@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/packages/agentsam-workbench/package.json

@@ -1,7 +1,6 @@
 {
   "name": "@inneranimalmedia/agentsam-workbench",
-  "version": "0.1.0",
-  "private": true,
+  "version": "2.6.7",
   "description": "Reusable AgentSam workbench primitives for agent threads, composer, browser, terminal and resizable work surfaces.",
   "type": "module",
   "main": "./src/index.ts",
@@ -10,6 +9,7 @@
     "./agent": "./src/agent/index.ts",
     "./agent/mini-agentsam.css": "./src/agent/mini-agentsam.css",
     "./agent/contextual-composer.css": "./src/agent/contextual-composer.css",
+    "./agent/tool-permission.css": "./src/agent/tool-permission.css",
     "./shell": "./src/shell/index.ts",
     "./browser": "./src/browser/index.ts",
     "./terminal": "./src/terminal/index.ts",
@@ -22,7 +22,7 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@inneranimalmedia/agentsam-contracts": "0.1.0"
+    "@inneranimalmedia/agentsam-contracts": "2.6.7"
   },
   "peerDependencies": {
     "react": ">=18",
@@ -34,5 +34,16 @@
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "typescript": "^5.9.3"
-  }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/agentsam-workbench"
+  },
+  "files": [
+    "src"
+  ]
 }

package/packages/agentsam-workbench/src/agent/ToolPermissionRequest.tsx

@@ -0,0 +1,94 @@
+import type {
+  AgentToolPermissionDecision,
+  AgentToolPermissionRequest as AgentToolPermissionRequestContract,
+} from '@inneranimalmedia/agentsam-contracts';
+
+export interface ToolPermissionRequestProps {
+  request: AgentToolPermissionRequestContract;
+  busy?: boolean;
+  className?: string;
+  onDecision: (decision: AgentToolPermissionDecision) => void | Promise<void>;
+}
+
+function permissionSummary(request: AgentToolPermissionRequestContract) {
+  if (request.summary) return request.summary;
+  const provider = request.provider ? ' through ' + request.provider : '';
+  return 'AgentSam wants to use ' + request.displayName + provider + '.';
+}
+
+export function ToolPermissionRequest({
+  request,
+  busy = false,
+  className,
+  onDecision,
+}: ToolPermissionRequestProps) {
+  const titleId = request.id + '-title';
+  const descriptionId = request.id + '-description';
+  const rootClass = 'agentsam-tool-permission-overlay' + (className ? ' ' + className : '');
+  return (
+    <div className={rootClass} role="presentation">
+      <section
+        className="agentsam-tool-permission-card"
+        role="alertdialog"
+        aria-modal="true"
+        aria-labelledby={titleId}
+        aria-describedby={descriptionId}
+      >
+        <header className="agentsam-tool-permission-header">
+          <div className="agentsam-tool-permission-mark" aria-hidden="true">AS</div>
+          <div>
+            <h2 id={titleId}>Allow AgentSam to use {request.displayName}?</h2>
+            <p id={descriptionId}>{permissionSummary(request)}</p>
+          </div>
+        </header>
+
+        <div className="agentsam-tool-permission-body">
+          <dl className="agentsam-tool-permission-facts">
+            <div><dt>Tool</dt><dd>{request.toolKey}</dd></div>
+            {request.provider ? <div><dt>Provider</dt><dd>{request.provider}</dd></div> : null}
+            {request.scope ? <div><dt>Scope</dt><dd>{request.scope}</dd></div> : null}
+            {request.riskLevel ? <div><dt>Risk</dt><dd>{request.riskLevel}</dd></div> : null}
+          </dl>
+
+          {request.sharedData?.length ? (
+            <div className="agentsam-tool-permission-shared">
+              <h3>Sharing data includes:</h3>
+              <dl>
+                {request.sharedData.map((item) => (
+                  <div key={item.label + ':' + item.value}>
+                    <dt>{item.label}</dt>
+                    <dd>{item.value}</dd>
+                  </div>
+                ))}
+              </dl>
+            </div>
+          ) : null}
+
+          {request.destructive ? (
+            <p className="agentsam-tool-permission-warning">
+              This action may modify or delete data. Review the scope before allowing it.
+            </p>
+          ) : null}
+        </div>
+
+        <footer className="agentsam-tool-permission-actions">
+          <button type="button" disabled={busy} onClick={() => void onDecision('deny')}>
+            Deny
+          </button>
+          <span className="agentsam-tool-permission-spacer" />
+          <button type="button" disabled={busy} onClick={() => void onDecision('allow_once')}>
+            Allow once
+          </button>
+          <button
+            type="button"
+            className="agentsam-tool-permission-primary"
+            disabled={busy}
+            onClick={() => void onDecision('allow_session')}
+          >
+            Allow for this session
+          </button>
+        </footer>
+      </section>
+    </div>
+  );
+}

package/packages/agentsam-workbench/src/agent/index.ts

@@ -8,3 +8,5 @@ export * from './ConnectedAgentPanel';
 export * from './GoalStatusStrip';
 export * from './MiniAgentSam';
 export * from './ContextualComposer';
+
+export * from './ToolPermissionRequest';

package/packages/agentsam-workbench/src/agent/tool-permission.css

@@ -0,0 +1,134 @@
+.agentsam-tool-permission-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 120;
+  display: grid;
+  place-items: center;
+  padding: 24px;
+  background: color-mix(in srgb, var(--background, #09090b) 68%, transparent);
+  backdrop-filter: blur(10px);
+}
+.agentsam-tool-permission-card {
+  width: min(640px, calc(100vw - 32px));
+  overflow: hidden;
+  border: 1px solid color-mix(in srgb, var(--border, #3f3f46) 82%, transparent);
+  border-radius: 22px;
+  background: color-mix(in srgb, var(--card, #18181b) 97%, black);
+  color: var(--card-foreground, #fafafa);
+  box-shadow: 0 28px 90px rgba(0, 0, 0, .45);
+}
+.agentsam-tool-permission-header {
+  display: flex;
+  gap: 14px;
+  align-items: flex-start;
+  padding: 22px 22px 18px;
+  border-bottom: 1px solid var(--border, #3f3f46);
+}
+.agentsam-tool-permission-mark {
+  display: grid;
+  place-items: center;
+  width: 38px;
+  height: 38px;
+  flex: 0 0 auto;
+  border: 1px solid var(--border, #3f3f46);
+  border-radius: 11px;
+  background: var(--background, #09090b);
+  font-size: 11px;
+  font-weight: 700;
+  letter-spacing: .08em;
+}
+.agentsam-tool-permission-header h2 {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 650;
+}
+.agentsam-tool-permission-header p {
+  margin: 6px 0 0;
+  color: var(--muted-foreground, #a1a1aa);
+  font-size: 13px;
+  line-height: 1.45;
+}
+.agentsam-tool-permission-body {
+  display: grid;
+  gap: 16px;
+  padding: 18px 22px;
+}
+.agentsam-tool-permission-facts,
+.agentsam-tool-permission-shared dl {
+  display: grid;
+  gap: 8px;
+  margin: 0;
+}
+.agentsam-tool-permission-facts > div,
+.agentsam-tool-permission-shared dl > div {
+  display: grid;
+  grid-template-columns: minmax(90px, 140px) 1fr;
+  gap: 14px;
+  align-items: baseline;
+}
+.agentsam-tool-permission-facts dt,
+.agentsam-tool-permission-shared dt {
+  color: var(--muted-foreground, #a1a1aa);
+  font-size: 12px;
+}
+.agentsam-tool-permission-facts dd,
+.agentsam-tool-permission-shared dd {
+  min-width: 0;
+  margin: 0;
+  overflow-wrap: anywhere;
+  font-size: 13px;
+}
+.agentsam-tool-permission-shared { padding-top: 2px; }
+.agentsam-tool-permission-shared h3 {
+  margin: 0 0 10px;
+  font-size: 12px;
+  font-weight: 600;
+}
+.agentsam-tool-permission-warning {
+  margin: 0;
+  border: 1px solid color-mix(in srgb, #f59e0b 45%, var(--border, #3f3f46));
+  border-radius: 12px;
+  padding: 10px 12px;
+  color: color-mix(in srgb, #fbbf24 72%, var(--card-foreground, #fafafa));
+  font-size: 12px;
+  line-height: 1.45;
+}
+.agentsam-tool-permission-actions {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  padding: 14px 16px;
+  border-top: 1px solid var(--border, #3f3f46);
+  background: color-mix(in srgb, var(--muted, #27272a) 42%, transparent);
+}
+.agentsam-tool-permission-actions button {
+  min-height: 36px;
+  border: 1px solid var(--border, #3f3f46);
+  border-radius: 10px;
+  padding: 0 13px;
+  background: var(--card, #18181b);
+  color: inherit;
+  font: inherit;
+  font-size: 12px;
+  cursor: pointer;
+}
+.agentsam-tool-permission-actions button:disabled {
+  cursor: wait;
+  opacity: .55;
+}
+.agentsam-tool-permission-actions button:hover:not(:disabled) {
+  background: var(--muted, #27272a);
+}
+.agentsam-tool-permission-actions .agentsam-tool-permission-primary {
+  border-color: color-mix(in srgb, var(--primary, #fafafa) 48%, var(--border, #3f3f46));
+  background: var(--primary, #fafafa);
+  color: var(--primary-foreground, #18181b);
+}
+.agentsam-tool-permission-spacer { flex: 1; }
+@media (max-width: 640px) {
+  .agentsam-tool-permission-overlay { padding: 12px; align-items: end; }
+  .agentsam-tool-permission-card { width: 100%; border-radius: 18px; }
+  .agentsam-tool-permission-actions { flex-wrap: wrap; }
+  .agentsam-tool-permission-spacer { display: none; }
+  .agentsam-tool-permission-actions button { flex: 1 1 auto; }
+}

package/packages/connectors/cloudflare/package.json

@@ -1,12 +1,22 @@
 {
   "name": "@inneranimalmedia/agentsam-connector-cloudflare",
-  "version": "0.1.0",
-  "private": true,
+  "version": "2.6.7",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
     "./capabilities": "./src/capabilities.js",
     "./api-client": "./src/api-client.js"
-  }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/connectors/cloudflare"
+  },
+  "files": [
+    "src"
+  ]
 }

package/packages/connectors/cloudflare/src/api-client.js

@@ -135,15 +135,16 @@ export class CloudflareApiClient {
     }
 
     const headers = {
-      Authorization: `Bearer ${this.apiToken}`,
       Accept: 'application/json',
+      ...(opts.headers || {}),
+      Authorization: `Bearer ${this.apiToken}`,
     };
     let body;
     if (opts.body != null && method !== 'GET' && method !== 'HEAD') {
       if (opts.body instanceof FormData || typeof opts.body === 'string' || Buffer.isBuffer(opts.body)) {
         body = opts.body;
       } else {
-        headers['Content-Type'] = 'application/json';
+        if (!headers['Content-Type'] && !headers['content-type']) headers['Content-Type'] = 'application/json';
         body = JSON.stringify(opts.body);
       }
     }

package/packages/connectors/cloudflare/src/families/vectorize.js

@@ -0,0 +1,127 @@
+import { createCloudflareApiClient } from '../api-client.js';
+
+export const VECTORIZE_CAPABILITY_ID = 'cloudflare.vectorize';
+
+const clean = value => String(value || '').trim();
+
+function assertIndex(index) {
+  const value = clean(index);
+  if (!value) throw new Error('cloudflare_vectorize_index_required');
+  return value;
+}
+
+function normalizeVector(record = {}) {
+  const id = clean(record.id);
+  const values = Array.isArray(record.values) ? record.values : record.vector;
+  if (!id) throw new Error('cloudflare_vectorize_vector_id_required');
+  if (!Array.isArray(values) || !values.length || values.some(value => typeof value !== 'number' || !Number.isFinite(value))) {
+    throw new Error('cloudflare_vectorize_vector_values_required');
+  }
+  const vector = { id, values };
+  if (record.namespace != null) vector.namespace = record.namespace;
+  if (record.metadata != null) vector.metadata = record.metadata;
+  return vector;
+}
+
+function workerBinding(binding, context = {}) {
+  if (context.backend && typeof context.backend.query === 'function' && typeof context.backend.upsert === 'function') return context.backend;
+  if (context.workerBinding && typeof context.workerBinding.query === 'function' && typeof context.workerBinding.upsert === 'function') return context.workerBinding;
+  return context.env?.[binding] || null;
+}
+
+async function apiClient(context = {}) {
+  if (context.apiClient) return context.apiClient;
+  return createCloudflareApiClient({
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    env: context.env || process.env,
+    ownerId: context.ownerId || context.owner_id || '',
+    explicitAccountId: context.accountId || context.account_id || '',
+    apiToken: context.apiToken || '',
+    authMode: context.authMode,
+    fetchImpl: context.fetchImpl,
+    decryptUserOauthToken: context.decryptUserOauthToken,
+  });
+}
+
+function indexPath(client, index, operation = '') {
+  const suffix = `/vectorize/v2/indexes/${encodeURIComponent(assertIndex(index))}${operation ? `/${operation}` : ''}`;
+  return client.accountPath(suffix);
+}
+
+export async function vectorizeUpsert({ binding, index, records, context = {} } = {}) {
+  const vectors = (records || []).map(normalizeVector);
+  const worker = workerBinding(binding, context);
+  if (worker) return { transport: 'worker_binding', result: await worker.upsert(vectors) };
+  const client = await apiClient(context);
+  const ndjson = vectors.map(row => JSON.stringify(row)).join('\n') + (vectors.length ? '\n' : '');
+  const result = await client.request('POST', indexPath(client, index, 'upsert'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.upsert',
+    headers: { 'Content-Type': 'application/x-ndjson' },
+    body: ndjson,
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeQuery({ binding, index, vector, options = {}, context = {} } = {}) {
+  if (!Array.isArray(vector) || !vector.length) throw new Error('cloudflare_vectorize_query_vector_required');
+  const worker = workerBinding(binding, context);
+  if (worker) return { transport: 'worker_binding', result: await worker.query(vector, options) };
+  const client = await apiClient(context);
+  const result = await client.request('POST', indexPath(client, index, 'query'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.query',
+    body: { vector, ...options },
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeDelete({ binding, index, ids, context = {} } = {}) {
+  const normalizedIds = (ids || []).map(clean).filter(Boolean);
+  const worker = workerBinding(binding, context);
+  if (worker) {
+    if (typeof worker.deleteByIds !== 'function') throw new Error('cloudflare_vectorize_worker_delete_unavailable');
+    return { transport: 'worker_binding', result: await worker.deleteByIds(normalizedIds) };
+  }
+  const client = await apiClient(context);
+  const result = await client.request('POST', indexPath(client, index, 'delete_by_ids'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.delete_by_ids',
+    body: { ids: normalizedIds },
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeGetByIds({ binding, index, ids, context = {} } = {}) {
+  const normalizedIds = (ids || []).map(clean).filter(Boolean);
+  const worker = workerBinding(binding, context);
+  if (worker) {
+    if (typeof worker.getByIds !== 'function') throw new Error('cloudflare_vectorize_worker_get_by_ids_unavailable');
+    return { transport: 'worker_binding', result: await worker.getByIds(normalizedIds) };
+  }
+  const client = await apiClient(context);
+  const result = await client.request('POST', indexPath(client, index, 'get_by_ids'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.get_by_ids',
+    body: { ids: normalizedIds },
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeHealth({ binding, index, context = {} } = {}) {
+  const worker = workerBinding(binding, context);
+  if (worker) {
+    if (typeof worker.describe !== 'function') return { operational: true, transport: 'worker_binding', detail: null };
+    return { operational: true, transport: 'worker_binding', detail: await worker.describe() };
+  }
+  try {
+    const client = await apiClient(context);
+    const result = await client.request('GET', indexPath(client, index, 'info'), {
+      capabilityId: VECTORIZE_CAPABILITY_ID,
+      operation: 'vectorize.info',
+    });
+    return { operational: true, transport: 'cloudflare_api', detail: result.result, auth: result.auth };
+  } catch (error) {
+    return { operational: false, transport: 'cloudflare_api', error: error?.code || error?.message || String(error) };
+  }
+}

package/packages/connectors/cloudflare/src/index.js

@@ -64,6 +64,7 @@ export * as keyless from './families/keyless.js';
 export * as tokenValidation from './families/token-validation.js';
 export * as pages from './families/pages.js';
 export * as snippets from './families/snippets.js';
+export * as vectorize from './families/vectorize.js';
 
 import { scopesForCapabilities as _scopesForCapabilities, scopesForFeaturePacks as _scopesForFeaturePacks } from './capabilities.js';
 import { CLOUDFLARE_ALL_SCOPES as _CLOUDFLARE_ALL_SCOPES, isKnownCloudflareScope } from './scope-catalog.js';

package/packages/heuristic-theme/README.md

@@ -1,9 +1,9 @@
-# @inneranimalmedia/heuristic-theme
+# @inneranimalmedia/theme-heuristic
 
 Stock AgentSam CMS storefront shell theme. Exports a deterministic theme contract consumed by CMS presets and `theme.storefront.shell`.
 
 ```js
-import { createStorefrontShellTheme } from "@inneranimalmedia/heuristic-theme";
+import { createStorefrontShellTheme } from "@inneranimalmedia/theme-heuristic";
 
 const theme = createStorefrontShellTheme();
 ```

package/packages/heuristic-theme/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "@inneranimalmedia/heuristic-theme",
-  "version": "0.1.0",
+  "name": "@inneranimalmedia/theme-heuristic",
+  "version": "2.6.7",
   "description": "Stock AgentSam CMS storefront shell theme contract (heuristic-theme).",
   "type": "module",
   "main": "./src/index.js",
@@ -21,5 +21,10 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/heuristic-theme"
+  }
 }

package/packages/heuristic-theme/src/registry.js

@@ -14,11 +14,11 @@ export function createHeuristicThemeProductRow({ accountId, repositoryId = null
     status: "wired",
     repository_id: repositoryId,
     canonical_path: "packages/heuristic-theme",
-    package_name: "@inneranimalmedia/heuristic-theme",
+    package_name: "@inneranimalmedia/theme-heuristic",
     metadata: {
       origin: "gallery_mount",
       normalization_state: "wired",
-      package: "@inneranimalmedia/heuristic-theme",
+      package: "@inneranimalmedia/theme-heuristic",
       preview_kind: "live",
       capabilities: ["theme.storefront.shell"],
       app_manifest: null,

package/packages/heuristic-theme/src/theme.js

@@ -32,7 +32,7 @@ export function createStorefrontShellTheme() {
       { type: "footer", label: "Footer" },
     ],
     metadata: {
-      package: "@inneranimalmedia/heuristic-theme",
+      package: "@inneranimalmedia/theme-heuristic",
       capability: "theme.storefront.shell",
       deterministic: true,
       demoSite: "demo",

package/packages/heuristic-theme/test/theme.test.mjs

@@ -10,7 +10,7 @@ test("createStorefrontShellTheme returns stable stock contract", () => {
   assert.ok(theme.surfaces.includes("cms.editor"));
   assert.ok(theme.slots.shell.includes("header"));
   assert.equal(theme.tokens["--color-accent"], "#1e6a6f");
-  assert.equal(theme.metadata.package, "@inneranimalmedia/heuristic-theme");
+  assert.equal(theme.metadata.package, "@inneranimalmedia/theme-heuristic");
   assert.deepEqual(createStorefrontShellTheme(), theme);
 });
 

package/packages/identity/.agentsam/features/oauth-login-portal/agentsam.feature.json

@@ -5,7 +5,7 @@
   "kind": "integration",
   "status": "extracted",
   "package": {
-    "name": "@inneranimalmedia/agentsam-sdk-identity",
+    "name": "@inneranimalmedia/agentsam-identity",
     "version": "2.6.3",
     "directory": "packages/identity"
   },

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -5,7 +5,9 @@
   "providers": [
     {
       "id": "inneranimalmedia",
-      "aliases": ["iam"],
+      "aliases": [
+        "iam"
+      ],
       "oauth_provider_key": "iam",
       "kind": "oidc",
       "status": "ready",
@@ -40,7 +42,9 @@
     },
     {
       "id": "google_desktop",
-      "aliases": ["google-desktop"],
+      "aliases": [
+        "google-desktop"
+      ],
       "kind": "oauth",
       "status": "ready",
       "implementation": "src/providers/google",
@@ -52,10 +56,8 @@
       "required_configuration": [
         "GOOGLE_DESKTOP_CLIENT_ID"
       ],
-      "optional_configuration": [
-        "GOOGLE_DESKTOP_CLIENT_SECRET"
-      ],
-      "notes": "Desktop/public PKCE client (Console type Desktop app — no secret). Worker brokers POST /api/oauth/google/desktop-exchange for loopback redirects. Optional GOOGLE_DESKTOP_CLIENT_SECRET only if the client id was mis-typed as Web."
+      "optional_configuration": [],
+      "notes": "Desktop/public PKCE client (Console type Desktop app). Uses system browser + loopback redirect and no embedded client secret."
     },
     {
       "id": "github",
@@ -81,7 +83,7 @@
         "identity.oauth.authorize",
         "identity.profile.resolve"
       ],
-      "notes": "Contract + authorize URL only — exchange not implemented."
+      "notes": "Contract + authorize URL only \u2014 exchange not implemented."
     },
     {
       "id": "email",
@@ -111,6 +113,24 @@
         "CLOUDFLARE_OAUTH_CLIENT_SECRET"
       ],
       "notes": "Cloudflare sign-in (same Worker secrets as the Cloudflare resource connector). Client secret optional for PKCE-only clients (Token Authentication Method = None)."
+    },
+    {
+      "id": "chatgpt",
+      "aliases": [
+        "openai",
+        "chatgpt-hosted"
+      ],
+      "kind": "hosted_headers",
+      "status": "ready",
+      "registered": true,
+      "implementation": "src/providers/chatgpt",
+      "capabilities": [
+        "identity.hosted.headers",
+        "identity.profile.resolve",
+        "cms.auth_host"
+      ],
+      "required_configuration": [],
+      "notes": "ChatGPT / OpenAI Apps SDK hosted identity. Reads oai-authenticated-* request headers and normalizes to NormalizedExternalIdentity (provider=chatgpt). Not classic OAuth client credentials — use createChatGptCmsAuthHost for /cms protection."
     }
   ]
 }

package/packages/identity/README.md

@@ -20,14 +20,14 @@ identity.login(request);   // alpha: throws until Identity Service adapter is wi
 identity.session.fromRequest(request);  // alpha: throws until adapter is wired
 ```
 
-**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. BYOK options: Google web, Google Desktop (`GOOGLE_DESKTOP_CLIENT_ID`), GitHub, Cloudflare (`CLOUDFLARE_OAUTH_CLIENT_*`). **Account SSOT:** `accounts` (not `account_identities` — that table is IdP linkage only).
+**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. BYOK options: Google web, Google Desktop (`GOOGLE_DESKTOP_CLIENT_ID`), GitHub, Cloudflare (`CLOUDFLARE_OAUTH_CLIENT_*`). **Stock CMS sign-in picker:** Cloudflare · Google · Inner Animal Media · ChatGPT (`hosted_headers` via Apps SDK). **Account SSOT:** `accounts` (not `account_identities` — that table is IdP linkage only).
 
 ## Layout
 
 ```
 src/
   core/           identity · sessions · accounts · recovery
-  providers/      google · github · gcp · email
+  providers/      google · github · gcp · email · iam · cloudflare · chatgpt
   oauth/          authorize/callback (extract from IAM — next sprint)
   adapters/       inneranimalmedia · cloudflare-d1
   contracts/