUTH_COOKIE_NAME, AUTH_SESSION_TTL_SECONDS, DASHBOARD_AFTER_LOGIN_PATH } from '../core/constants.js';
+import { AUTH_COOKIE_NAME, SESSION_POLICY } from '../core/constants.js';
 import { hashPassword, verifyPassword } from '../core/password-crypto.js';
 import { jsonResponse } from '../core/http-json.js';
-import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+import { resolvePostAuthDestination } from './post-auth.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { newAuthUserId } from '../adapters/cloudflare-d1/ids.js';
 
 /**
- * @typedef {ReturnType<import('../adapters/cloudflare-d1/index.js').createCloudflareD1Adapter>} IdentityStorageAdapter
+ * @typedef {import('../contracts/identity-store.js').IdentityStore} IdentityStore
  */
 
 /**
  * Server-side identity orchestration (Worker / Node). No secrets in client bundle.
- * @param {{ adapter: IdentityStorageAdapter, cookieName?: string, defaultRedirect?: string }} config
+ * Hosts must supply `app` + `routeRegistry` — no platform "/" fallback.
+ *
+ * @param {{
+ *   adapter: IdentityStore,
+ *   cookieName?: string,
+ *   app: { id: string },
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ * }} config
  */
 export function createIdentityService(config) {
   const adapter = config.adapter;
   if (!adapter) throw new Error('identity_service_requires_adapter');
   const cookieName = config.cookieName || AUTH_COOKIE_NAME;
-  const defaultRedirect = config.defaultRedirect || DASHBOARD_AFTER_LOGIN_PATH;
+  const app = config.app || null;
+  const routeRegistry = config.routeRegistry || null;
+  if (!app?.id || !routeRegistry) {
+    throw new IdentityRoutingError(
+      'AUTH_APP_UNRESOLVED',
+      'createIdentityService requires app + routeRegistry (no platform fallback)',
+    );
+  }
+  routeRegistry.assertAuthCapable(app.id);
+
+  function resolvePostLoginPath(nextPath) {
+    return resolvePostAuthDestination({
+      transaction: { return_to: nextPath, app_id: app.id },
+      app,
+      routeRegistry,
+    });
+  }
 
-  function sessionCookieHeader(sessionId, requestUrl, maxAge = AUTH_SESSION_TTL_SECONDS) {
+  function sessionCookieHeader(sessionId, requestUrl, maxAge = SESSION_POLICY.browser.ttlSeconds) {
     const secure = new URL(requestUrl).protocol === 'https:';
     const parts = [
       `${cookieName}=${sessionId}`,
@@ -39,7 +63,9 @@ export function createIdentityService(config) {
 
   return Object.freeze({
     cookieName,
-    defaultRedirect,
+    app,
+    routeRegistry,
+    defaultRedirect: resolvePostLoginPath(null),
 
     async signup({ email, password, displayName }) {
       const normalized = String(email || '').trim().toLowerCase();
@@ -127,7 +153,7 @@ export function createIdentityService(config) {
     },
 
     buildLoginSuccessResponse(request, sessionId, nextPath) {
-      const redirect = sanitizeBrowserNextPath(nextPath) || defaultRedirect;
+      const redirect = resolvePostLoginPath(nextPath);
       return jsonResponse(
         { ok: true, redirect },
         200,
@@ -150,6 +176,7 @@ export function createIdentityService(config) {
 
     parseSessionId,
     sessionCookieHeader,
+    resolvePostLoginPath,
   });
 }
 

package/packages/identity/src/server/mount-policy.js

@@ -0,0 +1,30 @@
+/**
+ * Mount-level auth policy helpers (host applies; identity does not invent mounts).
+ */
+
+/**
+ * @typedef {{ path: string, auth?: 'required'|'optional'|'public', spa?: boolean, shell?: string }} AppMount
+ */
+
+export function pathMatchesMount(pathname, mount) {
+  const base = String(mount?.path || '');
+  if (!base) return false;
+  const path = String(pathname || '');
+  return path === base || path.startsWith(`${base}/`);
+}
+
+export function resolveMountForPath(pathname, app) {
+  const mounts = Array.isArray(app?.routes?.mounts) ? app.routes.mounts : [];
+  let best = null;
+  for (const mount of mounts) {
+    if (!pathMatchesMount(pathname, mount)) continue;
+    if (!best || String(mount.path).length > String(best.path).length) best = mount;
+  }
+  return best;
+}
+
+export function mountRequiresAuth(pathname, app) {
+  const mount = resolveMountForPath(pathname, app);
+  if (!mount) return false;
+  return (mount.auth || 'public') === 'required';
+}