@runeditrun/rer 0.0.0-stage → 0.1.0

package/modules/dependencies/auth.mjs

@@ -0,0 +1,40 @@
+import { nativeDependencyAuthority } from './native.mjs';
+import { createIdpOwnerClaimHandler } from '../owner-claim/idp.mjs';
+import { createOidcProviders } from '../operator-auth/identity/oidc/index.mjs';
+import { dependencyStore } from './store.mjs';
+import { backchannelLogout } from './logout.mjs';
+// Resolve the persisted server key at use, so Worker instances never cache a removed link.
+export function linkedProviders(options) {
+ const {db,config,staticProviders,native}=options;
+ if(native)nativeDependencyAuthority(native);
+ if(config.dependencies && (staticProviders?.ids.includes('auth') || staticProviders?.callbackPaths?.['/auth/oidc/auth/callback'])) throw new Error('dependency_provider_conflict');
+ async function current() {
+  if (!config.dependencies) return staticProviders;
+  const store=dependencyStore(db),link=await store.link();
+  if(!link || link.needs_relink) return staticProviders;
+  const row=await store.first("SELECT private_key FROM rer_dependency_keys WHERE interface='oidc-provider@1'");
+  if(!row?.private_key) return null;
+  const unclaimed=native?()=>native.unclaimed():async()=>!await db.prepare('SELECT 1 FROM oa_operators LIMIT 1').first();
+  return createOidcProviders({...options, enabled:async()=>await options.enabled() || await unclaimed(), claim:async(request,token,expectedPin)=>{
+   if(!await unclaimed())return null;
+   if(native)return native.claimOwner?native.claimOwner({request,token,expectedPin}):null;
+   return createIdpOwnerClaimHandler({expectedPin,db,authConfig:config,clientIp:()=>options.clientIp(request),clock:options.clock,fetch:options.fetch})(new Request(config.origin+'/auth/owner-claim',{method:'POST',headers:{Host:new URL(config.origin).host,Origin:config.origin,'Content-Type':'application/json'},body:JSON.stringify({token})}));
+  }, claimScope: unclaimed, config:{origin:config.origin,local:config.local,transactionSecret:config.OIDC_TRANSACTION_SECRET ?? config.SESSION_SECRET+'-oidc',providers:[{
+   id:'auth',preset:'auth',issuer:link.issuer,clientId:link.client_id,privateKey:JSON.parse(row.private_key),
+  }]}});
+ }
+ if(!config.dependencies) return staticProviders;
+ return {
+  ids:[...new Set(['auth',...(staticProviders?.ids??[])])],
+  callbackPaths:{...staticProviders?.callbackPaths,'/auth/oidc/auth/callback':'auth'},
+  async begin(...args){const p=args[1]!=='auth'?staticProviders:await current();return p?p.begin(...args):Response.json({error:'provider_unlinked'},{status:403});},
+  async callback(...args){const p=args[1]!=='auth'?staticProviders:await current();return p?p.callback(...args):Response.json({error:'provider_unlinked'},{status:403});},
+  async logout(request){return backchannelLogout({...options,request});},
+  async list(){const p=await current();return p===staticProviders?(p?.list()??[]):[...await staticProviders?.list()??[],...await p?.list()??[]];},
+  async links(){const p=await current();const links=[...await staticProviders?.links()??[],...(p!==staticProviders?await p?.links()??[]:[])];return [...new Map(links.map(link=>[link.id,link])).values()];},
+  // The Auth dependency is linked and unlinked through its own approval routes;
+  // a static provider keeps its own pin controls.
+  async relink(id){if(id==='auth')throw new Error('Use the dependency link with fresh local owner proof');return staticProviders.relink(id);},
+  async unlink(id){if(id==='auth')throw new Error('Use the dependency unlink with fresh local owner proof');return staticProviders.unlink(id);},
+ };
+}

package/modules/dependencies/authority.mjs

@@ -0,0 +1,14 @@
+import { providerPinFence } from '../operator-auth/accounts/provider-pin.mjs';
+// Repeat local owner authority inside the mutation transaction.
+export function ownerFence(actor, now) {
+ const pin=providerPinFence(actor.providerPin);
+ return {sql:`${pin.sql} AND EXISTS(SELECT 1 FROM oa_sessions s JOIN oa_operators o ON o.id=s.operator_id
+ WHERE s.id=? AND o.id=? AND o.version=? AND s.operator_version=o.version AND s.revoked_at IS NULL AND s.expires_at>?
+ AND o.status='active' AND o.id=(SELECT p.id FROM oa_operators p LEFT JOIN oa_bootstrap b ON b.claim_id=p.id WHERE p.role='owner' AND p.status='active' ORDER BY b.claim_id IS NULL,p.created_at,p.id LIMIT 1))`,args:[...pin.args,actor.id,actor.operator.id,actor.operator.version,now]};
+}
+export function pinStatement(db, clientId, metadata, now) {
+ return db.prepare(`INSERT INTO oa_identity_providers(provider_id,preset,status,issuer,client_id,jwks_uri,authorization_endpoint,token_endpoint,algorithms,token_auth_method,response_iss,interface_version,linked_at)
+ VALUES('auth','auth','linked',?,?,?,?,?,?,'private_key_jwt',?,?,?) ON CONFLICT(provider_id) DO UPDATE SET
+ preset='auth',status='linked',issuer=excluded.issuer,client_id=excluded.client_id,jwks_uri=excluded.jwks_uri,authorization_endpoint=excluded.authorization_endpoint,token_endpoint=excluded.token_endpoint,algorithms=excluded.algorithms,token_auth_method=excluded.token_auth_method,response_iss=excluded.response_iss,interface_version=excluded.interface_version,linked_at=MAX(oa_identity_providers.linked_at+1,excluded.linked_at),pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL,jwks=NULL,jwks_fetched_at=NULL`)
+ .bind(metadata.issuer,clientId,metadata.jwks,metadata.authorization,metadata.token,JSON.stringify(metadata.algorithms),metadata.responseIssuer?1:0,metadata.interfaceVersion,now);
+}

package/modules/dependencies/crypto.mjs

@@ -0,0 +1,13 @@
+const encode = bytes => btoa(String.fromCharCode(...bytes)).replaceAll('+','-').replaceAll('/','_').replace(/=+$/,'');
+const json = value => encode(new TextEncoder().encode(JSON.stringify(value)));
+export async function keyPair() {
+ const pair = await crypto.subtle.generateKey({name:'ECDSA',namedCurve:'P-256'},true,['sign','verify']);
+ return {...await crypto.subtle.exportKey('jwk',pair.privateKey),kid:crypto.randomUUID(),alg:'ES256',use:'sig'};
+}
+export function publicKey(key) { return {kty:key.kty,crv:key.crv,x:key.x,y:key.y,kid:key.kid,alg:'ES256',use:'sig',key_ops:['verify']}; }
+export async function assertion(key, claims) {
+ const encoded = `${json({alg:'ES256',typ:'JWT',kid:key.kid})}.${json(claims)}`;
+ const imported = await crypto.subtle.importKey('jwk',{...key,key_ops:['sign']},{name:'ECDSA',namedCurve:'P-256'},false,['sign']);
+ return `${encoded}.${encode(new Uint8Array(await crypto.subtle.sign({name:'ECDSA',hash:'SHA-256'},imported,new TextEncoder().encode(encoded))))}`;
+}
+export async function digest(value) { return encode(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(value)))); }

package/modules/dependencies/index.d.mts

@@ -0,0 +1,23 @@
+import type { Database, OperatorAuth } from '../operator-auth/index.mjs';
+export function createDependencies<R extends string>(options: { db: Database; origin: string; name: string; provider?: string; local?: boolean; auth: OperatorAuth<R>; claimOwner?:(token:string)=>Promise<Response|null>; clock?: () => number; fetch?: typeof fetch; provides?:string[]; interfaces?: {interface:string;optional?:boolean;provider?:string;paths:string[]}[] }): {document():Promise<unknown>;handle(request:Request):Promise<Response|null>};
+export const INTERFACE:string;
+export const CALLBACK:string;
+export const PATHS:string[];
+export interface SqlFence {sql: string; args: unknown[]}
+/** Snapshot captured before provider I/O; equality is repeated by shared code. */
+export interface DependencyApproval {
+  interface: string; issuer: string; callbacks: string; attempt_id: string;
+  approved_by: string; approved_session: string; approved_version: number; expires_at: number;
+}
+export interface NativeDependencyAuthority<R extends string = string> {
+  unclaimed(): Promise<boolean>;
+  ownerFence(actor: import('../operator-auth/index.mjs').Session<R>, now: number): SqlFence | Promise<SqlFence>;
+  /** Repeat native current-owner/session/version/proof and provider policy/pin authority. Shared code fences the exact pending attempt and actor snapshot. */
+  approvalFence(input: {pending: DependencyApproval; contract: string; issuer: string; callbacks: string; now: number}): SqlFence | Promise<SqlFence>;
+  /** Ordinary owner approval must never enable identity from a stale first-setup flag. */
+  linkedStatements(input: {pending: DependencyApproval; contract: string; old: Record<string, unknown> | null; issuer: string; now: number}): import('../operator-auth/index.mjs').Statement[] | Promise<import('../operator-auth/index.mjs').Statement[]>;
+  unlinkStatements(input: {contract: string; actor: import('../operator-auth/index.mjs').Session<R>; now: number}): import('../operator-auth/index.mjs').Statement[] | Promise<import('../operator-auth/index.mjs').Statement[]>;
+  /** Atomic replay claim + pinned link/current binding checks + native session revocation/fence bump. */
+  consumeLogout(input: {claims: Record<string, unknown>; link: Record<string, unknown>; now: number; fence: boolean}): Promise<boolean>;
+  claimOwner?(input: {request: Request; token: string; expectedPin: {id: string; issuer: string; clientId: string; linkedAt: number}}): Promise<Response | null>;
+}

package/modules/dependencies/index.mjs

@@ -0,0 +1,113 @@
+import { nativeDependencyAuthority } from './native.mjs';
+import { approveSetup, approveOwner, approvalFence, callbacksFor } from './approval.mjs';
+import { dependencyStore } from './store.mjs';
+import { publicKey, assertion, digest } from './crypto.mjs';
+import { CALLBACK, INTERFACE, PATHS, NETWORK, insist, originOf, providerMetadata } from './protocol.mjs';
+import { readJson } from '../operator-auth/identity/oidc/network.mjs';
+import { readInput } from '../operator-auth/input.mjs';
+import { ownerFence, pinStatement } from './authority.mjs';
+export { INTERFACE, CALLBACK, PATHS } from './protocol.mjs';
+export function createDependencies({db,origin,name,provider,interfaces=[{interface:INTERFACE,provider,paths:PATHS}],provides=[],local=false,auth,claimOwner,clock=Date.now,fetch:fetcher=globalThis.fetch}) {
+ originOf(origin,local);insist(Array.isArray(provides) && new Set(provides).size===provides.length && provides.every(value=>/^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(value)));
+ insist(Array.isArray(interfaces) && new Set(interfaces.map(d=>d.interface)).size===interfaces.length && interfaces.every(d=>/^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(d.interface) && Array.isArray(d.paths) && new Set(d.paths).size===d.paths.length && d.paths.every(p=>typeof p==='string' && /^\/[A-Za-z0-9_~/-]+$/.test(p) && !p.startsWith('//'))));
+ const store=dependencyStore(db);
+ const native=auth?.native?nativeDependencyAuthority(auth.accounts.dependencies):null;
+ async function owner(request,action) {
+  const actor=await auth.requireStepUp(request,action), current=await auth.accounts.owner();
+  insist(actor.operator.id===current?.id,'owner_required',403);return actor;
+ }
+ async function document() {
+  const installation=await store.installation(interfaces[0]?.interface??INTERFACE);
+  const linked=await Promise.all(interfaces.map(d=>store.link(d.interface)));
+  return {name,version:1,origin,sector_id:installation.sector_id,dependencies:interfaces.map((d,i)=>({provider:linked[i]?.issuer??d.provider??null,interface:d.interface,optional:d.optional??true,cardinality:1,paths:d.paths.map(p=>origin+p),jwks_uri:origin+'/.well-known/rer-link/jwks/'+d.interface})),provides,
+   claim:interfaces.some(d=>d.interface===INTERFACE) && (native?await native.unclaimed():!await db.prepare('SELECT 1 FROM oa_operators LIMIT 1').first()),callback:origin+CALLBACK,jwks_uri:origin+'/.well-known/rer-link/jwks'};
+ }
+ async function callback(request) {
+  const data=await readInput(request);
+  insist(Object.keys(data).every(k=>['issuer','code','interface'].includes(k)) && typeof data.code==='string' && data.code.length>0 && data.code.length<=4096);
+  const contract=data.interface??INTERFACE,declared=interfaces.find(d=>d.interface===contract);insist(declared,'undeclared_interface',403);
+  const old=await store.link(contract),pending=await store.first('SELECT * FROM rer_dependency_pending WHERE interface=?',contract);
+  const callbacks=callbacksFor(origin,declared);
+  insist(pending?.attempt_id && pending.expires_at>clock() && pending.callbacks===callbacks,'local_owner_proof_required',403);
+  const expected=pending.issuer;
+  insist(data.issuer===expected,'untrusted_link_issuer',403);
+  const pendingPin=native?null:await store.first('SELECT provider_id AS id,issuer,client_id AS clientId,linked_at AS linkedAt FROM oa_provider_session_pins WHERE session_id=?',pending.approved_session);
+  const initialApproval=await approvalFence(pending,contract,expected,callbacks,clock(),pendingPin,native);
+  insist(await store.first(`SELECT 1 WHERE ${initialApproval.sql}`,...initialApproval.args),'local_owner_proof_required',403);
+  const metadata=await providerMetadata(expected,fetcher,contract),installation=await store.installation(contract);
+  const codeDigest=await digest(expected+'\0'+data.code);
+  const consumed=await store.run('INSERT INTO rer_dependency_codes(digest,created_at) VALUES(?,?) ON CONFLICT DO NOTHING',codeDigest,clock());
+  insist(consumed.meta.changes===1,'link_code_used',409);
+  const now=Math.floor(clock()/1000), proof=await assertion(installation.key,{iss:origin,sub:origin,aud:metadata.link.redeem,iat:now,exp:now+60,jti:crypto.randomUUID(),code:data.code,interface:contract,sector_id:installation.sector_id,callback:origin+CALLBACK});
+  const result=await readJson(fetcher,metadata.link.redeem,NETWORK,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({code:data.code,interface:contract,origin,callback:origin+CALLBACK,client_assertion_type:'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',client_assertion:proof})});
+  insist(result.issuer===expected && result.interface===contract && result.sector_id===installation.sector_id && result.origin===origin && result.callback===origin+CALLBACK && typeof result.client_id==='string' && result.client_id.length>0 && result.client_id.length<=512,'invalid_link_grant',403);
+  if(old && old.issuer===expected) insist(result.client_id===old.client_id && ['previous-key','provider-owner'].includes(result.continuity),'link_continuity_required',403);
+  // A provider move never edits identity bindings. Only a new, proven-email sign-in
+  // can establish a binding at the new issuer; existing principals remain immutable.
+  const unchanged=old?{sql:'EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface=? AND issuer=? AND client_id=? AND metadata=? AND needs_relink=? AND linked_at=?)',args:[contract,old.issuer,old.client_id,JSON.stringify(old.metadata),old.needs_relink,old.linked_at]}:{sql:'NOT EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface=?)',args:[contract]};
+  const approval=await approvalFence(pending,contract,expected,callbacks,clock(),pendingPin,native);
+  await db.batch([
+   db.prepare(`UPDATE rer_dependency_codes SET created_at=CASE WHEN EXISTS(SELECT 1 FROM rer_dependency_keys WHERE interface=? AND json_extract(private_key,'$.kid')=?) AND ${unchanged.sql} AND ${approval.sql} THEN created_at ELSE -1 END WHERE digest=?`).bind(contract,installation.key.kid,...unchanged.args,...approval.args,codeDigest),
+   db.prepare(`INSERT INTO rer_dependency_link(interface,issuer,client_id,metadata,needs_relink,linked_at) VALUES(?,?,?,?,0,?) ON CONFLICT(interface) DO UPDATE SET issuer=excluded.issuer,client_id=excluded.client_id,metadata=excluded.metadata,needs_relink=0,linked_at=MAX(rer_dependency_link.linked_at+1,excluded.linked_at)`).bind(contract,expected,result.client_id,JSON.stringify(metadata),clock()),
+   ...(native?await native.linkedStatements({pending,contract,old,issuer:expected,now:clock()}):[
+   ...(contract===INTERFACE?[db.prepare("INSERT INTO oa_auth_audit(id,actor_id,action,value,created_at) SELECT ?,claim_id,'idpSignIn','true',? FROM oa_bootstrap WHERE EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND first_setup=1 AND idp_sign_in=0) AND EXISTS(SELECT 1 FROM oa_setup_links WHERE interface='oidc-provider@1' AND attempt_id=? AND completed=0 AND owner_id=claim_id)").bind(crypto.randomUUID(),clock(),pending.attempt_id)]:[]),
+   ...(contract===INTERFACE?[db.prepare("UPDATE oa_auth_settings SET idp_sign_in=CASE WHEN first_setup=1 AND EXISTS(SELECT 1 FROM oa_setup_links WHERE interface='oidc-provider@1' AND attempt_id=? AND completed=0 AND owner_id=(SELECT claim_id FROM oa_bootstrap)) THEN 1 ELSE idp_sign_in END,first_setup=0 WHERE singleton=1").bind(pending.attempt_id)]:[]),
+   db.prepare('UPDATE oa_setup_links SET completed=1 WHERE interface=? AND attempt_id=?').bind(contract,pending.attempt_id),
+   ]),
+   db.prepare('DELETE FROM rer_dependency_pending WHERE interface=?').bind(contract),
+   ...(contract===INTERFACE?[pinStatement(db,result.client_id,metadata,clock())]:[]),
+   ...(!native && contract===INTERFACE && old?[db.prepare("UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id IN (SELECT p.session_id FROM oa_provider_sessions p LEFT JOIN oa_provider_session_pins pin ON pin.session_id=p.session_id WHERE pin.provider_id='auth' OR (p.issuer=? AND (? OR pin.session_id IS NULL)))").bind(clock(),old.issuer,old.issuer!==expected?1:0)]:[]),
+   ...(!native && contract===INTERFACE && old && old.issuer!==expected?[db.prepare("DELETE FROM oa_domain_rules WHERE provider_id='auth'")]:[]),
+  ]);
+  if(result.install_owner!==undefined) {
+   insist(contract===INTERFACE && typeof result.install_owner==='string' && typeof claimOwner==='function','owner_claim_unavailable',403);
+   const claimed=await claimOwner(result.install_owner);
+   if(claimed?.status!==303){const detail=await claimed?.json().catch(()=>null);insist(false,typeof detail?.error==='string' && /^[a-z_]+$/.test(detail.error)?detail.error:'owner_claim_refused',claimed?.status??403);}
+  }
+  return Response.json({linked:true,interface:contract});
+ }
+ async function unlink(request) {
+  const actor=await owner(request,'providers:unlink'),input=await readInput(request),contract=input.interface??INTERFACE,link=await store.link(contract);
+  insist(interfaces.some(d=>d.interface===contract));
+  const key=await store.first('SELECT private_key FROM rer_dependency_keys WHERE interface=?',contract),fence=native?await native.ownerFence(actor,clock()):ownerFence(actor,clock()),guard=crypto.randomUUID();
+  await db.batch([
+   db.prepare(`INSERT INTO rer_dependency_codes(digest,created_at) SELECT ?,CASE WHEN ${fence.sql} THEN ? ELSE -1 END`).bind(guard,...fence.args,clock()),
+   db.prepare('DELETE FROM rer_dependency_keys WHERE interface=?').bind(contract),
+   ...(native?await native.unlinkStatements({contract,actor,now:clock()}):[
+   ...(contract===INTERFACE?[db.prepare("UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id IN (SELECT p.session_id FROM oa_provider_sessions p LEFT JOIN oa_provider_session_pins pin ON pin.session_id=p.session_id WHERE pin.provider_id='auth' OR p.issuer=(SELECT issuer FROM rer_dependency_link WHERE interface=?))").bind(clock(),contract)]:[]),
+   ...(contract===INTERFACE?[db.prepare("DELETE FROM oa_domain_rules WHERE provider_id='auth'")]:[]),
+   ]),
+   ...(contract===INTERFACE?[db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id='auth'")]:[]),
+   db.prepare('DELETE FROM rer_dependency_pending WHERE interface=?').bind(contract),
+   db.prepare('DELETE FROM rer_dependency_link WHERE interface=?').bind(contract),
+   ...(!native?[db.prepare('DELETE FROM oa_setup_links WHERE interface=?').bind(contract),
+   db.prepare("INSERT INTO oa_auth_audit VALUES(?,?,'provider:unlink',?,?)").bind(crypto.randomUUID(),actor.operator.id,contract,clock())]:[]),
+  ]);
+  // Local removal is already complete. The provider may be offline.
+  if(link && key) {try {await readJson(fetcher,link.metadata.link.deregister,NETWORK,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({client_id:link.client_id,origin,interface:contract,client_assertion_type:'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',client_assertion:await assertion(JSON.parse(key.private_key),{iss:link.client_id,sub:link.client_id,aud:link.metadata.link.deregister,iat:Math.floor(clock()/1000),exp:Math.floor(clock()/1000)+60,jti:crypto.randomUUID()})})});}catch{}}
+  return Response.json({unlinked:true});
+ }
+ return {document,async handle(request) {
+  const u=new URL(request.url),path=u.pathname;
+  const jwksContract=path.startsWith('/.well-known/rer-link/jwks/')?path.slice('/.well-known/rer-link/jwks/'.length):null;
+  if(!jwksContract && !['/.well-known/rer-dependencies','/.well-known/rer-link/jwks',CALLBACK,'/auth/dependencies/relink','/auth/dependencies/setup','/auth/dependencies/unlink','/auth/dependencies/status'].includes(path))return null;
+  try {
+   insist(u.origin===origin && (!request.headers.has('host') || request.headers.get('host')===u.host) && !u.search && !u.hash,'invalid_link_origin',403);
+   if(path==='/.well-known/rer-dependencies' && request.method==='GET')return Response.json(await document());
+   if((path==='/.well-known/rer-link/jwks' || jwksContract) && request.method==='GET') {const contract=jwksContract??interfaces[0]?.interface??INTERFACE;insist(interfaces.some(d=>d.interface===contract));return Response.json({keys:[publicKey((await store.installation(contract)).key)]});}
+   if(path==='/auth/dependencies/status' && request.method==='GET') {const link=await store.link(),links=(await db.prepare('SELECT interface,issuer,needs_relink FROM rer_dependency_link').all()).results;return Response.json({linked:!!link && !link.needs_relink,needsRelink:!!link?.needs_relink,links:links.map(r=>({interface:r.interface,issuer:r.issuer,linked:!r.needs_relink}))});}
+   insist(request.method==='POST','method_not_allowed',405);
+   if(path===CALLBACK)return await callback(request);
+   insist(request.headers.get('origin')===origin,'invalid_link_origin',403);
+   if(path==='/auth/dependencies/unlink')return await unlink(request);
+   if(path==='/auth/dependencies/relink' || path==='/auth/dependencies/setup') {
+    const input=await readInput(request),contract=input.interface??INTERFACE;originOf(input.issuer);const declared=interfaces.find(d=>d.interface===contract);insist(declared);
+    const callbacks=callbacksFor(origin,declared);
+    if(path==='/auth/dependencies/setup') await approveSetup({db,auth,request,input,contract,callbacks,clock});
+    else await approveOwner({store,actor:await owner(request,'providers:relink'),input,contract,callbacks,clock,native});
+    return Response.json({pending:true});
+   }
+   insist(false,'not_found',404);
+  }catch(e){return Response.json({error:e.code??'link_unavailable'},{status:e.status??503});}
+ }};
+}

package/modules/dependencies/logout.mjs

@@ -0,0 +1,42 @@
+import { dependencyStore } from './store.mjs';
+import { parseIdToken, verifySignature } from '../operator-auth/identity/oidc/jwt.mjs';
+import { readJson } from '../operator-auth/identity/oidc/network.mjs';
+import { readInput } from '../operator-auth/input.mjs';
+import { insist, NETWORK } from './protocol.mjs';
+export const LOGOUT_EVENT='http://schemas.openid.net/event/backchannel-logout';
+export const FENCE_EVENT='https://runeditrun.com/events/identity-fence';
+export async function backchannelLogout({db,config,request,clock=Date.now,fetch:fetcher=globalThis.fetch,native}) {
+ try {
+  const url=new URL(request.url);
+  insist(url.origin===config.origin && url.pathname==='/auth/oidc/auth/logout' && !url.search && request.method==='POST');
+  const data=await readInput(request);insist(typeof data.logout_token==='string');
+  const link=await dependencyStore(db).link();insist(link && !link.needs_relink,'provider_unlinked',403);
+  const pin={issuer:link.issuer,clientId:link.client_id,algorithms:link.metadata.algorithms};
+  const parsed=parseIdToken(data.logout_token,pin, 'logout+jwt'),c=parsed.claims;
+  await verifySignature(parsed,await readJson(fetcher,link.metadata.jwks,NETWORK));
+  const now=clock()/1000;
+  insist(c.iss===pin.issuer && (c.aud===pin.clientId || Array.isArray(c.aud) && c.aud.length===1 && c.aud[0]===pin.clientId));
+  insist(Number.isSafeInteger(c.iat) && c.iat<=now+30 && c.iat>=now-86400 && Number.isSafeInteger(c.exp) && c.exp>now && c.exp>c.iat && c.exp-c.iat<=86400);
+  insist(c.nbf===undefined || Number.isSafeInteger(c.nbf) && c.nbf<=now+30);
+  insist(!Object.hasOwn(c,'nonce') && typeof c.jti==='string' && c.jti.trim().length>0 && c.jti.length<=256);
+  insist(c.events && typeof c.events==='object' && !Array.isArray(c.events));
+  const events=Object.keys(c.events);insist(events.length>0 && events.every(k=>[LOGOUT_EVENT,FENCE_EVENT].includes(k) && c.events[k] && typeof c.events[k]==='object' && !Array.isArray(c.events[k]) && Object.keys(c.events[k]).length===0));
+  for(const key of ['sub','sid']) if(Object.hasOwn(c,key)) insist(typeof c[key]==='string' && c[key].length>0 && c[key].length<=255);
+  insist(c.sub || c.sid);
+  if(native) {
+   const consumed=await native.consumeLogout({claims:c,link,now:clock(),fence:events.includes(FENCE_EVENT)});
+   insist(consumed,'logout_already_used',409);
+   return new Response(null,{status:204});
+  }
+  const rows=(await db.prepare('SELECT DISTINCT subject FROM oa_provider_sessions WHERE issuer=? AND (? IS NULL OR sid=?)').bind(c.iss,c.sid??null,c.sid??null).all()).results;
+  if(c.sid) insist(rows.length>0 && (!c.sub || rows.every(r=>r.subject===c.sub)));
+  const subject=c.sub??(rows.length===1?rows[0].subject:null);insist(subject);
+  const person=await db.prepare('SELECT operator_id FROM oa_external_identities WHERE issuer=? AND subject=?').bind(c.iss,subject).first();insist(person);
+  const statements=[db.prepare(`INSERT INTO oa_logout_events(issuer,jti,consumed_at) VALUES(?,?,CASE WHEN EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface='oidc-provider@1' AND issuer=? AND client_id=? AND metadata=? AND needs_relink=0 AND linked_at=?) AND EXISTS(SELECT 1 FROM oa_external_identities WHERE issuer=? AND subject=? AND operator_id=?) THEN ? ELSE -1 END)`).bind(c.iss,c.jti,link.issuer,link.client_id,JSON.stringify(link.metadata),link.linked_at,c.iss,subject,person.operator_id,clock())];
+  if(events.includes(FENCE_EVENT)) statements.push(db.prepare('UPDATE oa_operators SET version=version+1 WHERE id=?').bind(person.operator_id));
+  statements.push(db.prepare(`UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id IN
+   (SELECT session_id FROM oa_provider_sessions WHERE issuer=? AND subject=? AND (? IS NULL OR sid=?))`).bind(clock(),c.iss,subject,c.sid??null,c.sid??null));
+  try { await db.batch(statements); } catch { insist(false,'logout_already_used',409); }
+  return new Response(null,{status:204});
+ } catch(error) { return Response.json({error:error.code??'invalid_logout'},{status:error.status??400}); }
+}

package/modules/dependencies/native.mjs

@@ -0,0 +1,9 @@
+import { AuthError } from '../operator-auth/errors.mjs';
+// These are D1 transaction fragments, not a second linking protocol. Each
+// fragment uses only the adopter's tenant/account/session tables. The common
+// protocol adds key/link/code/pin guards and commits everything in one batch.
+export function nativeDependencyAuthority(value) {
+  const methods = ['unclaimed', 'ownerFence', 'approvalFence', 'linkedStatements', 'unlinkStatements', 'consumeLogout'];
+  if (!value || typeof value !== 'object' || methods.some(k => typeof value[k] !== 'function') || value.claimOwner !== undefined && typeof value.claimOwner !== 'function') throw new AuthError('native_dependency_capability_required', 503);
+  return value;
+}

package/modules/dependencies/protocol.mjs

@@ -0,0 +1,23 @@
+import { readJson, discover } from '../operator-auth/identity/oidc/network.mjs';
+import { PRESETS, MINIMUM_PROVIDER_VERSION } from '../operator-auth/identity/oidc/presets.mjs';
+export const INTERFACE = 'oidc-provider@1';
+export const CALLBACK = '/.well-known/rer-link/callback';
+export const PATHS = ['/auth/oidc/auth/callback','/auth/oidc/auth/logout'];
+export const NETWORK = { timeoutMs:5000 };
+export function insist(value, code = 'invalid_link', status = 400) { if (!value) throw Object.assign(new Error(code),{code,status}); }
+export function originOf(value, local = false) {
+ let u;try { u=new URL(value); } catch { insist(false); }
+ insist(u.origin===value && !u.username && !u.password && (u.protocol==='https:' || local && u.protocol==='http:' && ['localhost','127.0.0.1','[::1]'].includes(u.hostname)));
+ return u.origin;
+}
+export async function providerMetadata(issuer, fetcher, contract = INTERFACE) {
+ originOf(issuer);
+ const p={...PRESETS.auth,id:'auth',issuer,endpointOrigins:[issuer],tokenAuthMethod:'private_key_jwt',keyAlgorithm:'ES256',minimumVersion:MINIMUM_PROVIDER_VERSION};
+ const oidc=contract===INTERFACE?await discover(fetcher,p,NETWORK):{};
+ const link=await readJson(fetcher,`${issuer}/.well-known/rer-provider`,NETWORK);
+ insist(link.issuer===issuer && (link.interface===contract || Array.isArray(link.provides) && new Set(link.provides).size===link.provides.length && link.provides.every(i=>typeof i==='string' && /^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(i)) && link.provides.includes(contract)) && link.version===1,'unsupported_link_interface',502);
+ for (const name of ['initiate','redeem','deregister']) {
+  const u=new URL(link[name]);insist(u.origin===issuer && u.protocol==='https:' && !u.search && !u.hash && !u.username && !u.password,'untrusted_link_endpoint',502);
+ }
+ return {...oidc,link};
+}

package/modules/dependencies/schema/approval-attempt.sql

@@ -0,0 +1,3 @@
+-- Existing pending approvals predate attempt fencing and must be renewed.
+ALTER TABLE rer_dependency_pending ADD COLUMN attempt_id TEXT;
+DELETE FROM rer_dependency_pending;

package/modules/dependencies/schema/dependencies.sql

@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS rer_dependency_installation (
+ singleton INTEGER PRIMARY KEY CHECK(singleton=1), sector_id TEXT NOT NULL UNIQUE
+);
+CREATE TABLE IF NOT EXISTS rer_dependency_link (
+ interface TEXT PRIMARY KEY, issuer TEXT NOT NULL, client_id TEXT NOT NULL, metadata TEXT NOT NULL,
+ needs_relink INTEGER NOT NULL DEFAULT 0, linked_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS rer_dependency_pending (
+ interface TEXT PRIMARY KEY, issuer TEXT NOT NULL, approved_by TEXT NOT NULL, expires_at INTEGER NOT NULL, approved_session TEXT NOT NULL, approved_version INTEGER NOT NULL, callbacks TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS rer_dependency_codes (
+ digest TEXT PRIMARY KEY, created_at INTEGER NOT NULL CHECK(created_at>=0)
+);
+
+CREATE TABLE IF NOT EXISTS rer_dependency_keys (interface TEXT PRIMARY KEY, private_key TEXT NOT NULL);

package/modules/dependencies/store.mjs

@@ -0,0 +1,19 @@
+import { keyPair } from './crypto.mjs';
+export function dependencyStore(db) {
+ const first=(sql,...args)=>db.prepare(sql).bind(...args).first();
+ const run=(sql,...args)=>db.prepare(sql).bind(...args).run();
+ return {
+  first,run,
+  async installation(contract = 'oidc-provider@1') {
+   await run('INSERT INTO rer_dependency_installation(singleton,sector_id) VALUES(1,?) ON CONFLICT DO NOTHING',crypto.randomUUID());
+   const row=await first('SELECT * FROM rer_dependency_installation WHERE singleton=1');
+   let key=await first('SELECT private_key FROM rer_dependency_keys WHERE interface=?',contract);
+   if(!key) {
+    await run('INSERT INTO rer_dependency_keys(interface,private_key) VALUES(?,?) ON CONFLICT DO NOTHING',contract,JSON.stringify(await keyPair()));
+    key=await first('SELECT private_key FROM rer_dependency_keys WHERE interface=?',contract);
+   }
+   return {...row,key:JSON.parse(key.private_key)};
+  },
+  async link(contract = 'oidc-provider@1') { const row=await first("SELECT * FROM rer_dependency_link WHERE interface=?",contract);return row?{...row,metadata:JSON.parse(row.metadata)}:null; },
+ };
+}