@runeditrun/rer 0.0.0-stage → 0.1.0

package/modules/operator-auth/identity/principal.mjs

@@ -0,0 +1,28 @@
+import { deny } from '../errors.mjs';
+import { normalizeEmail } from '../policy.mjs';
+
+// How long an email proof counts: the owner's decision, 10 October 2026.
+export const EMAIL_PROOF_DAYS = 30;
+const PROOF_MS = EMAIL_PROOF_DAYS * 86400000;
+const RESERVED = /\.(?:localhost|test|invalid)$/;
+
+// The principal's email, only when it was proven in the last 30 days. A
+// provider that sends email_verified_at dates the proof; one that does not
+// (Google, Microsoft, Okta) proves it at this sign-in.
+export function trustedEmail(principal, now) {
+  if (principal.emailVerified !== true || typeof principal.email !== 'string') return null;
+  if (principal.emailVerifiedAt !== undefined) {
+    if (!Number.isSafeInteger(principal.emailVerifiedAt) || principal.emailVerifiedAt > now + 300000 || now - principal.emailVerifiedAt > PROOF_MS) return null;
+  }
+  return normalizeEmail(principal.email);
+}
+
+// A production app refuses dev identities and addresses that only local or
+// test systems can hold, whatever the provider asserts.
+export function refuseInProduction(principal, config) {
+  if (config.local === true) return;
+  if (Array.isArray(principal.amr) && principal.amr.includes('dev')) deny('dev_identity_refused');
+  for (const value of [principal.email, principal.associatedEmail]) {
+    if (typeof value === 'string' && RESERVED.test(value.trim().toLowerCase())) deny('reserved_email');
+  }
+}

package/modules/operator-auth/index.d.mts

@@ -0,0 +1,223 @@
+export type Role = 'owner' | 'admin' | 'member';
+export type SessionKind = 'native' | 'review' | 'oidc' | 'password' | 'dev';
+export interface Operator<R extends string = Role> { id: string; email: string; displayName: string; role: R; status: 'invited' | 'active' | 'inactive'; version: number; createdAt: number }
+export interface Session<R extends string = Role> { issuer?: string; subject?: string; sid?: string; id: string; kind: SessionKind; operatorId: string; operator: Operator<R>; createdAt: number; expiresAt: number }
+export interface CompletedSession<R extends string = Role> { session: Pick<Session<R>, 'id' | 'kind' | 'createdAt' | 'expiresAt'>; operator: Operator<R>; cookie: string; returnTo: string }
+export interface MailMessage { deliveryId: string; from: string; to: string[]; subject: string; text: string; html: string; headers: Record<string, string> }
+export interface MailSender { send(message: MailMessage): Promise<{ status: 'accepted' | 'rejected' | 'rate_limited' | 'uncertain' | 'development'; provider: string; providerMessageId: string | null; code?: string }> }
+export interface AuthBranding { productName?: string; accentColor?: string; signInPath?: string; /** Same-origin path of the seed's served rer-theme.css. */ theme?: string }
+export interface AuthPresentation { readonly productName: string; readonly accentColor: string; readonly signInPath: string; readonly theme?: string }
+export interface LinkPreview { kind: 'magic' | 'invite' | 'step_up'; expiresInMinutes: number }
+/** A step-up confirmation proves the session's operator again; it issues no new session. */
+export interface StepUpConfirmed { stepUp: StepUpAction; returnTo: string; cookie?: undefined }
+export type StepUpAction = 'providers:unlink' | 'providers:relink' | 'domains:change' | 'owner:transfer' | 'export' | 'delete' | 'credentials:mint';
+export const STEP_UP_ACTIONS: readonly StepUpAction[];
+export type ProviderPreset = 'auth' | 'google' | 'microsoft' | 'okta' | 'legacy-rs256';
+/** One identity provider. Secrets and the private key are server bindings, never source text. */
+export interface IdentityProviderConfig {
+  /** Route and pin id: /auth/oidc/<id>/start and /auth/oidc/<id>/callback. */
+  id: string;
+  preset: ProviderPreset;
+  /** Auth and Okta: the exact HTTPS issuer. Google's is fixed; Microsoft's comes from tenant. */
+  issuer?: string;
+  tenant?: string;
+  /** Explicit same-origin callback, including an incumbent path outside /auth/oidc/. */
+  redirectUri?: string;
+  /** Required only for legacy-rs256: exact HTTPS endpoints trusted for verified email. */
+  endpointPins?: { authorization: string; token: string; jwks: string };
+  clientId: string;
+  label?: string;
+  /** Default: private_key_jwt (no shared secret). Auth accepts only private_key_jwt. */
+  tokenAuthMethod?: 'private_key_jwt' | 'client_secret_basic' | 'client_secret_post';
+  clientSecret?: string;
+  /** The app's private JWK (ES256 or RS256) with kid; the provider holds its public half. */
+  privateKey?: JsonWebKey & { kid: string };
+  /** Explicit issuer-scoped sub to existing operator email associations; the only way Microsoft and Okta identify a person. */
+  subjectEmails?: Record<string, string>;
+  additionalAudiences?: string[];
+  endpointOrigins?: string[];
+  /** Auth only: the lowest oidc-provider interface version accepted (at least the module's minimum). */
+  minimumVersion?: string;
+}
+export interface AuthConfig {
+  dependencies?: boolean;
+  /** Name: 1-80 characters; accent: #rrggbb; signInPath: same-origin absolute path. */
+  branding?: AuthBranding;
+  origin: string; OWNER_EMAIL: string; SESSION_SECRET: string; SETUP_TOKEN?: string; MAIL_FROM?: string;
+  /** Local HTTP is allowed only for literal localhost, 127.0.0.1 or [::1] with matching Host. */
+  local?: boolean; allowList?: string[]; sessionSeconds?: number; linkSeconds?: number;
+  review?: { enabled: boolean; operatorEmail: string }; reviewSeconds?: number;
+  limitWindowSeconds?: number; ipLimit?: number; emailLimit?: number;
+  /** Issuers the original admitVerifiedIdentity/createIdentityAdmission seams accept. */
+  externalIssuers?: string[];
+  /** Linked identity providers, offered as "Continue with…" on the sign-in page. */
+  providers?: IdentityProviderConfig[];
+  /** Independent secret of at least 32 characters for provider transactions; required with providers. */
+  OIDC_TRANSACTION_SECRET?: string;
+  identityTimeoutMs?: number; identityStartLimit?: number;
+}
+export type Action = 'operators:list' | 'operators:invite' | 'operators:deactivate' | 'operators:reactivate' | 'operators:role' | 'sessions:list' | 'sessions:revoke' | 'providers:manage' | 'domains:manage';
+export interface PolicyInput { actor: Operator; action: Action; target?: Operator; role?: Role }
+export type RolePolicy = (input: PolicyInput) => boolean | Promise<boolean>;
+/** Minimal structural D1 binding contract, compatible with Workers D1Database. */
+export interface Database {
+  prepare(sql: string): Statement;
+  batch(statements: Statement[]): Promise<Result[]>;
+}
+export interface Statement {
+  bind(...values: unknown[]): Statement;
+  first<T = Record<string, unknown>>(): Promise<T | null>;
+  all<T = Record<string, unknown>>(): Promise<Result<T>>;
+  run<T = Record<string, unknown>>(): Promise<Result<T>>;
+}
+export interface Result<T = Record<string, unknown>> { results: T[]; meta: { changes: number } }
+/**
+ * Cryptographically verified principal, the identity layer's output. Its email
+ * counts only when emailVerified is true and any emailVerifiedAt (ms) is within
+ * 30 days. associatedEmail comes only from trusted server configuration.
+ */
+export interface VerifiedPrincipal { issuer: string; subject: string; provider?: string; email?: string; emailVerified?: boolean; emailVerifiedAt?: number; amr?: string[] }
+export interface Principal extends VerifiedPrincipal { associatedEmail?: string; sid?: string; datedEmailRequired?: boolean; providerGeneration?: number; providerPin?: { id: string; issuer: string; clientId: string; linkedAt: number } }
+export interface VerifiedIdentity extends VerifiedPrincipal { email: string; emailVerified: true }
+/** Deployment-owned association, never populated from token claims or HTTP input. */
+export interface IdentityAdmissionConfig { issuer: string; subjectEmails?: Record<string, string> }
+export type IdentityAdmission<R extends string = Role> = (request: Request, identity: VerifiedPrincipal, input?: { returnTo?: string }) => Promise<CompletedSession<R>>;
+export interface AuthHooks<R extends string = Role> {
+  /** Before an email link is sent to an active operator. Return false to send nothing; the public answer is unchanged. */
+  beforeMagicLink?(input: { request: Request; email: string; operator: Operator<R> }): boolean | void | Promise<boolean | void>;
+  /** After an email-link or provider sign-in completes. Return a returnTo to redirect; throw to refuse (the new session is revoked). */
+  afterConfirm?(input: { request: Request; operator: Operator<R>; session: CompletedSession<R>['session']; method: 'email' | 'oidc'; returnTo: string }): void | { returnTo?: string } | Promise<void | { returnTo?: string }>;
+}
+export interface AuthOptions<R extends string = Role> {
+  db: Database; config: AuthConfig; mailSender?: MailSender; clientIp: (request: Request) => string | Promise<string>; rolePolicy?: RolePolicy; clock?: () => number;
+  hooks?: AuthHooks<R>;
+  /** The runtime's fetch for provider discovery, JWKS and token calls (it must honour redirect: 'manual' and AbortSignal). */
+  fetch?: typeof globalThis.fetch;
+  /** The Worker's waitUntil, so a hidden provider is re-checked after the page answers. */
+  waitUntil?: (promise: Promise<unknown>) => void;
+}
+/** A person as the identity layer sees them through an accounts adapter. */
+export interface AccountPerson { id: string; email: string; status: 'active' | 'invited' | 'inactive'; owner: boolean; [extra: string]: unknown }
+/**
+ * The accounts adapter interface: what identity needs from an app's own
+ * accounts. Base's oa_ store implements it; a seed with its own tables may too.
+ */
+export interface AccountsAdapter<R extends string = Role> {
+  findByEmail(email: string): Promise<AccountPerson | null>;
+  findBinding(principal: { issuer: string; subject: string }): Promise<AccountPerson | null>;
+  /** Never rebinds a principal bound to someone else; binds only proven emails or explicit associations; revokes earlier passwords. */
+  bind(input: { issuer: string; subject: string; person: AccountPerson; associated: boolean }): Promise<boolean>;
+  issueSession(input: { person: AccountPerson; principal: Principal; method: 'oidc'; returnTo?: string; request: Request }): Promise<CompletedSession<R> | null>;
+  bindAndIssueSession?(input: { person: AccountPerson; principal: Principal; method: 'oidc'; returnTo?: string; request: Request }): Promise<CompletedSession<R> | null>;
+  revokeSession(sessionId: string): Promise<void>;
+  owner(): Promise<AccountPerson | null>;
+  currentBoundSubject?(input: {personId:string;issuer:string}):Promise<string|null>;
+  identityEnabled?():Promise<boolean>;
+  acceptInvitation?(input: { person: AccountPerson; principal: Principal; returnTo?: string; request: Request }): Promise<CompletedSession<R> | null>;
+  requiredProvider?(email: string): Promise<string | null>;
+}
+export interface Admission<R extends string = Role> {
+  admit(request: Request, principal: Principal, input?: { returnTo?: string }): Promise<CompletedSession<R>>;
+  readonly accounts: AccountsAdapter<R>;
+}
+export interface ProviderEntry { id: string; label: string; preset: ProviderPreset; startPath: string; visible: boolean; linked: boolean; pendingRelink: boolean }
+export interface ProviderLink {
+  id: string; preset: ProviderPreset; status: 'linked' | 'unlinked'; issuer: string; clientId: string; jwks: string; authorization: string; token: string;
+  algorithms: Array<'ES256' | 'RS256'>; tokenAuthMethod: string; responseIssuer: boolean; interfaceVersion: string | null; linkedAt: number;
+  pendingIssuer: string | null; pendingClientId: string | null; pendingPreset: string | null; pendingAt: number | null;
+}
+export interface IdentityProviders {
+  readonly ids: readonly string[];
+  readonly callbackPaths?: Readonly<Record<string, string>>;
+  begin(request: Request, id: string, input?: { returnTo?: string }): Promise<Response>;
+  callback(request: Request, id: string): Promise<Response>;
+  list(): Promise<ProviderEntry[]>;
+  relink(id: string): Promise<ProviderLink | null>;
+  unlink(id: string): Promise<void>;
+  links(): Promise<ProviderLink[]>;
+}
+export interface DomainRule { domain: string; providerId: string; createdAt: number }
+export interface OperatorAuth<R extends string = Role> {
+  mintCredential(request:Request,input?:{expiresInSeconds?:number}):Promise<{id:string;token:string;expiresAt:number}>;
+  authenticateCredential(request:Request):Promise<{id:string;personId:string;fence:number;kind:SessionKind}|null>;
+  authorizeDependencySetup(request: Request, input: { token?: string }): Promise<boolean>;
+  completeLocalSetup(request:Request):Promise<{complete:boolean}>;
+  identitySettings(request:Request):Promise<{idpSignIn:boolean}>;
+  setIdentitySettings(request:Request,input:{idpSignIn:boolean}):Promise<{idpSignIn:boolean}>;
+  requireEditorOwner(request:Request):Promise<Session<R>>;
+  credentialFence(request:Request):Promise<{personId:string;fence:number;kind:SessionKind}>;
+  checkCredentialFence(credential:{personId:string;fence?:number;kind?:SessionKind},request?:Request):Promise<boolean>;
+  /** Frozen public branding only; contains no credentials or auth configuration. */
+  readonly presentation: AuthPresentation;
+  /** Linked identity providers; null when none is configured. */
+  readonly providers: IdentityProviders | null;
+  readonly admission: Admission<R>;
+  readonly accounts: AccountsAdapter<R>;
+  bootstrap(request: Request, input: { token: string; displayName: string; returnTo?: string }): Promise<CompletedSession<R>>;
+  /** requiredProvider names the provider the address's domain must use, whoever asks. */
+  requestMagicLink(request: Request, input: { email: string; returnTo?: string }): Promise<{ status: 'accepted'; requiredProvider?: string }>;
+  previewLink(request: Request, token: string | null): Promise<LinkPreview | null>;
+  confirmLink(request: Request, input: { token: string }): Promise<CompletedSession<R> | StepUpConfirmed>;
+  getSession(request: Request): Promise<Session<R> | null>;
+  signOut(request: Request): Promise<{ cookie: string }>;
+  invite(request: Request, input: { email: string; displayName: string; role?: Role; returnTo?: string }): Promise<{ status: 'accepted' }>;
+  listOperators(request: Request): Promise<Operator<R>[]>;
+  /** Cancel a pending invitation using operators:deactivate policy; accepted invitations conflict. */
+  cancelInvitation(request: Request, operatorId: string): Promise<Operator<R>>;
+  setOperatorStatus(request: Request, operatorId: string, status: 'active' | 'inactive'): Promise<Operator<R>>;
+  setRole(request: Request, operatorId: string, role: Role): Promise<Operator<R>>;
+  listSessions(request: Request, operatorId?: string): Promise<Array<{ id: string; kind: SessionKind; createdAt: number; expiresAt: number; active: boolean }>>;
+  revokeSession(request: Request, sessionId: string): Promise<void>;
+  issueReviewSession(request: Request, input?: { returnTo?: string }): Promise<CompletedSession<R>>;
+  /** Server-only: caller has verified the full OIDC protocol. Never bind untrusted JSON to this method. */
+  admitVerifiedIdentity(request: Request, identity: VerifiedIdentity, input?: { returnTo?: string }): Promise<CompletedSession<R>>;
+  /** Server-only configuration: snapshots exact subject associations; caller must verify the full OIDC protocol. */
+  createIdentityAdmission(config: IdentityAdmissionConfig): IdentityAdmission<R>;
+  /** Server-only: caller has verified a real password against this existing operator. Rate-limit that verifier independently. */
+  admitVerifiedPassword(request: Request, operatorId: string, input?: { returnTo?: string }): Promise<CompletedSession<R>>;
+  /** Email a step-up link to the signed-in operator's own address. */
+  requestStepUp(request: Request, input: { action: StepUpAction; returnTo?: string }): Promise<{ status: 'accepted' }>;
+  /** Refuse unless this session holds a fresh (10-minute) app-local email-link proof. Provider sessions never do by themselves. */
+  requireStepUp(request: Request, action: StepUpAction): Promise<Session<R>>;
+  listDomainRules(request: Request): Promise<DomainRule[]>;
+  /** provider null lifts the rule. Needs a fresh step-up proof. */
+  setDomainRule(request: Request, input: { domain: string; provider: string | null }): Promise<DomainRule[]>;
+  listProviders(request: Request): Promise<ProviderLink[]>;
+  unlinkProvider(request: Request, input: { provider: string }): Promise<ProviderLink[]>;
+  relinkProvider(request: Request, input: { provider: string }): Promise<ProviderLink[]>;
+}
+export type { NativeAccountsAdapter, NativeAuthOptions, NativePerson, NativeOperatorAuth } from './accounts/native.mjs';
+export type { NativeProofPersistence } from './identity/email-link/index.mjs';
+export function createOperatorAuth<R extends string>(options: import('./accounts/native.mjs').NativeAuthOptions<R>): import('./accounts/native.mjs').NativeOperatorAuth<R>;
+export function createOperatorAuth(options: AuthOptions): OperatorAuth;
+export function createAuthHandler<R extends string>(auth: OperatorAuth<R>): (request: Request) => Promise<Response | null>;
+export interface SignInPageOptions {
+  /** While the first owner is unclaimed: the setup form and its instructions. */
+  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
+  /** Extra same-origin links under the form (for example the local development outbox). */
+  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
+  defaultReturnTo?: string;
+}
+/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
+export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;
+export class AuthError extends Error { constructor(code: string, status?: number); code: string; status: number }
+export const DEFAULT_ROLES: readonly Role[];
+export function defaultRolePolicy(input: PolicyInput): boolean;
+export function normalizeEmail(value: unknown): string;
+export function safeReturnTo(value: unknown, fallback?: string): string;
+export function isActiveOperator(operator: Operator | null | undefined, allowList?: string[]): boolean;
+export function requireLoopback(request: Request): void;
+export function isLoopbackHost(hostname: string): boolean;
+export function securityHeaders(): Record<string, string>;
+export interface DevGateInput { key: string | undefined; origin: string; local: boolean }
+export interface DevGate {
+  /** `rer_dev_gate_<port>`: one gate cookie per local origin. */
+  readonly cookieName: string;
+  admits(request: Request): Promise<boolean>;
+  setCookie(): Promise<string>;
+  /** Handles GET/POST /__dev/key; null for every other path. */
+  exchange(request: Request): Promise<Response | null>;
+}
+export const DEV_KEY_HEADER: 'x-rer-dev-key';
+export function devGate(input: DevGateInput): DevGate | null;
+export function devNotFound(): Response;

package/modules/operator-auth/index.mjs

@@ -0,0 +1,11 @@
+// Server-only entry. Never import this module into browser components/loaders.
+// Layers: identity/ proves who a person is, accounts/ holds who they are in this
+// app and what they may do, dev/ is local only. See README.md.
+export { createOperatorAuth, STEP_UP_ACTIONS } from './service.mjs';
+export { createAuthHandler } from './routes.mjs';
+export { createSignInHandler } from './signin/index.mjs';
+export { AuthError } from './errors.mjs';
+export { normalizeEmail, safeReturnTo } from './policy.mjs';
+export { DEFAULT_ROLES, defaultRolePolicy, isActiveOperator } from './accounts/roles.mjs';
+export { requireLoopback, isLoopbackHost, securityHeaders } from './http.mjs';
+export { devGate, devNotFound, DEV_KEY_HEADER } from './dev-gate.mjs';

package/modules/operator-auth/input.mjs

@@ -0,0 +1,55 @@
+import { AuthError } from './errors.mjs';
+
+// URLSearchParams decodes field names before comparison, so token and %74oken
+// cannot be interpreted as different credentials by different HTTP layers.
+export function readParameters(parameters) {
+  const fields = Object.create(null);
+  for (const [name, value] of parameters) {
+    if (Object.hasOwn(fields, name)) throw new AuthError('invalid_input');
+    fields[name] = value;
+  }
+  return fields;
+}
+
+function readJson(text) {
+  const value = JSON.parse(text);
+  // JSON.parse discards duplicate members. Scan the already validated JSON's
+  // strings and containers, comparing decoded keys in each object before using
+  // its parsed value. Strings inside values never become object keys.
+  const objects = [];
+  for (const token of text.matchAll(/"(?:\\[\s\S]|[^"\\])*"|[{}\[\]]/g)) {
+    const part = token[0];
+    if (part === '{') objects.push(new Set());
+    else if (part === '[') objects.push(null);
+    else if (part === '}' || part === ']') objects.pop();
+    else if (/^\s*:/.test(text.slice(token.index + part.length))) {
+      const name = JSON.parse(part);
+      const keys = objects.at(-1);
+      if (keys.has(name)) throw new AuthError('invalid_input');
+      keys.add(name);
+    }
+  }
+  return value;
+}
+
+export async function readInput(request) {
+  const contentType = request.headers.get('content-type')?.split(';')[0];
+  if (!['application/json', 'application/x-www-form-urlencoded'].includes(contentType)) throw new AuthError('unsupported_media_type', 415);
+  const reader = request.body?.getReader();
+  if (!reader) throw new AuthError('invalid_input');
+  const chunks = []; let length = 0;
+  while (true) {
+    const next = await reader.read(); if (next.done) break;
+    length += next.value.byteLength;
+    if (length > 8192) { await reader.cancel(); throw new AuthError('input_too_large', 413); }
+    chunks.push(next.value);
+  }
+  const bytes = new Uint8Array(length); let offset = 0;
+  for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
+  try {
+    const text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+    const parsed = contentType === 'application/json' ? readJson(text) : readParameters(new URLSearchParams(text));
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new AuthError('invalid_input');
+    return parsed;
+  } catch { throw new AuthError('invalid_input'); }
+}

package/modules/operator-auth/local-cli.mjs

@@ -0,0 +1,16 @@
+import { hashToken, constantEqual } from './crypto.mjs';
+
+// The rer command line signs in to its own loopback development server on every
+// setup and dev start. It proves it holds the private SESSION_SECRET with this
+// header so those requests do not spend the owner's sign-in budget. Only a local
+// (loopback) configuration honours it; production ignores the header entirely.
+// The onboarding adapter derives the same value: HMAC-SHA256(SESSION_SECRET,
+// "local-cli\0sign-in") as lowercase hex.
+export const LOCAL_CLI_HEADER = 'x-rer-local-cli';
+
+export async function isLocalCli(request, config) {
+  if (!config.local) return false;
+  const presented = request.headers.get(LOCAL_CLI_HEADER);
+  if (!presented) return false;
+  return constantEqual(presented, await hashToken(config.SESSION_SECRET, 'local-cli', 'sign-in'));
+}

package/modules/operator-auth/page.mjs

@@ -0,0 +1,34 @@
+import { accentInk } from './branding.mjs';
+import { escapeHtml, securityHeaders } from './http.mjs';
+
+// The shared frame of every server-rendered auth page (confirmation, sign-in):
+// no script, styles allowed only by their own hash, the seed's theme when it
+// declares one, light and dark.
+// Added only when the seed declares a theme: its linked rer-theme.css supplies
+// the --rer-* tokens; --rer-logo toggles and draws the mark beside the name.
+// Each token falls back to a readable neutral if the file cannot load.
+function themed(accentColor) {
+  return `.rer-themed{color-scheme:light;background:var(--rer-page,#f3f5f8);color:var(--rer-text,#172033)}.rer-themed body{font-family:var(--rer-font-body,inherit)}.rer-themed main{background:var(--rer-surface,#fff);border-color:transparent;border-radius:var(--rer-radius,20px);box-shadow:0 1px 2px #0000000d,0 14px 36px #00000014}.rer-themed h1{font-family:var(--rer-font-heading,var(--rer-font-body,inherit))}.rer-themed .brand{display:flex;align-items:center;gap:12px;font-size:16px;color:var(--rer-text,#172033);font-family:var(--rer-font-heading,var(--rer-font-body,inherit))}.rer-themed .mark{display:none}.rer-themed .brand::before{content:var(--rer-logo,none);display:block;flex:none;width:32px;height:32px;overflow:hidden;text-indent:200%;white-space:nowrap;background:var(--rer-logo) center/contain no-repeat}.rer-themed p{color:var(--rer-muted,#475569)}.rer-themed button,.rer-themed .action{border-color:transparent;border-radius:var(--rer-radius,10px);background:var(--rer-accent,${accentColor});color:var(--rer-accent-text,${accentInk(accentColor)})}.rer-themed button:focus-visible,.rer-themed .action:focus-visible{outline-color:var(--rer-focus,#172033)}.rer-themed button.secondary{background:transparent;color:var(--rer-text,#172033);border-color:var(--rer-muted,#64748b)}.rer-themed .secondary-link a{color:var(--rer-link,var(--rer-text,#172033))}.rer-themed .secondary-link a:focus-visible{outline-color:var(--rer-focus,#172033)}`;
+}
+
+function stylesheet(accentColor) {
+  return `:root{color-scheme:light;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#172033;background:#f3f5f8}*{box-sizing:border-box}body{margin:0;min-height:100vh;padding:32px 20px;display:grid;place-items:center}main{width:100%;max-width:480px;background:#fff;border:1px solid #dce2ea;border-radius:20px;padding:36px;box-shadow:0 12px 40px #1720330a;overflow-wrap:anywhere}.brand{font-size:14px;font-weight:650;line-height:1.5;margin:0 0 32px;color:#475569}.mark{display:block;width:32px;height:6px;border-radius:3px;border:1px solid currentColor;background:${accentColor};margin-bottom:16px}h1,h2{text-wrap:balance}h1{font-size:30px;line-height:1.3;letter-spacing:-.02em;margin:0 0 24px;font-weight:700}p{font-size:16px;line-height:1.6;margin:0 0 24px;color:#475569;text-wrap:pretty}form{margin:0}button,.action{display:block;width:100%;border:1px solid #64748b;border-radius:10px;background:${accentColor};color:${accentInk(accentColor)};padding:13px 18px;font:inherit;font-weight:650;text-align:center;text-decoration:none;cursor:pointer;line-height:1.5}button:hover,.action:hover{box-shadow:inset 0 0 0 2px currentColor}button:focus-visible,.action:focus-visible{outline:3px solid #172033;outline-offset:4px}@media(max-width:480px){body{padding:24px 16px}main{padding:28px 24px}h1{font-size:28px}}@media(prefers-color-scheme:dark){:root{color-scheme:dark;background:#111827;color:#f8fafc}main{background:#1e293b;border-color:#475569;box-shadow:none}.brand,p{color:#cbd5e1}button:focus-visible,.action:focus-visible{outline-color:#f8fafc}}`;
+}
+
+// Form controls and notices used by the sign-in page; part of the same hashed sheet.
+const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
+
+export async function pageResponse({ branding, title, heading, content, status = 200, method = 'GET', referrer, formTargets = [] }) {
+  const css = stylesheet(branding.accentColor) + FORMS + (branding.theme ? themed(branding.accentColor) : '');
+  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(css)));
+  const hash = btoa(String.fromCharCode(...digest));
+  const product = escapeHtml(branding.productName);
+  const html = `<!doctype html><html lang="en"${branding.theme ? ' class="rer-themed"' : ''}><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${title ?? heading}</title>${branding.theme ? `<link rel="stylesheet" href="${escapeHtml(branding.theme)}">` : ''}<style>${css}</style></head><body><main><p class="brand"><span class="mark" aria-hidden="true"></span>${product}</p><h1>${heading}</h1>${content}</main></body></html>`;
+  const headers = { ...securityHeaders(), 'Content-Type': 'text/html; charset=utf-8' };
+  // A form may post to this origin only, plus any origin its own redirect must reach (a provider's authorization endpoint).
+  if (formTargets.length) headers['Content-Security-Policy'] = headers['Content-Security-Policy'].replace("form-action 'self'", `form-action 'self' ${formTargets.join(' ')}`);
+  headers['Content-Security-Policy'] += branding.theme ? `; style-src 'self' 'sha256-${hash}'; font-src 'self'; img-src 'self'` : `; style-src 'sha256-${hash}'`;
+  // Native form POSTs need their Origin; never disclose the path or query.
+  if (referrer) headers['Referrer-Policy'] = referrer;
+  return new Response(method === 'HEAD' ? null : html, { status, headers });
+}

package/modules/operator-auth/policy.mjs

@@ -0,0 +1,20 @@
+import { AuthError } from './errors.mjs';
+// Value rules shared by every layer.
+export function normalizeEmail(value) {
+  if (typeof value !== 'string') throw new AuthError('invalid_email');
+  const email = value.trim().toLowerCase();
+  if (email.length > 254 || !/^[^\s@<>\x00-\x1f]+@[^\s@<>\x00-\x1f]+\.[^\s@<>\x00-\x1f]+$/.test(email)) throw new AuthError('invalid_email');
+  return email;
+}
+export function emailDomain(email) { return email.slice(email.lastIndexOf('@') + 1); }
+export function safeReturnTo(value, fallback = '/app') {
+  const safeFallback = fallback === '/app' ? '/app' : safeReturnTo(fallback);
+  if (typeof value !== 'string' || value.length > 2048 || !value.startsWith('/') || value.startsWith('//') || /[\\\x00-\x20\x7f]/.test(value)) return safeFallback;
+  // Decode repeatedly to reject encoded slash/backslash/control redirect tricks.
+  let decoded = value;
+  for (let i = 0; i < 4; i++) {
+    try { const next = decodeURIComponent(decoded); if (next === decoded) break; decoded = next; } catch { return safeFallback; }
+    if (decoded.startsWith('//') || /[\\\x00-\x1f\x7f]/.test(decoded)) return safeFallback;
+  }
+  return value;
+}

package/modules/operator-auth/routes.mjs

@@ -0,0 +1,91 @@
+import { identitySettingsPage } from './accounts/settings-page.mjs';
+import { confirmationResponse } from './identity/email-link/confirmation.mjs';
+import { createOidcHandler } from './identity/oidc/index.mjs';
+import { AuthError } from './errors.mjs';
+import { securityHeaders, requireLoopback } from './http.mjs';
+import { safeReturnTo } from './policy.mjs';
+import { readInput, readParameters } from './input.mjs';
+function json(value, status = 200) { return Response.json(value, { status, headers: securityHeaders() }); }
+function seeOther(location, cookie) { return new Response(null, { status: 303, headers: { ...securityHeaders(), ...(cookie ? { 'Set-Cookie': cookie } : {}), Location: location } }); }
+// A native HTML form (the sign-in page before any script) gets a page back; an
+// API caller gets JSON.
+const formPost = request => (request.headers.get('content-type') ?? '').split(';')[0].trim().toLowerCase() === 'application/x-www-form-urlencoded';
+function notice(auth, code, extra = {}) {
+  const url = new URL(auth.presentation.signInPath, 'https://signin.invalid');
+  url.searchParams.set('notice', code);
+  for (const [key, value] of Object.entries(extra)) if (value) url.searchParams.set(key, value);
+  return url.pathname + url.search;
+}
+
+/** Fetch-compatible optional HTTP adapter. Returns null for paths it does not own. */
+export function createAuthHandler(auth) {
+  const oidc = auth.providers ? createOidcHandler(auth.providers) : null;
+  return async function handleAuth(request) {
+    const url = new URL(request.url);
+    const path = url.pathname;
+    let form = false;
+    try {
+      const providerResponse = await oidc?.(request);
+      if (providerResponse) return providerResponse;
+      if (!path.startsWith('/auth/')) return null;
+      if (path.startsWith('/auth/oidc/')) return json({ error: 'not_found' }, 404);
+      if (path === '/auth/review-session') requireLoopback(request);
+      if (path === '/auth/confirm' && ['GET', 'HEAD'].includes(request.method)) {
+        const token = readParameters(url.searchParams).token ?? null;
+        const preview = await auth.previewLink(request, token);
+        return await confirmationResponse({ branding: auth.presentation, preview, token, method: request.method });
+      }
+      if (path === '/auth/session' && request.method === 'GET') {
+        const session = await auth.getSession(request);
+        return session ? json(session) : json({ error: 'unauthenticated' }, 401);
+      }
+      if (path === '/auth/operators' && request.method === 'GET') return json(await auth.listOperators(request));
+      if (path === '/auth/sessions' && request.method === 'GET') return json(await auth.listSessions(request, readParameters(url.searchParams).operatorId));
+      if (path === '/auth/domain-rules' && request.method === 'GET') return json(await auth.listDomainRules(request));
+      if (path === '/auth/settings/identity' && request.method === 'GET') {const value=await auth.identitySettings(request);return /text\/html/.test(request.headers.get('accept')??'')?identitySettingsPage(value):json(value);}
+      if (path === '/auth/providers' && request.method === 'GET') return json(await auth.listProviders(request));
+      const posts = new Set(['/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/invite', '/auth/invite/cancel', '/auth/review-session',
+        '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
+      if (!posts.has(path)) return json({ error: 'not_found' }, 404);
+      if (request.method !== 'POST') return json({ error: 'method_not_allowed' }, 405);
+      const query = readParameters(url.searchParams);
+      // POST credentials belong only in the body. Refuse a second credential
+      // source even if a proxy or caller would choose one of the two values.
+      if (Object.hasOwn(query, 'token')) throw new AuthError('invalid_input');
+      form = formPost(request) && ['/auth/magic-link', '/auth/step-up'].includes(path);
+      const input = await readInput(request);
+      switch (path) {
+        case '/auth/settings/identity': {const value=await auth.setIdentitySettings(request,formPost(request)?{idpSignIn:input.idpSignIn==='true'}:input);return formPost(request)?seeOther('/auth/settings/identity'):json(value);}
+        case '/auth/setup-complete': return json(await auth.completeLocalSetup(request));
+        case '/auth/bootstrap': { const value = await auth.bootstrap(request, input); return seeOther(value.returnTo, value.cookie); }
+        case '/auth/magic-link': {
+          const result = await auth.requestMagicLink(request, input);
+          return form ? seeOther(notice(auth, 'sent', { returnTo: safeReturnTo(input.returnTo) === '/app' ? undefined : safeReturnTo(input.returnTo), provider: result.requiredProvider })) : json(result, 202);
+        }
+        case '/auth/confirm': { const value = await auth.confirmLink(request, input); return seeOther(value.returnTo, value.cookie); }
+        case '/auth/review-session': { const value = await auth.issueReviewSession(request, input); return seeOther(value.returnTo, value.cookie); }
+        case '/auth/step-up': {
+          const result = await auth.requestStepUp(request, input);
+          return form ? seeOther(notice(auth, 'step_up_sent')) : json(result, 202);
+        }
+        case '/auth/invite': return json(await auth.invite(request, input), 202);
+        case '/auth/invite/cancel': return json(await auth.cancelInvitation(request, input.operatorId));
+        case '/auth/signout': {
+          const result = await auth.signOut(request);
+          return new Response(null, { status: 204, headers: { ...securityHeaders(), 'Set-Cookie': result.cookie } });
+        }
+        case '/auth/operator/status': return json(await auth.setOperatorStatus(request, input.operatorId, input.status));
+        case '/auth/operator/role': return json(await auth.setRole(request, input.operatorId, input.role));
+        case '/auth/session/revoke': await auth.revokeSession(request, input.sessionId); return new Response(null, { status: 204, headers: securityHeaders() });
+        case '/auth/domain-rules': return json(await auth.setDomainRule(request, input));
+        case '/auth/providers/unlink': return json(await auth.unlinkProvider(request, input));
+        case '/auth/providers/relink': return json(await auth.relinkProvider(request, input));
+      }
+    } catch (error) {
+      if (form) return seeOther(notice(auth, error instanceof AuthError ? error.code : 'auth_unavailable'));
+      if (error instanceof AuthError) return json({ error: error.code }, error.status);
+      // Do not put SQL, email addresses, setup tokens or provider exceptions on the wire.
+      return json({ error: 'auth_unavailable' }, 503);
+    }
+  };
+}