@inneranimalmedia/agentsam-sdk 2.6.4 → 2.6.7

package/packages/identity/src/core/session-policy.js

@@ -6,10 +6,24 @@
  * Product routing does not live here.
  */
 
+/** auth_sessions.type values written by this package. */
+export const SESSION_TYPES = Object.freeze({
+  BROWSER: 'browser',
+  DESKTOP: 'desktop',
+});
+
+/** Lifetime of the one-time code a native OAuth callback hands to the app. */
+export const NATIVE_HANDOFF_TTL_SECONDS = 120;
+
 export const SESSION_POLICY = Object.freeze({
   browser: Object.freeze({
     ttlSeconds: 30 * 24 * 60 * 60,
   }),
+  /** Native app bearer session (OS keychain) — minted via the native OAuth handoff. */
+  desktop: Object.freeze({
+    ttlSeconds: 30 * 24 * 60 * 60,
+    renewWindowSeconds: 7 * 24 * 60 * 60,
+  }),
   /** Temporary execution authority — not the user's Local Studio login. */
   agent: Object.freeze({
     minTtlSeconds: 60,
@@ -18,6 +32,23 @@ export const SESSION_POLICY = Object.freeze({
   }),
 });
 
+/**
+ * Desktop sessions are durable/revocable AgentSam sessions, not provider tokens.
+ * Renew only near expiry so normal app launches remain read-mostly.
+ */
+export function shouldRenewDesktopSession(session, nowSeconds) {
+  const now = Number.isFinite(Number(nowSeconds))
+    ? Math.floor(Number(nowSeconds))
+    : Math.floor(Date.now() / 1000);
+  const expiresAt = Number(session?.expires_at);
+  return (
+    session?.type === SESSION_TYPES.DESKTOP
+    && Number.isFinite(expiresAt)
+    && expiresAt > now
+    && expiresAt - now <= SESSION_POLICY.desktop.renewWindowSeconds
+  );
+}
+
 /**
  * Clamp a requested agent/runtime grant TTL into policy bounds.
  * @param {number|null|undefined} requestedSeconds

package/packages/identity/src/frontend/auth-portal/README.md

@@ -26,7 +26,8 @@ The CLI can now scaffold the reusable identity app surfaces directly with `agent
 - `POST /api/auth/login`
 - `POST /api/auth/signup` — create account (email/password); portal form must call this, not login
 - `GET /api/company` — public branding SSOT (loaded by `shared/company-branding.js`)
-- OAuth: `/api/oauth/google/start`, `/api/oauth/github/start`
+- OAuth: `/api/oauth/google/start`, `/api/oauth/github/start`, `/api/oauth/cloudflare/start`
+- Desktop PKCE broker: `POST /api/oauth/google/desktop-exchange` (`GOOGLE_DESKTOP_CLIENT_ID`)
 - GCP: per-client when demanded — scaffold only until requested
 
 Sensitive finalize stays server-side (`oauth/callback` → Identity Service).

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign in | Inner Animal Media</title>
+    <title>Sign in</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -360,12 +360,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/app-icon.png"
+      alt="Sign in"
     />
 
-    <h1 data-company-tagline>Instant Access</h1>
-    <p class="subtitle" data-company-subtitle="signin">Sign in to Inner Animal Media</p>
+    <h1 data-company-tagline>Welcome</h1>
+    <p class="subtitle" data-company-subtitle="signin">Sign in</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="resetMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Password updated. Sign in with your new password.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
@@ -451,7 +451,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>App</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -824,6 +824,7 @@
     });
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/pages/reset.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Reset password | Inner Animal Media</title>
+    <title>Reset password</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -280,8 +280,8 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/app-icon.png"
+      alt="Sign in"
       style="width:120px;height:120px;object-fit:contain;display:block;margin:0 auto 20px;"
     />
 
@@ -290,7 +290,7 @@
     <p class="subtitle">We'll send you a secure verification code.</p>
 
     <div class="email-note">
-        You'll receive an email from <strong data-company-support-email>hey@inneranimalmedia.com</strong>.<br>
+        You'll receive an email from <strong data-company-support-email>support@example.com</strong>.<br>
         Check your inbox and spam folder.
     </div>
 
@@ -365,7 +365,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>App</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -579,6 +579,7 @@
     }
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/pages/signup.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign up | Inner Animal Media</title>
+    <title>Sign up</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -398,12 +398,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="https://imagedelivery.net/g7wf09fCONpnidkRnR_5vw/527ab85a-01bb-4125-57bb-694fe8be8700/public"
-      alt="Inner Animal Media"
+      src="/shared/app-icon.png"
+      alt="Sign in"
     />
 
     <h1>Create account</h1>
-    <p class="subtitle" data-company-subtitle="signup">Join Inner Animal Media</p>
+    <p class="subtitle" data-company-subtitle="signup">Create an account</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
     <p id="cfConnectNotice" class="subtitle" style="color: #fdba74; display: none; margin-top: -12px; margin-bottom: 12px; font-size: 12px; line-height: 1.45; text-align: center; max-width: 320px;">Sign in with Google, GitHub, or Supabase first, then connect Cloudflare from Integrations.</p>
@@ -485,7 +485,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>Inner Animal Media</span>
+    <span data-company-name>App</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
@@ -835,6 +835,7 @@
     });
 })();
 </script>
+<script src="/shared/desktop-identity-bridge.js" defer></script>
 <script src="/shared/company-branding.js" defer></script>
 </body>
 </html>

package/packages/identity/src/frontend/auth-portal/shared/company-branding.js

@@ -1,6 +1,6 @@
 /**
  * Auth portal branding from D1 `company` via GET /api/company.
- * Static HTML keeps IAM defaults as fallback when API is unavailable.
+ * Static HTML keeps neutral portable defaults as fallback when host branding is unavailable.
  */
 (function () {
   var SUBTITLE_PREFIX = {

package/packages/identity/src/frontend/auth-portal/shared/desktop-identity-bridge.js

@@ -0,0 +1,176 @@
+(function () {
+  function getInvoke() {
+    try {
+      return window.__TAURI__?.core?.invoke
+        || window.parent?.__TAURI__?.core?.invoke
+        || null;
+    } catch {
+      return null;
+    }
+  }
+
+  var invoke = getInvoke();
+  if (!invoke) return;
+
+  var originalFetch = window.fetch.bind(window);
+
+  async function callIdentity(payload) {
+    var raw = await invoke('identity_bridge', {
+      requestJson: JSON.stringify(payload || {}),
+    });
+    var body = typeof raw === 'string' ? JSON.parse(raw) : raw;
+    if (!body || body.ok === false) {
+      throw new Error(body?.error || 'identity_request_failed');
+    }
+    return body;
+  }
+
+
+  function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+      status: status || 200,
+      headers: { 'content-type': 'application/json' },
+    });
+  }
+
+  function parseBody(init) {
+    if (!init?.body) return {};
+    try {
+      return typeof init.body === 'string' ? JSON.parse(init.body) : {};
+    } catch {
+      return {};
+    }
+  }
+
+  function notifyAuthenticated(body) {
+    try {
+      window.parent?.postMessage({
+        type: 'agentsam:desktop-identity',
+        authenticated: true,
+        user: body?.user || null,
+      }, '*');
+    } catch {}
+  }
+
+  window.fetch = async function packagedIdentityFetch(input, init) {
+    var url;
+    try {
+      url = new URL(typeof input === 'string' ? input : input.url, window.location.href);
+    } catch {
+      return originalFetch(input, init);
+    }
+
+    if (url.pathname === '/api/company') {
+      return jsonResponse({
+        name: 'App',
+        tagline: 'Welcome',
+        logoUrl: '/shared/app-icon.png',
+        authBgColor: '#050508',
+      });
+    }
+
+    if (url.pathname === '/api/auth/login') {
+      try {
+        var loginBody = parseBody(init);
+        var login = await callIdentity({
+          op: 'login',
+          email: loginBody.email,
+          password: loginBody.password,
+          next: loginBody.next || '/agentsam',
+        });
+        notifyAuthenticated(login);
+        return jsonResponse({ ok: true, user: login.user, redirect: '/agentsam' });
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 401);
+      }
+    }
+
+    if (url.pathname === '/api/auth/signup') {
+      try {
+        var signupBody = parseBody(init);
+        var signup = await callIdentity({
+          op: 'signup',
+          email: signupBody.email,
+          password: signupBody.password,
+          displayName: signupBody.name || signupBody.displayName || signupBody.display_name,
+          next: signupBody.next || '/agentsam',
+        });
+        notifyAuthenticated(signup);
+        return jsonResponse({ ok: true, user: signup.user, redirect: '/agentsam' });
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/password-reset/request') {
+      try {
+        var requestBody = parseBody(init);
+        var requested = await callIdentity({
+          op: 'reset_request',
+          email: requestBody.email,
+        });
+        return jsonResponse(requested);
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/password-reset/confirm') {
+      try {
+        var resetBody = parseBody(init);
+        var reset = await callIdentity({
+          op: 'reset_confirm',
+          email: resetBody.email,
+          code: resetBody.code,
+          password: resetBody.password,
+          confirm_password: resetBody.confirm_password || resetBody.confirmPassword || resetBody.confirm,
+        });
+        return jsonResponse(reset);
+      } catch (error) {
+        return jsonResponse({ ok: false, error: error?.message || String(error) }, 400);
+      }
+    }
+
+    if (url.pathname === '/api/auth/logout') {
+      try {
+        await callIdentity({ op: 'logout' });
+      } catch {}
+      return jsonResponse({ ok: true });
+    }
+
+    return originalFetch(input, init);
+  };
+
+  function localizeAuthLinks() {
+    var map = {
+      '/auth/login': './login.html',
+      '/auth/signup': './signup.html',
+      '/auth/reset': './reset.html',
+    };
+    document.querySelectorAll('a[href]').forEach(function (link) {
+      var href = link.getAttribute('href');
+      if (!href) return;
+      var base = href.split('?')[0];
+      if (map[base]) {
+        var query = href.indexOf('?') >= 0 ? href.slice(href.indexOf('?')) : '';
+        link.setAttribute('href', map[base] + query);
+      }
+    });
+
+    // Provider OAuth belongs to installed provider adapters. Do not render
+    // decorative/dead login buttons in the packaged native surface.
+    ['googleSignIn', 'githubSignIn', 'cloudflareSignIn'].forEach(function (id) {
+      var link = document.getElementById(id);
+      if (link) link.style.display = 'none';
+    });
+    var backupToggle = document.getElementById('backupCodeToggle');
+    if (backupToggle) {
+      var backupPrompt = backupToggle.closest('p');
+      if (backupPrompt) backupPrompt.style.display = 'none';
+      else backupToggle.style.display = 'none';
+    }
+  }
+
+  window.addEventListener('DOMContentLoaded', localizeAuthLinks);
+  window.__AGENTSAM_DESKTOP_IDENTITY__ = true;
+})();

package/packages/identity/src/index.js

@@ -21,7 +21,21 @@ import {
   GcpProvider,
   EmailProvider,
   CloudflareProvider,
+  ChatGptProvider,
 } from './providers/index.js';
+import {
+  STOCK_SIGN_IN_OPTIONS,
+  CMS_STOCK_SIGN_IN_IDS,
+  listStockSignInOptions,
+  getStockSignInOption,
+} from './contracts/sign-in-options.js';
+import {
+  createChatGptCmsAuthHost,
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  chatGPTSignOutPath,
+} from './providers/chatgpt/index.js';
 
 export {
   IdentityContractVersion,
@@ -40,6 +54,16 @@ export {
   GcpProvider,
   EmailProvider,
   CloudflareProvider,
+  ChatGptProvider,
+  STOCK_SIGN_IN_OPTIONS,
+  CMS_STOCK_SIGN_IN_IDS,
+  listStockSignInOptions,
+  getStockSignInOption,
+  createChatGptCmsAuthHost,
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  chatGPTSignOutPath,
 };
 
 export * from './core/index.js';
@@ -66,17 +90,36 @@ export {
 } from './server/post-auth.js';
 export { verifyAppAuthContract, verifyAppPackage } from './app/verify-app.js';
 export { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from './contracts/company.js';
+export {
+  buildOAuthConsentView,
+  normalizeOAuthConsentCompany,
+  normalizeOAuthConsentResource,
+  normalizeOAuthConsentClient,
+  normalizeOAuthConsentScope,
+} from './oauth/consent-view.js';
 export * from './contracts/auth-config.js';
 export { createPasswordResetService } from './recovery/password-reset.js';
 export {
   finalizeInboundOAuth,
   registerFinalizeInboundOAuth,
 } from './oauth/callback.js';
-export { createCloudflareD1Adapter } from './adapters/cloudflare-d1/index.js';
+export {
+  resolveOAuthCredentialLane,
+  resolveIamPlatformCredentials,
+  requireIamPlatformCredentials,
+} from './oauth/credentials.js';
+export {
+  handleGoogleDesktopExchangeRequest,
+  resolveGoogleExchangeSecret,
+} from './oauth/google-desktop-exchange.js';
+export { createCloudflareD1Adapter, createIamCompatIdentityAdapter } from './adapters/cloudflare-d1/index.js';
 export {
   createSqliteIdentityAdapter,
   applySqliteIdentityMigrations,
+  applyPortableIdentityMigrations,
+  resolveIdentitySchemaPack,
 } from './adapters/sqlite/index.js';
+export { createPortableD1IdentityAdapter } from './adapters/portable-d1/index.js';
 export { createIdentityService } from './server/identity-service.js';
 export { handleIdentityWorkerRequest } from './server/worker-router.js';
 

package/packages/identity/src/migrations/0001_identity_core.sql

@@ -1,5 +1,20 @@
 -- AgentSam Identity — customer D1 core (portable, boring, growable)
 -- Timestamps: INTEGER unixepoch seconds (AGENTS.md §2)
+--
+-- SSOT: `accounts` is the account row of record.
+-- `auth_users` is the login principal (1:1 with accounts.id in this portable scaffold).
+-- `account_identities` is IdP linkage only (provider + subject → accounts.id) — never the account SSOT.
+
+CREATE TABLE IF NOT EXISTS accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
 
 CREATE TABLE IF NOT EXISTS auth_users (
   id TEXT PRIMARY KEY NOT NULL,
@@ -9,7 +24,8 @@ CREATE TABLE IF NOT EXISTS auth_users (
   salt TEXT,
   status TEXT NOT NULL DEFAULT 'active',
   created_at INTEGER NOT NULL,
-  updated_at INTEGER NOT NULL
+  updated_at INTEGER NOT NULL,
+  FOREIGN KEY (id) REFERENCES accounts(id)
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_auth_users_email ON auth_users(email);
@@ -31,6 +47,7 @@ CREATE TABLE IF NOT EXISTS auth_sessions (
 CREATE INDEX IF NOT EXISTS idx_auth_sessions_user_expires
   ON auth_sessions(user_id, expires_at);
 
+-- IdP linkage only — points at accounts (SSOT), not a substitute for accounts.
 CREATE TABLE IF NOT EXISTS account_identities (
   id TEXT PRIMARY KEY NOT NULL,
   account_id TEXT NOT NULL,
@@ -39,7 +56,7 @@ CREATE TABLE IF NOT EXISTS account_identities (
   email TEXT,
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL,
-  FOREIGN KEY (account_id) REFERENCES auth_users(id)
+  FOREIGN KEY (account_id) REFERENCES accounts(id)
 );
 
 CREATE UNIQUE INDEX IF NOT EXISTS idx_account_identities_provider_subject

package/packages/identity/src/migrations/0003_accounts_ssot.sql

@@ -0,0 +1,20 @@
+-- Additive upgrade: accounts as SSOT for scaffolds that already applied an older 0001.
+-- Safe to re-run. New scaffolds get accounts from 0001_identity_core.sql directly.
+--
+-- account_identities remains IdP linkage only (provider + subject → accounts.id).
+
+CREATE TABLE IF NOT EXISTS accounts (
+  id TEXT PRIMARY KEY NOT NULL,
+  email TEXT NOT NULL COLLATE NOCASE,
+  display_name TEXT,
+  status TEXT NOT NULL DEFAULT 'active',
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_accounts_email ON accounts(email);
+
+-- Backfill from auth_users (1:1 portable scaffold).
+INSERT OR IGNORE INTO accounts (id, email, display_name, status, created_at, updated_at)
+SELECT id, email, display_name, COALESCE(status, 'active'), created_at, updated_at
+FROM auth_users;

package/packages/identity/src/migrations/README.md

@@ -1,28 +1,31 @@
-# Identity D1 migrations
+# Identity migrations under `src/migrations/` — IAM-compat scaffold / history
 
-Customer-scoped identity tables for `@inneranimalmedia/agentsam-sdk` identity apps.
+**This tree is NOT the portable customer D1 authority.**
 
-## Apply
+| Path | Authority |
+|---|---|
+| `packages/identity/migrations/sqlite/` | **Portable** `identity_*` SQL SSOT (`agentsam.identity` pack) |
+| `packages/identity/src/migrations/` | **IAM-shaped** scaffold / history (accounts, auth_users, company, …) |
 
-```bash
-# local
-wrangler d1 execute <database_name> --local --file=migrations/0001_identity_core.sql
+## When to use which
 
-# remote
-wrangler d1 execute <database_name> --remote --file=migrations/0001_identity_core.sql
-```
+| Audience | Adapter | Schema |
+|---|---|---|
+| New customer clean D1 / local SQLite | `createSqliteIdentityAdapter` / `createPortableD1IdentityAdapter` | Portable pack via `applyPortableIdentityMigrations` |
+| Existing InnerAnimalMedia / Local Studio hosted DB | `createIamCompatIdentityAdapter` (`createCloudflareD1Adapter` alias) | Live IAM tables — do not rename for portability |
 
-`agentsam identity init` copies this migration into the customer project automatically.
-
-## Tables
+## IAM-shaped tables in this directory
 
 | Table | Purpose |
 |-------|---------|
-| `auth_users` | Login identity (`au_*` ids) |
-| `auth_sessions` | Browser sessions |
-| `account_identities` | OAuth provider linkage |
-| `oauth_states` | PKCE/state for OAuth start |
-| `password_reset_tokens` | Reset flow (grow when wired) |
-| `company` | Branding SSOT — name, logo, colors, support info (`GET /api/company`) |
-
-IAM production tables remain the reference; this schema is **portable and boring** for customer Workers.
+| `accounts` | Account SSOT on hosted IAM |
+| `auth_users` | Login principal |
+| `auth_sessions` | Browser/desktop sessions |
+| `account_identities` | IdP linkage |
+| `oauth_states` | Historical PKCE/state (note: missing `app_id` vs portable invariant) |
+| `password_reset_tokens` | Historical SQL reset tokens — runtime recovery uses KV/`createPasswordResetService` |
+| `company` | Hosted branding table |
+
+New generic scaffolds must be generated from the **portable** `agentsam.identity` pack, not by copying this tree as “portable D1.”
+
+Preserve these files for IAM-compat fixtures and historical feature resources. Do not delete until Lane 1 parity is proven and call sites no longer need them.

package/packages/identity/src/oauth/README.md

@@ -3,15 +3,17 @@
 | Lane | Env vars | When |
 |------|----------|------|
 | **IAM platform (default)** | `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET` | Minted at install/build for every customer worker |
-| Developer Google | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET` | Takes `/api/oauth/google/start` when set |
+| Developer Google (web) | `GOOGLE_CLIENT_ID` + `GOOGLE_CLIENT_SECRET` | Takes `/api/oauth/google/start` when set |
+| Google Desktop / CLI | `GOOGLE_DESKTOP_CLIENT_ID` | Public Authorization Code + PKCE with loopback redirect; no desktop secret |
 | Developer GitHub | `GITHUB_CLIENT_ID` + `GITHUB_CLIENT_SECRET` | Takes `/api/oauth/github/start` when set |
+| Cloudflare sign-in | `CLOUDFLARE_OAUTH_CLIENT_ID` (+ optional secret) | Takes `/api/oauth/cloudflare/start` when set |
 
 Optional: `IAM_ORIGIN` (default `https://inneranimalmedia.com`).
 
 ## Secrets law
 
-- `IAM_CLIENT_ID` / `GOOGLE_CLIENT_ID` / `GITHUB_CLIENT_ID` — plaintext Wrangler vars (public by OAuth design).
-- `*_CLIENT_SECRET` — **Wrangler secrets only** — never plaintext in `wrangler.toml`.
+- `IAM_CLIENT_ID` / `GOOGLE_CLIENT_ID` / `GOOGLE_DESKTOP_CLIENT_ID` / `GITHUB_CLIENT_ID` / `CLOUDFLARE_OAUTH_CLIENT_ID` — plaintext Wrangler vars (public by OAuth design).
+- `*_CLIENT_SECRET` — **Wrangler secrets only** — never plaintext in `wrangler.toml`. Desktop clients normally have **no** secret.
 
 ```bash
 npx wrangler secret put IAM_CLIENT_SECRET
@@ -24,8 +26,10 @@ These routes live in the **customer** worker (`handleIdentityWorkerRequest`):
 1. `/api/oauth/inneranimalmedia/start` → redirects to IAM AS (requires minted `IAM_CLIENT_*`)
    - Legacy alias: `/api/oauth/iam/start`
 2. `/api/oauth/google/start` → BYOK Google if `GOOGLE_*` set, else platform lane if minted, else 503
-3. `/api/oauth/github/start` → same for GitHub
-4. Callback: `/api/oauth/inneranimalmedia/callback` (platform lane) or `/api/oauth/{google|github|cloudflare}/callback` (BYOK)
+3. `/api/oauth/google/desktop-exchange` → CLI/desktop PKCE broker (`GOOGLE_DESKTOP_CLIENT_ID`; loopback only)
+4. `/api/oauth/github/start` → same for GitHub
+5. `/api/oauth/cloudflare/start` → Cloudflare sign-in when `CLOUDFLARE_OAUTH_CLIENT_ID` set
+6. Callback: `/api/oauth/inneranimalmedia/callback` (platform lane) or `/api/oauth/{google|github|cloudflare}/callback` (BYOK)
    - Legacy alias: `/api/oauth/iam/callback`
 
 Register platform redirect URI on the IAM client:
@@ -49,6 +53,7 @@ OIDC scopes: `openid profile email` (not a bespoke `identity:*` namespace).
 ## Code
 
 - `credentials.js` — lane resolution
+- `google-desktop-exchange.js` — desktop PKCE token broker
 - `providers/iam/` — IAM AS client (`getIamAuthUrl`, `exchangeIamCode`, `fetchIamProfile`)
 - `iam-platform.js` — customer-worker start/callback wiring (uses `providers/iam/`)
 - `pkce.js` — shared PKCE helpers