@inneranimalmedia/agentsam-sdk 2.6.2 → 2.6.4

package/packages/identity/src/server/post-auth.js

@@ -0,0 +1,79 @@
+/**
+ * Fail-closed post-auth destination resolver.
+ * Never redirects to "/" / marketing / invented dashboard paths.
+ */
+
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
+
+/**
+ * @typedef {{ app_id?: string|null, return_to?: string|null }} AuthTransaction
+ */
+
+/**
+ * @param {{
+ *   transaction?: AuthTransaction|null,
+ *   app?: { id: string }|null,
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ * }} opts
+ * @returns {string}
+ */
+export function resolvePostAuthDestination({ transaction, app, routeRegistry }) {
+  if (!routeRegistry) {
+    throw new IdentityRoutingError('AUTH_ROUTE_REGISTRY_REQUIRED');
+  }
+  if (!app?.id) {
+    throw new IdentityRoutingError('AUTH_APP_UNRESOLVED');
+  }
+
+  routeRegistry.assertAuthCapable(app.id);
+
+  const returnTo = routeRegistry.resolveReturnTo({
+    appId: app.id,
+    value: transaction?.return_to,
+  });
+  if (returnTo) return returnTo;
+
+  const entry = routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.APP_AUTHENTICATED)
+    || routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.APP_HOME);
+  if (entry) return entry;
+
+  const recovery = routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.RECOVERY)
+    || routeRegistry.resolve(app.id, IDENTITY_ROUTE_IDS.LOGIN);
+  if (recovery) {
+    return `${recovery}?error=missing_authenticated_entry`;
+  }
+
+  throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', undefined, {
+    appId: app.id,
+    returnTo: transaction?.return_to || null,
+  });
+}
+
+/**
+ * Begin login redirect URL for an unauthenticated request into an app mount.
+ * @param {{
+ *   appId: string,
+ *   returnTo: string,
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ *   origin: string,
+ * }} opts
+ */
+export function beginLoginRedirect({ appId, returnTo, routeRegistry, origin }) {
+  routeRegistry.assertAuthCapable(appId);
+  const login = routeRegistry.resolve(appId, IDENTITY_ROUTE_IDS.LOGIN);
+  if (!login) {
+    throw new IdentityRoutingError('AUTH_ROUTE_MISSING', 'identity.login projection missing', { appId });
+  }
+  const safeReturn = routeRegistry.resolveReturnTo({ appId, value: returnTo }) || '';
+  const url = new URL(login, origin);
+  if (safeReturn) url.searchParams.set('next', safeReturn);
+  return url.toString();
+}
+
+/** @deprecated Mount helpers moved with host registry — kept for host gate wiring. */
+export {
+  pathMatchesMount,
+  resolveMountForPath,
+  mountRequiresAuth,
+} from './mount-policy.js';

package/packages/identity/src/server/worker-router.js

@@ -7,7 +7,10 @@ import { getGoogleAuthUrl, exchangeGoogleCode } from '../providers/google/oauth.
 import { fetchGoogleProfile } from '../providers/google/profile.js';
 import { getGithubAuthUrl, exchangeGithubCode } from '../providers/github/oauth.js';
 import { fetchGithubProfile } from '../providers/github/profile.js';
-import { AUTH_LOGIN_PATH } from '../core/constants.js';
+import { getCloudflareAuthUrl, exchangeCloudflareCode } from '../providers/cloudflare/oauth.js';
+import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from '../oauth/pkce.js';
@@ -78,7 +81,22 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   const method = request.method.toUpperCase();
 
   const adapter = createCloudflareD1Adapter(env.DB);
-  const identity = options.identity || createIdentityService({ adapter });
+  if (!options.identity && (!options.app?.id || !options.routeRegistry)) {
+    throw new IdentityRoutingError(
+      'AUTH_APP_UNRESOLVED',
+      'handleIdentityWorkerRequest requires options.app + options.routeRegistry',
+    );
+  }
+  const identity = options.identity || createIdentityService({
+    adapter,
+    app: options.app,
+    routeRegistry: options.routeRegistry,
+  });
+  const loginPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN);
+  const signupPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.SIGNUP)
+    || loginPath();
+  const resetPath = () => identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.RESET)
+    || loginPath();
   const passwordReset = buildPasswordResetService(env, adapter, options);
 
   // ── API: email auth ─────────────────────────────────────────────────────
@@ -89,8 +107,14 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
       password: body.password,
     });
     if (!result.ok) {
+      await adapter.logAuthEvent({
+        eventType: 'login', status: 'failed', provider: 'email', request,
+      });
       return jsonResponse({ ok: false, error: result.error }, 401);
     }
+    await adapter.logAuthEvent({
+      userId: result.user.id, eventType: 'login', status: 'ok', provider: 'email', request,
+    });
     return identity.buildLoginSuccessResponse(request, result.sessionId, body.next);
   }
 
@@ -108,7 +132,11 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   }
 
   if (path === '/api/auth/logout' && method === 'POST') {
+    const sessionCtx = await identity.sessionFromRequest(request).catch(() => null);
     await identity.logout(request);
+    await adapter.logAuthEvent({
+      userId: sessionCtx?.user?.id, eventType: 'logout', status: 'ok', request,
+    });
     return identity.buildLogoutResponse(request);
   }
 
@@ -186,38 +214,48 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!result.ok) {
       return jsonResponse({ error: result.error }, result.status || 400);
     }
-    return jsonResponse({ ok: true, redirect: `${AUTH_LOGIN_PATH}?reset=success` });
+    return jsonResponse({ ok: true, redirect: `${loginPath()}?reset=success` });
   }
 
   // ── OAuth ────────────────────────────────────────────────────────────────
   // Default: IAM_CLIENT_* (minted). Developer BYOK GOOGLE_*/GITHUB_* take the
   // matching /api/oauth/{provider}/start button when set.
-  if (path === '/api/oauth/iam/callback' && method === 'GET') {
-    return iamPlatformOAuthCallback(request, env, adapter, identity);
+  // Canonical platform id = inneranimalmedia (legacy /api/oauth/iam/* still accepted).
+  if (path === '/api/oauth/inneranimalmedia/callback' || path === '/api/oauth/iam/callback') {
+    if (method === 'GET') {
+      return iamPlatformOAuthCallback(request, env, adapter, identity);
+    }
   }
-  if (path === '/api/oauth/iam/start' && method === 'GET') {
-    const lane = resolveOAuthCredentialLane(env, 'iam');
-    if (!lane) return jsonResponse({ ok: false, error: 'iam_oauth_not_configured' }, 503);
-    return iamPlatformOAuthStart(request, env, adapter);
+  if (path === '/api/oauth/inneranimalmedia/start' || path === '/api/oauth/iam/start') {
+    if (method === 'GET') {
+      const lane = resolveOAuthCredentialLane(env, 'inneranimalmedia');
+      if (!lane) return jsonResponse({ ok: false, error: 'inneranimalmedia_oauth_not_configured' }, 503);
+      return iamPlatformOAuthStart(request, env, adapter, identity);
+    }
   }
 
   if (path === '/api/oauth/google/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) return jsonResponse({ ok: false, error: 'google_oauth_not_configured' }, 503);
-    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter);
-    return oauthStart(request, env, adapter, 'google', lane);
+    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
+    return oauthStart(request, env, identity, adapter, 'google', lane);
   }
   if (path === '/api/oauth/github/start' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) return jsonResponse({ ok: false, error: 'github_oauth_not_configured' }, 503);
-    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter);
-    return oauthStart(request, env, adapter, 'github', lane);
+    if (lane.lane === 'iam_platform') return iamPlatformOAuthStart(request, env, adapter, identity);
+    return oauthStart(request, env, identity, adapter, 'github', lane);
+  }
+  if (path === '/api/oauth/cloudflare/start' && method === 'GET') {
+    const lane = resolveOAuthCredentialLane(env, 'cloudflare');
+    if (!lane) return jsonResponse({ ok: false, error: 'cloudflare_oauth_not_configured' }, 503);
+    return oauthStart(request, env, identity, adapter, 'cloudflare', lane);
   }
 
   if (path === '/api/oauth/google/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'google');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     if (lane.lane === 'iam_platform') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -227,40 +265,38 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/github/callback' && method === 'GET') {
     const lane = resolveOAuthCredentialLane(env, 'github');
     if (!lane) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_not_configured`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
     }
     if (lane.lane === 'iam_platform') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
     }
     return oauthCallback(request, env, identity, adapter, 'github', lane);
   }
+  if (path === '/api/oauth/cloudflare/callback' && method === 'GET') {
+    const lane = resolveOAuthCredentialLane(env, 'cloudflare');
+    if (!lane) {
+      return Response.redirect(`${url.origin}${loginPath()}?error=oauth_not_configured`, 302);
+    }
+    return oauthCallback(request, env, identity, adapter, 'cloudflare', lane);
+  }
 
-  // Auth HTML shells — use extensionless paths; assets serves foo.html at /foo.
-  const authPageMap = {
-    '/auth/login': '/auth/login',
-    '/auth/signup': '/auth/signup',
-    '/auth/reset': '/auth/reset',
-  };
+  // Auth HTML shells — identity pages only (Worker ASSETS binding, not R2).
+  const authPages = new Set([
+    loginPath(),
+    signupPath(),
+    resetPath(),
+  ]);
 
-  if (method === 'GET' && authPageMap[path]) {
+  if (method === 'GET' && authPages.has(path)) {
     if (env.ASSETS?.fetch) {
-      const assetUrl = new URL(authPageMap[path], url.origin);
+      const assetUrl = new URL(path, url.origin);
       return env.ASSETS.fetch(new Request(assetUrl, request));
     }
     return jsonResponse({ error: 'assets_binding_required', path }, 500);
   }
 
-  if (method === 'GET' && (path === '/dashboard' || path.startsWith('/dashboard/'))) {
-    const ctx = await identity.sessionFromRequest(request);
-    if (!ctx) {
-      const next = encodeURIComponent(path + url.search);
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?next=${next}`, 302);
-    }
-    if (env.ASSETS?.fetch) {
-      const assetUrl = new URL('/dashboard/index.html', url.origin);
-      return env.ASSETS.fetch(new Request(assetUrl, request));
-    }
-  }
+  // Product SPA mounts (/agentsam, /admin, /cad, …) are owned by the host app
+  // registry — identity does not invent or gate those routes here.
 
   if (env.ASSETS?.fetch) {
     return env.ASSETS.fetch(request);
@@ -269,35 +305,64 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   return jsonResponse({ error: 'not_found', path }, 404);
 }
 
-async function oauthStart(request, env, adapter, provider, creds) {
+async function oauthStart(request, env, identity, adapter, provider, creds) {
   const url = new URL(request.url);
   if (!creds.clientId) {
     return jsonResponse({ ok: false, error: `${provider}_oauth_not_configured` }, 503);
   }
-  const state = randomOAuthState();
-  const codeVerifier = pkceVerifier();
-  const codeChallenge = await pkceChallenge(codeVerifier);
-  const redirectTo = url.searchParams.get('next') || url.searchParams.get('return_to') || '/dashboard/cms';
-  await adapter.saveOAuthState({ state, provider, codeVerifier, redirectTo });
-
-  const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
-  let authUrl;
-  if (provider === 'google') {
-    authUrl = getGoogleAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
+  try {
+    const state = randomOAuthState();
+    const codeVerifier = pkceVerifier();
+    const codeChallenge = await pkceChallenge(codeVerifier);
+    const redirectTo = identity.resolvePostLoginPath(
+      url.searchParams.get('next') || url.searchParams.get('return_to'),
+    );
+    await adapter.saveOAuthState({
       state,
-      codeChallenge,
-    });
-  } else {
-    authUrl = getGithubAuthUrl({
-      clientId: creds.clientId,
-      redirectUri,
-      state,
-      codeChallenge,
+      provider,
+      codeVerifier,
+      redirectTo,
+      appId: identity.app?.id || null,
     });
+
+    const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
+    let authUrl;
+    if (provider === 'google') {
+      authUrl = getGoogleAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    } else if (provider === 'cloudflare') {
+      authUrl = getCloudflareAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    } else {
+      authUrl = getGithubAuthUrl({
+        clientId: creds.clientId,
+        redirectUri,
+        state,
+        codeChallenge,
+      });
+    }
+    return Response.redirect(authUrl, 302);
+  } catch (error) {
+    const message = String(error?.message || error || 'oauth_start_failed');
+    console.error('oauth_start_failed', provider, message);
+    // Prefer redirect to login with error over bare Worker 1101 for browsers.
+    const lp = identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN);
+    const login = new URL(lp, url.origin);
+    login.searchParams.set('error', 'oauth_start_failed');
+    login.searchParams.set('provider', provider);
+    login.searchParams.set('detail', message.slice(0, 120));
+    const next = url.searchParams.get('next') || url.searchParams.get('return_to');
+    if (next) login.searchParams.set('next', next);
+    return Response.redirect(login.toString(), 302);
   }
-  return Response.redirect(authUrl, 302);
 }
 
 async function oauthCallback(request, env, identity, adapter, provider, creds) {
@@ -306,11 +371,13 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
   const state = url.searchParams.get('state');
   const err = url.searchParams.get('error');
   if (err || !code || !state) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
+    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'oauth_failed' } });
+    return Response.redirect(`${url.origin}${loginPath()}?error=oauth_failed`, 302);
   }
   const saved = await adapter.consumeOAuthState(state);
   if (!saved || saved.provider !== provider) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
+    await adapter.logAuthEvent({ eventType: 'login', status: 'failed', provider, request, metadata: { reason: 'state_mismatch' } });
+    return Response.redirect(`${url.origin}${loginPath()}?error=state_mismatch`, 302);
   }
   const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
   let token;
@@ -324,9 +391,21 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       redirectUri,
     });
     if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
     }
     profile = await fetchGoogleProfile(token.access_token);
+  } else if (provider === 'cloudflare') {
+    token = await exchangeCloudflareCode({
+      code,
+      codeVerifier: saved.code_verifier,
+      clientId: creds.clientId,
+      clientSecret: creds.clientSecret,
+      redirectUri,
+    });
+    if (!token?.access_token) {
+      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
+    }
+    profile = await fetchCloudflareProfile(token.access_token);
   } else {
     token = await exchangeGithubCode({
       code,
@@ -336,17 +415,22 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       redirectUri,
     });
     if (!token?.access_token) {
-      return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+      return Response.redirect(`${url.origin}${loginPath()}?error=token_exchange_failed`, 302);
     }
     profile = await fetchGithubProfile(token.access_token);
   }
   if (!profile) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
+    return Response.redirect(`${url.origin}${loginPath()}?error=userinfo_failed`, 302);
   }
 
-  const normalized = provider === 'google'
-    ? { subject: profile.sub, email: profile.email, name: profile.name }
-    : { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+  let normalized;
+  if (provider === 'google') {
+    normalized = { subject: profile.sub, email: profile.email, name: profile.name };
+  } else if (provider === 'cloudflare') {
+    normalized = { subject: String(profile.sub), email: profile.email, name: profile.name || profile.email };
+  } else {
+    normalized = { subject: String(profile.id), email: profile.email, name: profile.name || profile.login };
+  }
 
   const result = await identity.provisionOAuthUser({
     provider,
@@ -354,10 +438,13 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
     email: normalized.email,
     displayName: normalized.name,
   });
+  await adapter.logAuthEvent({
+    userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
+  });
 
-  const redirectTo = saved.redirect_to || '/dashboard/cms';
+  const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  const globeUrl = `${url.origin}${loginPath()}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {
     status: 302,
     headers: {

package/packages/identity/tests/finalize-inbound-oauth.test.mjs

@@ -99,16 +99,16 @@ test('createFinalizeInboundOAuth fails closed when identity plane fails for new
   assert.deepEqual(result, { ok: false, error: 'provision_failed' });
 });
 
-test('createOAuthRedirectHelpers blocks integrations return path', () => {
-  const { safeDashboardLoginRedirectPath } = createOAuthRedirectHelpers({
+test('createOAuthRedirectHelpers rejects disallowed return paths', () => {
+  const { safeLoginRedirectPath } = createOAuthRedirectHelpers({
+    loginPath: '/auth/login',
     isAllowedLoginResumePath: (p) => p.startsWith('/mcp-oauth'),
   });
-  assert.equal(
-    safeDashboardLoginRedirectPath('https://inneranimalmedia.com', '/dashboard/settings/integrations'),
-    '/dashboard/agent',
+  assert.throws(
+    () => safeLoginRedirectPath('https://inneranimalmedia.com', '/dashboard/settings/integrations'),
   );
   assert.equal(
-    safeDashboardLoginRedirectPath('https://inneranimalmedia.com', '/mcp-oauth/resume'),
+    safeLoginRedirectPath('https://inneranimalmedia.com', '/mcp-oauth/resume'),
     '/mcp-oauth/resume',
   );
 });

package/packages/identity/tests/iam-provider.test.mjs

@@ -16,7 +16,7 @@ describe('iam identity provider', () => {
       getIamAuthUrl({
         issuer: 'https://inneranimalmedia.com',
         clientId: 'iam_identity_test',
-        redirectUri: 'https://legendary.example/api/oauth/iam/callback',
+        redirectUri: 'https://legendary.example/api/oauth/inneranimalmedia/callback',
         state: 'st_test',
         codeChallenge: 'challenge',
         scope: IAM_DEFAULT_OIDC_SCOPE,

package/packages/identity/tests/identity-service.test.mjs

@@ -1,7 +1,29 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
+import { IDENTITY_ROUTE_IDS } from '../src/contracts/route-ids.js';
+import {
+  createRouteRegistry,
+  defineRouteProjection,
+} from '../src/contracts/route-projection.js';
 import { createIdentityService } from '../src/server/identity-service.js';
 
+function createTestRouting() {
+  const app = { id: 'identity-test-app' };
+  const routeRegistry = createRouteRegistry([
+    defineRouteProjection({
+      appId: app.id,
+      routes: {
+        [IDENTITY_ROUTE_IDS.LOGIN]: '/auth/login',
+        [IDENTITY_ROUTE_IDS.RECOVERY]: '/auth/reset',
+        [IDENTITY_ROUTE_IDS.APP_AUTHENTICATED]: '/agentsam',
+        [IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]: '/api/oauth/:provider/callback',
+        'app.mount./projects': { path: '/projects', auth: 'required' },
+      },
+    }),
+  ]);
+  return { app, routeRegistry };
+}
+
 function createMemoryAdapter() {
   const users = new Map();
   const sessions = new Map();
@@ -66,8 +88,32 @@ function createMemoryAdapter() {
 }
 
 describe('identity service', () => {
+  it('owns its projected fallback and rejects external OAuth return targets', () => {
+    const { app, routeRegistry } = createTestRouting();
+    const identity = createIdentityService({
+      adapter: createMemoryAdapter(),
+      app,
+      routeRegistry,
+    });
+
+    assert.equal(identity.resolvePostLoginPath('/projects?tab=recent'), '/projects?tab=recent');
+    assert.equal(identity.resolvePostLoginPath('https://attacker.example/'), '/agentsam');
+    assert.equal(identity.resolvePostLoginPath('//attacker.example/'), '/agentsam');
+    assert.equal(identity.resolvePostLoginPath(null), '/agentsam');
+
+    assert.throws(
+      () => createIdentityService({ adapter: createMemoryAdapter() }),
+      (error) => error?.code === 'AUTH_APP_UNRESOLVED',
+    );
+  });
+
   it('signup and login issue session', async () => {
-    const identity = createIdentityService({ adapter: createMemoryAdapter() });
+    const { app, routeRegistry } = createTestRouting();
+    const identity = createIdentityService({
+      adapter: createMemoryAdapter(),
+      app,
+      routeRegistry,
+    });
     const signup = await identity.signup({
       email: 'user@example.com',
       password: 'secret-pass',

package/packages/identity/tests/oauth-credentials.test.mjs

@@ -42,8 +42,10 @@ describe('oauth credentials', () => {
     const lane = resolveOAuthCredentialLane(env, 'google');
     assert.equal(lane?.lane, 'byok_google');
     assert.equal(lane?.clientId, 'google-byok');
-    // IAM start path still resolves IAM
+    // IAM / inneranimalmedia start path still resolves platform lane
     assert.equal(resolveOAuthCredentialLane(env, 'iam')?.lane, 'iam_platform');
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.provider, 'inneranimalmedia');
+    assert.equal(resolveOAuthCredentialLane(env, 'inneranimalmedia')?.lane, 'iam_platform');
   });
 
   it('prefers IAM_OAUTH_ISSUER and exposes issuer as the canonical authority', () => {