@mccaskie-labs/workbench-config 0.1.41 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.2.1
+
+### Patch Changes
+
+- Sign-in gets its own component, `sign-in`: a built-in skill (`workbench-sign-in`) that `workbench-start` lists, with one client question (which pages and actions need a signed-in person, who among them may use each, and which also need a fresh code), written to `workbench/sign-in.json`. Its surfaces, config (`SESSION_SECRET`, `TURNSTILE_SITE_KEY`, `TURNSTILE_SECRET_KEY`), Turnstile actions and three rules move out of `database` (rule ids now `sign-in.server-side`, `sign-in.writes-same-origin`, `sign-in.checks-for-bots`); the probes keep their `database.*` ids. A new optional `proved_by` lets a manifest's rules name probes in the components it lists (sign-in names `database`); only then may its own `probes` be empty.
+
+## 0.2.0
+
+### Minor Changes
+
+- Breaking: there is no built-in Gateway address any more (hard rule 13, `docs/install-plan.md`). `DEFAULT_GATEWAY_URL` is removed from workbench-config, `createAi` needs `url`, and `createMailer`'s gateway transport needs `gateway.url`. Pass the app's `WORKBENCH_GATEWAY_URL`, which Control writes into `wrangler.jsonc` when it creates a project. A missing address fails at start-up with `invalid_config` and the message "WORKBENCH_GATEWAY_URL is missing". The gateway manifest marks `WORKBENCH_GATEWAY_URL` required with no default.
+
 ## 0.1.41
 
 ### Patch Changes

package/README.md

@@ -30,7 +30,6 @@ const { WORKBENCH_GATEWAY_KEY } = config.parse(env)
 | `defineBrand(json)`, `brandSchema`, `resolveBrand`, `BRAND_DEFAULTS`, `BRAND_FILE` | The app's brand file, `brand.json` at the repo root: `name`, `siteUrl` (https), `logo.url` (https PNG, JPEG or SVG; optional `alt`, `width`, `height`), `colours.primary` (`#rrggbb`; `text`, `background`, `muted` default), optional `fonts.heading`/`fonts.body` (`{ family, url? }`, `url` an https stylesheet), `supportEmail` and `footer`. Unknown keys fail. Account emails, PDFs and Supabase's sign-in emails all read it |
 | `checkLogo(bytes)`, `placeholderLogo(name, colour)`, `colourForId(id)`, `parseColour`, `whiteContrast`, `shownSize`, `LOGO_PATHS`, `MAX_LOGO_BYTES`, `BrandAssetError` | Setting a brand from an upload: the logo is checked by its own bytes (PNG or JPEG, at most 256 KiB; SVG refused because Gmail and Outlook don't show it), a project with no logo gets its initials on its colour as a 96 × 96 PNG, and a project with no colour gets a steady one from its id that white text reads on (WCAG 4.5:1). Runs in Workers, the browser and Node |
 | `VENDOR_SETTINGS`, `resolveVendorSettings(file, env)`, `vendorSettingsFileSchema`, `VENDOR_SETTINGS_FILE`, `SEND_EMAIL_HOOK`, `SEND_EMAIL_HOOK_PATH`, `SEND_EMAIL_HOOK_SECRET` | The vendor settings baseline: settings that live in a vendor dashboard (field, value, where it is, what breaks if it changes). A project changes a row in `vendor-settings.json` at its repo root, with a reason. Control applies it with `vendor_settings_apply` and compares it every day |
-| `DEFAULT_GATEWAY_URL` | `https://gateway.mccaskielabs.dev` |
 
 `npx workbench-config check [dir]` compares the variable names in `.dev.vars` with `.dev.vars.example` and prints names only.
 

package/capabilities/ai.json

@@ -95,7 +95,7 @@
       "title": "One-shot text",
       "lang": "ts",
       "probe": "ai.text.claude-default",
-      "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst r = await ai.text({ model: 'claude-default', job: 'article.write', prompt })\nawait save({ text: r.text, model: r.model, requestId: r.requestId })"
+      "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst r = await ai.text({ model: 'claude-default', job: 'article.write', prompt })\nawait save({ text: r.text, model: r.model, requestId: r.requestId })"
     },
     {
       "id": "ai.example.voice",

package/capabilities/database.json

@@ -17,10 +17,7 @@
       "createServerClient",
       "createUserClient",
       "createServiceClient",
-      "WorkbenchSupabaseError",
-      "createSessions",
-      "safeReturnPath",
-      "sameOrigin"
+      "WorkbenchSupabaseError"
     ],
     "tools": [
       "sb_project_create",
@@ -29,9 +26,7 @@
       "sb_query",
       "sb_project_delete",
       "cf_worker_secret_put",
-      "vendor_settings_apply",
-      "cf_turnstile_widget_create",
-      "cf_turnstile_widget_delete"
+      "vendor_settings_apply"
     ]
   },
   "config": [
@@ -66,39 +61,6 @@
         "production"
       ],
       "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
-    },
-    {
-      "name": "SESSION_SECRET",
-      "required": false,
-      "secret": true,
-      "environments": [
-        "development",
-        "staging",
-        "production"
-      ],
-      "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
-    },
-    {
-      "name": "TURNSTILE_SITE_KEY",
-      "required": false,
-      "secret": false,
-      "environments": [
-        "development",
-        "staging",
-        "production"
-      ],
-      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
-    },
-    {
-      "name": "TURNSTILE_SECRET_KEY",
-      "required": false,
-      "secret": true,
-      "environments": [
-        "development",
-        "staging",
-        "production"
-      ],
-      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
     }
   ],
   "actions": [
@@ -141,16 +103,6 @@
       "gate": "two_step_when",
       "when": "production, after the first successful apply on that database; staging and check_only are free",
       "ships": "5"
-    },
-    {
-      "tool": "cf_turnstile_widget_create",
-      "gate": "free",
-      "ships": "5"
-    },
-    {
-      "tool": "cf_turnstile_widget_delete",
-      "gate": "two_step",
-      "ships": "5"
     }
   ],
   "rules": [
@@ -195,27 +147,6 @@
       "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
       "enforced_by": "control",
       "probe": "database.vendor-settings"
-    },
-    {
-      "id": "database.sign-in-server-side",
-      "kind": "must",
-      "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
-      "enforced_by": "review",
-      "probe": "database.sign-in"
-    },
-    {
-      "id": "database.session-writes-same-origin",
-      "kind": "must",
-      "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
-      "enforced_by": "review",
-      "probe": "database.session-cookie"
-    },
-    {
-      "id": "database.sign-in-checks-for-bots",
-      "kind": "must",
-      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
-      "enforced_by": "review",
-      "probe": "database.sign-in-bot-check"
     }
   ],
   "examples": [

package/capabilities/email.json

@@ -52,7 +52,7 @@
       "title": "Send a transactional mail with an inline logo",
       "lang": "ts",
       "probe": "email.send.inline-attachment",
-      "code": "const env = workbenchEnv(process.env)\nconst mailer = createMailer({ env, transport: selectTransport(env), from: { address: 'hello@mail.example.com', name: 'Example' }, gateway: { key: process.env.WORKBENCH_GATEWAY_KEY! } })\nawait mailer.send({ to: user.email, subject: 'Welcome', text, html: '<img src=\"cid:logo\"> ...', template: 'welcome', idempotencyKey: `welcome:${user.id}`, attachments: [{ filename: 'logo.png', mimeType: 'image/png', bytes: logo, contentId: 'logo' }] })"
+      "code": "const env = workbenchEnv(process.env)\nconst mailer = createMailer({ env, transport: selectTransport(env), from: { address: 'hello@mail.example.com', name: 'Example' }, gateway: { key: process.env.WORKBENCH_GATEWAY_KEY!, url: process.env.WORKBENCH_GATEWAY_URL! } })\nawait mailer.send({ to: user.email, subject: 'Welcome', text, html: '<img src=\"cid:logo\"> ...', template: 'welcome', idempotencyKey: `welcome:${user.id}`, attachments: [{ filename: 'logo.png', mimeType: 'image/png', bytes: logo, contentId: 'logo' }] })"
     }
   ],
   "probes": [

package/capabilities/gateway.json

@@ -6,8 +6,7 @@
   "summary": "What every Gateway endpoint shares: project keys by environment and scope, the request and response headers, the monthly budget check and the error codes. Apps hold one Workbench key and never a vendor key.",
   "status": "built",
   "surfaces": {
-    "gateway": ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities", "GET /v1/calls"],
-    "package": ["DEFAULT_GATEWAY_URL"]
+    "gateway": ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities", "GET /v1/calls"]
   },
   "config": [
     {
@@ -19,11 +18,10 @@
     },
     {
       "name": "WORKBENCH_GATEWAY_URL",
-      "required": false,
+      "required": true,
       "secret": false,
-      "default": "https://gateway.mccaskielabs.dev",
       "environments": ["development", "staging", "production"],
-      "description": "Gateway base URL. Leave unset outside tests"
+      "description": "The address of this Workbench install's Gateway. Control writes it into wrangler.jsonc when it creates the project; there is no built-in address"
     }
   ],
   "allowed": {

package/capabilities/image-search.json

@@ -120,7 +120,7 @@
       "title": "Search for images",
       "lang": "ts",
       "probe": "image-search.serper",
-      "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst results = await ai.images.search({ q: 'Mayon volcano', job: 'editor.image-search', num: 10 })"
+      "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst results = await ai.images.search({ q: 'Mayon volcano', job: 'editor.image-search', num: 10 })"
     }
   ],
   "probes": [

package/capabilities/images.json

@@ -166,7 +166,7 @@
       "title": "Generate one image",
       "lang": "ts",
       "probe": "images.generate.image-default",
-      "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst img = await ai.images.generate({ prompt, aspectRatio: '3:2', job: 'article.hero' })\nawait env.IMAGES.put(key, img.bytes, { httpMetadata: { contentType: img.mimeType }, customMetadata: { model: img.model, requestId: img.requestId } })"
+      "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst img = await ai.images.generate({ prompt, aspectRatio: '3:2', job: 'article.hero' })\nawait env.IMAGES.put(key, img.bytes, { httpMetadata: { contentType: img.mimeType }, customMetadata: { model: img.model, requestId: img.requestId } })"
     },
     {
       "id": "images.example.reference",

package/capabilities/schema.json

@@ -34,7 +34,8 @@
         "github",
         "strings",
         "ui",
-        "forms"
+        "forms",
+        "sign-in"
       ]
     },
     "title": {
@@ -352,7 +353,6 @@
       }
     },
     "probes": {
-      "minItems": 1,
       "type": "array",
       "items": {
         "type": "object",
@@ -402,6 +402,38 @@
         "additionalProperties": false
       }
     },
+    "proved_by": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "gateway",
+          "ai",
+          "images",
+          "image-search",
+          "config",
+          "email",
+          "email-inbound",
+          "email-sending",
+          "database",
+          "workers",
+          "domains",
+          "dns",
+          "analytics",
+          "country",
+          "pdf",
+          "access",
+          "r2",
+          "kv",
+          "github",
+          "strings",
+          "ui",
+          "forms",
+          "sign-in"
+        ]
+      }
+    },
     "offer": {
       "type": "object",
       "properties": {

package/capabilities/sign-in.json

@@ -0,0 +1,137 @@
+{
+  "$schema": "./schema.json",
+  "format": 1,
+  "component": "sign-in",
+  "title": "Sign-in",
+  "summary": "People sign in to the app with a code emailed to them and typed on the next screen: no password, no link and no reset email. The Worker holds the session in one sealed cookie and talks to Supabase Auth itself, so the browser never sees a token, and a Cloudflare Turnstile check runs before any code is sent. The template has it all; a page that needs a signed-in person asks for one with requireUser. Signing in proves who someone is, not what they may do: anyone can make an account.",
+  "status": "built",
+  "delivery": {
+    "choice": "built_in",
+    "intro": "People signing in to the app with a code emailed to them, with no passwords to forget."
+  },
+  "surfaces": {
+    "package": [
+      "createSessions",
+      "safeReturnPath",
+      "sameOrigin",
+      "plainAuthError"
+    ],
+    "tools": [
+      "cf_worker_secret_put",
+      "cf_turnstile_widget_create",
+      "cf_turnstile_widget_delete"
+    ]
+  },
+  "config": [
+    {
+      "name": "SESSION_SECRET",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+    },
+    {
+      "name": "TURNSTILE_SITE_KEY",
+      "required": false,
+      "secret": false,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+    },
+    {
+      "name": "TURNSTILE_SECRET_KEY",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
+    }
+  ],
+  "actions": [
+    {
+      "tool": "cf_turnstile_widget_create",
+      "gate": "free",
+      "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_delete",
+      "gate": "two_step",
+      "ships": "5"
+    }
+  ],
+  "rules": [
+    {
+      "id": "sign-in.server-side",
+      "kind": "must",
+      "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+      "enforced_by": "review",
+      "probe": "database.sign-in"
+    },
+    {
+      "id": "sign-in.writes-same-origin",
+      "kind": "must",
+      "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+      "enforced_by": "review",
+      "probe": "database.session-cookie"
+    },
+    {
+      "id": "sign-in.checks-for-bots",
+      "kind": "must",
+      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+      "enforced_by": "review",
+      "probe": "database.sign-in-bot-check"
+    }
+  ],
+  "probes": [],
+  "offer": {
+    "pattern": "switch_on",
+    "when": "The client wants people to sign in or have accounts: a members' area, saved orders or bookings, a profile, \"my account\", or a page only some people may see.",
+    "say": "Sign-in is already built in: people get a code by email and type it, so there are no passwords to forget or leak. I'll put the pages that need it behind it. Here's what I think needs sign-in; tell me what to change.",
+    "answers_file": "workbench/sign-in.json",
+    "answers_format": "`{ \"format\": 1, \"status\": \"draft\" | \"done\", \"pages\": [{ \"path\": \"/orders\", \"what\": \"<what it shows or does, in the client's words>\", \"who\": \"signed_in\" | \"owner\" | \"admins\", \"fresh\": true | false }] }`, one entry per page or action that needs a signed-in person. `who` is `signed_in` (anyone with an account), `owner` (only the person the thing belongs to, enforced by row-level security on their user id through `dbAs`) or `admins` (only people in `app_admins`). `fresh` is true where it also needs a code typed in the last 15 minutes. Save it as a draft until the client accepts the table. Then build each page with `requireUser`, enforce its `who`, and check `fresh` on the ones marked so.",
+    "questions": [
+      {
+        "id": "sign-in.pages",
+        "sets": [
+          "page.sign_in",
+          "page.who",
+          "page.fresh"
+        ],
+        "ask": "Here are the pages and actions that need someone signed in, who among them may use each one, and which also need a fresh code because they show or change something sensitive. Accept them, or change some?",
+        "style": "table",
+        "note": "Propose from the pages built or planned. Anything that shows or changes a person's own things (orders, bookings, a profile) needs sign-in, with `who` set to `owner`. Signing in only proves who someone is, and anyone can make an account, so a page for staff or admins must say `admins`: `requireUser` alone would let any stranger who signs up use it. Mark `fresh` where a stranger holding a signed-in phone could do harm: showing payment details, changing an email address, adding an admin, deleting an account. The template has no re-check screen: when `fresh` is false, the page tells the person to sign out and sign in again with a new code, as the admins section of `/admin/brand` does. Pages anyone may read, such as the home page, a menu or a contact form, stay open. Only the client knows what is private and who may do what, so always show the table."
+      }
+    ],
+    "not_asked": [
+      {
+        "sets": "sign_in.method",
+        "why": "The template signs people in with an emailed code only (Workbench's choice: no password to forget, leak or reuse), and the authentication standard rules out sign-in links. Passwords and social sign-in (\"sign in with Google\") aren't built. If the client asks for one, say so and that it is the Workbench owner's call; don't build it."
+      },
+      {
+        "sets": "sign_in.length",
+        "why": "Sessions last weeks, with a cap, as the authentication standard (§10) asks. The package's defaults (SESSION_DEFAULTS) sign a person out after 14 days without a visit and 30 days after the code was typed, whatever happens; on a shared device they untick \"keep me signed in\" and are signed out after 30 minutes idle. Say so if the client asks, and don't change them."
+      },
+      {
+        "sets": "sign_in.who",
+        "why": "Anyone with an email address can make an account; invite-only sign-up isn't built yet. If the client needs only invited people, say it isn't built yet and ask them how they want to handle it. Don't build an invite system of your own."
+      },
+      {
+        "sets": "sign_in.bot_check",
+        "why": "The Turnstile check is always on outside development. Control sets it up (cf_turnstile_widget_create, then cf_worker_secret_put sources turnstile_sitekey and turnstile_secret); there is nothing to ask."
+      }
+    ]
+  },
+  "proved_by": [
+    "database"
+  ]
+}

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "b986177e8690";
+export declare const MANIFEST_VERSION: "984099bc7d3f";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -119,7 +119,7 @@ export declare const capabilities: {
             readonly id: "ai.example.text";
             readonly title: "One-shot text";
             readonly lang: "ts";
-            readonly code: "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst r = await ai.text({ model: 'claude-default', job: 'article.write', prompt })\nawait save({ text: r.text, model: r.model, requestId: r.requestId })";
+            readonly code: "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst r = await ai.text({ model: 'claude-default', job: 'article.write', prompt })\nawait save({ text: r.text, model: r.model, requestId: r.requestId })";
             readonly probe: "ai.text.claude-default";
         }, {
             readonly id: "ai.example.voice";
@@ -437,8 +437,8 @@ export declare const capabilities: {
         readonly summary: "Each project has its own Supabase projects, <id>-staging and <id>-production. Apps use them natively through workbench-supabase; Control creates them, writes their URL and keys onto the Workers, and applies migrations read from the repo.";
         readonly status: "built";
         readonly surfaces: {
-            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
-            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
+            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
+            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError"];
         };
         readonly config: readonly [{
             readonly name: "SUPABASE_URL";
@@ -458,24 +458,6 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["staging", "production"];
             readonly description: "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step";
-        }, {
-            readonly name: "SESSION_SECRET";
-            readonly required: false;
-            readonly secret: true;
-            readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
-        }, {
-            readonly name: "TURNSTILE_SITE_KEY";
-            readonly required: false;
-            readonly secret: false;
-            readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
-        }, {
-            readonly name: "TURNSTILE_SECRET_KEY";
-            readonly required: false;
-            readonly secret: true;
-            readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -510,14 +492,6 @@ export declare const capabilities: {
             readonly gate: "two_step_when";
             readonly when: "production, after the first successful apply on that database; staging and check_only are free";
             readonly ships: "5";
-        }, {
-            readonly tool: "cf_turnstile_widget_create";
-            readonly gate: "free";
-            readonly ships: "5";
-        }, {
-            readonly tool: "cf_turnstile_widget_delete";
-            readonly gate: "two_step";
-            readonly ships: "5";
         }];
         readonly rules: readonly [{
             readonly id: "database.rls-isolates-users";
@@ -555,24 +529,6 @@ export declare const capabilities: {
             readonly text: "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.";
             readonly enforced_by: "control";
             readonly probe: "database.vendor-settings";
-        }, {
-            readonly id: "database.sign-in-server-side";
-            readonly kind: "must";
-            readonly text: "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.";
-            readonly enforced_by: "review";
-            readonly probe: "database.sign-in";
-        }, {
-            readonly id: "database.session-writes-same-origin";
-            readonly kind: "must";
-            readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
-            readonly enforced_by: "review";
-            readonly probe: "database.session-cookie";
-        }, {
-            readonly id: "database.sign-in-checks-for-bots";
-            readonly kind: "must";
-            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
-            readonly enforced_by: "review";
-            readonly probe: "database.sign-in-bot-check";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -816,7 +772,7 @@ export declare const capabilities: {
             readonly id: "email.example.send";
             readonly title: "Send a transactional mail with an inline logo";
             readonly lang: "ts";
-            readonly code: "const env = workbenchEnv(process.env)\nconst mailer = createMailer({ env, transport: selectTransport(env), from: { address: 'hello@mail.example.com', name: 'Example' }, gateway: { key: process.env.WORKBENCH_GATEWAY_KEY! } })\nawait mailer.send({ to: user.email, subject: 'Welcome', text, html: '<img src=\"cid:logo\"> ...', template: 'welcome', idempotencyKey: `welcome:${user.id}`, attachments: [{ filename: 'logo.png', mimeType: 'image/png', bytes: logo, contentId: 'logo' }] })";
+            readonly code: "const env = workbenchEnv(process.env)\nconst mailer = createMailer({ env, transport: selectTransport(env), from: { address: 'hello@mail.example.com', name: 'Example' }, gateway: { key: process.env.WORKBENCH_GATEWAY_KEY!, url: process.env.WORKBENCH_GATEWAY_URL! } })\nawait mailer.send({ to: user.email, subject: 'Welcome', text, html: '<img src=\"cid:logo\"> ...', template: 'welcome', idempotencyKey: `welcome:${user.id}`, attachments: [{ filename: 'logo.png', mimeType: 'image/png', bytes: logo, contentId: 'logo' }] })";
             readonly probe: "email.send.inline-attachment";
         }];
         readonly probes: readonly [{
@@ -1366,7 +1322,6 @@ export declare const capabilities: {
         readonly status: "built";
         readonly surfaces: {
             readonly gateway: readonly ["GET /v1/health", "GET /v1/usage", "GET /v1/capabilities", "GET /v1/calls"];
-            readonly package: readonly ["DEFAULT_GATEWAY_URL"];
         };
         readonly config: readonly [{
             readonly name: "WORKBENCH_GATEWAY_KEY";
@@ -1376,11 +1331,10 @@ export declare const capabilities: {
             readonly description: "The project's Gateway key for this environment, delivered as a Worker secret by gw_key_issue. Never in code, .dev.vars.example or logs";
         }, {
             readonly name: "WORKBENCH_GATEWAY_URL";
-            readonly required: false;
+            readonly required: true;
             readonly secret: false;
-            readonly default: "https://gateway.mccaskielabs.dev";
             readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "Gateway base URL. Leave unset outside tests";
+            readonly description: "The address of this Workbench install's Gateway. Control writes it into wrangler.jsonc when it creates the project; there is no built-in address";
         }];
         readonly allowed: {
             readonly scopes: readonly ["ai", "images", "search", "email"];
@@ -1679,7 +1633,7 @@ export declare const capabilities: {
             readonly id: "image-search.example.search";
             readonly title: "Search for images";
             readonly lang: "ts";
-            readonly code: "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst results = await ai.images.search({ q: 'Mayon volcano', job: 'editor.image-search', num: 10 })";
+            readonly code: "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst results = await ai.images.search({ q: 'Mayon volcano', job: 'editor.image-search', num: 10 })";
             readonly probe: "image-search.serper";
         }];
         readonly probes: readonly [{
@@ -1809,7 +1763,7 @@ export declare const capabilities: {
             readonly id: "images.example.generate";
             readonly title: "Generate one image";
             readonly lang: "ts";
-            readonly code: "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst img = await ai.images.generate({ prompt, aspectRatio: '3:2', job: 'article.hero' })\nawait env.IMAGES.put(key, img.bytes, { httpMetadata: { contentType: img.mimeType }, customMetadata: { model: img.model, requestId: img.requestId } })";
+            readonly code: "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst img = await ai.images.generate({ prompt, aspectRatio: '3:2', job: 'article.hero' })\nawait env.IMAGES.put(key, img.bytes, { httpMetadata: { contentType: img.mimeType }, customMetadata: { model: img.model, requestId: img.requestId } })";
             readonly probe: "images.generate.image-default";
         }, {
             readonly id: "images.example.reference";
@@ -1936,6 +1890,98 @@ export declare const capabilities: {
             readonly when: "The client wants a PDF: an invoice, receipt, quote, certificate, report or anything else to download or print.";
         };
     };
+    readonly "sign-in": {
+        readonly $schema: "./schema.json";
+        readonly format: 1;
+        readonly component: "sign-in";
+        readonly title: "Sign-in";
+        readonly summary: "People sign in to the app with a code emailed to them and typed on the next screen: no password, no link and no reset email. The Worker holds the session in one sealed cookie and talks to Supabase Auth itself, so the browser never sees a token, and a Cloudflare Turnstile check runs before any code is sent. The template has it all; a page that needs a signed-in person asks for one with requireUser. Signing in proves who someone is, not what they may do: anyone can make an account.";
+        readonly status: "built";
+        readonly surfaces: {
+            readonly tools: readonly ["cf_worker_secret_put", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
+            readonly package: readonly ["createSessions", "safeReturnPath", "sameOrigin", "plainAuthError"];
+        };
+        readonly config: readonly [{
+            readonly name: "SESSION_SECRET";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
+        }, {
+            readonly name: "TURNSTILE_SITE_KEY";
+            readonly required: false;
+            readonly secret: false;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
+        }, {
+            readonly name: "TURNSTILE_SECRET_KEY";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
+        }];
+        readonly actions: readonly [{
+            readonly tool: "cf_turnstile_widget_create";
+            readonly gate: "free";
+            readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_delete";
+            readonly gate: "two_step";
+            readonly ships: "5";
+        }];
+        readonly rules: readonly [{
+            readonly id: "sign-in.server-side";
+            readonly kind: "must";
+            readonly text: "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in";
+        }, {
+            readonly id: "sign-in.writes-same-origin";
+            readonly kind: "must";
+            readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
+            readonly enforced_by: "review";
+            readonly probe: "database.session-cookie";
+        }, {
+            readonly id: "sign-in.checks-for-bots";
+            readonly kind: "must";
+            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in-bot-check";
+        }];
+        readonly probes: readonly [];
+        readonly proved_by: readonly ["database"];
+        readonly offer: {
+            readonly pattern: "switch_on";
+            readonly when: "The client wants people to sign in or have accounts: a members' area, saved orders or bookings, a profile, \"my account\", or a page only some people may see.";
+            readonly say: "Sign-in is already built in: people get a code by email and type it, so there are no passwords to forget or leak. I'll put the pages that need it behind it. Here's what I think needs sign-in; tell me what to change.";
+            readonly answers_file: "workbench/sign-in.json";
+            readonly answers_format: "`{ \"format\": 1, \"status\": \"draft\" | \"done\", \"pages\": [{ \"path\": \"/orders\", \"what\": \"<what it shows or does, in the client's words>\", \"who\": \"signed_in\" | \"owner\" | \"admins\", \"fresh\": true | false }] }`, one entry per page or action that needs a signed-in person. `who` is `signed_in` (anyone with an account), `owner` (only the person the thing belongs to, enforced by row-level security on their user id through `dbAs`) or `admins` (only people in `app_admins`). `fresh` is true where it also needs a code typed in the last 15 minutes. Save it as a draft until the client accepts the table. Then build each page with `requireUser`, enforce its `who`, and check `fresh` on the ones marked so.";
+            readonly questions: readonly [{
+                readonly id: "sign-in.pages";
+                readonly sets: readonly ["page.sign_in", "page.who", "page.fresh"];
+                readonly ask: "Here are the pages and actions that need someone signed in, who among them may use each one, and which also need a fresh code because they show or change something sensitive. Accept them, or change some?";
+                readonly style: "table";
+                readonly note: "Propose from the pages built or planned. Anything that shows or changes a person's own things (orders, bookings, a profile) needs sign-in, with `who` set to `owner`. Signing in only proves who someone is, and anyone can make an account, so a page for staff or admins must say `admins`: `requireUser` alone would let any stranger who signs up use it. Mark `fresh` where a stranger holding a signed-in phone could do harm: showing payment details, changing an email address, adding an admin, deleting an account. The template has no re-check screen: when `fresh` is false, the page tells the person to sign out and sign in again with a new code, as the admins section of `/admin/brand` does. Pages anyone may read, such as the home page, a menu or a contact form, stay open. Only the client knows what is private and who may do what, so always show the table.";
+            }];
+            readonly not_asked: readonly [{
+                readonly sets: "sign_in.method";
+                readonly why: "The template signs people in with an emailed code only (Workbench's choice: no password to forget, leak or reuse), and the authentication standard rules out sign-in links. Passwords and social sign-in (\"sign in with Google\") aren't built. If the client asks for one, say so and that it is the Workbench owner's call; don't build it.";
+            }, {
+                readonly sets: "sign_in.length";
+                readonly why: "Sessions last weeks, with a cap, as the authentication standard (§10) asks. The package's defaults (SESSION_DEFAULTS) sign a person out after 14 days without a visit and 30 days after the code was typed, whatever happens; on a shared device they untick \"keep me signed in\" and are signed out after 30 minutes idle. Say so if the client asks, and don't change them.";
+            }, {
+                readonly sets: "sign_in.who";
+                readonly why: "Anyone with an email address can make an account; invite-only sign-up isn't built yet. If the client needs only invited people, say it isn't built yet and ask them how they want to handle it. Don't build an invite system of your own.";
+            }, {
+                readonly sets: "sign_in.bot_check";
+                readonly why: "The Turnstile check is always on outside development. Control sets it up (cf_turnstile_widget_create, then cf_worker_secret_put sources turnstile_sitekey and turnstile_secret); there is nothing to ask.";
+            }];
+        };
+        readonly delivery: {
+            readonly choice: "built_in";
+            readonly intro: "People signing in to the app with a code emailed to them, with no passwords to forget.";
+        };
+    };
     readonly strings: {
         readonly $schema: "./schema.json";
         readonly format: 1;

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "b986177e8690";
+export const MANIFEST_VERSION = "984099bc7d3f";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -204,7 +204,7 @@ export const capabilities = {
                 "id": "ai.example.text",
                 "title": "One-shot text",
                 "lang": "ts",
-                "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst r = await ai.text({ model: 'claude-default', job: 'article.write', prompt })\nawait save({ text: r.text, model: r.model, requestId: r.requestId })",
+                "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst r = await ai.text({ model: 'claude-default', job: 'article.write', prompt })\nawait save({ text: r.text, model: r.model, requestId: r.requestId })",
                 "probe": "ai.text.claude-default"
             },
             {
@@ -637,9 +637,7 @@ export const capabilities = {
                 "sb_query",
                 "sb_project_delete",
                 "cf_worker_secret_put",
-                "vendor_settings_apply",
-                "cf_turnstile_widget_create",
-                "cf_turnstile_widget_delete"
+                "vendor_settings_apply"
             ],
             "package": [
                 "supabaseConfig",
@@ -647,10 +645,7 @@ export const capabilities = {
                 "createServerClient",
                 "createUserClient",
                 "createServiceClient",
-                "WorkbenchSupabaseError",
-                "createSessions",
-                "safeReturnPath",
-                "sameOrigin"
+                "WorkbenchSupabaseError"
             ]
         },
         "config": [
@@ -685,39 +680,6 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
-            },
-            {
-                "name": "SESSION_SECRET",
-                "required": false,
-                "secret": true,
-                "environments": [
-                    "development",
-                    "staging",
-                    "production"
-                ],
-                "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
-            },
-            {
-                "name": "TURNSTILE_SITE_KEY",
-                "required": false,
-                "secret": false,
-                "environments": [
-                    "development",
-                    "staging",
-                    "production"
-                ],
-                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
-            },
-            {
-                "name": "TURNSTILE_SECRET_KEY",
-                "required": false,
-                "secret": true,
-                "environments": [
-                    "development",
-                    "staging",
-                    "production"
-                ],
-                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
             }
         ],
         "actions": [
@@ -760,16 +722,6 @@ export const capabilities = {
                 "gate": "two_step_when",
                 "when": "production, after the first successful apply on that database; staging and check_only are free",
                 "ships": "5"
-            },
-            {
-                "tool": "cf_turnstile_widget_create",
-                "gate": "free",
-                "ships": "5"
-            },
-            {
-                "tool": "cf_turnstile_widget_delete",
-                "gate": "two_step",
-                "ships": "5"
             }
         ],
         "rules": [
@@ -814,27 +766,6 @@ export const capabilities = {
                 "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
                 "enforced_by": "control",
                 "probe": "database.vendor-settings"
-            },
-            {
-                "id": "database.sign-in-server-side",
-                "kind": "must",
-                "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
-                "enforced_by": "review",
-                "probe": "database.sign-in"
-            },
-            {
-                "id": "database.session-writes-same-origin",
-                "kind": "must",
-                "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
-                "enforced_by": "review",
-                "probe": "database.session-cookie"
-            },
-            {
-                "id": "database.sign-in-checks-for-bots",
-                "kind": "must",
-                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
-                "enforced_by": "review",
-                "probe": "database.sign-in-bot-check"
             }
         ],
         "examples": [
@@ -1139,7 +1070,7 @@ export const capabilities = {
                 "id": "email.example.send",
                 "title": "Send a transactional mail with an inline logo",
                 "lang": "ts",
-                "code": "const env = workbenchEnv(process.env)\nconst mailer = createMailer({ env, transport: selectTransport(env), from: { address: 'hello@mail.example.com', name: 'Example' }, gateway: { key: process.env.WORKBENCH_GATEWAY_KEY! } })\nawait mailer.send({ to: user.email, subject: 'Welcome', text, html: '<img src=\"cid:logo\"> ...', template: 'welcome', idempotencyKey: `welcome:${user.id}`, attachments: [{ filename: 'logo.png', mimeType: 'image/png', bytes: logo, contentId: 'logo' }] })",
+                "code": "const env = workbenchEnv(process.env)\nconst mailer = createMailer({ env, transport: selectTransport(env), from: { address: 'hello@mail.example.com', name: 'Example' }, gateway: { key: process.env.WORKBENCH_GATEWAY_KEY!, url: process.env.WORKBENCH_GATEWAY_URL! } })\nawait mailer.send({ to: user.email, subject: 'Welcome', text, html: '<img src=\"cid:logo\"> ...', template: 'welcome', idempotencyKey: `welcome:${user.id}`, attachments: [{ filename: 'logo.png', mimeType: 'image/png', bytes: logo, contentId: 'logo' }] })",
                 "probe": "email.send.inline-attachment"
             }
         ],
@@ -1861,9 +1792,6 @@ export const capabilities = {
                 "GET /v1/usage",
                 "GET /v1/capabilities",
                 "GET /v1/calls"
-            ],
-            "package": [
-                "DEFAULT_GATEWAY_URL"
             ]
         },
         "config": [
@@ -1879,15 +1807,14 @@ export const capabilities = {
             },
             {
                 "name": "WORKBENCH_GATEWAY_URL",
-                "required": false,
+                "required": true,
                 "secret": false,
-                "default": "https://gateway.mccaskielabs.dev",
                 "environments": [
                     "development",
                     "staging",
                     "production"
                 ],
-                "description": "Gateway base URL. Leave unset outside tests"
+                "description": "The address of this Workbench install's Gateway. Control writes it into wrangler.jsonc when it creates the project; there is no built-in address"
             }
         ],
         "allowed": {
@@ -2278,7 +2205,7 @@ export const capabilities = {
                 "id": "image-search.example.search",
                 "title": "Search for images",
                 "lang": "ts",
-                "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst results = await ai.images.search({ q: 'Mayon volcano', job: 'editor.image-search', num: 10 })",
+                "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst results = await ai.images.search({ q: 'Mayon volcano', job: 'editor.image-search', num: 10 })",
                 "probe": "image-search.serper"
             }
         ],
@@ -2459,7 +2386,7 @@ export const capabilities = {
                 "id": "images.example.generate",
                 "title": "Generate one image",
                 "lang": "ts",
-                "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env) })\nconst img = await ai.images.generate({ prompt, aspectRatio: '3:2', job: 'article.hero' })\nawait env.IMAGES.put(key, img.bytes, { httpMetadata: { contentType: img.mimeType }, customMetadata: { model: img.model, requestId: img.requestId } })",
+                "code": "const ai = createAi({ key: env.WORKBENCH_GATEWAY_KEY, env: workbenchEnv(env), url: env.WORKBENCH_GATEWAY_URL })\nconst img = await ai.images.generate({ prompt, aspectRatio: '3:2', job: 'article.hero' })\nawait env.IMAGES.put(key, img.bytes, { httpMetadata: { contentType: img.mimeType }, customMetadata: { model: img.model, requestId: img.requestId } })",
                 "probe": "images.generate.image-default"
             },
             {
@@ -2611,6 +2538,143 @@ export const capabilities = {
             "when": "The client wants a PDF: an invoice, receipt, quote, certificate, report or anything else to download or print."
         }
     },
+    "sign-in": {
+        "$schema": "./schema.json",
+        "format": 1,
+        "component": "sign-in",
+        "title": "Sign-in",
+        "summary": "People sign in to the app with a code emailed to them and typed on the next screen: no password, no link and no reset email. The Worker holds the session in one sealed cookie and talks to Supabase Auth itself, so the browser never sees a token, and a Cloudflare Turnstile check runs before any code is sent. The template has it all; a page that needs a signed-in person asks for one with requireUser. Signing in proves who someone is, not what they may do: anyone can make an account.",
+        "status": "built",
+        "surfaces": {
+            "tools": [
+                "cf_worker_secret_put",
+                "cf_turnstile_widget_create",
+                "cf_turnstile_widget_delete"
+            ],
+            "package": [
+                "createSessions",
+                "safeReturnPath",
+                "sameOrigin",
+                "plainAuthError"
+            ]
+        },
+        "config": [
+            {
+                "name": "SESSION_SECRET",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+            },
+            {
+                "name": "TURNSTILE_SITE_KEY",
+                "required": false,
+                "secret": false,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+            },
+            {
+                "name": "TURNSTILE_SECRET_KEY",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
+            }
+        ],
+        "actions": [
+            {
+                "tool": "cf_turnstile_widget_create",
+                "gate": "free",
+                "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_delete",
+                "gate": "two_step",
+                "ships": "5"
+            }
+        ],
+        "rules": [
+            {
+                "id": "sign-in.server-side",
+                "kind": "must",
+                "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+                "enforced_by": "review",
+                "probe": "database.sign-in"
+            },
+            {
+                "id": "sign-in.writes-same-origin",
+                "kind": "must",
+                "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+                "enforced_by": "review",
+                "probe": "database.session-cookie"
+            },
+            {
+                "id": "sign-in.checks-for-bots",
+                "kind": "must",
+                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+                "enforced_by": "review",
+                "probe": "database.sign-in-bot-check"
+            }
+        ],
+        "probes": [],
+        "proved_by": [
+            "database"
+        ],
+        "offer": {
+            "pattern": "switch_on",
+            "when": "The client wants people to sign in or have accounts: a members' area, saved orders or bookings, a profile, \"my account\", or a page only some people may see.",
+            "say": "Sign-in is already built in: people get a code by email and type it, so there are no passwords to forget or leak. I'll put the pages that need it behind it. Here's what I think needs sign-in; tell me what to change.",
+            "answers_file": "workbench/sign-in.json",
+            "answers_format": "`{ \"format\": 1, \"status\": \"draft\" | \"done\", \"pages\": [{ \"path\": \"/orders\", \"what\": \"<what it shows or does, in the client's words>\", \"who\": \"signed_in\" | \"owner\" | \"admins\", \"fresh\": true | false }] }`, one entry per page or action that needs a signed-in person. `who` is `signed_in` (anyone with an account), `owner` (only the person the thing belongs to, enforced by row-level security on their user id through `dbAs`) or `admins` (only people in `app_admins`). `fresh` is true where it also needs a code typed in the last 15 minutes. Save it as a draft until the client accepts the table. Then build each page with `requireUser`, enforce its `who`, and check `fresh` on the ones marked so.",
+            "questions": [
+                {
+                    "id": "sign-in.pages",
+                    "sets": [
+                        "page.sign_in",
+                        "page.who",
+                        "page.fresh"
+                    ],
+                    "ask": "Here are the pages and actions that need someone signed in, who among them may use each one, and which also need a fresh code because they show or change something sensitive. Accept them, or change some?",
+                    "style": "table",
+                    "note": "Propose from the pages built or planned. Anything that shows or changes a person's own things (orders, bookings, a profile) needs sign-in, with `who` set to `owner`. Signing in only proves who someone is, and anyone can make an account, so a page for staff or admins must say `admins`: `requireUser` alone would let any stranger who signs up use it. Mark `fresh` where a stranger holding a signed-in phone could do harm: showing payment details, changing an email address, adding an admin, deleting an account. The template has no re-check screen: when `fresh` is false, the page tells the person to sign out and sign in again with a new code, as the admins section of `/admin/brand` does. Pages anyone may read, such as the home page, a menu or a contact form, stay open. Only the client knows what is private and who may do what, so always show the table."
+                }
+            ],
+            "not_asked": [
+                {
+                    "sets": "sign_in.method",
+                    "why": "The template signs people in with an emailed code only (Workbench's choice: no password to forget, leak or reuse), and the authentication standard rules out sign-in links. Passwords and social sign-in (\"sign in with Google\") aren't built. If the client asks for one, say so and that it is the Workbench owner's call; don't build it."
+                },
+                {
+                    "sets": "sign_in.length",
+                    "why": "Sessions last weeks, with a cap, as the authentication standard (§10) asks. The package's defaults (SESSION_DEFAULTS) sign a person out after 14 days without a visit and 30 days after the code was typed, whatever happens; on a shared device they untick \"keep me signed in\" and are signed out after 30 minutes idle. Say so if the client asks, and don't change them."
+                },
+                {
+                    "sets": "sign_in.who",
+                    "why": "Anyone with an email address can make an account; invite-only sign-up isn't built yet. If the client needs only invited people, say it isn't built yet and ask them how they want to handle it. Don't build an invite system of your own."
+                },
+                {
+                    "sets": "sign_in.bot_check",
+                    "why": "The Turnstile check is always on outside development. Control sets it up (cf_turnstile_widget_create, then cf_worker_secret_put sources turnstile_sitekey and turnstile_secret); there is nothing to ask."
+                }
+            ]
+        },
+        "delivery": {
+            "choice": "built_in",
+            "intro": "People signing in to the app with a code emailed to them, with no passwords to forget."
+        }
+    },
     "strings": {
         "$schema": "./schema.json",
         "format": 1,

package/dist/capability-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui", "forms"];
+export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui", "forms", "sign-in"];
 export type Component = (typeof COMPONENTS)[number];
 export declare const allowedSchemas: {
     gateway: z.ZodObject<{
@@ -179,6 +179,7 @@ export declare const capabilitySchema: z.ZodObject<{
         kv: "kv";
         pdf: "pdf";
         r2: "r2";
+        "sign-in": "sign-in";
         strings: "strings";
         ui: "ui";
         workers: "workers";
@@ -289,6 +290,31 @@ export declare const capabilitySchema: z.ZodObject<{
         two_step: z.ZodOptional<z.ZodBoolean>;
         note: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    proved_by: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        access: "access";
+        ai: "ai";
+        analytics: "analytics";
+        config: "config";
+        country: "country";
+        database: "database";
+        dns: "dns";
+        domains: "domains";
+        email: "email";
+        "email-inbound": "email-inbound";
+        "email-sending": "email-sending";
+        forms: "forms";
+        gateway: "gateway";
+        github: "github";
+        "image-search": "image-search";
+        images: "images";
+        kv: "kv";
+        pdf: "pdf";
+        r2: "r2";
+        "sign-in": "sign-in";
+        strings: "strings";
+        ui: "ui";
+        workers: "workers";
+    }>>>;
     offer: z.ZodOptional<z.ZodObject<{
         pattern: z.ZodEnum<{
             drafts: "drafts";

package/dist/capability-schema.js

@@ -25,6 +25,7 @@ export const COMPONENTS = [
     "strings",
     "ui",
     "forms",
+    "sign-in",
 ];
 const id = z.string().regex(/^[a-z0-9][a-z0-9.-]*$/, "lower case, digits, dots and hyphens");
 const code = z.string().regex(/^[a-z][a-z0-9_]*$/, "a snake_case error code");
@@ -226,7 +227,14 @@ const baseShape = {
     errors: z.array(errorEntry).min(1).optional(),
     rules: z.array(rule).min(1),
     examples: z.array(example).min(1).optional(),
-    probes: z.array(probe).min(1),
+    /** Empty only with `proved_by`, when every rule's probe lives in those manifests. */
+    probes: z.array(probe),
+    /**
+     * Components whose probes may prove this one's rules, when one run proves
+     * both (sign-in's rules are proved by database's sign-in probes, whose ids
+     * wb-probe's run history keys on).
+     */
+    proved_by: z.array(z.enum(COMPONENTS)).min(1).optional(),
     offer: offer.optional(),
     /** Why a client has nothing to answer for this component (plumbing). A manifest has `offer` or `no_offer`. */
     no_offer: z.string().min(1).optional(),
@@ -307,6 +315,8 @@ export function checkManifests(files) {
     const problems = [];
     const manifests = [];
     const globalIds = new Map();
+    // A rule may name a probe in a `proved_by` manifest; checked once every file is read.
+    const deferred = [];
     for (const [file, json] of Object.entries(files)) {
         const parsed = capabilitySchema.safeParse(json);
         if (!parsed.success) {
@@ -344,10 +354,9 @@ export function checkManifests(files) {
             seen("limit", l.id);
         for (const e of m.examples ?? [])
             seen("example", e.id);
-        for (const r of m.rules) {
-            if (!probeIds.has(r.probe))
-                problems.push({ file, check: "proof", message: `rule ${r.id} names probe ${r.probe}, which isn't in this file` });
-        }
+        deferred.push({ file, m, own: probeIds });
+        if (m.probes.length === 0 && !m.proved_by)
+            problems.push({ file, check: "proof", message: "has no probes: add one, or name in proved_by the component whose probes prove these rules" });
         for (const e of m.examples ?? []) {
             if (!probeIds.has(e.probe))
                 problems.push({ file, check: "proof", message: `example ${e.id} names probe ${e.probe}, which isn't in this file` });
@@ -388,5 +397,21 @@ export function checkManifests(files) {
         if (m.delivery && !m.offer && !m.delivery.when)
             problems.push({ file, check: "schema", message: "delivery needs when, because there is no offer to say when the tool applies" });
     }
+    const byComponent = new Map(manifests.map((m) => [m.component, m]));
+    for (const { file, m, own } of deferred) {
+        const provers = (m.proved_by ?? []).flatMap((c) => {
+            const prover = byComponent.get(c);
+            if (!prover)
+                problems.push({ file, check: "proof", message: `proved_by names ${c}, which isn't among the manifests` });
+            else if (m.status === "built" && prover.status !== "built")
+                problems.push({ file, check: "proof", message: `proved_by names ${c}, which isn't built` });
+            return prover ? [prover] : [];
+        });
+        for (const r of m.rules) {
+            if (own.has(r.probe) || provers.some((p) => p.probes.some((x) => x.id === r.probe)))
+                continue;
+            problems.push({ file, check: "proof", message: `rule ${r.id} names probe ${r.probe}, which isn't in this file${m.proved_by ? " or a proved_by manifest" : ""}` });
+        }
+    }
     return { manifests, problems };
 }

package/dist/env.d.ts

@@ -1,6 +1,5 @@
 export declare const WORKBENCH_ENVS: readonly ["development", "staging", "production"];
 export type WorkbenchEnv = (typeof WORKBENCH_ENVS)[number];
-export declare const DEFAULT_GATEWAY_URL = "https://gateway.mccaskielabs.dev";
 /**
  * Reads `WORKBENCH_ENV`. Throws if it is missing or not one of the three
  * environments. Never falls back to `NODE_ENV` or a default (audit F9, F18).

package/dist/env.js

@@ -1,6 +1,5 @@
 import { invalid, missing } from "./errors.js";
 export const WORKBENCH_ENVS = ["development", "staging", "production"];
-export const DEFAULT_GATEWAY_URL = "https://gateway.mccaskielabs.dev";
 /**
  * Reads `WORKBENCH_ENV`. Throws if it is missing or not one of the three
  * environments. Never falls back to `NODE_ENV` or a default (audit F9, F18).

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { WORKBENCH_ENVS, DEFAULT_GATEWAY_URL, workbenchEnv, type WorkbenchEnv } from "./env.ts";
+export { WORKBENCH_ENVS, workbenchEnv, type WorkbenchEnv } from "./env.ts";
 export { defineConfig, type Config } from "./define-config.ts";
 export { sharedSecret, workerSecret, redact, redactAll, type SecretsStoreSecretLike } from "./secrets.ts";
 export { WorkbenchConfigError, type ConfigErrorCode, type ConfigProblem } from "./errors.ts";

package/dist/index.js

@@ -1,4 +1,4 @@
-export { WORKBENCH_ENVS, DEFAULT_GATEWAY_URL, workbenchEnv } from "./env.js";
+export { WORKBENCH_ENVS, workbenchEnv } from "./env.js";
 export { defineConfig } from "./define-config.js";
 export { sharedSecret, workerSecret, redact, redactAll } from "./secrets.js";
 export { WorkbenchConfigError } from "./errors.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.41",
+  "version": "0.2.1",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",