@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.5

package/packages/connectors/cloudflare/tests/connector.test.mjs

@@ -52,16 +52,7 @@ describe('cloudflare connector', () => {
   });
 
   it('keeps connector return paths same-origin', async () => {
-    const calls = [];
-    const DB = {
-      prepare(sql) {
-        return {
-          args: [],
-          bind(...args) { this.args = args; return this; },
-          async run() { calls.push({ sql, args: this.args }); return { success: true }; },
-        };
-      },
-    };
+    const oauthState = new Map();
     const response = await handleCloudflareConnectionRequest(
       new Request('https://agentsam.example/api/connections/cloudflare/start?return_to=https://untrusted.example/after', {
         headers: {
@@ -70,19 +61,17 @@ describe('cloudflare connector', () => {
         },
       }),
       {
-        DB,
+        oauthState,
         fixtureSessions: new Map([['fixture', 'user_123']]),
         CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
       },
     );
     assert.equal(response.status, 200);
-    assert.equal(
-      calls.some((call) => call.sql.includes('DELETE FROM agentsam_cloudflare_oauth_state WHERE created_at < unixepoch() - 600')),
-      true,
-    );
-    const stateInsert = calls.find((call) => call.sql.includes('INSERT INTO agentsam_cloudflare_oauth_state'));
-    assert.ok(stateInsert);
-    assert.equal(stateInsert.args.at(-1), null);
+    const body = await response.json();
+    assert.equal(body.ok, true);
+    assert.equal(oauthState.size, 1);
+    const stored = [...oauthState.values()][0];
+    assert.equal(stored.returnTo, '');
   });
 
   it('redirects browser starts to Cloudflare authorization', async () => {
@@ -108,9 +97,15 @@ describe('cloudflare connector', () => {
   });
 
   it('consumes callback state and stores only encrypted OAuth tokens', async () => {
-    const now = Math.floor(Date.now() / 1000);
     const calls = [];
-    const statements = [];
+    const oauthState = new Map([
+      ['state_123', {
+        ownerId: 'user_123',
+        verifier: 'verifier',
+        returnTo: '',
+        createdAt: Math.floor(Date.now() / 1000),
+      }],
+    ]);
     const DB = {
       prepare(sql) {
         const statement = {
@@ -121,9 +116,6 @@ describe('cloudflare connector', () => {
             return this;
           },
           async first() {
-            if (sql.includes('agentsam_cloudflare_oauth_state')) {
-              return { owner_id: 'user_123', code_verifier: 'verifier', created_at: now };
-            }
             return null;
           },
           async run() {
@@ -131,7 +123,6 @@ describe('cloudflare connector', () => {
             return { success: true };
           },
         };
-        statements.push(statement);
         return statement;
       },
       async batch(batchStatements) {
@@ -146,7 +137,7 @@ describe('cloudflare connector', () => {
       return new Response(JSON.stringify({
         access_token: 'access-plaintext',
         refresh_token: 'refresh-plaintext',
-        account_id: 'account_123',
+        account_id: 'abc123abc123abc123abc123abc123ab',
         scope: 'd1.read workers-scripts.write',
         expires_in: 3600,
       }), { status: 200, headers: { 'content-type': 'application/json' } });
@@ -157,6 +148,7 @@ describe('cloudflare connector', () => {
         new Request('https://agentsam.example/api/connections/cloudflare/callback?code=code_123&state=state_123'),
         {
           DB,
+          oauthState,
           CLOUDFLARE_OAUTH_CLIENT_ID: 'real-client-id',
           CLOUDFLARE_OAUTH_CLIENT_SECRET: 'obsolete-secret-must-not-be-sent',
           VAULT_MASTER_KEY: '01234567890123456789012345678901',
@@ -167,11 +159,15 @@ describe('cloudflare connector', () => {
         response.headers.get('location'),
         'https://agentsam.example/settings/integrations?connection=cloudflare&result=connected',
       );
-      assert.equal(calls.some((call) => call.sql.includes('DELETE FROM agentsam_cloudflare_oauth_state')), true);
-      const insert = calls.find((call) => call.sql.includes('INSERT INTO agentsam_cloudflare_connections'));
-      assert.ok(insert);
-      assert.notEqual(insert.args[4], 'access-plaintext');
-      assert.notEqual(insert.args[5], 'refresh-plaintext');
+      assert.equal(oauthState.has('state_123'), false);
+      const insert = calls.find((call) => call.sql.includes('INSERT INTO user_oauth_tokens'));
+      assert.ok(insert, 'expected user_oauth_tokens insert (SSOT)');
+      // With vault: plaintext args are null; ciphertext is not plaintext tokens.
+      assert.equal(insert.args[3], null); // access_token plaintext
+      assert.equal(insert.args[4], null); // refresh_token plaintext
+      assert.notEqual(insert.args[5], 'access-plaintext'); // access_token_encrypted
+      assert.notEqual(insert.args[6], 'refresh-plaintext'); // refresh_token_encrypted
+      assert.equal(calls.some((call) => call.sql.includes('agentsam_cloudflare_connections')), false);
     } finally {
       globalThis.fetch = originalFetch;
     }

package/packages/connectors/cloudflare/tests/oauth-persist.test.mjs

@@ -0,0 +1,125 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  resolveCloudflareAccountId,
+  unionScopes,
+  upsertCloudflareUserOauthToken,
+} from '../src/oauth-persist.js';
+
+describe('oauth-persist spine', () => {
+  it('unions scopes without duplicates', () => {
+    assert.deepEqual(
+      unionScopes(['d1.read', 'offline_access'], ['d1.read', 'workers-scripts.write']).sort(),
+      ['d1.read', 'offline_access', 'workers-scripts.write'].sort(),
+    );
+  });
+
+  it('requires explicit selection when Cloudflare exposes multiple accounts', async () => {
+    const result = await resolveCloudflareAccountId('token', {
+      fetchImpl: async () => ({
+        ok: true,
+        async json() {
+          return {
+            result: [
+              { id: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', name: 'A' },
+              { id: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb', name: 'B' },
+            ],
+          };
+        },
+      }),
+    });
+    assert.equal(result?.error, 'cloudflare_account_selection_required');
+    assert.equal(result?.accounts?.length, 2);
+  });
+
+  it('rejects provider labels and synthetic values as account identifiers', async () => {
+    const result = await upsertCloudflareUserOauthToken(
+      { DB: { prepare() { throw new Error('should not query'); } } },
+      { userId: 'au_1', accessToken: 'token', accountId: 'Cloudflare' },
+    );
+    assert.equal(result.ok, false);
+    assert.equal(result.error, 'cloudflare_account_identifier_required');
+  });
+
+  it('upserts with client_id provenance and scope union (no connected_via_app)', async () => {
+    const rows = new Map();
+    const sqlSeen = [];
+    const env = {
+      VAULT_MASTER_KEY: 'test-vault-material',
+      DB: {
+        prepare(sql) {
+          sqlSeen.push(String(sql));
+          return {
+            bind(...args) {
+              return {
+                async first() {
+                  if (String(sql).includes('SELECT')) {
+                    return rows.get(`${args[0]}|${args[2]}`) || null;
+                  }
+                  return null;
+                },
+                async run() {
+                  if (String(sql).includes('INSERT')) {
+                    // Encrypted-only path: plaintext [3]/[4] are null; ciphertext [5]/[6].
+                    const key = `${args[0]}|${args[2]}`;
+                    const prior = rows.get(key);
+                    rows.set(key, {
+                      scopes: args[7],
+                      scope: args[7],
+                      metadata_json: args[11],
+                      access_token: args[3],
+                      refresh_token: args[4],
+                      created_at: prior?.created_at || args[12],
+                    });
+                  }
+                  return { success: true };
+                },
+              };
+            },
+          };
+        },
+      },
+    };
+
+    const r1 = await upsertCloudflareUserOauthToken(env, {
+      userId: 'au_1',
+      accessToken: 'tok1',
+      scopes: 'd1.read offline_access',
+      accountId: 'abc123abc123abc123abc123abc123ab',
+      clientId: 'c0704bd7a7aab7216b362603e1985499',
+      capabilitySet: ['cloudflare.d1'],
+    });
+    assert.equal(r1.ok, true);
+    assert.equal(r1.status, 'connected');
+    assert.equal(r1.provenance.connected_via_client_id, 'c0704bd7a7aab7216b362603e1985499');
+    assert.equal(r1.provenance.connected_via_app, undefined);
+
+    rows.set('au_1|abc123abc123abc123abc123abc123ab', {
+      scopes: 'd1.read offline_access',
+      scope: 'd1.read offline_access',
+      metadata_json: JSON.stringify({
+        cloudflare_account_id: 'abc123abc123abc123abc123abc123ab',
+        connected_via_client_id: 'c0704bd7a7aab7216b362603e1985499',
+        connected_via_app: 'should_be_stripped',
+      }),
+      access_token: 'tok1',
+      refresh_token: null,
+      created_at: 1,
+    });
+
+    const r2 = await upsertCloudflareUserOauthToken(env, {
+      userId: 'au_1',
+      accessToken: 'tok2',
+      scopes: 'workers-scripts.write',
+      accountId: 'abc123abc123abc123abc123abc123ab',
+      clientId: 'c0704bd7a7aab7216b362603e1985499',
+      capabilitySet: ['cloudflare.workers'],
+    });
+    assert.equal(r2.ok, true);
+    assert.ok(r2.scopes.includes('d1.read'));
+    assert.ok(r2.scopes.includes('workers-scripts.write'));
+    const upsertSql = sqlSeen.find((sql) => sql.includes('ON CONFLICT(user_id, provider, account_identifier)'));
+    assert.match(upsertSql || '', /last_refresh_error_code = NULL/);
+    assert.match(upsertSql || '', /refresh_failure_count = 0/);
+  });
+});

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -35,7 +35,27 @@
       "required_configuration": [
         "GOOGLE_CLIENT_ID",
         "GOOGLE_CLIENT_SECRET"
-      ]
+      ],
+      "notes": "Web browser OAuth (confidential client). For Desktop/CLI PKCE use google_desktop."
+    },
+    {
+      "id": "google_desktop",
+      "aliases": ["google-desktop"],
+      "kind": "oauth",
+      "status": "ready",
+      "implementation": "src/providers/google",
+      "capabilities": [
+        "identity.oauth.authorize",
+        "identity.oauth.desktop_exchange",
+        "identity.profile.resolve"
+      ],
+      "required_configuration": [
+        "GOOGLE_DESKTOP_CLIENT_ID"
+      ],
+      "optional_configuration": [
+        "GOOGLE_DESKTOP_CLIENT_SECRET"
+      ],
+      "notes": "Desktop/public PKCE client (Console type Desktop app — no secret). Worker brokers POST /api/oauth/google/desktop-exchange for loopback redirects. Optional GOOGLE_DESKTOP_CLIENT_SECRET only if the client id was mis-typed as Web."
     },
     {
       "id": "github",
@@ -90,7 +110,7 @@
       "optional_configuration": [
         "CLOUDFLARE_OAUTH_CLIENT_SECRET"
       ],
-      "notes": "Registered in identityProviders. Client secret optional for PKCE-only clients."
+      "notes": "Cloudflare sign-in (same Worker secrets as the Cloudflare resource connector). Client secret optional for PKCE-only clients (Token Authentication Method = None)."
     }
   ]
 }

package/packages/identity/.agentsam/features/oauth-login-portal/resources.json

@@ -4,13 +4,19 @@
   "engine": "d1",
   "migration_sources": [
     "src/migrations/0001_identity_core.sql",
-    "src/migrations/0002_company.sql"
+    "src/migrations/0002_company.sql",
+    "src/migrations/0003_accounts_ssot.sql"
   ],
-  "notes": "Migration files remain the schema authority. This JSON is an index/contract only.",
+  "notes": "Migration files remain the schema authority. accounts is the account SSOT; account_identities is IdP linkage only.",
   "tables": [
+    {
+      "name": "accounts",
+      "purpose": "account SSOT (row of record)",
+      "source": "src/migrations/0001_identity_core.sql"
+    },
     {
       "name": "auth_users",
-      "purpose": "canonical user identity",
+      "purpose": "login principal (1:1 with accounts.id in portable scaffold)",
       "source": "src/migrations/0001_identity_core.sql"
     },
     {
@@ -21,7 +27,7 @@
     },
     {
       "name": "account_identities",
-      "purpose": "external identity/provider mapping",
+      "purpose": "IdP linkage only (provider + subject → accounts.id) — not the account SSOT",
       "owner_column": "account_id",
       "source": "src/migrations/0001_identity_core.sql"
     },

package/packages/identity/.agentsam/features/oauth-login-portal/routes.json

@@ -39,12 +39,32 @@
       "access": "public",
       "provider": "google"
     },
+    {
+      "path": "/api/oauth/google/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "google"
+    },
+    {
+      "path": "/api/oauth/google/desktop-exchange",
+      "method": "POST",
+      "kind": "api",
+      "access": "public",
+      "provider": "google_desktop",
+      "notes": "CLI/desktop PKCE broker — loopback redirect_uri only"
+    },
     {
       "path": "/api/oauth/github/start",
       "kind": "api",
       "access": "public",
       "provider": "github"
     },
+    {
+      "path": "/api/oauth/github/callback",
+      "kind": "api",
+      "access": "public",
+      "provider": "github"
+    },
     {
       "path": "/api/oauth/inneranimalmedia/start",
       "kind": "api",

package/packages/identity/README.md

@@ -20,7 +20,7 @@ identity.login(request);   // alpha: throws until Identity Service adapter is wi
 identity.session.fromRequest(request);  // alpha: throws until adapter is wired
 ```
 
-**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. Developer Google/GitHub BYOK still supported when those env pairs are set.
+**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. BYOK options: Google web, Google Desktop (`GOOGLE_DESKTOP_CLIENT_ID`), GitHub, Cloudflare (`CLOUDFLARE_OAUTH_CLIENT_*`). **Account SSOT:** `accounts` (not `account_identities` — that table is IdP linkage only).
 
 ## Layout
 

package/packages/identity/backend/README.md

@@ -11,7 +11,7 @@ Worker-side identity: providers, OAuth finalize, sessions, adapters.
 | `oauth/callback.js` | `src/core/auth/oauth-finalize.js` → `finalizeInboundOAuth` | **bulletproof path** |
 | `oauth/authorize.js` | `src/api/auth.js` OAuth start handlers | PKCE + state — next sprint |
 | `core/session-service.js` | `src/core/auth.js` | cookie, `createLoginSession`, revoke |
-| `core/account-linking.js` | `ensureIdentityPlaneBeforeSession`, `ensureAppUser` | account_identities |
+| `core/account-linking.js` | `ensureIdentityPlaneBeforeSession`, `ensureAppUser` | **accounts** SSOT + account_identities (IdP link) |
 | `adapters/inneranimalmedia/*` | D1 writes in auth side-effects | tenant/workspace stays adapter-only |
 
 ## Rule

package/packages/identity/migrations/D1_SCHEMA_MAPPING.md

@@ -5,8 +5,9 @@ The D1 adapter maps existing hosted table names without requiring a big-bang ren
 
 | Portable (SQLite) | Hosted D1 (current) | Notes |
 |---|---|---|
-| `identity_users` | `auth_users` | Same columns |
-| `identity_external_accounts` | `account_identities` | `user_id` ↔ `account_id` |
+| `identity_users` / account plane | **`accounts`** | **Account SSOT** — row of record |
+| login principal | `auth_users` | 1:1 with `accounts.id` in portable scaffold |
+| `identity_external_accounts` | `account_identities` | IdP linkage only (`account_id` → `accounts.id`) — never the account SSOT |
 | `identity_sessions` | `auth_sessions` | Same columns |
 | `identity_auth_events` | `auth_event_log` | Same columns |
 | `identity_oauth_transactions` | `identity_oauth_states` → migrate to `identity_oauth_transactions` | Requires `app_id NOT NULL`; no silent pre-app_id fallback |

package/packages/identity/migrations/sqlite/004_identity_oauth_consent_catalog.sql

@@ -0,0 +1,48 @@
+-- identity.oauth-server consent catalog.
+-- Issuer branding remains owned by the portable company table.
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_consent_catalog', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_resources (
+  id TEXT PRIMARY KEY NOT NULL,
+  audience TEXT NOT NULL UNIQUE,
+  resource_type TEXT NOT NULL DEFAULT 'mcp',
+  display_name TEXT NOT NULL,
+  description TEXT,
+  logo_url TEXT,
+  homepage_url TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  is_active INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_scopes (
+  scope TEXT PRIMARY KEY NOT NULL,
+  label TEXT NOT NULL,
+  description TEXT NOT NULL,
+  category TEXT NOT NULL DEFAULT 'general',
+  sensitivity TEXT NOT NULL DEFAULT 'normal'
+    CHECK (sensitivity IN ('normal','elevated','sensitive')),
+  is_active INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  sort_order INTEGER NOT NULL DEFAULT 50,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_resource_scopes (
+  resource_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  required INTEGER NOT NULL DEFAULT 0 CHECK (required IN (0,1)),
+  sort_order INTEGER NOT NULL DEFAULT 50,
+  PRIMARY KEY (resource_id, scope),
+  FOREIGN KEY (resource_id) REFERENCES identity_oauth_resources(id) ON DELETE CASCADE,
+  FOREIGN KEY (scope) REFERENCES identity_oauth_scopes(scope) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_resources_active
+  ON identity_oauth_resources(is_active, resource_type);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_resource_scopes_sort
+  ON identity_oauth_resource_scopes(resource_id, sort_order, scope);

package/packages/identity/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.4",
+  "version": "2.6.5",
   "private": true,
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",
@@ -29,7 +29,8 @@
     "./contracts/auth-config": "./src/contracts/auth-config.js",
     "./oauth/callback": "./src/oauth/callback.js",
     "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
-    "./providers/cloudflare": "./src/providers/cloudflare/index.js"
+    "./providers/cloudflare": "./src/providers/cloudflare/index.js",
+    "./oauth/consent-view": "./src/oauth/consent-view.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",

package/packages/identity/scripts/local-identity-bridge.mjs

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { DatabaseSync } from 'node:sqlite';
+import {
+  applySqliteIdentityMigrations,
+  createSqliteIdentityAdapter,
+} from '../src/adapters/sqlite/index.js';
+import {
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from '../src/contracts/route-projection.js';
+import { createIdentityService } from '../src/server/identity-service.js';
+import { hashPassword } from '../src/core/password-crypto.js';
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => { body += chunk; });
+    process.stdin.on('end', () => {
+      try { resolve(body.trim() ? JSON.parse(body) : {}); }
+      catch (error) { reject(error); }
+    });
+    process.stdin.on('error', reject);
+  });
+}
+
+function wrapDatabase(database, filePath) {
+  return {
+    filePath,
+    prepare(sql) {
+      const statement = database.prepare(sql);
+      const bound = (values = []) => ({
+        async run() { return statement.run(...values); },
+        async first() { return statement.get(...values) ?? null; },
+        async all() { return { results: statement.all(...values) }; },
+      });
+      return {
+        bind(...values) { return bound(values); },
+        async run() { return statement.run(); },
+        async first() { return statement.get() ?? null; },
+        async all() { return { results: statement.all() }; },
+      };
+    },
+    exec(sql) { database.exec(sql); },
+    close() { database.close(); },
+  };
+}
+
+function sanitizeUser(user) {
+  if (!user) return null;
+  return {
+    id: user.id,
+    email: user.email,
+    display_name: user.display_name ?? null,
+    status: user.status ?? null,
+  };
+}
+
+const request = await readStdin();
+const dbPath = path.resolve(
+  process.env.AGENTSAM_IDENTITY_DB || '.agentsam/data/local-studio-identity.sqlite',
+);
+const manifestPath = path.resolve(
+  process.env.AGENTSAM_IDENTITY_APP_MANIFEST
+    || new URL('../../../apps/local-studio/agentsam.app.json', import.meta.url).pathname,
+);
+
+fs.mkdirSync(path.dirname(dbPath), { recursive: true, mode: 0o700 });
+const nativeDb = new DatabaseSync(dbPath);
+try {
+  if (process.platform !== 'win32') {
+    try { fs.chmodSync(dbPath, 0o600); } catch {}
+  }
+  const db = wrapDatabase(nativeDb, dbPath);
+  await applySqliteIdentityMigrations(db);
+  const adapter = createSqliteIdentityAdapter(db);
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const routeRegistry = createRouteRegistry([projectionFromAppManifest(manifest)]);
+  const identity = createIdentityService({
+    adapter,
+    app: { id: manifest.id },
+    routeRegistry,
+  });
+
+  let result;
+  switch (request.op) {
+    case 'status': {
+      const sessionId = String(request.session_id || '').trim();
+      if (!sessionId) {
+        result = { ok: true, authenticated: false, user: null };
+        break;
+      }
+      const session = await identity.sessionFromRequest(new Request('http://local.identity/session', {
+        headers: { Authorization: `Bearer ${sessionId}` },
+      }));
+      result = {
+        ok: true,
+        authenticated: Boolean(session),
+        user: sanitizeUser(session?.user),
+      };
+      break;
+    }
+
+    case 'login': {
+      const login = await identity.loginWithPassword({
+        email: request.email,
+        password: request.password,
+      });
+      result = login.ok
+        ? {
+            ok: true,
+            authenticated: true,
+            session_id: login.sessionId,
+            user: sanitizeUser(login.user),
+            redirect: identity.resolvePostLoginPath(request.next || null),
+          }
+        : login;
+      break;
+    }
+
+    case 'signup': {
+      const signup = await identity.signup({
+        email: request.email,
+        password: request.password,
+        displayName: request.display_name,
+      });
+      result = signup.ok
+        ? {
+            ok: true,
+            authenticated: true,
+            session_id: signup.sessionId,
+            user: sanitizeUser(signup.user),
+            redirect: identity.resolvePostLoginPath(request.next || null),
+          }
+        : signup;
+      break;
+    }
+
+    case 'logout': {
+      const sessionId = String(request.session_id || '').trim();
+      if (sessionId) {
+        await identity.logout(new Request('http://local.identity/logout', {
+          headers: { Authorization: `Bearer ${sessionId}` },
+        }));
+      }
+      result = { ok: true };
+      break;
+    }
+
+    case 'reset_password': {
+      const email = String(request.email || '').trim().toLowerCase();
+      const password = String(request.password || '');
+      if (!email || password.length < 8) {
+        result = { ok: false, error: 'email_and_valid_password_required' };
+        break;
+      }
+      const user = await adapter.findUserByEmail(email);
+      if (!user) {
+        result = { ok: false, error: 'account_not_found' };
+        break;
+      }
+      const { saltHex, hashHex } = await hashPassword(password);
+      await adapter.updateUserPassword(user.id, hashHex, saltHex);
+      result = { ok: true };
+      break;
+    }
+
+    default:
+      result = { ok: false, error: 'unsupported_identity_operation' };
+  }
+
+  process.stdout.write(JSON.stringify(result));
+} catch (error) {
+  process.stdout.write(JSON.stringify({
+    ok: false,
+    error: error?.message || String(error),
+  }));
+  process.exitCode = 1;
+} finally {
+  try { nativeDb.close(); } catch {}
+}

package/packages/identity/scripts/preview-auth-portal.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Local static preview for IAM auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
+ * Local static preview for the portable AgentSam auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
  * API routes are stubbed so forms and globe-exit transitions work without a Worker.
  */
 import http from 'node:http';
@@ -119,14 +119,14 @@ function hubHtml(baseUrl) {
 const PREVIEW_COMPANY = {
   id: 'co_default',
   slug: 'default',
-  name: 'Inner Animal Media',
-  legalName: 'Inner Animals LLC',
-  logoUrl: 'https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public',
-  faviconUrl: 'https://inneranimalmedia.com/favicon.ico',
+  name: 'AgentSam',
+  legalName: 'AgentSam',
+  logoUrl: '/shared/agentsam-mark.svg',
+  faviconUrl: null,
   primaryColor: '#007AFF',
   authBgColor: '#050508',
-  supportEmail: 'hey@inneranimalmedia.com',
-  websiteUrl: 'https://inneranimalmedia.com',
+  supportEmail: 'support@agentsam.dev',
+  websiteUrl: 'https://agentsam.dev',
   tagline: 'Instant Access',
   meta: {
     privacyUrl: '/privacy',