@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/identity/migrations/sqlite/003_identity_oauth_server.sql

@@ -0,0 +1,64 @@
+-- identity.oauth-server — OPTIONAL pack for products that issue their own
+-- client IDs, authorization codes, access tokens, and refresh tokens.
+-- Do not apply unless the installed product is an OAuth authorization server.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_server', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_clients (
+  id TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL UNIQUE,
+  client_secret_hash TEXT,
+  name TEXT NOT NULL,
+  redirect_uris_json TEXT NOT NULL DEFAULT '[]',
+  grant_types_json TEXT NOT NULL DEFAULT '["authorization_code"]',
+  token_endpoint_auth_method TEXT NOT NULL DEFAULT 'none',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_authorization_codes (
+  code_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  code_challenge TEXT,
+  code_challenge_method TEXT,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_access_tokens (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_refresh_tokens (
+  token_hash TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  expires_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  created_at INTEGER NOT NULL,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_grants (
+  id TEXT PRIMARY KEY NOT NULL,
+  client_id TEXT NOT NULL,
+  user_id TEXT NOT NULL,
+  scopes_json TEXT NOT NULL DEFAULT '[]',
+  created_at INTEGER NOT NULL,
+  revoked_at INTEGER,
+  FOREIGN KEY (user_id) REFERENCES identity_users(id)
+);

package/packages/identity/migrations/sqlite/004_identity_oauth_consent_catalog.sql

@@ -0,0 +1,48 @@
+-- identity.oauth-server consent catalog.
+-- Issuer branding remains owned by the portable company table.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_consent_catalog', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_resources (
+  id TEXT PRIMARY KEY NOT NULL,
+  audience TEXT NOT NULL UNIQUE,
+  resource_type TEXT NOT NULL DEFAULT 'mcp',
+  display_name TEXT NOT NULL,
+  description TEXT,
+  logo_url TEXT,
+  homepage_url TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  is_active INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_scopes (
+  scope TEXT PRIMARY KEY NOT NULL,
+  label TEXT NOT NULL,
+  description TEXT NOT NULL,
+  category TEXT NOT NULL DEFAULT 'general',
+  sensitivity TEXT NOT NULL DEFAULT 'normal'
+    CHECK (sensitivity IN ('normal','elevated','sensitive')),
+  is_active INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  sort_order INTEGER NOT NULL DEFAULT 50,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_resource_scopes (
+  resource_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  required INTEGER NOT NULL DEFAULT 0 CHECK (required IN (0,1)),
+  sort_order INTEGER NOT NULL DEFAULT 50,
+  PRIMARY KEY (resource_id, scope),
+  FOREIGN KEY (resource_id) REFERENCES identity_oauth_resources(id) ON DELETE CASCADE,
+  FOREIGN KEY (scope) REFERENCES identity_oauth_scopes(scope) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_resources_active
+  ON identity_oauth_resources(is_active, resource_type);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_resource_scopes_sort
+  ON identity_oauth_resource_scopes(resource_id, sort_order, scope);

package/packages/identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.3",
+  "version": "2.6.5",
   "private": true,
   "type": "module",
   "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
@@ -29,7 +29,8 @@
     "./contracts/auth-config": "./src/contracts/auth-config.js",
     "./oauth/callback": "./src/oauth/callback.js",
     "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
-    "./providers/cloudflare": "./src/providers/cloudflare/index.js"
+    "./providers/cloudflare": "./src/providers/cloudflare/index.js",
+    "./oauth/consent-view": "./src/oauth/consent-view.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",

package/packages/identity/scripts/local-identity-bridge.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { DatabaseSync } from 'node:sqlite';
+import {
+  applySqliteIdentityMigrations,
+  createSqliteIdentityAdapter,
+} from '../src/adapters/sqlite/index.js';
+import {
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from '../src/contracts/route-projection.js';
+import { createIdentityService } from '../src/server/identity-service.js';
+import { hashPassword } from '../src/core/password-crypto.js';
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => { body += chunk; });
+    process.stdin.on('end', () => {
+      try { resolve(body.trim() ? JSON.parse(body) : {}); }
+      catch (error) { reject(error); }
+    });
+    process.stdin.on('error', reject);
+  });
+}
+
+function wrapDatabase(database, filePath) {
+  return {
+    filePath,
+    prepare(sql) {
+      const statement = database.prepare(sql);
+      const bound = (values = []) => ({
+        async run() { return statement.run(...values); },
+        async first() { return statement.get(...values) ?? null; },
+        async all() { return { results: statement.all(...values) }; },
+      });
+      return {
+        bind(...values) { return bound(values); },
+        async run() { return statement.run(); },
+        async first() { return statement.get() ?? null; },
+        async all() { return { results: statement.all() }; },
+      };
+    },
+    exec(sql) { database.exec(sql); },
+    close() { database.close(); },
+  };
+}
+
+function sanitizeUser(user) {
+  if (!user) return null;
+  return {
+    id: user.id,
+    email: user.email,
+    display_name: user.display_name ?? null,
+    status: user.status ?? null,
+  };
+}
+
+const request = await readStdin();
+const dbPath = path.resolve(
+  process.env.AGENTSAM_IDENTITY_DB || '.agentsam/data/local-studio-identity.sqlite',
+);
+const manifestPath = path.resolve(
+  process.env.AGENTSAM_IDENTITY_APP_MANIFEST
+    || new URL('../../../apps/local-studio/agentsam.app.json', import.meta.url).pathname,
+);
+
+fs.mkdirSync(path.dirname(dbPath), { recursive: true, mode: 0o700 });
+const nativeDb = new DatabaseSync(dbPath);
+try {
+  if (process.platform !== 'win32') {
+    try { fs.chmodSync(dbPath, 0o600); } catch {}
+  }
+  const db = wrapDatabase(nativeDb, dbPath);
+  await applySqliteIdentityMigrations(db);
+  const adapter = createSqliteIdentityAdapter(db);
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const routeRegistry = createRouteRegistry([projectionFromAppManifest(manifest)]);
+  const identity = createIdentityService({
+    adapter,
+    app: { id: manifest.id },
+    routeRegistry,
+  });
+
+  let result;
+  switch (request.op) {
+    case 'status': {
+      const sessionId = String(request.session_id || '').trim();
+      if (!sessionId) {
+        result = { ok: true, authenticated: false, user: null };
+        break;
+      }
+      const session = await identity.sessionFromRequest(new Request('http://local.identity/session', {
+        headers: { Authorization: `Bearer ${sessionId}` },
+      }));
+      result = {
+        ok: true,
+        authenticated: Boolean(session),
+        user: sanitizeUser(session?.user),
+      };
+      break;
+    }
+
+    case 'login': {
+      const login = await identity.loginWithPassword({
+        email: request.email,
+        password: request.password,
+      });
+      result = login.ok
+        ? {
+            ok: true,
+            authenticated: true,
+            session_id: login.sessionId,
+            user: sanitizeUser(login.user),
+            redirect: identity.resolvePostLoginPath(request.next || null),
+          }
+        : login;
+      break;
+    }
+
+    case 'signup': {
+      const signup = await identity.signup({
+        email: request.email,
+        password: request.password,
+        displayName: request.display_name,
+      });
+      result = signup.ok
+        ? {
+            ok: true,
+            authenticated: true,
+            session_id: signup.sessionId,
+            user: sanitizeUser(signup.user),
+            redirect: identity.resolvePostLoginPath(request.next || null),
+          }
+        : signup;
+      break;
+    }
+
+    case 'logout': {
+      const sessionId = String(request.session_id || '').trim();
+      if (sessionId) {
+        await identity.logout(new Request('http://local.identity/logout', {
+          headers: { Authorization: `Bearer ${sessionId}` },
+        }));
+      }
+      result = { ok: true };
+      break;
+    }
+
+    case 'reset_password': {
+      const email = String(request.email || '').trim().toLowerCase();
+      const password = String(request.password || '');
+      if (!email || password.length < 8) {
+        result = { ok: false, error: 'email_and_valid_password_required' };
+        break;
+      }
+      const user = await adapter.findUserByEmail(email);
+      if (!user) {
+        result = { ok: false, error: 'account_not_found' };
+        break;
+      }
+      const { saltHex, hashHex } = await hashPassword(password);
+      await adapter.updateUserPassword(user.id, hashHex, saltHex);
+      result = { ok: true };
+      break;
+    }
+
+    default:
+      result = { ok: false, error: 'unsupported_identity_operation' };
+  }
+
+  process.stdout.write(JSON.stringify(result));
+} catch (error) {
+  process.stdout.write(JSON.stringify({
+    ok: false,
+    error: error?.message || String(error),
+  }));
+  process.exitCode = 1;
+} finally {
+  try { nativeDb.close(); } catch {}
+}

package/packages/identity/scripts/preview-auth-portal.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Local static preview for IAM auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
+ * Local static preview for the portable AgentSam auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
  * API routes are stubbed so forms and globe-exit transitions work without a Worker.
  */
 import http from 'node:http';
@@ -119,14 +119,14 @@ function hubHtml(baseUrl) {
 const PREVIEW_COMPANY = {
   id: 'co_default',
   slug: 'default',
-  name: 'Inner Animal Media',
-  legalName: 'Inner Animals LLC',
-  logoUrl: 'https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public',
-  faviconUrl: 'https://inneranimalmedia.com/favicon.ico',
+  name: 'AgentSam',
+  legalName: 'AgentSam',
+  logoUrl: '/shared/agentsam-mark.svg',
+  faviconUrl: null,
   primaryColor: '#007AFF',
   authBgColor: '#050508',
-  supportEmail: 'hey@inneranimalmedia.com',
-  websiteUrl: 'https://inneranimalmedia.com',
+  supportEmail: 'support@agentsam.dev',
+  websiteUrl: 'https://agentsam.dev',
   tagline: 'Instant Access',
   meta: {
     privacyUrl: '/privacy',

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -1,7 +1,10 @@
+import { SESSION_POLICY } from '../../core/constants.js';
+import { IdentitySchemaError } from '../../contracts/identity-store.js';
+import { IDENTITY_STORE_SCHEMA_VERSION } from '../../contracts/identity-store.js';
 import { newAccountIdentityId, newAuthUserId, newSessionId, newAuthEventId, nowUnix } from './ids.js';
-import { AUTH_SESSION_TTL_SECONDS } from '../../core/constants.js';
 import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '../../contracts/company.js';
 
+
 /**
  * @typedef {object} D1Database
  * @property {(sql: string) => { bind: (...args: unknown[]) => { first: () => Promise<unknown>, run: () => Promise<unknown>, all: () => Promise<{ results?: unknown[] }> } }} prepare
@@ -24,22 +27,45 @@ export function createCloudflareD1Adapter(db, options = {}) {
   if (!db?.prepare) {
     throw new Error('cloudflare_d1_adapter_requires_db_binding');
   }
-  const sessionTtlSeconds = options.sessionTtlSeconds ?? AUTH_SESSION_TTL_SECONDS;
+  const sessionTtlSeconds = options.sessionTtlSeconds ?? SESSION_POLICY.browser.ttlSeconds;
 
   return Object.freeze({
+    schemaVersion: IDENTITY_STORE_SCHEMA_VERSION,
     sessionTtlSeconds,
+    backend: 'cloudflare-d1',
 
     /**
      * Append-only login/logout/failed-attempt audit trail (auth_event_log).
-     * Never throws -- an observability write must not break a real auth flow.
-     * ip/userAgent are hashed (SHA-256) before storage, matching the
-     * ip_hash/user_agent_hash column names -- raw values are never persisted.
+     * Never throws — an observability write must not break a real auth flow.
+     * status remains the event outcome only ('ok' | 'failed').
+     * Richer context (session, capabilities, activity, client) goes in metadata_json.
+     * ip/userAgent are hashed (SHA-256) — raw values are never persisted.
      */
-    async logAuthEvent({ userId, eventType, status = 'ok', provider, metadata, request }) {
+    async logAuthEvent({
+      userId,
+      accountId,
+      eventType,
+      status = 'ok',
+      provider,
+      session,
+      capabilities,
+      activity,
+      client,
+      metadata,
+      request,
+    }) {
       try {
         const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
         const ua = request?.headers?.get?.('user-agent') || '';
         const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
+        const envelope = {
+          ...(metadata && typeof metadata === 'object' ? metadata : {}),
+          ...(accountId ? { accountId } : {}),
+          ...(session ? { session } : {}),
+          ...(capabilities ? { capabilities } : {}),
+          ...(activity ? { activity } : {}),
+          ...(client ? { client } : {}),
+        };
         await db.prepare(
           `INSERT INTO auth_event_log
            (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash)
@@ -50,7 +76,7 @@ export function createCloudflareD1Adapter(db, options = {}) {
           eventType,
           status,
           provider || null,
-          metadata ? JSON.stringify(metadata) : '{}',
+          JSON.stringify(envelope),
           ipHash,
           uaHash,
         ).run();
@@ -59,6 +85,34 @@ export function createCloudflareD1Adapter(db, options = {}) {
       }
     },
 
+    /**
+     * Account/session activity snapshot for auth receipts (not event outcome).
+     * @param {string} userId
+     */
+    async countAuthActivity(userId) {
+      if (!userId) {
+        return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
+      }
+      try {
+        const logins = await db.prepare(
+          `SELECT COUNT(*) AS c, MAX(created_at) AS last_at
+           FROM auth_event_log
+           WHERE user_id = ? AND event_type = 'login' AND status = 'ok'`,
+        ).bind(userId).first();
+        const sessions = await db.prepare(
+          `SELECT COUNT(*) AS c FROM auth_sessions
+           WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?`,
+        ).bind(userId, nowUnix()).first();
+        return {
+          loginCount: Number(logins?.c || 0),
+          activeSessionCount: Number(sessions?.c || 0),
+          lastLoginAt: logins?.last_at != null ? Number(logins.last_at) : null,
+        };
+      } catch {
+        return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
+      }
+    },
+
     async findUserByEmail(email) {
       const row = await db.prepare(
         `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
@@ -79,6 +133,11 @@ export function createCloudflareD1Adapter(db, options = {}) {
       const id = newAuthUserId();
       const ts = nowUnix();
       const normalizedEmail = String(email || '').trim().toLowerCase();
+      // accounts = SSOT; auth_users = login principal (1:1 id in portable scaffold).
+      await db.prepare(
+        `INSERT INTO accounts (id, email, display_name, status, created_at, updated_at)
+         VALUES (?, ?, ?, 'active', ?, ?)`,
+      ).bind(id, normalizedEmail, displayName || null, ts, ts).run();
       await db.prepare(
         `INSERT INTO auth_users (id, email, display_name, password_hash, salt, status, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`,
@@ -91,24 +150,48 @@ export function createCloudflareD1Adapter(db, options = {}) {
       await db.prepare(
         `UPDATE auth_users SET password_hash = ?, salt = ?, updated_at = ? WHERE id = ?`,
       ).bind(passwordHash, salt, ts, userId).run();
+      await db.prepare(
+        `UPDATE accounts SET updated_at = ? WHERE id = ?`,
+      ).bind(ts, userId).run().catch(() => {});
     },
 
     async findUserByProvider(provider, providerSubject) {
       const row = await db.prepare(
         `SELECT u.id, u.email, u.display_name, u.password_hash, u.salt, u.status, u.created_at, u.updated_at
          FROM account_identities ai
-         JOIN auth_users u ON u.id = ai.account_id
+         JOIN accounts a ON a.id = ai.account_id
+         JOIN auth_users u ON u.id = a.id
          WHERE ai.provider = ? AND ai.provider_subject = ?
+           AND COALESCE(a.status, 'active') = 'active'
          LIMIT 1`,
       ).bind(provider, providerSubject).first();
       return row || null;
     },
 
     async upsertProviderIdentity({ accountId, provider, providerSubject, email }) {
+      // Ensure SSOT account row exists (OAuth may create identity before password user).
+      const ts = nowUnix();
+      const account = await db.prepare(
+        `SELECT id FROM accounts WHERE id = ? LIMIT 1`,
+      ).bind(accountId).first();
+      if (!account?.id) {
+        const authUser = await this.findUserById(accountId);
+        if (!authUser) throw new Error('account_ssot_missing');
+        await db.prepare(
+          `INSERT INTO accounts (id, email, display_name, status, created_at, updated_at)
+           VALUES (?, ?, ?, 'active', ?, ?)`,
+        ).bind(
+          accountId,
+          authUser.email,
+          authUser.display_name || null,
+          authUser.created_at || ts,
+          ts,
+        ).run();
+      }
+
       const existing = await db.prepare(
         `SELECT id FROM account_identities WHERE provider = ? AND provider_subject = ? LIMIT 1`,
       ).bind(provider, providerSubject).first();
-      const ts = nowUnix();
       if (existing?.id) {
         await db.prepare(
           `UPDATE account_identities SET account_id = ?, email = ?, updated_at = ? WHERE id = ?`,
@@ -173,27 +256,73 @@ export function createCloudflareD1Adapter(db, options = {}) {
       return { ok: true, reason };
     },
 
-    async saveOAuthState({ state, provider, codeVerifier, redirectTo, ttlSeconds = 600 }) {
-      // Dedicated table, deliberately NOT named `oauth_states` -- that name collides
-      // with unrelated Stripe Connect state tracking in customer apps that reuse
-      // their inneranimalmedia D1 instance (id/user_id/provider_id/redirect_uri/
-      // scope schema, no default on primary key). See AgentSamRemix incident,
-      // 2026-08-29: D1_ERROR: table oauth_states has no column named state.
+    async createOAuthTransaction({ state, provider, codeVerifier, returnTo, redirectTo, appId, ttlSeconds = 600 }) {
+      if (!appId) {
+        throw new IdentitySchemaError(
+          'OAUTH_TRANSACTION_APP_ID_REQUIRED',
+          'OAuth transactions must include app_id',
+        );
+      }
       const ts = nowUnix();
-      await db.prepare(
-        `INSERT INTO identity_oauth_states (state, provider, code_verifier, redirect_to, expires_at, created_at)
-         VALUES (?, ?, ?, ?, ?, ?)`,
-      ).bind(state, provider, codeVerifier, redirectTo || null, ts + ttlSeconds, ts).run();
+      const expiresAt = ts + ttlSeconds;
+      try {
+        await db.prepare(
+          `INSERT INTO identity_oauth_states
+           (state, provider, code_verifier, redirect_to, app_id, expires_at, created_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?)`,
+        ).bind(state, provider, codeVerifier, returnTo ?? redirectTo ?? null, appId, expiresAt, ts).run();
+      } catch (err) {
+        throw new IdentitySchemaError(
+          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
+          'identity_oauth_states.app_id required — apply migration 0015 (no silent pre-app_id fallback)',
+          { cause: String(err?.message || err) },
+        );
+      }
     },
 
-    async consumeOAuthState(state) {
-      const row = await db.prepare(
-        `SELECT state, provider, code_verifier, redirect_to, expires_at FROM identity_oauth_states WHERE state = ? LIMIT 1`,
-      ).bind(state).first();
+    /** @deprecated Use createOAuthTransaction */
+    async saveOAuthState(input) {
+      return this.createOAuthTransaction(input);
+    },
+
+    async consumeOAuthTransaction(state) {
+      let row;
+      try {
+        row = await db.prepare(
+          `SELECT state, provider, code_verifier, redirect_to, app_id, expires_at, created_at
+           FROM identity_oauth_states WHERE state = ? LIMIT 1`,
+        ).bind(state).first();
+      } catch (err) {
+        throw new IdentitySchemaError(
+          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
+          'identity_oauth_states.app_id column missing — apply migration 0015',
+          { cause: String(err?.message || err) },
+        );
+      }
       if (!row) return null;
       await db.prepare(`DELETE FROM identity_oauth_states WHERE state = ?`).bind(state).run();
       if (row.expires_at <= nowUnix()) return null;
-      return row;
+      if (!row.app_id) {
+        throw new IdentitySchemaError(
+          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
+          'OAuth transaction missing app_id — refuse silent pre-app_id semantics',
+        );
+      }
+      return {
+        state: row.state,
+        provider: row.provider,
+        code_verifier: row.code_verifier,
+        redirect_to: row.redirect_to,
+        return_to: row.redirect_to,
+        app_id: row.app_id,
+        expires_at: row.expires_at,
+        created_at: row.created_at,
+      };
+    },
+
+    /** @deprecated Use consumeOAuthTransaction */
+    async consumeOAuthState(state) {
+      return this.consumeOAuthTransaction(state);
     },
 
     async getCompanyBySlug(slug = DEFAULT_COMPANY_SLUG) {