@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/dependencies/README.md

@@ -0,0 +1,211 @@
+# Application dependency links
+
+This module implements the application side of the pull-link protocol. Auth's
+provider implementation (auth-7) is separate. `createDependencies` mounts the
+well-known routes and owner controls; `AuthConfig.dependencies: true` resolves
+OIDC client settings from the persisted link and the server-generated key.
+No client ID or private-key environment answer is needed. The default seed and
+composed foundation declare an optional `oidc-provider@1` dependency using the
+`IDENTITY_PROVIDER` URL answer. A blank answer keeps email-link access working.
+Other interfaces use the same handshake, storage and callback; only the OIDC
+adapter adds OIDC discovery, sessions, domain policy and owner claims.
+
+## Discovery and registration
+
+`GET /.well-known/rer-dependencies` returns `name`, `version: 1`, the exact
+`origin`, stable `sector_id`, `provides`, `dependencies`, `claim`, `callback`, and
+`jwks_uri`. Each dependency has `interface` (for example `oidc-provider@1`),
+`optional`, `cardinality: 1`, selected `provider` origin or null, registered
+same-origin `paths` as absolute URLs, and a per-interface `jwks_uri`.
+`GET /.well-known/rer-link/jwks/INTERFACE` publishes an ES256 public JWK only.
+The unqualified JWKS URL selects the identity interface. The application retains
+its private key in the server database. Sector/install identity survives re-link,
+provider moves and export/import. Keys are isolated per interface.
+
+Provider origins and metadata endpoints require HTTPS. The application's local
+runtime explicitly permits loopback HTTP; deployed registration requires HTTPS.
+Every provider serves `/.well-known/rer-dependencies` with the same graph fields,
+including its `provides` list and selected dependency provider origins. The CLI
+traverses these documents before setup effects, including selected optional
+edges, and refuses cycles, invalid references and oversized graphs.
+
+A provider serves `GET /.well-known/rer-provider` with `issuer`, `version: 1`,
+`interface` or `provides`, and absolute `initiate`, `redeem`, `deregister` URLs.
+All three endpoints must be HTTPS on exactly that issuer, with no query,
+fragment or URL credentials. OIDC additionally serves standards discovery with
+`rer_interfaces: ["oidc-provider@1.0.0"]` and compatible authorization, token,
+JWKS, ES256 and private_key_jwt support. The application pins those metadata and
+interface versions; callback input cannot select an endpoint or change the pin.
+
+## Owner approval and pull handshake
+
+1. The provider owner approves this exact app origin, interface and callback set.
+   For unattended `rer setup` or `rer deploy`, the provider issues an opaque,
+   one-use approval lasting at most one hour. Save it in an untracked 0600 file
+   named by `RER_LINK_TOKEN_FILE`. For multiple interfaces, use
+   `RER_LINK_TOKEN_FILES` instead: a JSON map such as
+   `{"oidc-provider@1":"auth-approval.json","error-sink@1":"errors-approval.json"}`.
+   Each interface needs a distinct private file; all pending approvals are
+   validated before setup effects and each consumed file is deleted. Its JSON envelope is
+   `{token, issuer, interface, origin, callbacks, issuedAt, expiresAt}`; times are
+   integer epoch milliseconds. `callbacks` is exactly the fixed link callback
+   plus the dependency's registered paths. Git-tracked files are refused.
+2. Before any provider callback, the app must hold its own ten-minute approval.
+   On an empty app, `POST /auth/dependencies/setup` accepts `{issuer,interface,token}`
+   using the app's private setup token, or the local CLI proof on loopback only.
+   Local onboarding opens these approvals before native bootstrap. Hosted deploy
+   uses the deployed app's setup token, never a local HMAC. Base account bootstrap binds
+   pending setup approvals to that owner's version and exact bootstrap session;
+   callback commit requires that session to remain active, unrevoked and unexpired.
+   A signed IdP owner claim may convert that same session to OIDC while sibling
+   setup approvals remain pending. Those approvals also require enabled provider
+   sign-in, the current policy generation and the session's matching linked
+   provider pin, including when claim completes during callback redemption.
+   After claim, use the current owner's fresh email proof at
+   `/auth/dependencies/relink`.
+   The CLI posts `{origin, interface, token}` to the provider's pinned `initiate`
+   endpoint. Interactive provider-owned approval can start the same pull without
+   a CLI token. The provider fetches the app's document and public JWKS, verifies
+   its approval against that origin and exact callback set, and stores the key,
+   sector, interface and registration paths with a short one-use code.
+3. The provider posts only `{issuer, interface, code}` to the fixed app URL
+   `/.well-known/rer-link/callback`. The app accepts only its configured/trusted
+   issuer named by that fresh app-local approval. Every callback, including an
+   unchanged link or a link after unlink, requires a new approval. The exact
+   attempt, owner/session authority and link snapshot are rechecked atomically
+   after redemption; replacing an approval invalidates in-flight callbacks. It never
+   follows a callback URL supplied in the request.
+4. The app durably consumes the code digest and posts to the pinned `redeem`
+   endpoint: `{code, interface, origin, callback, client_assertion_type,
+   client_assertion}`. Assertion type is
+   `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`. Its signed ES256 JWT
+   has `iss` and `sub` equal to the app origin, `aud` equal to the redeem URL,
+   `iat`, `exp` at most 60 seconds later, unique `jti`, `code`, `interface`,
+   `sector_id` and the fixed `callback`.
+5. The provider verifies the signature against the key fetched at approval,
+   audience, times, unique assertion/code use and every bound registration
+   property. Code redemption is atomic: concurrent requests have one winner.
+   The response contains `{issuer, interface, origin, callback, sector_id,
+   client_id}`. For an existing same-provider link it must retain the client ID
+   and provide `continuity: "previous-key"` after proving the previous key, or
+   `continuity: "provider-owner"` after fresh provider-owner approval. A new key
+   alone is never continuity proof. The app checks these values and commits the
+   link and OIDC pins in one transaction. The provider returns `{linked:true}`
+   from initiation only after the app accepted the callback.
+6. The CLI checks the app's accepted link then deletes its approval file. The
+   token never enters public answers, runtime variables, logs or exports. An
+   unchanged completed link needs no token on later setup. An explicitly supplied
+   token is always validated. Changed provider answers retain the old link and
+   require a new app-local approval and provider approval.
+
+Provider implementations must enforce code and token expiry, one-use redemption,
+origin/callback binding and key continuity themselves. The application-side
+network tests model those provider obligations without contacting a live service.
+
+## App owner controls and claims
+
+Normal Base account setup claims the native owner first, then links. Only that first setup's
+successful identity link enables `idpSignIn` automatically. The setup attempt
+ must have been opened before that native claim; a native claim without one
+ closes eligibility in its transaction. A link completed before a native claim
+ cannot authorize a later relink to enable sign-in. The CLI closes that
+first-setup eligibility after successful setup, including a blank optional
+provider. Existing and imported installs remain off until their current owner
+enables the app setting. `GET/POST /auth/settings/identity` has JSON and plain HTML
+forms, requires the current owner, records effective changes in `oa_auth_audit`,
+and never accepts platform authority. Any valid settings POST closes setup
+eligibility, including an unchanged value, without auditing a nonexistent change
+or advancing the session generation. Turning off increments a session generation
+and revokes provider sessions. In-flight callbacks cannot cross that generation;
+turning on never restores old sessions. Provider identity or roles alone grant no
+app membership: accounts or invitations remain authoritative.
+
+An app linked before claim advertises `claim: true` and requests the OIDC `claim`
+scope. SETUP owner-claim mode `idp` names the declared identity dependency and
+`/auth/owner-claim`. The provider can return `install_owner` from link redemption
+or an OIDC ID token containing the grant. The former value is itself a signed JWT;
+the latter is the signed ID token. Both use the pinned issuer, client audience,
+subject, fresh verified designated email, unique jti, iat and exp (at most five
+minutes), and `install_owner: {client_id, sector_id, subject, email}`. The app
+requires all four properties to match its own installation and designated owner.
+The existing bootstrap transaction commits owner, grant consumption, binding,
+setting audit and provider session together. Durable issuer/client uniqueness
+allows one owner grant even after a restart; the grant never becomes an ordinary
+role or a general sign-in credential. CLI readiness also verifies the local owner
+exists; linking alone is insufficient.
+
+`POST /auth/dependencies/relink` with `{interface,issuer}` requires the current
+owner's fresh app-local email proof. It creates a ten-minute pending approval
+bound to interface, issuer, exact callback set, owner, owner version and session. A provider move
+keeps existing principal bindings immutable; new-issuer access needs a newly
+proved email matching an existing account/invitation. `POST
+/auth/dependencies/unlink` with `{interface}` uses the same owner proof, deletes
+that interface's link, key and pending approval while retaining the sector, revokes only its provider sessions, and lifts only its
+provider domain rules before any network call. Signed deregistration is best
+effort; offline providers cannot prevent local removal.
+
+## Sessions, logout and portability
+
+Provider sessions record issuer, subject, sid and policy generation and last at
+most 24 hours. OIDC sessions also record their provider pin. Each completed
+re-link advances that provider's monotonic link timestamp, including an unchanged
+metadata re-link in the same millisecond. Binding, invitation acceptance and
+session issuance check the captured pin inside their transaction; session reads
+and privileged writes also require that pin to remain linked. Unrelated
+providers and native sessions retain their own authority. Existing consumers
+apply `accounts/schema/provider-pins.sql` as a new numbered migration (the
+default seed uses `0014_provider_pins.sql`). Existing consumers also apply
+`operator-auth/accounts/schema/dependency-setup.sql` and
+`dependencies/schema/approval-attempt.sql` as new migrations (default-seed
+`0015` and `0016`). Native-account consumers apply only the latter alongside
+their own native migrations; they must not install the OA setup schema. The
+latter invalidates older pending approvals. Auth email proof must be dated, valid and no older than 30 days,
+even for a bound account. Explicit mappings between an upstream subject and email remain
+supported only when they do not contradict an asserted stale proof.
+
+`POST /auth/oidc/auth/logout` accepts `logout_token` and ignores other fields.
+Use a signed JWT with `typ: "logout+jwt"`, pinned issuer/client audience, current
+iat/exp, nonempty durable one-use jti, no nonce property, and sub or sid. When
+both selectors exist they must agree. `events` must contain an empty object at
+`http://schemas.openid.net/event/backchannel-logout` or
+`https://runeditrun.com/events/identity-fence`; unknown events are refused.
+The fence event increments only the selected person's durable identity fence.
+All their fenced sessions and minted credentials then fail admission, while
+other people remain active. Ordinary ID tokens with any `events` property are
+refused. Credential consumers must record/check the fence; the provided
+`mintCredential`/`authenticateCredential` functions also refuse legacy credentials
+with no recorded fence. Editor grants require the actual current install owner;
+OIDC sessions must also match that owner's current issuer/subject account binding.
+
+Exports omit server link keys, approvals, code state, provider sessions and OIDC
+transients, preserve durable people/bindings/grant use/sector, set sign-in off and
+mark links as needing re-link. Import checks these conditions and requires an
+explicit fresh provider approval. Local `rer import` returns `needsRelink: true`
+and `nextCommand: "rer setup"`; that setup continuation consumes the fresh approval
+and retains the imported sector and bindings. `rer doctor` reports dangling providers or a
+needed re-link without reading or emitting private keys or approvals.
+
+## Native accounts
+
+Native `createOperatorAuth` composition reuses this protocol with
+`accounts.dependencies: NativeDependencyAuthority<R>`. Missing capabilities
+refuse enablement. Native authority checks and revocation statements join the
+same D1 link/unlink transaction; verified logout consumption uses the native
+binding/session/fence store atomically. No OA account tables are queried.
+Every native callback requires a new local owner approval, including initial
+and unchanged links. Shared code fences the exact attempt and approving
+person/session/version snapshot at preflight and commit; native contributions
+repeat their own current authority. Ordinary owner linking preserves disabled
+identity regardless of stale setup flags. Unlink deletes the link, key and
+pending approval while preserving the sector.
+
+Native dependency setup before a first owner is currently unsupported:
+`/auth/dependencies/setup` and `auth.authorizeDependencySetup` explicitly refuse
+with `native_capability_unavailable` (501) before pending/key mutation or OA
+setup SQL. Claim the native owner through the seed's supported bootstrap, then
+confirm a local email proof and approve at `/auth/dependencies/relink`. A native
+`claimOwner` capability alone does not make an empty installation's initial IdP
+link/claim journey available. Static incumbent providers remain available beside
+linked Auth.
+See [the exact native contract](../operator-auth/docs/native-accounts.md) for
+method arguments, migration selection, proof fences and adoption steps.

package/modules/dependencies/approval.mjs

@@ -0,0 +1,51 @@
+import { providerPinFence } from '../operator-auth/accounts/provider-pin.mjs';
+import { ownerFence } from './authority.mjs';
+import { CALLBACK, insist } from './protocol.mjs';
+
+export const callbacksFor = (origin, declared) => JSON.stringify([origin+CALLBACK,...declared.paths.map(path=>origin+path)].sort());
+export async function approveSetup({db,auth,request,input,contract,callbacks,clock}) {
+ // Native setup needs durable native bootstrap provenance. Until that optional
+ // capability exists, refuse before touching pending approvals or OA tables.
+ insist(!auth.native,'native_capability_unavailable',501);
+ await auth.authorizeDependencySetup(request,input);
+ const attempt=crypto.randomUUID(),expires=clock()+600000,guard=crypto.randomUUID();
+ await db.batch([
+  db.prepare('INSERT INTO rer_dependency_codes(digest,created_at) SELECT ?,CASE WHEN NOT EXISTS(SELECT 1 FROM oa_operators) AND NOT EXISTS(SELECT 1 FROM oa_bootstrap) THEN ? ELSE -1 END').bind(guard,clock()),
+  db.prepare("INSERT INTO rer_dependency_pending(interface,issuer,approved_by,expires_at,approved_session,approved_version,callbacks,attempt_id) VALUES(?,?,'setup',?,?,0,?,?) ON CONFLICT(interface) DO UPDATE SET issuer=excluded.issuer,approved_by=excluded.approved_by,expires_at=excluded.expires_at,approved_session=excluded.approved_session,approved_version=excluded.approved_version,callbacks=excluded.callbacks,attempt_id=excluded.attempt_id").bind(contract,input.issuer,expires,attempt,callbacks,attempt),
+  db.prepare('INSERT INTO oa_setup_links(interface,attempt_id,expires_at) VALUES(?,?,?) ON CONFLICT(interface) DO UPDATE SET attempt_id=excluded.attempt_id,expires_at=excluded.expires_at,owner_id=NULL,owner_version=NULL,session_id=NULL,completed=0').bind(contract,attempt,expires),
+ ]);
+}
+export async function approveOwner({store,actor,input,contract,callbacks,clock,native}) {
+ const fence=native?await native.ownerFence(actor,clock()):ownerFence(actor,clock());
+ const approval=await store.run(`INSERT INTO rer_dependency_pending(interface,issuer,approved_by,expires_at,approved_session,approved_version,callbacks,attempt_id) SELECT ?,?,?,?,?,?,?,? WHERE ${fence.sql} ON CONFLICT(interface) DO UPDATE SET issuer=excluded.issuer,approved_by=excluded.approved_by,expires_at=excluded.expires_at,approved_session=excluded.approved_session,approved_version=excluded.approved_version,callbacks=excluded.callbacks,attempt_id=excluded.attempt_id`,contract,input.issuer,actor.operator.id,clock()+600000,actor.id,actor.operator.version,callbacks,crypto.randomUUID(),...fence.args);
+ insist(approval.meta.changes===1,'authority_changed',409);
+}
+// Snapshot the attempt before network I/O. Every authority and exact attempt
+// predicate is executed again in the transaction that installs the link.
+export async function approvalFence(pending,contract,issuer,callbacks,now,pendingPin,native) {
+ const base={sql:'EXISTS(SELECT 1 FROM rer_dependency_pending p WHERE p.interface=? AND p.issuer=? AND p.callbacks=? AND p.expires_at>? AND p.attempt_id=?',args:[contract,issuer,callbacks,now,pending.attempt_id]};
+ if(native) {
+  const authority=await native.approvalFence({pending,contract,issuer,callbacks,now});
+  // The shared protocol owns attempt/snapshot equality. An adopter contributes
+  // native authority only; replacing any approval invalidates this callback.
+  return {sql:`${base.sql} AND p.approved_by=? AND p.approved_session=? AND p.approved_version=?) AND (${authority.sql})`,args:[...base.args,pending.approved_by,pending.approved_session,pending.approved_version,...authority.args]};
+ }
+ // A signed IdP claim converts the bootstrap session in the same transaction.
+ // Resolve its live provenance here: a callback may have started before claim.
+ if(pending.approved_by==='setup')return {
+  sql:base.sql+` AND EXISTS(SELECT 1 FROM oa_setup_links l WHERE l.interface=p.interface AND l.attempt_id=p.attempt_id AND l.completed=0 AND l.expires_at>?
+   AND ((l.owner_id IS NULL AND l.owner_version IS NULL AND l.session_id IS NULL AND NOT EXISTS(SELECT 1 FROM oa_operators) AND NOT EXISTS(SELECT 1 FROM oa_bootstrap))
+    OR EXISTS(SELECT 1 FROM oa_bootstrap b JOIN oa_operators o ON o.id=b.claim_id JOIN oa_sessions s ON s.operator_id=o.id
+     WHERE o.id=l.owner_id AND o.role='owner' AND o.status='active' AND o.version=l.owner_version
+     AND s.id=l.session_id AND s.operator_version=l.owner_version AND s.revoked_at IS NULL AND s.expires_at>?
+     AND (s.kind='native' OR (s.kind='oidc' AND EXISTS(
+      SELECT 1 FROM oa_provider_sessions ps
+      JOIN oa_auth_settings a ON a.singleton=1 AND a.idp_sign_in=1 AND a.generation=ps.generation
+      JOIN oa_provider_session_pins pin ON pin.session_id=ps.session_id AND pin.provider_id='auth' AND pin.issuer=ps.issuer
+      JOIN oa_identity_providers provider ON provider.provider_id=pin.provider_id AND provider.status='linked'
+       AND provider.issuer=pin.issuer AND provider.client_id=pin.client_id AND provider.linked_at=pin.linked_at
+      WHERE ps.session_id=s.id)))))))`,args:[...base.args,now,now],
+ };
+ const pin=providerPinFence(pendingPin);
+ return {sql:`${pin.sql} AND ${base.sql} AND p.approved_by=? AND p.approved_session=? AND p.approved_version=? AND EXISTS(SELECT 1 FROM oa_operators o JOIN oa_sessions s ON s.operator_id=o.id WHERE o.id=p.approved_by AND o.version=p.approved_version AND s.id=p.approved_session AND s.operator_version=o.version AND s.revoked_at IS NULL AND s.expires_at>? AND o.status='active' AND o.id=(SELECT a.id FROM oa_operators a LEFT JOIN oa_bootstrap b ON b.claim_id=a.id WHERE a.role='owner' AND a.status='active' ORDER BY b.claim_id IS NULL,a.created_at,a.id LIMIT 1)))`,args:[...pin.args,...base.args,pending.approved_by,pending.approved_session,pending.approved_version,now]};
+}

package/modules/dependencies/auth.mjs

@@ -0,0 +1,40 @@
+import { nativeDependencyAuthority } from './native.mjs';
+import { createIdpOwnerClaimHandler } from '../owner-claim/idp.mjs';
+import { createOidcProviders } from '../operator-auth/identity/oidc/index.mjs';
+import { dependencyStore } from './store.mjs';
+import { backchannelLogout } from './logout.mjs';
+// Resolve the persisted server key at use, so Worker instances never cache a removed link.
+export function linkedProviders(options) {
+ const {db,config,staticProviders,native}=options;
+ if(native)nativeDependencyAuthority(native);
+ if(config.dependencies && (staticProviders?.ids.includes('auth') || staticProviders?.callbackPaths?.['/auth/oidc/auth/callback'])) throw new Error('dependency_provider_conflict');
+ async function current() {
+  if (!config.dependencies) return staticProviders;
+  const store=dependencyStore(db),link=await store.link();
+  if(!link || link.needs_relink) return staticProviders;
+  const row=await store.first("SELECT private_key FROM rer_dependency_keys WHERE interface='oidc-provider@1'");
+  if(!row?.private_key) return null;
+  const unclaimed=native?()=>native.unclaimed():async()=>!await db.prepare('SELECT 1 FROM oa_operators LIMIT 1').first();
+  return createOidcProviders({...options, enabled:async()=>await options.enabled() || await unclaimed(), claim:async(request,token,expectedPin)=>{
+   if(!await unclaimed())return null;
+   if(native)return native.claimOwner?native.claimOwner({request,token,expectedPin}):null;
+   return createIdpOwnerClaimHandler({expectedPin,db,authConfig:config,clientIp:()=>options.clientIp(request),clock:options.clock,fetch:options.fetch})(new Request(config.origin+'/auth/owner-claim',{method:'POST',headers:{Host:new URL(config.origin).host,Origin:config.origin,'Content-Type':'application/json'},body:JSON.stringify({token})}));
+  }, claimScope: unclaimed, config:{origin:config.origin,local:config.local,transactionSecret:config.OIDC_TRANSACTION_SECRET ?? config.SESSION_SECRET+'-oidc',providers:[{
+   id:'auth',preset:'auth',issuer:link.issuer,clientId:link.client_id,privateKey:JSON.parse(row.private_key),
+  }]}});
+ }
+ if(!config.dependencies) return staticProviders;
+ return {
+  ids:[...new Set(['auth',...(staticProviders?.ids??[])])],
+  callbackPaths:{...staticProviders?.callbackPaths,'/auth/oidc/auth/callback':'auth'},
+  async begin(...args){const p=args[1]!=='auth'?staticProviders:await current();return p?p.begin(...args):Response.json({error:'provider_unlinked'},{status:403});},
+  async callback(...args){const p=args[1]!=='auth'?staticProviders:await current();return p?p.callback(...args):Response.json({error:'provider_unlinked'},{status:403});},
+  async logout(request){return backchannelLogout({...options,request});},
+  async list(){const p=await current();return p===staticProviders?(p?.list()??[]):[...await staticProviders?.list()??[],...await p?.list()??[]];},
+  async links(){const p=await current();const links=[...await staticProviders?.links()??[],...(p!==staticProviders?await p?.links()??[]:[])];return [...new Map(links.map(link=>[link.id,link])).values()];},
+  // The Auth dependency is linked and unlinked through its own approval routes;
+  // a static provider keeps its own pin controls.
+  async relink(id){if(id==='auth')throw new Error('Use the dependency link with fresh local owner proof');return staticProviders.relink(id);},
+  async unlink(id){if(id==='auth')throw new Error('Use the dependency unlink with fresh local owner proof');return staticProviders.unlink(id);},
+ };
+}

package/modules/dependencies/authority.mjs

@@ -0,0 +1,14 @@
+import { providerPinFence } from '../operator-auth/accounts/provider-pin.mjs';
+// Repeat local owner authority inside the mutation transaction.
+export function ownerFence(actor, now) {
+ const pin=providerPinFence(actor.providerPin);
+ return {sql:`${pin.sql} AND EXISTS(SELECT 1 FROM oa_sessions s JOIN oa_operators o ON o.id=s.operator_id
+ WHERE s.id=? AND o.id=? AND o.version=? AND s.operator_version=o.version AND s.revoked_at IS NULL AND s.expires_at>?
+ AND o.status='active' AND o.id=(SELECT p.id FROM oa_operators p LEFT JOIN oa_bootstrap b ON b.claim_id=p.id WHERE p.role='owner' AND p.status='active' ORDER BY b.claim_id IS NULL,p.created_at,p.id LIMIT 1))`,args:[...pin.args,actor.id,actor.operator.id,actor.operator.version,now]};
+}
+export function pinStatement(db, clientId, metadata, now) {
+ return db.prepare(`INSERT INTO oa_identity_providers(provider_id,preset,status,issuer,client_id,jwks_uri,authorization_endpoint,token_endpoint,algorithms,token_auth_method,response_iss,interface_version,linked_at)
+ VALUES('auth','auth','linked',?,?,?,?,?,?,'private_key_jwt',?,?,?) ON CONFLICT(provider_id) DO UPDATE SET
+ preset='auth',status='linked',issuer=excluded.issuer,client_id=excluded.client_id,jwks_uri=excluded.jwks_uri,authorization_endpoint=excluded.authorization_endpoint,token_endpoint=excluded.token_endpoint,algorithms=excluded.algorithms,token_auth_method=excluded.token_auth_method,response_iss=excluded.response_iss,interface_version=excluded.interface_version,linked_at=MAX(oa_identity_providers.linked_at+1,excluded.linked_at),pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL,jwks=NULL,jwks_fetched_at=NULL`)
+ .bind(metadata.issuer,clientId,metadata.jwks,metadata.authorization,metadata.token,JSON.stringify(metadata.algorithms),metadata.responseIssuer?1:0,metadata.interfaceVersion,now);
+}

package/modules/dependencies/crypto.mjs

@@ -0,0 +1,13 @@
+const encode = bytes => btoa(String.fromCharCode(...bytes)).replaceAll('+','-').replaceAll('/','_').replace(/=+$/,'');
+const json = value => encode(new TextEncoder().encode(JSON.stringify(value)));
+export async function keyPair() {
+ const pair = await crypto.subtle.generateKey({name:'ECDSA',namedCurve:'P-256'},true,['sign','verify']);
+ return {...await crypto.subtle.exportKey('jwk',pair.privateKey),kid:crypto.randomUUID(),alg:'ES256',use:'sig'};
+}
+export function publicKey(key) { return {kty:key.kty,crv:key.crv,x:key.x,y:key.y,kid:key.kid,alg:'ES256',use:'sig',key_ops:['verify']}; }
+export async function assertion(key, claims) {
+ const encoded = `${json({alg:'ES256',typ:'JWT',kid:key.kid})}.${json(claims)}`;
+ const imported = await crypto.subtle.importKey('jwk',{...key,key_ops:['sign']},{name:'ECDSA',namedCurve:'P-256'},false,['sign']);
+ return `${encoded}.${encode(new Uint8Array(await crypto.subtle.sign({name:'ECDSA',hash:'SHA-256'},imported,new TextEncoder().encode(encoded))))}`;
+}
+export async function digest(value) { return encode(new Uint8Array(await crypto.subtle.digest('SHA-256',new TextEncoder().encode(value)))); }

package/modules/dependencies/index.d.mts

@@ -0,0 +1,23 @@
+import type { Database, OperatorAuth } from '../operator-auth/index.mjs';
+export function createDependencies<R extends string>(options: { db: Database; origin: string; name: string; provider?: string; local?: boolean; auth: OperatorAuth<R>; claimOwner?:(token:string)=>Promise<Response|null>; clock?: () => number; fetch?: typeof fetch; provides?:string[]; interfaces?: {interface:string;optional?:boolean;provider?:string;paths:string[]}[] }): {document():Promise<unknown>;handle(request:Request):Promise<Response|null>};
+export const INTERFACE:string;
+export const CALLBACK:string;
+export const PATHS:string[];
+export interface SqlFence {sql: string; args: unknown[]}
+/** Snapshot captured before provider I/O; equality is repeated by shared code. */
+export interface DependencyApproval {
+  interface: string; issuer: string; callbacks: string; attempt_id: string;
+  approved_by: string; approved_session: string; approved_version: number; expires_at: number;
+}
+export interface NativeDependencyAuthority<R extends string = string> {
+  unclaimed(): Promise<boolean>;
+  ownerFence(actor: import('../operator-auth/index.mjs').Session<R>, now: number): SqlFence | Promise<SqlFence>;
+  /** Repeat native current-owner/session/version/proof and provider policy/pin authority. Shared code fences the exact pending attempt and actor snapshot. */
+  approvalFence(input: {pending: DependencyApproval; contract: string; issuer: string; callbacks: string; now: number}): SqlFence | Promise<SqlFence>;
+  /** Ordinary owner approval must never enable identity from a stale first-setup flag. */
+  linkedStatements(input: {pending: DependencyApproval; contract: string; old: Record<string, unknown> | null; issuer: string; now: number}): import('../operator-auth/index.mjs').Statement[] | Promise<import('../operator-auth/index.mjs').Statement[]>;
+  unlinkStatements(input: {contract: string; actor: import('../operator-auth/index.mjs').Session<R>; now: number}): import('../operator-auth/index.mjs').Statement[] | Promise<import('../operator-auth/index.mjs').Statement[]>;
+  /** Atomic replay claim + pinned link/current binding checks + native session revocation/fence bump. */
+  consumeLogout(input: {claims: Record<string, unknown>; link: Record<string, unknown>; now: number; fence: boolean}): Promise<boolean>;
+  claimOwner?(input: {request: Request; token: string; expectedPin: {id: string; issuer: string; clientId: string; linkedAt: number}}): Promise<Response | null>;
+}

package/modules/dependencies/index.mjs

@@ -0,0 +1,113 @@
+import { nativeDependencyAuthority } from './native.mjs';
+import { approveSetup, approveOwner, approvalFence, callbacksFor } from './approval.mjs';
+import { dependencyStore } from './store.mjs';
+import { publicKey, assertion, digest } from './crypto.mjs';
+import { CALLBACK, INTERFACE, PATHS, NETWORK, insist, originOf, providerMetadata } from './protocol.mjs';
+import { readJson } from '../operator-auth/identity/oidc/network.mjs';
+import { readInput } from '../operator-auth/input.mjs';
+import { ownerFence, pinStatement } from './authority.mjs';
+export { INTERFACE, CALLBACK, PATHS } from './protocol.mjs';
+export function createDependencies({db,origin,name,provider,interfaces=[{interface:INTERFACE,provider,paths:PATHS}],provides=[],local=false,auth,claimOwner,clock=Date.now,fetch:fetcher=globalThis.fetch}) {
+ originOf(origin,local);insist(Array.isArray(provides) && new Set(provides).size===provides.length && provides.every(value=>/^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(value)));
+ insist(Array.isArray(interfaces) && new Set(interfaces.map(d=>d.interface)).size===interfaces.length && interfaces.every(d=>/^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(d.interface) && Array.isArray(d.paths) && new Set(d.paths).size===d.paths.length && d.paths.every(p=>typeof p==='string' && /^\/[A-Za-z0-9_~/-]+$/.test(p) && !p.startsWith('//'))));
+ const store=dependencyStore(db);
+ const native=auth?.native?nativeDependencyAuthority(auth.accounts.dependencies):null;
+ async function owner(request,action) {
+  const actor=await auth.requireStepUp(request,action), current=await auth.accounts.owner();
+  insist(actor.operator.id===current?.id,'owner_required',403);return actor;
+ }
+ async function document() {
+  const installation=await store.installation(interfaces[0]?.interface??INTERFACE);
+  const linked=await Promise.all(interfaces.map(d=>store.link(d.interface)));
+  return {name,version:1,origin,sector_id:installation.sector_id,dependencies:interfaces.map((d,i)=>({provider:linked[i]?.issuer??d.provider??null,interface:d.interface,optional:d.optional??true,cardinality:1,paths:d.paths.map(p=>origin+p),jwks_uri:origin+'/.well-known/rer-link/jwks/'+d.interface})),provides,
+   claim:interfaces.some(d=>d.interface===INTERFACE) && (native?await native.unclaimed():!await db.prepare('SELECT 1 FROM oa_operators LIMIT 1').first()),callback:origin+CALLBACK,jwks_uri:origin+'/.well-known/rer-link/jwks'};
+ }
+ async function callback(request) {
+  const data=await readInput(request);
+  insist(Object.keys(data).every(k=>['issuer','code','interface'].includes(k)) && typeof data.code==='string' && data.code.length>0 && data.code.length<=4096);
+  const contract=data.interface??INTERFACE,declared=interfaces.find(d=>d.interface===contract);insist(declared,'undeclared_interface',403);
+  const old=await store.link(contract),pending=await store.first('SELECT * FROM rer_dependency_pending WHERE interface=?',contract);
+  const callbacks=callbacksFor(origin,declared);
+  insist(pending?.attempt_id && pending.expires_at>clock() && pending.callbacks===callbacks,'local_owner_proof_required',403);
+  const expected=pending.issuer;
+  insist(data.issuer===expected,'untrusted_link_issuer',403);
+  const pendingPin=native?null:await store.first('SELECT provider_id AS id,issuer,client_id AS clientId,linked_at AS linkedAt FROM oa_provider_session_pins WHERE session_id=?',pending.approved_session);
+  const initialApproval=await approvalFence(pending,contract,expected,callbacks,clock(),pendingPin,native);
+  insist(await store.first(`SELECT 1 WHERE ${initialApproval.sql}`,...initialApproval.args),'local_owner_proof_required',403);
+  const metadata=await providerMetadata(expected,fetcher,contract),installation=await store.installation(contract);
+  const codeDigest=await digest(expected+'\0'+data.code);
+  const consumed=await store.run('INSERT INTO rer_dependency_codes(digest,created_at) VALUES(?,?) ON CONFLICT DO NOTHING',codeDigest,clock());
+  insist(consumed.meta.changes===1,'link_code_used',409);
+  const now=Math.floor(clock()/1000), proof=await assertion(installation.key,{iss:origin,sub:origin,aud:metadata.link.redeem,iat:now,exp:now+60,jti:crypto.randomUUID(),code:data.code,interface:contract,sector_id:installation.sector_id,callback:origin+CALLBACK});
+  const result=await readJson(fetcher,metadata.link.redeem,NETWORK,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({code:data.code,interface:contract,origin,callback:origin+CALLBACK,client_assertion_type:'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',client_assertion:proof})});
+  insist(result.issuer===expected && result.interface===contract && result.sector_id===installation.sector_id && result.origin===origin && result.callback===origin+CALLBACK && typeof result.client_id==='string' && result.client_id.length>0 && result.client_id.length<=512,'invalid_link_grant',403);
+  if(old && old.issuer===expected) insist(result.client_id===old.client_id && ['previous-key','provider-owner'].includes(result.continuity),'link_continuity_required',403);
+  // A provider move never edits identity bindings. Only a new, proven-email sign-in
+  // can establish a binding at the new issuer; existing principals remain immutable.
+  const unchanged=old?{sql:'EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface=? AND issuer=? AND client_id=? AND metadata=? AND needs_relink=? AND linked_at=?)',args:[contract,old.issuer,old.client_id,JSON.stringify(old.metadata),old.needs_relink,old.linked_at]}:{sql:'NOT EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface=?)',args:[contract]};
+  const approval=await approvalFence(pending,contract,expected,callbacks,clock(),pendingPin,native);
+  await db.batch([
+   db.prepare(`UPDATE rer_dependency_codes SET created_at=CASE WHEN EXISTS(SELECT 1 FROM rer_dependency_keys WHERE interface=? AND json_extract(private_key,'$.kid')=?) AND ${unchanged.sql} AND ${approval.sql} THEN created_at ELSE -1 END WHERE digest=?`).bind(contract,installation.key.kid,...unchanged.args,...approval.args,codeDigest),
+   db.prepare(`INSERT INTO rer_dependency_link(interface,issuer,client_id,metadata,needs_relink,linked_at) VALUES(?,?,?,?,0,?) ON CONFLICT(interface) DO UPDATE SET issuer=excluded.issuer,client_id=excluded.client_id,metadata=excluded.metadata,needs_relink=0,linked_at=MAX(rer_dependency_link.linked_at+1,excluded.linked_at)`).bind(contract,expected,result.client_id,JSON.stringify(metadata),clock()),
+   ...(native?await native.linkedStatements({pending,contract,old,issuer:expected,now:clock()}):[
+   ...(contract===INTERFACE?[db.prepare("INSERT INTO oa_auth_audit(id,actor_id,action,value,created_at) SELECT ?,claim_id,'idpSignIn','true',? FROM oa_bootstrap WHERE EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND first_setup=1 AND idp_sign_in=0) AND EXISTS(SELECT 1 FROM oa_setup_links WHERE interface='oidc-provider@1' AND attempt_id=? AND completed=0 AND owner_id=claim_id)").bind(crypto.randomUUID(),clock(),pending.attempt_id)]:[]),
+   ...(contract===INTERFACE?[db.prepare("UPDATE oa_auth_settings SET idp_sign_in=CASE WHEN first_setup=1 AND EXISTS(SELECT 1 FROM oa_setup_links WHERE interface='oidc-provider@1' AND attempt_id=? AND completed=0 AND owner_id=(SELECT claim_id FROM oa_bootstrap)) THEN 1 ELSE idp_sign_in END,first_setup=0 WHERE singleton=1").bind(pending.attempt_id)]:[]),
+   db.prepare('UPDATE oa_setup_links SET completed=1 WHERE interface=? AND attempt_id=?').bind(contract,pending.attempt_id),
+   ]),
+   db.prepare('DELETE FROM rer_dependency_pending WHERE interface=?').bind(contract),
+   ...(contract===INTERFACE?[pinStatement(db,result.client_id,metadata,clock())]:[]),
+   ...(!native && contract===INTERFACE && old?[db.prepare("UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id IN (SELECT p.session_id FROM oa_provider_sessions p LEFT JOIN oa_provider_session_pins pin ON pin.session_id=p.session_id WHERE pin.provider_id='auth' OR (p.issuer=? AND (? OR pin.session_id IS NULL)))").bind(clock(),old.issuer,old.issuer!==expected?1:0)]:[]),
+   ...(!native && contract===INTERFACE && old && old.issuer!==expected?[db.prepare("DELETE FROM oa_domain_rules WHERE provider_id='auth'")]:[]),
+  ]);
+  if(result.install_owner!==undefined) {
+   insist(contract===INTERFACE && typeof result.install_owner==='string' && typeof claimOwner==='function','owner_claim_unavailable',403);
+   const claimed=await claimOwner(result.install_owner);
+   if(claimed?.status!==303){const detail=await claimed?.json().catch(()=>null);insist(false,typeof detail?.error==='string' && /^[a-z_]+$/.test(detail.error)?detail.error:'owner_claim_refused',claimed?.status??403);}
+  }
+  return Response.json({linked:true,interface:contract});
+ }
+ async function unlink(request) {
+  const actor=await owner(request,'providers:unlink'),input=await readInput(request),contract=input.interface??INTERFACE,link=await store.link(contract);
+  insist(interfaces.some(d=>d.interface===contract));
+  const key=await store.first('SELECT private_key FROM rer_dependency_keys WHERE interface=?',contract),fence=native?await native.ownerFence(actor,clock()):ownerFence(actor,clock()),guard=crypto.randomUUID();
+  await db.batch([
+   db.prepare(`INSERT INTO rer_dependency_codes(digest,created_at) SELECT ?,CASE WHEN ${fence.sql} THEN ? ELSE -1 END`).bind(guard,...fence.args,clock()),
+   db.prepare('DELETE FROM rer_dependency_keys WHERE interface=?').bind(contract),
+   ...(native?await native.unlinkStatements({contract,actor,now:clock()}):[
+   ...(contract===INTERFACE?[db.prepare("UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id IN (SELECT p.session_id FROM oa_provider_sessions p LEFT JOIN oa_provider_session_pins pin ON pin.session_id=p.session_id WHERE pin.provider_id='auth' OR p.issuer=(SELECT issuer FROM rer_dependency_link WHERE interface=?))").bind(clock(),contract)]:[]),
+   ...(contract===INTERFACE?[db.prepare("DELETE FROM oa_domain_rules WHERE provider_id='auth'")]:[]),
+   ]),
+   ...(contract===INTERFACE?[db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id='auth'")]:[]),
+   db.prepare('DELETE FROM rer_dependency_pending WHERE interface=?').bind(contract),
+   db.prepare('DELETE FROM rer_dependency_link WHERE interface=?').bind(contract),
+   ...(!native?[db.prepare('DELETE FROM oa_setup_links WHERE interface=?').bind(contract),
+   db.prepare("INSERT INTO oa_auth_audit VALUES(?,?,'provider:unlink',?,?)").bind(crypto.randomUUID(),actor.operator.id,contract,clock())]:[]),
+  ]);
+  // Local removal is already complete. The provider may be offline.
+  if(link && key) {try {await readJson(fetcher,link.metadata.link.deregister,NETWORK,{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({client_id:link.client_id,origin,interface:contract,client_assertion_type:'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',client_assertion:await assertion(JSON.parse(key.private_key),{iss:link.client_id,sub:link.client_id,aud:link.metadata.link.deregister,iat:Math.floor(clock()/1000),exp:Math.floor(clock()/1000)+60,jti:crypto.randomUUID()})})});}catch{}}
+  return Response.json({unlinked:true});
+ }
+ return {document,async handle(request) {
+  const u=new URL(request.url),path=u.pathname;
+  const jwksContract=path.startsWith('/.well-known/rer-link/jwks/')?path.slice('/.well-known/rer-link/jwks/'.length):null;
+  if(!jwksContract && !['/.well-known/rer-dependencies','/.well-known/rer-link/jwks',CALLBACK,'/auth/dependencies/relink','/auth/dependencies/setup','/auth/dependencies/unlink','/auth/dependencies/status'].includes(path))return null;
+  try {
+   insist(u.origin===origin && (!request.headers.has('host') || request.headers.get('host')===u.host) && !u.search && !u.hash,'invalid_link_origin',403);
+   if(path==='/.well-known/rer-dependencies' && request.method==='GET')return Response.json(await document());
+   if((path==='/.well-known/rer-link/jwks' || jwksContract) && request.method==='GET') {const contract=jwksContract??interfaces[0]?.interface??INTERFACE;insist(interfaces.some(d=>d.interface===contract));return Response.json({keys:[publicKey((await store.installation(contract)).key)]});}
+   if(path==='/auth/dependencies/status' && request.method==='GET') {const link=await store.link(),links=(await db.prepare('SELECT interface,issuer,needs_relink FROM rer_dependency_link').all()).results;return Response.json({linked:!!link && !link.needs_relink,needsRelink:!!link?.needs_relink,links:links.map(r=>({interface:r.interface,issuer:r.issuer,linked:!r.needs_relink}))});}
+   insist(request.method==='POST','method_not_allowed',405);
+   if(path===CALLBACK)return await callback(request);
+   insist(request.headers.get('origin')===origin,'invalid_link_origin',403);
+   if(path==='/auth/dependencies/unlink')return await unlink(request);
+   if(path==='/auth/dependencies/relink' || path==='/auth/dependencies/setup') {
+    const input=await readInput(request),contract=input.interface??INTERFACE;originOf(input.issuer);const declared=interfaces.find(d=>d.interface===contract);insist(declared);
+    const callbacks=callbacksFor(origin,declared);
+    if(path==='/auth/dependencies/setup') await approveSetup({db,auth,request,input,contract,callbacks,clock});
+    else await approveOwner({store,actor:await owner(request,'providers:relink'),input,contract,callbacks,clock,native});
+    return Response.json({pending:true});
+   }
+   insist(false,'not_found',404);
+  }catch(e){return Response.json({error:e.code??'link_unavailable'},{status:e.status??503});}
+ }};
+}

package/modules/dependencies/logout.mjs

@@ -0,0 +1,42 @@
+import { dependencyStore } from './store.mjs';
+import { parseIdToken, verifySignature } from '../operator-auth/identity/oidc/jwt.mjs';
+import { readJson } from '../operator-auth/identity/oidc/network.mjs';
+import { readInput } from '../operator-auth/input.mjs';
+import { insist, NETWORK } from './protocol.mjs';
+export const LOGOUT_EVENT='http://schemas.openid.net/event/backchannel-logout';
+export const FENCE_EVENT='https://runeditrun.com/events/identity-fence';
+export async function backchannelLogout({db,config,request,clock=Date.now,fetch:fetcher=globalThis.fetch,native}) {
+ try {
+  const url=new URL(request.url);
+  insist(url.origin===config.origin && url.pathname==='/auth/oidc/auth/logout' && !url.search && request.method==='POST');
+  const data=await readInput(request);insist(typeof data.logout_token==='string');
+  const link=await dependencyStore(db).link();insist(link && !link.needs_relink,'provider_unlinked',403);
+  const pin={issuer:link.issuer,clientId:link.client_id,algorithms:link.metadata.algorithms};
+  const parsed=parseIdToken(data.logout_token,pin, 'logout+jwt'),c=parsed.claims;
+  await verifySignature(parsed,await readJson(fetcher,link.metadata.jwks,NETWORK));
+  const now=clock()/1000;
+  insist(c.iss===pin.issuer && (c.aud===pin.clientId || Array.isArray(c.aud) && c.aud.length===1 && c.aud[0]===pin.clientId));
+  insist(Number.isSafeInteger(c.iat) && c.iat<=now+30 && c.iat>=now-86400 && Number.isSafeInteger(c.exp) && c.exp>now && c.exp>c.iat && c.exp-c.iat<=86400);
+  insist(c.nbf===undefined || Number.isSafeInteger(c.nbf) && c.nbf<=now+30);
+  insist(!Object.hasOwn(c,'nonce') && typeof c.jti==='string' && c.jti.trim().length>0 && c.jti.length<=256);
+  insist(c.events && typeof c.events==='object' && !Array.isArray(c.events));
+  const events=Object.keys(c.events);insist(events.length>0 && events.every(k=>[LOGOUT_EVENT,FENCE_EVENT].includes(k) && c.events[k] && typeof c.events[k]==='object' && !Array.isArray(c.events[k]) && Object.keys(c.events[k]).length===0));
+  for(const key of ['sub','sid']) if(Object.hasOwn(c,key)) insist(typeof c[key]==='string' && c[key].length>0 && c[key].length<=255);
+  insist(c.sub || c.sid);
+  if(native) {
+   const consumed=await native.consumeLogout({claims:c,link,now:clock(),fence:events.includes(FENCE_EVENT)});
+   insist(consumed,'logout_already_used',409);
+   return new Response(null,{status:204});
+  }
+  const rows=(await db.prepare('SELECT DISTINCT subject FROM oa_provider_sessions WHERE issuer=? AND (? IS NULL OR sid=?)').bind(c.iss,c.sid??null,c.sid??null).all()).results;
+  if(c.sid) insist(rows.length>0 && (!c.sub || rows.every(r=>r.subject===c.sub)));
+  const subject=c.sub??(rows.length===1?rows[0].subject:null);insist(subject);
+  const person=await db.prepare('SELECT operator_id FROM oa_external_identities WHERE issuer=? AND subject=?').bind(c.iss,subject).first();insist(person);
+  const statements=[db.prepare(`INSERT INTO oa_logout_events(issuer,jti,consumed_at) VALUES(?,?,CASE WHEN EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface='oidc-provider@1' AND issuer=? AND client_id=? AND metadata=? AND needs_relink=0 AND linked_at=?) AND EXISTS(SELECT 1 FROM oa_external_identities WHERE issuer=? AND subject=? AND operator_id=?) THEN ? ELSE -1 END)`).bind(c.iss,c.jti,link.issuer,link.client_id,JSON.stringify(link.metadata),link.linked_at,c.iss,subject,person.operator_id,clock())];
+  if(events.includes(FENCE_EVENT)) statements.push(db.prepare('UPDATE oa_operators SET version=version+1 WHERE id=?').bind(person.operator_id));
+  statements.push(db.prepare(`UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id IN
+   (SELECT session_id FROM oa_provider_sessions WHERE issuer=? AND subject=? AND (? IS NULL OR sid=?))`).bind(clock(),c.iss,subject,c.sid??null,c.sid??null));
+  try { await db.batch(statements); } catch { insist(false,'logout_already_used',409); }
+  return new Response(null,{status:204});
+ } catch(error) { return Response.json({error:error.code??'invalid_logout'},{status:error.status??400}); }
+}

package/modules/dependencies/native.mjs

@@ -0,0 +1,9 @@
+import { AuthError } from '../operator-auth/errors.mjs';
+// These are D1 transaction fragments, not a second linking protocol. Each
+// fragment uses only the adopter's tenant/account/session tables. The common
+// protocol adds key/link/code/pin guards and commits everything in one batch.
+export function nativeDependencyAuthority(value) {
+  const methods = ['unclaimed', 'ownerFence', 'approvalFence', 'linkedStatements', 'unlinkStatements', 'consumeLogout'];
+  if (!value || typeof value !== 'object' || methods.some(k => typeof value[k] !== 'function') || value.claimOwner !== undefined && typeof value.claimOwner !== 'function') throw new AuthError('native_dependency_capability_required', 503);
+  return value;
+}

package/modules/dependencies/protocol.mjs

@@ -0,0 +1,23 @@
+import { readJson, discover } from '../operator-auth/identity/oidc/network.mjs';
+import { PRESETS, MINIMUM_PROVIDER_VERSION } from '../operator-auth/identity/oidc/presets.mjs';
+export const INTERFACE = 'oidc-provider@1';
+export const CALLBACK = '/.well-known/rer-link/callback';
+export const PATHS = ['/auth/oidc/auth/callback','/auth/oidc/auth/logout'];
+export const NETWORK = { timeoutMs:5000 };
+export function insist(value, code = 'invalid_link', status = 400) { if (!value) throw Object.assign(new Error(code),{code,status}); }
+export function originOf(value, local = false) {
+ let u;try { u=new URL(value); } catch { insist(false); }
+ insist(u.origin===value && !u.username && !u.password && (u.protocol==='https:' || local && u.protocol==='http:' && ['localhost','127.0.0.1','[::1]'].includes(u.hostname)));
+ return u.origin;
+}
+export async function providerMetadata(issuer, fetcher, contract = INTERFACE) {
+ originOf(issuer);
+ const p={...PRESETS.auth,id:'auth',issuer,endpointOrigins:[issuer],tokenAuthMethod:'private_key_jwt',keyAlgorithm:'ES256',minimumVersion:MINIMUM_PROVIDER_VERSION};
+ const oidc=contract===INTERFACE?await discover(fetcher,p,NETWORK):{};
+ const link=await readJson(fetcher,`${issuer}/.well-known/rer-provider`,NETWORK);
+ insist(link.issuer===issuer && (link.interface===contract || Array.isArray(link.provides) && new Set(link.provides).size===link.provides.length && link.provides.every(i=>typeof i==='string' && /^[a-z][a-z0-9-]*@[1-9][0-9]*$/.test(i)) && link.provides.includes(contract)) && link.version===1,'unsupported_link_interface',502);
+ for (const name of ['initiate','redeem','deregister']) {
+  const u=new URL(link[name]);insist(u.origin===issuer && u.protocol==='https:' && !u.search && !u.hash && !u.username && !u.password,'untrusted_link_endpoint',502);
+ }
+ return {...oidc,link};
+}

package/modules/dependencies/schema/approval-attempt.sql

@@ -0,0 +1,3 @@
+-- Existing pending approvals predate attempt fencing and must be renewed.
+ALTER TABLE rer_dependency_pending ADD COLUMN attempt_id TEXT;
+DELETE FROM rer_dependency_pending;

package/modules/dependencies/schema/dependencies.sql

@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS rer_dependency_installation (
+ singleton INTEGER PRIMARY KEY CHECK(singleton=1), sector_id TEXT NOT NULL UNIQUE
+);
+CREATE TABLE IF NOT EXISTS rer_dependency_link (
+ interface TEXT PRIMARY KEY, issuer TEXT NOT NULL, client_id TEXT NOT NULL, metadata TEXT NOT NULL,
+ needs_relink INTEGER NOT NULL DEFAULT 0, linked_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS rer_dependency_pending (
+ interface TEXT PRIMARY KEY, issuer TEXT NOT NULL, approved_by TEXT NOT NULL, expires_at INTEGER NOT NULL, approved_session TEXT NOT NULL, approved_version INTEGER NOT NULL, callbacks TEXT NOT NULL
+);
+CREATE TABLE IF NOT EXISTS rer_dependency_codes (
+ digest TEXT PRIMARY KEY, created_at INTEGER NOT NULL CHECK(created_at>=0)
+);
+
+CREATE TABLE IF NOT EXISTS rer_dependency_keys (interface TEXT PRIMARY KEY, private_key TEXT NOT NULL);

package/modules/dependencies/store.mjs

@@ -0,0 +1,19 @@
+import { keyPair } from './crypto.mjs';
+export function dependencyStore(db) {
+ const first=(sql,...args)=>db.prepare(sql).bind(...args).first();
+ const run=(sql,...args)=>db.prepare(sql).bind(...args).run();
+ return {
+  first,run,
+  async installation(contract = 'oidc-provider@1') {
+   await run('INSERT INTO rer_dependency_installation(singleton,sector_id) VALUES(1,?) ON CONFLICT DO NOTHING',crypto.randomUUID());
+   const row=await first('SELECT * FROM rer_dependency_installation WHERE singleton=1');
+   let key=await first('SELECT private_key FROM rer_dependency_keys WHERE interface=?',contract);
+   if(!key) {
+    await run('INSERT INTO rer_dependency_keys(interface,private_key) VALUES(?,?) ON CONFLICT DO NOTHING',contract,JSON.stringify(await keyPair()));
+    key=await first('SELECT private_key FROM rer_dependency_keys WHERE interface=?',contract);
+   }
+   return {...row,key:JSON.parse(key.private_key)};
+  },
+  async link(contract = 'oidc-provider@1') { const row=await first("SELECT * FROM rer_dependency_link WHERE interface=?",contract);return row?{...row,metadata:JSON.parse(row.metadata)}:null; },
+ };
+}