@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/operator-auth/service.mjs

@@ -0,0 +1,152 @@
+// Composed identity over Base's OA accounts, or an explicitly paired native
+// accounts/proof adapter. Native composition never constructs the OA store.
+import { fencedCredentials } from './accounts/credentials.mjs';
+import { providerControl } from './accounts/provider-control.mjs';
+import { linkedProviders } from '../dependencies/auth.mjs';
+import { createEmailLinkLifecycle } from './identity/email-link/index.mjs';
+import { createNativeAuth } from './accounts/native.mjs';
+import { AuthError, deny } from './errors.mjs';
+import { configure } from './config.mjs';
+import { constantEqual } from './crypto.mjs';
+import { normalizeEmail } from './policy.mjs';
+import { requirePost, requireLoopback, readCookie, sessionCookie } from './http.mjs';
+import { AuthStore } from './accounts/store.mjs';
+import { administration, displayName } from './accounts/admin.mjs';
+import { emailAllowed, isActiveOperator, defaultRolePolicy } from './accounts/roles.mjs';
+import { oaSessions, createOaAccounts } from './accounts/oa.mjs';
+import { createAdmission, legacyAdmission } from './identity/admission.mjs';
+import { createOidcProviders } from './identity/oidc/index.mjs';
+import { isLocalCli } from './local-cli.mjs';
+import { devAdmitted } from './dev-admission.mjs';
+
+export { STEP_UP_ACTIONS, STEP_UP_SECONDS } from './identity/email-link/index.mjs';
+export function createOperatorAuth(options) {
+  const { db, config: input, mailSender, clientIp, rolePolicy = defaultRolePolicy, clock = Date.now, hooks = {}, fetch, waitUntil, accounts: nativeAccounts, proofs } = options;
+  const config = configure(input);
+  if (typeof clientIp !== 'function') throw new AuthError('client_ip_required', 503);
+  if (!hooks || typeof hooks !== 'object' || ['beforeMagicLink', 'afterConfirm'].some(name => hooks[name] !== undefined && typeof hooks[name] !== 'function')) throw new AuthError('invalid_configuration', 503);
+  if (Object.hasOwn(options, 'accounts') || Object.hasOwn(options, 'proofs')) return createNativeAuth({ db, config, accounts: nativeAccounts, proofs, mailSender, clientIp, clock, hooks, fetch, waitUntil });
+  const store = new AuthStore(db);
+  const sessions = oaSessions({ config, store, clock });
+  const { hash, newSession, completed, authenticate } = sessions;
+  const accounts = createOaAccounts({ config, store, clock, sessions, rolePolicy });
+  const admission = createAdmission({ accounts, config, clock, hooks });
+  const policyVersion = async () => (await store.first('SELECT generation FROM oa_auth_settings WHERE singleton=1'))?.generation ?? -1;
+  const staticProviders = config.providers.length ? createOidcProviders({ admission, db, clientIp, clock, waitUntil, policyVersion, enabled: () => accounts.identityEnabled(), ...(fetch ? { fetch } : {}),
+    config: { origin: config.origin, local: config.local, transactionSecret: config.OIDC_TRANSACTION_SECRET, providers: config.providers, signInPath: config.branding.signInPath,
+      timeoutMs: config.identityTimeoutMs, startLimit: config.identityStartLimit } }) : null;
+  const providers = linkedProviders({ db, config, admission, clientIp, clock, waitUntil, fetch, staticProviders, policyVersion, enabled: () => accounts.identityEnabled() });
+  // A domain's required provider refuses the email link and every other
+  // non-provider route; owners are exempt.
+  async function requireRoute(operator) {
+    if (operator.role === 'owner' && operator.status === 'active') return;
+    if (await accounts.requiredProvider(operator.email)) deny('provider_required');
+  }
+  async function authorizedLink(request, digest) {
+    const link = await store.preview(digest, clock());
+    if (!link || !emailAllowed(link.email, config.allowList)) return null;
+    if (link.dev && !await devAdmitted(request)) return null;
+    if (link.kind !== 'invite') return { link };
+    const issuer = await store.operator(link.issuerId);
+    if (!isActiveOperator(issuer, config.allowList) || issuer.version !== link.issuerVersion
+      || !await rolePolicy({ actor: issuer, action: 'operators:invite', role: link.role })) return null;
+    return { link, issuer };
+  }
+  const email = createEmailLinkLifecycle({ config, clock, mailSender, clientIp, hash, hooks: { beforeMagicLink: hooks.beforeMagicLink }, afterConfirm: admission.afterConfirm,
+    persistence: {
+      authenticate, requiredProvider: value => accounts.requiredProvider(value),
+      limits: (...args) => store.limits(...args), byEmail: value => store.byEmail(value), token: value => store.token(value),
+      authorizedLink, stepUpPreview: (...args) => store.stepUpPreview(...args), consumeStepUp: (...args) => store.consumeStepUp(...args),
+      stepUpChallenge: (...args) => store.stepUpChallenge(...args), steppedUp: (...args) => store.steppedUp(...args),
+      revokeLink: (id, now) => store.run('UPDATE oa_tokens SET revoked_at=? WHERE id=?', [now, id]),
+      revokeStepUp: id => store.run('UPDATE oa_step_up_challenges SET expires_at=0 WHERE id=?', [id]),
+      async consumeLink({ digest, approval, now }) {
+        await requireRoute({ email: approval.link.email, role: approval.link.role, status: approval.link.kind === 'invite' ? 'invited' : 'active' });
+        const session = await newSession();
+        const record = await store.consume(digest, now, session, config.allowList, approval.issuer);
+        return completed(session, record, record?.returnTo);
+      },
+    } });
+  const { limit, newToken, sendLink, requireFreshProof } = email;
+  const admin = administration({ config, store, clock, authorize: rolePolicy, authenticate, newToken, sendLink, limit, requireFreshProof, providers });
+  const external = legacyAdmission({ admission, config });
+  return Object.freeze({
+    ...admin,
+    ...providerControl({ store, accounts, authenticate, config, clock }),
+    ...fencedCredentials({store,authenticate,requireFreshProof,config,clock,hash}),
+    presentation: config.branding,
+    /** Identity providers (null when none is configured): routes, the sign-in page's list and owner actions. */
+    providers,
+    /** The admission identity methods use: a verified principal in, a session out. */
+    admission,
+    /** Base's accounts adapter over the oa_ store. */
+    accounts,
+    async authorizeDependencySetup(request, { token }) {
+      requirePost(request, config);
+      if (!await isLocalCli(request, config) && (!config.SETUP_TOKEN || typeof token !== 'string' || token.length > 1024 || !constantEqual(await hash('setup', token), await hash('setup', config.SETUP_TOKEN)))) deny('invalid_setup_token',403);
+      if (await accounts.owner()) deny('already_initialized',409);
+      return true;
+    },
+    async completeLocalSetup(request) {
+      requirePost(request, config);
+      if (!await isLocalCli(request, config) || !await accounts.owner()) deny('owner_required',403);
+      await store.run('UPDATE oa_auth_settings SET first_setup=0 WHERE singleton=1');
+      return {complete:true};
+    },
+    async getSession(request) {
+      const value = await authenticate(request);
+      if (!value) return null;
+      const { hash: _, ...session } = value;
+      return session;
+    },
+    async bootstrap(request, { token, displayName: name, returnTo }) {
+      requirePost(request, config);
+      await limit(request, config.OWNER_EMAIL, 'bootstrap');
+      if (!config.SETUP_TOKEN || typeof token !== 'string' || token.length > 1024 || !constantEqual(await hash('setup', token), await hash('setup', config.SETUP_TOKEN))) deny('invalid_setup_token', 403);
+      if (!emailAllowed(config.OWNER_EMAIL, config.allowList)) deny('email_not_allowed');
+      const session = await newSession();
+      const record = await store.bootstrap({ id: crypto.randomUUID(), email: config.OWNER_EMAIL, displayName: displayName(name), now: clock(), session });
+      if (!record) deny('already_initialized', 409);
+      return completed(session, record, returnTo);
+    },
+    requestMagicLink: email.requestMagicLink,
+    previewLink: email.previewLink,
+    confirmLink: email.confirmLink,
+    async signOut(request) {
+      requirePost(request, config);
+      const token = readCookie(request, config);
+      if (token) await store.run('UPDATE oa_sessions SET revoked_at=COALESCE(revoked_at,?) WHERE token_hash=?', [clock(), await hash('session', token)]);
+      return { cookie: sessionCookie('', config, 0) };
+    },
+    async issueReviewSession(request, { returnTo } = {}) {
+      // Evaluate Host before flags so every non-loopback attempt is 403.
+      requireLoopback(request);
+      requirePost(request, config);
+      if (config.review?.enabled !== true) deny('review_disabled', 403);
+      const email = normalizeEmail(config.review.operatorEmail);
+      await limit(request, email, 'review');
+      const operator = await store.byEmail(email);
+      if (!isActiveOperator(operator, config.allowList)) deny();
+      await requireRoute(operator);
+      const session = await newSession('review');
+      const record = await store.issue({ operatorId: operator.id, expectedVersion: operator.version, session, now: clock(), kind: 'review' });
+      return completed(session, record, returnTo);
+    },
+    ...external,
+    // Compatibility seam for an edition's real credential verifier. Never expose
+    // this method as an HTTP endpoint accepting an unverified operator ID. A
+    // provider binding revokes the operator's password: it no longer admits.
+    async admitVerifiedPassword(request, operatorId, { returnTo } = {}) {
+      requirePost(request, config);
+      const operator = await store.operator(operatorId);
+      if (!isActiveOperator(operator, config.allowList)) deny();
+      await requireRoute(operator);
+      if (await store.hasBinding(operator.id)) deny('password_revoked');
+      const session = await newSession('password');
+      const record = await store.issue({ operatorId, expectedVersion: operator.version, session, now: clock(), kind: 'password' });
+      return completed(session, record, returnTo);
+    },
+    requestStepUp: email.requestStepUp,
+    requireStepUp: email.requireStepUp,
+  });
+}

package/modules/operator-auth/signin/index.mjs

@@ -0,0 +1,67 @@
+// The one sign-in page every Base seed mounts. Server-rendered plain HTML forms:
+// it works before any script loads (and without one). It lists "Continue
+// with…" for each linked, reachable provider and always offers the email link;
+// a hidden provider's button is simply absent.
+import { escapeHtml } from '../http.mjs';
+import { safeReturnTo } from '../policy.mjs';
+import { pageResponse } from '../page.mjs';
+
+const NOTICES = {
+  sent: ['status', 'If this address can sign in here, a sign-in link is on its way. Open it on this device and press Confirm.'],
+  step_up_sent: ['status', 'A confirmation link is on its way to your email address. Open it in this browser to continue.'],
+  signed_out: ['status', 'You are signed out.'],
+  rate_limited: ['alert', 'Too many attempts. Wait a few minutes and try again.'],
+  mail_unavailable: ['alert', 'Sign-in email is not available right now. Ask the person who runs this app to check its mail settings.'],
+  invalid_email: ['alert', 'Enter a complete email address.'],
+  invalid_input: ['alert', 'Enter a complete email address.'],
+  provider_required: ['alert', 'Your organisation requires its own sign-in provider for this address.'],
+  oidc_provider_required: ['alert', 'Your organisation requires its own sign-in provider for this address.'],
+  oidc_admission_denied: ['alert', 'That account cannot sign in here. Use the email link, or ask an owner of this app for an invitation.'],
+  oidc_provider_denied: ['alert', 'Sign-in was cancelled at the provider.'],
+};
+const UNAVAILABLE = ['alert', 'That sign-in provider is not available right now. Use the email link instead.'];
+const UNFINISHED = ['alert', 'Signing in with that provider did not finish. Try again, or use the email link.'];
+function noticeFor(code) {
+  if (typeof code !== 'string') return null;
+  if (Object.hasOwn(NOTICES, code)) return NOTICES[code];
+  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return UNAVAILABLE;
+  return code.startsWith('oidc_') ? UNFINISHED : null;
+}
+const hidden = returnTo => `<input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}">`;
+
+/**
+ * Handles GET and HEAD of the configured sign-in path; null for anything else.
+ * setup(request) may return { instructions } while the first owner is unclaimed;
+ * links(request) may return [{ href, label }] shown under the form (same-origin paths only).
+ */
+export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/app' } = {}) {
+  const path = new URL(auth.presentation.signInPath, 'https://signin.invalid').pathname;
+  return async function signIn(request) {
+    const url = new URL(request.url);
+    if (url.pathname !== path || !['GET', 'HEAD'].includes(request.method)) return null;
+    const branding = auth.presentation;
+    const returnTo = safeReturnTo(url.searchParams.get('returnTo'), defaultReturnTo);
+    const providers = auth.providers ? (await auth.providers.list()).filter(p => p.visible) : [];
+    const parts = [];
+    const notice = noticeFor(url.searchParams.get('notice'));
+    if (notice) {
+      const required = providers.find(p => p.id === url.searchParams.get('provider'));
+      const extra = required ? ` Addresses at this domain sign in with ${escapeHtml(required.label)}.` : '';
+      parts.push(`<p class="notice" role="${notice[0]}">${escapeHtml(notice[1])}${extra}</p>`);
+    }
+    if (providers.length) {
+      parts.push(`<div class="stack">${providers.map(p => `<form method="post" action="${escapeHtml(p.startPath)}">${hidden(returnTo)}<button class="secondary" type="submit">Continue with ${escapeHtml(p.label)}</button></form>`).join('')}</div>`);
+      parts.push('<p class="divider">or</p>');
+    }
+    parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
+    for (const link of (await links?.(request)) ?? []) {
+      if (typeof link?.href === 'string' && /^\/(?!\/)[^\s\\]*$/.test(link.href) && typeof link.label === 'string') parts.push(`<p class="secondary-link"><a href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></p>`);
+    }
+    const firstOwner = await setup?.(request);
+    if (firstOwner) {
+      parts.push(`<h2>Set up the first owner</h2><p>${escapeHtml(firstOwner.instructions ?? 'Use the setup token from your deployment.')}</p><form method="post" action="/auth/bootstrap">${hidden(returnTo)}<label for="setup-name">Your name</label><input id="setup-name" name="displayName" autocomplete="name" required maxlength="120"><label for="setup-token">Setup token</label><input id="setup-token" name="token" type="password" autocomplete="off" required><button type="submit">Create owner and sign in</button></form>`);
+    }
+    const formTargets = [...new Set(providers.flatMap(p => p.authorizationOrigins))];
+    return pageResponse({ branding, heading: `Sign in to ${escapeHtml(branding.productName)}`, content: parts.join(''), method: request.method, referrer: 'strict-origin', formTargets });
+  };
+}

package/modules/owner-claim/README.md

@@ -0,0 +1,137 @@
+# Signed owner claim
+
+This optional server-only module lets an installation owner claim an adopted
+application using a five-minute Run Edit Run signature. It calls the existing
+`createOperatorAuth().bootstrap()` with the application's hidden setup token.
+The owner never receives that token. An existing operator or bootstrap ledger
+permanently prevents another claim, including after the consumed claim expires.
+
+## Adopting this module
+
+1. Copy `modules/owner-claim/` and `modules/operator-auth/` together as source;
+   preserve their relative paths. Apply `operator-auth/accounts/schema/operator-auth.sql`
+   to a fresh store, then `owner-claim/schema/owner-claim.sql`, each as a new
+   numbered application migration. Preserve existing migrations and ledgers.
+2. Provision an independent random `SESSION_SECRET` (32 random bytes or more)
+   through trusted secret provisioning. The signed manifest names a required,
+   hidden generated setup-token field; the platform creates and stores its value
+   encrypted when the owner saves the plan. Map that field to the app's
+   `SETUP_TOKEN` configuration. Keep both secrets server-side; never include
+   either in browser bundles, claims or logs. The app's deployment configuration
+   must also supply the trusted RER issuer, installation ID, exact application
+   origin, canonical owner email and public signing-key ring. Claims are never a
+   configuration source.
+3. Mount this handler before the operator-auth dispatcher; it owns only
+   `/auth/owner-claim`. Continue protecting application routes with real
+   operator-auth sessions. Never expose a server function taking authConfig or
+   verified payload fields from browser input.
+4. Declare the release setup manifest's owner claim step with
+   `type: 'owner-claim'`, `mode: 'signed'`, `emailField` naming the public
+   owner-email setup field, `path: '/auth/owner-claim'`, and `tokenField` naming
+   the private hidden setup-token field. Map the manifest field named by
+   `emailField` to both `authConfig.OWNER_EMAIL` and
+   `expectedEmail`; map the generated secret named by `tokenField` to
+   `authConfig.SETUP_TOKEN`. Map deployment installation ID and application
+   origin to `installationId` and `appOrigin`.
+   Use only the exact field names accepted by your pinned SETUP schema.
+   Declare signed mode only in a new release containing this handler/migration.
+   Existing releases which accept only setup-token must keep legacy claim mode.
+5. Include the module's tests in the application's CI. Re-run the real workerd
+   tests on operator-auth updates; bootstrap SQL changes intentionally fail
+   closed and need an explicit adapter review.
+
+```js
+import { createOwnerClaimHandler } from './modules/owner-claim/index.mjs';
+
+// Map the manifest emailField to OWNER_EMAIL and tokenField to SETUP_TOKEN in
+// trusted app config. The platform supplies the fixed issuer, installation,
+// app-origin and public-key values below; never derive them from a request.
+const appOrigin = env.RER_OWNER_CLAIM_APP_ORIGIN;
+const ownerEmail = env.OWNER_EMAIL;
+const claim = createOwnerClaimHandler({
+  db: env.DB,
+  authConfig: {
+    origin: appOrigin, OWNER_EMAIL: ownerEmail,
+    SESSION_SECRET: env['SESSION_SECRET'], SETUP_TOKEN: env['SETUP_TOKEN'],
+  },
+  clientIp: request => request.headers.get('CF-Connecting-IP') ?? '',
+  issuer: env.RER_OWNER_CLAIM_ISSUER,
+  installationId: env.RER_OWNER_CLAIM_INSTALLATION_ID,
+  appOrigin,
+  expectedEmail: ownerEmail, // canonical lowercase configured email
+  publicKeys: JSON.parse(env.RER_OWNER_CLAIM_PUBLIC_KEYS),
+});
+const response = await claim(request); // null means another dispatcher owns it
+```
+
+Use an infrastructure-authenticated client IP. For explicit local development,
+operator-auth supports `local:true` and literal loopback HTTP with a matching
+Host; production origins are HTTPS. Missing configuration fails closed. Public
+key rotation may overlap old and new kids for the five-minute window, then remove
+the old kid. Public keys are EC/P-256 JWKs, never private JWKs; missing/unknown kids
+and untrusted issuers fail. Config is snapshotted when the handler is created.
+Remove the hidden setup token after successful bootstrap as part of ordinary
+application secret maintenance; never delete either admission ledger.
+
+## Wire and browser transport
+
+`verifyOwnerClaim(token, config)` validates compact JWS ES256, a 64-byte P1363
+signature, and an exact protected header `{alg:'ES256',typ:'rer-owner-claim+jwt',kid}`.
+The exact payload fields are `{v:1,iss,aud,installationId,email,jti,iat,exp}`.
+`aud` is the exact app origin; `iss` is the configured RER origin; `jti` is a UUID.
+`iat` and `exp` are integer epoch seconds: issuance may be at most 30 seconds
+ahead of the consumer clock, inclusive. Expiry must be strictly in the future
+with no expiry tolerance; `exp` must exceed `iat` and their difference must be
+at most 300 seconds. These time bounds are checked at verification and again
+immediately before the atomic admission batch. Config fields are
+`{issuer,installationId,appOrigin,expectedEmail,publicKeys,now?}`; `now` is optional
+epoch seconds. The async verifier returns a frozen claim or throws
+`OwnerClaimError`. The handler's optional `clock` returns milliseconds.
+
+The installation screen opens the bare `/auth/owner-claim` page. Its confirmation
+GET/HEAD writes zero and issues no cookie. The page sends
+`{type:'rer-owner-claim-ready'}` to its opener at the configured issuer. The
+installation checks the popup source and exact application origin before sending
+`{type:'rer-owner-claim',token}` to that origin. The consumer accepts only that
+opener and exact issuer, retains the token in its in-memory form, clears its
+opener, and waits for the owner to press Claim your workspace. Native form POST
+carries the token in the body and the exact Origin; its 303 supplies the existing
+auth cookie and a safe local redirect. JSON POST accepts the same `token`, optional
+`displayName` and `returnTo` fields. It accepts no email/config overrides.
+
+Never place claims in URLs, fragments, history, browser storage, logs or durable
+installation records. RER returns a token only in the authorized owner's response.
+Query/fragment credentials and duplicate body fields are rejected. Every response
+is no-store. Confirmation uses a nonce CSP and `strict-origin` Referrer-Policy so
+native POST retains Origin; the URL never contains credentials. Browser opener
+isolation policies must permit the initial cross-origin handshake; do not apply
+COOP `same-origin` to these two cooperating screens.
+
+## Atomic admission and checks
+
+Operator-auth normally commits rate limits before bootstrap. A request-local D1
+adapter reads actual existing limit counters and projects the real UPSERT result
+without writing. It defers those unchanged UPSERTs until the real bootstrap's
+unchanged three-statement batch. One D1 transaction inserts the single-use claim,
+checks an empty auth store, runs the original limits and bootstrap SQL, then
+checks owner/session identity and actual limit thresholds before committing.
+A SQL CHECK failure or racing claim rolls the entire batch back. No application
+mock, substitute owner/session creation, in-memory lock or retry is involved.
+The adapter accepts only that exact SQL protocol and never serves other auth APIs.
+
+Invalid signatures, expiry, audiences, issuer, email, request origin, unknown key,
+replay and already-initialized stores cause zero durable writes, including rate
+limits. Valid claims preserve auth's durable limiter, cookie, allow-list and
+session policy. The claim table stores only binding metadata and IDs, never the
+raw credential. Keep this ledger permanently; rolling application code back
+must retain migrations and admission state.
+
+Run `node --test --test-concurrency=1 modules/owner-claim/tests/*.test.mjs`.
+The suite uses ephemeral test-only keys, deterministic verifier/transaction clock
+boundaries with a test-only SQLite adapter, actual workerd+D1 with per-table write
+audits, concurrent claims, restart/replay, forced SQL rollback and exhausted real
+rate limits. Chromium exercises 1440/390 confirmation, opener transport, native
+Origin-preserving POST and a real authenticated session. Runtime fixtures are
+never exported or deployed. Declarations are `index.d.mts`; verifier-only copying
+uses `verify.mjs` without auth imports. Local runtime/browser proof is distinct
+from deployed application adoption and hosted-provider acceptance.

package/modules/owner-claim/idp.mjs

@@ -0,0 +1,40 @@
+import { configure } from '../operator-auth/config.mjs';
+import { createOperatorAuth } from '../operator-auth/service.mjs';
+import { requirePost, securityHeaders } from '../operator-auth/http.mjs';
+import { readInput } from '../operator-auth/input.mjs';
+import { parseIdToken, verifySignature } from '../operator-auth/identity/oidc/jwt.mjs';
+import { readJson } from '../operator-auth/identity/oidc/network.mjs';
+import { dependencyStore } from '../dependencies/store.mjs';
+import { insist, NETWORK } from '../dependencies/protocol.mjs';
+import { bootstrapTransaction } from './transaction.mjs';
+
+// install_owner is a single-use installation grant. It never participates in roles.
+export function createIdpOwnerClaimHandler({db,authConfig,clientIp,clock=Date.now,fetch:fetcher=globalThis.fetch,expectedPin}) {
+ const config=configure(authConfig);
+ return async request=>{
+  const url=new URL(request.url);if(url.pathname!=='/auth/owner-claim')return null;
+  try {
+   requirePost(request,config);insist(!url.search && !url.hash);
+   const input=await readInput(request);insist(Object.keys(input).every(k=>['token','displayName','returnTo'].includes(k)));
+   const store=dependencyStore(db),link=await store.link(),installation=await store.first('SELECT sector_id FROM rer_dependency_installation WHERE singleton=1');
+   insist(link && !link.needs_relink && installation,'provider_unlinked',403);
+   const pin=await store.first("SELECT provider_id AS id,issuer,client_id AS clientId,linked_at AS linkedAt FROM oa_identity_providers WHERE provider_id='auth' AND status='linked'");
+   insist(pin && pin.issuer===link.issuer && pin.clientId===link.client_id && (!expectedPin || ['id','issuer','clientId','linkedAt'].every(k=>pin[k]===expectedPin[k])),'provider_unlinked',403);
+   const parsed=parseIdToken(input.token,{algorithms:link.metadata.algorithms});
+   await verifySignature(parsed,await readJson(fetcher,link.metadata.jwks,NETWORK));
+   const c=parsed.claims,g=c.install_owner,now=Math.floor(clock()/1000);
+   insist(c.iss===link.issuer && c.aud===link.client_id && typeof c.sub==='string' && c.sub.length>0 && c.sub.length<=255);
+   insist(!Object.hasOwn(c,'events') && !c.amr?.includes('dev'));
+   insist(Number.isSafeInteger(c.iat) && Number.isSafeInteger(c.exp) && c.iat<=now+30 && c.exp>now && c.exp>c.iat && c.exp-c.iat<=300);
+   insist(typeof c.jti==='string' && c.jti.trim().length>0 && c.jti.length<=256);
+   insist(g && typeof g==='object' && g.client_id===link.client_id && g.sector_id===installation.sector_id && g.subject===c.sub && g.email===config.OWNER_EMAIL,'invalid_owner_grant',403);
+   insist(c.sid===undefined || typeof c.sid==='string' && c.sid.length>0 && c.sid.length<=255);
+   insist(c.nbf===undefined || Number.isSafeInteger(c.nbf) && c.nbf<=now+30);
+   insist(c.email===config.OWNER_EMAIL && c.email_verified===true && Number.isSafeInteger(c.email_verified_at) && c.email_verified_at<=now+30 && c.email_verified_at>=now-30*86400,'email_proof_required',403);
+   const claim={email:config.OWNER_EMAIL,installationId:installation.sector_id,jti:c.jti,iat:c.iat,exp:c.exp,identity:{issuer:c.iss,subject:c.sub,clientId:link.client_id,sid:c.sid??null,metadata:JSON.stringify(link.metadata),linkedAt:link.linked_at,pin}};
+   const admission=createOperatorAuth({db:bootstrapTransaction(db,claim,config,clock),config,clientIp,clock});
+   const result=await admission.bootstrap(request,{token:config.SETUP_TOKEN,displayName:input.displayName??'Owner',returnTo:input.returnTo});
+   return new Response(null,{status:303,headers:{...securityHeaders(),'Set-Cookie':result.cookie,Location:result.returnTo}});
+  }catch(e){return Response.json({error:e.code??'invalid_owner_grant'},{status:e.status??400,headers:securityHeaders()});}
+ };
+}

package/modules/owner-claim/index.d.mts

@@ -0,0 +1,27 @@
+import type { AuthConfig, Database } from '../operator-auth/index.mjs';
+export interface OwnerClaimConfig {
+  /** Trusted exact Run Edit Run origin. */
+  issuer: string;
+  installationId: string;
+  appOrigin: string;
+  /** Canonical lowercase configured owner email; never taken from the token. */
+  expectedEmail: string;
+  publicKeys: Record<string, JsonWebKey>;
+}
+export interface OwnerClaim {
+  v: 1; iss: string; aud: string; installationId: string; email: string;
+  jti: string; iat: number; exp: number;
+}
+export class OwnerClaimError extends Error { constructor(code?: string, status?: number); code: string; status: number }
+export function verifyOwnerClaim(token: string, config: OwnerClaimConfig & { /** Epoch seconds. */ now?: number }): Promise<Readonly<OwnerClaim>>;
+export interface OwnerClaimHandlerOptions extends OwnerClaimConfig {
+  db: Database;
+  /** Includes the server-only hidden SETUP_TOKEN and SESSION_SECRET. */
+  authConfig: AuthConfig;
+  clientIp: (request: Request) => string | Promise<string>;
+  /** Milliseconds, default Date.now. */
+  clock?: () => number;
+}
+export function createOwnerClaimHandler(options: OwnerClaimHandlerOptions): (request: Request) => Promise<Response | null>;
+
+export function createIdpOwnerClaimHandler(options:{db:import('../operator-auth/index.mjs').Database;authConfig:import('../operator-auth/index.mjs').AuthConfig;clientIp:(request:Request)=>string|Promise<string>;clock?:()=>number;fetch?:typeof fetch}):(request:Request)=>Promise<Response|null>;

package/modules/owner-claim/index.mjs

@@ -0,0 +1,39 @@
+import { createOperatorAuth, AuthError } from '../operator-auth/index.mjs';
+import { configure } from '../operator-auth/config.mjs';
+import { requireOrigin, requirePost, securityHeaders } from '../operator-auth/http.mjs';
+import { readInput } from '../operator-auth/input.mjs';
+import { OwnerClaimError, configureClaim, verifyOwnerClaim } from './verify.mjs';
+import { bootstrapTransaction } from './transaction.mjs';
+import { confirmationPage } from './page.mjs';
+export { OwnerClaimError, verifyOwnerClaim } from './verify.mjs';
+
+export function createOwnerClaimHandler({ db, authConfig, clientIp, clock = Date.now, ...input }) {
+  const config = configureClaim(input);
+  const auth = configure(authConfig);
+  if (auth.origin !== config.appOrigin || auth.OWNER_EMAIL !== config.expectedEmail || !auth.SETUP_TOKEN
+    || typeof clientIp !== 'function' || typeof clock !== 'function' || !db?.prepare || !db?.batch) throw new OwnerClaimError('invalid_configuration', 503);
+  return async request => {
+    const url = new URL(request.url);
+    if (url.pathname !== '/auth/owner-claim') return null;
+    try {
+      requireOrigin(request, auth);
+      // Credential URLs are never accepted, including legacy query transport.
+      if (url.search || url.hash) throw new OwnerClaimError('invalid_input', 400);
+      if (request.method === 'GET' || request.method === 'HEAD') return confirmationPage(config, request.method === 'HEAD');
+      requirePost(request, auth);
+      const data = await readInput(request);
+      if (Object.keys(data).some(key => !['token', 'displayName', 'returnTo'].includes(key))) throw new OwnerClaimError('invalid_input', 400);
+      const claim = await verifyOwnerClaim(data.token, { ...config, now: Math.floor(clock() / 1000) });
+      const initialized = await db.prepare('SELECT 1 AS present FROM oa_bootstrap UNION ALL SELECT 1 FROM oa_operators UNION ALL SELECT 1 FROM oc_owner_claims LIMIT 1').first();
+      if (initialized) throw new OwnerClaimError('claim_unavailable', 409);
+      const admission = createOperatorAuth({ db: bootstrapTransaction(db, claim, auth, clock), config: auth, clientIp, clock });
+      const result = await admission.bootstrap(request, { token: auth.SETUP_TOKEN, displayName: data.displayName ?? 'Owner', returnTo: data.returnTo });
+      return new Response(null, { status: 303, headers: { ...securityHeaders(), 'Set-Cookie': result.cookie, Location: result.returnTo } });
+    } catch (error) {
+      const known = error instanceof OwnerClaimError || error instanceof AuthError;
+      return Response.json({ error: known ? error.code : 'claim_unavailable' }, { status: known ? error.status : 503, headers: securityHeaders() });
+    }
+  };
+}
+
+export { createIdpOwnerClaimHandler } from './idp.mjs';

package/modules/owner-claim/page.mjs

@@ -0,0 +1,11 @@
+import { escapeHtml, securityHeaders } from '../operator-auth/http.mjs';
+export function confirmationPage(config, head = false) {
+  const nonce = btoa(crypto.randomUUID());
+  const issuer = JSON.stringify(config.issuer).replaceAll('<', '\\u003c');
+  const script = `const issuer=${issuer};const source=window.opener;const form=document.querySelector('form');const message=document.querySelector('[role=status]');let received=false;
+window.addEventListener('message',event=>{if(received||!source||event.source!==source||event.origin!==issuer||event.data?.type!=='rer-owner-claim'||typeof event.data.token!=='string'||event.data.token.length>8192)return;received=true;form.elements.token.value=event.data.token;form.querySelector('button').disabled=false;message.textContent='Ready to claim your workspace.';window.opener=null;});
+if(source)source.postMessage({type:'rer-owner-claim-ready'},issuer);else message.textContent='Open this confirmation from your installation in Run Edit Run.';`;
+  const headers = { ...securityHeaders(), 'Content-Type': 'text/html; charset=utf-8', 'Referrer-Policy': 'strict-origin',
+    'Content-Security-Policy': `default-src 'none'; script-src 'nonce-${nonce}'; style-src 'nonce-${nonce}'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'` };
+  return new Response(head ? null : `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Claim your workspace</title><style nonce="${nonce}">*{box-sizing:border-box}body{margin:0;font:16px/1.5 system-ui;background:#f5f7fb;color:#182130}main{max-width:32rem;margin:8vh auto;padding:2rem}label{display:block;margin:1rem 0 .3rem}input,button{width:100%;font:inherit;padding:.7rem;border:1px solid #687385;border-radius:.4rem}button{margin-top:1.5rem;background:#183dad;color:white}button:disabled{background:#566274}h1{font-size:2rem;line-height:1.2}p{overflow-wrap:anywhere}</style></head><body><main><h1>Claim your workspace</h1><p>Confirm to create your owner account and sign in.</p><form method="post" action="/auth/owner-claim"><label for="email">Owner email</label><input id="email" type="email" value="${escapeHtml(config.expectedEmail)}" readonly><label for="name">Your name</label><input id="name" name="displayName" autocomplete="name" maxlength="100" value="Owner" required><input type="hidden" name="token"><button disabled>Claim your workspace</button></form><p role="status">Waiting for your secure claim.</p></main><script nonce="${nonce}">${script}</script></body></html>`, { headers });
+}

package/modules/owner-claim/schema/idp.sql

@@ -0,0 +1,4 @@
+CREATE TABLE IF NOT EXISTS oc_idp_grants (
+ issuer TEXT NOT NULL, client_id TEXT NOT NULL, jti TEXT NOT NULL, subject TEXT NOT NULL, sector_id TEXT NOT NULL,
+ PRIMARY KEY(issuer,client_id), UNIQUE(issuer,jti)
+);

package/modules/owner-claim/schema/owner-claim.sql

@@ -0,0 +1,18 @@
+-- Apply after operator-auth.sql as a new numbered migration. Never prune this ledger.
+CREATE TABLE oc_owner_claims (
+  singleton INTEGER PRIMARY KEY CHECK(singleton=1),
+  jti TEXT NOT NULL UNIQUE,
+  installation_id TEXT NOT NULL,
+  email TEXT NOT NULL,
+  issued_at INTEGER NOT NULL,
+  expires_at INTEGER NOT NULL,
+  consumed_at INTEGER NOT NULL CHECK(consumed_at<expires_at),
+  operator_id TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  completed INTEGER NOT NULL DEFAULT 0 CHECK(completed IN (0,1))
+);
+CREATE TRIGGER oc_owner_claim_empty_store BEFORE INSERT ON oc_owner_claims
+WHEN EXISTS(SELECT 1 FROM oa_bootstrap) OR EXISTS(SELECT 1 FROM oa_operators)
+BEGIN
+  SELECT RAISE(ABORT, 'owner_claim_already_initialized');
+END;

package/modules/owner-claim/transaction.mjs

@@ -0,0 +1,87 @@
+import { providerPinFence } from '../operator-auth/accounts/provider-pin.mjs';
+import { OwnerClaimError } from './verify.mjs';
+
+// The existing bootstrap performs its limit batch before its admission batch.
+// Keep both real SQL batches, but defer the first until admission so losers do
+// not increment durable rate counters. This adapter is private to one request.
+// Exact SQL matching makes upstream protocol drift fail closed before writing.
+const normalize = sql => sql.replace(/\s+/g, ' ').trim();
+const LIMIT = normalize(`INSERT INTO oa_limits(key,window,count) VALUES(?,?,1)
+ ON CONFLICT(key) DO UPDATE SET window=excluded.window,count=CASE WHEN oa_limits.window=excluded.window THEN oa_limits.count+1 ELSE 1 END RETURNING count`);
+const BOOTSTRAP = [
+  `INSERT INTO oa_bootstrap(singleton,claim_id,claimed_at) SELECT 1,?,? WHERE NOT EXISTS(SELECT 1 FROM oa_operators) ON CONFLICT DO NOTHING`,
+  `INSERT INTO oa_operators(id,email,display_name,role,status,created_at) SELECT ?,?,?,'owner','active',? WHERE EXISTS(SELECT 1 FROM oa_bootstrap WHERE claim_id=?) ON CONFLICT DO NOTHING`,
+  `INSERT INTO oa_sessions(id,token_hash,operator_id,operator_version,kind,created_at,expires_at) SELECT ?,?,id,version,'native',?,? FROM oa_operators WHERE id=?`,
+].map(normalize);
+const drift = () => { throw new OwnerClaimError('auth_protocol_changed', 503); };
+export function bootstrapTransaction(db, claim, config, clock) {
+  let limits;
+  let committed = false;
+  const owned = new WeakSet();
+  function prepare(sql, args = []) {
+    const statement = {
+      sql, args,
+      bind(...values) { return prepare(sql, values); },
+      first() {
+        if (!committed || !/^SELECT\s/i.test(sql)) return drift();
+        return db.prepare(sql).bind(...args).first();
+      },
+      all: drift, run: drift,
+    };
+    owned.add(statement);
+    return statement;
+  }
+  return {
+    prepare,
+    async batch(statements) {
+      if (committed || !Array.isArray(statements) || statements.some(s => !owned.has(s))) return drift();
+      if (!limits) {
+        if (statements.length !== 2 || statements.some(s => normalize(s.sql) !== LIMIT || s.args.length !== 2) || statements[0].args[0] === statements[1].args[0]) return drift();
+        limits = statements;
+        // Read the exact counters which the real UPSERT will increment. Auth's
+        // configured limit check still runs; repeat it on actual transaction
+        // results below to handle concurrent writes from other auth routes.
+        return Promise.all(statements.map(async s => {
+          const row = await db.prepare('SELECT CASE WHEN window=? THEN count+1 ELSE 1 END AS count FROM oa_limits WHERE key=?').bind(s.args[1], s.args[0]).first();
+          return { results: [{ count: row?.count ?? 1 }], meta: { changes: 0 } };
+        }));
+      }
+      if (statements.length !== 3 || statements.some((s, i) => normalize(s.sql) !== BOOTSTRAP[i])
+        || statements[0].args.length !== 2 || statements[1].args.length !== 5 || statements[2].args.length !== 5) return drift();
+      const owner = statements[0].args[0];
+      const session = statements[2].args[0];
+      if (statements[1].args[0] !== owner || statements[1].args[4] !== owner || statements[2].args[4] !== owner || statements[1].args[1] !== claim.email) return drift();
+      const now = Math.floor(clock() / 1000);
+      if (claim.iat - now > 30 || claim.exp <= now || claim.exp <= claim.iat || claim.exp - claim.iat > 300) throw new OwnerClaimError();
+      const start = db.prepare(`INSERT INTO oc_owner_claims(singleton,jti,installation_id,email,issued_at,expires_at,consumed_at,operator_id,session_id)
+        VALUES(1,?,?,?,?,?,?,?,?)`).bind(claim.jti, claim.installationId, claim.email, claim.iat, claim.exp, now, owner, session);
+      const pin = providerPinFence(claim.identity?.pin);
+      const finish = db.prepare(`UPDATE oc_owner_claims SET completed=CASE WHEN
+        EXISTS(SELECT 1 FROM oa_bootstrap WHERE claim_id=?) AND
+        EXISTS(SELECT 1 FROM oa_operators WHERE id=? AND email=? AND role='owner' AND status='active') AND
+        EXISTS(SELECT 1 FROM oa_sessions WHERE id=? AND operator_id=?) AND
+        ${claim.identity ? `EXISTS(SELECT 1 FROM rer_dependency_link WHERE interface='oidc-provider@1' AND issuer=? AND client_id=? AND metadata=? AND needs_relink=0 AND linked_at=?) AND EXISTS(SELECT 1 FROM rer_dependency_installation WHERE singleton=1 AND sector_id=?) AND` : ''}
+        ${pin.sql} AND (SELECT count FROM oa_limits WHERE key=?)<=? AND (SELECT count FROM oa_limits WHERE key=?)<=?
+        THEN 1 ELSE 2 END WHERE jti=?`).bind(owner, owner, claim.email, session, owner,
+          ...(claim.identity?[claim.identity.issuer,claim.identity.clientId,claim.identity.metadata,claim.identity.linkedAt,claim.installationId]:[]), ...pin.args, limits[0].args[0], config.ipLimit, limits[1].args[0], config.emailLimit, claim.jti);
+      try {
+        const identity = claim.identity ? [
+          db.prepare('INSERT INTO oc_idp_grants(issuer,client_id,jti,subject,sector_id) VALUES(?,?,?,?,?)').bind(claim.identity.issuer,claim.identity.clientId,claim.jti,claim.identity.subject,claim.installationId),
+          db.prepare('INSERT INTO oa_external_identities(issuer,subject,operator_id) VALUES(?,?,?)').bind(claim.identity.issuer,claim.identity.subject,owner),
+          db.prepare("INSERT INTO oa_auth_audit(id,actor_id,action,value,created_at) VALUES(?,?,'idpSignIn','true',?)").bind(crypto.randomUUID(),owner,clock()),
+          db.prepare('UPDATE oa_auth_settings SET idp_sign_in=1,first_setup=0,generation=generation+1 WHERE singleton=1'),
+          db.prepare("UPDATE oa_sessions SET kind='oidc',expires_at=MIN(expires_at,?) WHERE id=?").bind(clock()+86400000,session),
+          db.prepare("INSERT INTO oa_provider_session_pins(session_id,provider_id,issuer,client_id,linked_at) SELECT ?,provider_id,issuer,client_id,linked_at FROM oa_identity_providers WHERE provider_id='auth' AND status='linked'").bind(session),
+          db.prepare('INSERT INTO oa_provider_sessions(session_id,issuer,subject,sid,generation) SELECT ?,?,?,?,generation FROM oa_auth_settings WHERE singleton=1').bind(session,claim.identity.issuer,claim.identity.subject,claim.identity.sid),
+        ] : [];
+        const results = await db.batch([start, ...[...limits, ...statements].map(s => db.prepare(s.sql).bind(...s.args)), ...identity, finish]);
+        committed = true;
+        return results.slice(3, 6);
+      } catch {
+        // Includes unique/empty-store fences and final CHECK failure. D1 has
+        // rolled the whole batch back, including every original limit UPSERT.
+        throw new OwnerClaimError('claim_unavailable', 409);
+      }
+    },
+  };
+}