@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/operator-auth/accounts/admin.mjs

@@ -0,0 +1,159 @@
+import { AuthError, deny } from '../errors.mjs';
+import { normalizeEmail, safeReturnTo } from '../policy.mjs';
+import { requirePost } from '../http.mjs';
+import { operatorColumns } from './store.mjs';
+import { DEFAULT_ROLES, emailAllowed } from './roles.mjs';
+const DOMAIN = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,61}[a-z0-9]$/;
+export function administration(context) {
+  const { config, store, clock, authorize, authenticate, newToken, sendLink, limit, requireFreshProof, providers } = context;
+  async function actorFor(request, action, target, role, mutation = true) {
+    if (mutation) requirePost(request, config);
+    const actor = await authenticate(request);
+    if (!actor) deny('unauthenticated', 401);
+    if (!await authorize({ actor: actor.operator, action, target, role })) deny();
+    // Every administrative owner-authority write passes this shared guard,
+    // including pending grants and removal by invitation cancellation.
+    const unchanged = (action === 'operators:role' && role === target?.role)
+      || (action === 'operators:deactivate' && target?.status === 'inactive')
+      || (action === 'operators:reactivate' && target?.status === 'active');
+    if (mutation && action.startsWith('operators:')
+      && !unchanged
+      && (role === 'owner' || target?.role === 'owner')) await requireFreshProof(actor);
+    return actor;
+  }
+  async function targetFor(id) {
+    const target = typeof id === 'string' ? await store.operator(id) : null;
+    if (!target) deny('operator_not_found', 404);
+    return target;
+  }
+  return {
+    async invite(request, input) {
+      const role = input.role ?? 'member';
+      if (!DEFAULT_ROLES.includes(role)) throw new AuthError('invalid_role');
+      const actor = await actorFor(request, 'operators:invite', undefined, role);
+      const email = normalizeEmail(input.email);
+      await limit(request, email, 'invite');
+      if (!emailAllowed(email, config.allowList)) deny('email_not_allowed');
+      const existing = await store.byEmail(email);
+      const reinviting = existing?.status === 'inactive' && !!await store.cancellation(existing.id);
+      if (existing && (existing.role !== role || (!reinviting && existing.status !== 'invited'))) deny('invitation_conflict', 409);
+      const now = clock();
+      const token = await newToken('invite', safeReturnTo(input.returnTo));
+      const created = await store.invite({ operatorId: existing?.id ?? crypto.randomUUID(), expectedVersion: existing?.version ?? 1, reinviting, email, displayName: displayName(input.displayName), role, token, now }, actor);
+      if (!created) deny('invitation_conflict', 409);
+      await sendLink(email, token);
+      return { status: 'accepted' };
+    },
+    async listOperators(request) {
+      const actor = await actorFor(request, 'operators:list', undefined, undefined, false);
+      const fence = store.actorFence(actor, clock());
+      const rows = await store.statement(`SELECT ${operatorColumns} FROM oa_operators WHERE ${fence.sql} ORDER BY created_at,id`, fence.args).all();
+      return rows.results;
+    },
+    async cancelInvitation(request, operatorId) {
+      const target = await targetFor(operatorId);
+      const actor = await actorFor(request, 'operators:deactivate', target);
+      if (target.status !== 'invited') deny('invitation_conflict', 409);
+      const fence = store.actorFence(actor, clock());
+      // The guarded write and version trigger are one transaction: cancellation
+      // invalidates every outstanding link and cannot deactivate a raced join.
+      // Read the ledger to fail closed if its migration is missing. A previous
+      // cancellation remains guarded throughout reinvitation; cancelling again
+      // refreshes that marker through the existing database trigger.
+      await store.cancellation(target.id);
+      const result = await store.run(`UPDATE oa_operators SET status='inactive' WHERE id=? AND status='invited' AND version=?
+        AND ${fence.sql}`,
+        [target.id, target.version, ...fence.args]);
+      if (result.meta.changes < 1) deny('authority_changed', 409);
+      return store.operator(target.id);
+    },
+    async setOperatorStatus(request, operatorId, status) {
+      if (status !== 'active' && status !== 'inactive') throw new AuthError('invalid_status');
+      const target = await targetFor(operatorId);
+      const actor = await actorFor(request, status === 'active' ? 'operators:reactivate' : 'operators:deactivate', target);
+      if (target.status === 'invited') deny('invitation_required', 409);
+      const fence = store.actorFence(actor, clock());
+      try {
+        const result = await store.run(`UPDATE oa_operators SET status=? WHERE id=? AND version=? AND ${fence.sql}`, [status, target.id, target.version, ...fence.args]);
+        if (result.meta.changes < 1) deny('authority_changed', 409);
+      } catch (e) {
+        if (String(e).includes('last_owner')) deny('last_owner', 409);
+        if (String(e).includes('invitation_required')) deny('invitation_required', 409);
+        throw e;
+      }
+      return store.operator(target.id);
+    },
+    async setRole(request, operatorId, role) {
+      if (!DEFAULT_ROLES.includes(role)) throw new AuthError('invalid_role');
+      const target = await targetFor(operatorId);
+      const actor = await actorFor(request, 'operators:role', target, role);
+      const fence = store.actorFence(actor, clock());
+      try {
+        const result = await store.run(`UPDATE oa_operators SET role=? WHERE id=? AND version=? AND ${fence.sql}`, [role, target.id, target.version, ...fence.args]);
+        if (result.meta.changes < 1) deny('authority_changed', 409);
+      } catch (e) { if (String(e).includes('last_owner')) deny('last_owner', 409); throw e; }
+      return store.operator(target.id);
+    },
+    async listSessions(request, operatorId) {
+      const current = await authenticate(request);
+      if (!current) deny('unauthenticated', 401);
+      const target = await targetFor(operatorId ?? current.operator.id);
+      const actor = await actorFor(request, 'sessions:list', target, undefined, false);
+      const now = clock();
+      const fence = store.actorFence(actor, now);
+      const rows = await store.statement(`SELECT s.id,s.kind,s.created_at AS createdAt,s.expires_at AS expiresAt,
+        CASE WHEN s.revoked_at IS NOT NULL OR s.operator_version!=o.version OR o.status!='active' OR s.expires_at<=? THEN 0 ELSE 1 END AS active
+        FROM oa_sessions s JOIN oa_operators o ON o.id=s.operator_id WHERE s.operator_id=? AND o.version=? AND ${fence.sql} ORDER BY s.created_at DESC,s.id`, [now, target.id, target.version, ...fence.args]).all();
+      return rows.results.map((r) => ({ ...r, active: !!r.active }));
+    },
+    async revokeSession(request, sessionId) {
+      const row = await store.first('SELECT operator_id AS operatorId FROM oa_sessions WHERE id=?', [sessionId]);
+      if (!row) deny('session_not_found', 404);
+      const target = await targetFor(row.operatorId);
+      const actor = await actorFor(request, 'sessions:revoke', target);
+      const now = clock();
+      const fence = store.actorFence(actor, now);
+      const result = await store.run(`UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id=? AND EXISTS(SELECT 1 FROM oa_operators WHERE id=? AND version=?) AND ${fence.sql}`, [now, sessionId, target.id, target.version, ...fence.args]);
+      if (result.meta.changes < 1) deny('authority_changed', 409);
+    },
+    async listDomainRules(request) {
+      await actorFor(request, 'domains:manage', undefined, undefined, false);
+      return store.domainRules();
+    },
+    // An owner requires a provider for an email domain, or lifts the rule (provider null).
+    async setDomainRule(request, input) {
+      const actor = await actorFor(request, 'domains:manage');
+      const domain = typeof input?.domain === 'string' ? input.domain.trim().toLowerCase() : '';
+      if (!DOMAIN.test(domain)) throw new AuthError('invalid_domain');
+      const providerId = input.provider ?? null;
+      if (providerId !== null && !providers?.ids.includes(providerId)) throw new AuthError('unknown_provider');
+      await requireFreshProof(actor);
+      await store.setDomainRule({ domain, providerId, now: clock() }, actor);
+      return store.domainRules();
+    },
+    async listProviders(request) {
+      await actorFor(request, 'providers:manage', undefined, undefined, false);
+      return providers ? providers.links() : [];
+    },
+    async unlinkProvider(request, input) {
+      const actor = await actorFor(request, 'providers:manage');
+      if (!providers?.ids.includes(input?.provider)) throw new AuthError('unknown_provider');
+      await requireFreshProof(actor);
+      await providers.unlink(input.provider);
+      // A rule naming a provider that is gone would lock its domain out.
+      await store.liftDomainRules(input.provider);
+      return providers.links();
+    },
+    async relinkProvider(request, input) {
+      const actor = await actorFor(request, 'providers:manage');
+      if (!providers?.ids.includes(input?.provider)) throw new AuthError('unknown_provider');
+      await requireFreshProof(actor);
+      await providers.relink(input.provider);
+      return providers.links();
+    },
+  };
+}
+export function displayName(value) {
+  if (typeof value !== 'string' || !value.trim() || value.length > 120 || /[\x00-\x1f]/.test(value)) throw new AuthError('invalid_display_name');
+  return value.trim();
+}

package/modules/operator-auth/accounts/credentials.mjs

@@ -0,0 +1,27 @@
+import { devAdmitted } from '../dev-admission.mjs';
+import { opaqueToken } from '../crypto.mjs';
+import { requirePost } from '../http.mjs';
+import { deny } from '../errors.mjs';
+// A product may expose mintCredential after selecting its scopes. Every use
+// resolves the current person fence; older credentials with no fence refuse.
+export function fencedCredentials({store,authenticate,requireFreshProof,config,clock,hash}) {
+ return {
+  async mintCredential(request,{expiresInSeconds=86400}={}) {
+   requirePost(request,config);const actor=await authenticate(request);if(!actor)deny('unauthenticated',401);
+   await requireFreshProof(actor);
+   if(!Number.isSafeInteger(expiresInSeconds)||expiresInSeconds<1||expiresInSeconds>365*86400)deny('invalid_input');
+   const token=opaqueToken(),id=crypto.randomUUID(),fence=store.actorFence(actor,clock());
+   const inserted=await store.run(`INSERT INTO oa_credentials(id,token_hash,operator_id,operator_version,kind,expires_at) SELECT ?,?,?,?,?,? WHERE ${fence.sql}`,
+    [id,await hash('credential',token),actor.operator.id,actor.operator.version,actor.kind,clock()+expiresInSeconds*1000,...fence.args]);
+   if(inserted.meta.changes!==1)deny('authority_changed',409);
+   return {id,token,expiresAt:clock()+expiresInSeconds*1000};
+  },
+  async authenticateCredential(request) {
+   const match=/^Bearer ([A-Za-z0-9_-]{40,100})$/.exec(request.headers.get('authorization')??'');if(!match)return null;
+   const row=await store.first(`SELECT c.id,c.operator_id AS personId,c.operator_version AS fence,c.kind,o.status,o.version
+    FROM oa_credentials c JOIN oa_operators o ON o.id=c.operator_id WHERE c.token_hash=? AND c.expires_at>? AND c.revoked_at IS NULL`,[await hash('credential',match[1]),clock()]);
+   if(!row || !Number.isSafeInteger(row.fence) || row.fence!==row.version || row.status!=='active' || row.kind==='dev' && !await devAdmitted(request))return null;
+   return {id:row.id,personId:row.personId,fence:row.fence,kind:row.kind};
+  },
+ };
+}

package/modules/operator-auth/accounts/editor-owner.mjs

@@ -0,0 +1,13 @@
+import { deny } from '../errors.mjs';
+// Product adapters keep their own tables. The editor checks the current install
+// owner and, for OIDC, the owner's current principal at this exact issuer.
+export async function requireEditorOwner({request,getSession,accounts}) {
+ const session=await getSession(request),owner=await accounts.owner();
+ const personId=session?.operator?.id??session?.personId;
+ if(!session || !owner || owner.status!=='active' || personId!==owner.id)deny('owner_required',403);
+ if(session.kind==='oidc') {
+  if(!session.issuer || !session.subject || typeof accounts.currentBoundSubject!=='function' ||
+   await accounts.currentBoundSubject({personId:owner.id,issuer:session.issuer})!==session.subject)deny('owner_subject_required',403);
+ }
+ return session;
+}

package/modules/operator-auth/accounts/index.d.mts

@@ -0,0 +1,9 @@
+import type { AccountsAdapter, Action, Operator, PolicyInput, Role } from '../index.mjs';
+export function accountsAdapter<T extends AccountsAdapter<string>>(adapter: T): T;
+export const DEFAULT_ROLES: readonly Role[];
+export const ACTIONS: readonly Action[];
+export function defaultRolePolicy(input: PolicyInput): boolean;
+export function isActiveOperator(operator: Operator | null | undefined, allowList?: string[]): boolean;
+export function emailAllowed(email: string, allowList?: string[]): boolean;
+
+export function requireEditorOwner<R extends string>(options:{request:Request;getSession:(request:Request)=>Promise<import('../index.mjs').Session<R>|null>;accounts:import('../index.mjs').AccountsAdapter<R>}):Promise<import('../index.mjs').Session<R>>;

package/modules/operator-auth/accounts/index.mjs

@@ -0,0 +1,9 @@
+// Accounts: who a person is in this app and what they may do. Base's own
+// implementation is the oa_ store; a seed with its own tables implements the
+// accounts adapter interface instead (./adapter.mjs).
+export { accountsAdapter } from './adapter.mjs';
+export { createOaAccounts, oaSessions } from './oa.mjs';
+export { AuthStore } from './store.mjs';
+export { DEFAULT_ROLES, ACTIONS, defaultRolePolicy, isActiveOperator, emailAllowed } from './roles.mjs';
+
+export { requireEditorOwner } from './editor-owner.mjs';

package/modules/operator-auth/accounts/native.d.mts

@@ -0,0 +1,38 @@
+import type { AccountsAdapter, AccountPerson, Operator, Role, Session, CompletedSession, AuthOptions, Principal, OperatorAuth } from '../index.mjs';
+import type { NativeProofPersistence } from '../identity/email-link/index.mjs';
+import type { NativeDependencyAuthority } from '../../dependencies/index.mjs';
+export type NativePerson<R extends string = string> = AccountPerson & Operator<R>;
+/** All reads and mutations are scoped to the tenant selected by server composition. */
+export interface NativeAccountsAdapter<R extends string = string> extends AccountsAdapter<R> {
+  findByEmail(email: string): Promise<NativePerson<R> | null>;
+  findBinding(principal: {issuer: string; subject: string}): Promise<NativePerson<R> | null>;
+  findById(id: string): Promise<NativePerson<R> | null>;
+  getSession(request: Request, input: {now: number}): Promise<Session<R> | null>;
+  /** Revoke the request's native cookie token durably and return its native clearing cookie. */
+  signOut(request: Request, input: {now: number}): Promise<{cookie: string}>;
+  identityEnabled(): Promise<boolean>;
+  policyVersion(): Promise<number>;
+  requiredProvider(email: string): Promise<string | null>;
+  /** Atomically check person version/status/email, domain, binding and policy generation; check the provider pin when present (server-verified seams have none). Bind, revoke password credentials AND existing password sessions, and issue a <=24h native session. */
+  bindAndIssueSession(input: {person: NativePerson<R>; principal: Principal & {providerGeneration: number}; method: 'oidc'; returnTo?: string; request: Request}): Promise<CompletedSession<R> | null>;
+  /** Atomically check current version/status/domain policy and, for password, absence of any provider binding. */
+  issueLocalSession?(input: {request: Request; person: NativePerson<R>; kind: 'password' | 'review'; now: number; returnTo: string}): Promise<CompletedSession<R> | null>;
+  /** Atomically claim the native owner. Without supported native dependency setup provenance, close first-setup identity eligibility. */
+  bootstrap?(input: {request: Request; email: string; displayName: string; returnTo: string; now: number}): Promise<CompletedSession<R> | null>;
+  completeLocalSetup?(request: Request): Promise<{complete: boolean}>;
+  /** Atomically fence the current owner/session, audit, bump generation, and revoke all provider sessions when disabled. */
+  setIdentitySettings?(input: {actor: Session<R>; idpSignIn: boolean; now: number}): Promise<boolean>;
+  checkCredentialFence?(credential: {personId: string; fence: number; kind?: string}, input: {now: number}): Promise<boolean>;
+  dependencies?: NativeDependencyAuthority<R>;
+}
+export interface NativeAuthOptions<R extends string = string> extends Omit<AuthOptions<R>, 'rolePolicy'> {
+  accounts: NativeAccountsAdapter<R>;
+  proofs: NativeProofPersistence<R>;
+}
+
+export interface NativeOperatorAuth<R extends string = string> extends Omit<OperatorAuth<R>, 'accounts'> {
+  readonly native: true;
+  readonly accounts: NativeAccountsAdapter<R>;
+  /** Explicitly refuses with native_capability_unavailable (501); no native setup provenance capability is supplied. */
+  authorizeDependencySetup(request: Request, input: {token?: string}): Promise<never>;
+}

package/modules/operator-auth/accounts/native.mjs

@@ -0,0 +1,171 @@
+// Native composition never constructs an OA account/session store. The seed
+// selects its tenant in these adapters, before any request is handled.
+import { AuthError, deny } from '../errors.mjs';
+import { accountsAdapter, person } from './adapter.mjs';
+import { emailAllowed } from './roles.mjs';
+import { requireEditorOwner } from './editor-owner.mjs';
+import { requirePost, requireOrigin, requireLoopback } from '../http.mjs';
+import { normalizeEmail, safeReturnTo } from '../policy.mjs';
+import { hashToken, constantEqual } from '../crypto.mjs';
+import { devAdmitted } from '../dev-admission.mjs';
+import { createAdmission, legacyAdmission } from '../identity/admission.mjs';
+import { createEmailLinkLifecycle } from '../identity/email-link/index.mjs';
+import { createOidcProviders } from '../identity/oidc/index.mjs';
+import { isLocalCli } from '../local-cli.mjs';
+import { nativeDependencyAuthority } from '../../dependencies/native.mjs';
+import { linkedProviders } from '../../dependencies/auth.mjs';
+
+const ACCOUNT_METHODS = ['findById', 'getSession', 'signOut', 'policyVersion', 'identityEnabled', 'requiredProvider', 'bindAndIssueSession'];
+const PROOF_METHODS = ['limits', 'token', 'preview', 'consumeLink', 'revokeLink', 'stepUpPreview', 'stepUpChallenge', 'consumeStepUp', 'revokeStepUp', 'steppedUp'];
+const OPTIONAL = ['issueLocalSession', 'bootstrap', 'completeLocalSetup', 'setIdentitySettings', 'currentBoundSubject', 'checkCredentialFence'];
+const unavailable = () => deny('native_capability_unavailable', 501);
+function validate(value, required, optional = []) {
+  if (!value || typeof value !== 'object' || required.some(k => typeof value[k] !== 'function') || optional.some(k => value[k] !== undefined && typeof value[k] !== 'function')) throw new AuthError('invalid_native_adapter', 503);
+}
+
+export function createNativeAuth({ accounts, proofs, db, config, clock, hooks, mailSender, clientIp, fetch, waitUntil }) {
+  accountsAdapter(accounts);
+  validate(accounts, ACCOUNT_METHODS, OPTIONAL);
+  validate(proofs, PROOF_METHODS);
+  if (config.dependencies || accounts.dependencies !== undefined) nativeDependencyAuthority(accounts.dependencies);
+  const hash = (purpose, token) => hashToken(config.SESSION_SECRET, purpose, token);
+  const visible = value => {
+    const p = person(value);
+    if (p && (!Number.isSafeInteger(p.version) || p.version < 0 || typeof p.role !== 'string' || !p.role)) throw new AuthError('invalid_native_adapter', 503);
+    return p && emailAllowed(p.email, config.allowList) ? p : null;
+  };
+  // Filtering is shared; the adapter must repeat these authority conditions in
+  // every mutation transaction (a read here alone cannot fence a racing change).
+  const admittedAccounts = Object.fromEntries(['findByEmail', 'findBinding', 'bind', 'issueSession', 'revokeSession', 'owner', 'bindAndIssueSession', 'acceptInvitation', 'requiredProvider', 'currentBoundSubject', 'identityEnabled'].filter(key => typeof accounts[key] === 'function').map(key => [key, (...args) => accounts[key](...args)]));
+  admittedAccounts.identityEnabled = async () => await accounts.identityEnabled() === true;
+  admittedAccounts.findByEmail = async email => visible(await accounts.findByEmail(email));
+  admittedAccounts.findBinding = async principal => visible(await accounts.findBinding(principal));
+  const admission = createAdmission({ accounts: admittedAccounts, config, clock, hooks });
+  async function authenticate(request) {
+    requireOrigin(request, config);
+    const session = await accounts.getSession(request, { now: clock() });
+    if (!session) return null;
+    if (!session.operator || session.operator.status !== 'active' || !emailAllowed(session.operator.email, config.allowList)
+      || !Number.isSafeInteger(session.operator.version) || !Number.isFinite(session.expiresAt) || session.expiresAt <= clock()) return null;
+    if (session.kind === 'oidc' && (!Number.isFinite(session.createdAt) || clock() >= session.createdAt + 86400000 || (await accounts.identityEnabled()) !== true)) return null;
+    if (session.kind === 'dev' && !await devAdmitted(request)) return null;
+    if (session.kind === 'review') {
+      requireLoopback(request);
+      if (config.review?.enabled !== true || session.operator.email !== config.review.operatorEmail) return null;
+    }
+    return session;
+  }
+  const email = createEmailLinkLifecycle({ config, clock, mailSender, clientIp, hash, hooks: { beforeMagicLink: hooks.beforeMagicLink }, afterConfirm: admission.afterConfirm, persistence: {
+    limits: (...a) => proofs.limits(...a), authenticate, requiredProvider: email => accounts.requiredProvider(email),
+    byEmail: async email => visible(await accounts.findByEmail(email)),
+    token: input => proofs.token(input), revokeLink: (...a) => proofs.revokeLink(...a),
+    async authorizedLink(request, digest) {
+      const link = await proofs.preview(digest, clock());
+      if (!link || !emailAllowed(link.email, config.allowList)) return null;
+      const current = visible(await accounts.findById(link.operatorId));
+      if (!current || current.status !== 'active' || current.version !== link.version || current.email !== link.email) return null;
+      if (link.dev && !await devAdmitted(request)) return null;
+      return { link, person: current };
+    },
+    async consumeLink({ request, digest, approval, now }) {
+      await admission.requireRoute(approval.person);
+      return proofs.consumeLink({ request, digest, person: approval.person, now, returnTo: safeReturnTo(approval.link.returnTo) });
+    },
+    stepUpPreview: (...a) => proofs.stepUpPreview(...a), stepUpChallenge: (...a) => proofs.stepUpChallenge(...a),
+    consumeStepUp: (...a) => proofs.consumeStepUp(...a), revokeStepUp: (...a) => proofs.revokeStepUp(...a), steppedUp: (...a) => proofs.steppedUp(...a),
+  } });
+  const policyVersion = async () => {
+    const value = await accounts.policyVersion();
+    if (!Number.isSafeInteger(value) || value < 0) throw new AuthError('invalid_native_adapter', 503);
+    return value;
+  };
+  const enabled = admittedAccounts.identityEnabled;
+  const staticProviders = config.providers.length ? createOidcProviders({ admission, db, clientIp, clock, waitUntil, policyVersion, enabled, ...(fetch ? { fetch } : {}),
+    config: { origin: config.origin, local: config.local, transactionSecret: config.OIDC_TRANSACTION_SECRET, providers: config.providers,
+      signInPath: config.branding.signInPath, timeoutMs: config.identityTimeoutMs, startLimit: config.identityStartLimit } }) : null;
+  const providers = linkedProviders({ db, config, admission, clientIp, clock, waitUntil, fetch, staticProviders, policyVersion, enabled, native: accounts.dependencies });
+  async function owner(request, post = false) {
+    if (post) requirePost(request, config);
+    const actor = await authenticate(request), current = await accounts.owner();
+    if (!actor) deny('unauthenticated', 401);
+    if (!current || current.status !== 'active' || actor.operator.id !== current.id) deny('owner_required', 403);
+    return actor;
+  }
+  async function localSession(request, id, kind, returnTo) {
+    if (!accounts.issueLocalSession) unavailable();
+    const current = visible(await accounts.findById(id));
+    if (!current || current.status !== 'active') deny();
+    await admission.requireRoute(current);
+    const result = await accounts.issueLocalSession({ request, person: current, kind, now: clock(), returnTo: safeReturnTo(returnTo) });
+    if (!result) deny('invalid_or_expired', 400);
+    return { ...result, returnTo: safeReturnTo(result.returnTo) };
+  }
+  async function getSession(request) {
+    const actor = await authenticate(request);
+    if (!actor) return null;
+    const { hash: _, ...session } = actor;
+    return session;
+  }
+  return Object.freeze({
+    // Account administration belongs to the seed; unsupported operations are
+    // explicit refusals, never apparently successful writes to an unused store.
+    ...Object.fromEntries(['invite', 'listOperators', 'cancelInvitation', 'setOperatorStatus', 'setRole', 'listSessions', 'revokeSession',
+      'listDomainRules', 'setDomainRule', 'unlinkProvider', 'relinkProvider', 'mintCredential', 'authenticateCredential'].map(k => [k, unavailable])),
+    native: true, presentation: config.branding, accounts, admission, providers,
+    requestMagicLink: email.requestMagicLink, previewLink: email.previewLink, confirmLink: email.confirmLink,
+    requestStepUp: email.requestStepUp, requireStepUp: email.requireStepUp,
+    ...legacyAdmission({ admission, config, policyVersion }),
+    getSession,
+    async authorizeDependencySetup() { unavailable(); },
+    async signOut(request) { requirePost(request, config); return accounts.signOut(request, { now: clock() }); },
+    async bootstrap(request, { token, displayName, returnTo }) {
+      requirePost(request, config);
+      if (!accounts.bootstrap) unavailable();
+      await email.limit(request, config.OWNER_EMAIL, 'bootstrap');
+      if (!config.SETUP_TOKEN || typeof token !== 'string' || token.length > 1024 || !constantEqual(await hash('setup', token), await hash('setup', config.SETUP_TOKEN))) deny('invalid_setup_token', 403);
+      if (!emailAllowed(config.OWNER_EMAIL, config.allowList)) deny('email_not_allowed');
+      const result = await accounts.bootstrap({ request, email: config.OWNER_EMAIL, displayName, returnTo: safeReturnTo(returnTo), now: clock() });
+      if (!result) deny('already_initialized', 409);
+      return { ...result, returnTo: safeReturnTo(result.returnTo) };
+    },
+    async completeLocalSetup(request) {
+      requirePost(request, config);
+      if (!accounts.completeLocalSetup) unavailable();
+      if (!await isLocalCli(request, config) || !await accounts.owner()) deny('owner_required', 403);
+      return accounts.completeLocalSetup(request);
+    },
+    async issueReviewSession(request, { returnTo } = {}) {
+      requireLoopback(request); requirePost(request, config);
+      if (config.review?.enabled !== true) deny('review_disabled', 403);
+      const emailAddress = normalizeEmail(config.review.operatorEmail);
+      await email.limit(request, emailAddress, 'review');
+      const current = visible(await accounts.findByEmail(emailAddress));
+      if (!current) deny();
+      return localSession(request, current.id, 'review', returnTo);
+    },
+    async admitVerifiedPassword(request, id, { returnTo } = {}) {
+      requirePost(request, config); return localSession(request, id, 'password', returnTo);
+    },
+    async identitySettings(request) { await owner(request); return { idpSignIn: await enabled() }; },
+    async setIdentitySettings(request, { idpSignIn }) {
+      const actor = await owner(request, true);
+      if (typeof idpSignIn !== 'boolean') deny('invalid_input', 400);
+      if (!accounts.setIdentitySettings) unavailable();
+      if (!await accounts.setIdentitySettings({ actor, idpSignIn, now: clock() })) deny('authority_changed', 409);
+      return { idpSignIn };
+    },
+    async listProviders(request) { await owner(request); return providers ? providers.links() : []; },
+    requireEditorOwner: request => requireEditorOwner({ request, getSession, accounts }),
+    async credentialFence(request) {
+      const actor = await authenticate(request);
+      if (!actor) deny('unauthenticated', 401);
+      if (!accounts.checkCredentialFence) unavailable();
+      return { personId: actor.operator.id, fence: actor.operator.version, kind: actor.kind };
+    },
+    async checkCredentialFence(credential, request) {
+      if (!accounts.checkCredentialFence) unavailable();
+      if (!credential || !Number.isSafeInteger(credential.fence) || credential.kind === 'dev' && (!request || !await devAdmitted(request))) return false;
+      return accounts.checkCredentialFence(credential, { now: clock() });
+    },
+  });
+}

package/modules/operator-auth/accounts/oa.mjs

@@ -0,0 +1,90 @@
+// Base's own accounts: operators, roles, invitations and sessions in the oa_
+// store, behind the accounts adapter interface (./adapter.mjs).
+import { deny } from '../errors.mjs';
+import { opaqueToken, hashToken } from '../crypto.mjs';
+import { safeReturnTo, normalizeEmail, emailDomain } from '../policy.mjs';
+import { requireOrigin, requireLoopback, readCookie, sessionCookie } from '../http.mjs';
+import { devAdmitted } from '../dev-admission.mjs';
+import { emailAllowed, isActiveOperator } from './roles.mjs';
+
+export function oaSessions({ config, store, clock }) {
+  const hash = (purpose, token) => hashToken(config.SESSION_SECRET, purpose, token);
+  async function newSession(kind = 'native') {
+    const token = opaqueToken();
+    const seconds = kind === 'review' ? config.reviewSeconds : kind === 'oidc' ? Math.min(config.sessionSeconds, 86400) : config.sessionSeconds;
+    return { id: crypto.randomUUID(), token, hash: await hash('session', token), expiresAt: clock() + seconds * 1000 };
+  }
+  function completed(session, record, returnTo) {
+    if (!record) deny('invalid_or_expired', 400);
+    return { session: { id: record.id, kind: record.kind, createdAt: record.createdAt, expiresAt: record.expiresAt }, operator: record.operator,
+      cookie: sessionCookie(session.token, config, Math.max(0, Math.floor((record.expiresAt - clock()) / 1000))), returnTo: safeReturnTo(returnTo) };
+  }
+  async function authenticate(request) {
+    requireOrigin(request, config);
+    const token = readCookie(request, config);
+    if (!token) return null;
+    const digest = await hash('session', token);
+    const session = await store.session(digest, clock());
+    if (!session || !isActiveOperator(session.operator, config.allowList)) return null;
+    // A dev session counts only behind the local key gate, on every request.
+    if (session.kind === 'dev' && !await devAdmitted(request)) return null;
+    if (session.kind === 'review') {
+      requireLoopback(request);
+      if (config.review?.enabled !== true || session.operator.email !== normalizeEmail(config.review.operatorEmail)) return null;
+    }
+    return { ...session, hash: digest };
+  }
+  return { hash, newSession, completed, authenticate };
+}
+
+function personOf(operator, ownerFlag = operator.role === 'owner' && operator.status === 'active') {
+  return { id: operator.id, email: operator.email, status: operator.status, owner: ownerFlag, role: operator.role, version: operator.version };
+}
+
+export function createOaAccounts({ config, store, clock, sessions, rolePolicy }) {
+  const visible = operator => operator && emailAllowed(operator.email, config.allowList) ? personOf(operator) : null;
+  return {
+    async identityEnabled() { return !!(await store.first('SELECT idp_sign_in FROM oa_auth_settings WHERE singleton=1'))?.idp_sign_in; },
+    async currentBoundSubject({ personId, issuer }) {
+      const rows = (await store.statement('SELECT subject FROM oa_external_identities WHERE operator_id=? AND issuer=?', [personId, issuer]).all()).results;
+      return rows.length === 1 ? rows[0].subject : null;
+    },
+    async findByEmail(email) { return visible(await store.byEmail(email)); },
+    async findBinding({ issuer, subject }) { return visible(await store.binding(issuer, subject)); },
+    async bind({ issuer, subject, person, associated }) {
+      return store.bind({ issuer, subject, operatorId: person.id, expectedVersion: person.version, associated, now: clock() });
+    },
+    async issueSession({ person, principal, returnTo }) {
+      const session = await sessions.newSession('oidc');
+      const record = await store.issueBound({ issuer: principal.issuer, subject: principal.subject, sid: principal.sid ?? null, expectedGeneration: principal.providerGeneration ?? null, providerPin: principal.providerPin, operatorId: person.id, expectedVersion: person.version, session, now: clock() });
+      return record ? sessions.completed(session, record, returnTo) : null;
+    },
+    async bindAndIssueSession({ person, principal, returnTo }) {
+      const session = await sessions.newSession('oidc');
+      const record = await store.issueBound({ issuer: principal.issuer, subject: principal.subject, sid: principal.sid ?? null, associated: principal.associatedEmail !== undefined, establish: true, expectedGeneration: principal.providerGeneration ?? null, providerPin: principal.providerPin, operatorId: person.id, expectedVersion: person.version, session, now: clock() });
+      return record ? sessions.completed(session, record, returnTo) : null;
+    },
+    async acceptInvitation({ person, principal, returnTo }) {
+      const invitation = await store.liveInvitation(person.id, clock());
+      if (!invitation) return null;
+      const inviter = await store.operator(invitation.issuerId);
+      if (!isActiveOperator(inviter, config.allowList) || inviter.version !== invitation.issuerVersion
+        || !await rolePolicy({ actor: inviter, action: 'operators:invite', role: person.role })) return null;
+      const session = await sessions.newSession('oidc');
+      const record = await store.acceptByBinding({ issuer: principal.issuer, subject: principal.subject, sid: principal.sid ?? null, expectedGeneration: principal.providerGeneration ?? null, providerPin: principal.providerPin, tokenId: invitation.id, operatorId: person.id,
+        expectedVersion: person.version, inviter, session, now: clock() });
+      return record ? sessions.completed(session, record, returnTo ?? invitation.returnTo) : null;
+    },
+    async revokeSession(sessionId) {
+      await store.run('UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE id=?', [clock(), sessionId]);
+    },
+    async owner() {
+      const row = await store.first(`SELECT o.id,o.email,o.display_name AS displayName,o.role,o.status,o.version,o.created_at AS createdAt FROM oa_operators o
+        LEFT JOIN oa_bootstrap b ON b.claim_id=o.id WHERE o.role='owner' AND o.status='active' ORDER BY b.claim_id IS NULL, o.created_at, o.id LIMIT 1`);
+      return row ? personOf(row) : null;
+    },
+    async requiredProvider(email) {
+      return (await store.domainRule(emailDomain(email)))?.providerId ?? null;
+    },
+  };
+}

package/modules/operator-auth/accounts/provider-control.mjs

@@ -0,0 +1,50 @@
+import { devAdmitted } from '../dev-admission.mjs';
+import { deny } from '../errors.mjs';
+import { requirePost } from '../http.mjs';
+
+export function providerControl({ store, accounts, authenticate, config, clock }) {
+  async function owner(request, post = false) {
+    if (post) requirePost(request, config);
+    const actor = await authenticate(request), current = await accounts.owner();
+    if (!actor) deny('unauthenticated', 401);
+    if (!current || current.id !== actor.operator.id) deny('owner_required', 403);
+    return actor;
+  }
+  return {
+    async identitySettings(request) { await owner(request); return { idpSignIn: await accounts.identityEnabled() }; },
+    async setIdentitySettings(request, { idpSignIn }) {
+      const actor = await owner(request, true);
+      if (typeof idpSignIn !== 'boolean') deny('invalid_input', 400);
+      const fence = store.actorFence(actor, clock());
+      const currentOwner = `?=(SELECT o.id FROM oa_operators o LEFT JOIN oa_bootstrap b ON b.claim_id=o.id WHERE o.role='owner' AND o.status='active' ORDER BY b.claim_id IS NULL,o.created_at,o.id LIMIT 1)`;
+      const auditId=crypto.randomUUID();
+      const results = await store.batch([
+        [`INSERT INTO oa_auth_settings(singleton,idp_sign_in,generation,first_setup) SELECT 1,0,0,0 WHERE ${fence.sql} AND ${currentOwner} ON CONFLICT(singleton) DO UPDATE SET first_setup=0`, [...fence.args, actor.operator.id]],
+        [`INSERT INTO oa_auth_settings(singleton,idp_sign_in,generation) SELECT 1,?,1 WHERE ${fence.sql} AND ${currentOwner} AND NOT EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=?)
+          ON CONFLICT(singleton) DO UPDATE SET idp_sign_in=excluded.idp_sign_in,generation=oa_auth_settings.generation+1,first_setup=0`, [idpSignIn ? 1 : 0, ...fence.args, actor.operator.id, idpSignIn ? 1 : 0]],
+        [`INSERT INTO oa_auth_audit(id,actor_id,action,value,created_at) SELECT ?,?,'idpSignIn',?,? WHERE changes()=1`, [auditId, actor.operator.id, String(idpSignIn), clock()]],
+        [`UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE kind='oidc' AND EXISTS(SELECT 1 FROM oa_auth_audit WHERE id=? AND value='false')`, [clock(), auditId]],
+      ]);
+      if (results[0].meta.changes !== 1 && results[1].meta.changes !== 1) deny('authority_changed', 409);
+      return { idpSignIn };
+    },
+    async requireEditorOwner(request) {
+      const actor = await owner(request);
+      if (actor.kind === 'oidc') {
+        if (!actor.issuer || !actor.subject || await accounts.currentBoundSubject({ personId: actor.operator.id, issuer: actor.issuer }) !== actor.subject) deny('owner_subject_required', 403);
+      }
+      const { hash, ...session } = actor;
+      return session;
+    },
+    async credentialFence(request) {
+      const actor = await authenticate(request);
+      if (!actor) deny('unauthenticated', 401);
+      return { personId: actor.operator.id, fence: actor.operator.version, kind: actor.kind };
+    },
+    async checkCredentialFence(credential,request) {
+      if (!credential || !Number.isSafeInteger(credential.fence)) return false;
+      const person = await store.operator(credential.personId);
+      return !!person && person.status === 'active' && person.version === credential.fence && (credential.kind !== 'dev' || request && await devAdmitted(request));
+    },
+  };
+}

package/modules/operator-auth/accounts/provider-pin.mjs

@@ -0,0 +1,14 @@
+// Only protocol-created principals carry a pin. External admission works without
+// the OIDC protocol tables; a pinned callback repeats this fence in its batch.
+export function providerPinFence(pin) {
+  return pin ? {
+    sql: `EXISTS(SELECT 1 FROM oa_identity_providers WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?)`,
+    args: [pin.id, pin.issuer, pin.clientId, pin.linkedAt],
+  } : { sql: '1', args: [] };
+}
+
+export function recordProviderPin(pin, sessionId) {
+  return pin ? [[`INSERT INTO oa_provider_session_pins(session_id,provider_id,issuer,client_id,linked_at)
+    SELECT ?,?,?,?,? WHERE EXISTS(SELECT 1 FROM oa_sessions WHERE id=?)`,
+    [sessionId, pin.id, pin.issuer, pin.clientId, pin.linkedAt, sessionId]]] : [];
+}

package/modules/operator-auth/accounts/roles.mjs

@@ -0,0 +1,26 @@
+// Roles and the pure authorization policy of Base's own accounts. A product can
+// replace defaultRolePolicy, but never the active-session guard or the
+// database's final-owner protection.
+export const DEFAULT_ROLES = Object.freeze(['owner', 'admin', 'member']);
+export const ACTIONS = Object.freeze(['operators:list', 'operators:invite', 'operators:deactivate', 'operators:reactivate', 'operators:role',
+  'sessions:list', 'sessions:revoke', 'providers:manage', 'domains:manage']);
+export function emailAllowed(email, allowList) {
+  return allowList === undefined || allowList.includes(email);
+}
+export function isActiveOperator(operator, allowList) {
+  return !!operator && operator.status === 'active' && emailAllowed(operator.email, allowList);
+}
+// Default applied: owner/admin/member. Provider links and domain rules are the
+// owner's alone.
+export function defaultRolePolicy({ actor, action, target, role }) {
+  if (!isActiveOperator(actor) || !ACTIONS.includes(action)) return false;
+  if (action === 'sessions:list' || action === 'sessions:revoke') {
+    if (target?.id === actor.id) return true;
+  }
+  if (actor.role === 'owner') return true;
+  if (actor.role !== 'admin' || action === 'providers:manage' || action === 'domains:manage') return false;
+  if (action === 'operators:list') return true;
+  if (action === 'operators:invite') return role === 'member';
+  if (target?.role !== 'member') return false;
+  return action !== 'operators:role' || role === 'member';
+}