@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/operator-auth/accounts/schema/dependency-setup.sql

@@ -0,0 +1,17 @@
+-- Ephemeral app-local setup attempts are never exported. A native claim binds
+-- only attempts opened before that claim to its exact owner/session authority,
+-- in its own bootstrap transaction.
+CREATE TABLE IF NOT EXISTS oa_setup_links (
+ interface TEXT PRIMARY KEY, attempt_id TEXT NOT NULL, expires_at INTEGER NOT NULL,
+ owner_id TEXT, owner_version INTEGER, session_id TEXT,
+ completed INTEGER NOT NULL DEFAULT 0 CHECK(completed IN (0,1))
+);
+CREATE TRIGGER IF NOT EXISTS oa_native_claim_closes_provider_setup AFTER INSERT ON oa_sessions
+WHEN NEW.kind='native' AND NOT EXISTS(SELECT 1 FROM oa_sessions WHERE operator_id=NEW.operator_id AND id!=NEW.id) AND EXISTS(SELECT 1 FROM oa_bootstrap WHERE claim_id=NEW.operator_id AND claimed_at=NEW.created_at)
+BEGIN
+ UPDATE oa_auth_settings SET first_setup=0 WHERE singleton=1 AND NOT EXISTS(
+  SELECT 1 FROM oa_setup_links WHERE interface='oidc-provider@1' AND completed=0 AND owner_id IS NULL AND expires_at>NEW.created_at
+ );
+ UPDATE oa_setup_links SET owner_id=NEW.operator_id,owner_version=NEW.operator_version,session_id=NEW.id
+ WHERE owner_id IS NULL AND completed=0 AND expires_at>NEW.created_at;
+END;

package/modules/operator-auth/accounts/schema/dev-sessions.sql

@@ -0,0 +1,22 @@
+-- Local dev identity for an existing store. Apply as a NEW numbered migration
+-- under the seed's next unused number; never rewrite an applied migration.
+-- SQLite cannot change a CHECK in place, so oa_sessions is rebuilt with 'dev'
+-- admitted, keeping every row, column, index and constraint. No table refers
+-- to oa_sessions. The file is also safe on a store created from the current
+-- schema/operator-auth.sql, so a fresh store may apply both.
+CREATE TABLE oa_sessions_dev_rebuild (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE,
+ operator_id TEXT NOT NULL REFERENCES oa_operators(id), operator_version INTEGER NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('native','review','oidc','password','dev')),
+ source_token_id TEXT UNIQUE REFERENCES oa_tokens(id),
+ created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER
+);
+INSERT INTO oa_sessions_dev_rebuild(id,token_hash,operator_id,operator_version,kind,source_token_id,created_at,expires_at,revoked_at)
+ SELECT id,token_hash,operator_id,operator_version,kind,source_token_id,created_at,expires_at,revoked_at FROM oa_sessions;
+DROP TABLE oa_sessions;
+ALTER TABLE oa_sessions_dev_rebuild RENAME TO oa_sessions;
+CREATE INDEX oa_sessions_operator ON oa_sessions(operator_id);
+CREATE TABLE IF NOT EXISTS oa_dev_credentials (
+ credential TEXT NOT NULL, id TEXT NOT NULL, created_at INTEGER NOT NULL,
+ PRIMARY KEY(credential, id)
+);

package/modules/operator-auth/accounts/schema/domain-rules-step-up.sql

@@ -0,0 +1,20 @@
+-- Domain rules and step-up proofs for an existing store. Apply as a NEW
+-- numbered migration under the seed's next unused number; never rewrite an
+-- applied migration. Additive only: every existing row stays as it is. The file
+-- is also safe after the current schema/operator-auth.sql.
+-- A required sign-in provider for an email domain. Sign-ins for that domain by
+-- any other route are refused; app owners are exempt.
+CREATE TABLE IF NOT EXISTS oa_domain_rules (
+ domain TEXT PRIMARY KEY, provider_id TEXT NOT NULL,
+ created_by TEXT NOT NULL REFERENCES oa_operators(id), created_at INTEGER NOT NULL
+);
+-- A step-up proof: an app-local email link sent to the operator's own address,
+-- bound to the session that asked and completed only in that session. No
+-- foreign key names oa_sessions, which schema/dev-sessions.sql rebuilds.
+CREATE TABLE IF NOT EXISTS oa_step_up_challenges (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE,
+ session_id TEXT NOT NULL, operator_id TEXT NOT NULL REFERENCES oa_operators(id),
+ operator_version INTEGER NOT NULL, action TEXT NOT NULL, return_to TEXT NOT NULL,
+ created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, consumed_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS oa_step_up_session ON oa_step_up_challenges(session_id);

package/modules/operator-auth/accounts/schema/invitation-cancellation.sql

@@ -0,0 +1,17 @@
+-- Apply as a NEW numbered migration after operator-auth.sql in existing stores.
+-- This durable record is admission state, not an expiring credential. Never prune it.
+-- Existing active/inactive operators retain their recorded status: no historical
+-- acceptance is inferred. Only a witnessed invited -> inactive transition records
+-- an unaccepted cancellation, including direct administrative SQL transitions.
+CREATE TABLE oa_invitation_cancellations (
+ operator_id TEXT PRIMARY KEY REFERENCES oa_operators(id),
+ operator_version INTEGER NOT NULL
+);
+CREATE TRIGGER oa_record_invitation_cancellation AFTER UPDATE OF status ON oa_operators
+ WHEN OLD.status='invited' AND NEW.status='inactive'
+ BEGIN INSERT INTO oa_invitation_cancellations(operator_id,operator_version)
+ VALUES(NEW.id,OLD.version+1)
+ ON CONFLICT(operator_id) DO UPDATE SET operator_version=excluded.operator_version; END;
+CREATE TRIGGER oa_reject_cancelled_invitation_reactivation BEFORE UPDATE OF status ON oa_operators
+ WHEN NEW.status='active' AND EXISTS(SELECT 1 FROM oa_invitation_cancellations WHERE operator_id=OLD.id)
+ BEGIN SELECT RAISE(ABORT, 'invitation_required'); END;

package/modules/operator-auth/accounts/schema/operator-auth.sql

@@ -0,0 +1,142 @@
+-- Additive schema draft. Integrator assigns the next migration number; never
+-- replace an applied migration. All epoch timestamps are milliseconds.
+CREATE TABLE oa_operators (
+ id TEXT PRIMARY KEY, email TEXT NOT NULL UNIQUE, display_name TEXT NOT NULL,
+ role TEXT NOT NULL CHECK(role IN ('owner','admin','member')),
+ status TEXT NOT NULL CHECK(status IN ('invited','active','inactive')),
+ version INTEGER NOT NULL DEFAULT 1, created_at INTEGER NOT NULL
+);
+CREATE TABLE oa_bootstrap (singleton INTEGER PRIMARY KEY CHECK(singleton=1), claim_id TEXT NOT NULL UNIQUE, claimed_at INTEGER NOT NULL);
+CREATE TABLE oa_tokens (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE,
+ kind TEXT NOT NULL CHECK(kind IN ('magic','invite')),
+ operator_id TEXT NOT NULL REFERENCES oa_operators(id), operator_version INTEGER NOT NULL,
+ issuer_id TEXT REFERENCES oa_operators(id), issuer_version INTEGER,
+ return_to TEXT NOT NULL, created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL,
+ consumed_at INTEGER, revoked_at INTEGER,
+ CHECK((kind='invite' AND issuer_id IS NOT NULL AND issuer_version IS NOT NULL)
+    OR (kind='magic' AND issuer_id IS NULL AND issuer_version IS NULL))
+);
+CREATE TABLE oa_sessions (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE,
+ operator_id TEXT NOT NULL REFERENCES oa_operators(id), operator_version INTEGER NOT NULL,
+ kind TEXT NOT NULL CHECK(kind IN ('native','review','oidc','password','dev')),
+ source_token_id TEXT UNIQUE REFERENCES oa_tokens(id),
+ created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER
+);
+CREATE INDEX oa_sessions_operator ON oa_sessions(operator_id);
+CREATE TABLE oa_external_identities (
+ issuer TEXT NOT NULL, subject TEXT NOT NULL, operator_id TEXT NOT NULL REFERENCES oa_operators(id),
+ PRIMARY KEY(issuer, subject)
+);
+CREATE TABLE oa_limits (key TEXT PRIMARY KEY, window INTEGER NOT NULL, count INTEGER NOT NULL);
+CREATE TRIGGER oa_preserve_last_owner_update BEFORE UPDATE OF status,role ON oa_operators
+ WHEN OLD.role='owner' AND OLD.status='active' AND (NEW.role!='owner' OR NEW.status!='active')
+ AND (SELECT COUNT(*) FROM oa_operators WHERE role='owner' AND status='active') <= 1
+ BEGIN SELECT RAISE(ABORT, 'last_owner'); END;
+CREATE TRIGGER oa_preserve_last_owner_delete BEFORE DELETE ON oa_operators
+ WHEN OLD.role='owner' AND OLD.status='active'
+ AND (SELECT COUNT(*) FROM oa_operators WHERE role='owner' AND status='active') <= 1
+ BEGIN SELECT RAISE(ABORT, 'last_owner'); END;
+-- A status/role change invalidates every preexisting session and link, including
+-- after a later reactivation. Keep this invariant for direct administrative SQL.
+CREATE TRIGGER oa_operator_version AFTER UPDATE OF status,role ON oa_operators
+ WHEN OLD.status != NEW.status OR OLD.role != NEW.role
+ BEGIN UPDATE oa_operators SET version=OLD.version+1 WHERE id=NEW.id; END;
+
+-- Fresh installs include local dev identity. Apply schema/dev-sessions.sql as a
+-- NEW numbered migration in existing stores; it is also safe after this file.
+-- A credential minted while signed in with a dev session is recorded here and,
+-- like the dev session itself, counts only behind the local key gate.
+CREATE TABLE IF NOT EXISTS oa_dev_credentials (
+ credential TEXT NOT NULL, id TEXT NOT NULL, created_at INTEGER NOT NULL,
+ PRIMARY KEY(credential, id)
+);
+
+-- Fresh installs include the additive invitation cancellation ledger.
+-- Apply as a NEW numbered migration after operator-auth.sql in existing stores.
+-- This durable record is admission state, not an expiring credential. Never prune it.
+-- Existing active/inactive operators retain their recorded status: no historical
+-- acceptance is inferred. Only a witnessed invited -> inactive transition records
+-- an unaccepted cancellation, including direct administrative SQL transitions.
+CREATE TABLE oa_invitation_cancellations (
+ operator_id TEXT PRIMARY KEY REFERENCES oa_operators(id),
+ operator_version INTEGER NOT NULL
+);
+CREATE TRIGGER oa_record_invitation_cancellation AFTER UPDATE OF status ON oa_operators
+ WHEN OLD.status='invited' AND NEW.status='inactive'
+ BEGIN INSERT INTO oa_invitation_cancellations(operator_id,operator_version)
+ VALUES(NEW.id,OLD.version+1)
+ ON CONFLICT(operator_id) DO UPDATE SET operator_version=excluded.operator_version; END;
+CREATE TRIGGER oa_reject_cancelled_invitation_reactivation BEFORE UPDATE OF status ON oa_operators
+ WHEN NEW.status='active' AND EXISTS(SELECT 1 FROM oa_invitation_cancellations WHERE operator_id=OLD.id)
+ BEGIN SELECT RAISE(ABORT, 'invitation_required'); END;
+
+-- Fresh installs include domain rules and step-up proofs. Apply
+-- schema/domain-rules-step-up.sql as a NEW numbered migration in existing
+-- stores; it is also safe after this file.
+-- A required sign-in provider for an email domain. Sign-ins for that domain by
+-- any other route are refused; app owners are exempt.
+CREATE TABLE IF NOT EXISTS oa_domain_rules (
+ domain TEXT PRIMARY KEY, provider_id TEXT NOT NULL,
+ created_by TEXT NOT NULL REFERENCES oa_operators(id), created_at INTEGER NOT NULL
+);
+-- A step-up proof: an app-local email link sent to the operator's own address,
+-- bound to the session that asked and completed only in that session. No
+-- foreign key names oa_sessions, which schema/dev-sessions.sql rebuilds.
+CREATE TABLE IF NOT EXISTS oa_step_up_challenges (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE,
+ session_id TEXT NOT NULL, operator_id TEXT NOT NULL REFERENCES oa_operators(id),
+ operator_version INTEGER NOT NULL, action TEXT NOT NULL, return_to TEXT NOT NULL,
+ created_at INTEGER NOT NULL, expires_at INTEGER NOT NULL, consumed_at INTEGER
+);
+CREATE INDEX IF NOT EXISTS oa_step_up_session ON oa_step_up_challenges(session_id);
+
+-- Additive provider controls. An absent setting means off, including upgrades.
+CREATE TABLE IF NOT EXISTS oa_auth_settings (
+ singleton INTEGER PRIMARY KEY CHECK(singleton=1), idp_sign_in INTEGER NOT NULL CHECK(idp_sign_in IN (0,1)), generation INTEGER NOT NULL DEFAULT 0, first_setup INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE IF NOT EXISTS oa_auth_audit (
+ id TEXT PRIMARY KEY, actor_id TEXT NOT NULL, action TEXT NOT NULL, value TEXT NOT NULL, created_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS oa_provider_sessions (
+ session_id TEXT PRIMARY KEY, issuer TEXT NOT NULL, subject TEXT NOT NULL, sid TEXT, generation INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS oa_provider_session_identity ON oa_provider_sessions(issuer,subject,sid);
+CREATE TABLE IF NOT EXISTS oa_logout_events (
+ issuer TEXT NOT NULL, jti TEXT NOT NULL, consumed_at INTEGER NOT NULL CHECK(consumed_at>=0), PRIMARY KEY(issuer,jti)
+);
+
+CREATE TRIGGER IF NOT EXISTS oa_first_setup_provider_setting AFTER INSERT ON oa_bootstrap BEGIN
+ INSERT INTO oa_auth_settings(singleton,idp_sign_in,generation,first_setup) VALUES(1,0,0,1) ON CONFLICT DO NOTHING;
+END;
+
+CREATE TABLE IF NOT EXISTS oa_credentials (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE, operator_id TEXT NOT NULL REFERENCES oa_operators(id),
+ operator_version INTEGER, kind TEXT NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER
+);
+
+-- Session provenance for OIDC pins. Apply as a new migration on existing stores.
+-- External admission has no OIDC pin and does not require OIDC protocol tables.
+CREATE TABLE IF NOT EXISTS oa_provider_session_pins (
+ session_id TEXT PRIMARY KEY, provider_id TEXT NOT NULL, issuer TEXT NOT NULL,
+ client_id TEXT NOT NULL, linked_at INTEGER NOT NULL
+);
+
+-- Ephemeral app-local setup attempts are never exported. A native claim binds
+-- only attempts opened before that claim to its exact owner/session authority,
+-- in its own bootstrap transaction.
+CREATE TABLE IF NOT EXISTS oa_setup_links (
+ interface TEXT PRIMARY KEY, attempt_id TEXT NOT NULL, expires_at INTEGER NOT NULL,
+ owner_id TEXT, owner_version INTEGER, session_id TEXT,
+ completed INTEGER NOT NULL DEFAULT 0 CHECK(completed IN (0,1))
+);
+CREATE TRIGGER IF NOT EXISTS oa_native_claim_closes_provider_setup AFTER INSERT ON oa_sessions
+WHEN NEW.kind='native' AND NOT EXISTS(SELECT 1 FROM oa_sessions WHERE operator_id=NEW.operator_id AND id!=NEW.id) AND EXISTS(SELECT 1 FROM oa_bootstrap WHERE claim_id=NEW.operator_id AND claimed_at=NEW.created_at)
+BEGIN
+ UPDATE oa_auth_settings SET first_setup=0 WHERE singleton=1 AND NOT EXISTS(
+  SELECT 1 FROM oa_setup_links WHERE interface='oidc-provider@1' AND completed=0 AND owner_id IS NULL AND expires_at>NEW.created_at
+ );
+ UPDATE oa_setup_links SET owner_id=NEW.operator_id,owner_version=NEW.operator_version,session_id=NEW.id
+ WHERE owner_id IS NULL AND completed=0 AND expires_at>NEW.created_at;
+END;

package/modules/operator-auth/accounts/schema/provider-control.sql

@@ -0,0 +1,30 @@
+-- Additive provider controls. An absent setting means off, including upgrades.
+CREATE TABLE IF NOT EXISTS oa_auth_settings (
+ singleton INTEGER PRIMARY KEY CHECK(singleton=1), idp_sign_in INTEGER NOT NULL CHECK(idp_sign_in IN (0,1)), generation INTEGER NOT NULL DEFAULT 0, first_setup INTEGER NOT NULL DEFAULT 0
+);
+CREATE TABLE IF NOT EXISTS oa_auth_audit (
+ id TEXT PRIMARY KEY, actor_id TEXT NOT NULL, action TEXT NOT NULL, value TEXT NOT NULL, created_at INTEGER NOT NULL
+);
+CREATE TABLE IF NOT EXISTS oa_provider_sessions (
+ session_id TEXT PRIMARY KEY, issuer TEXT NOT NULL, subject TEXT NOT NULL, sid TEXT, generation INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS oa_provider_session_identity ON oa_provider_sessions(issuer,subject,sid);
+CREATE TABLE IF NOT EXISTS oa_logout_events (
+ issuer TEXT NOT NULL, jti TEXT NOT NULL, consumed_at INTEGER NOT NULL CHECK(consumed_at>=0), PRIMARY KEY(issuer,jti)
+);
+
+CREATE TRIGGER IF NOT EXISTS oa_first_setup_provider_setting AFTER INSERT ON oa_bootstrap BEGIN
+ INSERT INTO oa_auth_settings(singleton,idp_sign_in,generation,first_setup) VALUES(1,0,0,1) ON CONFLICT DO NOTHING;
+END;
+
+CREATE TABLE IF NOT EXISTS oa_credentials (
+ id TEXT PRIMARY KEY, token_hash TEXT NOT NULL UNIQUE, operator_id TEXT NOT NULL REFERENCES oa_operators(id),
+ operator_version INTEGER, kind TEXT NOT NULL, expires_at INTEGER NOT NULL, revoked_at INTEGER
+);
+
+-- Session provenance for OIDC pins. Apply as a new migration on existing stores.
+-- External admission has no OIDC pin and does not require OIDC protocol tables.
+CREATE TABLE IF NOT EXISTS oa_provider_session_pins (
+ session_id TEXT PRIMARY KEY, provider_id TEXT NOT NULL, issuer TEXT NOT NULL,
+ client_id TEXT NOT NULL, linked_at INTEGER NOT NULL
+);

package/modules/operator-auth/accounts/schema/provider-pins.sql

@@ -0,0 +1,6 @@
+-- Session provenance for OIDC pins. Apply as a new migration on existing stores.
+-- External admission has no OIDC pin and does not require OIDC protocol tables.
+CREATE TABLE IF NOT EXISTS oa_provider_session_pins (
+ session_id TEXT PRIMARY KEY, provider_id TEXT NOT NULL, issuer TEXT NOT NULL,
+ client_id TEXT NOT NULL, linked_at INTEGER NOT NULL
+);

package/modules/operator-auth/accounts/settings-page.mjs

@@ -0,0 +1,4 @@
+import { securityHeaders } from '../http.mjs';
+export function identitySettingsPage({idpSignIn}) {
+ return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in settings</title><style>body{font:18px system-ui;margin:0;padding:24px;color:#152523}main{max-width:640px;margin:8vh auto}label{display:block;padding:20px 0}button{font:inherit;padding:12px 20px}input{width:20px;height:20px;margin-right:12px}</style></head><body><main><a href="/app">Back to app</a><h1>Sign-in settings</h1><p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p><form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label><input type="checkbox" name="idpSignIn" value="true" ${idpSignIn?'checked':''}>Allow provider sign-in</label><button>Save settings</button></form></main></body></html>`,{headers:{...securityHeaders(),'Referrer-Policy':'strict-origin','Content-Type':'text/html; charset=utf-8','Content-Security-Policy':"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"}});
+}

package/modules/operator-auth/accounts/store.mjs

@@ -0,0 +1,246 @@
+import { providerPinFence, recordProviderPin } from './provider-pin.mjs';
+// D1 batches are transactions. All decisions that grant a session or mutate
+// operator authority are repeated inside the same database transaction.
+export const operatorColumns = 'id, email, display_name AS displayName, role, status, version, created_at AS createdAt';
+export class AuthStore {
+  constructor(db) { this.db = db; }
+  statement(sql, args = []) { return this.db.prepare(sql).bind(...args); }
+  async first(sql, args = []) { return this.statement(sql, args).first(); }
+  async run(sql, args = []) { return this.statement(sql, args).run(); }
+  async batch(statements) { return this.db.batch(statements.map(([sql, args]) => this.statement(sql, args))); }
+  operator(id) { return this.first(`SELECT ${operatorColumns} FROM oa_operators WHERE id=?`, [id]); }
+  byEmail(email) { return this.first(`SELECT ${operatorColumns} FROM oa_operators WHERE email=?`, [email]); }
+  cancellation(operatorId) { return this.first('SELECT operator_version FROM oa_invitation_cancellations WHERE operator_id=?', [operatorId]); }
+  async session(hash, now) {
+    const pin = await this.first('SELECT p.provider_id AS id,p.issuer,p.client_id AS clientId,p.linked_at AS linkedAt FROM oa_provider_session_pins p JOIN oa_sessions s ON s.id=p.session_id WHERE s.token_hash=?', [hash]);
+    const fence = providerPinFence(pin);
+    const session = await this.first(`SELECT s.id,s.operator_id AS operatorId,s.created_at AS createdAt,s.expires_at AS expiresAt,s.kind,p.issuer,p.subject,p.sid, o.email,o.display_name AS displayName,o.role,o.status,o.version,o.created_at AS operatorCreatedAt
+      FROM oa_sessions s JOIN oa_operators o ON o.id=s.operator_id LEFT JOIN oa_provider_sessions p ON p.session_id=s.id
+      WHERE s.token_hash=? AND s.revoked_at IS NULL AND s.expires_at>? AND o.status='active' AND s.operator_version=o.version AND (s.kind!='oidc' OR (p.session_id IS NOT NULL AND EXISTS(SELECT 1 FROM oa_auth_settings a WHERE a.singleton=1 AND a.idp_sign_in=1 AND a.generation=p.generation))) AND ${fence.sql}`, [hash, now, ...fence.args]);
+    if (!session) return null;
+    if (pin) session.providerPin = pin;
+    const { email, displayName, role, status, version, operatorCreatedAt, ...fields } = session;
+    return { ...fields, operator: { id: session.operatorId, email, displayName, role, status, version, createdAt: operatorCreatedAt } };
+  }
+  async limits(keys, now, windowMs) {
+    const window = Math.floor(now / windowMs);
+    const rows = await this.batch(keys.map((key) => [`INSERT INTO oa_limits(key,window,count) VALUES(?,?,1)
+      ON CONFLICT(key) DO UPDATE SET window=excluded.window,count=CASE WHEN oa_limits.window=excluded.window THEN oa_limits.count+1 ELSE 1 END RETURNING count`, [key, window]]));
+    return rows.map((r) => r.results[0].count);
+  }
+  async bootstrap({ id, email, displayName, now, session }) {
+    await this.batch([
+      [`INSERT INTO oa_bootstrap(singleton,claim_id,claimed_at) SELECT 1,?,? WHERE NOT EXISTS(SELECT 1 FROM oa_operators) ON CONFLICT DO NOTHING`, [id, now]],
+      [`INSERT INTO oa_operators(id,email,display_name,role,status,created_at)
+        SELECT ?,?,?,'owner','active',? WHERE EXISTS(SELECT 1 FROM oa_bootstrap WHERE claim_id=?) ON CONFLICT DO NOTHING`, [id, email, displayName, now, id]],
+      [`INSERT INTO oa_sessions(id,token_hash,operator_id,operator_version,kind,created_at,expires_at)
+        SELECT ?,?,id,version,'native',?,? FROM oa_operators WHERE id=?`, [session.id, session.hash, now, session.expiresAt, id]],
+    ]);
+    return this.session(session.hash, now);
+  }
+  // Snapshot authorization fence: both actor session and operator authority must
+  // still be valid when the SQL mutation executes, not merely when JS checked it.
+  actorFence(actor, now) {
+    const pin = providerPinFence(actor.providerPin);
+    return { sql: `${pin.sql} AND EXISTS(SELECT 1 FROM oa_sessions a JOIN oa_operators ao ON ao.id=a.operator_id
+      WHERE a.token_hash=? AND a.revoked_at IS NULL AND a.expires_at>? AND ao.status='active'
+      AND a.operator_version=ao.version AND ao.id=? AND ao.version=?
+      AND (a.kind!='oidc' OR EXISTS(SELECT 1 FROM oa_provider_sessions p JOIN oa_auth_settings c ON c.singleton=1 AND c.idp_sign_in=1 AND c.generation=p.generation WHERE p.session_id=a.id)))`, args: [...pin.args, actor.hash, now, actor.operator.id, actor.operator.version] };
+  }
+  async token(input, actor) {
+    let fence = { sql: '1', args: [] };
+    if (actor) fence = this.actorFence(actor, input.now);
+    const result = await this.run(`INSERT INTO oa_tokens(id,token_hash,kind,operator_id,operator_version,return_to,created_at,expires_at)
+      SELECT ?,?,?,id,version,?,?,? FROM oa_operators WHERE id=? AND status='active' AND ${fence.sql}`,
+    [input.id, input.hash, input.kind, input.returnTo, input.now, input.expiresAt, input.operatorId, ...fence.args]);
+    return result.meta.changes === 1;
+  }
+  async invite({ operatorId, expectedVersion, reinviting = false, email, displayName, role, token, now }, actor) {
+    const fence = this.actorFence(actor, now);
+    // Only a witnessed cancellation may reopen an inactive identity. Keep its
+    // durable admission guard until confirmation, including through pruning.
+    const prepare = reinviting
+      ? [`UPDATE oa_operators SET status='invited',display_name=? WHERE id=? AND email=? AND role=? AND status='inactive' AND version=?
+          AND EXISTS(SELECT 1 FROM oa_invitation_cancellations WHERE operator_id=?) AND ${fence.sql}`,
+        [displayName, operatorId, email, role, expectedVersion, operatorId, ...fence.args]]
+      : [`INSERT INTO oa_operators(id,email,display_name,role,status,created_at)
+          SELECT ?,?,?,?,'invited',? WHERE ${fence.sql} ON CONFLICT(email) DO NOTHING`, [operatorId, email, displayName, role, now, ...fence.args]];
+    const results = await this.batch([
+      prepare,
+      [`INSERT INTO oa_tokens(id,token_hash,kind,operator_id,operator_version,issuer_id,issuer_version,return_to,created_at,expires_at)
+        SELECT ?,?,'invite',id,version,?,?,?,?,? FROM oa_operators WHERE id=? AND status='invited' AND role=? AND version=?
+        ${reinviting ? 'AND changes()=1' : ''} AND ${fence.sql}`,
+      [token.id, token.hash, actor.operator.id, actor.operator.version, token.returnTo, now, token.expiresAt, operatorId, role, expectedVersion + (reinviting ? 1 : 0), ...fence.args]],
+      // Bind revocation to this transaction's successful issuance, so a stale
+      // reissue cannot invalidate the winner's link or send another credential.
+      [`UPDATE oa_tokens SET revoked_at=? WHERE operator_id=? AND id!=? AND consumed_at IS NULL
+        AND EXISTS(SELECT 1 FROM oa_tokens WHERE id=?)`, [now, operatorId, token.id, token.id]],
+      // A link minted while using a dev session stays a dev credential.
+      ...(actor.kind === 'dev' ? [[`INSERT INTO oa_dev_credentials(credential,id,created_at)
+        SELECT 'oa_tokens',id,? FROM oa_tokens WHERE id=?`, [now, token.id]]] : []),
+    ]);
+    return results[1].meta.changes === 1;
+  }
+  async preview(hash, now) {
+    return this.first(`SELECT t.kind,t.expires_at AS expiresAt,t.return_to AS returnTo,o.email,o.role,t.issuer_id AS issuerId,t.issuer_version AS issuerVersion,
+      EXISTS(SELECT 1 FROM oa_dev_credentials d WHERE d.credential='oa_tokens' AND d.id=t.id) AS dev FROM oa_tokens t JOIN oa_operators o ON o.id=t.operator_id
+      WHERE t.token_hash=? AND t.consumed_at IS NULL AND t.revoked_at IS NULL AND t.expires_at>? AND t.operator_version=o.version
+      AND (o.status='active' OR (o.status='invited' AND t.kind='invite'))`, [hash, now]);
+  }
+  async consume(hash, now, session, allowedEmails, issuer) {
+    const allow = allowedEmails === undefined ? { sql: '1', args: [] } : { sql: `o.email IN (${allowedEmails.map(() => '?').join(',') || 'NULL'})`, args: allowedEmails };
+    // JS evaluated the configured policy on this issuer snapshot. Bind that
+    // approval to the invitation and repeat its authority check in the session
+    // transaction, so a concurrent demotion/deactivation cannot admit anyone.
+    const authority = issuer ? { sql: `t.issuer_id=? AND t.issuer_version=? AND EXISTS(
+      SELECT 1 FROM oa_operators i WHERE i.id=t.issuer_id AND i.version=t.issuer_version AND i.status='active')`,
+    args: [issuer.id, issuer.version] } : { sql: '0', args: [] };
+    await this.batch([
+      [`INSERT INTO oa_sessions(id,token_hash,operator_id,operator_version,kind,source_token_id,created_at,expires_at)
+        SELECT ?,?,o.id,o.version+CASE WHEN o.status='invited' THEN 1 ELSE 0 END,
+        CASE WHEN EXISTS(SELECT 1 FROM oa_dev_credentials d WHERE d.credential='oa_tokens' AND d.id=t.id) THEN 'dev' ELSE 'native' END,t.id,?,?
+        FROM oa_tokens t JOIN oa_operators o ON o.id=t.operator_id
+        WHERE t.token_hash=? AND t.consumed_at IS NULL AND t.revoked_at IS NULL AND t.expires_at>? AND t.operator_version=o.version
+        AND (o.status='active' OR (o.status='invited' AND t.kind='invite')) AND ${allow.sql}
+        AND (t.kind='magic' OR (${authority.sql}))`,
+      [session.id, session.hash, now, session.expiresAt, hash, now, ...allow.args, ...authority.args]],
+      // Only the session just admitted by the full token/issuer/allow-list
+      // predicate witnesses acceptance. Removing its cancellation guard and
+      // activating the operator are atomic with that admission; failures roll
+      // back all three writes. An ordinary status update has no such witness.
+      [`DELETE FROM oa_invitation_cancellations WHERE operator_id=(
+        SELECT s.operator_id FROM oa_sessions s JOIN oa_tokens t ON t.id=s.source_token_id
+        JOIN oa_operators o ON o.id=s.operator_id WHERE s.id=? AND t.kind='invite'
+        AND t.operator_id=o.id AND o.status='invited' AND t.operator_version=o.version AND s.operator_version=o.version+1)`, [session.id]],
+      [`UPDATE oa_operators SET status='active' WHERE status='invited' AND id=(SELECT operator_id FROM oa_sessions WHERE id=?)`, [session.id]],
+      [`UPDATE oa_tokens SET consumed_at=? WHERE id=(SELECT source_token_id FROM oa_sessions WHERE id=?)`, [now, session.id]],
+    ]);
+    const admitted = await this.session(session.hash, now);
+    if (!admitted) return null;
+    const token = await this.first(`SELECT return_to AS returnTo FROM oa_tokens WHERE token_hash=?`, [hash]);
+    return { ...admitted, returnTo: token.returnTo };
+  }
+  async issue({ operatorId, session, now, kind, expectedVersion }) {
+    await this.run(`INSERT INTO oa_sessions(id,token_hash,operator_id,operator_version,kind,created_at,expires_at)
+      SELECT ?,?,id,version,?,?,? FROM oa_operators WHERE id=? AND status='active' AND version=?`,
+    [session.id, session.hash, kind, now, session.expiresAt, operatorId, expectedVersion]);
+    return this.session(session.hash, now);
+  }
+  // The account bound to a provider principal. Bindings are never rebound.
+  async binding(issuer, subject) {
+    return this.first(`SELECT o.id, o.email, o.display_name AS displayName, o.role, o.status, o.version, o.created_at AS createdAt
+      FROM oa_external_identities e JOIN oa_operators o ON o.id=e.operator_id
+      WHERE e.issuer=? AND e.subject=?`, [issuer, subject]);
+  }
+  // Binds (issuer, subject) to an active operator at the version the caller
+  // checked. A proven email binds only the operator's first principal at that
+  // issuer; an explicit configured association may add another. Binding closes
+  // the operator's password sessions in the same transaction.
+  async bind({ issuer, subject, operatorId, expectedVersion, associated, now }) {
+    await this.batch([
+      [`INSERT INTO oa_external_identities(issuer,subject,operator_id)
+        SELECT ?,?,o.id FROM oa_operators o WHERE o.id=? AND o.status='active' AND o.version=?
+        AND (? OR NOT EXISTS(SELECT 1 FROM oa_external_identities e WHERE e.operator_id=o.id AND e.issuer=?))
+        ON CONFLICT DO NOTHING`, [issuer, subject, operatorId, expectedVersion, associated ? 1 : 0, issuer]],
+      [`UPDATE oa_sessions SET revoked_at=? WHERE operator_id=? AND kind='password' AND revoked_at IS NULL
+        AND EXISTS(SELECT 1 FROM oa_external_identities WHERE issuer=? AND subject=? AND operator_id=?)`, [now, operatorId, issuer, subject, operatorId]],
+    ]);
+    const row = await this.first('SELECT operator_id AS operatorId FROM oa_external_identities WHERE issuer=? AND subject=?', [issuer, subject]);
+    return row?.operatorId === operatorId;
+  }
+  // A provider session exists only while its binding still names the operator.
+  async issueBound({ issuer, subject, sid = null, associated = false, establish = false, expectedGeneration = null, providerPin, operatorId, expectedVersion, session, now }) {
+    const pin = providerPinFence(providerPin);
+    await this.batch([
+      ...(establish ? [[`INSERT INTO oa_external_identities(issuer,subject,operator_id)
+        SELECT ?,?,o.id FROM oa_operators o WHERE o.id=? AND o.status='active' AND o.version=?
+        AND (? OR NOT EXISTS(SELECT 1 FROM oa_external_identities e WHERE e.operator_id=o.id AND e.issuer=?))
+        AND ${pin.sql} AND EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=1 AND (? IS NULL OR generation=?)) ON CONFLICT DO NOTHING`,
+        [issuer,subject,operatorId,expectedVersion,associated?1:0,issuer,...pin.args,expectedGeneration,expectedGeneration]]] : []),
+      [`INSERT INTO oa_sessions(id,token_hash,operator_id,operator_version,kind,created_at,expires_at)
+        SELECT ?,?,o.id,o.version,'oidc',?,? FROM oa_external_identities e JOIN oa_operators o ON o.id=e.operator_id
+        WHERE e.issuer=? AND e.subject=? AND o.id=? AND o.status='active' AND o.version=?
+        AND ${pin.sql} AND EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=1 AND (? IS NULL OR generation=?))`,
+      [session.id, session.hash, now, Math.min(session.expiresAt, now+86400000), issuer, subject, operatorId, expectedVersion, ...pin.args, expectedGeneration, expectedGeneration]],
+      [`INSERT INTO oa_provider_sessions(session_id,issuer,subject,sid,generation)
+        SELECT ?,?,?,?,generation FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=1
+        AND EXISTS(SELECT 1 FROM oa_sessions WHERE id=?)`, [session.id, issuer, subject, sid, session.id]],
+      ...recordProviderPin(providerPin, session.id),
+      [`UPDATE oa_sessions SET revoked_at=? WHERE operator_id=? AND kind='password' AND revoked_at IS NULL AND EXISTS(SELECT 1 FROM oa_sessions WHERE id=?)`,[now,operatorId,session.id]],
+    ]);
+    return this.session(session.hash, now);
+  }
+  hasBinding(operatorId) { return this.first('SELECT 1 AS bound FROM oa_external_identities WHERE operator_id=? LIMIT 1', [operatorId]); }
+  // The live invitation a provider sign-in may accept. Dev-minted invitations
+  // count only behind the local key gate, so a provider never accepts one.
+  liveInvitation(operatorId, now) {
+    return this.first(`SELECT t.id,t.issuer_id AS issuerId,t.issuer_version AS issuerVersion,t.return_to AS returnTo FROM oa_tokens t JOIN oa_operators o ON o.id=t.operator_id
+      WHERE t.operator_id=? AND t.kind='invite' AND t.consumed_at IS NULL AND t.revoked_at IS NULL AND t.expires_at>? AND t.operator_version=o.version AND o.status='invited'
+      AND NOT EXISTS(SELECT 1 FROM oa_dev_credentials d WHERE d.credential='oa_tokens' AND d.id=t.id) ORDER BY t.created_at DESC LIMIT 1`, [operatorId, now]);
+  }
+  // Accepts a pending invitation through a proven provider principal: the same
+  // witnessed transaction as an email-link acceptance, plus the binding.
+  async acceptByBinding({ issuer, subject, sid = null, expectedGeneration = null, providerPin, tokenId, operatorId, expectedVersion, inviter, session, now }) {
+    const pin = providerPinFence(providerPin);
+    await this.batch([
+      [`INSERT INTO oa_external_identities(issuer,subject,operator_id)
+        SELECT ?,?,o.id FROM oa_operators o WHERE o.id=? AND o.status='invited' AND o.version=?
+        AND NOT EXISTS(SELECT 1 FROM oa_external_identities e WHERE e.operator_id=o.id AND e.issuer=?)
+        AND ${pin.sql} AND EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=1 AND (? IS NULL OR generation=?))
+        AND EXISTS(SELECT 1 FROM oa_tokens t JOIN oa_operators i ON i.id=t.issuer_id WHERE t.id=? AND t.operator_id=o.id AND t.kind='invite' AND t.consumed_at IS NULL AND t.revoked_at IS NULL AND t.expires_at>? AND t.operator_version=o.version AND t.issuer_id=? AND t.issuer_version=? AND i.version=t.issuer_version AND i.status='active') ON CONFLICT DO NOTHING`,
+      [issuer, subject, operatorId, expectedVersion, issuer,...pin.args,expectedGeneration,expectedGeneration,tokenId,now,inviter.id,inviter.version]],
+      [`INSERT INTO oa_sessions(id,token_hash,operator_id,operator_version,kind,source_token_id,created_at,expires_at)
+        SELECT ?,?,o.id,o.version+1,'oidc',t.id,?,? FROM oa_tokens t JOIN oa_operators o ON o.id=t.operator_id
+        JOIN oa_external_identities e ON e.operator_id=o.id AND e.issuer=? AND e.subject=?
+        WHERE t.id=? AND t.kind='invite' AND t.consumed_at IS NULL AND t.revoked_at IS NULL AND t.expires_at>? AND t.operator_version=o.version
+        AND o.id=? AND o.status='invited' AND o.version=? AND t.issuer_id=? AND t.issuer_version=?
+        AND EXISTS(SELECT 1 FROM oa_operators i WHERE i.id=t.issuer_id AND i.version=t.issuer_version AND i.status='active')
+        AND ${pin.sql} AND EXISTS(SELECT 1 FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=1 AND (? IS NULL OR generation=?))`,
+      [session.id, session.hash, now, Math.min(session.expiresAt, now+86400000), issuer, subject, tokenId, now, operatorId, expectedVersion, inviter.id, inviter.version, ...pin.args, expectedGeneration, expectedGeneration]],
+      [`INSERT INTO oa_provider_sessions(session_id,issuer,subject,sid,generation) SELECT ?,?,?,?,generation FROM oa_auth_settings WHERE singleton=1 AND idp_sign_in=1 AND EXISTS(SELECT 1 FROM oa_sessions WHERE id=?)`, [session.id, issuer, subject, sid, session.id]],
+      ...recordProviderPin(providerPin, session.id),
+      [`DELETE FROM oa_invitation_cancellations WHERE operator_id=(SELECT operator_id FROM oa_sessions WHERE id=?)`, [session.id]],
+      [`UPDATE oa_operators SET status='active' WHERE status='invited' AND id=(SELECT operator_id FROM oa_sessions WHERE id=?)`, [session.id]],
+      [`UPDATE oa_tokens SET consumed_at=? WHERE id=(SELECT source_token_id FROM oa_sessions WHERE id=?)`, [now, session.id]],
+    ]);
+    return this.session(session.hash, now);
+  }
+  domainRule(domain) { return this.first('SELECT domain,provider_id AS providerId FROM oa_domain_rules WHERE domain=?', [domain]); }
+  async domainRules() { return (await this.statement('SELECT domain,provider_id AS providerId,created_at AS createdAt FROM oa_domain_rules ORDER BY domain').all()).results; }
+  async setDomainRule({ domain, providerId, now }, actor) {
+    const fence = this.actorFence(actor, now);
+    const result = providerId === null
+      ? await this.run(`DELETE FROM oa_domain_rules WHERE domain=? AND ${fence.sql}`, [domain, ...fence.args])
+      : await this.run(`INSERT INTO oa_domain_rules(domain,provider_id,created_by,created_at) SELECT ?,?,?,? WHERE ${fence.sql}
+          ON CONFLICT(domain) DO UPDATE SET provider_id=excluded.provider_id,created_by=excluded.created_by,created_at=excluded.created_at`,
+        [domain, providerId, actor.operator.id, now, ...fence.args]);
+    return result.meta.changes;
+  }
+  liftDomainRules(providerId) { return this.run('DELETE FROM oa_domain_rules WHERE provider_id=?', [providerId]); }
+  async stepUpChallenge({ id, hash, action, returnTo, now, expiresAt }, actor) {
+    const fence = this.actorFence(actor, now);
+    const result = await this.run(`INSERT INTO oa_step_up_challenges(id,token_hash,session_id,operator_id,operator_version,action,return_to,created_at,expires_at)
+      SELECT ?,?,?,?,?,?,?,?,? WHERE ${fence.sql}`, [id, hash, actor.id, actor.operator.id, actor.operator.version, action, returnTo, now, expiresAt, ...fence.args]);
+    return result.meta.changes === 1;
+  }
+  stepUpPreview(hash, now) {
+    return this.first(`SELECT c.session_id AS sessionId,c.action,c.expires_at AS expiresAt FROM oa_step_up_challenges c JOIN oa_operators o ON o.id=c.operator_id
+      WHERE c.token_hash=? AND c.consumed_at IS NULL AND c.expires_at>? AND c.operator_version=o.version AND o.status='active'`, [hash, now]);
+  }
+  // Completed only in the session that asked, while it is still valid.
+  async consumeStepUp(hash, actor, now) {
+    const fence = this.actorFence(actor, now);
+    return this.first(`UPDATE oa_step_up_challenges SET consumed_at=? WHERE token_hash=? AND session_id=? AND operator_id=? AND operator_version=?
+      AND consumed_at IS NULL AND expires_at>? AND ${fence.sql} RETURNING return_to AS returnTo, action`,
+    [now, hash, actor.id, actor.operator.id, actor.operator.version, now, ...fence.args]);
+  }
+  // A fresh app-local email-link proof for this session: a completed step-up
+  // challenge, or the email-link sign-in that created it. Provider-issued
+  // sessions have neither.
+  async steppedUp(actor, since) {
+    const row = await this.first(`SELECT EXISTS(SELECT 1 FROM oa_step_up_challenges WHERE session_id=? AND operator_version=? AND consumed_at>=?)
+      OR EXISTS(SELECT 1 FROM oa_sessions s JOIN oa_tokens t ON t.id=s.source_token_id WHERE s.id=? AND s.kind='native' AND s.created_at>=?) AS fresh`,
+    [actor.id, actor.operator.version, since, actor.id, since]);
+    return !!row?.fresh;
+  }
+}

package/modules/operator-auth/branding.mjs

@@ -0,0 +1,66 @@
+import { AuthError } from './errors.mjs';
+
+// Canonical_Combining_Class=9 (Virama), Unicode 16. JavaScript regular
+// expressions have no combining-class property, so the scalars are listed.
+const VIRAMA = '\\u{94d}\\u{9cd}\\u{a4d}\\u{acd}\\u{b4d}\\u{bcd}\\u{c4d}\\u{ccd}\\u{d3b}-\\u{d3c}\\u{d4d}\\u{dca}\\u{e3a}\\u{eba}\\u{f84}'
+  + '\\u{1039}-\\u{103a}\\u{1714}-\\u{1715}\\u{1734}\\u{17d2}\\u{1a60}\\u{1b44}\\u{1baa}-\\u{1bab}\\u{1bf2}-\\u{1bf3}\\u{2d7f}\\u{a806}\\u{a82c}'
+  + '\\u{a8c4}\\u{a953}\\u{a9c0}\\u{aaf6}\\u{abed}\\u{10a3f}\\u{11046}\\u{11070}\\u{1107f}\\u{110b9}\\u{11133}-\\u{11134}\\u{111c0}'
+  + '\\u{11235}\\u{112ea}\\u{1134d}\\u{113ce}-\\u{113d0}\\u{11442}\\u{114c2}\\u{115bf}\\u{1163f}\\u{116b6}\\u{1172b}\\u{11839}'
+  + '\\u{1193d}-\\u{1193e}\\u{119e0}\\u{11a34}\\u{11a47}\\u{11a99}\\u{11c3f}\\u{11d44}-\\u{11d45}\\u{11d97}\\u{11f41}-\\u{11f42}\\u{1612f}';
+const ZWJ_AFTER_VIRAMA = new RegExp(`(?<=\\p{L}\\p{M}*[${VIRAMA}])\\u200d`, 'gu');
+
+function validProductName(name) {
+  // Lone surrogates are not text; U+FFFC is a placeholder for an absent object.
+  if (typeof name !== 'string' || name.length > 80 || !name.isWellFormed()) return false;
+  // Braille blank is a symbol by category, but cannot make a name visible.
+  if (!/(?!\u2800)[\p{L}\p{N}\p{P}\p{S}]/u.test(name)) return false;
+  // Inspect a copy: retain script shaping and emoji presentation in the name
+  // returned to callers, while rejecting every other default-ignorable scalar.
+  const inspected = name
+    // ZWNJ after a letter, before a letter or digit, optionally across spaces (Persian "کتاب‌ ها").
+    .replace(/(?<=\p{L}\p{M}*)\u200c(?=\s*[\p{L}\p{Nd}])/gu, '')
+    .replace(/(?<=\p{L}\p{M}*)\u200d(?=\p{L})/gu, '')
+    // ZWJ after a virama forms explicit half forms and Malayalam chillu, also word-final.
+    .replace(ZWJ_AFTER_VIRAMA, '')
+    .replace(/(?<=\p{Extended_Pictographic}\ufe0f?\p{Emoji_Modifier}?)\u200d(?=\p{Extended_Pictographic})/gu, '')
+    // U+FE0F selects emoji presentation of a pictograph, or of a keycap base only inside its keycap.
+    .replace(/(?<=\p{Extended_Pictographic})\ufe0f/gu, '')
+    .replace(/(?<=[0-9#*])\ufe0f(?=\u20e3)/gu, '');
+  return !/[\u0000-\u001f\u007f-\u009f\u2028\u2029\ufffc\p{Default_Ignorable_Code_Point}]/u.test(inspected);
+}
+
+export function configureBranding(input = {}) {
+  const invalid = () => { throw new AuthError('invalid_configuration', 503); };
+  if (!input || typeof input !== 'object' || Array.isArray(input)) invalid();
+  const { productName = 'your workspace', accentColor = '#334155', signInPath = '/signin', theme } = input;
+  if (!validProductName(productName)) invalid();
+  if (typeof accentColor !== 'string' || !/^#[0-9a-f]{6}$/i.test(accentColor)) invalid();
+  if (typeof signInPath !== 'string' || !signInPath.startsWith('/') || signInPath.startsWith('//') || /[\\\u0000-\u0020\u007f-\u009f]/u.test(signInPath)) invalid();
+  if (signInPath.length > 2048) invalid();
+  // Only the configured encoding must be well formed. Decoding %25 can produce
+  // literal percent data, so subsequent inspection must tolerate it while still
+  // revealing nested separators/control characters elsewhere in the route.
+  let decoded;
+  try { decoded = decodeURIComponent(signInPath); } catch { invalid(); }
+  const decoder = new TextDecoder('utf-8', { ignoreBOM: true });
+  for (;;) {
+    if (decoded.startsWith('//') || /[\\\u0000-\u001f\u007f-\u009f]/u.test(decoded)) invalid();
+    // Replacement characters for non-UTF-8 byte sequences are inspection-only;
+    // no decoded or repaired value is ever returned to the consumer.
+    const next = decoded.replace(/(?:%[0-9a-f]{2})+/giu, (encoded) =>
+      decoder.decode(Uint8Array.from(encoded.match(/[0-9a-f]{2}/giu), (byte) => parseInt(byte, 16))));
+    if (next === decoded) break;
+    decoded = next;
+  }
+  // A seed theme is its own served rer-theme.css; Base onboarding validates its contents.
+  if (theme !== undefined && (typeof theme !== 'string' || !/^\/(?!\/)[A-Za-z0-9._~/-]{1,200}\.css$/.test(theme) || theme.includes('//') || theme.includes('/.'))) invalid();
+  return Object.freeze({ productName: productName.trim(), accentColor, signInPath, ...(theme ? { theme } : {}) });
+}
+
+/** WCAG relative luminance chooses readable text for any permitted brand color. */
+export function accentInk(color) {
+  const channels = [1, 3, 5].map((offset) => parseInt(color.slice(offset, offset + 2), 16) / 255)
+    .map((value) => value <= 0.04045 ? value / 12.92 : ((value + 0.055) / 1.055) ** 2.4);
+  const luminance = channels[0] * 0.2126 + channels[1] * 0.7152 + channels[2] * 0.0722;
+  return luminance > 0.179 ? '#000000' : '#ffffff';
+}

package/modules/operator-auth/config.mjs

@@ -0,0 +1,35 @@
+import { configureBranding } from './branding.mjs';
+import { AuthError } from './errors.mjs';
+import { normalizeEmail } from './policy.mjs';
+import { isLoopbackHost, localCookieName } from './http.mjs';
+function seconds(value, fallback, max) {
+  const n = value ?? fallback;
+  if (!Number.isSafeInteger(n) || n < 1 || n > max) throw new AuthError('invalid_configuration', 503);
+  return n;
+}
+export function configure(input) {
+  let url;
+  try { url = new URL(input.origin); } catch { throw new AuthError('invalid_configuration', 503); }
+  const local = input.local === true;
+  if (url.origin !== input.origin || url.username || url.password || (local ? (!isLoopbackHost(url.hostname) || !['http:', 'https:'].includes(url.protocol)) : url.protocol !== 'https:')) throw new AuthError('invalid_configuration', 503);
+  if (typeof input.SESSION_SECRET !== 'string' || input.SESSION_SECRET.length < 32 || input.SESSION_SECRET.length > 1024) throw new AuthError('invalid_configuration', 503);
+  if (input.SETUP_TOKEN !== undefined && (typeof input.SETUP_TOKEN !== 'string' || input.SETUP_TOKEN.length < 32 || input.SETUP_TOKEN.length > 1024)) throw new AuthError('invalid_configuration', 503);
+  const cookieName = local ? localCookieName('operator_session_local', input.origin) : '__Host-operator_session';
+  // Identity providers are validated in full by identity/oidc; here only the
+  // shape and the independent transaction secret they need.
+  const providers = input.providers ?? [];
+  if (!Array.isArray(providers) || providers.length && (typeof input.OIDC_TRANSACTION_SECRET !== 'string' || input.OIDC_TRANSACTION_SECRET.length < 32
+    || input.OIDC_TRANSACTION_SECRET === input.SESSION_SECRET)) throw new AuthError('invalid_configuration', 503);
+  const externalIssuers = input.externalIssuers ?? [];
+  if (!Array.isArray(externalIssuers) || externalIssuers.some((v) => { try { const u = new URL(v); return u.protocol !== 'https:' || !!u.username || !!u.password || !!u.hash || !!u.search; } catch { return true; } })) throw new AuthError('invalid_configuration', 503);
+  return Object.freeze({
+    ...input, branding: configureBranding(input.branding), local, secure: url.protocol === 'https:', cookieName, OWNER_EMAIL: normalizeEmail(input.OWNER_EMAIL), externalIssuers: Object.freeze([...externalIssuers]), providers: Object.freeze([...providers]),
+    review: input.review ? Object.freeze({ ...input.review, operatorEmail: normalizeEmail(input.review.operatorEmail) }) : undefined,
+    allowList: input.allowList === undefined ? undefined : input.allowList.map(normalizeEmail),
+    sessionSeconds: seconds(input.sessionSeconds, 7 * 86400, 30 * 86400),
+    linkSeconds: seconds(input.linkSeconds, 900, 3600),
+    reviewSeconds: seconds(input.reviewSeconds, 3600, 3600),
+    limitWindowSeconds: seconds(input.limitWindowSeconds, 900, 86400),
+    ipLimit: seconds(input.ipLimit, 30, 10000), emailLimit: seconds(input.emailLimit, 5, 1000),
+  });
+}