@inneranimalmedia/agentsam-sdk 2.6.5 → 2.6.8

package/packages/identity/migrations/sqlite/005_identity_company_native.sql

@@ -0,0 +1,52 @@
+-- identity.core extension — company / brand + native handoff parity
+-- Portable identity_* names only. Does not create IAM `company` / `accounts`.
+-- Does NOT include password-reset tables — recovery remains storage-agnostic
+-- (createPasswordResetService + injected {get,put,delete} store).
+-- Upgrades schema_version 1 → 2. Safe to re-run (IF NOT EXISTS / ignorable ALTERs).
+
+INSERT OR REPLACE INTO identity_schema_meta (key, value)
+VALUES ('schema_version', '2');
+
+INSERT OR IGNORE INTO identity_schema_meta (key, value)
+VALUES ('pack_company_native', '1');
+
+CREATE TABLE IF NOT EXISTS identity_companies (
+  id TEXT PRIMARY KEY NOT NULL,
+  slug TEXT NOT NULL,
+  name TEXT NOT NULL,
+  legal_name TEXT,
+  logo_url TEXT,
+  favicon_url TEXT,
+  primary_color TEXT,
+  auth_bg_color TEXT,
+  support_email TEXT,
+  website_url TEXT,
+  tagline TEXT,
+  meta_json TEXT,
+  created_at INTEGER NOT NULL,
+  updated_at INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_identity_companies_slug
+  ON identity_companies(slug);
+
+CREATE TABLE IF NOT EXISTS identity_native_handoffs (
+  handoff_hash TEXT PRIMARY KEY NOT NULL,
+  session_id TEXT NOT NULL,
+  challenge TEXT NOT NULL,
+  expires_at INTEGER NOT NULL,
+  created_at INTEGER NOT NULL,
+  consumed_at INTEGER,
+  FOREIGN KEY (session_id) REFERENCES identity_sessions(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_identity_native_handoffs_expires
+  ON identity_native_handoffs(expires_at);
+
+-- Session type for browser vs desktop/native (default keeps existing rows as browser).
+ALTER TABLE identity_sessions ADD COLUMN type TEXT NOT NULL DEFAULT 'browser';
+
+-- Native OAuth transaction fields (optional on browser transactions).
+ALTER TABLE identity_oauth_transactions ADD COLUMN client_type TEXT;
+ALTER TABLE identity_oauth_transactions ADD COLUMN native_challenge TEXT;
+ALTER TABLE identity_oauth_transactions ADD COLUMN native_redirect TEXT;

package/packages/identity/package.json

@@ -1,9 +1,8 @@
 {
-  "name": "@inneranimalmedia/agentsam-sdk-identity",
-  "version": "2.6.5",
-  "private": true,
+  "name": "@inneranimalmedia/agentsam-identity",
+  "version": "2.6.7",
   "type": "module",
-  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace \u2014 publish via root SDK)",
+  "description": "Identity module for @inneranimalmedia/agentsam-sdk (workspace — publish via root SDK)",
   "agentsam": {
     "system": "identity",
     "kind": "library",
@@ -27,10 +26,17 @@
     "./contracts/provider": "./src/contracts/provider.js",
     "./contracts/external-identity": "./src/contracts/external-identity.js",
     "./contracts/auth-config": "./src/contracts/auth-config.js",
+    "./contracts/identity-store": "./src/contracts/identity-store.js",
     "./oauth/callback": "./src/oauth/callback.js",
     "./frontend/auth-portal/*": "./src/frontend/auth-portal/*",
     "./providers/cloudflare": "./src/providers/cloudflare/index.js",
-    "./oauth/consent-view": "./src/oauth/consent-view.js"
+    "./providers/chatgpt": "./src/providers/chatgpt/index.js",
+    "./contracts/sign-in-options": "./src/contracts/sign-in-options.js",
+    "./oauth/consent-view": "./src/oauth/consent-view.js",
+    "./adapters/sqlite": "./src/adapters/sqlite/index.js",
+    "./adapters/portable-d1": "./src/adapters/portable-d1/index.js",
+    "./adapters/iam-compat": "./src/adapters/iam-compat/index.js",
+    "./adapters/cloudflare-d1": "./src/adapters/cloudflare-d1/index.js"
   },
   "scripts": {
     "test": "node --test tests/*.test.mjs",
@@ -38,5 +44,20 @@
   },
   "engines": {
     "node": ">=20"
-  }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SamPrimeaux/agentsam-sdk.git",
+    "directory": "packages/identity"
+  },
+  "files": [
+    "src",
+    "backend",
+    "migrations",
+    "schema",
+    "scripts"
+  ]
 }

package/packages/identity/schema/agentsam.identity/manifest.json

@@ -0,0 +1,101 @@
+{
+  "$schema": "../../../protocol/database/agentsam.schema-pack.v1.schema.json",
+  "schema": "agentsam.schema-pack.v1",
+  "id": "agentsam.identity",
+  "version": "2.0.0",
+  "pack_family": "agentsam.identity",
+  "components": [
+    "identity.core",
+    "identity.oauth-client",
+    "identity.oauth-server"
+  ],
+  "component_dependencies": {
+    "identity.core": [],
+    "identity.oauth-client": ["identity.core"],
+    "identity.oauth-server": ["identity.core"]
+  },
+  "adapters": [
+    "sqlite",
+    "portable-d1",
+    "iam-compat"
+  ],
+  "sql": {
+    "portable_dir": "migrations/sqlite",
+    "files": {
+      "identity.core": [
+        "001_identity_core.sql",
+        "005_identity_company_native.sql"
+      ],
+      "identity.oauth-client": [
+        "002_identity_oauth_client.sql"
+      ],
+      "identity.oauth-server": [
+        "003_identity_oauth_server.sql",
+        "004_identity_oauth_consent_catalog.sql"
+      ]
+    },
+    "apply_order_fresh": [
+      "001_identity_core.sql",
+      "002_identity_oauth_client.sql",
+      "005_identity_company_native.sql"
+    ],
+    "apply_order_upgrade_v1_to_v2": [
+      "005_identity_company_native.sql"
+    ],
+    "optional_after_core": [
+      "003_identity_oauth_server.sql",
+      "004_identity_oauth_consent_catalog.sql"
+    ]
+  },
+  "tables": {
+    "identity.core": [
+      "identity_schema_meta",
+      "identity_users",
+      "identity_external_accounts",
+      "identity_sessions",
+      "identity_auth_events",
+      "identity_app_registry",
+      "identity_route_registry",
+      "identity_companies",
+      "identity_native_handoffs"
+    ],
+    "identity.oauth-client": [
+      "identity_oauth_transactions",
+      "identity_provider_connections"
+    ],
+    "identity.oauth-server": [
+      "identity_oauth_clients",
+      "identity_oauth_authorization_codes",
+      "identity_oauth_access_tokens",
+      "identity_oauth_refresh_tokens",
+      "identity_oauth_resources",
+      "identity_oauth_scopes",
+      "identity_oauth_resource_scopes"
+    ]
+  },
+  "table_patterns": ["identity_*"],
+  "seed_policy": "none",
+  "compatibility": {
+    "iam-compat": {
+      "owns_portable_schema": false,
+      "maps_onto": [
+        "accounts",
+        "auth_users",
+        "account_identities",
+        "auth_sessions",
+        "auth_event_log",
+        "identity_oauth_states",
+        "identity_native_handoffs",
+        "company"
+      ],
+      "stable_alias": "createCloudflareD1Adapter"
+    }
+  },
+  "recovery": {
+    "authority": "createPasswordResetService",
+    "storage": "injected {get,put,delete} — not IdentityStore / not identity.core SQL",
+    "optional_future_pack": "identity.recovery"
+  },
+  "owner": "@inneranimalmedia/agentsam-sdk/identity",
+  "notes": "Pack family for portable IdentityStore. Component IDs remain the contract units. Portable SQL SSOT is migrations/sqlite/. IAM production tables are NOT this pack — use the iam-compat adapter against hosted schema. Secrets are credential_ref / vault references, never raw tokens in rows. Password recovery stays storage-agnostic."
+}

package/packages/identity/scripts/local-identity-bridge.mjs

@@ -59,14 +59,20 @@ function sanitizeUser(user) {
   };
 }
 
+function cliArg(name) {
+  const i = process.argv.indexOf(name);
+  return i > 1 ? process.argv[i + 1] : undefined;
+}
+
 const request = await readStdin();
-const dbPath = path.resolve(
-  process.env.AGENTSAM_IDENTITY_DB || '.agentsam/data/local-studio-identity.sqlite',
-);
-const manifestPath = path.resolve(
-  process.env.AGENTSAM_IDENTITY_APP_MANIFEST
-    || new URL('../../../apps/local-studio/agentsam.app.json', import.meta.url).pathname,
-);
+const dbArg = cliArg('--db');
+const manifestArg = cliArg('--manifest');
+if (!dbArg || !manifestArg) {
+  process.stderr.write('usage: local-identity-bridge.mjs --db <sqlite path> --manifest <agentsam.app.json>\n');
+  process.exit(2);
+}
+const dbPath = path.resolve(dbArg);
+const manifestPath = path.resolve(manifestArg);
 
 fs.mkdirSync(path.dirname(dbPath), { recursive: true, mode: 0o700 });
 const nativeDb = new DatabaseSync(dbPath);

package/packages/identity/scripts/preview-auth-portal.mjs

@@ -119,15 +119,15 @@ function hubHtml(baseUrl) {
 const PREVIEW_COMPANY = {
   id: 'co_default',
   slug: 'default',
-  name: 'AgentSam',
-  legalName: 'AgentSam',
-  logoUrl: '/shared/agentsam-mark.svg',
+  name: 'Preview App',
+  legalName: 'Preview App',
+  logoUrl: '/shared/app-icon.png',
   faviconUrl: null,
   primaryColor: '#007AFF',
   authBgColor: '#050508',
-  supportEmail: 'support@agentsam.dev',
-  websiteUrl: 'https://agentsam.dev',
-  tagline: 'Instant Access',
+  supportEmail: 'support@example.com',
+  websiteUrl: 'https://example.com',
+  tagline: 'Welcome',
   meta: {
     privacyUrl: '/privacy',
     termsUrl: '/terms',

package/packages/identity/src/adapters/cloudflare-d1/index.js

@@ -1,403 +1,10 @@
-import { SESSION_POLICY } from '../../core/constants.js';
-import { IdentitySchemaError } from '../../contracts/identity-store.js';
-import { IDENTITY_STORE_SCHEMA_VERSION } from '../../contracts/identity-store.js';
-import { newAccountIdentityId, newAuthUserId, newSessionId, newAuthEventId, nowUnix } from './ids.js';
-import { DEFAULT_COMPANY_ID, DEFAULT_COMPANY_SLUG, normalizeCompanyRow } from '../../contracts/company.js';
-
-
 /**
- * @typedef {object} D1Database
- * @property {(sql: string) => { bind: (...args: unknown[]) => { first: () => Promise<unknown>, run: () => Promise<unknown>, all: () => Promise<{ results?: unknown[] }> } }} prepare
+ * Stable compatibility export path.
+ * createCloudflareD1Adapter remains IAM-compat behavior
+ * (accounts, auth_users, auth_sessions, company, ...).
+ * Do NOT repoint this path at portable identity_* tables.
  */
-
-/**
- * Portable Cloudflare D1 adapter for customer identity tables.
- * @param {D1Database} db
- * @param {{ sessionTtlSeconds?: number }} [options]
- */
-async function hashValue(value) {
-  const v = String(value || '').trim();
-  if (!v) return null;
-  const bytes = new TextEncoder().encode(v);
-  const digest = await crypto.subtle.digest('SHA-256', bytes);
-  return Array.from(new Uint8Array(digest)).map((b) => b.toString(16).padStart(2, '0')).join('');
-}
-
-export function createCloudflareD1Adapter(db, options = {}) {
-  if (!db?.prepare) {
-    throw new Error('cloudflare_d1_adapter_requires_db_binding');
-  }
-  const sessionTtlSeconds = options.sessionTtlSeconds ?? SESSION_POLICY.browser.ttlSeconds;
-
-  return Object.freeze({
-    schemaVersion: IDENTITY_STORE_SCHEMA_VERSION,
-    sessionTtlSeconds,
-    backend: 'cloudflare-d1',
-
-    /**
-     * Append-only login/logout/failed-attempt audit trail (auth_event_log).
-     * Never throws — an observability write must not break a real auth flow.
-     * status remains the event outcome only ('ok' | 'failed').
-     * Richer context (session, capabilities, activity, client) goes in metadata_json.
-     * ip/userAgent are hashed (SHA-256) — raw values are never persisted.
-     */
-    async logAuthEvent({
-      userId,
-      accountId,
-      eventType,
-      status = 'ok',
-      provider,
-      session,
-      capabilities,
-      activity,
-      client,
-      metadata,
-      request,
-    }) {
-      try {
-        const ip = request?.headers?.get?.('cf-connecting-ip') || request?.headers?.get?.('x-forwarded-for') || '';
-        const ua = request?.headers?.get?.('user-agent') || '';
-        const [ipHash, uaHash] = await Promise.all([hashValue(ip), hashValue(ua)]);
-        const envelope = {
-          ...(metadata && typeof metadata === 'object' ? metadata : {}),
-          ...(accountId ? { accountId } : {}),
-          ...(session ? { session } : {}),
-          ...(capabilities ? { capabilities } : {}),
-          ...(activity ? { activity } : {}),
-          ...(client ? { client } : {}),
-        };
-        await db.prepare(
-          `INSERT INTO auth_event_log
-           (id, user_id, event_type, status, provider, metadata_json, ip_hash, user_agent_hash)
-           VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
-        ).bind(
-          newAuthEventId(),
-          userId || null,
-          eventType,
-          status,
-          provider || null,
-          JSON.stringify(envelope),
-          ipHash,
-          uaHash,
-        ).run();
-      } catch {
-        // Never let audit logging break a real login/OAuth flow.
-      }
-    },
-
-    /**
-     * Account/session activity snapshot for auth receipts (not event outcome).
-     * @param {string} userId
-     */
-    async countAuthActivity(userId) {
-      if (!userId) {
-        return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
-      }
-      try {
-        const logins = await db.prepare(
-          `SELECT COUNT(*) AS c, MAX(created_at) AS last_at
-           FROM auth_event_log
-           WHERE user_id = ? AND event_type = 'login' AND status = 'ok'`,
-        ).bind(userId).first();
-        const sessions = await db.prepare(
-          `SELECT COUNT(*) AS c FROM auth_sessions
-           WHERE user_id = ? AND revoked_at IS NULL AND expires_at > ?`,
-        ).bind(userId, nowUnix()).first();
-        return {
-          loginCount: Number(logins?.c || 0),
-          activeSessionCount: Number(sessions?.c || 0),
-          lastLoginAt: logins?.last_at != null ? Number(logins.last_at) : null,
-        };
-      } catch {
-        return { loginCount: 0, activeSessionCount: 0, lastLoginAt: null };
-      }
-    },
-
-    async findUserByEmail(email) {
-      const row = await db.prepare(
-        `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
-         FROM auth_users WHERE email = ? COLLATE NOCASE LIMIT 1`,
-      ).bind(String(email || '').trim().toLowerCase()).first();
-      return row || null;
-    },
-
-    async findUserById(userId) {
-      const row = await db.prepare(
-        `SELECT id, email, display_name, password_hash, salt, status, created_at, updated_at
-         FROM auth_users WHERE id = ? LIMIT 1`,
-      ).bind(userId).first();
-      return row || null;
-    },
-
-    async createUser({ email, passwordHash, salt, displayName }) {
-      const id = newAuthUserId();
-      const ts = nowUnix();
-      const normalizedEmail = String(email || '').trim().toLowerCase();
-      // accounts = SSOT; auth_users = login principal (1:1 id in portable scaffold).
-      await db.prepare(
-        `INSERT INTO accounts (id, email, display_name, status, created_at, updated_at)
-         VALUES (?, ?, ?, 'active', ?, ?)`,
-      ).bind(id, normalizedEmail, displayName || null, ts, ts).run();
-      await db.prepare(
-        `INSERT INTO auth_users (id, email, display_name, password_hash, salt, status, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`,
-      ).bind(id, normalizedEmail, displayName || null, passwordHash || null, salt || null, ts, ts).run();
-      return this.findUserById(id);
-    },
-
-    async updateUserPassword(userId, passwordHash, salt) {
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE auth_users SET password_hash = ?, salt = ?, updated_at = ? WHERE id = ?`,
-      ).bind(passwordHash, salt, ts, userId).run();
-      await db.prepare(
-        `UPDATE accounts SET updated_at = ? WHERE id = ?`,
-      ).bind(ts, userId).run().catch(() => {});
-    },
-
-    async findUserByProvider(provider, providerSubject) {
-      const row = await db.prepare(
-        `SELECT u.id, u.email, u.display_name, u.password_hash, u.salt, u.status, u.created_at, u.updated_at
-         FROM account_identities ai
-         JOIN accounts a ON a.id = ai.account_id
-         JOIN auth_users u ON u.id = a.id
-         WHERE ai.provider = ? AND ai.provider_subject = ?
-           AND COALESCE(a.status, 'active') = 'active'
-         LIMIT 1`,
-      ).bind(provider, providerSubject).first();
-      return row || null;
-    },
-
-    async upsertProviderIdentity({ accountId, provider, providerSubject, email }) {
-      // Ensure SSOT account row exists (OAuth may create identity before password user).
-      const ts = nowUnix();
-      const account = await db.prepare(
-        `SELECT id FROM accounts WHERE id = ? LIMIT 1`,
-      ).bind(accountId).first();
-      if (!account?.id) {
-        const authUser = await this.findUserById(accountId);
-        if (!authUser) throw new Error('account_ssot_missing');
-        await db.prepare(
-          `INSERT INTO accounts (id, email, display_name, status, created_at, updated_at)
-           VALUES (?, ?, ?, 'active', ?, ?)`,
-        ).bind(
-          accountId,
-          authUser.email,
-          authUser.display_name || null,
-          authUser.created_at || ts,
-          ts,
-        ).run();
-      }
-
-      const existing = await db.prepare(
-        `SELECT id FROM account_identities WHERE provider = ? AND provider_subject = ? LIMIT 1`,
-      ).bind(provider, providerSubject).first();
-      if (existing?.id) {
-        await db.prepare(
-          `UPDATE account_identities SET account_id = ?, email = ?, updated_at = ? WHERE id = ?`,
-        ).bind(accountId, email || null, ts, existing.id).run();
-        return existing.id;
-      }
-      const id = newAccountIdentityId();
-      await db.prepare(
-        `INSERT INTO account_identities (id, account_id, provider, provider_subject, email, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(id, accountId, provider, providerSubject, email || null, ts, ts).run();
-      return id;
-    },
-
-    async createSession({ userId, email, provider, providerSubject, displayName }) {
-      const id = newSessionId();
-      const ts = nowUnix();
-      const expiresAt = ts + sessionTtlSeconds;
-      await db.prepare(
-        `INSERT INTO auth_sessions
-         (id, user_id, email, provider, provider_subject, display_name, expires_at, created_at, last_active_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(
-        id,
-        userId,
-        email || null,
-        provider || 'email',
-        providerSubject || null,
-        displayName || null,
-        expiresAt,
-        ts,
-        ts,
-      ).run();
-      return {
-        id,
-        user_id: userId,
-        email,
-        provider: provider || 'email',
-        provider_subject: providerSubject || null,
-        display_name: displayName || null,
-        expires_at: expiresAt,
-        created_at: ts,
-      };
-    },
-
-    async getSession(sessionId) {
-      const row = await db.prepare(
-        `SELECT id, user_id, email, provider, provider_subject, display_name, expires_at, revoked_at, created_at, last_active_at
-         FROM auth_sessions WHERE id = ? LIMIT 1`,
-      ).bind(sessionId).first();
-      if (!row) return null;
-      if (row.revoked_at) return null;
-      if (row.expires_at <= nowUnix()) return null;
-      return row;
-    },
-
-    async revokeSession(sessionId, reason = 'logout') {
-      const ts = nowUnix();
-      await db.prepare(
-        `UPDATE auth_sessions SET revoked_at = ?, last_active_at = ? WHERE id = ? AND revoked_at IS NULL`,
-      ).bind(ts, ts, sessionId).run();
-      return { ok: true, reason };
-    },
-
-    async createOAuthTransaction({ state, provider, codeVerifier, returnTo, redirectTo, appId, ttlSeconds = 600 }) {
-      if (!appId) {
-        throw new IdentitySchemaError(
-          'OAUTH_TRANSACTION_APP_ID_REQUIRED',
-          'OAuth transactions must include app_id',
-        );
-      }
-      const ts = nowUnix();
-      const expiresAt = ts + ttlSeconds;
-      try {
-        await db.prepare(
-          `INSERT INTO identity_oauth_states
-           (state, provider, code_verifier, redirect_to, app_id, expires_at, created_at)
-           VALUES (?, ?, ?, ?, ?, ?, ?)`,
-        ).bind(state, provider, codeVerifier, returnTo ?? redirectTo ?? null, appId, expiresAt, ts).run();
-      } catch (err) {
-        throw new IdentitySchemaError(
-          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-          'identity_oauth_states.app_id required — apply migration 0015 (no silent pre-app_id fallback)',
-          { cause: String(err?.message || err) },
-        );
-      }
-    },
-
-    /** @deprecated Use createOAuthTransaction */
-    async saveOAuthState(input) {
-      return this.createOAuthTransaction(input);
-    },
-
-    async consumeOAuthTransaction(state) {
-      let row;
-      try {
-        row = await db.prepare(
-          `SELECT state, provider, code_verifier, redirect_to, app_id, expires_at, created_at
-           FROM identity_oauth_states WHERE state = ? LIMIT 1`,
-        ).bind(state).first();
-      } catch (err) {
-        throw new IdentitySchemaError(
-          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-          'identity_oauth_states.app_id column missing — apply migration 0015',
-          { cause: String(err?.message || err) },
-        );
-      }
-      if (!row) return null;
-      await db.prepare(`DELETE FROM identity_oauth_states WHERE state = ?`).bind(state).run();
-      if (row.expires_at <= nowUnix()) return null;
-      if (!row.app_id) {
-        throw new IdentitySchemaError(
-          'IDENTITY_SCHEMA_MIGRATION_REQUIRED',
-          'OAuth transaction missing app_id — refuse silent pre-app_id semantics',
-        );
-      }
-      return {
-        state: row.state,
-        provider: row.provider,
-        code_verifier: row.code_verifier,
-        redirect_to: row.redirect_to,
-        return_to: row.redirect_to,
-        app_id: row.app_id,
-        expires_at: row.expires_at,
-        created_at: row.created_at,
-      };
-    },
-
-    /** @deprecated Use consumeOAuthTransaction */
-    async consumeOAuthState(state) {
-      return this.consumeOAuthTransaction(state);
-    },
-
-    async getCompanyBySlug(slug = DEFAULT_COMPANY_SLUG) {
-      const row = await db.prepare(
-        `SELECT id, slug, name, legal_name, logo_url, favicon_url, primary_color, auth_bg_color,
-                support_email, website_url, tagline, meta_json, created_at, updated_at
-         FROM company WHERE slug = ? LIMIT 1`,
-      ).bind(slug).first();
-      return normalizeCompanyRow(row);
-    },
-
-    async getDefaultCompany() {
-      const bySlug = await this.getCompanyBySlug(DEFAULT_COMPANY_SLUG);
-      if (bySlug) return bySlug;
-      const row = await db.prepare(
-        `SELECT id, slug, name, legal_name, logo_url, favicon_url, primary_color, auth_bg_color,
-                support_email, website_url, tagline, meta_json, created_at, updated_at
-         FROM company WHERE id = ? LIMIT 1`,
-      ).bind(DEFAULT_COMPANY_ID).first();
-      return normalizeCompanyRow(row);
-    },
-
-    async upsertCompany(input) {
-      const ts = nowUnix();
-      const id = input.id || DEFAULT_COMPANY_ID;
-      const slug = input.slug || DEFAULT_COMPANY_SLUG;
-      const existing = await db.prepare(`SELECT id FROM company WHERE id = ? OR slug = ? LIMIT 1`)
-        .bind(id, slug).first();
-      const metaJson = input.meta ? JSON.stringify(input.meta) : (input.metaJson ?? null);
-      if (existing?.id) {
-        await db.prepare(
-          `UPDATE company SET
-            slug = ?, name = ?, legal_name = ?, logo_url = ?, favicon_url = ?,
-            primary_color = ?, auth_bg_color = ?, support_email = ?, website_url = ?,
-            tagline = ?, meta_json = ?, updated_at = ?
-           WHERE id = ?`,
-        ).bind(
-          slug,
-          input.name,
-          input.legalName ?? null,
-          input.logoUrl ?? null,
-          input.faviconUrl ?? null,
-          input.primaryColor ?? null,
-          input.authBgColor ?? null,
-          input.supportEmail ?? null,
-          input.websiteUrl ?? null,
-          input.tagline ?? null,
-          metaJson,
-          ts,
-          existing.id,
-        ).run();
-        return this.getCompanyBySlug(slug);
-      }
-      await db.prepare(
-        `INSERT INTO company
-         (id, slug, name, legal_name, logo_url, favicon_url, primary_color, auth_bg_color,
-          support_email, website_url, tagline, meta_json, created_at, updated_at)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-      ).bind(
-        id,
-        slug,
-        input.name,
-        input.legalName ?? null,
-        input.logoUrl ?? null,
-        input.faviconUrl ?? null,
-        input.primaryColor ?? null,
-        input.authBgColor ?? null,
-        input.supportEmail ?? null,
-        input.websiteUrl ?? null,
-        input.tagline ?? null,
-        metaJson,
-        ts,
-        ts,
-      ).run();
-      return this.getCompanyBySlug(slug);
-    },
-  });
-}
+export {
+  createIamCompatIdentityAdapter,
+  createCloudflareD1Adapter,
+} from '../iam-compat/index.js';