@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.4

package/packages/identity/migrations/sqlite/001_identity_core.sql

@@ -0,0 +1,99 @@
+-- identity.core — portable local SQLite (no Cloudflare / IAM required)
+-- Timestamps: INTEGER unixepoch seconds
+
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS identity_schema_meta (
+  key TEXT PRIMARY KEY NOT NULL,
+  value TEXT NOT NULL
+);
+
+INSERT OR REPLACE INTO identity_schema_meta (key, value)
+VALUES ('schema_version', '1');
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_core', '1');
+
+CREATE TABLE IF NOT EXISTS identity_users (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  password_hash TEXT,
+  salt TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_users_email
+  ON identity_users(email);
+
+CREATE TABLE IF NOT EXISTS identity_external_accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  provider_subject TEXT NOT NULL,
+  email TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_external_provider_subject
+  ON identity_external_accounts(provider, provider_subject);
+
+CREATE TABLE IF NOT EXISTS identity_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  email TEXT,
+  provider TEXT,
+  provider_subject TEXT,
+  display_name TEXT,
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  last_active_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_sessions_user_expires
+  ON identity_sessions(user_id, expires_at);
+
+CREATE TABLE IF NOT EXISTS identity_auth_events (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT,
+  event_type TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'ok',
+  provider TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  ip_hash TEXT,
+  user_agent_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_auth_events_user_created
+  ON identity_auth_events(user_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS identity_app_registry (
+  id TEXT PRIMARY KEY NOT NULL,
+  package_name TEXT,
+  manifest_version TEXT,
+  display_name TEXT,
+  authenticated_route_id TEXT NOT NULL,
+  login_route_id TEXT NOT NULL,
+  recovery_route_id TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  installed_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_route_registry (
+  app_id TEXT NOT NULL,
+  route_id TEXT NOT NULL,
+  path_pattern TEXT NOT NULL,
+  runtime TEXT,
+  auth_policy TEXT,
+  shell_ref TEXT,
+  PRIMARY KEY (app_id, route_id),
+  FOREIGN KEY (app_id) REFERENCES identity_app_registry(id)
+);

package/packages/identity/migrations/sqlite/002_identity_oauth_client.sql

@@ -0,0 +1,38 @@
+-- identity.oauth-client — outbound OAuth (sign in with Google/CF/GitHub/IAM)
+-- Secrets/tokens live in the local encrypted vault; this pack stores refs + metadata.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_client', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_transactions (
+  state TEXT PRIMARY KEY NOT NULL,
+  provider TEXT NOT NULL,
+  code_verifier TEXT NOT NULL,
+  return_to TEXT,
+  app_id TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_transactions_expires
+  ON identity_oauth_transactions(expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_transactions_app
+  ON identity_oauth_transactions(app_id);
+
+CREATE TABLE IF NOT EXISTS identity_provider_connections (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  granted_scopes_json TEXT NOT NULL DEFAULT '[]',
+  credential_ref TEXT NOT NULL,
+  expires_at INTEGER,
+  refreshable INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_provider_connections_user_provider
+  ON identity_provider_connections(user_id, provider);

package/packages/identity/migrations/sqlite/003_identity_oauth_server.sql

@@ -0,0 +1,64 @@
+-- identity.oauth-server — OPTIONAL pack for products that issue their own
+-- client IDs, authorization codes, access tokens, and refresh tokens.
+-- Do not apply unless the installed product is an OAuth authorization server.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_server', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_clients (
+  id TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL UNIQUE,
+  client_secret_hash TEXT,
+  name TEXT NOT NULL,
+  redirect_uris_json TEXT NOT NULL DEFAULT '[]',
+  grant_types_json TEXT NOT NULL DEFAULT '["authorization_code"]',
+  token_endpoint_auth_method TEXT NOT NULL DEFAULT 'none',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_authorization_codes (
+  code_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_access_tokens (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_refresh_tokens (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_grants (
+  id TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  created_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);

package/packages/identity/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.3",
+  "version": "2.6.4",
   "private": true,
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -1,7 +1,10 @@
+import { SESSION_POLICY } from '../../core/constants.js';
+import { IdentitySchemaError } from '../../contracts/identity-store.js';
+import { IDENTITY_STORE_SCHEMA_VERSION } from '../../contracts/identity-store.js';
 import { newAccountIdentityId, newAuthUserId, newSessionId, newAuthEventId, nowUnix } from './ids.js';
-import { AUTH_SESSION_TTL_SECONDS } from '../../core/constants.js';
 import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '../../contracts/company.js';
 
+
 /**
  * @typedef {object} D1Database
  * @property {(sql: string) => { bind: (...args: unknown[]) => { first: () => Promise<unknown>, run: () => Promise<unknown>, all: () => Promise<{ results?: unknown[] }> } }} prepare
@@ -24,22 +27,45 @@ export function createCloudflareD1Adapter(db, options = {}) {
   if (!db?.prepare) {
     throw new Error('cloudflare_d1_adapter_requires_db_binding');
   }
-  const sessionTtlSeconds = options.sessionTtlSeconds ?? AUTH_SESSION_TTL_SECONDS;
+  const sessionTtlSeconds = options.sessionTtlSeconds ?? SESSION_POLICY.browser.ttlSeconds;
 
   return Object.freeze({
+    schemaVersion: IDENTITY_STORE_SCHEMA_VERSION,
     sessionTtlSeconds,
+    backend: 'cloudflare-d1',
 
     /**
      * Append-only login/logout/failed-attempt audit trail (auth_event_log).
-     * Never throws -- an observability write must not break a real auth flow.
-     * ip/userAgent are hashed (SHA-256) before storage, matching the
-     * ip_hash/user_agent_hash column names -- raw values are never persisted.
+     * Never throws — an observability write must not break a real auth flow.
+     * status remains the event outcome only ('ok' | 'failed').
+     * Richer context (session, capabilities, activity, client) goes in metadata_json.
+     * ip/userAgent are hashed (SHA-256) — raw values are never persisted.
      */
-    async logAuthEvent({ userId, eventType, status = 'ok', provider, metadata, request }) {
+    async logAuthEvent({
+      userId,
+      accountId,
+      eventType,
+      status = 'ok',
+      provider,
+      session,
+      capabilities,
+      activity,
+      client,
+      metadata,
+      request,
+    }) {
       try {
         const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
         const ua = request?.headers?.get?.('user-agent') || '';
         const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
+        const envelope = {
+          ...(metadata && typeof metadata === 'object' ? metadata : {}),
+          ...(accountId ? { accountId } : {}),
+          ...(session ? { session } : {}),
+          ...(capabilities ? { capabilities } : {}),
+          ...(activity ? { activity } : {}),
+          ...(client ? { client } : {}),
+        };
         await db.prepare(
           `INSERT INTO auth_event_log
            (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash)
@@ -50,7 +76,7 @@ export function createCloudflareD1Adapter(db, options = {}) {
           eventType,
           status,
           provider || null,
-          metadata ? JSON.stringify(metadata) : '{}',
+          JSON.stringify(envelope),
           ipHash,
           uaHash,
         ).run();
@@ -59,6 +85,34 @@ export function createCloudflareD1Adapter(db, options = {}) {
       }
     },
 
+    /**
+     * Account/session activity snapshot for auth receipts (not event outcome).
+     * @param {string} userId
+     */
+    async countAuthActivity(userId) {
+      if (!userId) {
+        return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
+      }
+      try {
+        const logins = await db.prepare(
+          `SELECT COUNT(*) AS c, MAX(created_at) AS last_at
+           FROM auth_event_log
+           WHERE user_id = ? AND event_type = 'login' AND status = 'ok'`,
+        ).bind(userId).first();
+        const sessions = await db.prepare(
+          `SELECT COUNT(*) AS c FROM auth_sessions
+           WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?`,
+        ).bind(userId, nowUnix()).first();
+        return {
+          loginCount: Number(logins?.c || 0),
+          activeSessionCount: Number(sessions?.c || 0),
+          lastLoginAt: logins?.last_at != null ? Number(logins.last_at) : null,
+        };
+      } catch {
+        return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
+      }
+    },
+
     async findUserByEmail(email) {
       const row = await db.prepare(
         `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
@@ -173,27 +227,73 @@ export function createCloudflareD1Adapter(db, options = {}) {
       return { ok: true, reason };
     },
 
-    async saveOAuthState({ state, provider, codeVerifier, redirectTo, ttlSeconds = 600 }) {
-      // Dedicated table, deliberately NOT named `oauth_states` -- that name collides
-      // with unrelated Stripe Connect state tracking in customer apps that reuse
-      // their inneranimalmedia D1 instance (id/user_id/provider_id/redirect_uri/
-      // scope schema, no default on primary key). See AgentSamRemix incident,
-      // 2026-08-29: D1_ERROR: table oauth_states has no column named state.
+    async createOAuthTransaction({ state, provider, codeVerifier, returnTo, redirectTo, appId, ttlSeconds = 600 }) {
+      if (!appId) {
+        throw new IdentitySchemaError(
+          'OAUTH_TRANSACTION_APP_ID_REQUIRED',
+          'OAuth transactions must include app_id',
+        );
+      }
       const ts = nowUnix();
-      await db.prepare(
-        `INSERT INTO identity_oauth_states (state, provider, code_verifier, redirect_to, expires_at, created_at)
-         VALUES (?, ?, ?, ?, ?, ?)`,
-      ).bind(state, provider, codeVerifier, redirectTo || null, ts + ttlSeconds, ts).run();
+      const expiresAt = ts + ttlSeconds;
+      try {
+        await db.prepare(
+          `INSERT INTO identity_oauth_states
+           (state, provider, code_verifier, redirect_to, app_id, expires_at, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        ).bind(state, provider, codeVerifier, returnTo ?? redirectTo ?? null, appId, expiresAt, ts).run();
+      } catch (err) {
+        throw new IdentitySchemaError(
+          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
+          'identity_oauth_states.app_id required — apply migration 0015 (no silent pre-app_id fallback)',
+          { cause: String(err?.message || err) },
+        );
+      }
     },
 
-    async consumeOAuthState(state) {
-      const row = await db.prepare(
-        `SELECT state, provider, code_verifier, redirect_to, expires_at FROM identity_oauth_states WHERE state = ? LIMIT 1`,
-      ).bind(state).first();
+    /** @deprecated Use createOAuthTransaction */
+    async saveOAuthState(input) {
+      return this.createOAuthTransaction(input);
+    },
+
+    async consumeOAuthTransaction(state) {
+      let row;
+      try {
+        row = await db.prepare(
+          `SELECT state, provider, code_verifier, redirect_to, app_id, expires_at, created_at
+           FROM identity_oauth_states WHERE state = ? LIMIT 1`,
+        ).bind(state).first();
+      } catch (err) {
+        throw new IdentitySchemaError(
+          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
+          'identity_oauth_states.app_id column missing — apply migration 0015',
+          { cause: String(err?.message || err) },
+        );
+      }
       if (!row) return null;
       await db.prepare(`DELETE FROM identity_oauth_states WHERE state = ?`).bind(state).run();
       if (row.expires_at <= nowUnix()) return null;
-      return row;
+      if (!row.app_id) {
+        throw new IdentitySchemaError(
+          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
+          'OAuth transaction missing app_id — refuse silent pre-app_id semantics',
+        );
+      }
+      return {
+        state: row.state,
+        provider: row.provider,
+        code_verifier: row.code_verifier,
+        redirect_to: row.redirect_to,
+        return_to: row.redirect_to,
+        app_id: row.app_id,
+        expires_at: row.expires_at,
+        created_at: row.created_at,
+      };
+    },
+
+    /** @deprecated Use consumeOAuthTransaction */
+    async consumeOAuthState(state) {
+      return this.consumeOAuthTransaction(state);
     },
 
     async getCompanyBySlug(slug = DEFAULT_COMPANY_SLUG) {