@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.5

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -133,6 +133,11 @@ export function createCloudflareD1Adapter(db, options = {}) {
       const id = newAuthUserId();
       const ts = nowUnix();
       const normalizedEmail = String(email || '').trim().toLowerCase();
+      // accounts = SSOT; auth_users = login principal (1:1 id in portable scaffold).
+      await db.prepare(
+        `INSERT INTO accounts (id, email, display_name, status, created_at, updated_at)
+         VALUES (?, ?, ?, 'active', ?, ?)`,
+      ).bind(id, normalizedEmail, displayName || null, ts, ts).run();
       await db.prepare(
         `INSERT INTO auth_users (id, email, display_name, password_hash, salt, status, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`,
@@ -145,24 +150,48 @@ export function createCloudflareD1Adapter(db, options = {}) {
       await db.prepare(
         `UPDATE auth_users SET password_hash = ?, salt = ?, updated_at = ? WHERE id = ?`,
       ).bind(passwordHash, salt, ts, userId).run();
+      await db.prepare(
+        `UPDATE accounts SET updated_at = ? WHERE id = ?`,
+      ).bind(ts, userId).run().catch(() => {});
     },
 
     async findUserByProvider(provider, providerSubject) {
       const row = await db.prepare(
         `SELECT u.id, u.email, u.display_name, u.password_hash, u.salt, u.status, u.created_at, u.updated_at
          FROM account_identities ai
-         JOIN auth_users u ON u.id = ai.account_id
+         JOIN accounts a ON a.id = ai.account_id
+         JOIN auth_users u ON u.id = a.id
          WHERE ai.provider = ? AND ai.provider_subject = ?
+           AND COALESCE(a.status, 'active') = 'active'
          LIMIT 1`,
       ).bind(provider, providerSubject).first();
       return row || null;
     },
 
     async upsertProviderIdentity({ accountId, provider, providerSubject, email }) {
+      // Ensure SSOT account row exists (OAuth may create identity before password user).
+      const ts = nowUnix();
+      const account = await db.prepare(
+        `SELECT id FROM accounts WHERE id = ? LIMIT 1`,
+      ).bind(accountId).first();
+      if (!account?.id) {
+        const authUser = await this.findUserById(accountId);
+        if (!authUser) throw new Error('account_ssot_missing');
+        await db.prepare(
+          `INSERT INTO accounts (id, email, display_name, status, created_at, updated_at)
+           VALUES (?, ?, ?, 'active', ?, ?)`,
+        ).bind(
+          accountId,
+          authUser.email,
+          authUser.display_name || null,
+          authUser.created_at || ts,
+          ts,
+        ).run();
+      }
+
       const existing = await db.prepare(
         `SELECT id FROM account_identities WHERE provider = ? AND provider_subject = ? LIMIT 1`,
       ).bind(provider, providerSubject).first();
-      const ts = nowUnix();
       if (existing?.id) {
         await db.prepare(
           `UPDATE account_identities SET account_id = ?, email = ?, updated_at = ? WHERE id = ?`,

package/packages/identity/src/adapters/sqlite/index.js

@@ -23,7 +23,10 @@ export async function applySqliteIdentityMigrations(db, opts = {}) {
     '001_identity_core.sql',
     '002_identity_oauth_client.sql',
   ];
-  if (opts.includeOAuthServer) files.push('003_identity_oauth_server.sql');
+  if (opts.includeOAuthServer) {
+    files.push('003_identity_oauth_server.sql');
+    files.push('004_identity_oauth_consent_catalog.sql');
+  }
 
   for (const file of files) {
     const sql = fs.readFileSync(path.join(SQLITE_MIGRATIONS_DIR, file), 'utf8');

package/packages/identity/src/contracts/auth-config.js

@@ -4,12 +4,13 @@
  * Browser login sessions and reusable API credentials are intentionally
  * separate: login sessions are opaque, machine-local session state while
  * AGENTSAM_API_KEY is an explicit delegated account credential.
+ *
+ * Namespaces (do not collapse):
+ *   PLATFORM issuer  → IAM_OAUTH_ISSUER (account API)
+ *   APP host         → agentsam.app.json hosts[] (e.g. local-studio)
+ * Never treat Local Studio host origin as an alias of IAM_OAUTH_ISSUER.
  */
 
-export const DEFAULT_IAM_OAUTH_ISSUER = 'https://inneranimalmedia.com';
-/** @deprecated Use DEFAULT_IAM_OAUTH_ISSUER. */
-export const DEFAULT_IAM_ORIGIN = DEFAULT_IAM_OAUTH_ISSUER;
-
 export const AGENTSAM_AUTH_ENV = Object.freeze({
   iamIssuer: 'IAM_OAUTH_ISSUER',
   iamOrigin: 'IAM_ORIGIN',
@@ -17,8 +18,23 @@ export const AGENTSAM_AUTH_ENV = Object.freeze({
   iamClientSecret: 'IAM_CLIENT_SECRET',
   apiKey: 'AGENTSAM_API_KEY',
   bridgeKey: 'AGENTSAM_BRIDGE_KEY',
+  googleClientId: 'GOOGLE_CLIENT_ID',
+  googleClientSecret: 'GOOGLE_CLIENT_SECRET',
+  googleDesktopClientId: 'GOOGLE_DESKTOP_CLIENT_ID',
+  googleDesktopClientSecret: 'GOOGLE_DESKTOP_CLIENT_SECRET',
+  githubClientId: 'GITHUB_CLIENT_ID',
+  githubClientSecret: 'GITHUB_CLIENT_SECRET',
+  cloudflareOauthClientId: 'CLOUDFLARE_OAUTH_CLIENT_ID',
+  cloudflareOauthClientSecret: 'CLOUDFLARE_OAUTH_CLIENT_SECRET',
 });
 
+/**
+ * Hosted AgentSam platform compatibility issuer — not an APP host and never a
+ * portable Local Studio default. Portable apps use packages/identity locally
+ * unless an installation explicitly selects a remote IAM adapter.
+ */
+export const PLATFORM_ACCOUNT_ISSUER = 'https://inneranimalmedia.com';
+
 export const AGENTSAM_AUTH_CONTRACT = Object.freeze({
   version: 2,
   authority: 'agentsam-sdk',
@@ -27,6 +43,7 @@ export const AGENTSAM_AUTH_CONTRACT = Object.freeze({
     origin: AGENTSAM_AUTH_ENV.iamOrigin,
     clientId: AGENTSAM_AUTH_ENV.iamClientId,
     clientSecret: AGENTSAM_AUTH_ENV.iamClientSecret,
+    defaultIssuer: PLATFORM_ACCOUNT_ISSUER,
   }),
   apiKey: Object.freeze({
     env: AGENTSAM_AUTH_ENV.apiKey,
@@ -55,11 +72,14 @@ function normalizeOrigin(value) {
   return clean(value).replace(/\/+$/, '');
 }
 
-/** Resolve canonical IAM issuer. IAM_OAUTH_ISSUER wins; IAM_ORIGIN is compatibility only. */
+/**
+ * Resolve PLATFORM account issuer.
+ * Order: explicit → IAM_OAUTH_ISSUER → IAM_ORIGIN → PLATFORM_ACCOUNT_ISSUER.
+ * Does not read APP host origins.
+ */
 export function resolveIamIssuer(env = {}, explicit = '') {
-  return normalizeOrigin(
-    explicit || env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || DEFAULT_IAM_OAUTH_ISSUER,
-  );
+  return normalizeOrigin(explicit || env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || '')
+    || PLATFORM_ACCOUNT_ISSUER;
 }
 
 /** @deprecated Use resolveIamIssuer. Same resolution order as issuer. */

package/packages/identity/src/contracts/external-identity.js

@@ -1,6 +1,6 @@
 /**
  * Portable external identity shape — storage-agnostic.
- * Adapters map this into application-specific account_identities rows.
+ * Adapters map this into account_identities rows that point at accounts (SSOT).
  */
 
 /** @typedef {import('../provider-contract.js').NormalizedExternalIdentity} NormalizedExternalIdentity */

package/packages/identity/src/contracts/provider.js

@@ -3,6 +3,7 @@
 export const IdentityProviders = Object.freeze([
   'email',
   'google',
+  'google_desktop',
   'github',
   'gcp',
   'inneranimalmedia',

package/packages/identity/src/frontend/auth-portal/README.md

@@ -26,7 +26,8 @@ The CLI can now scaffold the reusable identity app surfaces directly with `agent
 - `POST /api/auth/login`
 - `POST /api/auth/signup` — create account (email/password); portal form must call this, not login
 - `GET /api/company` — public branding SSOT (loaded by `shared/company-branding.js`)
-- OAuth: `/api/oauth/google/start`, `/api/oauth/github/start`
+- OAuth: `/api/oauth/google/start`, `/api/oauth/github/start`, `/api/oauth/cloudflare/start`
+- Desktop PKCE broker: `POST /api/oauth/google/desktop-exchange` (`GOOGLE_DESKTOP_CLIENT_ID`)
 - GCP: per-client when demanded — scaffold only until requested
 
 Sensitive finalize stays server-side (`oauth/callback` → Identity Service).

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign in | Inner Animal Media</title>
+    <title>Sign in | AgentSam</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -360,12 +360,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/agentsam-mark.svg"
+      alt="AgentSam"
     />
 
     <h1 data-company-tagline>Instant Access</h1>
-    <p class="subtitle" data-company-subtitle="signin">Sign in to Inner Animal Media</p>
+    <p class="subtitle" data-company-subtitle="signin">Sign in to AgentSam</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="resetMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Password updated. Sign in with your new password.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
@@ -451,7 +451,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>AgentSam</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -824,6 +824,7 @@
     });
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/pages/reset.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Reset password | Inner Animal Media</title>
+    <title>Reset password | AgentSam</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -280,8 +280,8 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/agentsam-mark.svg"
+      alt="AgentSam"
       style="width:120px;height:120px;object-fit:contain;display:block;margin:0 auto 20px;"
     />
 
@@ -290,7 +290,7 @@
     <p class="subtitle">We'll send you a secure verification code.</p>
 
     <div class="email-note">
-        You'll receive an email from <strong data-company-support-email>hey@inneranimalmedia.com</strong>.<br>
+        You'll receive an email from <strong data-company-support-email>support@agentsam.dev</strong>.<br>
         Check your inbox and spam folder.
     </div>
 
@@ -365,7 +365,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>AgentSam</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -579,6 +579,7 @@
     }
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/pages/signup.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign up | Inner Animal Media</title>
+    <title>Sign up | AgentSam</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -398,12 +398,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/agentsam-mark.svg"
+      alt="AgentSam"
     />
 
     <h1>Create account</h1>
-    <p class="subtitle" data-company-subtitle="signup">Join Inner Animal Media</p>
+    <p class="subtitle" data-company-subtitle="signup">Join AgentSam</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
     <p id="cfConnectNotice" class="subtitle" style="color: #fdba74; display: none; margin-top: -12px; margin-bottom: 12px; font-size: 12px; line-height: 1.45; text-align: center; max-width: 320px;">Sign in with Google, GitHub, or Supabase first, then connect Cloudflare from Integrations.</p>
@@ -485,7 +485,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>AgentSam</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -835,6 +835,7 @@
     });
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/shared/company-branding.js

@@ -1,6 +1,6 @@
 /**
  * Auth portal branding from D1 `company` via GET /api/company.
- * Static HTML keeps IAM defaults as fallback when API is unavailable.
+ * Static HTML keeps portable AgentSam defaults as fallback when host branding is unavailable.
  */
 (function () {
   var SUBTITLE_PREFIX = {

package/packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js

@@ -0,0 +1,207 @@
+(function () {
+  function getInvoke() {
+    try {
+      return window.__TAURI__?.core?.invoke
+        || window.parent?.__TAURI__?.core?.invoke
+        || null;
+    } catch {
+      return null;
+    }
+  }
+
+  var invoke = getInvoke();
+  if (!invoke) return;
+
+  var APP_ID = 'local-studio';
+  var SESSION_ACCOUNT = 'identity_session';
+  var originalFetch = window.fetch.bind(window);
+
+  async function callIdentity(payload) {
+    var raw = await invoke('identity_bridge', {
+      requestJson: JSON.stringify(payload || {}),
+    });
+    var body = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    if (!body || body.ok === false) {
+      throw new Error(body?.error || 'identity_request_failed');
+    }
+    return body;
+  }
+
+  async function getSessionId() {
+    return await invoke('secure_store_get', {
+      appId: APP_ID,
+      account: SESSION_ACCOUNT,
+    });
+  }
+
+  async function setSessionId(sessionId) {
+    await invoke('secure_store_set', {
+      appId: APP_ID,
+      account: SESSION_ACCOUNT,
+      value: String(sessionId || ''),
+    });
+  }
+
+  async function clearSessionId() {
+    try {
+      await invoke('secure_store_delete', {
+        appId: APP_ID,
+        account: SESSION_ACCOUNT,
+      });
+    } catch {}
+  }
+
+  function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+      status: status || 200,
+      headers: { 'content-type': 'application/json' },
+    });
+  }
+
+  function parseBody(init) {
+    if (!init?.body) return {};
+    try {
+      return typeof init.body === 'string' ? JSON.parse(init.body) : {};
+    } catch {
+      return {};
+    }
+  }
+
+  function notifyAuthenticated(body) {
+    try {
+      window.parent?.postMessage({
+        type: 'agentsam:desktop-identity',
+        authenticated: true,
+        user: body?.user || null,
+      }, '*');
+    } catch {}
+  }
+
+  window.fetch = async function packagedIdentityFetch(input, init) {
+    var url;
+    try {
+      url = new URL(typeof input === 'string' ? input : input.url, window.location.href);
+    } catch {
+      return originalFetch(input, init);
+    }
+
+    if (url.pathname === '/api/company') {
+      return jsonResponse({
+        name: 'AgentSam',
+        tagline: 'Instant Access',
+        logoUrl: '/shared/agentsam-mark.svg',
+        authBgColor: '#050508',
+      });
+    }
+
+    if (url.pathname === '/api/auth/login') {
+      try {
+        var loginBody = parseBody(init);
+        var login = await callIdentity({
+          op: 'login',
+          email: loginBody.email,
+          password: loginBody.password,
+          next: loginBody.next || '/agentsam',
+        });
+        await setSessionId(login.session_id);
+        notifyAuthenticated(login);
+        return jsonResponse({ ok: true, user: login.user, redirect: '/agentsam' });
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 401);
+      }
+    }
+
+    if (url.pathname === '/api/auth/signup') {
+      try {
+        var signupBody = parseBody(init);
+        var signup = await callIdentity({
+          op: 'signup',
+          email: signupBody.email,
+          password: signupBody.password,
+          displayName: signupBody.name || signupBody.displayName || signupBody.display_name,
+          next: signupBody.next || '/agentsam',
+        });
+        await setSessionId(signup.session_id);
+        notifyAuthenticated(signup);
+        return jsonResponse({ ok: true, user: signup.user, redirect: '/agentsam' });
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/password-reset/request') {
+      try {
+        var requestBody = parseBody(init);
+        var requested = await callIdentity({
+          op: 'reset_request',
+          email: requestBody.email,
+        });
+        return jsonResponse(requested);
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/password-reset/confirm') {
+      try {
+        var resetBody = parseBody(init);
+        var reset = await callIdentity({
+          op: 'reset_confirm',
+          email: resetBody.email,
+          code: resetBody.code,
+          password: resetBody.password,
+          confirm_password: resetBody.confirm_password || resetBody.confirmPassword || resetBody.confirm,
+        });
+        return jsonResponse(reset);
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/logout') {
+      var sessionId = await getSessionId();
+      if (sessionId) {
+        try {
+          await callIdentity({ op: 'logout', session_id: sessionId });
+        } catch {}
+      }
+      await clearSessionId();
+      return jsonResponse({ ok: true });
+    }
+
+    return originalFetch(input, init);
+  };
+
+  function localizeAuthLinks() {
+    var map = {
+      '/auth/login': './login.html',
+      '/auth/signup': './signup.html',
+      '/auth/reset': './reset.html',
+    };
+    document.querySelectorAll('a[href]').forEach(function (link) {
+      var href = link.getAttribute('href');
+      if (!href) return;
+      var base = href.split('?')[0];
+      if (map[base]) {
+        var query = href.indexOf('?') >= 0 ? href.slice(href.indexOf('?')) : '';
+        link.setAttribute('href', map[base] + query);
+      }
+    });
+
+    // Provider OAuth belongs to installed provider adapters. Do not render
+    // decorative/dead login buttons in the packaged native surface.
+    ['googleSignIn', 'githubSignIn', 'cloudflareSignIn'].forEach(function (id) {
+      var link = document.getElementById(id);
+      if (link) link.style.display = 'none';
+    });
+    var backupToggle = document.getElementById('backupCodeToggle');
+    if (backupToggle) {
+      var backupPrompt = backupToggle.closest('p');
+      if (backupPrompt) backupPrompt.style.display = 'none';
+      else backupToggle.style.display = 'none';
+    }
+  }
+
+  window.addEventListener('DOMContentLoaded', localizeAuthLinks);
+  window.__AGENTSAM_DESKTOP_IDENTITY__ = true;
+})();

package/packages/identity/src/index.js

@@ -66,12 +66,28 @@ export {
 } from './server/post-auth.js';
 export { verifyAppAuthContract, verifyAppPackage } from './app/verify-app.js';
 export { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from './contracts/company.js';
+export {
+  buildOAuthConsentView,
+  normalizeOAuthConsentCompany,
+  normalizeOAuthConsentResource,
+  normalizeOAuthConsentClient,
+  normalizeOAuthConsentScope,
+} from './oauth/consent-view.js';
 export * from './contracts/auth-config.js';
 export { createPasswordResetService } from './recovery/password-reset.js';
 export {
   finalizeInboundOAuth,
   registerFinalizeInboundOAuth,
 } from './oauth/callback.js';
+export {
+  resolveOAuthCredentialLane,
+  resolveIamPlatformCredentials,
+  requireIamPlatformCredentials,
+} from './oauth/credentials.js';
+export {
+  handleGoogleDesktopExchangeRequest,
+  resolveGoogleExchangeSecret,
+} from './oauth/google-desktop-exchange.js';
 export { createCloudflareD1Adapter } from './adapters/cloudflare-d1/index.js';
 export {
   createSqliteIdentityAdapter,

package/packages/identity/src/migrations/0001_identity_core.sql

@@ -1,5 +1,20 @@
 -- AgentSam Identity — customer D1 core (portable, boring, growable)
 -- Timestamps: INTEGER unixepoch seconds (AGENTS.md §2)
+--
+-- SSOT: `accounts` is the account row of record.
+-- `auth_users` is the login principal (1:1 with accounts.id in this portable scaffold).
+-- `account_identities` is IdP linkage only (provider + subject → accounts.id) — never the account SSOT.
+
+CREATE TABLE IF NOT EXISTS accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
 
 CREATE TABLE IF NOT EXISTS auth_users (
   id TEXT PRIMARY KEY NOT NULL,
@@ -9,7 +24,8 @@ CREATE TABLE IF NOT EXISTS auth_users (
   salt TEXT,
   status TEXT NOT NULL DEFAULT 'active',
   created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (id) REFERENCES accounts(id)
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_users_email ON auth_users(email);
@@ -31,6 +47,7 @@ CREATE TABLE IF NOT EXISTS auth_sessions (
 CREATE INDEX IF NOT EXISTS idx_auth_sessions_user_expires
   ON auth_sessions(user_id, expires_at);
 
+-- IdP linkage only — points at accounts (SSOT), not a substitute for accounts.
 CREATE TABLE IF NOT EXISTS account_identities (
   id TEXT PRIMARY KEY NOT NULL,
   account_id TEXT NOT NULL,
@@ -39,7 +56,7 @@ CREATE TABLE IF NOT EXISTS account_identities (
   email TEXT,
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL,
-  FOREIGN KEY (account_id) REFERENCES auth_users(id)
+  FOREIGN KEY (account_id) REFERENCES accounts(id)
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_account_identities_provider_subject

package/packages/identity/src/migrations/0003_accounts_ssot.sql

@@ -0,0 +1,20 @@
+-- Additive upgrade: accounts as SSOT for scaffolds that already applied an older 0001.
+-- Safe to re-run. New scaffolds get accounts from 0001_identity_core.sql directly.
+--
+-- account_identities remains IdP linkage only (provider + subject → accounts.id).
+
+CREATE TABLE IF NOT EXISTS accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
+
+-- Backfill from auth_users (1:1 portable scaffold).
+INSERT OR IGNORE INTO accounts (id, email, display_name, status, created_at, updated_at)
+SELECT id, email, display_name, COALESCE(status, 'active'), created_at, updated_at
+FROM auth_users;

package/packages/identity/src/migrations/README.md

@@ -14,13 +14,16 @@ wrangler d1 execute <database_name> --remote --file=migrations/0001_identity_cor
 
 `agentsam identity init` copies this migration into the customer project automatically.
 
+Existing scaffolds missing `accounts`: also apply `0003_accounts_ssot.sql`.
+
 ## Tables
 
 | Table | Purpose |
 |-------|---------|
-| `auth_users` | Login identity (`au_*` ids) |
+| `accounts` | **Account SSOT** — row of record (`au_*` ids shared with auth_users in portable scaffold) |
+| `auth_users` | Login principal (password hash, 1:1 with accounts.id) |
 | `auth_sessions` | Browser sessions |
-| `account_identities` | OAuth provider linkage |
+| `account_identities` | IdP linkage only (provider + subject → accounts.id) — **not** the account SSOT |
 | `oauth_states` | PKCE/state for OAuth start |
 | `password_reset_tokens` | Reset flow (grow when wired) |
 | `company` | Branding SSOT — name, logo, colors, support info (`GET /api/company`) |