@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/connectors/cloudflare/tests/connector.test.mjs

@@ -52,40 +52,60 @@ describe('cloudflare connector', () => {
   });
 
   it('keeps connector return paths same-origin', async () => {
-    const calls = [];
-    const DB = {
-      prepare(sql) {
-        return {
-          args: [],
-          bind(...args) { this.args = args; return this; },
-          async run() { calls.push({ sql, args: this.args }); return { success: true }; },
-        };
-      },
-    };
+    const oauthState = new Map();
     const response = await handleCloudflareConnectionRequest(
       new Request('https://agentsam.example/api/connections/cloudflare/start?return_to=https://untrusted.example/after', {
-        headers: { authorization: 'Bearer fixture' },
+        headers: {
+          authorization: 'Bearer fixture',
+          accept: 'application/json',
+        },
       }),
       {
-        DB,
+        oauthState,
         fixtureSessions: new Map([['fixture', 'user_123']]),
         CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
       },
     );
     assert.equal(response.status, 200);
-    assert.equal(
-      calls.some((call) => call.sql.includes('DELETE FROM agentsam_cloudflare_oauth_state WHERE created_at < unixepoch() - 600')),
-      true,
+    const body = await response.json();
+    assert.equal(body.ok, true);
+    assert.equal(oauthState.size, 1);
+    const stored = [...oauthState.values()][0];
+    assert.equal(stored.returnTo, '');
+  });
+
+  it('redirects browser starts to Cloudflare authorization', async () => {
+    const oauthState = new Map();
+    const response = await handleCloudflareConnectionRequest(
+      new Request('https://agentsam.example/api/connections/cloudflare/start', {
+        headers: { authorization: 'Bearer fixture' },
+      }),
+      {
+        fixtureSessions: new Map([['fixture', 'user_123']]),
+        oauthState,
+        CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
+      },
     );
-    const stateInsert = calls.find((call) => call.sql.includes('INSERT INTO agentsam_cloudflare_oauth_state'));
-    assert.ok(stateInsert);
-    assert.equal(stateInsert.args.at(-1), null);
+
+    assert.equal(response.status, 302);
+    const location = new URL(response.headers.get('location'));
+    assert.equal(location.origin, 'https://dash.cloudflare.com');
+    assert.equal(location.pathname, '/oauth2/auth');
+    assert.equal(location.searchParams.get('client_id'), 'real-client-id');
+    assert.equal(location.searchParams.get('redirect_uri'), 'https://agentsam.example/api/connections/cloudflare/callback');
+    assert.equal(oauthState.size, 1);
   });
 
   it('consumes callback state and stores only encrypted OAuth tokens', async () => {
-    const now = Math.floor(Date.now() / 1000);
     const calls = [];
-    const statements = [];
+    const oauthState = new Map([
+      ['state_123', {
+        ownerId: 'user_123',
+        verifier: 'verifier',
+        returnTo: '',
+        createdAt: Math.floor(Date.now() / 1000),
+      }],
+    ]);
     const DB = {
       prepare(sql) {
         const statement = {
@@ -96,9 +116,6 @@ describe('cloudflare connector', () => {
             return this;
           },
           async first() {
-            if (sql.includes('agentsam_cloudflare_oauth_state')) {
-              return { owner_id: 'user_123', code_verifier: 'verifier', created_at: now };
-            }
             return null;
           },
           async run() {
@@ -106,7 +123,6 @@ describe('cloudflare connector', () => {
             return { success: true };
           },
         };
-        statements.push(statement);
         return statement;
       },
       async batch(batchStatements) {
@@ -121,7 +137,7 @@ describe('cloudflare connector', () => {
       return new Response(JSON.stringify({
         access_token: 'access-plaintext',
         refresh_token: 'refresh-plaintext',
-        account_id: 'account_123',
+        account_id: 'abc123abc123abc123abc123abc123ab',
         scope: 'd1.read workers-scripts.write',
         expires_in: 3600,
       }), { status: 200, headers: { 'content-type': 'application/json' } });
@@ -132,6 +148,7 @@ describe('cloudflare connector', () => {
         new Request('https://agentsam.example/api/connections/cloudflare/callback?code=code_123&state=state_123'),
         {
           DB,
+          oauthState,
           CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
           CLOUDFLARE_OAUTH_CLIENT_SECRET: 'obsolete-secret-must-not-be-sent',
           VAULT_MASTER_KEY: '01234567890123456789012345678901',
@@ -142,11 +159,15 @@ describe('cloudflare connector', () => {
         response.headers.get('location'),
         'https://agentsam.example/settings/integrations?connection=cloudflare&result=connected',
       );
-      assert.equal(calls.some((call) => call.sql.includes('DELETE FROM agentsam_cloudflare_oauth_state')), true);
-      const insert = calls.find((call) => call.sql.includes('INSERT INTO agentsam_cloudflare_connections'));
-      assert.ok(insert);
-      assert.notEqual(insert.args[4], 'access-plaintext');
-      assert.notEqual(insert.args[5], 'refresh-plaintext');
+      assert.equal(oauthState.has('state_123'), false);
+      const insert = calls.find((call) => call.sql.includes('INSERT INTO user_oauth_tokens'));
+      assert.ok(insert, 'expected user_oauth_tokens insert (SSOT)');
+      // With vault: plaintext args are null; ciphertext is not plaintext tokens.
+      assert.equal(insert.args[3], null); // access_token plaintext
+      assert.equal(insert.args[4], null); // refresh_token plaintext
+      assert.notEqual(insert.args[5], 'access-plaintext'); // access_token_encrypted
+      assert.notEqual(insert.args[6], 'refresh-plaintext'); // refresh_token_encrypted
+      assert.equal(calls.some((call) => call.sql.includes('agentsam_cloudflare_connections')), false);
     } finally {
       globalThis.fetch = originalFetch;
     }

package/packages/connectors/cloudflare/tests/oauth-persist.test.mjs

@@ -0,0 +1,125 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  resolveCloudflareAccountId,
+  unionScopes,
+  upsertCloudflareUserOauthToken,
+} from '../src/oauth-persist.js';
+
+describe('oauth-persist spine', () => {
+  it('unions scopes without duplicates', () => {
+    assert.deepEqual(
+      unionScopes(['d1.read', 'offline_access'], ['d1.read', 'workers-scripts.write']).sort(),
+      ['d1.read', 'offline_access', 'workers-scripts.write'].sort(),
+    );
+  });
+
+  it('requires explicit selection when Cloudflare exposes multiple accounts', async () => {
+    const result = await resolveCloudflareAccountId('token', {
+      fetchImpl: async () => ({
+        ok: true,
+        async json() {
+          return {
+            result: [
+              { id: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', name: 'A' },
+              { id: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb', name: 'B' },
+            ],
+          };
+        },
+      }),
+    });
+    assert.equal(result?.error, 'cloudflare_account_selection_required');
+    assert.equal(result?.accounts?.length, 2);
+  });
+
+  it('rejects provider labels and synthetic values as account identifiers', async () => {
+    const result = await upsertCloudflareUserOauthToken(
+      { DB: { prepare() { throw new Error('should not query'); } } },
+      { userId: 'au_1', accessToken: 'token', accountId: 'Cloudflare' },
+    );
+    assert.equal(result.ok, false);
+    assert.equal(result.error, 'cloudflare_account_identifier_required');
+  });
+
+  it('upserts with client_id provenance and scope union (no connected_via_app)', async () => {
+    const rows = new Map();
+    const sqlSeen = [];
+    const env = {
+      VAULT_MASTER_KEY: 'test-vault-material',
+      DB: {
+        prepare(sql) {
+          sqlSeen.push(String(sql));
+          return {
+            bind(...args) {
+              return {
+                async first() {
+                  if (String(sql).includes('SELECT')) {
+                    return rows.get(`${args[0]}|${args[2]}`) || null;
+                  }
+                  return null;
+                },
+                async run() {
+                  if (String(sql).includes('INSERT')) {
+                    // Encrypted-only path: plaintext [3]/[4] are null; ciphertext [5]/[6].
+                    const key = `${args[0]}|${args[2]}`;
+                    const prior = rows.get(key);
+                    rows.set(key, {
+                      scopes: args[7],
+                      scope: args[7],
+                      metadata_json: args[11],
+                      access_token: args[3],
+                      refresh_token: args[4],
+                      created_at: prior?.created_at || args[12],
+                    });
+                  }
+                  return { success: true };
+                },
+              };
+            },
+          };
+        },
+      },
+    };
+
+    const r1 = await upsertCloudflareUserOauthToken(env, {
+      userId: 'au_1',
+      accessToken: 'tok1',
+      scopes: 'd1.read offline_access',
+      accountId: 'abc123abc123abc123abc123abc123ab',
+      clientId: 'c0704bd7a7aab7216b362603e1985499',
+      capabilitySet: ['cloudflare.d1'],
+    });
+    assert.equal(r1.ok, true);
+    assert.equal(r1.status, 'connected');
+    assert.equal(r1.provenance.connected_via_client_id, 'c0704bd7a7aab7216b362603e1985499');
+    assert.equal(r1.provenance.connected_via_app, undefined);
+
+    rows.set('au_1|abc123abc123abc123abc123abc123ab', {
+      scopes: 'd1.read offline_access',
+      scope: 'd1.read offline_access',
+      metadata_json: JSON.stringify({
+        cloudflare_account_id: 'abc123abc123abc123abc123abc123ab',
+        connected_via_client_id: 'c0704bd7a7aab7216b362603e1985499',
+        connected_via_app: 'should_be_stripped',
+      }),
+      access_token: 'tok1',
+      refresh_token: null,
+      created_at: 1,
+    });
+
+    const r2 = await upsertCloudflareUserOauthToken(env, {
+      userId: 'au_1',
+      accessToken: 'tok2',
+      scopes: 'workers-scripts.write',
+      accountId: 'abc123abc123abc123abc123abc123ab',
+      clientId: 'c0704bd7a7aab7216b362603e1985499',
+      capabilitySet: ['cloudflare.workers'],
+    });
+    assert.equal(r2.ok, true);
+    assert.ok(r2.scopes.includes('d1.read'));
+    assert.ok(r2.scopes.includes('workers-scripts.write'));
+    const upsertSql = sqlSeen.find((sql) => sql.includes('ON CONFLICT(user_id, provider, account_identifier)'));
+    assert.match(upsertSql || '', /last_refresh_error_code = NULL/);
+    assert.match(upsertSql || '', /refresh_failure_count = 0/);
+  });
+});

package/packages/identity/.agentsam/features/oauth-login-portal/agentsam.feature.json

@@ -6,7 +6,7 @@
   "status": "extracted",
   "package": {
     "name": "@inneranimalmedia/agentsam-sdk-identity",
-    "version": "2.6.2",
+    "version": "2.6.3",
     "directory": "packages/identity"
   },
   "provides": [

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -35,7 +35,27 @@
       "required_configuration": [
         "GOOGLE_CLIENT_ID",
         "GOOGLE_CLIENT_SECRET"
-      ]
+      ],
+      "notes": "Web browser OAuth (confidential client). For Desktop/CLI PKCE use google_desktop."
+    },
+    {
+      "id": "google_desktop",
+      "aliases": ["google-desktop"],
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/google",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.desktop_exchange",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GOOGLE_DESKTOP_CLIENT_ID"
+      ],
+      "optional_configuration": [
+        "GOOGLE_DESKTOP_CLIENT_SECRET"
+      ],
+      "notes": "Desktop/public PKCE client (Console type Desktop app — no secret). Worker brokers POST /api/oauth/google/desktop-exchange for loopback redirects. Optional GOOGLE_DESKTOP_CLIENT_SECRET only if the client id was mis-typed as Web."
     },
     {
       "id": "github",
@@ -90,7 +110,7 @@
       "optional_configuration": [
         "CLOUDFLARE_OAUTH_CLIENT_SECRET"
       ],
-      "notes": "Registered in identityProviders. Client secret optional for PKCE-only clients."
+      "notes": "Cloudflare sign-in (same Worker secrets as the Cloudflare resource connector). Client secret optional for PKCE-only clients (Token Authentication Method = None)."
     }
   ]
 }

package/packages/identity/.agentsam/features/oauth-login-portal/resources.json

@@ -4,13 +4,19 @@
   "engine": "d1",
   "migration_sources": [
     "src/migrations/0001_identity_core.sql",
-    "src/migrations/0002_company.sql"
+    "src/migrations/0002_company.sql",
+    "src/migrations/0003_accounts_ssot.sql"
   ],
-  "notes": "Migration files remain the schema authority. This JSON is an index/contract only.",
+  "notes": "Migration files remain the schema authority. accounts is the account SSOT; account_identities is IdP linkage only.",
   "tables": [
+    {
+      "name": "accounts",
+      "purpose": "account SSOT (row of record)",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
     {
       "name": "auth_users",
-      "purpose": "canonical user identity",
+      "purpose": "login principal (1:1 with accounts.id in portable scaffold)",
       "source": "src/migrations/0001_identity_core.sql"
     },
     {
@@ -21,7 +27,7 @@
     },
     {
       "name": "account_identities",
-      "purpose": "external identity/provider mapping",
+      "purpose": "IdP linkage only (provider + subject → accounts.id) — not the account SSOT",
       "owner_column": "account_id",
       "source": "src/migrations/0001_identity_core.sql"
     },

package/packages/identity/.agentsam/features/oauth-login-portal/routes.json

@@ -39,6 +39,20 @@
       "access": "public",
       "provider": "google"
     },
+    {
+      "path": "/api/oauth/google/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "google"
+    },
+    {
+      "path": "/api/oauth/google/desktop-exchange",
+      "method": "POST",
+      "kind": "api",
+      "access": "public",
+      "provider": "google_desktop",
+      "notes": "CLI/desktop PKCE broker — loopback redirect_uri only"
+    },
     {
       "path": "/api/oauth/github/start",
       "kind": "api",
@@ -46,11 +60,26 @@
       "provider": "github"
     },
     {
-      "path": "/api/oauth/iam/start",
+      "path": "/api/oauth/github/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "github"
+    },
+    {
+      "path": "/api/oauth/inneranimalmedia/start",
+      "kind": "api",
+      "access": "public",
+      "provider": "inneranimalmedia",
+      "oauth_provider_key": "iam",
+      "aliases": ["/api/oauth/iam/start"]
+    },
+    {
+      "path": "/api/oauth/inneranimalmedia/callback",
       "kind": "api",
       "access": "public",
       "provider": "inneranimalmedia",
-      "oauth_provider_key": "iam"
+      "oauth_provider_key": "iam",
+      "aliases": ["/api/oauth/iam/callback"]
     },
     {
       "path": "/api/oauth/cloudflare/start",

package/packages/identity/README.md

@@ -20,7 +20,7 @@ identity.login(request);   // alpha: throws until Identity Service adapter is wi
 identity.session.fromRequest(request);  // alpha: throws until adapter is wired
 ```
 
-**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. Developer Google/GitHub BYOK still supported when those env pairs are set.
+**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. BYOK options: Google web, Google Desktop (`GOOGLE_DESKTOP_CLIENT_ID`), GitHub, Cloudflare (`CLOUDFLARE_OAUTH_CLIENT_*`). **Account SSOT:** `accounts` (not `account_identities` — that table is IdP linkage only).
 
 ## Layout
 

package/packages/identity/backend/README.md

@@ -11,7 +11,7 @@ Worker-side identity: providers, OAuth finalize, sessions, adapters.
 | `oauth/callback.js` | `src/core/auth/oauth-finalize.js` → `finalizeInboundOAuth` | **bulletproof path** |
 | `oauth/authorize.js` | `src/api/auth.js` OAuth start handlers | PKCE + state — next sprint |
 | `core/session-service.js` | `src/core/auth.js` | cookie, `createLoginSession`, revoke |
-| `core/account-linking.js` | `ensureIdentityPlaneBeforeSession`, `ensureAppUser` | account_identities |
+| `core/account-linking.js` | `ensureIdentityPlaneBeforeSession`, `ensureAppUser` | **accounts** SSOT + account_identities (IdP link) |
 | `adapters/inneranimalmedia/*` | D1 writes in auth side-effects | tenant/workspace stays adapter-only |
 
 ## Rule

package/packages/identity/docs/PORTABLE_IDENTITY_ARCHITECTURE.md

@@ -0,0 +1,50 @@
+# Portable Identity Architecture (pre-commit return)
+
+## Invariants
+
+1. Portable SDK owns **semantic route IDs** (`identity.login`), never host paths.
+2. App manifests own **HTTP projections**.
+3. Auth-capable apps MUST declare authenticated / login / recovery / OAuth callback.
+4. OAuth **transactions** persist `app_id` + `return_to` (required).
+5. Post-login: valid `return_to` → authenticated entry → recovery+error → **throw** (never `/`).
+6. No `DASHBOARD_AFTER_LOGIN_PATH`, no `LOCAL_STUDIO_APP` in identity, no `APP_HOME_PATH` env.
+7. Missing shell/route → package verification failure.
+
+## Artifacts delivered
+
+| Deliverable | Location |
+|---|---|
+| IdentityStore + errors | `packages/identity/src/contracts/identity-store.js` |
+| Semantic IDs | `packages/identity/src/contracts/route-ids.js` |
+| Route projection | `packages/identity/src/contracts/route-projection.js` |
+| Fail-closed post-auth | `packages/identity/src/server/post-auth.js` |
+| SESSION_POLICY | `packages/identity/src/core/session-policy.js` |
+| SQLite core pack | `packages/identity/migrations/sqlite/001_identity_core.sql` |
+| SQLite oauth-client | `packages/identity/migrations/sqlite/002_identity_oauth_client.sql` |
+| SQLite oauth-server (optional) | `packages/identity/migrations/sqlite/003_identity_oauth_server.sql` |
+| D1 mapping | `packages/identity/migrations/D1_SCHEMA_MAPPING.md` |
+| createSqliteIdentityAdapter | `packages/identity/src/adapters/sqlite/index.js` |
+| App verify | `packages/identity/src/app/verify-app.js` |
+| App auth contract (Local Studio) | `apps/local-studio/agentsam.app.json` |
+| Tests | `packages/identity/tests/portable-identity-architecture.test.mjs` |
+
+## Redirect resolution
+
+```
+transaction.return_to  →  owned by app?
+        yes → use
+        no  → app.authenticated
+        missing → identity.recovery?error=…
+        none → IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED')
+```
+
+## Local-only path
+
+```
+applySqliteIdentityMigrations(db)  // core + oauth-client
+createSqliteIdentityAdapter(db)
+createIdentityService({ adapter, app, routeRegistry })
+```
+
+Zero Cloudflare / IAM / D1 required for password + session + OAuth transaction store.
+Provider secrets → encrypted vault via `credential_ref` on `identity_provider_connections`.

package/packages/identity/migrations/D1_SCHEMA_MAPPING.md

@@ -0,0 +1,32 @@
+# Identity schema mapping — portable ↔ Cloudflare D1
+
+Portable SQLite (`packages/identity/migrations/sqlite/`) is the product schema.
+The D1 adapter maps existing hosted table names without requiring a big-bang rename.
+
+| Portable (SQLite) | Hosted D1 (current) | Notes |
+|---|---|---|
+| `identity_users` / account plane | **`accounts`** | **Account SSOT** — row of record |
+| login principal | `auth_users` | 1:1 with `accounts.id` in portable scaffold |
+| `identity_external_accounts` | `account_identities` | IdP linkage only (`account_id` → `accounts.id`) — never the account SSOT |
+| `identity_sessions` | `auth_sessions` | Same columns |
+| `identity_auth_events` | `auth_event_log` | Same columns |
+| `identity_oauth_transactions` | `identity_oauth_states` → migrate to `identity_oauth_transactions` | Requires `app_id NOT NULL`; no silent pre-app_id fallback |
+| `identity_provider_connections` | (new / connector tables) | `credential_ref` → vault/KMS; never store raw tokens in D1 rows |
+| `identity_app_registry` | cache of `agentsam.app.json` | Disk manifests remain SSOT |
+| `identity_route_registry` | projection cache | Disk manifests remain SSOT |
+| `identity_oauth_clients` … | optional `identity.oauth-server` pack | Only if product is an AS |
+
+## Schema version
+
+Both adapters read `identity_schema_meta.schema_version` (SQLite) or
+`PRAGMA`/meta row. Missing `app_id` on OAuth transactions is an
+`IdentitySchemaError('IDENTITY_SCHEMA_MIGRATION_REQUIRED')`, not a soft
+downgrade.
+
+## Packs
+
+| Pack | Apply when |
+|---|---|
+| `identity.core` | Always (local + hosted) |
+| `identity.oauth-client` | Signing into external IdPs |
+| `identity.oauth-server` | Product issues its own codes/tokens |

package/packages/identity/migrations/sqlite/001_identity_core.sql

@@ -0,0 +1,99 @@
+-- identity.core — portable local SQLite (no Cloudflare / IAM required)
+-- Timestamps: INTEGER unixepoch seconds
+
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE IF NOT EXISTS identity_schema_meta (
+  key TEXT PRIMARY KEY NOT NULL,
+  value TEXT NOT NULL
+);
+
+INSERT OR REPLACE INTO identity_schema_meta (key, value)
+VALUES ('schema_version', '1');
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_core', '1');
+
+CREATE TABLE IF NOT EXISTS identity_users (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  password_hash TEXT,
+  salt TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_users_email
+  ON identity_users(email);
+
+CREATE TABLE IF NOT EXISTS identity_external_accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  provider_subject TEXT NOT NULL,
+  email TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_external_provider_subject
+  ON identity_external_accounts(provider, provider_subject);
+
+CREATE TABLE IF NOT EXISTS identity_sessions (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  email TEXT,
+  provider TEXT,
+  provider_subject TEXT,
+  display_name TEXT,
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  last_active_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_sessions_user_expires
+  ON identity_sessions(user_id, expires_at);
+
+CREATE TABLE IF NOT EXISTS identity_auth_events (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT,
+  event_type TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'ok',
+  provider TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  ip_hash TEXT,
+  user_agent_hash TEXT,
+  created_at INTEGER NOT NULL DEFAULT (unixepoch())
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_auth_events_user_created
+  ON identity_auth_events(user_id, created_at DESC);
+
+CREATE TABLE IF NOT EXISTS identity_app_registry (
+  id TEXT PRIMARY KEY NOT NULL,
+  package_name TEXT,
+  manifest_version TEXT,
+  display_name TEXT,
+  authenticated_route_id TEXT NOT NULL,
+  login_route_id TEXT NOT NULL,
+  recovery_route_id TEXT NOT NULL,
+  enabled INTEGER NOT NULL DEFAULT 1,
+  installed_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_route_registry (
+  app_id TEXT NOT NULL,
+  route_id TEXT NOT NULL,
+  path_pattern TEXT NOT NULL,
+  runtime TEXT,
+  auth_policy TEXT,
+  shell_ref TEXT,
+  PRIMARY KEY (app_id, route_id),
+  FOREIGN KEY (app_id) REFERENCES identity_app_registry(id)
+);

package/packages/identity/migrations/sqlite/002_identity_oauth_client.sql

@@ -0,0 +1,38 @@
+-- identity.oauth-client — outbound OAuth (sign in with Google/CF/GitHub/IAM)
+-- Secrets/tokens live in the local encrypted vault; this pack stores refs + metadata.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_client', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_transactions (
+  state TEXT PRIMARY KEY NOT NULL,
+  provider TEXT NOT NULL,
+  code_verifier TEXT NOT NULL,
+  return_to TEXT,
+  app_id TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_transactions_expires
+  ON identity_oauth_transactions(expires_at);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_transactions_app
+  ON identity_oauth_transactions(app_id);
+
+CREATE TABLE IF NOT EXISTS identity_provider_connections (
+  id TEXT PRIMARY KEY NOT NULL,
+  user_id TEXT NOT NULL,
+  provider TEXT NOT NULL,
+  granted_scopes_json TEXT NOT NULL DEFAULT '[]',
+  credential_ref TEXT NOT NULL,
+  expires_at INTEGER,
+  refreshable INTEGER NOT NULL DEFAULT 0,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_provider_connections_user_provider
+  ON identity_provider_connections(user_id, provider);