refactor(federation): dissolve backend-federation into oidc-provider; hoist credential type to core

.github/workflows/deploy.yml

@@ -107,7 +107,7 @@ jobs:
       id-token: write
     env:
       DEPLOY_URL: ${{ needs.deploy.outputs.deploy_url }}
-      # Object key the backend-federation smoke test GETs from the private
+      # Object key the federation smoke test GETs from the private
       # bucket (defaults to hello.txt). The full federation path is validated
       # here on both preview (PR) and staging deploys, against the stable
       # staging OIDC issuer — see preview.yml / staging.yml.

.github/workflows/preview.yml

@@ -25,7 +25,7 @@ jobs:
       # All deployments share OIDC_PROVIDER_KEY, so a preview can sign assertions
       # whose `iss` is the staging URL; AWS then validates them against the
       # single, already-registered staging IAM OIDC provider. This lets the full
-      # backend-federation path (tests/smoke/test_federation.py) run on every PR
+      # federation path (tests/smoke/test_federation.py) run on every PR
       # WITHOUT creating/tearing down a per-PR identity provider + role.
       oidc_issuer_override: ${{ vars.STAGING_OIDC_ISSUER }}
     secrets:

Cargo.toml

@@ -7,7 +7,6 @@ members = [
     "crates/static-config",
     "crates/sts",
     "crates/oidc-provider",
-    "crates/backend-federation",
     "examples/server",
     "examples/lambda",
     "examples/cf-workers",
@@ -19,7 +18,6 @@ default-members = [
     "crates/static-config",
     "crates/sts",
     "crates/oidc-provider",
-    "crates/backend-federation",
     "examples/server",
     "examples/lambda",
 ]
@@ -110,4 +108,3 @@ multistore-metering = { path = "crates/metering", version = "0.4.0" }
 multistore-cf-workers = { path = "crates/cf-workers", version = "0.4.0" }
 multistore-oidc-provider = { path = "crates/oidc-provider", version = "0.4.0" }
 multistore-path-mapping = { path = "crates/path-mapping", version = "0.4.0" }
-multistore-backend-federation = { path = "crates/backend-federation", version = "0.4.0" }

README.md

@@ -25,8 +25,7 @@ The workspace is split into reusable **libraries** (traits and logic) and exampl
 | [`multistore`](https://docs.rs/multistore) | [`crates/core/`](crates/core) | Runtime-agnostic core: traits, S3 parsing, SigV4, registries |
 | [`multistore-metering`](https://docs.rs/multistore-metering) | [`crates/metering/`](crates/metering) | Usage metering and quota enforcement middleware |
 | [`multistore-sts`](https://docs.rs/multistore-sts) | [`crates/sts/`](crates/sts) | OIDC/STS token exchange (`AssumeRoleWithWebIdentity`) |
-| [`multistore-oidc-provider`](https://docs.rs/multistore-oidc-provider) | [`crates/oidc-provider/`](crates/oidc-provider) | Outbound OIDC provider (JWT signing, JWKS, exchange) |
-| `multistore-backend-federation` | [`crates/backend-federation/`](crates/backend-federation) | Outbound credential federation (OIDC identity → backend cloud STS) |
+| [`multistore-oidc-provider`](https://docs.rs/multistore-oidc-provider) | [`crates/oidc-provider/`](crates/oidc-provider) | Outbound OIDC provider (JWT signing, JWKS, exchange, backend-cloud STS federation) |
 | `multistore-static-config` | [`crates/static-config/`](crates/static-config) | Static config provider (buckets/roles/credentials) |
 | [`multistore-path-mapping`](https://docs.rs/multistore-path-mapping) | [`crates/path-mapping/`](crates/path-mapping) | Hierarchical path-based backend resolution |
 | [`multistore-cf-workers`](https://docs.rs/multistore-cf-workers) | [`crates/cf-workers/`](crates/cf-workers) | Cloudflare Workers runtime library (WASM) |
@@ -39,7 +38,7 @@ The workspace is split into reusable **libraries** (traits and logic) and exampl
 | `multistore-lambda` | [`examples/lambda/`](examples/lambda) | AWS Lambda runtime |
 | `multistore-cf-workers-example` | [`examples/cf-workers/`](examples/cf-workers) | Cloudflare Workers example for edge deployments |
 
-`multistore-backend-federation` and `multistore-static-config` are not published to crates.io; follow their source links for documentation. For per-crate responsibilities and the dependency graph, see [Crate Layout](https://developmentseed.org/multistore/architecture/crate-layout/) in the docs.
+`multistore-static-config` is not published to crates.io; follow its source link for documentation. For per-crate responsibilities and the dependency graph, see [Crate Layout](https://developmentseed.org/multistore/architecture/crate-layout/) in the docs.
 
 ## Getting Started