@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/migrations/sqlite/004_identity_oauth_consent_catalog.sql

@@ -0,0 +1,48 @@
+-- identity.oauth-server consent catalog.
+-- Issuer branding remains owned by portable identity_companies (identity.core).
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_oauth_consent_catalog', '1');
+
+CREATE TABLE IF NOT EXISTS identity_oauth_resources (
+  id TEXT PRIMARY KEY NOT NULL,
+  audience TEXT NOT NULL UNIQUE,
+  resource_type TEXT NOT NULL DEFAULT 'mcp',
+  display_name TEXT NOT NULL,
+  description TEXT,
+  logo_url TEXT,
+  homepage_url TEXT,
+  metadata_json TEXT NOT NULL DEFAULT '{}',
+  is_active INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_scopes (
+  scope TEXT PRIMARY KEY NOT NULL,
+  label TEXT NOT NULL,
+  description TEXT NOT NULL,
+  category TEXT NOT NULL DEFAULT 'general',
+  sensitivity TEXT NOT NULL DEFAULT 'normal'
+    CHECK (sensitivity IN ('normal','elevated','sensitive')),
+  is_active INTEGER NOT NULL DEFAULT 1 CHECK (is_active IN (0,1)),
+  sort_order INTEGER NOT NULL DEFAULT 50,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_resource_scopes (
+  resource_id TEXT NOT NULL,
+  scope TEXT NOT NULL,
+  required INTEGER NOT NULL DEFAULT 0 CHECK (required IN (0,1)),
+  sort_order INTEGER NOT NULL DEFAULT 50,
+  PRIMARY KEY (resource_id, scope),
+  FOREIGN KEY (resource_id) REFERENCES identity_oauth_resources(id) ON DELETE CASCADE,
+  FOREIGN KEY (scope) REFERENCES identity_oauth_scopes(scope) ON DELETE CASCADE
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_resources_active
+  ON identity_oauth_resources(is_active, resource_type);
+
+CREATE INDEX IF NOT EXISTS idx_identity_oauth_resource_scopes_sort
+  ON identity_oauth_resource_scopes(resource_id, sort_order, scope);

package/packages/identity/migrations/sqlite/005_identity_company_native.sql

@@ -0,0 +1,52 @@
+-- identity.core extension — company / brand + native handoff parity
+-- Portable identity_* names only. Does not create IAM `company` / `accounts`.
+-- Does NOT include password-reset tables — recovery remains storage-agnostic
+-- (createPasswordResetService + injected {get,put,delete} store).
+-- Upgrades schema_version 1 → 2. Safe to re-run (IF NOT EXISTS / ignorable ALTERs).
+
+INSERT OR REPLACE INTO identity_schema_meta (key, value)
+VALUES ('schema_version', '2');
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_company_native', '1');
+
+CREATE TABLE IF NOT EXISTS identity_companies (
+  id TEXT PRIMARY KEY NOT NULL,
+  slug TEXT NOT NULL,
+  name TEXT NOT NULL,
+  legal_name TEXT,
+  logo_url TEXT,
+  favicon_url TEXT,
+  primary_color TEXT,
+  auth_bg_color TEXT,
+  support_email TEXT,
+  website_url TEXT,
+  tagline TEXT,
+  meta_json TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_companies_slug
+  ON identity_companies(slug);
+
+CREATE TABLE IF NOT EXISTS identity_native_handoffs (
+  handoff_hash TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL,
+  challenge TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  FOREIGN KEY (session_id) REFERENCES identity_sessions(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_native_handoffs_expires
+  ON identity_native_handoffs(expires_at);
+
+-- Session type for browser vs desktop/native (default keeps existing rows as browser).
+ALTER TABLE identity_sessions ADD COLUMN type TEXT NOT NULL DEFAULT 'browser';
+
+-- Native OAuth transaction fields (optional on browser transactions).
+ALTER TABLE identity_oauth_transactions ADD COLUMN client_type TEXT;
+ALTER TABLE identity_oauth_transactions ADD COLUMN native_challenge TEXT;
+ALTER TABLE identity_oauth_transactions ADD COLUMN native_redirect TEXT;

package/packages/identity/package.json

@@ -1,7 +1,6 @@
 {
-  "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.4",
-  "private": true,
+  "name": "@inneranimalmedia/agentsam-identity",
+  "version": "2.6.7",
   "type": "module",
   "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
   "agentsam": {
@@ -27,9 +26,17 @@
     "./contracts/provider": "./src/contracts/provider.js",
     "./contracts/external-identity": "./src/contracts/external-identity.js",
     "./contracts/auth-config": "./src/contracts/auth-config.js",
+    "./contracts/identity-store": "./src/contracts/identity-store.js",
     "./oauth/callback": "./src/oauth/callback.js",
     "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
-    "./providers/cloudflare": "./src/providers/cloudflare/index.js"
+    "./providers/cloudflare": "./src/providers/cloudflare/index.js",
+    "./providers/chatgpt": "./src/providers/chatgpt/index.js",
+    "./contracts/sign-in-options": "./src/contracts/sign-in-options.js",
+    "./oauth/consent-view": "./src/oauth/consent-view.js",
+    "./adapters/sqlite": "./src/adapters/sqlite/index.js",
+    "./adapters/portable-d1": "./src/adapters/portable-d1/index.js",
+    "./adapters/iam-compat": "./src/adapters/iam-compat/index.js",
+    "./adapters/cloudflare-d1": "./src/adapters/cloudflare-d1/index.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
@@ -37,5 +44,20 @@
   },
   "engines": {
     "node": ">=20"
-  }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/identity"
+  },
+  "files": [
+    "src",
+    "backend",
+    "migrations",
+    "schema",
+    "scripts"
+  ]
 }

package/packages/identity/schema/agentsam.identity/manifest.json

@@ -0,0 +1,101 @@
+{
+  "$schema": "../../../protocol/database/agentsam.schema-pack.v1.schema.json",
+  "schema": "agentsam.schema-pack.v1",
+  "id": "agentsam.identity",
+  "version": "2.0.0",
+  "pack_family": "agentsam.identity",
+  "components": [
+    "identity.core",
+    "identity.oauth-client",
+    "identity.oauth-server"
+  ],
+  "component_dependencies": {
+    "identity.core": [],
+    "identity.oauth-client": ["identity.core"],
+    "identity.oauth-server": ["identity.core"]
+  },
+  "adapters": [
+    "sqlite",
+    "portable-d1",
+    "iam-compat"
+  ],
+  "sql": {
+    "portable_dir": "migrations/sqlite",
+    "files": {
+      "identity.core": [
+        "001_identity_core.sql",
+        "005_identity_company_native.sql"
+      ],
+      "identity.oauth-client": [
+        "002_identity_oauth_client.sql"
+      ],
+      "identity.oauth-server": [
+        "003_identity_oauth_server.sql",
+        "004_identity_oauth_consent_catalog.sql"
+      ]
+    },
+    "apply_order_fresh": [
+      "001_identity_core.sql",
+      "002_identity_oauth_client.sql",
+      "005_identity_company_native.sql"
+    ],
+    "apply_order_upgrade_v1_to_v2": [
+      "005_identity_company_native.sql"
+    ],
+    "optional_after_core": [
+      "003_identity_oauth_server.sql",
+      "004_identity_oauth_consent_catalog.sql"
+    ]
+  },
+  "tables": {
+    "identity.core": [
+      "identity_schema_meta",
+      "identity_users",
+      "identity_external_accounts",
+      "identity_sessions",
+      "identity_auth_events",
+      "identity_app_registry",
+      "identity_route_registry",
+      "identity_companies",
+      "identity_native_handoffs"
+    ],
+    "identity.oauth-client": [
+      "identity_oauth_transactions",
+      "identity_provider_connections"
+    ],
+    "identity.oauth-server": [
+      "identity_oauth_clients",
+      "identity_oauth_authorization_codes",
+      "identity_oauth_access_tokens",
+      "identity_oauth_refresh_tokens",
+      "identity_oauth_resources",
+      "identity_oauth_scopes",
+      "identity_oauth_resource_scopes"
+    ]
+  },
+  "table_patterns": ["identity_*"],
+  "seed_policy": "none",
+  "compatibility": {
+    "iam-compat": {
+      "owns_portable_schema": false,
+      "maps_onto": [
+        "accounts",
+        "auth_users",
+        "account_identities",
+        "auth_sessions",
+        "auth_event_log",
+        "identity_oauth_states",
+        "identity_native_handoffs",
+        "company"
+      ],
+      "stable_alias": "createCloudflareD1Adapter"
+    }
+  },
+  "recovery": {
+    "authority": "createPasswordResetService",
+    "storage": "injected {get,put,delete} — not IdentityStore / not identity.core SQL",
+    "optional_future_pack": "identity.recovery"
+  },
+  "owner": "@inneranimalmedia/agentsam-sdk/identity",
+  "notes": "Pack family for portable IdentityStore. Component IDs remain the contract units. Portable SQL SSOT is migrations/sqlite/. IAM production tables are NOT this pack — use the iam-compat adapter against hosted schema. Secrets are credential_ref / vault references, never raw tokens in rows. Password recovery stays storage-agnostic."
+}

package/packages/identity/scripts/local-identity-bridge.mjs

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { DatabaseSync } from 'node:sqlite';
+import {
+  applySqliteIdentityMigrations,
+  createSqliteIdentityAdapter,
+} from '../src/adapters/sqlite/index.js';
+import {
+  createRouteRegistry,
+  projectionFromAppManifest,
+} from '../src/contracts/route-projection.js';
+import { createIdentityService } from '../src/server/identity-service.js';
+import { hashPassword } from '../src/core/password-crypto.js';
+
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let body = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => { body += chunk; });
+    process.stdin.on('end', () => {
+      try { resolve(body.trim() ? JSON.parse(body) : {}); }
+      catch (error) { reject(error); }
+    });
+    process.stdin.on('error', reject);
+  });
+}
+
+function wrapDatabase(database, filePath) {
+  return {
+    filePath,
+    prepare(sql) {
+      const statement = database.prepare(sql);
+      const bound = (values = []) => ({
+        async run() { return statement.run(...values); },
+        async first() { return statement.get(...values) ?? null; },
+        async all() { return { results: statement.all(...values) }; },
+      });
+      return {
+        bind(...values) { return bound(values); },
+        async run() { return statement.run(); },
+        async first() { return statement.get() ?? null; },
+        async all() { return { results: statement.all() }; },
+      };
+    },
+    exec(sql) { database.exec(sql); },
+    close() { database.close(); },
+  };
+}
+
+function sanitizeUser(user) {
+  if (!user) return null;
+  return {
+    id: user.id,
+    email: user.email,
+    display_name: user.display_name ?? null,
+    status: user.status ?? null,
+  };
+}
+
+function cliArg(name) {
+  const i = process.argv.indexOf(name);
+  return i > 1 ? process.argv[i + 1] : undefined;
+}
+
+const request = await readStdin();
+const dbArg = cliArg('--db');
+const manifestArg = cliArg('--manifest');
+if (!dbArg || !manifestArg) {
+  process.stderr.write('usage: local-identity-bridge.mjs --db <sqlite path> --manifest <agentsam.app.json>\n');
+  process.exit(2);
+}
+const dbPath = path.resolve(dbArg);
+const manifestPath = path.resolve(manifestArg);
+
+fs.mkdirSync(path.dirname(dbPath), { recursive: true, mode: 0o700 });
+const nativeDb = new DatabaseSync(dbPath);
+try {
+  if (process.platform !== 'win32') {
+    try { fs.chmodSync(dbPath, 0o600); } catch {}
+  }
+  const db = wrapDatabase(nativeDb, dbPath);
+  await applySqliteIdentityMigrations(db);
+  const adapter = createSqliteIdentityAdapter(db);
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  const routeRegistry = createRouteRegistry([projectionFromAppManifest(manifest)]);
+  const identity = createIdentityService({
+    adapter,
+    app: { id: manifest.id },
+    routeRegistry,
+  });
+
+  let result;
+  switch (request.op) {
+    case 'status': {
+      const sessionId = String(request.session_id || '').trim();
+      if (!sessionId) {
+        result = { ok: true, authenticated: false, user: null };
+        break;
+      }
+      const session = await identity.sessionFromRequest(new Request('http://local.identity/session', {
+        headers: { Authorization: `Bearer ${sessionId}` },
+      }));
+      result = {
+        ok: true,
+        authenticated: Boolean(session),
+        user: sanitizeUser(session?.user),
+      };
+      break;
+    }
+
+    case 'login': {
+      const login = await identity.loginWithPassword({
+        email: request.email,
+        password: request.password,
+      });
+      result = login.ok
+        ? {
+            ok: true,
+            authenticated: true,
+            session_id: login.sessionId,
+            user: sanitizeUser(login.user),
+            redirect: identity.resolvePostLoginPath(request.next || null),
+          }
+        : login;
+      break;
+    }
+
+    case 'signup': {
+      const signup = await identity.signup({
+        email: request.email,
+        password: request.password,
+        displayName: request.display_name,
+      });
+      result = signup.ok
+        ? {
+            ok: true,
+            authenticated: true,
+            session_id: signup.sessionId,
+            user: sanitizeUser(signup.user),
+            redirect: identity.resolvePostLoginPath(request.next || null),
+          }
+        : signup;
+      break;
+    }
+
+    case 'logout': {
+      const sessionId = String(request.session_id || '').trim();
+      if (sessionId) {
+        await identity.logout(new Request('http://local.identity/logout', {
+          headers: { Authorization: `Bearer ${sessionId}` },
+        }));
+      }
+      result = { ok: true };
+      break;
+    }
+
+    case 'reset_password': {
+      const email = String(request.email || '').trim().toLowerCase();
+      const password = String(request.password || '');
+      if (!email || password.length < 8) {
+        result = { ok: false, error: 'email_and_valid_password_required' };
+        break;
+      }
+      const user = await adapter.findUserByEmail(email);
+      if (!user) {
+        result = { ok: false, error: 'account_not_found' };
+        break;
+      }
+      const { saltHex, hashHex } = await hashPassword(password);
+      await adapter.updateUserPassword(user.id, hashHex, saltHex);
+      result = { ok: true };
+      break;
+    }
+
+    default:
+      result = { ok: false, error: 'unsupported_identity_operation' };
+  }
+
+  process.stdout.write(JSON.stringify(result));
+} catch (error) {
+  process.stdout.write(JSON.stringify({
+    ok: false,
+    error: error?.message || String(error),
+  }));
+  process.exitCode = 1;
+} finally {
+  try { nativeDb.close(); } catch {}
+}

package/packages/identity/scripts/preview-auth-portal.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * Local static preview for IAM auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
+ * Local static preview for the portable AgentSam auth portal HTML (1:1 paths: /auth/login, /auth/signup, /auth/reset).
  * API routes are stubbed so forms and globe-exit transitions work without a Worker.
  */
 import http from 'node:http';
@@ -119,15 +119,15 @@ function hubHtml(baseUrl) {
 const PREVIEW_COMPANY = {
   id: 'co_default',
   slug: 'default',
-  name: 'Inner Animal Media',
-  legalName: 'Inner Animals LLC',
-  logoUrl: 'https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public',
-  faviconUrl: 'https://inneranimalmedia.com/favicon.ico',
+  name: 'Preview App',
+  legalName: 'Preview App',
+  logoUrl: '/shared/app-icon.png',
+  faviconUrl: null,
   primaryColor: '#007AFF',
   authBgColor: '#050508',
-  supportEmail: 'hey@inneranimalmedia.com',
-  websiteUrl: 'https://inneranimalmedia.com',
-  tagline: 'Instant Access',
+  supportEmail: 'support@example.com',
+  websiteUrl: 'https://example.com',
+  tagline: 'Welcome',
   meta: {
     privacyUrl: '/privacy',
     termsUrl: '/terms',