@mccaskie-labs/workbench-config 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @mccaskie-labs/workbench-config
 
+## 0.2.1
+
+### Patch Changes
+
+- Sign-in gets its own component, `sign-in`: a built-in skill (`workbench-sign-in`) that `workbench-start` lists, with one client question (which pages and actions need a signed-in person, who among them may use each, and which also need a fresh code), written to `workbench/sign-in.json`. Its surfaces, config (`SESSION_SECRET`, `TURNSTILE_SITE_KEY`, `TURNSTILE_SECRET_KEY`), Turnstile actions and three rules move out of `database` (rule ids now `sign-in.server-side`, `sign-in.writes-same-origin`, `sign-in.checks-for-bots`); the probes keep their `database.*` ids. A new optional `proved_by` lets a manifest's rules name probes in the components it lists (sign-in names `database`); only then may its own `probes` be empty.
+
 ## 0.2.0
 
 ### Minor Changes

package/capabilities/database.json

@@ -17,10 +17,7 @@
       "createServerClient",
       "createUserClient",
       "createServiceClient",
-      "WorkbenchSupabaseError",
-      "createSessions",
-      "safeReturnPath",
-      "sameOrigin"
+      "WorkbenchSupabaseError"
     ],
     "tools": [
       "sb_project_create",
@@ -29,9 +26,7 @@
       "sb_query",
       "sb_project_delete",
       "cf_worker_secret_put",
-      "vendor_settings_apply",
-      "cf_turnstile_widget_create",
-      "cf_turnstile_widget_delete"
+      "vendor_settings_apply"
     ]
   },
   "config": [
@@ -66,39 +61,6 @@
         "production"
       ],
       "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
-    },
-    {
-      "name": "SESSION_SECRET",
-      "required": false,
-      "secret": true,
-      "environments": [
-        "development",
-        "staging",
-        "production"
-      ],
-      "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
-    },
-    {
-      "name": "TURNSTILE_SITE_KEY",
-      "required": false,
-      "secret": false,
-      "environments": [
-        "development",
-        "staging",
-        "production"
-      ],
-      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
-    },
-    {
-      "name": "TURNSTILE_SECRET_KEY",
-      "required": false,
-      "secret": true,
-      "environments": [
-        "development",
-        "staging",
-        "production"
-      ],
-      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
     }
   ],
   "actions": [
@@ -141,16 +103,6 @@
       "gate": "two_step_when",
       "when": "production, after the first successful apply on that database; staging and check_only are free",
       "ships": "5"
-    },
-    {
-      "tool": "cf_turnstile_widget_create",
-      "gate": "free",
-      "ships": "5"
-    },
-    {
-      "tool": "cf_turnstile_widget_delete",
-      "gate": "two_step",
-      "ships": "5"
     }
   ],
   "rules": [
@@ -195,27 +147,6 @@
       "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
       "enforced_by": "control",
       "probe": "database.vendor-settings"
-    },
-    {
-      "id": "database.sign-in-server-side",
-      "kind": "must",
-      "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
-      "enforced_by": "review",
-      "probe": "database.sign-in"
-    },
-    {
-      "id": "database.session-writes-same-origin",
-      "kind": "must",
-      "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
-      "enforced_by": "review",
-      "probe": "database.session-cookie"
-    },
-    {
-      "id": "database.sign-in-checks-for-bots",
-      "kind": "must",
-      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
-      "enforced_by": "review",
-      "probe": "database.sign-in-bot-check"
     }
   ],
   "examples": [

package/capabilities/schema.json

@@ -34,7 +34,8 @@
         "github",
         "strings",
         "ui",
-        "forms"
+        "forms",
+        "sign-in"
       ]
     },
     "title": {
@@ -352,7 +353,6 @@
       }
     },
     "probes": {
-      "minItems": 1,
       "type": "array",
       "items": {
         "type": "object",
@@ -402,6 +402,38 @@
         "additionalProperties": false
       }
     },
+    "proved_by": {
+      "minItems": 1,
+      "type": "array",
+      "items": {
+        "type": "string",
+        "enum": [
+          "gateway",
+          "ai",
+          "images",
+          "image-search",
+          "config",
+          "email",
+          "email-inbound",
+          "email-sending",
+          "database",
+          "workers",
+          "domains",
+          "dns",
+          "analytics",
+          "country",
+          "pdf",
+          "access",
+          "r2",
+          "kv",
+          "github",
+          "strings",
+          "ui",
+          "forms",
+          "sign-in"
+        ]
+      }
+    },
     "offer": {
       "type": "object",
       "properties": {

package/capabilities/sign-in.json

@@ -0,0 +1,137 @@
+{
+  "$schema": "./schema.json",
+  "format": 1,
+  "component": "sign-in",
+  "title": "Sign-in",
+  "summary": "People sign in to the app with a code emailed to them and typed on the next screen: no password, no link and no reset email. The Worker holds the session in one sealed cookie and talks to Supabase Auth itself, so the browser never sees a token, and a Cloudflare Turnstile check runs before any code is sent. The template has it all; a page that needs a signed-in person asks for one with requireUser. Signing in proves who someone is, not what they may do: anyone can make an account.",
+  "status": "built",
+  "delivery": {
+    "choice": "built_in",
+    "intro": "People signing in to the app with a code emailed to them, with no passwords to forget."
+  },
+  "surfaces": {
+    "package": [
+      "createSessions",
+      "safeReturnPath",
+      "sameOrigin",
+      "plainAuthError"
+    ],
+    "tools": [
+      "cf_worker_secret_put",
+      "cf_turnstile_widget_create",
+      "cf_turnstile_widget_delete"
+    ]
+  },
+  "config": [
+    {
+      "name": "SESSION_SECRET",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+    },
+    {
+      "name": "TURNSTILE_SITE_KEY",
+      "required": false,
+      "secret": false,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+    },
+    {
+      "name": "TURNSTILE_SECRET_KEY",
+      "required": false,
+      "secret": true,
+      "environments": [
+        "development",
+        "staging",
+        "production"
+      ],
+      "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
+    }
+  ],
+  "actions": [
+    {
+      "tool": "cf_turnstile_widget_create",
+      "gate": "free",
+      "ships": "5"
+    },
+    {
+      "tool": "cf_turnstile_widget_delete",
+      "gate": "two_step",
+      "ships": "5"
+    }
+  ],
+  "rules": [
+    {
+      "id": "sign-in.server-side",
+      "kind": "must",
+      "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+      "enforced_by": "review",
+      "probe": "database.sign-in"
+    },
+    {
+      "id": "sign-in.writes-same-origin",
+      "kind": "must",
+      "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+      "enforced_by": "review",
+      "probe": "database.session-cookie"
+    },
+    {
+      "id": "sign-in.checks-for-bots",
+      "kind": "must",
+      "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+      "enforced_by": "review",
+      "probe": "database.sign-in-bot-check"
+    }
+  ],
+  "probes": [],
+  "offer": {
+    "pattern": "switch_on",
+    "when": "The client wants people to sign in or have accounts: a members' area, saved orders or bookings, a profile, \"my account\", or a page only some people may see.",
+    "say": "Sign-in is already built in: people get a code by email and type it, so there are no passwords to forget or leak. I'll put the pages that need it behind it. Here's what I think needs sign-in; tell me what to change.",
+    "answers_file": "workbench/sign-in.json",
+    "answers_format": "`{ \"format\": 1, \"status\": \"draft\" | \"done\", \"pages\": [{ \"path\": \"/orders\", \"what\": \"<what it shows or does, in the client's words>\", \"who\": \"signed_in\" | \"owner\" | \"admins\", \"fresh\": true | false }] }`, one entry per page or action that needs a signed-in person. `who` is `signed_in` (anyone with an account), `owner` (only the person the thing belongs to, enforced by row-level security on their user id through `dbAs`) or `admins` (only people in `app_admins`). `fresh` is true where it also needs a code typed in the last 15 minutes. Save it as a draft until the client accepts the table. Then build each page with `requireUser`, enforce its `who`, and check `fresh` on the ones marked so.",
+    "questions": [
+      {
+        "id": "sign-in.pages",
+        "sets": [
+          "page.sign_in",
+          "page.who",
+          "page.fresh"
+        ],
+        "ask": "Here are the pages and actions that need someone signed in, who among them may use each one, and which also need a fresh code because they show or change something sensitive. Accept them, or change some?",
+        "style": "table",
+        "note": "Propose from the pages built or planned. Anything that shows or changes a person's own things (orders, bookings, a profile) needs sign-in, with `who` set to `owner`. Signing in only proves who someone is, and anyone can make an account, so a page for staff or admins must say `admins`: `requireUser` alone would let any stranger who signs up use it. Mark `fresh` where a stranger holding a signed-in phone could do harm: showing payment details, changing an email address, adding an admin, deleting an account. The template has no re-check screen: when `fresh` is false, the page tells the person to sign out and sign in again with a new code, as the admins section of `/admin/brand` does. Pages anyone may read, such as the home page, a menu or a contact form, stay open. Only the client knows what is private and who may do what, so always show the table."
+      }
+    ],
+    "not_asked": [
+      {
+        "sets": "sign_in.method",
+        "why": "The template signs people in with an emailed code only (Workbench's choice: no password to forget, leak or reuse), and the authentication standard rules out sign-in links. Passwords and social sign-in (\"sign in with Google\") aren't built. If the client asks for one, say so and that it is the Workbench owner's call; don't build it."
+      },
+      {
+        "sets": "sign_in.length",
+        "why": "Sessions last weeks, with a cap, as the authentication standard (§10) asks. The package's defaults (SESSION_DEFAULTS) sign a person out after 14 days without a visit and 30 days after the code was typed, whatever happens; on a shared device they untick \"keep me signed in\" and are signed out after 30 minutes idle. Say so if the client asks, and don't change them."
+      },
+      {
+        "sets": "sign_in.who",
+        "why": "Anyone with an email address can make an account; invite-only sign-up isn't built yet. If the client needs only invited people, say it isn't built yet and ask them how they want to handle it. Don't build an invite system of your own."
+      },
+      {
+        "sets": "sign_in.bot_check",
+        "why": "The Turnstile check is always on outside development. Control sets it up (cf_turnstile_widget_create, then cf_worker_secret_put sources turnstile_sitekey and turnstile_secret); there is nothing to ask."
+      }
+    ]
+  },
+  "proved_by": [
+    "database"
+  ]
+}

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "5f4a5d2dad37";
+export declare const MANIFEST_VERSION: "984099bc7d3f";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -437,8 +437,8 @@ export declare const capabilities: {
         readonly summary: "Each project has its own Supabase projects, <id>-staging and <id>-production. Apps use them natively through workbench-supabase; Control creates them, writes their URL and keys onto the Workers, and applies migrations read from the repo.";
         readonly status: "built";
         readonly surfaces: {
-            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
-            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError", "createSessions", "safeReturnPath", "sameOrigin"];
+            readonly tools: readonly ["sb_project_create", "sb_migration_apply", "sb_migration_rollback", "sb_query", "sb_project_delete", "cf_worker_secret_put", "vendor_settings_apply"];
+            readonly package: readonly ["supabaseConfig", "createBrowserClient", "createServerClient", "createUserClient", "createServiceClient", "WorkbenchSupabaseError"];
         };
         readonly config: readonly [{
             readonly name: "SUPABASE_URL";
@@ -458,24 +458,6 @@ export declare const capabilities: {
             readonly secret: true;
             readonly environments: readonly ["staging", "production"];
             readonly description: "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step";
-        }, {
-            readonly name: "SESSION_SECRET";
-            readonly required: false;
-            readonly secret: true;
-            readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
-        }, {
-            readonly name: "TURNSTILE_SITE_KEY";
-            readonly required: false;
-            readonly secret: false;
-            readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
-        }, {
-            readonly name: "TURNSTILE_SECRET_KEY";
-            readonly required: false;
-            readonly secret: true;
-            readonly environments: readonly ["development", "staging", "production"];
-            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
         }];
         readonly actions: readonly [{
             readonly tool: "sb_project_create";
@@ -510,14 +492,6 @@ export declare const capabilities: {
             readonly gate: "two_step_when";
             readonly when: "production, after the first successful apply on that database; staging and check_only are free";
             readonly ships: "5";
-        }, {
-            readonly tool: "cf_turnstile_widget_create";
-            readonly gate: "free";
-            readonly ships: "5";
-        }, {
-            readonly tool: "cf_turnstile_widget_delete";
-            readonly gate: "two_step";
-            readonly ships: "5";
         }];
         readonly rules: readonly [{
             readonly id: "database.rls-isolates-users";
@@ -555,24 +529,6 @@ export declare const capabilities: {
             readonly text: "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.";
             readonly enforced_by: "control";
             readonly probe: "database.vendor-settings";
-        }, {
-            readonly id: "database.sign-in-server-side";
-            readonly kind: "must";
-            readonly text: "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.";
-            readonly enforced_by: "review";
-            readonly probe: "database.sign-in";
-        }, {
-            readonly id: "database.session-writes-same-origin";
-            readonly kind: "must";
-            readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
-            readonly enforced_by: "review";
-            readonly probe: "database.session-cookie";
-        }, {
-            readonly id: "database.sign-in-checks-for-bots";
-            readonly kind: "must";
-            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
-            readonly enforced_by: "review";
-            readonly probe: "database.sign-in-bot-check";
         }];
         readonly examples: readonly [{
             readonly id: "database.example.user-client";
@@ -1934,6 +1890,98 @@ export declare const capabilities: {
             readonly when: "The client wants a PDF: an invoice, receipt, quote, certificate, report or anything else to download or print.";
         };
     };
+    readonly "sign-in": {
+        readonly $schema: "./schema.json";
+        readonly format: 1;
+        readonly component: "sign-in";
+        readonly title: "Sign-in";
+        readonly summary: "People sign in to the app with a code emailed to them and typed on the next screen: no password, no link and no reset email. The Worker holds the session in one sealed cookie and talks to Supabase Auth itself, so the browser never sees a token, and a Cloudflare Turnstile check runs before any code is sent. The template has it all; a page that needs a signed-in person asks for one with requireUser. Signing in proves who someone is, not what they may do: anyone can make an account.";
+        readonly status: "built";
+        readonly surfaces: {
+            readonly tools: readonly ["cf_worker_secret_put", "cf_turnstile_widget_create", "cf_turnstile_widget_delete"];
+            readonly package: readonly ["createSessions", "safeReturnPath", "sameOrigin", "plainAuthError"];
+        };
+        readonly config: readonly [{
+            readonly name: "SESSION_SECRET";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in";
+        }, {
+            readonly name: "TURNSTILE_SITE_KEY";
+            readonly required: false;
+            readonly secret: false;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it";
+        }, {
+            readonly name: "TURNSTILE_SECRET_KEY";
+            readonly required: false;
+            readonly secret: true;
+            readonly environments: readonly ["development", "staging", "production"];
+            readonly description: "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it";
+        }];
+        readonly actions: readonly [{
+            readonly tool: "cf_turnstile_widget_create";
+            readonly gate: "free";
+            readonly ships: "5";
+        }, {
+            readonly tool: "cf_turnstile_widget_delete";
+            readonly gate: "two_step";
+            readonly ships: "5";
+        }];
+        readonly rules: readonly [{
+            readonly id: "sign-in.server-side";
+            readonly kind: "must";
+            readonly text: "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in";
+        }, {
+            readonly id: "sign-in.writes-same-origin";
+            readonly kind: "must";
+            readonly text: "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.";
+            readonly enforced_by: "review";
+            readonly probe: "database.session-cookie";
+        }, {
+            readonly id: "sign-in.checks-for-bots";
+            readonly kind: "must";
+            readonly text: "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.";
+            readonly enforced_by: "review";
+            readonly probe: "database.sign-in-bot-check";
+        }];
+        readonly probes: readonly [];
+        readonly proved_by: readonly ["database"];
+        readonly offer: {
+            readonly pattern: "switch_on";
+            readonly when: "The client wants people to sign in or have accounts: a members' area, saved orders or bookings, a profile, \"my account\", or a page only some people may see.";
+            readonly say: "Sign-in is already built in: people get a code by email and type it, so there are no passwords to forget or leak. I'll put the pages that need it behind it. Here's what I think needs sign-in; tell me what to change.";
+            readonly answers_file: "workbench/sign-in.json";
+            readonly answers_format: "`{ \"format\": 1, \"status\": \"draft\" | \"done\", \"pages\": [{ \"path\": \"/orders\", \"what\": \"<what it shows or does, in the client's words>\", \"who\": \"signed_in\" | \"owner\" | \"admins\", \"fresh\": true | false }] }`, one entry per page or action that needs a signed-in person. `who` is `signed_in` (anyone with an account), `owner` (only the person the thing belongs to, enforced by row-level security on their user id through `dbAs`) or `admins` (only people in `app_admins`). `fresh` is true where it also needs a code typed in the last 15 minutes. Save it as a draft until the client accepts the table. Then build each page with `requireUser`, enforce its `who`, and check `fresh` on the ones marked so.";
+            readonly questions: readonly [{
+                readonly id: "sign-in.pages";
+                readonly sets: readonly ["page.sign_in", "page.who", "page.fresh"];
+                readonly ask: "Here are the pages and actions that need someone signed in, who among them may use each one, and which also need a fresh code because they show or change something sensitive. Accept them, or change some?";
+                readonly style: "table";
+                readonly note: "Propose from the pages built or planned. Anything that shows or changes a person's own things (orders, bookings, a profile) needs sign-in, with `who` set to `owner`. Signing in only proves who someone is, and anyone can make an account, so a page for staff or admins must say `admins`: `requireUser` alone would let any stranger who signs up use it. Mark `fresh` where a stranger holding a signed-in phone could do harm: showing payment details, changing an email address, adding an admin, deleting an account. The template has no re-check screen: when `fresh` is false, the page tells the person to sign out and sign in again with a new code, as the admins section of `/admin/brand` does. Pages anyone may read, such as the home page, a menu or a contact form, stay open. Only the client knows what is private and who may do what, so always show the table.";
+            }];
+            readonly not_asked: readonly [{
+                readonly sets: "sign_in.method";
+                readonly why: "The template signs people in with an emailed code only (Workbench's choice: no password to forget, leak or reuse), and the authentication standard rules out sign-in links. Passwords and social sign-in (\"sign in with Google\") aren't built. If the client asks for one, say so and that it is the Workbench owner's call; don't build it.";
+            }, {
+                readonly sets: "sign_in.length";
+                readonly why: "Sessions last weeks, with a cap, as the authentication standard (§10) asks. The package's defaults (SESSION_DEFAULTS) sign a person out after 14 days without a visit and 30 days after the code was typed, whatever happens; on a shared device they untick \"keep me signed in\" and are signed out after 30 minutes idle. Say so if the client asks, and don't change them.";
+            }, {
+                readonly sets: "sign_in.who";
+                readonly why: "Anyone with an email address can make an account; invite-only sign-up isn't built yet. If the client needs only invited people, say it isn't built yet and ask them how they want to handle it. Don't build an invite system of your own.";
+            }, {
+                readonly sets: "sign_in.bot_check";
+                readonly why: "The Turnstile check is always on outside development. Control sets it up (cf_turnstile_widget_create, then cf_worker_secret_put sources turnstile_sitekey and turnstile_secret); there is nothing to ask.";
+            }];
+        };
+        readonly delivery: {
+            readonly choice: "built_in";
+            readonly intro: "People signing in to the app with a code emailed to them, with no passwords to forget.";
+        };
+    };
     readonly strings: {
         readonly $schema: "./schema.json";
         readonly format: 1;

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "5f4a5d2dad37";
+export const MANIFEST_VERSION = "984099bc7d3f";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -637,9 +637,7 @@ export const capabilities = {
                 "sb_query",
                 "sb_project_delete",
                 "cf_worker_secret_put",
-                "vendor_settings_apply",
-                "cf_turnstile_widget_create",
-                "cf_turnstile_widget_delete"
+                "vendor_settings_apply"
             ],
             "package": [
                 "supabaseConfig",
@@ -647,10 +645,7 @@ export const capabilities = {
                 "createServerClient",
                 "createUserClient",
                 "createServiceClient",
-                "WorkbenchSupabaseError",
-                "createSessions",
-                "safeReturnPath",
-                "sameOrigin"
+                "WorkbenchSupabaseError"
             ]
         },
         "config": [
@@ -685,39 +680,6 @@ export const capabilities = {
                     "production"
                 ],
                 "description": "The sb_secret_ key, only for code that must bypass RLS (createServiceClient); written by cf_worker_secret_put source=supabase_secret, always two-step"
-            },
-            {
-                "name": "SESSION_SECRET",
-                "required": false,
-                "secret": true,
-                "environments": [
-                    "development",
-                    "staging",
-                    "production"
-                ],
-                "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
-            },
-            {
-                "name": "TURNSTILE_SITE_KEY",
-                "required": false,
-                "secret": false,
-                "environments": [
-                    "development",
-                    "staging",
-                    "production"
-                ],
-                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
-            },
-            {
-                "name": "TURNSTILE_SECRET_KEY",
-                "required": false,
-                "secret": true,
-                "environments": [
-                    "development",
-                    "staging",
-                    "production"
-                ],
-                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
             }
         ],
         "actions": [
@@ -760,16 +722,6 @@ export const capabilities = {
                 "gate": "two_step_when",
                 "when": "production, after the first successful apply on that database; staging and check_only are free",
                 "ships": "5"
-            },
-            {
-                "tool": "cf_turnstile_widget_create",
-                "gate": "free",
-                "ships": "5"
-            },
-            {
-                "tool": "cf_turnstile_widget_delete",
-                "gate": "two_step",
-                "ships": "5"
             }
         ],
         "rules": [
@@ -814,27 +766,6 @@ export const capabilities = {
                 "text": "Keep Supabase's sign-in settings at the Workbench baseline (workbench-config VENDOR_SETTINGS), or record a project's change in vendor-settings.json with a reason. Control applies it with vendor_settings_apply and checks it every day.",
                 "enforced_by": "control",
                 "probe": "database.vendor-settings"
-            },
-            {
-                "id": "database.sign-in-server-side",
-                "kind": "must",
-                "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
-                "enforced_by": "review",
-                "probe": "database.sign-in"
-            },
-            {
-                "id": "database.session-writes-same-origin",
-                "kind": "must",
-                "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
-                "enforced_by": "review",
-                "probe": "database.session-cookie"
-            },
-            {
-                "id": "database.sign-in-checks-for-bots",
-                "kind": "must",
-                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
-                "enforced_by": "review",
-                "probe": "database.sign-in-bot-check"
             }
         ],
         "examples": [
@@ -2607,6 +2538,143 @@ export const capabilities = {
             "when": "The client wants a PDF: an invoice, receipt, quote, certificate, report or anything else to download or print."
         }
     },
+    "sign-in": {
+        "$schema": "./schema.json",
+        "format": 1,
+        "component": "sign-in",
+        "title": "Sign-in",
+        "summary": "People sign in to the app with a code emailed to them and typed on the next screen: no password, no link and no reset email. The Worker holds the session in one sealed cookie and talks to Supabase Auth itself, so the browser never sees a token, and a Cloudflare Turnstile check runs before any code is sent. The template has it all; a page that needs a signed-in person asks for one with requireUser. Signing in proves who someone is, not what they may do: anyone can make an account.",
+        "status": "built",
+        "surfaces": {
+            "tools": [
+                "cf_worker_secret_put",
+                "cf_turnstile_widget_create",
+                "cf_turnstile_widget_delete"
+            ],
+            "package": [
+                "createSessions",
+                "safeReturnPath",
+                "sameOrigin",
+                "plainAuthError"
+            ]
+        },
+        "config": [
+            {
+                "name": "SESSION_SECRET",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "Seals the sign-in session cookie (createSessions). 32 random bytes written by cf_worker_secret_put source=generate:32; replacing it signs everybody out, so it is two-step. Only needed by an app with sign-in"
+            },
+            {
+                "name": "TURNSTILE_SITE_KEY",
+                "required": false,
+                "secret": false,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The public site key of the hostname's Turnstile widget, for the sign-in bot check; written by cf_worker_secret_put source=turnstile_sitekey after cf_turnstile_widget_create. Outside development, sign-in won't send codes without it"
+            },
+            {
+                "name": "TURNSTILE_SECRET_KEY",
+                "required": false,
+                "secret": true,
+                "environments": [
+                    "development",
+                    "staging",
+                    "production"
+                ],
+                "description": "The secret of the hostname's Turnstile widget, sent only to Cloudflare's Siteverify; written by cf_worker_secret_put source=turnstile_secret. Outside development, sign-in won't send codes without it"
+            }
+        ],
+        "actions": [
+            {
+                "tool": "cf_turnstile_widget_create",
+                "gate": "free",
+                "ships": "5"
+            },
+            {
+                "tool": "cf_turnstile_widget_delete",
+                "gate": "two_step",
+                "ships": "5"
+            }
+        ],
+        "rules": [
+            {
+                "id": "sign-in.server-side",
+                "kind": "must",
+                "text": "Sign people in through the app's own endpoints with createSessions: the browser never talks to Supabase Auth and never holds the access token, and codes are typed, never links.",
+                "enforced_by": "review",
+                "probe": "database.sign-in"
+            },
+            {
+                "id": "sign-in.writes-same-origin",
+                "kind": "must",
+                "text": "Refuse a write (anything but GET or HEAD) made with the session cookie unless sameOrigin(request) is true.",
+                "enforced_by": "review",
+                "probe": "database.session-cookie"
+            },
+            {
+                "id": "sign-in.checks-for-bots",
+                "kind": "must",
+                "text": "Outside development, verify a Turnstile token with Siteverify (success, this hostname and the sign-in action) before asking Supabase to send or re-send a sign-in code, and send no code when either Turnstile key is missing.",
+                "enforced_by": "review",
+                "probe": "database.sign-in-bot-check"
+            }
+        ],
+        "probes": [],
+        "proved_by": [
+            "database"
+        ],
+        "offer": {
+            "pattern": "switch_on",
+            "when": "The client wants people to sign in or have accounts: a members' area, saved orders or bookings, a profile, \"my account\", or a page only some people may see.",
+            "say": "Sign-in is already built in: people get a code by email and type it, so there are no passwords to forget or leak. I'll put the pages that need it behind it. Here's what I think needs sign-in; tell me what to change.",
+            "answers_file": "workbench/sign-in.json",
+            "answers_format": "`{ \"format\": 1, \"status\": \"draft\" | \"done\", \"pages\": [{ \"path\": \"/orders\", \"what\": \"<what it shows or does, in the client's words>\", \"who\": \"signed_in\" | \"owner\" | \"admins\", \"fresh\": true | false }] }`, one entry per page or action that needs a signed-in person. `who` is `signed_in` (anyone with an account), `owner` (only the person the thing belongs to, enforced by row-level security on their user id through `dbAs`) or `admins` (only people in `app_admins`). `fresh` is true where it also needs a code typed in the last 15 minutes. Save it as a draft until the client accepts the table. Then build each page with `requireUser`, enforce its `who`, and check `fresh` on the ones marked so.",
+            "questions": [
+                {
+                    "id": "sign-in.pages",
+                    "sets": [
+                        "page.sign_in",
+                        "page.who",
+                        "page.fresh"
+                    ],
+                    "ask": "Here are the pages and actions that need someone signed in, who among them may use each one, and which also need a fresh code because they show or change something sensitive. Accept them, or change some?",
+                    "style": "table",
+                    "note": "Propose from the pages built or planned. Anything that shows or changes a person's own things (orders, bookings, a profile) needs sign-in, with `who` set to `owner`. Signing in only proves who someone is, and anyone can make an account, so a page for staff or admins must say `admins`: `requireUser` alone would let any stranger who signs up use it. Mark `fresh` where a stranger holding a signed-in phone could do harm: showing payment details, changing an email address, adding an admin, deleting an account. The template has no re-check screen: when `fresh` is false, the page tells the person to sign out and sign in again with a new code, as the admins section of `/admin/brand` does. Pages anyone may read, such as the home page, a menu or a contact form, stay open. Only the client knows what is private and who may do what, so always show the table."
+                }
+            ],
+            "not_asked": [
+                {
+                    "sets": "sign_in.method",
+                    "why": "The template signs people in with an emailed code only (Workbench's choice: no password to forget, leak or reuse), and the authentication standard rules out sign-in links. Passwords and social sign-in (\"sign in with Google\") aren't built. If the client asks for one, say so and that it is the Workbench owner's call; don't build it."
+                },
+                {
+                    "sets": "sign_in.length",
+                    "why": "Sessions last weeks, with a cap, as the authentication standard (§10) asks. The package's defaults (SESSION_DEFAULTS) sign a person out after 14 days without a visit and 30 days after the code was typed, whatever happens; on a shared device they untick \"keep me signed in\" and are signed out after 30 minutes idle. Say so if the client asks, and don't change them."
+                },
+                {
+                    "sets": "sign_in.who",
+                    "why": "Anyone with an email address can make an account; invite-only sign-up isn't built yet. If the client needs only invited people, say it isn't built yet and ask them how they want to handle it. Don't build an invite system of your own."
+                },
+                {
+                    "sets": "sign_in.bot_check",
+                    "why": "The Turnstile check is always on outside development. Control sets it up (cf_turnstile_widget_create, then cf_worker_secret_put sources turnstile_sitekey and turnstile_secret); there is nothing to ask."
+                }
+            ]
+        },
+        "delivery": {
+            "choice": "built_in",
+            "intro": "People signing in to the app with a code emailed to them, with no passwords to forget."
+        }
+    },
     "strings": {
         "$schema": "./schema.json",
         "format": 1,

package/dist/capability-schema.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui", "forms"];
+export declare const COMPONENTS: readonly ["gateway", "ai", "images", "image-search", "config", "email", "email-inbound", "email-sending", "database", "workers", "domains", "dns", "analytics", "country", "pdf", "access", "r2", "kv", "github", "strings", "ui", "forms", "sign-in"];
 export type Component = (typeof COMPONENTS)[number];
 export declare const allowedSchemas: {
     gateway: z.ZodObject<{
@@ -179,6 +179,7 @@ export declare const capabilitySchema: z.ZodObject<{
         kv: "kv";
         pdf: "pdf";
         r2: "r2";
+        "sign-in": "sign-in";
         strings: "strings";
         ui: "ui";
         workers: "workers";
@@ -289,6 +290,31 @@ export declare const capabilitySchema: z.ZodObject<{
         two_step: z.ZodOptional<z.ZodBoolean>;
         note: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    proved_by: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        access: "access";
+        ai: "ai";
+        analytics: "analytics";
+        config: "config";
+        country: "country";
+        database: "database";
+        dns: "dns";
+        domains: "domains";
+        email: "email";
+        "email-inbound": "email-inbound";
+        "email-sending": "email-sending";
+        forms: "forms";
+        gateway: "gateway";
+        github: "github";
+        "image-search": "image-search";
+        images: "images";
+        kv: "kv";
+        pdf: "pdf";
+        r2: "r2";
+        "sign-in": "sign-in";
+        strings: "strings";
+        ui: "ui";
+        workers: "workers";
+    }>>>;
     offer: z.ZodOptional<z.ZodObject<{
         pattern: z.ZodEnum<{
             drafts: "drafts";

package/dist/capability-schema.js

@@ -25,6 +25,7 @@ export const COMPONENTS = [
     "strings",
     "ui",
     "forms",
+    "sign-in",
 ];
 const id = z.string().regex(/^[a-z0-9][a-z0-9.-]*$/, "lower case, digits, dots and hyphens");
 const code = z.string().regex(/^[a-z][a-z0-9_]*$/, "a snake_case error code");
@@ -226,7 +227,14 @@ const baseShape = {
     errors: z.array(errorEntry).min(1).optional(),
     rules: z.array(rule).min(1),
     examples: z.array(example).min(1).optional(),
-    probes: z.array(probe).min(1),
+    /** Empty only with `proved_by`, when every rule's probe lives in those manifests. */
+    probes: z.array(probe),
+    /**
+     * Components whose probes may prove this one's rules, when one run proves
+     * both (sign-in's rules are proved by database's sign-in probes, whose ids
+     * wb-probe's run history keys on).
+     */
+    proved_by: z.array(z.enum(COMPONENTS)).min(1).optional(),
     offer: offer.optional(),
     /** Why a client has nothing to answer for this component (plumbing). A manifest has `offer` or `no_offer`. */
     no_offer: z.string().min(1).optional(),
@@ -307,6 +315,8 @@ export function checkManifests(files) {
     const problems = [];
     const manifests = [];
     const globalIds = new Map();
+    // A rule may name a probe in a `proved_by` manifest; checked once every file is read.
+    const deferred = [];
     for (const [file, json] of Object.entries(files)) {
         const parsed = capabilitySchema.safeParse(json);
         if (!parsed.success) {
@@ -344,10 +354,9 @@ export function checkManifests(files) {
             seen("limit", l.id);
         for (const e of m.examples ?? [])
             seen("example", e.id);
-        for (const r of m.rules) {
-            if (!probeIds.has(r.probe))
-                problems.push({ file, check: "proof", message: `rule ${r.id} names probe ${r.probe}, which isn't in this file` });
-        }
+        deferred.push({ file, m, own: probeIds });
+        if (m.probes.length === 0 && !m.proved_by)
+            problems.push({ file, check: "proof", message: "has no probes: add one, or name in proved_by the component whose probes prove these rules" });
         for (const e of m.examples ?? []) {
             if (!probeIds.has(e.probe))
                 problems.push({ file, check: "proof", message: `example ${e.id} names probe ${e.probe}, which isn't in this file` });
@@ -388,5 +397,21 @@ export function checkManifests(files) {
         if (m.delivery && !m.offer && !m.delivery.when)
             problems.push({ file, check: "schema", message: "delivery needs when, because there is no offer to say when the tool applies" });
     }
+    const byComponent = new Map(manifests.map((m) => [m.component, m]));
+    for (const { file, m, own } of deferred) {
+        const provers = (m.proved_by ?? []).flatMap((c) => {
+            const prover = byComponent.get(c);
+            if (!prover)
+                problems.push({ file, check: "proof", message: `proved_by names ${c}, which isn't among the manifests` });
+            else if (m.status === "built" && prover.status !== "built")
+                problems.push({ file, check: "proof", message: `proved_by names ${c}, which isn't built` });
+            return prover ? [prover] : [];
+        });
+        for (const r of m.rules) {
+            if (own.has(r.probe) || provers.some((p) => p.probes.some((x) => x.id === r.probe)))
+                continue;
+            problems.push({ file, check: "proof", message: `rule ${r.id} names probe ${r.probe}, which isn't in this file${m.proved_by ? " or a proved_by manifest" : ""}` });
+        }
+    }
     return { manifests, problems };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",