@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.4

package/packages/identity/src/contracts/route-projection.js

@@ -0,0 +1,218 @@
+/**
+ * Host/app HTTP projection of semantic identity route IDs.
+ * Identity core never hardcodes /auth/login, /agentsam, etc.
+ */
+
+import { IDENTITY_ROUTE_IDS, REQUIRED_AUTH_ROUTE_IDS } from './route-ids.js';
+import { IdentityRoutingError } from './identity-store.js';
+import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+
+/**
+ * @typedef {{ path: string, auth?: 'required'|'optional'|'public', spa?: boolean, shell?: string, pattern?: string }} RouteProjection
+ * @typedef {Record<string, string|RouteProjection>} RouteProjectionMap
+ */
+
+/**
+ * @param {{ appId: string, routes: RouteProjectionMap }} input
+ */
+export function defineRouteProjection(input) {
+  const appId = String(input?.appId || '').trim();
+  if (!appId) throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', 'defineRouteProjection requires appId');
+  /** @type {Map<string, RouteProjection>} */
+  const routes = new Map();
+  for (const [routeId, value] of Object.entries(input.routes || {})) {
+    const path = typeof value === 'string' ? value : value?.path;
+    if (!path || !String(path).startsWith('/')) {
+      throw new IdentityRoutingError('AUTH_ROUTE_PROJECTION_INVALID', `Invalid path for ${routeId}`, { appId, routeId });
+    }
+    routes.set(routeId, Object.freeze({
+      path: String(path),
+      auth: typeof value === 'object' ? value.auth : undefined,
+      spa: typeof value === 'object' ? value.spa : undefined,
+      shell: typeof value === 'object' ? value.shell : undefined,
+      pattern: typeof value === 'object' ? value.pattern : undefined,
+    }));
+  }
+  return Object.freeze({ appId, routes });
+}
+
+/**
+ * @param {ReturnType<typeof defineRouteProjection>[]} projections
+ */
+export function createRouteRegistry(projections = []) {
+  /** @type {Map<string, ReturnType<typeof defineRouteProjection>>} */
+  const byApp = new Map();
+  for (const p of projections) {
+    if (!p?.appId) continue;
+    byApp.set(p.appId, p);
+  }
+
+  return Object.freeze({
+    get(appId) {
+      return byApp.get(String(appId || '')) || null;
+    },
+
+    /**
+     * @param {string} appId
+     * @param {string} routeId
+     * @returns {string|null}
+     */
+    resolve(appId, routeId) {
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) return null;
+      const entry = proj.routes.get(routeId);
+      return entry?.path || null;
+    },
+
+    /**
+     * Expand parameterized patterns, e.g. /api/oauth/:provider/callback
+     * @param {string} appId
+     * @param {string} routeId
+     * @param {Record<string, string>} params
+     */
+    resolvePath(appId, routeId, params = {}) {
+      const pattern = this.resolve(appId, routeId);
+      if (!pattern) return null;
+      return pattern.replace(/:([A-Za-z_][A-Za-z0-9_]*)/g, (_, key) => {
+        const v = params[key];
+        if (v == null || v === '') {
+          throw new IdentityRoutingError('AUTH_ROUTE_PARAM_MISSING', `Missing :${key} for ${routeId}`, { appId, routeId });
+        }
+        return encodeURIComponent(String(v));
+      });
+    },
+
+    /**
+     * return_to must be same-origin relative and owned by this app's projected mounts/paths.
+     * @param {{ appId: string, value?: string|null }} opts
+     */
+    resolveReturnTo({ appId, value }) {
+      const cleaned = sanitizeBrowserNextPath(value);
+      if (!cleaned) return null;
+      const pathname = cleaned.split('?')[0];
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) return null;
+
+      const authenticated = proj.routes.get(IDENTITY_ROUTE_IDS.APP_AUTHENTICATED)?.path
+        || proj.routes.get(IDENTITY_ROUTE_IDS.APP_HOME)?.path;
+      if (authenticated && (pathname === authenticated || pathname.startsWith(`${authenticated}/`))) {
+        return cleaned;
+      }
+
+      for (const [routeId, entry] of proj.routes) {
+        if (routeId.startsWith('identity.')) continue;
+        const base = entry.path.replace(/:[^/]+/g, ''); // strip params for prefix mounts
+        const mount = base.replace(/\/$/, '') || entry.path;
+        if (pathname === mount || pathname.startsWith(`${mount}/`)) return cleaned;
+        // Explicit mount keys: app.mount./projects style — also accept path values with auth required
+        if (entry.auth === 'required' && (pathname === entry.path || pathname.startsWith(`${entry.path}/`))) {
+          return cleaned;
+        }
+      }
+      return null;
+    },
+
+    /**
+     * Fail closed if auth-capable app is missing required semantic projections.
+     * @param {string} appId
+     */
+    assertAuthCapable(appId) {
+      const proj = byApp.get(String(appId || ''));
+      if (!proj) {
+        throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', `No route projection for app ${appId}`, { appId });
+      }
+      for (const routeId of REQUIRED_AUTH_ROUTE_IDS) {
+        if (!proj.routes.has(routeId)) {
+          throw new IdentityRoutingError(
+            'AUTH_ROUTE_MISSING',
+            `App ${appId} missing required route projection ${routeId}`,
+            { appId, routeId },
+          );
+        }
+      }
+      return proj;
+    },
+  });
+}
+
+/**
+ * Build a projection map from an agentsam.app.v1 auth+routes manifest section.
+ * @param {object} manifest
+ */
+export function projectionFromAppManifest(manifest) {
+  const appId = String(manifest?.id || '').trim();
+  if (!appId) throw new IdentityRoutingError('AUTH_APP_UNRESOLVED', 'manifest.id required');
+
+  /** @type {RouteProjectionMap} */
+  const routes = {};
+
+  const rawRoutes = manifest.routes || {};
+  for (const [routeId, value] of Object.entries(rawRoutes)) {
+    if (routeId === 'entry' || routeId === 'mounts' || routeId === 'paths') continue;
+    routes[routeId] = value;
+  }
+  for (const [routeId, value] of Object.entries(rawRoutes.paths || {})) {
+    routes[routeId] = value;
+  }
+
+  const auth = manifest.auth || {};
+  const entry = auth.entry || {};
+
+  function pathFor(ref, legacyPath) {
+    if (legacyPath) return legacyPath;
+    if (!ref) return null;
+    if (typeof ref === 'string' && ref.startsWith('/')) return ref;
+    if (typeof ref === 'string' && routes[ref]) {
+      const v = routes[ref];
+      return typeof v === 'string' ? v : v.path;
+    }
+    return null;
+  }
+
+  const authenticatedPath = pathFor(
+    entry.authenticated || IDENTITY_ROUTE_IDS.APP_AUTHENTICATED,
+    typeof rawRoutes.entry === 'string' ? rawRoutes.entry : null,
+  );
+  const loginPath = pathFor(entry.login || IDENTITY_ROUTE_IDS.LOGIN, null);
+  const failurePath = pathFor(
+    entry.failure || IDENTITY_ROUTE_IDS.RECOVERY || IDENTITY_ROUTE_IDS.LOGIN,
+    loginPath,
+  );
+
+  if (authenticatedPath) {
+    routes[IDENTITY_ROUTE_IDS.APP_AUTHENTICATED] = {
+      path: authenticatedPath,
+      auth: 'required',
+      spa: true,
+      shell: manifest.runtime?.shell
+        ? `${manifest.runtime.assetRoot || 'dist'}/${manifest.runtime.shell}`.replace(/\/{2,}/g, '/')
+        : undefined,
+    };
+    routes[IDENTITY_ROUTE_IDS.APP_HOME] = authenticatedPath;
+  }
+  if (loginPath) routes[IDENTITY_ROUTE_IDS.LOGIN] = loginPath;
+  if (failurePath) routes[IDENTITY_ROUTE_IDS.RECOVERY] = failurePath;
+
+  for (const mount of rawRoutes.mounts || []) {
+    if (!mount?.path) continue;
+    routes[`app.mount.${mount.path}`] = {
+      path: mount.path,
+      auth: mount.auth || 'required',
+      spa: mount.spa,
+      shell: mount.shell,
+    };
+  }
+
+  if (auth.oauth?.callbackPattern) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK] = auth.oauth.callbackPattern;
+  } else if (!routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK]) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_CALLBACK] = '/api/oauth/:provider/callback';
+  }
+  if (auth.oauth?.startPattern) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_START] = auth.oauth.startPattern;
+  } else if (!routes[IDENTITY_ROUTE_IDS.OAUTH_START]) {
+    routes[IDENTITY_ROUTE_IDS.OAUTH_START] = '/api/oauth/:provider/start';
+  }
+
+  return defineRouteProjection({ appId, routes });
+}

package/packages/identity/src/contracts/routes.js

@@ -0,0 +1,11 @@
+/**
+ * Portable identity = semantic route IDs only.
+ * Concrete paths live in host defineRouteProjection / agentsam.app.json.
+ */
+
+export { IDENTITY_ROUTE_IDS, REQUIRED_AUTH_ROUTE_IDS } from './route-ids.js';
+export {
+  defineRouteProjection,
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from './route-projection.js';

package/packages/identity/src/core/browser-paths.js

@@ -1,4 +1,7 @@
-import { AUTH_LOGIN_PATH, AUTH_SIGNUP_PATH } from './constants.js';
+/**
+ * Same-origin relative path sanitizer — no product-path rewriting.
+ * Alias normalization (/login → identity.login projection) is a host concern.
+ */
 
 export function sanitizeBrowserNextPath(raw) {
   if (raw == null) return null;
@@ -13,10 +16,6 @@ export function sanitizeBrowserNextPath(raw) {
     pathname = s.slice(0, q);
     search = s.slice(q);
   }
-  const lower = pathname.toLowerCase();
-  if (lower === '/login' || lower === '/auth/signin') pathname = AUTH_LOGIN_PATH;
-  else if (lower === '/signup' || lower === '/auth/register') pathname = AUTH_SIGNUP_PATH;
-
   return pathname + search;
 }
 

package/packages/identity/src/core/constants.js

@@ -1,9 +1,14 @@
-/** SDK-portable session/auth path constants. */
+/**
+ * Cookie name + session policy re-exports.
+ * Route vocabulary → contracts/routes.js (identity endpoints only).
+ * Product homes / mounts → each app's agentsam.app.json (not this package).
+ */
+
+import { SESSION_POLICY } from './session-policy.js';
+
+export { SESSION_POLICY, clampAgentSessionTtl } from './session-policy.js';
+
 export const AUTH_COOKIE_NAME = 'session';
-export const AUTH_SESSION_TTL_SECONDS = 30 * 24 * 60 * 60;
-export const MIN_AGENT_SESSION_TTL_SECONDS = 60;
-export const MAX_AGENT_SESSION_TTL_SECONDS = 86400;
-export const DEFAULT_AGENT_SESSION_TTL_SECONDS = 900;
-export const AUTH_LOGIN_PATH = '/auth/login';
-export const AUTH_SIGNUP_PATH = '/auth/signup';
-export const DASHBOARD_AFTER_LOGIN_PATH = '/dashboard/cms';
+
+/** @deprecated Prefer SESSION_POLICY.browser.ttlSeconds */
+export const AUTH_SESSION_TTL_SECONDS = SESSION_POLICY.browser.ttlSeconds;

package/packages/identity/src/core/session-policy.js

@@ -0,0 +1,32 @@
+/**
+ * Session policy — three concerns stay separate:
+ *   browser  = normal logged-in account session (cookie / auth_sessions)
+ *   agent    = short-lived delegated/runtime grant (execution, terminal, sandbox)
+ *
+ * Product routing does not live here.
+ */
+
+export const SESSION_POLICY = Object.freeze({
+  browser: Object.freeze({
+    ttlSeconds: 30 * 24 * 60 * 60,
+  }),
+  /** Temporary execution authority — not the user's Local Studio login. */
+  agent: Object.freeze({
+    minTtlSeconds: 60,
+    defaultTtlSeconds: 15 * 60,
+    maxTtlSeconds: 24 * 60 * 60,
+  }),
+});
+
+/**
+ * Clamp a requested agent/runtime grant TTL into policy bounds.
+ * @param {number|null|undefined} requestedSeconds
+ */
+export function clampAgentSessionTtl(requestedSeconds) {
+  const n = Number(requestedSeconds);
+  if (!Number.isFinite(n) || n <= 0) return SESSION_POLICY.agent.defaultTtlSeconds;
+  return Math.min(
+    SESSION_POLICY.agent.maxTtlSeconds,
+    Math.max(SESSION_POLICY.agent.minTtlSeconds, Math.floor(n)),
+  );
+}

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -404,15 +404,15 @@
         <button type="submit" id="submitBtn" class="btn-primary">Connect</button>
 
         <div class="oauth-stack">
-            <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/dashboard/agent" class="btn-primary" style="background: #ffffff; color: #1E293B; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/" class="btn-primary" style="background: #ffffff; color: #1E293B; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
                 Sign in with Google
             </a>
-            <a id="githubSignIn" href="/api/oauth/github/start?next=/dashboard/agent" class="btn-primary" style="background: rgba(255,255,255,0.1); color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="githubSignIn" href="/api/oauth/github/start?next=/" class="btn-primary" style="background: rgba(255,255,255,0.1); color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
                 Sign in with GitHub
             </a>
-            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start?next=/dashboard/agent" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
+            <a id="cloudflareSignIn" href="/api/oauth/cloudflare/start" class="btn-primary" style="background: #F6821F; color: white; text-decoration: none; padding: 12px 24px; border-radius: 10px; font-weight: 600; font-size: 14px; border: 1px solid rgba(255,255,255,0.2); box-shadow: 0 4px 12px rgba(0,0,0,0.1); display: flex; align-items: center; justify-content: center; gap: 8px;">
                 Sign in with Cloudflare
             </a>
         </div>
@@ -466,13 +466,13 @@
     var flow = qs.get('flow');
     var challenge = qs.get('challenge');
     var nextParam = qs.get('next');
-    var oauthDest = '/dashboard/agent';
+    // No product-home default here — host bounce supplies ?next=; otherwise
+    // the Worker resolves against the app manifest entry after auth.
+    var oauthDest = '/';
     if (flow === 'oauth' && challenge && challenge.indexOf('olc_') === 0) {
         oauthDest = '/api/oauth/login-challenge/resume?challenge=' + encodeURIComponent(challenge);
     } else if (nextParam && nextParam.startsWith('/') && !nextParam.startsWith('//')) {
-        if (nextParam.indexOf('/dashboard/settings/integrations') !== 0) {
-            oauthDest = nextParam;
-        }
+        oauthDest = nextParam;
     }
     var googleLink = document.getElementById('googleSignIn');
     if (googleLink) {
@@ -571,7 +571,7 @@
             if (res.ok && data.ok) {
                 btn.textContent = 'Success';
                 btn.style.background = '#10B981';
-                var redirectUrl = data.redirect || '/dashboard/agent';
+                var redirectUrl = data.redirect || '/';
                 if (typeof window.runGlobeExitTransition === 'function') {
                     window.runGlobeExitTransition(redirectUrl);
                 } else {
@@ -803,8 +803,8 @@
 (function() {
     var params = new URLSearchParams(window.location.search);
     if (params.get('globe_exit') !== '1') return;
-    var next = params.get('next') || '/dashboard/agent';
-    if (!next.startsWith('/') || next.startsWith('//')) next = '/dashboard/agent';
+    var next = params.get('next') || '/';
+    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
     document.body.classList.add('oauth-globe-exit');
     var tries = 0;
     var maxFrames = 180;

package/packages/identity/src/frontend/auth-portal/pages/reset.html

@@ -346,11 +346,11 @@
     </form>
 
     <div style="margin: 20px 0 0; width: 100%; text-align: center; display: flex; flex-direction: column; gap: 12px;">
-        <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/dashboard/agent" class="oauth-btn oauth-google">
+        <a id="googleSignIn" href="/api/oauth/google/start?login=1&return_to=/" class="oauth-btn oauth-google">
             <svg width="18" height="18" viewBox="0 0 24 24"><path fill="#4285F4" d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"/><path fill="#34A853" d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"/><path fill="#FBBC05" d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"/><path fill="#EA4335" d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"/></svg>
             Sign in with Google
         </a>
-        <a id="githubSignIn" href="/api/oauth/github/start?next=/dashboard/agent" class="oauth-btn oauth-github">
+        <a id="githubSignIn" href="/api/oauth/github/start?next=/" class="oauth-btn oauth-github">
             <svg width="18" height="18" viewBox="0 0 24 24" fill="currentColor"><path d="M12 0C5.37 0 0 5.37 0 12c0 5.31 3.43 9.8 8.2 11.38.6.11.82-.26.82-.58 0-.29-.01-1.06-.01-2.08-3.34.73-4.04-1.61-4.04-1.61-.55-1.39-1.34-1.76-1.34-1.76-1.09-.74.08-.73.08-.73 1.2.08 1.83 1.23 1.83 1.23 1.07 1.83 2.81 1.3 3.49.99.11-.78.42-1.3.76-1.6-2.67-.3-5.47-1.33-5.47-5.93 0-1.31.47-2.38 1.24-3.22-.12-.3-.54-1.52.12-3.18 0 0 1.01-.32 3.3 1.23a11.5 11.5 0 013-.41c1.02.01 2.05.14 3 .41 2.29-1.55 3.3-1.23 3.3-1.23.66 1.66.24 2.88.12 3.18.77.84 1.24 1.91 1.24 3.22 0 4.61-2.8 5.63-5.48 5.92.43.37.81 1.1.81 2.22 0 1.6-.01 2.89-.01 3.28 0 .32.21.69.83.57C20.57 21.79 24 17.3 24 12c0-6.63-5.37-12-12-12z"/></svg>
             Sign in with GitHub
         </a>
@@ -385,7 +385,7 @@
     var backLink = document.getElementById('backToLogin');
     if (backLink) backLink.href = loginHref;
 
-    var oauthDest = '/dashboard/agent';
+    var oauthDest = '/';
     if (nextParam && nextParam.startsWith('/') && !nextParam.startsWith('//')) {
         oauthDest = nextParam;
     }

package/packages/identity/src/frontend/auth-portal/pages/signup.html

@@ -582,7 +582,7 @@
                 }
                 btn.textContent = 'Success';
                 btn.style.background = '#10B981';
-                var redirectUrl = data.redirect || '/dashboard/overview';
+                var redirectUrl = data.redirect || '/';
                 if (typeof window.runGlobeExitTransition === 'function') {
                     window.runGlobeExitTransition(redirectUrl);
                 } else {
@@ -814,8 +814,8 @@
 (function() {
     var params = new URLSearchParams(window.location.search);
     if (params.get('globe_exit') !== '1') return;
-    var next = params.get('next') || '/dashboard/overview';
-    if (!next.startsWith('/') || next.startsWith('//')) next = '/dashboard/overview';
+    var next = params.get('next') || '/';
+    if (!next.startsWith('/') || next.startsWith('//')) next = '/';
     document.body.classList.add('oauth-globe-exit');
     var tries = 0;
     var maxFrames = 180;

package/packages/identity/src/frontend/auth-portal/preview/dashboard-stub.html

@@ -15,7 +15,7 @@
 <body>
   <main>
     <h1>Post-login (preview stub)</h1>
-    <p>In production you would land on <code>/dashboard/agent</code> (or your <code>next</code> URL) after OAuth or password sign-in.</p>
+    <p>In production you would land on <code>/</code> (or your <code>next</code> URL) after OAuth or password sign-in.</p>
     <p><a href="/auth/login">Back to sign in</a> · <a href="/">Preview hub</a></p>
   </main>
 </body>

package/packages/identity/src/index.js

@@ -44,6 +44,27 @@ export {
 
 export * from './core/index.js';
 export * from './core/constants.js';
+export {
+  IDENTITY_ROUTE_IDS,
+  REQUIRED_AUTH_ROUTE_IDS,
+  defineRouteProjection,
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from './contracts/routes.js';
+export {
+  IDENTITY_STORE_SCHEMA_VERSION,
+  IDENTITY_PACKS,
+  IdentityRoutingError,
+  IdentitySchemaError,
+} from './contracts/identity-store.js';
+export {
+  resolvePostAuthDestination,
+  beginLoginRedirect,
+  resolveMountForPath,
+  mountRequiresAuth,
+  pathMatchesMount,
+} from './server/post-auth.js';
+export { verifyAppAuthContract, verifyAppPackage } from './app/verify-app.js';
 export { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from './contracts/company.js';
 export * from './contracts/auth-config.js';
 export { createPasswordResetService } from './recovery/password-reset.js';
@@ -52,6 +73,10 @@ export {
   registerFinalizeInboundOAuth,
 } from './oauth/callback.js';
 export { createCloudflareD1Adapter } from './adapters/cloudflare-d1/index.js';
+export {
+  createSqliteIdentityAdapter,
+  applySqliteIdentityMigrations,
+} from './adapters/sqlite/index.js';
 export { createIdentityService } from './server/identity-service.js';
 export { handleIdentityWorkerRequest } from './server/worker-router.js';
 

package/packages/identity/src/oauth/README.md

@@ -21,12 +21,18 @@ npx wrangler secret put IAM_CLIENT_SECRET
 
 These routes live in the **customer** worker (`handleIdentityWorkerRequest`):
 
-1. `/api/oauth/iam/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
-2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else IAM if minted, else 503
+1. `/api/oauth/inneranimalmedia/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
+   - Legacy alias: `/api/oauth/iam/start`
+2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else platform lane if minted, else 503
 3. `/api/oauth/github/start` → same for GitHub
-4. Callback: `/api/oauth/iam/callback` (IAM lane) or `/api/oauth/{google|github}/callback` (BYOK)
+4. Callback: `/api/oauth/inneranimalmedia/callback` (platform lane) or `/api/oauth/{google|github|cloudflare}/callback` (BYOK)
+   - Legacy alias: `/api/oauth/iam/callback`
 
-Register IAM redirect URI: `https://<customer-host>/api/oauth/iam/callback`
+Register platform redirect URI on the IAM client:
+
+`https://<customer-host>/api/oauth/inneranimalmedia/callback`
+
+(Keep the legacy `/api/oauth/iam/callback` registered during migration.)
 
 ## IAM authorization server endpoints (issuer)
 

package/packages/identity/src/oauth/credentials.js

@@ -8,13 +8,17 @@ import { DEFAULT_IAM_ORIGIN, resolveIamOrigin } from '../contracts/auth-config.j
  *   — SECRET is wrangler secret put only (encryption is law, not luxury).
  *
  * Developer BYOK: GOOGLE_CLIENT_* / GITHUB_CLIENT_* when set for that provider
- * take the /api/oauth/{provider}/start button; otherwise the button uses IAM.
+ * take the /api/oauth/{provider}/start button; otherwise the button uses the
+ * Inner Animal Media platform lane (`inneranimalmedia`).
  */
 
 /** @deprecated Use DEFAULT_IAM_ORIGIN from the auth configuration contract. */
 export const DEFAULT_IAM_OAUTH_ISSUER = DEFAULT_IAM_ORIGIN;
 export const IAM_PLATFORM_STATE_PROVIDER = 'iam_platform';
-export const IAM_PLATFORM_CALLBACK_PATH = '/api/oauth/iam/callback';
+/** Canonical platform OAuth callback (protocol id = inneranimalmedia). */
+export const IAM_PLATFORM_CALLBACK_PATH = '/api/oauth/inneranimalmedia/callback';
+/** @deprecated Legacy path — still accepted; prefer IAM_PLATFORM_CALLBACK_PATH. */
+export const IAM_PLATFORM_CALLBACK_PATH_LEGACY = '/api/oauth/iam/callback';
 
 /**
  * @param {Record<string, unknown> | null | undefined} env
@@ -42,9 +46,9 @@ export function requireIamPlatformCredentials(env) {
 
 /**
  * @param {Record<string, unknown> | null | undefined} env
- * @param {'google' | 'github' | 'iam'} provider
+ * @param {'google' | 'github' | 'cloudflare' | 'inneranimalmedia' | 'iam'} provider
  * @returns {{
- *   lane: 'iam_platform' | 'byok_google' | 'byok_github',
+ *   lane: 'iam_platform' | 'byok_google' | 'byok_github' | 'byok_cloudflare',
  *   clientId: string,
  *   clientSecret: string,
  *   origin?: string,
@@ -53,7 +57,10 @@ export function requireIamPlatformCredentials(env) {
  * } | null}
  */
 export function resolveOAuthCredentialLane(env, provider) {
-  if (provider === 'iam') {
+  const key = String(provider || '').trim().toLowerCase();
+
+  // Protocol/selection id is inneranimalmedia; `iam` remains a legacy alias.
+  if (key === 'inneranimalmedia' || key === 'iam') {
     const iam = resolveIamPlatformCredentials(env);
     if (!iam) return null;
     return {
@@ -62,27 +69,27 @@ export function resolveOAuthCredentialLane(env, provider) {
       clientSecret: iam.clientSecret,
       origin: iam.origin,
       issuer: iam.issuer,
-      provider: 'iam',
+      provider: 'inneranimalmedia',
     };
   }
 
-  if (provider === 'google') {
+  if (key === 'google') {
     const clientId = String(env?.GOOGLE_CLIENT_ID || '').trim();
     const clientSecret = String(env?.GOOGLE_CLIENT_SECRET || '').trim();
     if (clientId && clientSecret) {
-      return { lane: 'byok_google', clientId, clientSecret, provider };
+      return { lane: 'byok_google', clientId, clientSecret, provider: 'google' };
     }
   }
 
-  if (provider === 'github') {
+  if (key === 'github') {
     const clientId = String(env?.GITHUB_CLIENT_ID || '').trim();
     const clientSecret = String(env?.GITHUB_CLIENT_SECRET || '').trim();
     if (clientId && clientSecret) {
-      return { lane: 'byok_github', clientId, clientSecret, provider };
+      return { lane: 'byok_github', clientId, clientSecret, provider: 'github' };
     }
   }
 
-  if (provider === 'cloudflare') {
+  if (key === 'cloudflare') {
     // Reuses the same Worker secrets as the Local Studio Cloudflare resource
     // connector (packages/connectors/cloudflare). clientSecret may be empty
     // if that client is configured as PKCE-only (Token Authentication
@@ -90,7 +97,7 @@ export function resolveOAuthCredentialLane(env, provider) {
     const clientId = String(env?.CLOUDFLARE_OAUTH_CLIENT_ID || '').trim();
     const clientSecret = String(env?.CLOUDFLARE_OAUTH_CLIENT_SECRET || '').trim();
     if (clientId) {
-      return { lane: 'byok_cloudflare', clientId, clientSecret, provider };
+      return { lane: 'byok_cloudflare', clientId, clientSecret, provider: 'cloudflare' };
     }
     return null;
   }
@@ -104,7 +111,7 @@ export function resolveOAuthCredentialLane(env, provider) {
       clientSecret: iam.clientSecret,
       origin: iam.origin,
       issuer: iam.issuer,
-      provider,
+      provider: 'inneranimalmedia',
     };
   }
 

package/packages/identity/src/oauth/finalize-inbound.js

@@ -51,7 +51,7 @@ export function createFinalizeInboundOAuth(ports) {
         ? String(input.supabaseUserId).trim()
         : null;
     const source = String(input?.source || `${provider}_oauth`).trim();
-    const pageContext = String(input?.pageContext || '/dashboard/agent').trim();
+    const pageContext = String(input?.pageContext || '/').trim();
 
     if (!ports.hasDatabase(env) || !oauthEmail || !provider || !providerUid) {
       return /** @type {InboundOAuthFailure} */ ({ ok: false, error: 'provision_failed' });

package/packages/identity/src/oauth/iam-platform.js

@@ -1,4 +1,4 @@
-import { AUTH_LOGIN_PATH } from '../core/constants.js';
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
 import {
   IAM_PLATFORM_CALLBACK_PATH,
   IAM_PLATFORM_STATE_PROVIDER,
@@ -38,6 +38,7 @@ export async function iamPlatformOAuthStart(request, env, adapter, identity) {
     provider: IAM_PLATFORM_STATE_PROVIDER,
     codeVerifier,
     redirectTo,
+    appId: identity?.app?.id || null,
   });
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -67,15 +68,15 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
   const err = url.searchParams.get('error');
 
   if (err || !code || !state) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=oauth_failed`, 302);
   }
   if (!creds) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=iam_oauth_not_configured`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=iam_oauth_not_configured`, 302);
   }
 
   const saved = await adapter.consumeOAuthState(state);
   if (!saved || saved.provider !== IAM_PLATFORM_STATE_PROVIDER) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=state_mismatch`, 302);
   }
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -88,7 +89,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     redirectUri,
   });
   if (!token?.access_token) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=token_exchange_failed`, 302);
   }
 
   const profile = await fetchIamProfile({
@@ -97,7 +98,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
   });
   const normalized = profile ? normalizeIamIdentity(profile) : null;
   if (!normalized?.subject || !normalized?.email) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=userinfo_failed`, 302);
   }
 
   const result = await identity.provisionOAuthUser({
@@ -109,7 +110,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
 
   const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  const globeUrl = `${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {
     status: 302,
     headers: {