@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/packages/identity/src/adapters/sqlite/index.js

@@ -1,322 +1,23 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-import {
-  IDENTITY_STORE_SCHEMA_VERSION,
-  IdentitySchemaError,
-} from '../../contracts/identity-store.js';
-import { newAccountIdentityId, newAuthEventId, newAuthUserId, newSessionId, nowUnix } from '../cloudflare-d1/ids.js';
-import { SESSION_POLICY } from '../../core/constants.js';
-
-const HERE = path.dirname(fileURLToPath(import.meta.url));
-export const SQLITE_MIGRATIONS_DIR = path.resolve(HERE, '../../../migrations/sqlite');
-
 /**
- * Apply identity.core + identity.oauth-client (+ optional oauth-server) to a
- * D1-shaped db ({ prepare().bind().run|first|all }).
- *
- * @param {{ prepare: Function }} db
- * @param {{ includeOAuthServer?: boolean }} [opts]
+ * Local SQLite IdentityStore — portable identity_* schema, zero Cloudflare/IAM.
+ * Shares the portable store implementation because Node SQLite is exposed through
+ * the same prepare/bind/first/run shape as D1-shaped bindings.
  */
-export async function applySqliteIdentityMigrations(db, opts = {}) {
-  const files = [
-    '001_identity_core.sql',
-    '002_identity_oauth_client.sql',
-  ];
-  if (opts.includeOAuthServer) {
-    files.push('003_identity_oauth_server.sql');
-    files.push('004_identity_oauth_consent_catalog.sql');
-  }
-
-  for (const file of files) {
-    const sql = fs.readFileSync(path.join(SQLITE_MIGRATIONS_DIR, file), 'utf8');
-    if (typeof db.exec === 'function') {
-      db.exec(sql);
-      continue;
-    }
-    // D1-shaped: run statement-by-statement (no multi-exec).
-    const stripped = sql.replace(/\/\*[\s\S]*?\*\//g, '');
-    const statements = stripped
-      .split(';')
-      .map((s) => s.replace(/--[^\n]*/g, '').trim())
-      .filter(Boolean);
-    for (const statement of statements) {
-      await db.prepare(statement).run();
-    }
-  }
-}
-
-async function hashValue(value) {
-  const v = String(value || '').trim();
-  if (!v) return null;
-  const bytes = new TextEncoder().encode(v);
-  const digest = await crypto.subtle.digest('SHA-256', bytes);
-  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
-}
+export {
+  applyPortableIdentityMigrations,
+  applySqliteIdentityMigrations,
+  PORTABLE_IDENTITY_MIGRATIONS_DIR,
+  SQLITE_MIGRATIONS_DIR,
+  resolveIdentitySchemaPack,
+  IDENTITY_SCHEMA_PACK_MANIFEST_PATH,
+} from '../../../migrations/apply-portable.js';
 
-async function requireSchema(db) {
-  let row;
-  try {
-    row = await db.prepare(
-      `SELECT value FROM identity_schema_meta WHERE key = 'schema_version' LIMIT 1`,
-    ).bind().first();
-  } catch (err) {
-    throw new IdentitySchemaError(
-      'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-      'identity.core migrations not applied — run applySqliteIdentityMigrations()',
-      { cause: String(err?.message || err) },
-    );
-  }
-  const version = Number(row?.value || 0);
-  if (version < IDENTITY_STORE_SCHEMA_VERSION) {
-    throw new IdentitySchemaError(
-      'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-      `identity schema_version=${version}, required=${IDENTITY_STORE_SCHEMA_VERSION}`,
-      { version, required: IDENTITY_STORE_SCHEMA_VERSION },
-    );
-  }
-}
+import { createPortableIdentityStore } from '../portable-store.js';
 
 /**
- * Local SQLite IdentityStore — full offline identity, no Cloudflare/IAM.
  * @param {{ prepare: Function }} db D1-shaped binding (see createLocalSqliteDatabase)
  * @param {{ sessionTtlSeconds?: number, skipSchemaCheck?: boolean }} [options]
  */
 export function createSqliteIdentityAdapter(db, options = {}) {
-  if (!db?.prepare) throw new Error('sqlite_identity_adapter_requires_db');
-  const sessionTtlSeconds = options.sessionTtlSeconds ?? SESSION_POLICY.browser.ttlSeconds;
-  let schemaReady = Boolean(options.skipSchemaCheck);
-
-  async function ensure() {
-    if (schemaReady) return;
-    await requireSchema(db);
-    schemaReady = true;
-  }
-
-  return Object.freeze({
-    schemaVersion: IDENTITY_STORE_SCHEMA_VERSION,
-    sessionTtlSeconds,
-    backend: 'sqlite',
-
-    async findUserByEmail(email) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
-         FROM identity_users WHERE email = ? COLLATE NOCASE LIMIT 1`,
-      ).bind(String(email || '').trim().toLowerCase()).first();
-      return row || null;
-    },
-
-    async findUserById(userId) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
-         FROM identity_users WHERE id = ? LIMIT 1`,
-      ).bind(userId).first();
-      return row || null;
-    },
-
-    async createUser({ email, passwordHash, salt, displayName }) {
-      await ensure();
-      const id = newAuthUserId();
-      const ts = nowUnix();
-      const normalizedEmail = String(email || '').trim().toLowerCase();
-      await db.prepare(
-        `INSERT INTO identity_users (id, email, display_name, password_hash, salt, status, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`,
-      ).bind(id, normalizedEmail, displayName || null, passwordHash || null, salt || null, ts, ts).run();
-      return this.findUserById(id);
-    },
-
-    async updateUserPassword(userId, passwordHash, salt) {
-      await ensure();
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE identity_users SET password_hash = ?, salt = ?, updated_at = ? WHERE id = ?`,
-      ).bind(passwordHash, salt, ts, userId).run();
-    },
-
-    async findUserByProvider(provider, providerSubject) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT u.id, u.email, u.display_name, u.password_hash, u.salt, u.status, u.created_at, u.updated_at
-         FROM identity_external_accounts ea
-         JOIN identity_users u ON u.id = ea.user_id
-         WHERE ea.provider = ? AND ea.provider_subject = ?
-         LIMIT 1`,
-      ).bind(provider, providerSubject).first();
-      return row || null;
-    },
-
-    async upsertProviderIdentity({ accountId, provider, providerSubject, email }) {
-      await ensure();
-      const existing = await db.prepare(
-        `SELECT id FROM identity_external_accounts WHERE provider = ? AND provider_subject = ? LIMIT 1`,
-      ).bind(provider, providerSubject).first();
-      const ts = nowUnix();
-      if (existing?.id) {
-        await db.prepare(
-          `UPDATE identity_external_accounts SET user_id = ?, email = ?, updated_at = ? WHERE id = ?`,
-        ).bind(accountId, email || null, ts, existing.id).run();
-        return existing.id;
-      }
-      const id = newAccountIdentityId();
-      await db.prepare(
-        `INSERT INTO identity_external_accounts (id, user_id, provider, provider_subject, email, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(id, accountId, provider, providerSubject, email || null, ts, ts).run();
-      return id;
-    },
-
-    async createSession({ userId, email, provider, providerSubject, displayName }) {
-      await ensure();
-      const id = newSessionId();
-      const ts = nowUnix();
-      const expiresAt = ts + sessionTtlSeconds;
-      await db.prepare(
-        `INSERT INTO identity_sessions
-         (id, user_id, email, provider, provider_subject, display_name, expires_at, created_at, last_active_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(
-        id, userId, email || null, provider || 'email', providerSubject || null,
-        displayName || null, expiresAt, ts, ts,
-      ).run();
-      return {
-        id, user_id: userId, email, provider: provider || 'email',
-        provider_subject: providerSubject || null, display_name: displayName || null,
-        expires_at: expiresAt, created_at: ts,
-      };
-    },
-
-    async getSession(sessionId) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT id, user_id, email, provider, provider_subject, display_name, expires_at, revoked_at, created_at, last_active_at
-         FROM identity_sessions WHERE id = ? LIMIT 1`,
-      ).bind(sessionId).first();
-      if (!row || row.revoked_at || row.expires_at <= nowUnix()) return null;
-      return row;
-    },
-
-    async revokeSession(sessionId, reason = 'logout') {
-      await ensure();
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE identity_sessions SET revoked_at = ?, last_active_at = ? WHERE id = ? AND revoked_at IS NULL`,
-      ).bind(ts, ts, sessionId).run();
-      return { ok: true, reason };
-    },
-
-    async createOAuthTransaction({ state, provider, codeVerifier, returnTo, appId, ttlSeconds = 600 }) {
-      await ensure();
-      if (!appId) {
-        throw new IdentitySchemaError(
-          'OAUTH_TRANSACTION_APP_ID_REQUIRED',
-          'OAuth transactions must include app_id — refusing to create orphan auth state',
-        );
-      }
-      const ts = nowUnix();
-      await db.prepare(
-        `INSERT INTO identity_oauth_transactions
-         (state, provider, code_verifier, return_to, app_id, expires_at, created_at, consumed_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, NULL)`,
-      ).bind(state, provider, codeVerifier, returnTo || null, appId, ts + ttlSeconds, ts).run();
-    },
-
-    /** @deprecated Use createOAuthTransaction */
-    async saveOAuthState(input) {
-      return this.createOAuthTransaction({
-        ...input,
-        returnTo: input.redirectTo ?? input.returnTo,
-        appId: input.appId,
-      });
-    },
-
-    async consumeOAuthTransaction(state) {
-      await ensure();
-      const row = await db.prepare(
-        `SELECT state, provider, code_verifier, return_to, app_id, expires_at, created_at, consumed_at
-         FROM identity_oauth_transactions WHERE state = ? LIMIT 1`,
-      ).bind(state).first();
-      if (!row) return null;
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE identity_oauth_transactions SET consumed_at = ? WHERE state = ?`,
-      ).bind(ts, state).run();
-      await db.prepare(`DELETE FROM identity_oauth_transactions WHERE state = ?`).bind(state).run();
-      if (row.consumed_at) return null;
-      if (row.expires_at <= ts) return null;
-      if (!row.app_id) {
-        throw new IdentitySchemaError(
-          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-          'OAuth transaction missing app_id — refuse silent pre-app_id semantics',
-        );
-      }
-      return {
-        state: row.state,
-        provider: row.provider,
-        code_verifier: row.code_verifier,
-        redirect_to: row.return_to,
-        return_to: row.return_to,
-        app_id: row.app_id,
-        expires_at: row.expires_at,
-        created_at: row.created_at,
-        consumed_at: ts,
-      };
-    },
-
-    /** @deprecated Use consumeOAuthTransaction */
-    async consumeOAuthState(state) {
-      return this.consumeOAuthTransaction(state);
-    },
-
-    async logAuthEvent({
-      userId, accountId, eventType, status = 'ok', provider,
-      session, capabilities, activity, client, metadata, request,
-    }) {
-      try {
-        await ensure();
-        const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
-        const ua = request?.headers?.get?.('user-agent') || '';
-        const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
-        const envelope = {
-          ...(metadata && typeof metadata === 'object' ? metadata : {}),
-          ...(accountId ? { accountId } : {}),
-          ...(session ? { session } : {}),
-          ...(capabilities ? { capabilities } : {}),
-          ...(activity ? { activity } : {}),
-          ...(client ? { client } : {}),
-        };
-        await db.prepare(
-          `INSERT INTO identity_auth_events
-           (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        ).bind(
-          newAuthEventId(), userId || null, eventType, status, provider || null,
-          JSON.stringify(envelope), ipHash, uaHash, nowUnix(),
-        ).run();
-      } catch {
-        /* never break auth on audit failure */
-      }
-    },
-
-    async countAuthActivity(userId) {
-      await ensure();
-      if (!userId) return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
-      const logins = await db.prepare(
-        `SELECT COUNT(*) AS c, MAX(created_at) AS last_at
-         FROM identity_auth_events
-         WHERE user_id = ? AND event_type = 'login' AND status = 'ok'`,
-      ).bind(userId).first();
-      const sessions = await db.prepare(
-        `SELECT COUNT(*) AS c FROM identity_sessions
-         WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?`,
-      ).bind(userId, nowUnix()).first();
-      return {
-        loginCount: Number(logins?.c || 0),
-        activeSessionCount: Number(sessions?.c || 0),
-        lastLoginAt: logins?.last_at != null ? Number(logins.last_at) : null,
-      };
-    },
-  });
+  return createPortableIdentityStore(db, { ...options, backend: 'sqlite' });
 }

package/packages/identity/src/contracts/auth-config.js

@@ -21,7 +21,6 @@ export const AGENTSAM_AUTH_ENV = Object.freeze({
   googleClientId: 'GOOGLE_CLIENT_ID',
   googleClientSecret: 'GOOGLE_CLIENT_SECRET',
   googleDesktopClientId: 'GOOGLE_DESKTOP_CLIENT_ID',
-  googleDesktopClientSecret: 'GOOGLE_DESKTOP_CLIENT_SECRET',
   githubClientId: 'GITHUB_CLIENT_ID',
   githubClientSecret: 'GITHUB_CLIENT_SECRET',
   cloudflareOauthClientId: 'CLOUDFLARE_OAUTH_CLIENT_ID',

package/packages/identity/src/contracts/identity-store.js

@@ -1,7 +1,12 @@
 /**
  * Portable IdentityStore contract.
- * Adapters (SQLite, D1, Postgres) implement this — the identity service never
- * imports Cloudflare/D1 APIs directly for product logic.
+ * Adapters (SQLite, portable D1, IAM-compat) implement this — the identity service
+ * never imports Cloudflare/D1 APIs directly for product logic.
+ *
+ * Company / native handoff / provider-connection behavior belong on this contract
+ * (not undocumented adapter-only magic). Password recovery remains a separate
+ * storage-agnostic service (createPasswordResetService + injected {get,put,delete});
+ * adapters supply user lookup / password update hooks, not a mandatory SQL reset table.
  */
 
 /**
@@ -24,6 +29,7 @@
  * @property {string|null} [provider]
  * @property {string|null} [provider_subject]
  * @property {string|null} [display_name]
+ * @property {'browser'|'desktop'} [type]
  * @property {number} expires_at
  * @property {number|null} [revoked_at]
  * @property {number} created_at
@@ -37,6 +43,9 @@
  * @property {string} code_verifier
  * @property {string|null} [return_to]
  * @property {string} app_id
+ * @property {'desktop'|string|null} [client_type]
+ * @property {string|null} [native_challenge]
+ * @property {string|null} [native_redirect]
  * @property {number} expires_at
  * @property {number} created_at
  * @property {number|null} [consumed_at]
@@ -57,6 +66,37 @@
  * @property {Request} [request]
  */
 
+/**
+ * @typedef {object} CompanyProfile
+ * @property {string} id
+ * @property {string} slug
+ * @property {string} name
+ * @property {string|null} [legalName]
+ * @property {string|null} [logoUrl]
+ * @property {string|null} [faviconUrl]
+ * @property {string|null} [primaryColor]
+ * @property {string|null} [authBgColor]
+ * @property {string|null} [supportEmail]
+ * @property {string|null} [websiteUrl]
+ * @property {string|null} [tagline]
+ * @property {object} [meta]
+ * @property {number} [createdAt]
+ * @property {number} [updatedAt]
+ */
+
+/**
+ * @typedef {object} ProviderConnection
+ * @property {string} id
+ * @property {string} user_id
+ * @property {string} provider
+ * @property {string[]} granted_scopes
+ * @property {string} credential_ref
+ * @property {number|null} [expires_at]
+ * @property {boolean} [refreshable]
+ * @property {number} created_at
+ * @property {number} updated_at
+ */
+
 /**
  * @typedef {object} IdentityStore
  * @property {number} schemaVersion
@@ -66,21 +106,32 @@
  * @property {(userId: string, passwordHash: string, salt: string) => Promise<void>} updateUserPassword
  * @property {(provider: string, providerSubject: string) => Promise<IdentityUser|null>} findUserByProvider
  * @property {(input: { accountId: string, provider: string, providerSubject: string, email?: string|null }) => Promise<string>} upsertProviderIdentity
- * @property {(input: { userId: string, email?: string|null, provider?: string, providerSubject?: string|null, displayName?: string|null }) => Promise<IdentitySession>} createSession
+ * @property {(input: { userId: string, email?: string|null, provider?: string, providerSubject?: string|null, displayName?: string|null, type?: 'browser'|'desktop' }) => Promise<IdentitySession>} createSession
  * @property {(sessionId: string) => Promise<IdentitySession|null>} getSession
  * @property {(sessionId: string, reason?: string) => Promise<{ ok: true, reason: string }>} revokeSession
- * @property {(input: { state: string, provider: string, codeVerifier: string, returnTo?: string|null, appId: string, ttlSeconds?: number }) => Promise<void>} createOAuthTransaction
+ * @property {(input: { state: string, provider: string, codeVerifier: string, returnTo?: string|null, appId: string, ttlSeconds?: number, clientType?: string, nativeChallenge?: string, nativeRedirect?: string }) => Promise<void>} createOAuthTransaction
  * @property {(state: string) => Promise<OAuthTransaction|null>} consumeOAuthTransaction
  * @property {(input: AuthEventInput) => Promise<void>} logAuthEvent
  * @property {(userId: string) => Promise<{ loginCount: number, activeSessionCount: number, lastLoginAt: number|null }>} [countAuthActivity]
+ * @property {(input: { handoffHash: string, sessionId: string, challenge: string, ttlSeconds?: number }) => Promise<void>} createNativeHandoff
+ * @property {(handoffHash: string) => Promise<{ session_id: string, challenge: string }|null>} consumeNativeHandoff
+ * @property {(slug?: string) => Promise<CompanyProfile|null>} getCompanyBySlug
+ * @property {(hostname: string|null|undefined) => Promise<CompanyProfile|null>} getCompanyByHost
+ * @property {() => Promise<CompanyProfile|null>} getDefaultCompany
+ * @property {(input: object) => Promise<CompanyProfile|null>} upsertCompany
+ * @property {(input: { userId: string, provider: string, credentialRef: string, grantedScopes?: string[], expiresAt?: number|null, refreshable?: boolean }) => Promise<string>} upsertProviderConnection
+ * @property {(userId: string, provider: string) => Promise<ProviderConnection|null>} getProviderConnection
  */
 
-export const IDENTITY_STORE_SCHEMA_VERSION = 1;
+/** Portable pack schema_version after 005_identity_company_native. */
+export const IDENTITY_STORE_SCHEMA_VERSION = 2;
 
 export const IDENTITY_PACKS = Object.freeze({
   CORE: 'identity.core',
   OAUTH_CLIENT: 'identity.oauth-client',
   OAUTH_SERVER: 'identity.oauth-server',
+  /** Optional future — not part of portable core. Recovery stays KV/injected today. */
+  RECOVERY: 'identity.recovery',
 });
 
 /**

package/packages/identity/src/contracts/provider.js

@@ -8,4 +8,5 @@ export const IdentityProviders = Object.freeze([
   'gcp',
   'inneranimalmedia',
   'cloudflare',
+  'chatgpt',
 ]);

package/packages/identity/src/contracts/sign-in-options.js

@@ -0,0 +1,104 @@
+/**
+ * Stock sign-in options for OAuth / CMS editor first-run setup.
+ * user123 picks from these prepackaged providers when wiring auth.
+ */
+
+/** @typedef {'oauth' | 'oidc' | 'hosted_headers' | 'local'} StockSignInKind */
+
+/**
+ * @typedef {object} StockSignInOption
+ * @property {string} id
+ * @property {string} label
+ * @property {string} [shortLabel]
+ * @property {StockSignInKind} kind
+ * @property {'ready' | 'scaffold'} status
+ * @property {string} description
+ * @property {string[]} [aliases]
+ * @property {string[]} [requiredEnv]
+ * @property {string[]} [optionalEnv]
+ * @property {string} [implementation]
+ * @property {boolean} [cmsDefault]
+ */
+
+/** @type {readonly StockSignInOption[]} */
+export const STOCK_SIGN_IN_OPTIONS = Object.freeze([
+  {
+    id: 'cloudflare',
+    label: 'Cloudflare',
+    shortLabel: 'Cloudflare',
+    kind: 'oauth',
+    status: 'ready',
+    description: 'Sign in with Cloudflare account OAuth (PKCE-capable).',
+    requiredEnv: ['CLOUDFLARE_OAUTH_CLIENT_ID'],
+    optionalEnv: ['CLOUDFLARE_OAUTH_CLIENT_SECRET'],
+    implementation: 'src/providers/cloudflare',
+  },
+  {
+    id: 'google',
+    label: 'Google',
+    shortLabel: 'Google',
+    kind: 'oauth',
+    status: 'ready',
+    description: 'Sign in with Google (browser OAuth confidential client).',
+    requiredEnv: ['GOOGLE_CLIENT_ID', 'GOOGLE_CLIENT_SECRET'],
+    implementation: 'src/providers/google',
+  },
+  {
+    id: 'inneranimalmedia',
+    label: 'Inner Animal Media',
+    shortLabel: 'IAM',
+    kind: 'oidc',
+    status: 'ready',
+    description: 'Sign in with Inner Animal Media platform identity (OIDC).',
+    aliases: ['iam'],
+    requiredEnv: ['IAM_CLIENT_ID', 'IAM_CLIENT_SECRET'],
+    optionalEnv: ['IAM_OAUTH_ISSUER', 'IAM_ORIGIN'],
+    implementation: 'src/providers/iam',
+    cmsDefault: true,
+  },
+  {
+    id: 'chatgpt',
+    label: 'ChatGPT',
+    shortLabel: 'ChatGPT',
+    kind: 'hosted_headers',
+    status: 'ready',
+    description:
+      'Sign in via ChatGPT / OpenAI Apps SDK hosted identity (oai-authenticated headers → NormalizedExternalIdentity).',
+    aliases: ['openai', 'chatgpt-hosted'],
+    requiredEnv: [],
+    implementation: 'src/providers/chatgpt',
+  },
+]);
+
+/** Canonical ids offered on CMS / OAuth prebuild pickers. */
+export const CMS_STOCK_SIGN_IN_IDS = Object.freeze(
+  STOCK_SIGN_IN_OPTIONS.map((row) => row.id),
+);
+
+/**
+ * @param {string} id
+ * @returns {StockSignInOption | null}
+ */
+export function getStockSignInOption(id) {
+  const key = String(id || '')
+    .trim()
+    .toLowerCase()
+    .replace(/-/g, '_');
+  if (!key) return null;
+  if (key === 'iam') {
+    return STOCK_SIGN_IN_OPTIONS.find((row) => row.id === 'inneranimalmedia') || null;
+  }
+  if (key === 'openai' || key === 'chatgpt_hosted') {
+    return STOCK_SIGN_IN_OPTIONS.find((row) => row.id === 'chatgpt') || null;
+  }
+  return (
+    STOCK_SIGN_IN_OPTIONS.find((row) => row.id === key) ||
+    STOCK_SIGN_IN_OPTIONS.find((row) => (row.aliases || []).includes(String(id || '').trim().toLowerCase())) ||
+    null
+  );
+}
+
+/** @returns {StockSignInOption[]} */
+export function listStockSignInOptions() {
+  return [...STOCK_SIGN_IN_OPTIONS];
+}

package/packages/identity/src/core/constants.js

@@ -6,7 +6,7 @@
 
 import { SESSION_POLICY } from './session-policy.js';
 
-export { SESSION_POLICY, clampAgentSessionTtl } from './session-policy.js';
+export { SESSION_POLICY, clampAgentSessionTtl, shouldRenewDesktopSession } from './session-policy.js';
 
 export const AUTH_COOKIE_NAME = 'session';
 

package/packages/identity/src/core/session-policy.js

@@ -6,10 +6,24 @@
  * Product routing does not live here.
  */
 
+/** auth_sessions.type values written by this package. */
+export const SESSION_TYPES = Object.freeze({
+  BROWSER: 'browser',
+  DESKTOP: 'desktop',
+});
+
+/** Lifetime of the one-time code a native OAuth callback hands to the app. */
+export const NATIVE_HANDOFF_TTL_SECONDS = 120;
+
 export const SESSION_POLICY = Object.freeze({
   browser: Object.freeze({
     ttlSeconds: 30 * 24 * 60 * 60,
   }),
+  /** Native app bearer session (OS keychain) — minted via the native OAuth handoff. */
+  desktop: Object.freeze({
+    ttlSeconds: 30 * 24 * 60 * 60,
+    renewWindowSeconds: 7 * 24 * 60 * 60,
+  }),
   /** Temporary execution authority — not the user's Local Studio login. */
   agent: Object.freeze({
     minTtlSeconds: 60,
@@ -18,6 +32,23 @@ export const SESSION_POLICY = Object.freeze({
   }),
 });
 
+/**
+ * Desktop sessions are durable/revocable AgentSam sessions, not provider tokens.
+ * Renew only near expiry so normal app launches remain read-mostly.
+ */
+export function shouldRenewDesktopSession(session, nowSeconds) {
+  const now = Number.isFinite(Number(nowSeconds))
+    ? Math.floor(Number(nowSeconds))
+    : Math.floor(Date.now() / 1000);
+  const expiresAt = Number(session?.expires_at);
+  return (
+    session?.type === SESSION_TYPES.DESKTOP
+    && Number.isFinite(expiresAt)
+    && expiresAt > now
+    && expiresAt - now <= SESSION_POLICY.desktop.renewWindowSeconds
+  );
+}
+
 /**
  * Clamp a requested agent/runtime grant TTL into policy bounds.
  * @param {number|null|undefined} requestedSeconds

package/packages/identity/src/frontend/auth-portal/pages/login.html

@@ -4,7 +4,7 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Sign in | AgentSam</title>
+    <title>Sign in</title>
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800;900&display=swap"
         rel="stylesheet">
     <script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
@@ -360,12 +360,12 @@
 <div class="login-card">
     <img
       class="auth-logo"
-      src="/shared/agentsam-mark.svg"
-      alt="AgentSam"
+      src="/shared/app-icon.png"
+      alt="Sign in"
     />
 
-    <h1 data-company-tagline>Instant Access</h1>
-    <p class="subtitle" data-company-subtitle="signin">Sign in to AgentSam</p>
+    <h1 data-company-tagline>Welcome</h1>
+    <p class="subtitle" data-company-subtitle="signin">Sign in</p>
     <p id="registeredMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Account created. Sign in below.</p>
     <p id="resetMsg" class="subtitle" style="color: #10B981; display: none; margin-top: -16px; margin-bottom: 16px;">Password updated. Sign in with your new password.</p>
     <p id="oauthErrorMsg" class="subtitle" style="color: #FF3B30; display: none; margin-top: -16px; margin-bottom: 16px;"></p>
@@ -451,7 +451,7 @@
 </div>
 
 <footer class="auth-min-footer" aria-label="Legal">
-    <span data-company-name>AgentSam</span>
+    <span data-company-name>App</span>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>
     <a href="/privacy">Privacy</a>
     <span class="auth-min-footer-sep" aria-hidden="true">|</span>