@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.7

package/packages/identity/src/oauth/native-handoff.js

@@ -0,0 +1,136 @@
+/**
+ * Native (desktop) OAuth handoff.
+ *
+ * A desktop app signs in through the system browser, so the provider redirect
+ * lands in a browser that cannot hand a Set-Cookie to the app. Instead:
+ *
+ *   start    GET  /api/oauth/{provider}/start?client=native
+ *                   &native_challenge=<S256(verifier)>&native_redirect=<deep link>
+ *   callback creates an auth_sessions row (type=desktop), stores a single-use
+ *            handoff bound to the PKCE challenge, and 302s to the deep link
+ *            with ?handoff=<one-time code> — the session id never rides a URL.
+ *   exchange POST /api/oauth/native/exchange { handoff, code_verifier }
+ *            → same JSON as native password login (session_id, expires_at, user)
+ *
+ * Identity only. This never writes provider resource grants (user_oauth_tokens).
+ */
+
+import { jsonResponse } from '../core/http-json.js';
+import { NATIVE_HANDOFF_TTL_SECONDS, SESSION_TYPES } from '../core/session-policy.js';
+import { pkceChallenge, randomOAuthState } from './pkce.js';
+
+const DEFAULT_NATIVE_SCHEMES = ['agentsamstudio'];
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]']);
+const S256_CHALLENGE = /^[A-Za-z0-9_-]{43}$/;
+
+export const NATIVE_EXCHANGE_PATH = '/api/oauth/native/exchange';
+
+async function sha256Hex(value) {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(String(value)));
+  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+
+function allowedSchemes(env) {
+  const configured = String(env?.IDENTITY_NATIVE_REDIRECT_SCHEMES || '')
+    .split(',')
+    .map((s) => s.trim().toLowerCase())
+    .filter(Boolean);
+  return configured.length ? configured : DEFAULT_NATIVE_SCHEMES;
+}
+
+/** Deep-link scheme allowlist, or an http loopback redirect. Never a web origin. */
+export function isAllowedNativeRedirect(uri, env) {
+  let parsed;
+  try {
+    parsed = new URL(String(uri || ''));
+  } catch {
+    return false;
+  }
+  if (parsed.protocol === 'http:') return LOOPBACK_HOSTS.has(parsed.hostname);
+  return allowedSchemes(env).includes(parsed.protocol.replace(/:$/, '').toLowerCase());
+}
+
+/**
+ * Read native params off an OAuth start URL.
+ * @returns {{ native: false } | { native: true, error: string } |
+ *           { native: true, clientType: 'desktop', nativeChallenge: string, nativeRedirect: string }}
+ */
+export function parseNativeStart(url, env) {
+  const client = String(url.searchParams.get('client') || '').toLowerCase();
+  if (client !== 'native' && client !== 'desktop') return { native: false };
+  const nativeChallenge = url.searchParams.get('native_challenge') || '';
+  const nativeRedirect = url.searchParams.get('native_redirect') || '';
+  if (!S256_CHALLENGE.test(nativeChallenge)) return { native: true, error: 'native_challenge_invalid' };
+  if (!isAllowedNativeRedirect(nativeRedirect, env)) return { native: true, error: 'native_redirect_not_allowed' };
+  return { native: true, clientType: SESSION_TYPES.DESKTOP, nativeChallenge, nativeRedirect };
+}
+
+/** Session type an OAuth transaction should mint. */
+export function sessionTypeForTransaction(saved) {
+  return saved?.client_type === SESSION_TYPES.DESKTOP ? SESSION_TYPES.DESKTOP : SESSION_TYPES.BROWSER;
+}
+
+/**
+ * Shared callback tail for every OAuth lane. Browser transactions keep the
+ * existing cookie + globe redirect; native transactions get the handoff redirect.
+ */
+export async function finishOAuthLogin({ request, env, identity, adapter, saved, result, loginPath }) {
+  const url = new URL(request.url);
+  const redirectTo = identity.resolvePostLoginPath(saved?.redirect_to);
+
+  if (sessionTypeForTransaction(saved) === SESSION_TYPES.DESKTOP) {
+    if (!saved.native_challenge || !isAllowedNativeRedirect(saved.native_redirect, env)) {
+      await adapter.revokeSession?.(result.sessionId);
+      return Response.redirect(`${url.origin}${loginPath}?error=native_handoff_invalid`, 302);
+    }
+    const handoff = randomOAuthState();
+    await adapter.createNativeHandoff({
+      handoffHash: await sha256Hex(handoff),
+      sessionId: result.sessionId,
+      challenge: saved.native_challenge,
+      ttlSeconds: NATIVE_HANDOFF_TTL_SECONDS,
+    });
+    const target = new URL(saved.native_redirect);
+    target.searchParams.set('handoff', handoff);
+    return new Response(null, {
+      status: 302,
+      headers: { Location: target.toString(), 'Cache-Control': 'no-store' },
+    });
+  }
+
+  const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
+  const globeUrl = `${url.origin}${loginPath}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
+  return new Response(null, {
+    status: 302,
+    headers: { Location: globeUrl, 'Set-Cookie': res.headers.get('Set-Cookie') || '' },
+  });
+}
+
+/** POST /api/oauth/native/exchange — single-use, PKCE-bound. */
+export async function handleNativeExchangeRequest(request, { adapter, identity }) {
+  if (request.method !== 'POST') return jsonResponse({ ok: false, error: 'method_not_allowed' }, 405);
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    return jsonResponse({ ok: false, error: 'invalid_json' }, 400);
+  }
+  const handoff = String(body?.handoff || '').trim();
+  const verifier = String(body?.code_verifier || body?.codeVerifier || '').trim();
+  if (!handoff || !verifier) {
+    return jsonResponse({ ok: false, error: 'handoff_and_code_verifier_required' }, 400);
+  }
+
+  // Consumed before the verifier check, so a wrong verifier burns the code.
+  const row = await adapter.consumeNativeHandoff(await sha256Hex(handoff));
+  if (!row) return jsonResponse({ ok: false, error: 'handoff_invalid_or_expired' }, 400);
+  if ((await pkceChallenge(verifier)) !== row.challenge) {
+    await adapter.revokeSession?.(row.session_id);
+    return jsonResponse({ ok: false, error: 'pkce_verification_failed' }, 400);
+  }
+
+  const session = await adapter.getSession(row.session_id);
+  const user = session ? await adapter.findUserById(session.user_id) : null;
+  if (!session || !user) return jsonResponse({ ok: false, error: 'session_unavailable' }, 401);
+  return identity.buildNativeLoginSuccessResponse({ sessionId: session.id, session, user }, body?.next);
+}

package/packages/identity/src/providers/chatgpt/headers.js

@@ -0,0 +1,65 @@
+/** ChatGPT Apps SDK / OpenAI hosted identity header constants. */
+
+export const CHATGPT_USER_EMAIL_HEADER = 'oai-authenticated-user-email';
+export const CHATGPT_USER_FULL_NAME_HEADER = 'oai-authenticated-user-full-name';
+export const CHATGPT_USER_FULL_NAME_ENCODING_HEADER =
+  'oai-authenticated-user-full-name-encoding';
+export const CHATGPT_PERCENT_ENCODED_UTF8 = 'percent-encoded-utf-8';
+
+export const CHATGPT_SIGN_IN_PATH = '/signin-with-chatgpt';
+export const CHATGPT_SIGN_OUT_PATH = '/signout-with-chatgpt';
+export const CHATGPT_CALLBACK_PATH = '/callback';
+
+/**
+ * @param {Headers | Record<string, string | string[] | undefined> | null | undefined} headers
+ * @param {string} name
+ */
+export function readHeader(headers, name) {
+  if (!headers) return null;
+  const key = String(name).toLowerCase();
+  if (typeof headers.get === 'function') {
+    const value = headers.get(name) ?? headers.get(key);
+    return value == null ? null : String(value);
+  }
+  const raw =
+    headers[name] ??
+    headers[key] ??
+    Object.entries(headers).find(([k]) => k.toLowerCase() === key)?.[1];
+  if (Array.isArray(raw)) return raw[0] == null ? null : String(raw[0]);
+  return raw == null ? null : String(raw);
+}
+
+function safeDecodeURIComponent(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Extract ChatGPT hosted user profile from request headers (Apps SDK).
+ * Does not leak transport headers into NormalizedExternalIdentity.raw beyond a redacted snapshot.
+ *
+ * @param {Headers | Record<string, string | string[] | undefined> | null | undefined} headers
+ * @returns {{ email: string, fullName: string | null, displayName: string } | null}
+ */
+export function readChatGptUserFromHeaders(headers) {
+  const email = readHeader(headers, CHATGPT_USER_EMAIL_HEADER);
+  if (!email) return null;
+
+  const encodedFullName = readHeader(headers, CHATGPT_USER_FULL_NAME_HEADER);
+  const encoding = readHeader(headers, CHATGPT_USER_FULL_NAME_ENCODING_HEADER);
+  const fullName =
+    encodedFullName && encoding === CHATGPT_PERCENT_ENCODED_UTF8
+      ? safeDecodeURIComponent(encodedFullName)
+      : encodedFullName && encoding !== CHATGPT_PERCENT_ENCODED_UTF8
+        ? encodedFullName
+        : null;
+
+  return {
+    email: email.trim().toLowerCase(),
+    fullName,
+    displayName: (fullName || email).trim(),
+  };
+}

package/packages/identity/src/providers/chatgpt/index.js

@@ -0,0 +1,86 @@
+import { createIdentityProvider } from '../../provider-contract.js';
+import { normalizeChatGptIdentity } from './mapper.js';
+import { readChatGptUserFromHeaders } from './headers.js';
+import { chatGPTSignInPath, chatGPTSignOutPath, safeRelativeReturnPath } from './paths.js';
+
+/**
+ * ChatGPT hosted identity provider (OpenAI Apps SDK).
+ *
+ * Auth is header-based in the ChatGPT host — not classic OAuth client credentials.
+ * `authorizeUrl` points at the hosted sign-in path; `exchangeCode` is unsupported.
+ */
+export const ChatGptProvider = createIdentityProvider({
+  id: 'chatgpt',
+  authorizeUrl: ({ redirectUri, state } = {}) => {
+    const returnTo =
+      typeof redirectUri === 'string' && redirectUri.startsWith('/')
+        ? redirectUri
+        : '/';
+    const path = chatGPTSignInPath(returnTo);
+    return state ? `${path}&state=${encodeURIComponent(state)}` : path;
+  },
+  exchangeCode: async () => null,
+  getProfile: async () => null,
+  normalizeIdentity: normalizeChatGptIdentity,
+});
+
+/**
+ * Build a portable CmsAuthHost for ChatGPT-hosted apps.
+ * Reads `oai-authenticated-*` headers; challenges to hosted sign-in when missing.
+ *
+ * @param {{ cmsBase?: string }} [options]
+ */
+export function createChatGptCmsAuthHost(options = {}) {
+  const cmsBase = options.cmsBase || '/cms';
+  return {
+    async authorizeCmsAccess({ path, headers }) {
+      const user = readChatGptUserFromHeaders(headers);
+      if (!user) {
+        return {
+          allowed: false,
+          principal: null,
+          reason: 'chatgpt_identity_required',
+          challengeUrl: chatGPTSignInPath(path || cmsBase),
+        };
+      }
+      const identity = normalizeChatGptIdentity({
+        email: user.email,
+        name: user.fullName || user.displayName,
+        sub: user.email,
+      });
+      return {
+        allowed: true,
+        principal: {
+          id: `chatgpt:${identity.subject}`,
+          displayName: identity.name || identity.email || identity.subject,
+          email: identity.email || undefined,
+          roles: ['cms_admin'],
+          localDevelopment: false,
+          provider: 'chatgpt',
+        },
+        reason: 'chatgpt_hosted_identity',
+      };
+    },
+    buildLoginUrl({ returnTo }) {
+      return chatGPTSignInPath(returnTo || cmsBase);
+    },
+  };
+}
+
+export {
+  normalizeChatGptIdentity,
+  readChatGptUserFromHeaders,
+  chatGPTSignInPath,
+  chatGPTSignOutPath,
+  safeRelativeReturnPath,
+};
+
+export {
+  CHATGPT_USER_EMAIL_HEADER,
+  CHATGPT_USER_FULL_NAME_HEADER,
+  CHATGPT_USER_FULL_NAME_ENCODING_HEADER,
+  CHATGPT_PERCENT_ENCODED_UTF8,
+  CHATGPT_SIGN_IN_PATH,
+  CHATGPT_SIGN_OUT_PATH,
+  CHATGPT_CALLBACK_PATH,
+} from './headers.js';

package/packages/identity/src/providers/chatgpt/mapper.js

@@ -0,0 +1,43 @@
+import { normalizeExternalIdentity } from '../../contracts/external-identity.js';
+
+/**
+ * Normalize ChatGPT / OpenAI Apps SDK identity into portable external identity.
+ * Provider id is always `chatgpt` — never leak `oai-authenticated-*` header names into contracts.
+ *
+ * @param {Record<string, unknown> | null | undefined} profile
+ */
+export function normalizeChatGptIdentity(profile) {
+  const raw = profile && typeof profile === 'object' ? profile : {};
+  const email =
+    typeof raw.email === 'string' && raw.email.trim()
+      ? raw.email.trim().toLowerCase()
+      : null;
+  const subject = String(raw.sub || raw.id || raw.subject || email || '').trim();
+  if (!subject) {
+    throw new Error('chatgpt_identity_requires_subject');
+  }
+
+  const name =
+    typeof raw.name === 'string' && raw.name.trim()
+      ? raw.name.trim()
+      : typeof raw.displayName === 'string' && raw.displayName.trim()
+        ? raw.displayName.trim()
+        : typeof raw.fullName === 'string' && raw.fullName.trim()
+          ? raw.fullName.trim()
+          : null;
+
+  return normalizeExternalIdentity({
+    provider: 'chatgpt',
+    subject,
+    email,
+    emailVerified: Boolean(email),
+    name,
+    avatar: null,
+    username: null,
+    raw: {
+      source: 'chatgpt_hosted',
+      email,
+      name,
+    },
+  });
+}

package/packages/identity/src/providers/chatgpt/paths.js

@@ -0,0 +1,45 @@
+import {
+  CHATGPT_CALLBACK_PATH,
+  CHATGPT_SIGN_IN_PATH,
+  CHATGPT_SIGN_OUT_PATH,
+} from './headers.js';
+
+function isReservedAuthPath(pathname) {
+  return (
+    pathname === CHATGPT_SIGN_IN_PATH ||
+    pathname === CHATGPT_SIGN_OUT_PATH ||
+    pathname === CHATGPT_CALLBACK_PATH
+  );
+}
+
+/** Safe relative return path for ChatGPT hosted sign-in/out redirects. */
+export function safeRelativeReturnPath(value) {
+  const raw = String(value || '/');
+  if (!raw.startsWith('/') || raw.startsWith('//')) return '/';
+
+  let url;
+  try {
+    url = new URL(raw, 'https://app.local');
+  } catch {
+    return '/';
+  }
+  if (url.origin !== 'https://app.local') return '/';
+  if (isReservedAuthPath(url.pathname)) return '/';
+  return `${url.pathname}${url.search}${url.hash}`;
+}
+
+export function chatGPTSignInPath(returnTo = '/') {
+  const safeReturnTo = safeRelativeReturnPath(returnTo);
+  return `${CHATGPT_SIGN_IN_PATH}?return_to=${encodeURIComponent(safeReturnTo)}`;
+}
+
+export function chatGPTSignOutPath(returnTo = '/') {
+  const safeReturnTo = safeRelativeReturnPath(returnTo);
+  return `${CHATGPT_SIGN_OUT_PATH}?return_to=${encodeURIComponent(safeReturnTo)}`;
+}
+
+export {
+  CHATGPT_SIGN_IN_PATH,
+  CHATGPT_SIGN_OUT_PATH,
+  CHATGPT_CALLBACK_PATH,
+};

package/packages/identity/src/providers/github/oauth.js

@@ -2,12 +2,11 @@ const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
 const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
 
 /** @param {import('../../provider-contract.js').OAuthAuthorizeInput} input */
-export function getGithubAuthUrl({ clientId, redirectUri, state, codeChallenge, scope } = {}) {
+export function getGithubAuthUrl({ clientId, redirectUri, state, codeChallenge } = {}) {
   const url = new URL(GITHUB_AUTH_URL);
   url.searchParams.set('client_id', clientId || '');
   url.searchParams.set('redirect_uri', redirectUri || '');
   url.searchParams.set('response_type', 'code');
-  url.searchParams.set('scope', scope || 'read:user user:email');
   url.searchParams.set('state', state || '');
   if (codeChallenge) {
     url.searchParams.set('code_challenge', codeChallenge);

package/packages/identity/src/providers/github/profile.js

@@ -3,7 +3,8 @@ const GITHUB_EMAILS_URL = 'https://api.github.com/user/emails';
 
 const GITHUB_HEADERS = {
   Accept: 'application/vnd.github+json',
-  'X-GitHub-Api-Version': '2022-11-28',
+  'X-GitHub-Api-Version': '2026-03-10',
+  'User-Agent': 'AgentSam-Local-Studio',
 };
 
 /** @param {string} accessToken */
@@ -17,7 +18,15 @@ export async function fetchGithubProfile(accessToken) {
         headers: { Authorization: `Bearer ${accessToken}`, ...GITHUB_HEADERS },
       }),
     ]);
-    if (!userRes.ok) return null;
+    if (!userRes.ok) {
+      const detail = (await userRes.text()).slice(0, 500);
+      console.error('github_userinfo_failed', {
+        status: userRes.status,
+        requestId: userRes.headers.get('x-github-request-id'),
+        detail,
+      });
+      return null;
+    }
     const user = await userRes.json();
     let email = null;
     let emailVerified = false;
@@ -26,6 +35,11 @@ export async function fetchGithubProfile(accessToken) {
       const primary = Array.isArray(emails) ? emails.find((e) => e?.primary) : null;
       email = primary?.email || null;
       emailVerified = !!primary?.verified;
+    } else {
+      console.warn('github_user_emails_failed', {
+        status: emailRes.status,
+        requestId: emailRes.headers.get('x-github-request-id'),
+      });
     }
     return { ...user, email, email_verified: emailVerified };
   } catch {

package/packages/identity/src/providers/index.js

@@ -5,11 +5,12 @@ import { GcpProvider } from './gcp/index.js';
 import { EmailProvider } from './email/index.js';
 import { IamProvider } from './iam/index.js';
 import { CloudflareProvider } from './cloudflare/index.js';
+import { ChatGptProvider } from './chatgpt/index.js';
 
 /**
  * Active identity provider registry.
- * `inneranimalmedia` is the canonical platform template id; `iam` remains a
- * legacy lookup alias (OAuth/DB provider key on platform identities).
+ * `inneranimalmedia` is the canonical platform template id; `iam` and `inneranimal` remain
+ * legacy lookup aliases (OAuth/DB provider keys on platform identities).
  * @type {Record<string, import('../provider-contract.js').IdentityProvider>}
  */
 export const identityProviders = Object.freeze({
@@ -20,12 +21,18 @@ export const identityProviders = Object.freeze({
   inneranimalmedia: IamProvider,
   iam: IamProvider,
   cloudflare: CloudflareProvider,
+  chatgpt: ChatGptProvider,
 });
 
 /** @param {string} id */
 export function getIdentityProvider(id) {
   const key = String(id || '').trim().toLowerCase();
-  if (key === 'iam') return identityProviders.inneranimalmedia || identityProviders.iam || null;
+  if (key === 'iam' || key === 'inneranimal') {
+    return identityProviders.inneranimalmedia || identityProviders.iam || null;
+  }
+  if (key === 'openai' || key === 'chatgpt-hosted' || key === 'chatgpt_hosted') {
+    return identityProviders.chatgpt || null;
+  }
   return identityProviders[key] || null;
 }
 
@@ -40,4 +47,5 @@ export {
   EmailProvider,
   IamProvider,
   CloudflareProvider,
+  ChatGptProvider,
 };

package/packages/identity/src/server/identity-service.js

@@ -130,7 +130,7 @@ export function createIdentityService(config) {
       return { ok: true };
     },
 
-    async provisionOAuthUser({ provider, providerSubject, email, displayName }) {
+    async provisionOAuthUser({ provider, providerSubject, email, displayName, sessionType }) {
       let user = await adapter.findUserByProvider(provider, providerSubject);
       if (!user && email) {
         user = await adapter.findUserByEmail(email);
@@ -155,6 +155,7 @@ export function createIdentityService(config) {
         displayName: displayName || user.display_name,
         provider,
         providerSubject,
+        type: sessionType,
       });
       return { ok: true, authUserId: user.id, sessionId: session.id, session };
     },

package/packages/identity/src/server/worker-router.js

@@ -1,4 +1,5 @@
-import { createCloudflareD1Adapter } from '../adapters/cloudflare-d1/index.js';
+import { createCloudflareD1Adapter, createIamCompatIdentityAdapter } from '../adapters/iam-compat/index.js';
+import { createPortableD1IdentityAdapter } from '../adapters/portable-d1/index.js';
 import { createIdentityService } from './identity-service.js';
 import { jsonResponse } from '../core/http-json.js';
 import { hashPassword } from '../core/password-crypto.js';
@@ -12,9 +13,31 @@ import { fetchCloudflareProfile } from '../providers/cloudflare/profile.js';
 import { IDENTITY_ROUTE_IDS } from '../contracts/route-ids.js';
 import { IdentityRoutingError } from '../contracts/identity-store.js';
 import { resolveOAuthCredentialLane } from '../oauth/credentials.js';
-import { handleGoogleDesktopExchangeRequest } from '../oauth/google-desktop-exchange.js';
+import {
+  GOOGLE_DESKTOP_LOGIN_EXCHANGE_PATH,
+  handleGoogleDesktopExchangeRequest,
+  handleGoogleDesktopLoginExchangeRequest,
+} from '../oauth/google-desktop-exchange.js';
 import { iamPlatformOAuthCallback, iamPlatformOAuthStart } from '../oauth/iam-platform.js';
 import { pkceChallenge, pkceVerifier, randomOAuthState } from '../oauth/pkce.js';
+import {
+  NATIVE_EXCHANGE_PATH,
+  finishOAuthLogin,
+  handleNativeExchangeRequest,
+  parseNativeStart,
+  sessionTypeForTransaction,
+} from '../oauth/native-handoff.js';
+
+function resolveIdentityAdapter(env, options = {}) {
+  if (options.adapter) return options.adapter;
+  const profile = String(options.identityProfile || env?.IDENTITY_ADAPTER_PROFILE || 'iam-compat')
+    .trim()
+    .toLowerCase();
+  if (profile === 'portable' || profile === 'portable-d1') {
+    return createPortableD1IdentityAdapter(env.DB);
+  }
+  return createIamCompatIdentityAdapter(env.DB);
+}
 
 function escapeHtml(value) {
   return String(value ?? '')
@@ -51,7 +74,12 @@ function buildPasswordResetService(env, adapter, options = {}) {
       }
       const company = await adapter.getDefaultCompany().catch(() => null);
       const brand = company?.name || 'Your App';
-      const fromEmail = company?.supportEmail || 'hey@inneranimalmedia.com';
+      const fromEmail = company?.supportEmail;
+      if (!fromEmail) {
+        const err = new Error('email_not_configured');
+        err.code = 'email_not_configured';
+        throw err;
+      }
       const html = `<p>Hi ${escapeHtml(name)},</p><p>Your ${escapeHtml(brand)} verification code is:</p><p style="font-size:22px;font-weight:700;letter-spacing:4px;">${escapeHtml(code)}</p><p>Enter this on the reset page. Expires in 15 minutes.</p>`;
       const res = await fetch('https://api.resend.com/emails', {
         method: 'POST',
@@ -78,14 +106,15 @@ function buildPasswordResetService(env, adapter, options = {}) {
  * Worker fetch handler for identity API + auth page routing.
  * @param {Request} request
  * @param {{ DB: import('../adapters/cloudflare-d1/index.js').D1Database, ASSETS?: { fetch: (req: Request) => Promise<Response> }, [key: string]: unknown }} env
- * @param {{ identity?: ReturnType<typeof createIdentityService>, brandName?: string }} [options]
+ * @param {{ identity?: ReturnType<typeof createIdentityService>, brandName?: string, companySlug?: string }} [options]
+ *   companySlug — host-app portal branding key into D1 `company.slug` (never product-hardcoded here).
  */
 export async function handleIdentityWorkerRequest(request, env, options = {}) {
   const url = new URL(request.url);
   const path = url.pathname;
   const method = request.method.toUpperCase();
 
-  const adapter = createCloudflareD1Adapter(env.DB);
+  const adapter = resolveIdentityAdapter(env, options);
   if (!options.identity && (!options.app?.id || !options.routeRegistry)) {
     throw new IdentityRoutingError(
       'AUTH_APP_UNRESOLVED',
@@ -156,6 +185,7 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
     if (!ctx) return jsonResponse({ ok: false, error: 'session_required' }, 401);
     return jsonResponse({
       ok: true,
+      authenticated: true,
       user: {
         id: ctx.user.id,
         email: ctx.user.email,
@@ -165,8 +195,21 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   }
 
   if (path === '/api/company' && method === 'GET') {
-    const slug = url.searchParams.get('slug') || undefined;
-    const company = slug ? await adapter.getCompanyBySlug(slug) : await adapter.getDefaultCompany();
+    // Portable: ?slug= → options.companySlug → env override → host match in company.meta.hosts → default
+    const slug = String(
+      url.searchParams.get('slug')
+        || options.companySlug
+        || env.IDENTITY_COMPANY_SLUG
+        || '',
+    ).trim() || undefined;
+    let company = null;
+    if (slug) {
+      company = await adapter.getCompanyBySlug(slug);
+    }
+    if (!company && typeof adapter.getCompanyByHost === 'function') {
+      company = await adapter.getCompanyByHost(url.hostname || request.headers.get('host'));
+    }
+    if (!company) company = await adapter.getDefaultCompany();
     if (!company) return jsonResponse({ ok: false, error: 'company_not_found' }, 404);
     return jsonResponse({ ok: true, company });
   }
@@ -236,6 +279,12 @@ export async function handleIdentityWorkerRequest(request, env, options = {}) {
   if (path === '/api/oauth/google/desktop-exchange') {
     return handleGoogleDesktopExchangeRequest(request, env);
   }
+  if (path === GOOGLE_DESKTOP_LOGIN_EXCHANGE_PATH) {
+    return handleGoogleDesktopLoginExchangeRequest(request, env, { adapter, identity });
+  }
+  if (path === NATIVE_EXCHANGE_PATH) {
+    return handleNativeExchangeRequest(request, { adapter, identity });
+  }
   if (path === '/api/oauth/inneranimalmedia/callback' || path === '/api/oauth/iam/callback') {
     if (method === 'GET') {
       return iamPlatformOAuthCallback(request, env, adapter, identity);
@@ -332,12 +381,23 @@ async function oauthStart(request, env, identity, adapter, provider, creds) {
     const redirectTo = identity.resolvePostLoginPath(
       url.searchParams.get('next') || url.searchParams.get('return_to'),
     );
+    const nativeStart = parseNativeStart(url, env);
+    if (nativeStart.error) {
+      return jsonResponse({ ok: false, error: nativeStart.error }, 400);
+    }
     await adapter.saveOAuthState({
       state,
       provider,
       codeVerifier,
       redirectTo,
       appId: identity.app?.id || null,
+      ...(nativeStart.native
+        ? {
+            clientType: nativeStart.clientType,
+            nativeChallenge: nativeStart.nativeChallenge,
+            nativeRedirect: nativeStart.nativeRedirect,
+          }
+        : {}),
     });
 
     const redirectUri = `${url.origin}/api/oauth/${provider}/callback`;
@@ -458,21 +518,14 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
       providerSubject: normalized.subject,
       email: normalized.email,
       displayName: normalized.name,
+      sessionType: sessionTypeForTransaction(saved),
     });
     await adapter.logAuthEvent({
       userId: result.authUserId, eventType: 'login', status: 'ok', provider, request,
+      metadata: { session_type: sessionTypeForTransaction(saved) },
     });
 
-    const redirectTo = identity.resolvePostLoginPath(saved.redirect_to);
-    const res = identity.buildLoginSuccessResponse(request, result.sessionId, redirectTo);
-    const globeUrl = `${url.origin}${login}?globe_exit=1&next=${encodeURIComponent(redirectTo)}`;
-    return new Response(null, {
-      status: 302,
-      headers: {
-        Location: globeUrl,
-        'Set-Cookie': res.headers.get('Set-Cookie') || '',
-      },
-    });
+    return finishOAuthLogin({ request, env, identity, adapter, saved, result, loginPath: login });
   } catch (error) {
     const message = String(error?.message || error || 'oauth_callback_failed');
     console.error('oauth_callback_failed', provider, message);
@@ -484,4 +537,4 @@ async function oauthCallback(request, env, identity, adapter, provider, creds) {
   }
 }
 
-export { createIdentityService, createCloudflareD1Adapter };
+export { createIdentityService, createCloudflareD1Adapter, createIamCompatIdentityAdapter, createPortableD1IdentityAdapter };