@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/packages/identity/migrations/D1_SCHEMA_MAPPING.md

@@ -1,32 +1,35 @@
-# Identity schema mapping — portable ↔ Cloudflare D1
+# Identity schema mapping — portable ↔ Cloudflare D1 (IAM compat)
 
 Portable SQLite (`packages/identity/migrations/sqlite/`) is the product schema.
-The D1 adapter maps existing hosted table names without requiring a big-bang rename.
+The IAM-compat adapter maps existing hosted table names without requiring a big-bang rename.
 
-| Portable (SQLite) | Hosted D1 (current) | Notes |
+| Portable (SQLite / portable D1) | Hosted D1 (IAM compat) | Notes |
 |---|---|---|
-| `identity_users` / account plane | **`accounts`** | **Account SSOT** — row of record |
-| login principal | `auth_users` | 1:1 with `accounts.id` in portable scaffold |
-| `identity_external_accounts` | `account_identities` | IdP linkage only (`account_id` → `accounts.id`) — never the account SSOT |
-| `identity_sessions` | `auth_sessions` | Same columns |
-| `identity_auth_events` | `auth_event_log` | Same columns |
-| `identity_oauth_transactions` | `identity_oauth_states` → migrate to `identity_oauth_transactions` | Requires `app_id NOT NULL`; no silent pre-app_id fallback |
-| `identity_provider_connections` | (new / connector tables) | `credential_ref` → vault/KMS; never store raw tokens in D1 rows |
+| `identity_users` / account plane | **`accounts`** + `auth_users` | **Account SSOT** — row of record |
+| `identity_external_accounts` | `account_identities` | IdP linkage only |
+| `identity_sessions` (+ `type`) | `auth_sessions` (+ `type`) | browser / desktop |
+| `identity_auth_events` | `auth_event_log` | Same semantics |
+| `identity_oauth_transactions` (+ native cols) | `identity_oauth_states` | Requires `app_id NOT NULL`; native cols optional |
+| `identity_native_handoffs` | `identity_native_handoffs` | Single-use desktop pickup |
+| `identity_companies` | `company` | Branding / host resolution |
+| `identity_provider_connections` | `identity_provider_connections` (or connector tables) | `credential_ref` only — never raw secrets |
 | `identity_app_registry` | cache of `agentsam.app.json` | Disk manifests remain SSOT |
 | `identity_route_registry` | projection cache | Disk manifests remain SSOT |
 | `identity_oauth_clients` … | optional `identity.oauth-server` pack | Only if product is an AS |
 
+Password recovery is **not** a portable core table. It uses `createPasswordResetService` with an injected `{get,put,delete}` store. Optional `identity.recovery` pack may exist later.
+
 ## Schema version
 
-Both adapters read `identity_schema_meta.schema_version` (SQLite) or
-`PRAGMA`/meta row. Missing `app_id` on OAuth transactions is an
-`IdentitySchemaError('IDENTITY_SCHEMA_MIGRATION_REQUIRED')`, not a soft
-downgrade.
+Portable adapters read `identity_schema_meta.schema_version`. Lane 1 requires version **2** (after `005_identity_company_native.sql`). Missing `app_id` on OAuth transactions is an `IdentitySchemaError`, not a soft downgrade.
 
 ## Packs
 
 | Pack | Apply when |
 |---|---|
-| `identity.core` | Always (local + hosted) |
+| `identity.core` | Always (local + hosted portable) |
 | `identity.oauth-client` | Signing into external IdPs |
 | `identity.oauth-server` | Product issues its own codes/tokens |
+
+Family manifest: `packages/identity/schema/agentsam.identity/manifest.json`
+Generic contract: `protocol/database/agentsam.schema-pack.v1.schema.json`

package/packages/identity/migrations/apply-portable.js

@@ -0,0 +1,109 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+
+/** Package-owned portable SQL SSOT (resolves inside installed npm package). */
+export const PORTABLE_IDENTITY_MIGRATIONS_DIR = path.resolve(HERE, 'sqlite');
+
+/** @deprecated Prefer PORTABLE_IDENTITY_MIGRATIONS_DIR */
+export const SQLITE_MIGRATIONS_DIR = PORTABLE_IDENTITY_MIGRATIONS_DIR;
+
+export const IDENTITY_SCHEMA_PACK_MANIFEST_PATH = path.resolve(
+  HERE,
+  '../schema/agentsam.identity/manifest.json',
+);
+
+/**
+ * Resolve the agentsam.identity pack-family manifest from the installed package.
+ * @returns {{ manifest: object, manifestPath: string, sqlDir: string }}
+ */
+export function resolveIdentitySchemaPack() {
+  const manifestPath = IDENTITY_SCHEMA_PACK_MANIFEST_PATH;
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  return {
+    manifest,
+    manifestPath,
+    sqlDir: PORTABLE_IDENTITY_MIGRATIONS_DIR,
+  };
+}
+
+function listPortableMigrationFiles(opts = {}) {
+  const files = [
+    '001_identity_core.sql',
+    '002_identity_oauth_client.sql',
+    '005_identity_company_native.sql',
+  ];
+  if (opts.includeOAuthServer) {
+    files.push('003_identity_oauth_server.sql');
+    files.push('004_identity_oauth_consent_catalog.sql');
+  }
+  return files;
+}
+
+function isIgnorableMigrationError(err) {
+  const msg = String(err?.message || err || '').toLowerCase();
+  return (
+    msg.includes('duplicate column')
+    || msg.includes('already exists')
+    || msg.includes('duplicate column name')
+  );
+}
+
+async function runSql(db, sql) {
+  if (typeof db.exec === 'function') {
+    try {
+      db.exec(sql);
+      return;
+    } catch (err) {
+      // Multi-statement exec may fail mid-file on duplicate ALTER; fall through to statements.
+      if (!isIgnorableMigrationError(err) && !/alter table/i.test(sql)) throw err;
+    }
+  }
+  const stripped = sql.replace(/\/\*[\s\S]*?\*\//g, '');
+  const statements = stripped
+    .split(';')
+    .map((s) => s.replace(/--[^\n]*/g, '').trim())
+    .filter(Boolean);
+  for (const statement of statements) {
+    try {
+      if (typeof db.exec === 'function' && !db.prepare) {
+        db.exec(statement);
+      } else {
+        await db.prepare(statement).run();
+      }
+    } catch (err) {
+      if (isIgnorableMigrationError(err)) continue;
+      throw err;
+    }
+  }
+}
+
+/**
+ * Apply portable agentsam.identity SQL pack to a SQLite or D1-shaped target.
+ * Same SQL sources for both; executor differs by driver API.
+ *
+ * @param {{ prepare?: Function, exec?: Function }} target
+ * @param {{ includeOAuthServer?: boolean }} [opts]
+ */
+export async function applyPortableIdentityMigrations(target, opts = {}) {
+  if (!target || (typeof target.exec !== 'function' && typeof target.prepare !== 'function')) {
+    throw new Error('applyPortableIdentityMigrations_requires_db_target');
+  }
+  const files = listPortableMigrationFiles(opts);
+  for (const file of files) {
+    const sqlPath = path.join(PORTABLE_IDENTITY_MIGRATIONS_DIR, file);
+    const sql = fs.readFileSync(sqlPath, 'utf8');
+    await runSql(target, sql);
+  }
+}
+
+/**
+ * Stable compatibility alias — same portable pack, same sources.
+ * @param {{ prepare?: Function, exec?: Function }} db
+ * @param {{ includeOAuthServer?: boolean }} [opts]
+ */
+export async function applySqliteIdentityMigrations(db, opts = {}) {
+  return applyPortableIdentityMigrations(db, opts);
+}

package/packages/identity/migrations/sqlite/004_identity_oauth_consent_catalog.sql

@@ -1,5 +1,5 @@
 -- identity.oauth-server consent catalog.
--- Issuer branding remains owned by the portable company table.
+-- Issuer branding remains owned by portable identity_companies (identity.core).
 
 INSERT OR IGNORE INTO identity_schema_meta (key, value)
 VALUES ('pack_oauth_consent_catalog', '1');

package/packages/identity/migrations/sqlite/005_identity_company_native.sql

@@ -0,0 +1,52 @@
+-- identity.core extension — company / brand + native handoff parity
+-- Portable identity_* names only. Does not create IAM `company` / `accounts`.
+-- Does NOT include password-reset tables — recovery remains storage-agnostic
+-- (createPasswordResetService + injected {get,put,delete} store).
+-- Upgrades schema_version 1 → 2. Safe to re-run (IF NOT EXISTS / ignorable ALTERs).
+
+INSERT OR REPLACE INTO identity_schema_meta (key, value)
+VALUES ('schema_version', '2');
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_company_native', '1');
+
+CREATE TABLE IF NOT EXISTS identity_companies (
+  id TEXT PRIMARY KEY NOT NULL,
+  slug TEXT NOT NULL,
+  name TEXT NOT NULL,
+  legal_name TEXT,
+  logo_url TEXT,
+  favicon_url TEXT,
+  primary_color TEXT,
+  auth_bg_color TEXT,
+  support_email TEXT,
+  website_url TEXT,
+  tagline TEXT,
+  meta_json TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_companies_slug
+  ON identity_companies(slug);
+
+CREATE TABLE IF NOT EXISTS identity_native_handoffs (
+  handoff_hash TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL,
+  challenge TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  FOREIGN KEY (session_id) REFERENCES identity_sessions(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_native_handoffs_expires
+  ON identity_native_handoffs(expires_at);
+
+-- Session type for browser vs desktop/native (default keeps existing rows as browser).
+ALTER TABLE identity_sessions ADD COLUMN type TEXT NOT NULL DEFAULT 'browser';
+
+-- Native OAuth transaction fields (optional on browser transactions).
+ALTER TABLE identity_oauth_transactions ADD COLUMN client_type TEXT;
+ALTER TABLE identity_oauth_transactions ADD COLUMN native_challenge TEXT;
+ALTER TABLE identity_oauth_transactions ADD COLUMN native_redirect TEXT;

package/packages/identity/package.json

@@ -1,9 +1,8 @@
 {
-  "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.5",
-  "private": true,
+  "name": "@inneranimalmedia/agentsam-identity",
+  "version": "2.6.7",
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",
@@ -27,10 +26,17 @@
     "./contracts/provider": "./src/contracts/provider.js",
     "./contracts/external-identity": "./src/contracts/external-identity.js",
     "./contracts/auth-config": "./src/contracts/auth-config.js",
+    "./contracts/identity-store": "./src/contracts/identity-store.js",
     "./oauth/callback": "./src/oauth/callback.js",
     "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
     "./providers/cloudflare": "./src/providers/cloudflare/index.js",
-    "./oauth/consent-view": "./src/oauth/consent-view.js"
+    "./providers/chatgpt": "./src/providers/chatgpt/index.js",
+    "./contracts/sign-in-options": "./src/contracts/sign-in-options.js",
+    "./oauth/consent-view": "./src/oauth/consent-view.js",
+    "./adapters/sqlite": "./src/adapters/sqlite/index.js",
+    "./adapters/portable-d1": "./src/adapters/portable-d1/index.js",
+    "./adapters/iam-compat": "./src/adapters/iam-compat/index.js",
+    "./adapters/cloudflare-d1": "./src/adapters/cloudflare-d1/index.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
@@ -38,5 +44,20 @@
   },
   "engines": {
     "node": ">=20"
-  }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/identity"
+  },
+  "files": [
+    "src",
+    "backend",
+    "migrations",
+    "schema",
+    "scripts"
+  ]
 }

package/packages/identity/schema/agentsam.identity/manifest.json

@@ -0,0 +1,101 @@
+{
+  "$schema": "../../../protocol/database/agentsam.schema-pack.v1.schema.json",
+  "schema": "agentsam.schema-pack.v1",
+  "id": "agentsam.identity",
+  "version": "2.0.0",
+  "pack_family": "agentsam.identity",
+  "components": [
+    "identity.core",
+    "identity.oauth-client",
+    "identity.oauth-server"
+  ],
+  "component_dependencies": {
+    "identity.core": [],
+    "identity.oauth-client": ["identity.core"],
+    "identity.oauth-server": ["identity.core"]
+  },
+  "adapters": [
+    "sqlite",
+    "portable-d1",
+    "iam-compat"
+  ],
+  "sql": {
+    "portable_dir": "migrations/sqlite",
+    "files": {
+      "identity.core": [
+        "001_identity_core.sql",
+        "005_identity_company_native.sql"
+      ],
+      "identity.oauth-client": [
+        "002_identity_oauth_client.sql"
+      ],
+      "identity.oauth-server": [
+        "003_identity_oauth_server.sql",
+        "004_identity_oauth_consent_catalog.sql"
+      ]
+    },
+    "apply_order_fresh": [
+      "001_identity_core.sql",
+      "002_identity_oauth_client.sql",
+      "005_identity_company_native.sql"
+    ],
+    "apply_order_upgrade_v1_to_v2": [
+      "005_identity_company_native.sql"
+    ],
+    "optional_after_core": [
+      "003_identity_oauth_server.sql",
+      "004_identity_oauth_consent_catalog.sql"
+    ]
+  },
+  "tables": {
+    "identity.core": [
+      "identity_schema_meta",
+      "identity_users",
+      "identity_external_accounts",
+      "identity_sessions",
+      "identity_auth_events",
+      "identity_app_registry",
+      "identity_route_registry",
+      "identity_companies",
+      "identity_native_handoffs"
+    ],
+    "identity.oauth-client": [
+      "identity_oauth_transactions",
+      "identity_provider_connections"
+    ],
+    "identity.oauth-server": [
+      "identity_oauth_clients",
+      "identity_oauth_authorization_codes",
+      "identity_oauth_access_tokens",
+      "identity_oauth_refresh_tokens",
+      "identity_oauth_resources",
+      "identity_oauth_scopes",
+      "identity_oauth_resource_scopes"
+    ]
+  },
+  "table_patterns": ["identity_*"],
+  "seed_policy": "none",
+  "compatibility": {
+    "iam-compat": {
+      "owns_portable_schema": false,
+      "maps_onto": [
+        "accounts",
+        "auth_users",
+        "account_identities",
+        "auth_sessions",
+        "auth_event_log",
+        "identity_oauth_states",
+        "identity_native_handoffs",
+        "company"
+      ],
+      "stable_alias": "createCloudflareD1Adapter"
+    }
+  },
+  "recovery": {
+    "authority": "createPasswordResetService",
+    "storage": "injected {get,put,delete} — not IdentityStore / not identity.core SQL",
+    "optional_future_pack": "identity.recovery"
+  },
+  "owner": "@inneranimalmedia/agentsam-sdk/identity",
+  "notes": "Pack family for portable IdentityStore. Component IDs remain the contract units. Portable SQL SSOT is migrations/sqlite/. IAM production tables are NOT this pack — use the iam-compat adapter against hosted schema. Secrets are credential_ref / vault references, never raw tokens in rows. Password recovery stays storage-agnostic."
+}

package/packages/identity/scripts/local-identity-bridge.mjs

@@ -59,14 +59,20 @@ function sanitizeUser(user) {
   };
 }
 
+function cliArg(name) {
+  const i = process.argv.indexOf(name);
+  return i > 1 ? process.argv[i + 1] : undefined;
+}
+
 const request = await readStdin();
-const dbPath = path.resolve(
-  process.env.AGENTSAM_IDENTITY_DB || '.agentsam/data/local-studio-identity.sqlite',
-);
-const manifestPath = path.resolve(
-  process.env.AGENTSAM_IDENTITY_APP_MANIFEST
-    || new URL('../../../apps/local-studio/agentsam.app.json', import.meta.url).pathname,
-);
+const dbArg = cliArg('--db');
+const manifestArg = cliArg('--manifest');
+if (!dbArg || !manifestArg) {
+  process.stderr.write('usage: local-identity-bridge.mjs --db <sqlite path> --manifest <agentsam.app.json>\n');
+  process.exit(2);
+}
+const dbPath = path.resolve(dbArg);
+const manifestPath = path.resolve(manifestArg);
 
 fs.mkdirSync(path.dirname(dbPath), { recursive: true, mode: 0o700 });
 const nativeDb = new DatabaseSync(dbPath);

package/packages/identity/scripts/preview-auth-portal.mjs

@@ -119,15 +119,15 @@ function hubHtml(baseUrl) {
 const PREVIEW_COMPANY = {
   id: 'co_default',
   slug: 'default',
-  name: 'AgentSam',
-  legalName: 'AgentSam',
-  logoUrl: '/shared/agentsam-mark.svg',
+  name: 'Preview App',
+  legalName: 'Preview App',
+  logoUrl: '/shared/app-icon.png',
   faviconUrl: null,
   primaryColor: '#007AFF',
   authBgColor: '#050508',
-  supportEmail: 'support@agentsam.dev',
-  websiteUrl: 'https://agentsam.dev',
-  tagline: 'Instant Access',
+  supportEmail: 'support@example.com',
+  websiteUrl: 'https://example.com',
+  tagline: 'Welcome',
   meta: {
     privacyUrl: '/privacy',
     termsUrl: '/terms',