@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/src/adapters/sqlite/index.js

@@ -1,319 +1,23 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import {
-  IDENTITY_STORE_SCHEMA_VERSION,
-  IdentitySchemaError,
-} from '../../contracts/identity-store.js';
-import { newAccountIdentityId, newAuthEventId, newAuthUserId, newSessionId, nowUnix } from '../cloudflare-d1/ids.js';
-import { SESSION_POLICY } from '../../core/constants.js';
-
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-export const SQLITE_MIGRATIONS_DIR = path.resolve(HERE, '../../../migrations/sqlite');
-
 /**
- * Apply identity.core + identity.oauth-client (+ optional oauth-server) to a
- * D1-shaped db ({ prepare().bind().run|first|all }).
- *
- * @param {{ prepare: Function }} db
- * @param {{ includeOAuthServer?: boolean }} [opts]
+ * Local SQLite IdentityStore — portable identity_* schema, zero Cloudflare/IAM.
+ * Shares the portable store implementation because Node SQLite is exposed through
+ * the same prepare/bind/first/run shape as D1-shaped bindings.
  */
-export async function applySqliteIdentityMigrations(db, opts = {}) {
-  const files = [
-    '001_identity_core.sql',
-    '002_identity_oauth_client.sql',
-  ];
-  if (opts.includeOAuthServer) files.push('003_identity_oauth_server.sql');
-
-  for (const file of files) {
-    const sql = fs.readFileSync(path.join(SQLITE_MIGRATIONS_DIR, file), 'utf8');
-    if (typeof db.exec === 'function') {
-      db.exec(sql);
-      continue;
-    }
-    // D1-shaped: run statement-by-statement (no multi-exec).
-    const stripped = sql.replace(/\/\*[\s\S]*?\*\//g, '');
-    const statements = stripped
-      .split(';')
-      .map((s) => s.replace(/--[^\n]*/g, '').trim())
-      .filter(Boolean);
-    for (const statement of statements) {
-      await db.prepare(statement).run();
-    }
-  }
-}
-
-async function hashValue(value) {
-  const v = String(value || '').trim();
-  if (!v) return null;
-  const bytes = new TextEncoder().encode(v);
-  const digest = await crypto.subtle.digest('SHA-256', bytes);
-  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
-}
+export {
+  applyPortableIdentityMigrations,
+  applySqliteIdentityMigrations,
+  PORTABLE_IDENTITY_MIGRATIONS_DIR,
+  SQLITE_MIGRATIONS_DIR,
+  resolveIdentitySchemaPack,
+  IDENTITY_SCHEMA_PACK_MANIFEST_PATH,
+} from '../../../migrations/apply-portable.js';
 
-async function requireSchema(db) {
-  let row;
-  try {
-    row = await db.prepare(
-      `SELECT value FROM identity_schema_meta WHERE key = 'schema_version' LIMIT 1`,
-    ).bind().first();
-  } catch (err) {
-    throw new IdentitySchemaError(
-      'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-      'identity.core migrations not applied — run applySqliteIdentityMigrations()',
-      { cause: String(err?.message || err) },
-    );
-  }
-  const version = Number(row?.value || 0);
-  if (version < IDENTITY_STORE_SCHEMA_VERSION) {
-    throw new IdentitySchemaError(
-      'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-      `identity schema_version=${version}, required=${IDENTITY_STORE_SCHEMA_VERSION}`,
-      { version, required: IDENTITY_STORE_SCHEMA_VERSION },
-    );
-  }
-}
+import { createPortableIdentityStore } from '../portable-store.js';
 
 /**
- * Local SQLite IdentityStore — full offline identity, no Cloudflare/IAM.
  * @param {{ prepare: Function }} db D1-shaped binding (see createLocalSqliteDatabase)
  * @param {{ sessionTtlSeconds?: number, skipSchemaCheck?: boolean }} [options]
  */
 export function createSqliteIdentityAdapter(db, options = {}) {
-  if (!db?.prepare) throw new Error('sqlite_identity_adapter_requires_db');
-  const sessionTtlSeconds = options.sessionTtlSeconds ?? SESSION_POLICY.browser.ttlSeconds;
-  let schemaReady = Boolean(options.skipSchemaCheck);
-
-  async function ensure() {
-    if (schemaReady) return;
-    await requireSchema(db);
-    schemaReady = true;
-  }
-
-  return Object.freeze({
-    schemaVersion: IDENTITY_STORE_SCHEMA_VERSION,
-    sessionTtlSeconds,
-    backend: 'sqlite',
-
-    async findUserByEmail(email) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
-         FROM identity_users WHERE email = ? COLLATE NOCASE LIMIT 1`,
-      ).bind(String(email || '').trim().toLowerCase()).first();
-      return row || null;
-    },
-
-    async findUserById(userId) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
-         FROM identity_users WHERE id = ? LIMIT 1`,
-      ).bind(userId).first();
-      return row || null;
-    },
-
-    async createUser({ email, passwordHash, salt, displayName }) {
-      await ensure();
-      const id = newAuthUserId();
-      const ts = nowUnix();
-      const normalizedEmail = String(email || '').trim().toLowerCase();
-      await db.prepare(
-        `INSERT INTO identity_users (id, email, display_name, password_hash, salt, status, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`,
-      ).bind(id, normalizedEmail, displayName || null, passwordHash || null, salt || null, ts, ts).run();
-      return this.findUserById(id);
-    },
-
-    async updateUserPassword(userId, passwordHash, salt) {
-      await ensure();
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE identity_users SET password_hash = ?, salt = ?, updated_at = ? WHERE id = ?`,
-      ).bind(passwordHash, salt, ts, userId).run();
-    },
-
-    async findUserByProvider(provider, providerSubject) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT u.id, u.email, u.display_name, u.password_hash, u.salt, u.status, u.created_at, u.updated_at
-         FROM identity_external_accounts ea
-         JOIN identity_users u ON u.id = ea.user_id
-         WHERE ea.provider = ? AND ea.provider_subject = ?
-         LIMIT 1`,
-      ).bind(provider, providerSubject).first();
-      return row || null;
-    },
-
-    async upsertProviderIdentity({ accountId, provider, providerSubject, email }) {
-      await ensure();
-      const existing = await db.prepare(
-        `SELECT id FROM identity_external_accounts WHERE provider = ? AND provider_subject = ? LIMIT 1`,
-      ).bind(provider, providerSubject).first();
-      const ts = nowUnix();
-      if (existing?.id) {
-        await db.prepare(
-          `UPDATE identity_external_accounts SET user_id = ?, email = ?, updated_at = ? WHERE id = ?`,
-        ).bind(accountId, email || null, ts, existing.id).run();
-        return existing.id;
-      }
-      const id = newAccountIdentityId();
-      await db.prepare(
-        `INSERT INTO identity_external_accounts (id, user_id, provider, provider_subject, email, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(id, accountId, provider, providerSubject, email || null, ts, ts).run();
-      return id;
-    },
-
-    async createSession({ userId, email, provider, providerSubject, displayName }) {
-      await ensure();
-      const id = newSessionId();
-      const ts = nowUnix();
-      const expiresAt = ts + sessionTtlSeconds;
-      await db.prepare(
-        `INSERT INTO identity_sessions
-         (id, user_id, email, provider, provider_subject, display_name, expires_at, created_at, last_active_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(
-        id, userId, email || null, provider || 'email', providerSubject || null,
-        displayName || null, expiresAt, ts, ts,
-      ).run();
-      return {
-        id, user_id: userId, email, provider: provider || 'email',
-        provider_subject: providerSubject || null, display_name: displayName || null,
-        expires_at: expiresAt, created_at: ts,
-      };
-    },
-
-    async getSession(sessionId) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT id, user_id, email, provider, provider_subject, display_name, expires_at, revoked_at, created_at, last_active_at
-         FROM identity_sessions WHERE id = ? LIMIT 1`,
-      ).bind(sessionId).first();
-      if (!row || row.revoked_at || row.expires_at <= nowUnix()) return null;
-      return row;
-    },
-
-    async revokeSession(sessionId, reason = 'logout') {
-      await ensure();
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE identity_sessions SET revoked_at = ?, last_active_at = ? WHERE id = ? AND revoked_at IS NULL`,
-      ).bind(ts, ts, sessionId).run();
-      return { ok: true, reason };
-    },
-
-    async createOAuthTransaction({ state, provider, codeVerifier, returnTo, appId, ttlSeconds = 600 }) {
-      await ensure();
-      if (!appId) {
-        throw new IdentitySchemaError(
-          'OAUTH_TRANSACTION_APP_ID_REQUIRED',
-          'OAuth transactions must include app_id — refusing to create orphan auth state',
-        );
-      }
-      const ts = nowUnix();
-      await db.prepare(
-        `INSERT INTO identity_oauth_transactions
-         (state, provider, code_verifier, return_to, app_id, expires_at, created_at, consumed_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, NULL)`,
-      ).bind(state, provider, codeVerifier, returnTo || null, appId, ts + ttlSeconds, ts).run();
-    },
-
-    /** @deprecated Use createOAuthTransaction */
-    async saveOAuthState(input) {
-      return this.createOAuthTransaction({
-        ...input,
-        returnTo: input.redirectTo ?? input.returnTo,
-        appId: input.appId,
-      });
-    },
-
-    async consumeOAuthTransaction(state) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT state, provider, code_verifier, return_to, app_id, expires_at, created_at, consumed_at
-         FROM identity_oauth_transactions WHERE state = ? LIMIT 1`,
-      ).bind(state).first();
-      if (!row) return null;
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE identity_oauth_transactions SET consumed_at = ? WHERE state = ?`,
-      ).bind(ts, state).run();
-      await db.prepare(`DELETE FROM identity_oauth_transactions WHERE state = ?`).bind(state).run();
-      if (row.consumed_at) return null;
-      if (row.expires_at <= ts) return null;
-      if (!row.app_id) {
-        throw new IdentitySchemaError(
-          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-          'OAuth transaction missing app_id — refuse silent pre-app_id semantics',
-        );
-      }
-      return {
-        state: row.state,
-        provider: row.provider,
-        code_verifier: row.code_verifier,
-        redirect_to: row.return_to,
-        return_to: row.return_to,
-        app_id: row.app_id,
-        expires_at: row.expires_at,
-        created_at: row.created_at,
-        consumed_at: ts,
-      };
-    },
-
-    /** @deprecated Use consumeOAuthTransaction */
-    async consumeOAuthState(state) {
-      return this.consumeOAuthTransaction(state);
-    },
-
-    async logAuthEvent({
-      userId, accountId, eventType, status = 'ok', provider,
-      session, capabilities, activity, client, metadata, request,
-    }) {
-      try {
-        await ensure();
-        const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
-        const ua = request?.headers?.get?.('user-agent') || '';
-        const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
-        const envelope = {
-          ...(metadata && typeof metadata === 'object' ? metadata : {}),
-          ...(accountId ? { accountId } : {}),
-          ...(session ? { session } : {}),
-          ...(capabilities ? { capabilities } : {}),
-          ...(activity ? { activity } : {}),
-          ...(client ? { client } : {}),
-        };
-        await db.prepare(
-          `INSERT INTO identity_auth_events
-           (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        ).bind(
-          newAuthEventId(), userId || null, eventType, status, provider || null,
-          JSON.stringify(envelope), ipHash, uaHash, nowUnix(),
-        ).run();
-      } catch {
-        /* never break auth on audit failure */
-      }
-    },
-
-    async countAuthActivity(userId) {
-      await ensure();
-      if (!userId) return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
-      const logins = await db.prepare(
-        `SELECT COUNT(*) AS c, MAX(created_at) AS last_at
-         FROM identity_auth_events
-         WHERE user_id = ? AND event_type = 'login' AND status = 'ok'`,
-      ).bind(userId).first();
-      const sessions = await db.prepare(
-        `SELECT COUNT(*) AS c FROM identity_sessions
-         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?`,
-      ).bind(userId, nowUnix()).first();
-      return {
-        loginCount: Number(logins?.c || 0),
-        activeSessionCount: Number(sessions?.c || 0),
-        lastLoginAt: logins?.last_at != null ? Number(logins.last_at) : null,
-      };
-    },
-  });
+  return createPortableIdentityStore(db, { ...options, backend: 'sqlite' });
 }

package/packages/identity/src/contracts/auth-config.js

@@ -4,12 +4,13 @@
  * Browser login sessions and reusable API credentials are intentionally
  * separate: login sessions are opaque, machine-local session state while
  * AGENTSAM_API_KEY is an explicit delegated account credential.
+ *
+ * Namespaces (do not collapse):
+ *   PLATFORM issuer  → IAM_OAUTH_ISSUER (account API)
+ *   APP host         → agentsam.app.json hosts[] (e.g. local-studio)
+ * Never treat Local Studio host origin as an alias of IAM_OAUTH_ISSUER.
  */
 
-export const DEFAULT_IAM_OAUTH_ISSUER = 'https://inneranimalmedia.com';
-/** @deprecated Use DEFAULT_IAM_OAUTH_ISSUER. */
-export const DEFAULT_IAM_ORIGIN = DEFAULT_IAM_OAUTH_ISSUER;
-
 export const AGENTSAM_AUTH_ENV = Object.freeze({
   iamIssuer: 'IAM_OAUTH_ISSUER',
   iamOrigin: 'IAM_ORIGIN',
@@ -17,8 +18,22 @@ export const AGENTSAM_AUTH_ENV = Object.freeze({
   iamClientSecret: 'IAM_CLIENT_SECRET',
   apiKey: 'AGENTSAM_API_KEY',
   bridgeKey: 'AGENTSAM_BRIDGE_KEY',
+  googleClientId: 'GOOGLE_CLIENT_ID',
+  googleClientSecret: 'GOOGLE_CLIENT_SECRET',
+  googleDesktopClientId: 'GOOGLE_DESKTOP_CLIENT_ID',
+  githubClientId: 'GITHUB_CLIENT_ID',
+  githubClientSecret: 'GITHUB_CLIENT_SECRET',
+  cloudflareOauthClientId: 'CLOUDFLARE_OAUTH_CLIENT_ID',
+  cloudflareOauthClientSecret: 'CLOUDFLARE_OAUTH_CLIENT_SECRET',
 });
 
+/**
+ * Hosted AgentSam platform compatibility issuer — not an APP host and never a
+ * portable Local Studio default. Portable apps use packages/identity locally
+ * unless an installation explicitly selects a remote IAM adapter.
+ */
+export const PLATFORM_ACCOUNT_ISSUER = 'https://inneranimalmedia.com';
+
 export const AGENTSAM_AUTH_CONTRACT = Object.freeze({
   version: 2,
   authority: 'agentsam-sdk',
@@ -27,6 +42,7 @@ export const AGENTSAM_AUTH_CONTRACT = Object.freeze({
     origin: AGENTSAM_AUTH_ENV.iamOrigin,
     clientId: AGENTSAM_AUTH_ENV.iamClientId,
     clientSecret: AGENTSAM_AUTH_ENV.iamClientSecret,
+    defaultIssuer: PLATFORM_ACCOUNT_ISSUER,
   }),
   apiKey: Object.freeze({
     env: AGENTSAM_AUTH_ENV.apiKey,
@@ -55,11 +71,14 @@ function normalizeOrigin(value) {
   return clean(value).replace(/\/+$/, '');
 }
 
-/** Resolve canonical IAM issuer. IAM_OAUTH_ISSUER wins; IAM_ORIGIN is compatibility only. */
+/**
+ * Resolve PLATFORM account issuer.
+ * Order: explicit → IAM_OAUTH_ISSUER → IAM_ORIGIN → PLATFORM_ACCOUNT_ISSUER.
+ * Does not read APP host origins.
+ */
 export function resolveIamIssuer(env = {}, explicit = '') {
-  return normalizeOrigin(
-    explicit || env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || DEFAULT_IAM_OAUTH_ISSUER,
-  );
+  return normalizeOrigin(explicit || env?.IAM_OAUTH_ISSUER || env?.IAM_ORIGIN || '')
+    || PLATFORM_ACCOUNT_ISSUER;
 }
 
 /** @deprecated Use resolveIamIssuer. Same resolution order as issuer. */

package/packages/identity/src/contracts/external-identity.js

@@ -1,6 +1,6 @@
 /**
  * Portable external identity shape — storage-agnostic.
- * Adapters map this into application-specific account_identities rows.
+ * Adapters map this into account_identities rows that point at accounts (SSOT).
  */
 
 /** @typedef {import('../provider-contract.js').NormalizedExternalIdentity} NormalizedExternalIdentity */

package/packages/identity/src/contracts/identity-store.js

@@ -1,7 +1,12 @@
 /**
  * Portable IdentityStore contract.
- * Adapters (SQLite, D1, Postgres) implement this — the identity service never
- * imports Cloudflare/D1 APIs directly for product logic.
+ * Adapters (SQLite, portable D1, IAM-compat) implement this — the identity service
+ * never imports Cloudflare/D1 APIs directly for product logic.
+ *
+ * Company / native handoff / provider-connection behavior belong on this contract
+ * (not undocumented adapter-only magic). Password recovery remains a separate
+ * storage-agnostic service (createPasswordResetService + injected {get,put,delete});
+ * adapters supply user lookup / password update hooks, not a mandatory SQL reset table.
  */
 
 /**
@@ -24,6 +29,7 @@
  * @property {string|null} [provider]
  * @property {string|null} [provider_subject]
  * @property {string|null} [display_name]
+ * @property {'browser'|'desktop'} [type]
  * @property {number} expires_at
  * @property {number|null} [revoked_at]
  * @property {number} created_at
@@ -37,6 +43,9 @@
  * @property {string} code_verifier
  * @property {string|null} [return_to]
  * @property {string} app_id
+ * @property {'desktop'|string|null} [client_type]
+ * @property {string|null} [native_challenge]
+ * @property {string|null} [native_redirect]
  * @property {number} expires_at
  * @property {number} created_at
  * @property {number|null} [consumed_at]
@@ -57,6 +66,37 @@
  * @property {Request} [request]
  */
 
+/**
+ * @typedef {object} CompanyProfile
+ * @property {string} id
+ * @property {string} slug
+ * @property {string} name
+ * @property {string|null} [legalName]
+ * @property {string|null} [logoUrl]
+ * @property {string|null} [faviconUrl]
+ * @property {string|null} [primaryColor]
+ * @property {string|null} [authBgColor]
+ * @property {string|null} [supportEmail]
+ * @property {string|null} [websiteUrl]
+ * @property {string|null} [tagline]
+ * @property {object} [meta]
+ * @property {number} [createdAt]
+ * @property {number} [updatedAt]
+ */
+
+/**
+ * @typedef {object} ProviderConnection
+ * @property {string} id
+ * @property {string} user_id
+ * @property {string} provider
+ * @property {string[]} granted_scopes
+ * @property {string} credential_ref
+ * @property {number|null} [expires_at]
+ * @property {boolean} [refreshable]
+ * @property {number} created_at
+ * @property {number} updated_at
+ */
+
 /**
  * @typedef {object} IdentityStore
  * @property {number} schemaVersion
@@ -66,21 +106,32 @@
  * @property {(userId: string, passwordHash: string, salt: string) => Promise<void>} updateUserPassword
  * @property {(provider: string, providerSubject: string) => Promise<IdentityUser|null>} findUserByProvider
  * @property {(input: { accountId: string, provider: string, providerSubject: string, email?: string|null }) => Promise<string>} upsertProviderIdentity
- * @property {(input: { userId: string, email?: string|null, provider?: string, providerSubject?: string|null, displayName?: string|null }) => Promise<IdentitySession>} createSession
+ * @property {(input: { userId: string, email?: string|null, provider?: string, providerSubject?: string|null, displayName?: string|null, type?: 'browser'|'desktop' }) => Promise<IdentitySession>} createSession
  * @property {(sessionId: string) => Promise<IdentitySession|null>} getSession
  * @property {(sessionId: string, reason?: string) => Promise<{ ok: true, reason: string }>} revokeSession
- * @property {(input: { state: string, provider: string, codeVerifier: string, returnTo?: string|null, appId: string, ttlSeconds?: number }) => Promise<void>} createOAuthTransaction
+ * @property {(input: { state: string, provider: string, codeVerifier: string, returnTo?: string|null, appId: string, ttlSeconds?: number, clientType?: string, nativeChallenge?: string, nativeRedirect?: string }) => Promise<void>} createOAuthTransaction
  * @property {(state: string) => Promise<OAuthTransaction|null>} consumeOAuthTransaction
  * @property {(input: AuthEventInput) => Promise<void>} logAuthEvent
  * @property {(userId: string) => Promise<{ loginCount: number, activeSessionCount: number, lastLoginAt: number|null }>} [countAuthActivity]
+ * @property {(input: { handoffHash: string, sessionId: string, challenge: string, ttlSeconds?: number }) => Promise<void>} createNativeHandoff
+ * @property {(handoffHash: string) => Promise<{ session_id: string, challenge: string }|null>} consumeNativeHandoff
+ * @property {(slug?: string) => Promise<CompanyProfile|null>} getCompanyBySlug
+ * @property {(hostname: string|null|undefined) => Promise<CompanyProfile|null>} getCompanyByHost
+ * @property {() => Promise<CompanyProfile|null>} getDefaultCompany
+ * @property {(input: object) => Promise<CompanyProfile|null>} upsertCompany
+ * @property {(input: { userId: string, provider: string, credentialRef: string, grantedScopes?: string[], expiresAt?: number|null, refreshable?: boolean }) => Promise<string>} upsertProviderConnection
+ * @property {(userId: string, provider: string) => Promise<ProviderConnection|null>} getProviderConnection
  */
 
-export const IDENTITY_STORE_SCHEMA_VERSION = 1;
+/** Portable pack schema_version after 005_identity_company_native. */
+export const IDENTITY_STORE_SCHEMA_VERSION = 2;
 
 export const IDENTITY_PACKS = Object.freeze({
   CORE: 'identity.core',
   OAUTH_CLIENT: 'identity.oauth-client',
   OAUTH_SERVER: 'identity.oauth-server',
+  /** Optional future — not part of portable core. Recovery stays KV/injected today. */
+  RECOVERY: 'identity.recovery',
 });
 
 /**

package/packages/identity/src/contracts/provider.js

@@ -3,8 +3,10 @@
 export const IdentityProviders = Object.freeze([
   'email',
   'google',
+  'google_desktop',
   'github',
   'gcp',
   'inneranimalmedia',
   'cloudflare',
+  'chatgpt',
 ]);

package/packages/identity/src/contracts/sign-in-options.js

@@ -0,0 +1,104 @@
+/**
+ * Stock sign-in options for OAuth / CMS editor first-run setup.
+ * user123 picks from these prepackaged providers when wiring auth.
+ */
+
+/** @typedef {'oauth' | 'oidc' | 'hosted_headers' | 'local'} StockSignInKind */
+
+/**
+ * @typedef {object} StockSignInOption
+ * @property {string} id
+ * @property {string} label
+ * @property {string} [shortLabel]
+ * @property {StockSignInKind} kind
+ * @property {'ready' | 'scaffold'} status
+ * @property {string} description
+ * @property {string[]} [aliases]
+ * @property {string[]} [requiredEnv]
+ * @property {string[]} [optionalEnv]
+ * @property {string} [implementation]
+ * @property {boolean} [cmsDefault]
+ */
+
+/** @type {readonly StockSignInOption[]} */
+export const STOCK_SIGN_IN_OPTIONS = Object.freeze([
+  {
+    id: 'cloudflare',
+    label: 'Cloudflare',
+    shortLabel: 'Cloudflare',
+    kind: 'oauth',
+    status: 'ready',
+    description: 'Sign in with Cloudflare account OAuth (PKCE-capable).',
+    requiredEnv: ['CLOUDFLARE_OAUTH_CLIENT_ID'],
+    optionalEnv: ['CLOUDFLARE_OAUTH_CLIENT_SECRET'],
+    implementation: 'src/providers/cloudflare',
+  },
+  {
+    id: 'google',
+    label: 'Google',
+    shortLabel: 'Google',
+    kind: 'oauth',
+    status: 'ready',
+    description: 'Sign in with Google (browser OAuth confidential client).',
+    requiredEnv: ['GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET'],
+    implementation: 'src/providers/google',
+  },
+  {
+    id: 'inneranimalmedia',
+    label: 'Inner Animal Media',
+    shortLabel: 'IAM',
+    kind: 'oidc',
+    status: 'ready',
+    description: 'Sign in with Inner Animal Media platform identity (OIDC).',
+    aliases: ['iam'],
+    requiredEnv: ['IAM_CLIENT_ID', 'IAM_CLIENT_SECRET'],
+    optionalEnv: ['IAM_OAUTH_ISSUER', 'IAM_ORIGIN'],
+    implementation: 'src/providers/iam',
+    cmsDefault: true,
+  },
+  {
+    id: 'chatgpt',
+    label: 'ChatGPT',
+    shortLabel: 'ChatGPT',
+    kind: 'hosted_headers',
+    status: 'ready',
+    description:
+      'Sign in via ChatGPT / OpenAI Apps SDK hosted identity (oai-authenticated headers → NormalizedExternalIdentity).',
+    aliases: ['openai', 'chatgpt-hosted'],
+    requiredEnv: [],
+    implementation: 'src/providers/chatgpt',
+  },
+]);
+
+/** Canonical ids offered on CMS / OAuth prebuild pickers. */
+export const CMS_STOCK_SIGN_IN_IDS = Object.freeze(
+  STOCK_SIGN_IN_OPTIONS.map((row) => row.id),
+);
+
+/**
+ * @param {string} id
+ * @returns {StockSignInOption | null}
+ */
+export function getStockSignInOption(id) {
+  const key = String(id || '')
+    .trim()
+    .toLowerCase()
+    .replace(/-/g, '_');
+  if (!key) return null;
+  if (key === 'iam') {
+    return STOCK_SIGN_IN_OPTIONS.find((row) => row.id === 'inneranimalmedia') || null;
+  }
+  if (key === 'openai' || key === 'chatgpt_hosted') {
+    return STOCK_SIGN_IN_OPTIONS.find((row) => row.id === 'chatgpt') || null;
+  }
+  return (
+    STOCK_SIGN_IN_OPTIONS.find((row) => row.id === key) ||
+    STOCK_SIGN_IN_OPTIONS.find((row) => (row.aliases || []).includes(String(id || '').trim().toLowerCase())) ||
+    null
+  );
+}
+
+/** @returns {StockSignInOption[]} */
+export function listStockSignInOptions() {
+  return [...STOCK_SIGN_IN_OPTIONS];
+}

package/packages/identity/src/core/constants.js

@@ -6,7 +6,7 @@
 
 import { SESSION_POLICY } from './session-policy.js';
 
-export { SESSION_POLICY, clampAgentSessionTtl } from './session-policy.js';
+export { SESSION_POLICY, clampAgentSessionTtl, shouldRenewDesktopSession } from './session-policy.js';
 
 export const AUTH_COOKIE_NAME = 'session';