test(auth-atproto): prove confidential OAuth custody in workerd

[ascorbic]

What does this PR do?

Completes delegated release service feasibility task W0.4 by adding an executable workerd harness for confidential atproto OAuth custody.

The harness proves private-key JWT authentication, distinct DPoP keys, real D1 persistence, nonce retry, rotating-token refresh serialization, operation-local lease ownership, lease renewal, fail-closed stale-owner mutation, assertion-key rotation, and the exact create-only release scope. It also records the persisted atcute fields and production constraints in the tracked evidence document.

This changes no production auth implementation or public API. It adds package-local test infrastructure and includes the package in the root unit-test filter.

Related to #1908, #1870, and Discussion #1590.

Type of change

• Bug fix
• Feature (requires maintainer-approved Discussion)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation (if applicable). Do not include messages.po changes except in translation PRs — a workflow extracts catalogs on merge to main.
• I have added a changeset (if this PR changes a published package)
• New features link to an approved Discussion: RFC: Attested Automated Publishing #1590

i18n and a changeset are not applicable: this PR has no UI or published runtime behavior. Package manifest changes are test-only dev dependencies and scripts.

AI-generated code disclosure

• This PR includes AI-generated code — model/tool: OpenCode with GPT-5.6-sol

Screenshots / test output

• pnpm build passes with existing virtual-import and deliberate test-plugin eval warnings
• pnpm --filter @emdash-cms/auth-atproto typecheck passes
• Harness tsgo --noEmit passes
• pnpm --filter @emdash-cms/auth-atproto test passes: 27 Node tests and 9 workerd tests
• pnpm lint passes with 0 warnings/errors
• pnpm lint:json | jq '.diagnostics | length' returns 0
• Frozen lockfile install passes
• Targeted formatting and git diff --check pass

The generated lockfile also reconciles stale TypeScript peer snapshots and deduplicates stale build-time transitives; no shipped runtime dependency changes.

---

Try this PR

Open a fresh playground →

A full working EmDash site, deployed from this branch. Each visit gets its own session-scoped sandbox: no login needed and no shared state. Try the admin, edit content, hit the public site.

_{Tracks feat/delegated-release-service-04-oauth-workerd. Updated automatically when the playground redeploys.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 212f0f6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-playground	212f0f6	Jul 10 2026, 01:40 PM

[github-actions]

Scope check

This PR changes 1,289 lines across 13 files. Large PRs are harder to review and more likely to be closed without review.

If this scope is intentional, no action needed. A maintainer will review it. If not, please consider splitting this into smaller PRs.

See CONTRIBUTING.md for contribution guidelines.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-do	212f0f6	Jul 10 2026, 01:39 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	emdash-demo-cache	212f0f6	Jul 10 2026, 01:37 PM

[ascorbic]

Closing this feasibility spike. It expanded into a speculative OAuth coordinator rather than the minimal Gate 0 compatibility evidence we need. We will replace it with a small ratification-oriented evidence artifact after resetting the scope.