@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.8

package/packages/agentsam-workbench/src/agent/tool-permission.css

@@ -0,0 +1,134 @@
+.agentsam-tool-permission-overlay {
+  position: fixed;
+  inset: 0;
+  z-index: 120;
+  display: grid;
+  place-items: center;
+  padding: 24px;
+  background: color-mix(in srgb, var(--background, #09090b) 68%, transparent);
+  backdrop-filter: blur(10px);
+}
+.agentsam-tool-permission-card {
+  width: min(640px, calc(100vw - 32px));
+  overflow: hidden;
+  border: 1px solid color-mix(in srgb, var(--border, #3f3f46) 82%, transparent);
+  border-radius: 22px;
+  background: color-mix(in srgb, var(--card, #18181b) 97%, black);
+  color: var(--card-foreground, #fafafa);
+  box-shadow: 0 28px 90px rgba(0, 0, 0, .45);
+}
+.agentsam-tool-permission-header {
+  display: flex;
+  gap: 14px;
+  align-items: flex-start;
+  padding: 22px 22px 18px;
+  border-bottom: 1px solid var(--border, #3f3f46);
+}
+.agentsam-tool-permission-mark {
+  display: grid;
+  place-items: center;
+  width: 38px;
+  height: 38px;
+  flex: 0 0 auto;
+  border: 1px solid var(--border, #3f3f46);
+  border-radius: 11px;
+  background: var(--background, #09090b);
+  font-size: 11px;
+  font-weight: 700;
+  letter-spacing: .08em;
+}
+.agentsam-tool-permission-header h2 {
+  margin: 0;
+  font-size: 16px;
+  font-weight: 650;
+}
+.agentsam-tool-permission-header p {
+  margin: 6px 0 0;
+  color: var(--muted-foreground, #a1a1aa);
+  font-size: 13px;
+  line-height: 1.45;
+}
+.agentsam-tool-permission-body {
+  display: grid;
+  gap: 16px;
+  padding: 18px 22px;
+}
+.agentsam-tool-permission-facts,
+.agentsam-tool-permission-shared dl {
+  display: grid;
+  gap: 8px;
+  margin: 0;
+}
+.agentsam-tool-permission-facts > div,
+.agentsam-tool-permission-shared dl > div {
+  display: grid;
+  grid-template-columns: minmax(90px, 140px) 1fr;
+  gap: 14px;
+  align-items: baseline;
+}
+.agentsam-tool-permission-facts dt,
+.agentsam-tool-permission-shared dt {
+  color: var(--muted-foreground, #a1a1aa);
+  font-size: 12px;
+}
+.agentsam-tool-permission-facts dd,
+.agentsam-tool-permission-shared dd {
+  min-width: 0;
+  margin: 0;
+  overflow-wrap: anywhere;
+  font-size: 13px;
+}
+.agentsam-tool-permission-shared { padding-top: 2px; }
+.agentsam-tool-permission-shared h3 {
+  margin: 0 0 10px;
+  font-size: 12px;
+  font-weight: 600;
+}
+.agentsam-tool-permission-warning {
+  margin: 0;
+  border: 1px solid color-mix(in srgb, #f59e0b 45%, var(--border, #3f3f46));
+  border-radius: 12px;
+  padding: 10px 12px;
+  color: color-mix(in srgb, #fbbf24 72%, var(--card-foreground, #fafafa));
+  font-size: 12px;
+  line-height: 1.45;
+}
+.agentsam-tool-permission-actions {
+  display: flex;
+  gap: 8px;
+  align-items: center;
+  padding: 14px 16px;
+  border-top: 1px solid var(--border, #3f3f46);
+  background: color-mix(in srgb, var(--muted, #27272a) 42%, transparent);
+}
+.agentsam-tool-permission-actions button {
+  min-height: 36px;
+  border: 1px solid var(--border, #3f3f46);
+  border-radius: 10px;
+  padding: 0 13px;
+  background: var(--card, #18181b);
+  color: inherit;
+  font: inherit;
+  font-size: 12px;
+  cursor: pointer;
+}
+.agentsam-tool-permission-actions button:disabled {
+  cursor: wait;
+  opacity: .55;
+}
+.agentsam-tool-permission-actions button:hover:not(:disabled) {
+  background: var(--muted, #27272a);
+}
+.agentsam-tool-permission-actions .agentsam-tool-permission-primary {
+  border-color: color-mix(in srgb, var(--primary, #fafafa) 48%, var(--border, #3f3f46));
+  background: var(--primary, #fafafa);
+  color: var(--primary-foreground, #18181b);
+}
+.agentsam-tool-permission-spacer { flex: 1; }
+@media (max-width: 640px) {
+  .agentsam-tool-permission-overlay { padding: 12px; align-items: end; }
+  .agentsam-tool-permission-card { width: 100%; border-radius: 18px; }
+  .agentsam-tool-permission-actions { flex-wrap: wrap; }
+  .agentsam-tool-permission-spacer { display: none; }
+  .agentsam-tool-permission-actions button { flex: 1 1 auto; }
+}

package/packages/connectors/cloudflare/package.json

@@ -1,12 +1,24 @@
 {
   "name": "@inneranimalmedia/agentsam-connector-cloudflare",
-  "version": "0.1.0",
-  "private": true,
+  "version": "2.6.7",
   "type": "module",
   "main": "./src/index.js",
   "exports": {
     ".": "./src/index.js",
     "./capabilities": "./src/capabilities.js",
     "./api-client": "./src/api-client.js"
-  }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/connectors/cloudflare"
+  },
+  "files": [
+    "src"
+  ],
+  "description": "Portable Cloudflare capability connector for AgentSam applications and SDK consumers.",
+  "license": "MIT"
 }

package/packages/connectors/cloudflare/src/api-client.js

@@ -135,15 +135,16 @@ export class CloudflareApiClient {
     }
 
     const headers = {
-      Authorization: `Bearer ${this.apiToken}`,
       Accept: 'application/json',
+      ...(opts.headers || {}),
+      Authorization: `Bearer ${this.apiToken}`,
     };
     let body;
     if (opts.body != null && method !== 'GET' && method !== 'HEAD') {
       if (opts.body instanceof FormData || typeof opts.body === 'string' || Buffer.isBuffer(opts.body)) {
         body = opts.body;
       } else {
-        headers['Content-Type'] = 'application/json';
+        if (!headers['Content-Type'] && !headers['content-type']) headers['Content-Type'] = 'application/json';
         body = JSON.stringify(opts.body);
       }
     }

package/packages/connectors/cloudflare/src/families/vectorize.js

@@ -0,0 +1,127 @@
+import { createCloudflareApiClient } from '../api-client.js';
+
+export const VECTORIZE_CAPABILITY_ID = 'cloudflare.vectorize';
+
+const clean = value => String(value || '').trim();
+
+function assertIndex(index) {
+  const value = clean(index);
+  if (!value) throw new Error('cloudflare_vectorize_index_required');
+  return value;
+}
+
+function normalizeVector(record = {}) {
+  const id = clean(record.id);
+  const values = Array.isArray(record.values) ? record.values : record.vector;
+  if (!id) throw new Error('cloudflare_vectorize_vector_id_required');
+  if (!Array.isArray(values) || !values.length || values.some(value => typeof value !== 'number' || !Number.isFinite(value))) {
+    throw new Error('cloudflare_vectorize_vector_values_required');
+  }
+  const vector = { id, values };
+  if (record.namespace != null) vector.namespace = record.namespace;
+  if (record.metadata != null) vector.metadata = record.metadata;
+  return vector;
+}
+
+function workerBinding(binding, context = {}) {
+  if (context.backend && typeof context.backend.query === 'function' && typeof context.backend.upsert === 'function') return context.backend;
+  if (context.workerBinding && typeof context.workerBinding.query === 'function' && typeof context.workerBinding.upsert === 'function') return context.workerBinding;
+  return context.env?.[binding] || null;
+}
+
+async function apiClient(context = {}) {
+  if (context.apiClient) return context.apiClient;
+  return createCloudflareApiClient({
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    env: context.env || process.env,
+    ownerId: context.ownerId || context.owner_id || '',
+    explicitAccountId: context.accountId || context.account_id || '',
+    apiToken: context.apiToken || '',
+    authMode: context.authMode,
+    fetchImpl: context.fetchImpl,
+    decryptUserOauthToken: context.decryptUserOauthToken,
+  });
+}
+
+function indexPath(client, index, operation = '') {
+  const suffix = `/vectorize/v2/indexes/${encodeURIComponent(assertIndex(index))}${operation ? `/${operation}` : ''}`;
+  return client.accountPath(suffix);
+}
+
+export async function vectorizeUpsert({ binding, index, records, context = {} } = {}) {
+  const vectors = (records || []).map(normalizeVector);
+  const worker = workerBinding(binding, context);
+  if (worker) return { transport: 'worker_binding', result: await worker.upsert(vectors) };
+  const client = await apiClient(context);
+  const ndjson = vectors.map(row => JSON.stringify(row)).join('\n') + (vectors.length ? '\n' : '');
+  const result = await client.request('POST', indexPath(client, index, 'upsert'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.upsert',
+    headers: { 'Content-Type': 'application/x-ndjson' },
+    body: ndjson,
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeQuery({ binding, index, vector, options = {}, context = {} } = {}) {
+  if (!Array.isArray(vector) || !vector.length) throw new Error('cloudflare_vectorize_query_vector_required');
+  const worker = workerBinding(binding, context);
+  if (worker) return { transport: 'worker_binding', result: await worker.query(vector, options) };
+  const client = await apiClient(context);
+  const result = await client.request('POST', indexPath(client, index, 'query'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.query',
+    body: { vector, ...options },
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeDelete({ binding, index, ids, context = {} } = {}) {
+  const normalizedIds = (ids || []).map(clean).filter(Boolean);
+  const worker = workerBinding(binding, context);
+  if (worker) {
+    if (typeof worker.deleteByIds !== 'function') throw new Error('cloudflare_vectorize_worker_delete_unavailable');
+    return { transport: 'worker_binding', result: await worker.deleteByIds(normalizedIds) };
+  }
+  const client = await apiClient(context);
+  const result = await client.request('POST', indexPath(client, index, 'delete_by_ids'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.delete_by_ids',
+    body: { ids: normalizedIds },
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeGetByIds({ binding, index, ids, context = {} } = {}) {
+  const normalizedIds = (ids || []).map(clean).filter(Boolean);
+  const worker = workerBinding(binding, context);
+  if (worker) {
+    if (typeof worker.getByIds !== 'function') throw new Error('cloudflare_vectorize_worker_get_by_ids_unavailable');
+    return { transport: 'worker_binding', result: await worker.getByIds(normalizedIds) };
+  }
+  const client = await apiClient(context);
+  const result = await client.request('POST', indexPath(client, index, 'get_by_ids'), {
+    capabilityId: VECTORIZE_CAPABILITY_ID,
+    operation: 'vectorize.get_by_ids',
+    body: { ids: normalizedIds },
+  });
+  return { transport: 'cloudflare_api', result: result.result, auth: result.auth };
+}
+
+export async function vectorizeHealth({ binding, index, context = {} } = {}) {
+  const worker = workerBinding(binding, context);
+  if (worker) {
+    if (typeof worker.describe !== 'function') return { operational: true, transport: 'worker_binding', detail: null };
+    return { operational: true, transport: 'worker_binding', detail: await worker.describe() };
+  }
+  try {
+    const client = await apiClient(context);
+    const result = await client.request('GET', indexPath(client, index, 'info'), {
+      capabilityId: VECTORIZE_CAPABILITY_ID,
+      operation: 'vectorize.info',
+    });
+    return { operational: true, transport: 'cloudflare_api', detail: result.result, auth: result.auth };
+  } catch (error) {
+    return { operational: false, transport: 'cloudflare_api', error: error?.code || error?.message || String(error) };
+  }
+}

package/packages/connectors/cloudflare/src/index.js

@@ -64,6 +64,7 @@ export * as keyless from './families/keyless.js';
 export * as tokenValidation from './families/token-validation.js';
 export * as pages from './families/pages.js';
 export * as snippets from './families/snippets.js';
+export * as vectorize from './families/vectorize.js';
 
 import { scopesForCapabilities as _scopesForCapabilities, scopesForFeaturePacks as _scopesForFeaturePacks } from './capabilities.js';
 import { CLOUDFLARE_ALL_SCOPES as _CLOUDFLARE_ALL_SCOPES, isKnownCloudflareScope } from './scope-catalog.js';

package/packages/heuristic-theme/README.md

@@ -1,9 +1,9 @@
-# @inneranimalmedia/heuristic-theme
+# @inneranimalmedia/theme-heuristic
 
 Stock AgentSam CMS storefront shell theme. Exports a deterministic theme contract consumed by CMS presets and `theme.storefront.shell`.
 
 ```js
-import { createStorefrontShellTheme } from "@inneranimalmedia/heuristic-theme";
+import { createStorefrontShellTheme } from "@inneranimalmedia/theme-heuristic";
 
 const theme = createStorefrontShellTheme();
 ```

package/packages/heuristic-theme/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "@inneranimalmedia/heuristic-theme",
-  "version": "0.1.0",
+  "name": "@inneranimalmedia/theme-heuristic",
+  "version": "2.6.7",
   "description": "Stock AgentSam CMS storefront shell theme contract (heuristic-theme).",
   "type": "module",
   "main": "./src/index.js",
@@ -21,5 +21,10 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/heuristic-theme"
+  }
 }

package/packages/heuristic-theme/src/registry.js

@@ -14,11 +14,11 @@ export function createHeuristicThemeProductRow({ accountId, repositoryId = null
     status: "wired",
     repository_id: repositoryId,
     canonical_path: "packages/heuristic-theme",
-    package_name: "@inneranimalmedia/heuristic-theme",
+    package_name: "@inneranimalmedia/theme-heuristic",
     metadata: {
       origin: "gallery_mount",
       normalization_state: "wired",
-      package: "@inneranimalmedia/heuristic-theme",
+      package: "@inneranimalmedia/theme-heuristic",
       preview_kind: "live",
       capabilities: ["theme.storefront.shell"],
       app_manifest: null,

package/packages/heuristic-theme/src/theme.js

@@ -32,7 +32,7 @@ export function createStorefrontShellTheme() {
       { type: "footer", label: "Footer" },
     ],
     metadata: {
-      package: "@inneranimalmedia/heuristic-theme",
+      package: "@inneranimalmedia/theme-heuristic",
       capability: "theme.storefront.shell",
       deterministic: true,
       demoSite: "demo",

package/packages/heuristic-theme/test/theme.test.mjs

@@ -10,7 +10,7 @@ test("createStorefrontShellTheme returns stable stock contract", () => {
   assert.ok(theme.surfaces.includes("cms.editor"));
   assert.ok(theme.slots.shell.includes("header"));
   assert.equal(theme.tokens["--color-accent"], "#1e6a6f");
-  assert.equal(theme.metadata.package, "@inneranimalmedia/heuristic-theme");
+  assert.equal(theme.metadata.package, "@inneranimalmedia/theme-heuristic");
   assert.deepEqual(createStorefrontShellTheme(), theme);
 });
 

package/packages/identity/.agentsam/features/oauth-login-portal/agentsam.feature.json

@@ -5,7 +5,7 @@
   "kind": "integration",
   "status": "extracted",
   "package": {
-    "name": "@inneranimalmedia/agentsam-sdk-identity",
+    "name": "@inneranimalmedia/agentsam-identity",
     "version": "2.6.3",
     "directory": "packages/identity"
   },

package/packages/identity/.agentsam/features/oauth-login-portal/providers.json

@@ -5,7 +5,9 @@
   "providers": [
     {
       "id": "inneranimalmedia",
-      "aliases": ["iam"],
+      "aliases": [
+        "iam"
+      ],
       "oauth_provider_key": "iam",
       "kind": "oidc",
       "status": "ready",
@@ -40,7 +42,9 @@
     },
     {
       "id": "google_desktop",
-      "aliases": ["google-desktop"],
+      "aliases": [
+        "google-desktop"
+      ],
       "kind": "oauth",
       "status": "ready",
       "implementation": "src/providers/google",
@@ -52,10 +56,8 @@
       "required_configuration": [
         "GOOGLE_DESKTOP_CLIENT_ID"
       ],
-      "optional_configuration": [
-        "GOOGLE_DESKTOP_CLIENT_SECRET"
-      ],
-      "notes": "Desktop/public PKCE client (Console type Desktop app — no secret). Worker brokers POST /api/oauth/google/desktop-exchange for loopback redirects. Optional GOOGLE_DESKTOP_CLIENT_SECRET only if the client id was mis-typed as Web."
+      "optional_configuration": [],
+      "notes": "Desktop/public PKCE client (Console type Desktop app). Uses system browser + loopback redirect and no embedded client secret."
     },
     {
       "id": "github",
@@ -81,7 +83,7 @@
         "identity.oauth.authorize",
         "identity.profile.resolve"
       ],
-      "notes": "Contract + authorize URL only — exchange not implemented."
+      "notes": "Contract + authorize URL only \u2014 exchange not implemented."
     },
     {
       "id": "email",
@@ -111,6 +113,24 @@
         "CLOUDFLARE_OAUTH_CLIENT_SECRET"
       ],
       "notes": "Cloudflare sign-in (same Worker secrets as the Cloudflare resource connector). Client secret optional for PKCE-only clients (Token Authentication Method = None)."
+    },
+    {
+      "id": "chatgpt",
+      "aliases": [
+        "openai",
+        "chatgpt-hosted"
+      ],
+      "kind": "hosted_headers",
+      "status": "ready",
+      "registered": true,
+      "implementation": "src/providers/chatgpt",
+      "capabilities": [
+        "identity.hosted.headers",
+        "identity.profile.resolve",
+        "cms.auth_host"
+      ],
+      "required_configuration": [],
+      "notes": "ChatGPT / OpenAI Apps SDK hosted identity. Reads oai-authenticated-* request headers and normalizes to NormalizedExternalIdentity (provider=chatgpt). Not classic OAuth client credentials — use createChatGptCmsAuthHost for /cms protection."
     }
   ]
 }

package/packages/identity/README.md

@@ -20,14 +20,14 @@ identity.login(request);   // alpha: throws until Identity Service adapter is wi
 identity.session.fromRequest(request);  // alpha: throws until adapter is wired
 ```
 
-**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. BYOK options: Google web, Google Desktop (`GOOGLE_DESKTOP_CLIENT_ID`), GitHub, Cloudflare (`CLOUDFLARE_OAUTH_CLIENT_*`). **Account SSOT:** `accounts` (not `account_identities` — that table is IdP linkage only).
+**Alpha scope:** contracts, D1 adapter, Worker router, `agentsam identity init` scaffold (`app/frontend` + `backend` + migrations), and `agentsam identity preview`. Default OAuth: minted `IAM_CLIENT_ID` + `IAM_CLIENT_SECRET`. BYOK options: Google web, Google Desktop (`GOOGLE_DESKTOP_CLIENT_ID`), GitHub, Cloudflare (`CLOUDFLARE_OAUTH_CLIENT_*`). **Stock CMS sign-in picker:** Cloudflare · Google · Inner Animal Media · ChatGPT (`hosted_headers` via Apps SDK). **Account SSOT:** `accounts` (not `account_identities` — that table is IdP linkage only).
 
 ## Layout
 
 ```
 src/
   core/           identity · sessions · accounts · recovery
-  providers/      google · github · gcp · email
+  providers/      google · github · gcp · email · iam · cloudflare · chatgpt
   oauth/          authorize/callback (extract from IAM — next sprint)
   adapters/       inneranimalmedia · cloudflare-d1
   contracts/

package/packages/identity/migrations/D1_SCHEMA_MAPPING.md

@@ -1,32 +1,35 @@
-# Identity schema mapping — portable ↔ Cloudflare D1
+# Identity schema mapping — portable ↔ Cloudflare D1 (IAM compat)
 
 Portable SQLite (`packages/identity/migrations/sqlite/`) is the product schema.
-The D1 adapter maps existing hosted table names without requiring a big-bang rename.
+The IAM-compat adapter maps existing hosted table names without requiring a big-bang rename.
 
-| Portable (SQLite) | Hosted D1 (current) | Notes |
+| Portable (SQLite / portable D1) | Hosted D1 (IAM compat) | Notes |
 |---|---|---|
-| `identity_users` / account plane | **`accounts`** | **Account SSOT** — row of record |
-| login principal | `auth_users` | 1:1 with `accounts.id` in portable scaffold |
-| `identity_external_accounts` | `account_identities` | IdP linkage only (`account_id` → `accounts.id`) — never the account SSOT |
-| `identity_sessions` | `auth_sessions` | Same columns |
-| `identity_auth_events` | `auth_event_log` | Same columns |
-| `identity_oauth_transactions` | `identity_oauth_states` → migrate to `identity_oauth_transactions` | Requires `app_id NOT NULL`; no silent pre-app_id fallback |
-| `identity_provider_connections` | (new / connector tables) | `credential_ref` → vault/KMS; never store raw tokens in D1 rows |
+| `identity_users` / account plane | **`accounts`** + `auth_users` | **Account SSOT** — row of record |
+| `identity_external_accounts` | `account_identities` | IdP linkage only |
+| `identity_sessions` (+ `type`) | `auth_sessions` (+ `type`) | browser / desktop |
+| `identity_auth_events` | `auth_event_log` | Same semantics |
+| `identity_oauth_transactions` (+ native cols) | `identity_oauth_states` | Requires `app_id NOT NULL`; native cols optional |
+| `identity_native_handoffs` | `identity_native_handoffs` | Single-use desktop pickup |
+| `identity_companies` | `company` | Branding / host resolution |
+| `identity_provider_connections` | `identity_provider_connections` (or connector tables) | `credential_ref` only — never raw secrets |
 | `identity_app_registry` | cache of `agentsam.app.json` | Disk manifests remain SSOT |
 | `identity_route_registry` | projection cache | Disk manifests remain SSOT |
 | `identity_oauth_clients` … | optional `identity.oauth-server` pack | Only if product is an AS |
 
+Password recovery is **not** a portable core table. It uses `createPasswordResetService` with an injected `{get,put,delete}` store. Optional `identity.recovery` pack may exist later.
+
 ## Schema version
 
-Both adapters read `identity_schema_meta.schema_version` (SQLite) or
-`PRAGMA`/meta row. Missing `app_id` on OAuth transactions is an
-`IdentitySchemaError('IDENTITY_SCHEMA_MIGRATION_REQUIRED')`, not a soft
-downgrade.
+Portable adapters read `identity_schema_meta.schema_version`. Lane 1 requires version **2** (after `005_identity_company_native.sql`). Missing `app_id` on OAuth transactions is an `IdentitySchemaError`, not a soft downgrade.
 
 ## Packs
 
 | Pack | Apply when |
 |---|---|
-| `identity.core` | Always (local + hosted) |
+| `identity.core` | Always (local + hosted portable) |
 | `identity.oauth-client` | Signing into external IdPs |
 | `identity.oauth-server` | Product issues its own codes/tokens |
+
+Family manifest: `packages/identity/schema/agentsam.identity/manifest.json`
+Generic contract: `protocol/database/agentsam.schema-pack.v1.schema.json`

package/packages/identity/migrations/apply-portable.js

@@ -0,0 +1,109 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+
+/** Package-owned portable SQL SSOT (resolves inside installed npm package). */
+export const PORTABLE_IDENTITY_MIGRATIONS_DIR = path.resolve(HERE, 'sqlite');
+
+/** @deprecated Prefer PORTABLE_IDENTITY_MIGRATIONS_DIR */
+export const SQLITE_MIGRATIONS_DIR = PORTABLE_IDENTITY_MIGRATIONS_DIR;
+
+export const IDENTITY_SCHEMA_PACK_MANIFEST_PATH = path.resolve(
+  HERE,
+  '../schema/agentsam.identity/manifest.json',
+);
+
+/**
+ * Resolve the agentsam.identity pack-family manifest from the installed package.
+ * @returns {{ manifest: object, manifestPath: string, sqlDir: string }}
+ */
+export function resolveIdentitySchemaPack() {
+  const manifestPath = IDENTITY_SCHEMA_PACK_MANIFEST_PATH;
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+  return {
+    manifest,
+    manifestPath,
+    sqlDir: PORTABLE_IDENTITY_MIGRATIONS_DIR,
+  };
+}
+
+function listPortableMigrationFiles(opts = {}) {
+  const files = [
+    '001_identity_core.sql',
+    '002_identity_oauth_client.sql',
+    '005_identity_company_native.sql',
+  ];
+  if (opts.includeOAuthServer) {
+    files.push('003_identity_oauth_server.sql');
+    files.push('004_identity_oauth_consent_catalog.sql');
+  }
+  return files;
+}
+
+function isIgnorableMigrationError(err) {
+  const msg = String(err?.message || err || '').toLowerCase();
+  return (
+    msg.includes('duplicate column')
+    || msg.includes('already exists')
+    || msg.includes('duplicate column name')
+  );
+}
+
+async function runSql(db, sql) {
+  if (typeof db.exec === 'function') {
+    try {
+      db.exec(sql);
+      return;
+    } catch (err) {
+      // Multi-statement exec may fail mid-file on duplicate ALTER; fall through to statements.
+      if (!isIgnorableMigrationError(err) && !/alter table/i.test(sql)) throw err;
+    }
+  }
+  const stripped = sql.replace(/\/\*[\s\S]*?\*\//g, '');
+  const statements = stripped
+    .split(';')
+    .map((s) => s.replace(/--[^\n]*/g, '').trim())
+    .filter(Boolean);
+  for (const statement of statements) {
+    try {
+      if (typeof db.exec === 'function' && !db.prepare) {
+        db.exec(statement);
+      } else {
+        await db.prepare(statement).run();
+      }
+    } catch (err) {
+      if (isIgnorableMigrationError(err)) continue;
+      throw err;
+    }
+  }
+}
+
+/**
+ * Apply portable agentsam.identity SQL pack to a SQLite or D1-shaped target.
+ * Same SQL sources for both; executor differs by driver API.
+ *
+ * @param {{ prepare?: Function, exec?: Function }} target
+ * @param {{ includeOAuthServer?: boolean }} [opts]
+ */
+export async function applyPortableIdentityMigrations(target, opts = {}) {
+  if (!target || (typeof target.exec !== 'function' && typeof target.prepare !== 'function')) {
+    throw new Error('applyPortableIdentityMigrations_requires_db_target');
+  }
+  const files = listPortableMigrationFiles(opts);
+  for (const file of files) {
+    const sqlPath = path.join(PORTABLE_IDENTITY_MIGRATIONS_DIR, file);
+    const sql = fs.readFileSync(sqlPath, 'utf8');
+    await runSql(target, sql);
+  }
+}
+
+/**
+ * Stable compatibility alias — same portable pack, same sources.
+ * @param {{ prepare?: Function, exec?: Function }} db
+ * @param {{ includeOAuthServer?: boolean }} [opts]
+ */
+export async function applySqliteIdentityMigrations(db, opts = {}) {
+  return applyPortableIdentityMigrations(db, opts);
+}

package/packages/identity/migrations/sqlite/004_identity_oauth_consent_catalog.sql

@@ -1,5 +1,5 @@
 -- identity.oauth-server consent catalog.
--- Issuer branding remains owned by the portable company table.
+-- Issuer branding remains owned by portable identity_companies (identity.core).
 
 INSERT OR IGNORE INTO identity_schema_meta (key, value)
 VALUES ('pack_oauth_consent_catalog', '1');