@inneranimalmedia/agentsam-sdk 2.6.3 → 2.6.5

package/packages/identity/src/oauth/google-desktop-exchange.js

@@ -0,0 +1,173 @@
+/**
+ * Server-side Google token exchange for CLI / desktop PKCE.
+ *
+ * Desktop/"installed" OAuth clients must be type Desktop in Google Console (no secret).
+ * If the configured desktop client_id was created as a Web client, Google demands a secret.
+ * Secrets never leave the Worker: GOOGLE_DESKTOP_CLIENT_SECRET (optional) or GOOGLE_CLIENT_SECRET
+ * when client_id matches the web client.
+ */
+
+const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function json(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: {
+      'content-type': 'application/json; charset=utf-8',
+      'cache-control': 'no-store',
+    },
+  });
+}
+
+function isLoopbackRedirect(uri) {
+  try {
+    const u = new URL(String(uri || ''));
+    if (u.protocol !== 'http:') return false;
+    return u.hostname === '127.0.0.1' || u.hostname === 'localhost' || u.hostname === '[::1]';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolve which secret (if any) the Worker may attach for this client_id.
+ */
+export function resolveGoogleExchangeSecret(env, clientId) {
+  const id = clean(clientId);
+  const desktopId = clean(env?.GOOGLE_DESKTOP_CLIENT_ID);
+  const webId = clean(env?.GOOGLE_CLIENT_ID);
+  const desktopSecret = clean(env?.GOOGLE_DESKTOP_CLIENT_SECRET);
+  const webSecret = clean(env?.GOOGLE_CLIENT_SECRET);
+
+  if (id && desktopId && id === desktopId && desktopSecret) {
+    return { clientId: id, clientSecret: desktopSecret, mode: 'desktop_with_optional_secret' };
+  }
+  if (id && webId && id === webId && webSecret) {
+    return { clientId: id, clientSecret: webSecret, mode: 'web_confidential' };
+  }
+  if (id && desktopId && id === desktopId) {
+    return { clientId: id, clientSecret: null, mode: 'desktop_public_pkce' };
+  }
+  return { clientId: id || null, clientSecret: null, mode: 'unknown_client' };
+}
+
+export async function exchangeGoogleAuthorizationCode({
+  code,
+  codeVerifier,
+  clientId,
+  redirectUri,
+  clientSecret = null,
+  fetchImpl = fetch,
+} = {}) {
+  const body = new URLSearchParams({
+    grant_type: 'authorization_code',
+    code: clean(code),
+    code_verifier: clean(codeVerifier),
+    client_id: clean(clientId),
+    redirect_uri: clean(redirectUri),
+  });
+  if (clean(clientSecret)) body.set('client_secret', clean(clientSecret));
+
+  const res = await fetchImpl(GOOGLE_TOKEN_URL, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body,
+  });
+  const data = await res.json().catch(() => ({}));
+  return { ok: res.ok && Boolean(data.access_token), status: res.status, data };
+}
+
+/**
+ * POST /api/oauth/google/desktop-exchange
+ * Body JSON: { code, code_verifier, redirect_uri, client_id }
+ */
+export async function handleGoogleDesktopExchangeRequest(request, env, opts = {}) {
+  if (request.method !== 'POST') {
+    return json({ ok: false, error: 'method_not_allowed' }, 405);
+  }
+
+  let payload = {};
+  try {
+    payload = await request.json();
+  } catch {
+    return json({ ok: false, error: 'invalid_json' }, 400);
+  }
+
+  const code = clean(payload.code);
+  const codeVerifier = clean(payload.code_verifier || payload.codeVerifier);
+  const redirectUri = clean(payload.redirect_uri || payload.redirectUri);
+  const clientId = clean(payload.client_id || payload.clientId);
+
+  if (!code || !codeVerifier || !redirectUri || !clientId) {
+    return json({
+      ok: false,
+      error: 'code_code_verifier_redirect_uri_client_id_required',
+    }, 400);
+  }
+  if (!isLoopbackRedirect(redirectUri)) {
+    return json({ ok: false, error: 'redirect_uri_must_be_loopback' }, 400);
+  }
+
+  const allowed = new Set(
+    [clean(env?.GOOGLE_DESKTOP_CLIENT_ID), clean(env?.GOOGLE_CLIENT_ID)].filter(Boolean),
+  );
+  if (!allowed.has(clientId)) {
+    return json({ ok: false, error: 'client_id_not_configured_on_host' }, 403);
+  }
+
+  const resolved = resolveGoogleExchangeSecret(env, clientId);
+  if (resolved.mode === 'unknown_client') {
+    return json({ ok: false, error: 'client_id_not_configured_on_host' }, 403);
+  }
+
+  const fetchImpl = opts.fetchImpl || fetch;
+  const result = await exchangeGoogleAuthorizationCode({
+    code,
+    codeVerifier,
+    clientId,
+    redirectUri,
+    clientSecret: resolved.clientSecret,
+    fetchImpl,
+  });
+
+  const detail = String(result.data?.error_description || result.data?.error || '');
+  if (
+    !result.ok
+    && /client_secret/i.test(detail)
+    && resolved.mode === 'desktop_public_pkce'
+    && !resolved.clientSecret
+  ) {
+    return json({
+      ok: false,
+      error: 'desktop_client_requires_secret',
+      detail,
+      remediation: [
+        'In Google Cloud Console create OAuth client type Desktop app (no secret) and set GOOGLE_DESKTOP_CLIENT_ID to that client id.',
+        'Or if this client id is a Web app, put its secret on the Worker: wrangler secret put GOOGLE_DESKTOP_CLIENT_SECRET',
+        'Web browser login continues to use GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET.',
+      ],
+    }, 502);
+  }
+
+  if (!result.ok) {
+    return json({
+      ok: false,
+      error: 'google_token_exchange_failed',
+      detail: detail || `http_${result.status}`,
+    }, 502);
+  }
+
+  return json({
+    ok: true,
+    access_token: result.data.access_token,
+    refresh_token: result.data.refresh_token || null,
+    token_type: result.data.token_type || 'Bearer',
+    expires_in: result.data.expires_in || null,
+    scope: result.data.scope || null,
+    exchange_mode: resolved.mode,
+  });
+}

package/packages/identity/src/oauth/iam-platform.js

@@ -1,4 +1,4 @@
-import { AUTH_LOGIN_PATH } from '../core/constants.js';
+import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
 import {
   IAM_PLATFORM_CALLBACK_PATH,
   IAM_PLATFORM_STATE_PROVIDER,
@@ -38,6 +38,7 @@ export async function iamPlatformOAuthStart(request, env, adapter, identity) {
     provider: IAM_PLATFORM_STATE_PROVIDER,
     codeVerifier,
     redirectTo,
+    appId: identity?.app?.id || null,
   });
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -67,15 +68,15 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
   const err = url.searchParams.get('error');
 
   if (err || !code || !state) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=oauth_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=oauth_failed`, 302);
   }
   if (!creds) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=iam_oauth_not_configured`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=iam_oauth_not_configured`, 302);
   }
 
   const saved = await adapter.consumeOAuthState(state);
   if (!saved || saved.provider !== IAM_PLATFORM_STATE_PROVIDER) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=state_mismatch`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=state_mismatch`, 302);
   }
 
   const redirectUri = `${url.origin}${IAM_PLATFORM_CALLBACK_PATH}`;
@@ -88,7 +89,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
     redirectUri,
   });
   if (!token?.access_token) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=token_exchange_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=token_exchange_failed`, 302);
   }
 
   const profile = await fetchIamProfile({
@@ -97,7 +98,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
   });
   const normalized = profile ? normalizeIamIdentity(profile) : null;
   if (!normalized?.subject || !normalized?.email) {
-    return Response.redirect(`${url.origin}${AUTH_LOGIN_PATH}?error=userinfo_failed`, 302);
+    return Response.redirect(`${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?error=userinfo_failed`, 302);
   }
 
   const result = await identity.provisionOAuthUser({
@@ -109,7 +110,7 @@ export async function iamPlatformOAuthCallback(request, env, adapter, identity)
 
   const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
   const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-  const globeUrl = `${url.origin}${AUTH_LOGIN_PATH}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  const globeUrl = `${url.origin}${identity.routeRegistry.resolve(identity.app.id, IDENTITY_ROUTE_IDS.LOGIN)}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
   return new Response(null, {
     status: 302,
     headers: {

package/packages/identity/src/oauth/redirect-paths.js

@@ -1,29 +1,35 @@
 /**
  * Post-OAuth redirect helpers — portable path policy with host injectables.
+ * Hosts MUST pass loginPath from their route projection (never hardcode).
  */
 
-const DEFAULT_DASHBOARD_FALLBACK = '/dashboard/agent';
+import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 
 /**
  * @typedef {object} OAuthRedirectPathOptions
  * @property {string} [authCookieName]
- * @property {string} [dashboardFallback]
+ * @property {string} loginPath concrete projection of identity.login
+ * @property {string} [fallback] only used when isAllowedLoginResumePath rejects; prefer omit
  * @property {(path: string) => boolean} [isAllowedLoginResumePath]
  * @property {(env: unknown, rawCookie: string) => Promise<string|null>} [resolveSessionIdFromCookie]
  * @property {(env: unknown, sessionId: string, reason: string, userId: string|null) => Promise<void>} [revokeAuthSession]
  */
 
-/**
- * @param {OAuthRedirectPathOptions} options
- */
 export function createOAuthRedirectHelpers(options = {}) {
   const authCookieName = options.authCookieName ?? 'iam_session';
-  const dashboardFallback = options.dashboardFallback ?? DEFAULT_DASHBOARD_FALLBACK;
-  const isAllowedLoginResumePath = options.isAllowedLoginResumePath ?? (() => false);
+  const loginPath = options.loginPath;
+  if (!loginPath || !String(loginPath).startsWith('/')) {
+    throw new IdentityRoutingError(
+      'AUTH_ROUTE_MISSING',
+      'createOAuthRedirectHelpers requires loginPath from route projection',
+    );
+  }
+  const isAllowedLoginResumePath = options.isAllowedLoginResumePath
+    ?? ((path) => Boolean(sanitizeBrowserNextPath(path)));
   const resolveSessionIdFromCookie = options.resolveSessionIdFromCookie;
   const revokeAuthSession = options.revokeAuthSession;
 
-  /** Revoke browser cookie session before issuing a new login session. */
   async function revokeIncomingCookieSession(request, env, reason = 'oauth_login_replaced') {
     const cookie = request.headers.get('Cookie') || '';
     const match = cookie.match(new RegExp(`(?:^|;\\s*)${authCookieName}=([^;]+)`));
@@ -45,48 +51,33 @@ export function createOAuthRedirectHelpers(options = {}) {
     }
   }
 
-  function safeDashboardLoginRedirectPath(originBase, returnTo) {
-    if (!returnTo || typeof returnTo !== 'string') return dashboardFallback;
-    const t = returnTo.trim();
-    if (!t) return dashboardFallback;
-    if (t.startsWith('/') && !t.startsWith('//') && !t.includes('://')) {
-      if (isAllowedLoginResumePath(t)) return t;
-      if (t.startsWith('/dashboard/settings/integrations')) return dashboardFallback;
-      if (!t.startsWith('/dashboard')) return dashboardFallback;
-      return t;
+  function safeLoginRedirectPath(_originBase, returnTo) {
+    const cleaned = sanitizeBrowserNextPath(returnTo);
+    if (!cleaned) {
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'return_to missing/invalid');
     }
-    try {
-      const u = new URL(t);
-      const ob = new URL(originBase);
-      if (u.origin !== ob.origin) return dashboardFallback;
-      const p = u.pathname + (u.search || '');
-      if (p.startsWith('/dashboard/settings/integrations')) return dashboardFallback;
-      if (!p.startsWith('/dashboard')) return dashboardFallback;
-      return p;
-    } catch {
-      return dashboardFallback;
+    if (!isAllowedLoginResumePath(cleaned)) {
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'return_to not allowed', { returnTo: cleaned });
     }
+    return cleaned;
   }
 
   function oauthPostLoginGlobeRedirectUrl(originBase, returnToFullUrl) {
-    let path = dashboardFallback;
+    let path;
     try {
       const u = new URL(returnToFullUrl);
       path = u.pathname + (u.search || '');
     } catch {
-      /* keep default */
-    }
-    if (!path.startsWith('/') || path.startsWith('//')) path = dashboardFallback;
-    if (path.startsWith('/dashboard/settings/integrations')) path = dashboardFallback;
-    if (!isAllowedLoginResumePath(path) && !path.startsWith('/dashboard')) {
-      path = dashboardFallback;
+      throw new IdentityRoutingError('AUTH_DESTINATION_UNRESOLVED', 'invalid returnToFullUrl');
     }
-    return `${originBase}/auth/login?globe_exit=1&next=${encodeURIComponent(path)}`;
+    path = safeLoginRedirectPath(originBase, path);
+    return `${originBase}${loginPath}?globe_exit=1&next=${encodeURIComponent(path)}`;
   }
 
   return {
     revokeIncomingCookieSession,
-    safeDashboardLoginRedirectPath,
+    safeDashboardLoginRedirectPath: safeLoginRedirectPath,
+    safeLoginRedirectPath,
     oauthPostLoginGlobeRedirectUrl,
   };
 }

package/packages/identity/src/providers/cloudflare/oauth.js

@@ -1,10 +1,9 @@
 const CLOUDFLARE_AUTH_URL = 'https://dash.cloudflare.com/oauth2/auth';
 const CLOUDFLARE_TOKEN_URL = 'https://dash.cloudflare.com/oauth2/token';
 
-// Identity-only login should not request the full resource-access scope set
-// used elsewhere for the Local Studio Cloudflare *connection* (deploy/d1/r2/etc).
-// account-settings.read is enough to resolve the account for userinfo.
-const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read offline_access';
+// Identity-only login: account identity + user details (email/name via /v4/user).
+// Do NOT request the resource-access scope set used by the Cloudflare *connection* flow.
+const CLOUDFLARE_LOGIN_SCOPE = 'account-settings.read user-details.read offline_access';
 
 /** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
 export function getCloudflareAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {

package/packages/identity/src/providers/cloudflare/profile.js

@@ -1,26 +1,61 @@
 const CLOUDFLARE_USERINFO_URL = 'https://dash.cloudflare.com/oauth2/userinfo';
+const CLOUDFLARE_API_USER_URL = 'https://api.cloudflare.com/client/v4/user';
 
 /**
  * Fetch the authenticated Cloudflare user's identity.
- * Response shape not fully verified against a live token yet — this reads
- * defensively (sub/id/user_id, email, name) rather than assuming Cloudflare's
- * exact OIDC field names. Confirm the real shape on first live login and
- * tighten this if fields differ.
+ *
+ * OIDC userinfo (`/oauth2/userinfo`) structurally returns `sub` only.
+ * Email/name require `user-details.read` and a second call to `/client/v4/user`
+ * (`data.result.*`, not top-level fields).
+ *
  * @param {string} accessToken
+ * @param {{ fetchImpl?: typeof fetch }} [opts]
  */
-export async function fetchCloudflareProfile(accessToken) {
+export async function fetchCloudflareProfile(accessToken, opts = {}) {
+  const token = String(accessToken || '').trim();
+  if (!token) return null;
+  const fetchImpl = opts.fetchImpl || fetch;
   try {
-    const res = await fetch(CLOUDFLARE_USERINFO_URL, {
-      headers: { Authorization: `Bearer ${accessToken}` },
+    const userinfoRes = await fetchImpl(CLOUDFLARE_USERINFO_URL, {
+      headers: { Authorization: `Bearer ${token}` },
     });
-    if (!res.ok) return null;
-    const data = await res.json();
-    if (!data) return null;
+    if (!userinfoRes.ok) return null;
+    const userinfo = await userinfoRes.json().catch(() => null);
+    if (!userinfo) return null;
+
+    const sub = userinfo.sub || userinfo.id || userinfo.user_id || null;
+    let email = typeof userinfo.email === 'string' ? userinfo.email : null;
+    let name = typeof userinfo.name === 'string'
+      ? userinfo.name
+      : (typeof userinfo.display_name === 'string' ? userinfo.display_name : null);
+
+    // Cloudflare userinfo does not return email/name — enrich from /v4/user.
+    if (!email || !name) {
+      try {
+        const apiRes = await fetchImpl(CLOUDFLARE_API_USER_URL, {
+          headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
+        });
+        if (apiRes.ok) {
+          const body = await apiRes.json().catch(() => null);
+          const result = body?.result && typeof body.result === 'object' ? body.result : null;
+          if (result) {
+            if (!email && typeof result.email === 'string') email = result.email;
+            if (!name && typeof result.first_name === 'string' && typeof result.last_name === 'string') {
+              name = `${result.first_name} ${result.last_name}`.trim() || null;
+            }
+            if (!name && typeof result.name === 'string') name = result.name;
+          }
+        }
+      } catch {
+        // Non-fatal: identity can proceed with sub alone.
+      }
+    }
+
     return {
-      sub: data.sub || data.id || data.user_id || data.account_id || null,
-      email: data.email || null,
-      name: data.name || data.display_name || null,
-      raw: data,
+      sub: sub || null,
+      email,
+      name,
+      raw: userinfo,
     };
   } catch {
     return null;

package/packages/identity/src/providers/iam/index.js

@@ -9,13 +9,16 @@ import {
 } from './oauth.js';
 import { fetchIamProfile } from './profile.js';
 import { normalizeIamIdentity } from './mapper.js';
-import { DEFAULT_IAM_ORIGIN } from '../../contracts/auth-config.js';
+import { resolveIamIssuer } from '../../contracts/auth-config.js';
 
 /**
- * @param {string} [origin]
+ * @param {string} origin Absolute IAM issuer origin (required — no DEFAULT_*).
  */
-export function createIamIdentityProvider(origin = DEFAULT_IAM_ORIGIN) {
-  const resolvedOrigin = String(origin || DEFAULT_IAM_ORIGIN).replace(/\/+$/, '');
+export function createIamIdentityProvider(origin) {
+  const resolvedOrigin = String(origin || '').replace(/\/+$/, '');
+  if (!resolvedOrigin) {
+    throw new Error('IAM_OAUTH_ISSUER is required to create the IAM identity provider');
+  }
   return createIdentityProvider({
     id: 'iam',
     authorizeUrl: (input) => getIamAuthUrl({ ...input, origin: resolvedOrigin }),
@@ -25,7 +28,26 @@ export function createIamIdentityProvider(origin = DEFAULT_IAM_ORIGIN) {
   });
 }
 
-export const IamProvider = createIamIdentityProvider();
+/**
+ * Registry singleton — resolves IAM_OAUTH_ISSUER from env/input at call time.
+ * No baked-in product host.
+ */
+export const IamProvider = createIdentityProvider({
+  id: 'iam',
+  authorizeUrl: (input) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return getIamAuthUrl({ ...input, origin });
+  },
+  exchangeCode: (input) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return exchangeIamCode({ ...input, origin });
+  },
+  getProfile: (accessToken, input = {}) => {
+    const origin = resolveIamIssuer(input?.env || process.env, input?.origin || input?.issuer || '');
+    return fetchIamProfile({ origin, accessToken });
+  },
+  normalizeIdentity: normalizeIamIdentity,
+});
 
 export {
   getIamAuthUrl,

package/packages/identity/src/server/identity-service.js

@@ -1,33 +1,48 @@
-import { AUTH_COOKIE_NAME, AUTH_SESSION_TTL_SECONDS } from '../core/constants.js';
+import { AUTH_COOKIE_NAME, SESSION_POLICY } from '../core/constants.js';
 import { hashPassword, verifyPassword } from '../core/password-crypto.js';
 import { jsonResponse } from '../core/http-json.js';
-import { sanitizeBrowserNextPath } from '../core/browser-paths.js';
+import { resolvePostAuthDestination } from './post-auth.js';
+import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { newAuthUserId } from '../adapters/cloudflare-d1/ids.js';
 
 /**
- * @typedef {ReturnType<import('../adapters/cloudflare-d1/index.js').createCloudflareD1Adapter>} IdentityStorageAdapter
+ * @typedef {import('../contracts/identity-store.js').IdentityStore} IdentityStore
  */
 
 /**
  * Server-side identity orchestration (Worker / Node). No secrets in client bundle.
- * @param {{ adapter: IdentityStorageAdapter, cookieName?: string, defaultRedirect?: string }} config
+ * Hosts must supply `app` + `routeRegistry` — no platform "/" fallback.
+ *
+ * @param {{
+ *   adapter: IdentityStore,
+ *   cookieName?: string,
+ *   app: { id: string },
+ *   routeRegistry: ReturnType<import('../contracts/route-projection.js').createRouteRegistry>,
+ * }} config
  */
 export function createIdentityService(config) {
   const adapter = config.adapter;
   if (!adapter) throw new Error('identity_service_requires_adapter');
   const cookieName = config.cookieName || AUTH_COOKIE_NAME;
-  // Direct sign-in has no navigation intent to restore. Land at the site root;
-  // protected routes always provide their own validated `next` path.
-  const defaultRedirect = sanitizeBrowserNextPath(config.defaultRedirect) || '/';
+  const app = config.app || null;
+  const routeRegistry = config.routeRegistry || null;
+  if (!app?.id || !routeRegistry) {
+    throw new IdentityRoutingError(
+      'AUTH_APP_UNRESOLVED',
+      'createIdentityService requires app + routeRegistry (no platform fallback)',
+    );
+  }
+  routeRegistry.assertAuthCapable(app.id);
 
-  // OAuth state is durable and may outlive a deployment. Normalize both the
-  // incoming request value and a value read back from prior state so an old or
-  // malformed value can never become an open redirect.
   function resolvePostLoginPath(nextPath) {
-    return sanitizeBrowserNextPath(nextPath) || defaultRedirect;
+    return resolvePostAuthDestination({
+      transaction: { return_to: nextPath, app_id: app.id },
+      app,
+      routeRegistry,
+    });
   }
 
-  function sessionCookieHeader(sessionId, requestUrl, maxAge = AUTH_SESSION_TTL_SECONDS) {
+  function sessionCookieHeader(sessionId, requestUrl, maxAge = SESSION_POLICY.browser.ttlSeconds) {
     const secure = new URL(requestUrl).protocol === 'https:';
     const parts = [
       `${cookieName}=${sessionId}`,
@@ -46,9 +61,16 @@ export function createIdentityService(config) {
     return match ? decodeURIComponent(match[1]) : null;
   }
 
+  function parseBearerSessionId(authorization) {
+    const match = String(authorization || '').match(/^Bearer\s+([^\s]+)$/i);
+    return match ? match[1] : null;
+  }
+
   return Object.freeze({
     cookieName,
-    defaultRedirect,
+    app,
+    routeRegistry,
+    defaultRedirect: resolvePostLoginPath(null),
 
     async signup({ email, password, displayName }) {
       const normalized = String(email || '').trim().toLowerCase();
@@ -91,7 +113,8 @@ export function createIdentityService(config) {
     },
 
     async sessionFromRequest(request) {
-      const sessionId = parseSessionId(request.headers.get('Cookie'));
+      const sessionId = parseBearerSessionId(request.headers.get('Authorization'))
+        || parseSessionId(request.headers.get('Cookie'));
       if (!sessionId) return null;
       const session = await adapter.getSession(sessionId);
       if (!session) return null;
@@ -101,7 +124,8 @@ export function createIdentityService(config) {
     },
 
     async logout(request) {
-      const sessionId = parseSessionId(request.headers.get('Cookie'));
+      const sessionId = parseBearerSessionId(request.headers.get('Authorization'))
+        || parseSessionId(request.headers.get('Cookie'));
       if (sessionId) await adapter.revokeSession(sessionId);
       return { ok: true };
     },
@@ -135,6 +159,28 @@ export function createIdentityService(config) {
       return { ok: true, authUserId: user.id, sessionId: session.id, session };
     },
 
+    isNativeSessionRequest(request) {
+      const marker = String(request?.headers?.get?.('X-AgentSam-Native-Client') || '').toLowerCase();
+      return marker === '1' || marker === 'true' || marker === 'native';
+    },
+
+    buildNativeLoginSuccessResponse(result, nextPath) {
+      const redirect = resolvePostLoginPath(nextPath);
+      return jsonResponse({
+        ok: true,
+        redirect,
+        session_id: result.sessionId,
+        expires_at: result.session?.expires_at ?? null,
+        user: result.user
+          ? {
+              id: result.user.id,
+              email: result.user.email,
+              displayName: result.user.display_name ?? null,
+            }
+          : null,
+      });
+    },
+
     buildLoginSuccessResponse(request, sessionId, nextPath) {
       const redirect = resolvePostLoginPath(nextPath);
       return jsonResponse(

package/packages/identity/src/server/mount-policy.js

@@ -0,0 +1,30 @@
+/**
+ * Mount-level auth policy helpers (host applies; identity does not invent mounts).
+ */
+
+/**
+ * @typedef {{ path: string, auth?: 'required'|'optional'|'public', spa?: boolean, shell?: string }} AppMount
+ */
+
+export function pathMatchesMount(pathname, mount) {
+  const base = String(mount?.path || '');
+  if (!base) return false;
+  const path = String(pathname || '');
+  return path === base || path.startsWith(`${base}/`);
+}
+
+export function resolveMountForPath(pathname, app) {
+  const mounts = Array.isArray(app?.routes?.mounts) ? app.routes.mounts : [];
+  let best = null;
+  for (const mount of mounts) {
+    if (!pathMatchesMount(pathname, mount)) continue;
+    if (!best || String(mount.path).length > String(best.path).length) best = mount;
+  }
+  return best;
+}
+
+export function mountRequiresAuth(pathname, app) {
+  const mount = resolveMountForPath(pathname, app);
+  if (!mount) return false;
+  return (mount.auth || 'public') === 'required';
+}