@sanoma-ai/workflows 0.10.2 → 0.10.3

package/dist/host.d.ts

@@ -38,8 +38,11 @@ export interface HostSpec {
         source: string;
         /** The branch (or tag) it runs: `main`, never a commit. */
         ref: string;
-        /** The secrets it passes the runtime (`SANOMA_DATABASE_URL`, `SANOMA_SECRETS_KEY`): a write-only field. */
-        secrets: string;
+        /**
+         * The secrets it passes the runtime (`SANOMA_DATABASE_URL`, `SANOMA_SECRETS_KEY`): a write-only
+         * field. Absent for a host that binds its own bootstrap (`bindsBootstrap`).
+         */
+        secrets?: string;
         /** The port the app listens on. */
         port: string;
         /** A public site's domain, by site name: the app serves each site at the root of its domain (`SANOMA_DOMAINS`). */
@@ -50,14 +53,20 @@ export interface HostSpec {
      * file may not declare it, so a merge to `ref` is a change to the host.
      */
     revision: string;
+    /**
+     * True for a host whose vendor mints the instance's bootstrap (its database URL, keys and
+     * tokens) and binds it itself, as Sanoma Cloud's does: such a type takes no `secrets`.
+     */
+    bindsBootstrap?: boolean;
     outputs: (state: Record<string, unknown>) => HostOutputs;
 }
 /** True when `schema` has a field at the dotted `path`, looking through optional, nullable and default wrappers. */
 export declare function hasPath(schema: z.ZodType, path: string): boolean;
 /**
  * Throws what is wrong with a resource type's `host`: an input or `revision` that names no field,
- * `secrets` that is not write-only, a `revision` that is, an unknown lifetime, a type apply cannot
- * change (not `writable`).
+ * `secrets` that is not write-only, missing (unless the host binds its own bootstrap) or given
+ * beside `bindsBootstrap`, a `revision` that is write-only, an unknown lifetime, a type apply
+ * cannot change (not `writable`).
  */
 export declare function checkHost(what: string, host: HostSpec, type: {
     schema: z.ZodObject;

package/dist/host.js

@@ -19,8 +19,9 @@ function unwrap(schema) {
 }
 /**
  * Throws what is wrong with a resource type's `host`: an input or `revision` that names no field,
- * `secrets` that is not write-only, a `revision` that is, an unknown lifetime, a type apply cannot
- * change (not `writable`).
+ * `secrets` that is not write-only, missing (unless the host binds its own bootstrap) or given
+ * beside `bindsBootstrap`, a `revision` that is write-only, an unknown lifetime, a type apply
+ * cannot change (not `writable`).
  */
 export function checkHost(what, host, type) {
     const problems = [];
@@ -29,12 +30,20 @@ export function checkHost(what, host, type) {
     if (!LIFETIMES.includes(host.capabilities?.lifetime)) {
         problems.push(`capabilities.lifetime is one of ${LIFETIMES.join(", ")}`);
     }
-    for (const [input, path] of [...Object.entries(host.inputs ?? {}), ["revision", host.revision]]) {
+    // An input given as undefined is one not given.
+    const given = Object.entries(host.inputs ?? {}).filter(([, path]) => path !== undefined);
+    for (const [input, path] of [...given, ["revision", host.revision]]) {
         if (typeof path !== "string" || !hasPath(type.schema, path))
             problems.push(`${input} names no field (${path})`);
     }
-    if (!type.fields.writeOnly.includes(host.inputs?.secrets))
-        problems.push("inputs.secrets must be a write-only field");
+    const secrets = host.inputs?.secrets;
+    if (host.bindsBootstrap) {
+        if (secrets !== undefined)
+            problems.push("inputs.secrets is not taken by a host that binds its own bootstrap");
+    }
+    else if (secrets === undefined || !type.fields.writeOnly.includes(secrets)) {
+        problems.push("inputs.secrets must be a write-only field, unless the host binds its own bootstrap");
+    }
     if (type.fields.writeOnly.includes(host.revision))
         problems.push("revision must not be write-only: drift reads it");
     if (typeof host.outputs !== "function")

package/dist/host.js.map

@@ -1 +1 @@
-{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AA+DA,MAAM,SAAS,GAA4B,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAE9E,oHAAoH;AACpH,MAAM,UAAU,OAAO,CAAC,MAAiB,EAAE,IAAY;IACrD,IAAI,EAAE,GAA0B,MAAM,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,KAAK,GAAI,EAA2B,CAAC,KAAK,CAAC;QACjD,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAiB;IAC/B,IAAI,EAAE,GAAG,MAAM,CAAC;IAChB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,UAAU;QAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAe,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAAc,EACd,IAA2F;IAE3F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAU,CAAC,EAAE,CAAC;QACzG,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACpH,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC"}
+{"version":3,"file":"host.js","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAuEA,MAAM,SAAS,GAA4B,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAE9E,oHAAoH;AACpH,MAAM,UAAU,OAAO,CAAC,MAAiB,EAAE,IAAY;IACrD,IAAI,EAAE,GAA0B,MAAM,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,KAAK,GAAI,EAA2B,CAAC,KAAK,CAAC;QACjD,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,MAAM,CAAC,MAAiB;IAC/B,IAAI,EAAE,GAAG,MAAM,CAAC;IAChB,OAAO,QAAQ,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,MAAM,KAAK,UAAU;QAAE,EAAE,GAAG,EAAE,CAAC,MAAM,EAAe,CAAC;IACxF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAAc,EACd,IAA2F;IAE3F,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,QAAQ,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IAC5F,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC,mCAAmC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,gDAAgD;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACzF,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAU,CAAC,EAAE,CAAC;QAC7E,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,oBAAoB,IAAI,GAAG,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;IACrC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACjH,CAAC;SAAM,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,QAAQ,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IACtG,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACpH,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU;QAAE,QAAQ,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,eAAe,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACpF,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-export { type CallContext, CLIENT_IP_HEADER, type Connector, type ConnectorSetup, type ConnectorVendor, type Driver, type DriverEnv, type DriverFn, defineConnector, DriverError, type Effect, isOp, isSvgElement, type LoginContext, type LoginHalf, type ModelContext, type Op, type OpSpec, type ResourceGroup, retryableStatus, type VendorInfo, withSetup, } from "./op.ts";
+export { type CallContext, CLIENT_IP_HEADER, requestOrigin, sameOrigin, type Connector, type ConnectorSetup, type ConnectorVendor, type Driver, type DriverEnv, type DriverFn, defineConnector, DriverError, type Effect, isOp, isSvgElement, INVITE_SECONDS, type LoginContext, type LoginHalf, type LoginIdentity, type LoginMethod, type ModelContext, type Op, type OpSpec, type ResourceGroup, retryableStatus, type SignInMethod, type VendorInfo, withSetup, } from "./op.ts";
 export { SanomaPackageField, vendorInfo } from "./vendor-info.ts";
-export { defineWorkflow, Principal, type ApprovalRequest, type ApprovalResult, type ApprovalState, type Approver, type Builtin, type Ctx, type SleepRequest, type StepOptions, type Trigger, type Use, type WorkflowDefinition, } from "./define.ts";
+export { defineWorkflow, Principal, type ApprovalRequest, type ApprovalResult, type ApprovalState, type Approver, type Builtin, type Ctx, type SleepRequest, type StartedBy, type StepOptions, type Trigger, type Use, type WorkflowDefinition, } from "./define.ts";
 export { compareDeclared, type Declared, type Declaring, defineResource, diffDeclared, type FieldReference, type PlanAction, type References, type Resource, type ResourceFields, type ResourceOps, type ResourceSpec, withoutWriteOnly, } from "./resource.ts";
-export { declaredWakeup, defineConfig, resolveConfig, resolveDatabaseUrl, type ResolvedConfig, type SanomaConfig, } from "./config.ts";
+export { declaredWakeup, defineConfig, envWakeup, resolveConfig, resolveDatabaseUrl, type ResolvedConfig, type SanomaConfig, } from "./config.ts";
 export { type AppEntry, appSourceOf, readApps } from "./apps.ts";
 export { type AppDefinition, defineApp } from "./definitions.ts";
 export { appFolders, APPS_DIR, filesUnder, kindDirs } from "./paths.ts";
@@ -31,15 +31,19 @@ export { type AppMerge, type CheckResult, type Draft, draftBranch, type DraftDif
 export type { HostCapabilities, HostLifetime, HostOutputs, HostSpec } from "./host.ts";
 export { checkDatabase, type DatabaseCapabilities, type DatabaseOutputs, type DatabaseSpec, databaseUrlSecret, storeDatabaseUrl, } from "./database.ts";
 export type { Chat, Chats } from "./chats.ts";
-export { checkWakeup, type DeclaredWakeup, type WakeupOutputs, type WakeupRegistration, type WakeupSpec, wakeupHostTypes, } from "./wakeup.ts";
+export type { Tokens } from "./tokens.ts";
+export { type InviteRequest, openInvite, sealInvite, sealLoginCode } from "./seal.ts";
+export { postInvite, sanoma } from "./runtime-ops.ts";
+export { sourceKeyPair, sshPublicKey } from "./ssh-key.ts";
+export { checkWakeup, type DeclaredWakeup, type EnvWakeup, HOST_URL, WAKE_PATH, type WakeupOutputs, type WakeupRegistration, type WakeupSpec, wakeupHostTypes, } from "./wakeup.ts";
 export { type CallOptions, type ChangesFilter, type ChangeView, type ClientOptions, type ConnectionReview, SanomaClient, type RunsFilter, type RunSummary, type StartOptions, type StoredSecret, } from "./client.ts";
 export { dbosClient } from "./db.ts";
-export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, type PeopleResource, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, type RunStatus, VISITORS, visitorPrincipal, warningLine, } from "./shared.ts";
+export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, type PeopleResource, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, LOGIN_AGENT, LOGIN_CODE_WORKFLOW, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, type RunStatus, VISITORS, visitorPrincipal, warningLine, } from "./shared.ts";
 export { defineDriver, type DriverImpl, type OpIdOf } from "./op.ts";
 export { defineSteps, type Expect, type RunView, type Seed, type Steps } from "./steps.ts";
 export { SecretAccess, SecretStoreError, checkSecretConfiguration, memorySecretStore, type SecretAddress, type SecretBinding, type SecretConfiguration, type SecretLocation, type SecretStore, type SecretStoreCapabilities, type SecretStoreErrorCode, type SecretValue, } from "./secret-store.ts";
 export { defineAuthentication, checkAuthenticationStore, encodeCredentials, decodeCredentials, authenticationCredentials, verifyAuthentication, AuthenticationError, type AuthenticationProblem, type Authentication, type AuthenticationIdentity, type AuthenticationContext, type CallAuthentication, } from "./authentication.ts";
 export { checkSecretStore, type SecretStoreCheck } from "./secret-store-check.ts";
 export { postgresSecretStore } from "./credentials.ts";
-export { deploymentKey } from "./deployment-key.ts";
+export { deploymentKey, signingKeyFor } from "./deployment-key.ts";
 export { defineConnection, defineConnectionRule, connectionRef, connectionOps, type ConnectionRef, type ConnectionDefinition, type ConnectionRule, type ConnectionSnapshot, type ConnectionCard, type ConnectionHealth, type ConnectionTarget, type ConnectionSetup, } from "./connection.ts";

package/dist/index.js

@@ -1,8 +1,8 @@
-export { CLIENT_IP_HEADER, defineConnector, DriverError, isOp, isSvgElement, retryableStatus, withSetup, } from "./op.js";
+export { CLIENT_IP_HEADER, requestOrigin, sameOrigin, defineConnector, DriverError, isOp, isSvgElement, INVITE_SECONDS, retryableStatus, withSetup, } from "./op.js";
 export { SanomaPackageField, vendorInfo } from "./vendor-info.js";
 export { defineWorkflow, Principal, } from "./define.js";
 export { compareDeclared, defineResource, diffDeclared, withoutWriteOnly, } from "./resource.js";
-export { declaredWakeup, defineConfig, resolveConfig, resolveDatabaseUrl, } from "./config.js";
+export { declaredWakeup, defineConfig, envWakeup, resolveConfig, resolveDatabaseUrl, } from "./config.js";
 // An app's `app.ts` (`defineApp`), and where the launcher finds an app's workflows and data file.
 export { appSourceOf, readApps } from "./apps.js";
 export { defineApp } from "./definitions.js";
@@ -30,12 +30,15 @@ export { nextFire, nextScheduledFire } from "./schedules.js";
 export { generateSecret, isSecret, memorySecrets, resolveSecrets, } from "./secret.js";
 export { draftBranch, draftOf, remoteFor, resolveRevision, SOURCE_RESOLVE, } from "./source.js";
 export { checkDatabase, databaseUrlSecret, storeDatabaseUrl, } from "./database.js";
-export { checkWakeup, wakeupHostTypes, } from "./wakeup.js";
+export { openInvite, sealInvite, sealLoginCode } from "./seal.js";
+export { postInvite, sanoma } from "./runtime-ops.js";
+export { sourceKeyPair, sshPublicKey } from "./ssh-key.js";
+export { checkWakeup, HOST_URL, WAKE_PATH, wakeupHostTypes, } from "./wakeup.js";
 export { SanomaClient, } from "./client.js";
 // A raw DBOS client on the runtime's database, for tests and tools that read DBOS directly.
 export { dbosClient } from "./db.js";
 // Also at `@sanoma-ai/workflows/shared`, which a browser bundle can import.
-export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, VISITORS, visitorPrincipal, warningLine, } from "./shared.js";
+export { AGENTS, ANONYMOUS, ANONYMOUS_PRINCIPAL, approverLabel, approverOf, CHANGE_CLOSE, CHANGE_EVENT, CHANGE_MERGE, CHANGE_OPEN, CHANGE_REVIEW, CHANGE_TOPIC, CHANGE_WORKFLOW, declaresPeople, personOf, principalOf, RUNTIME_AGENTS, HOST_CHECK_AGENT, LOGIN_AGENT, LOGIN_CODE_WORKFLOW, SCHEDULE_AGENT, credentialReady, DEFAULT_SLEEP_NAME, ENDED_STATUSES, errorMessage, isEnded, isLoopback, isVisitor, mayDecide, problemAt, problemLine, RUN_STATUSES, VISITORS, visitorPrincipal, warningLine, } from "./shared.js";
 // describeConfig, with the outline and every problem lintWorkflow finds, lives at
 // `@sanoma-ai/workflows/describe`: what a UI renders from, apart from what runs. The worker reads
 // each workflow's outline too, to hold its runs to it.
@@ -47,6 +50,6 @@ export { SecretAccess, SecretStoreError, checkSecretConfiguration, memorySecretS
 export { defineAuthentication, checkAuthenticationStore, encodeCredentials, decodeCredentials, authenticationCredentials, verifyAuthentication, AuthenticationError, } from "./authentication.js";
 export { checkSecretStore } from "./secret-store-check.js";
 export { postgresSecretStore } from "./credentials.js";
-export { deploymentKey } from "./deployment-key.js";
+export { deploymentKey, signingKeyFor } from "./deployment-key.js";
 export { defineConnection, defineConnectionRule, connectionRef, connectionOps, } from "./connection.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAOhB,eAAe,EACf,WAAW,EAEX,IAAI,EACJ,YAAY,EAOZ,eAAe,EAEf,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,SAAS,GAYV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,cAAc,EACd,YAAY,EAQZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,aAAa,EACb,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,kGAAkG;AAClG,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxE,2GAA2G;AAC3G,gIAAgI;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,cAAc,EACd,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,KAAK,EAIL,WAAW,EACX,WAAW,EACX,SAAS,EAIT,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,cAAc,GAMf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EAIJ,UAAU,EAIV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EAEX,YAAY,EACZ,YAAY,EAEZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EAET,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAA2C,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,qGAAqG;AACrG,OAAO,EACL,cAAc,EACd,QAAQ,EACR,aAAa,EAEb,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,WAAW,EAEX,OAAO,EAMP,SAAS,EAET,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAIb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EAKX,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAML,YAAY,GAKb,MAAM,aAAa,CAAC;AACrB,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,4EAA4E;AAC5E,OAAO,EACL,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EAEd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EAEZ,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,kGAAkG;AAClG,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAgC,MAAM,SAAS,CAAC;AACrE,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAoD,MAAM,YAAY,CAAC;AAC3F,8EAA8E;AAC9E,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GASlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,aAAa,GASd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,aAAa,EACb,UAAU,EAOV,eAAe,EACf,WAAW,EAEX,IAAI,EACJ,YAAY,EACZ,cAAc,EASd,eAAe,EAGf,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,SAAS,GAaV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,cAAc,EACd,YAAY,EAQZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,aAAa,EACb,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,kGAAkG;AAClG,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxE,2GAA2G;AAC3G,gIAAgI;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,cAAc,EACd,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,KAAK,EAIL,WAAW,EACX,WAAW,EACX,SAAS,EAIT,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,cAAc,GAMf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EAIJ,UAAU,EAIV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EAEX,YAAY,EACZ,YAAY,EAEZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EAET,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAA2C,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,qGAAqG;AACrG,OAAO,EACL,cAAc,EACd,QAAQ,EACR,aAAa,EAEb,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,WAAW,EAEX,OAAO,EAMP,SAAS,EAET,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAIb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAsB,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,WAAW,EAGX,QAAQ,EACR,SAAS,EAIT,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAML,YAAY,GAKb,MAAM,aAAa,CAAC;AACrB,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,4EAA4E;AAC5E,OAAO,EACL,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EAEd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EAEZ,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,kGAAkG;AAClG,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAgC,MAAM,SAAS,CAAC;AACrE,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAoD,MAAM,YAAY,CAAC;AAC3F,8EAA8E;AAC9E,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GASlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,aAAa,GASd,MAAM,iBAAiB,CAAC"}

package/dist/ledger.d.ts

@@ -3,7 +3,7 @@ import { AsyncLocalStorage } from "node:async_hooks";
 import { type Db } from "./db.ts";
 import type { Approver, Principal } from "./define.ts";
 import { type ErrorInfo } from "./errors.ts";
-import type { Effect } from "./op.ts";
+import type { Effect, SignInMethod } from "./op.ts";
 import type { RecordedDecision } from "./policy.ts";
 import type { Run } from "./run.ts";
 /**
@@ -143,7 +143,36 @@ export type LedgerRecord = {
  | {
     type: "run.failed";
     error: ErrorInfo;
+}
+/**
+ * A declared person signed in to the staff login, by `method`; written outside any run, in the
+ * person's own `signin:<person>` (`signInRecord`), its `at` when.
+ */
+ | {
+    type: "signin.recorded";
+    person: string;
+    method: SignInMethod;
+}
+/** `by` minted an invite for the declared `person`, good until `expiresAt` (ISO 8601); in `invite:<person>`, outside any run. */
+ | {
+    type: "invite.minted";
+    person: string;
+    by: string;
+    expiresAt: string;
 });
+/**
+ * The record of a sign-in or an invite, written outside any run (`SanomaClient.recordSignIn`,
+ * `recordInvite`): in the run `signin:<person>` or `invite:<person>`, each with an id of its own,
+ * `seq` 0, so a person's records read in the order they were written.
+ */
+export declare function loginRecord(app: string, actor: Principal, body: Extract<LedgerBody, {
+    type: "signin.recorded" | "invite.minted";
+}>, at?: number): LedgerRecord;
+/** When each of `people` last signed in, and how, by id: from their `signin:<person>` records; one who never did is left out. */
+export declare function lastSignIns(store: LedgerStore, people: readonly string[]): Promise<Record<string, {
+    at: number;
+    method: SignInMethod;
+}>>;
 /**
  * The `ctx.all` member a record was written in. `id` is `all:<seq>`, the run's next `seq` when
  * the `ctx.all` began, so a replay names it the same; `index` is the member's position, `size`

package/dist/ledger.js

@@ -1,4 +1,5 @@
 import { AsyncLocalStorage } from "node:async_hooks";
+import { randomUUID } from "node:crypto";
 import { appendFile, mkdir, readFile, truncate } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
@@ -7,6 +8,36 @@ import { LEDGER_TABLE as TABLE, lazyPool, pgCode } from "./db.js";
 import { isFinal, keepCode } from "./errors.js";
 import { shown, warn } from "./log.js";
 import { errorMessage } from "./shared.js";
+/** What a sign-in's or an invite's record names as its workflow: the staff login, which is no run. */
+const LOGIN = "login";
+/**
+ * The record of a sign-in or an invite, written outside any run (`SanomaClient.recordSignIn`,
+ * `recordInvite`): in the run `signin:<person>` or `invite:<person>`, each with an id of its own,
+ * `seq` 0, so a person's records read in the order they were written.
+ */
+export function loginRecord(app, actor, body, at = Date.now()) {
+    const runId = `${body.type === "signin.recorded" ? "signin" : "invite"}:${body.person}`;
+    return {
+        v: 1,
+        app,
+        id: `${runId}:${body.type}:${at}:${randomUUID()}`,
+        runId,
+        seq: 0,
+        at,
+        actor,
+        workflow: LOGIN,
+        ...body,
+    };
+}
+/** When each of `people` last signed in, and how, by id: from their `signin:<person>` records; one who never did is left out. */
+export async function lastSignIns(store, people) {
+    const last = await Promise.all(people.map(async (person) => {
+        const records = await store.read(`signin:${person}`);
+        const latest = records.reduce((a, r) => (a && a.at > r.at ? a : r), undefined);
+        return latest?.type === "signin.recorded" ? [[person, { at: latest.at, method: latest.method }]] : [];
+    }));
+    return Object.fromEntries(last.flat());
+}
 /**
  * The `ctx.all` member a call was made in. Each member runs inside `currentGroup.run`, and a
  * queued call keeps the context it was queued in, so a call made outside the member meanwhile

package/dist/ledger.js.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAW,YAAY,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE3E,OAAO,EAAkB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AA6I3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAe,CAAC;AA0BjE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqD;IAC/E,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAe,EAAE,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAElE,oDAAoD;AACpD,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEtH,iHAAiH;AACjH,SAAS,SAAS,CAAC,MAAoB;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,KAAK,CAAC,iBAAiB,MAAM,CAAC,EAAE,GAAG,EAAE,8BAA8B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAElE,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAEzF;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAoB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAI,MAAkC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,iCAAiC,MAAM,CAAC,EAAE,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AACxG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjF,sFAAsF;IACtF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,OAAO;QACL,MAAM,CAAC,MAAM;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;iBACjD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACf,IAAI,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvD,IAAI,MAAM;oBAAE,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,IAAI,CAAC,WAAW,IAAI,yDAAyD,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1F,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACL,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,uFAAuF;YACvF,kEAAkE;YAClE,kEAAkE;YAClE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7B,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO;YAC7C,kEAAkE;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAA2B,sBAAsB,KAAK,gBAAgB,EAAE;gBACvG,MAAM,CAAC,EAAE;aACV,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CACrB,MAAM,IAAI,CAAC,EAAE,EAAE,CAChB,CAAC,KAAK,CAA2B,sBAAsB,KAAK,oCAAoC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5G,iFAAiF;YACjF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,MAAoB;IAC7D,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,KAAK,CACJ,eAAe,KAAK,mGAAmG,EACvH,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CACtD;SACA,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC,iBAAiB,MAAM,CAAC,EAAE,qBAAqB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC1D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,MAAM;gBAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;;gBACrC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC;AAOD,uHAAuH;AACvH,MAAM,UAAU,KAAK,CACnB,GAAQ,EACR,IAAgB,EAChB,IAAI,GAAgD,EAAE;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG;QACb,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG;QAClB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE;QAC/C,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,GAAG;QACH,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,IAAI;KACQ,CAAC;IAClB,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,MAAM,eAAe,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEvC,KAAK,UAAU,MAAM,CAAC,GAAQ,EAAE,MAAoB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAClD,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,YAAY,YAAY,CAAC,GAAG,CAAC,sBAAsB,IAAI,KAAK,CAAC,CAAC;YACjG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAQ,EAAE,MAAoB;IACxD,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAQ,EAAE,MAAoB,EAAE,QAAiB;IAClF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,QAAQ,CACZ,IAAI,cAAc,CAChB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvB,GAAG,YAAY,CAAC,QAAQ,CAAC,qCAAqC,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,CAAC,GAAG,EACxG,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,EACD,QAAQ,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,MAAoB,EAAE,GAAW;IACvD,IAAI,CAAC,iBAAiB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC"}
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../src/ledger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAW,YAAY,IAAI,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAE3E,OAAO,EAAkB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAIvC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAuI3C,sGAAsG;AACtG,MAAM,KAAK,GAAG,OAAO,CAAC;AAEtB;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,GAAW,EACX,KAAgB,EAChB,IAAwE,EACxE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;IAEf,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;IACxF,OAAO;QACL,CAAC,EAAE,CAAC;QACJ,GAAG;QACH,EAAE,EAAE,GAAG,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,UAAU,EAAE,EAAE;QACjD,KAAK;QACL,GAAG,EAAE,CAAC;QACN,EAAE;QACF,KAAK;QACL,QAAQ,EAAE,KAAK;QACf,GAAG,IAAI;KACQ,CAAC;AACpB,CAAC;AAED,iIAAiI;AACjI,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAkB,EAClB,MAAyB;IAEzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAC5B,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAA2B,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACzG,OAAO,MAAM,EAAE,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACzC,CAAC;AAeD;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,iBAAiB,EAAe,CAAC;AA0BjE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqD;IAC/E,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAe,EAAE,CAAe,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAElE,oDAAoD;AACpD,MAAM,KAAK,GAAG,CAAC,OAAe,EAAE,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;AAEtH,iHAAiH;AACjH,SAAS,SAAS,CAAC,MAAoB;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,KAAK,CAAC,iBAAiB,MAAM,CAAC,EAAE,GAAG,EAAE,8BAA8B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAE,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAElE,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AAEzF;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAoB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;IAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAI,MAAkC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,OAAO,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,iCAAiC,MAAM,CAAC,EAAE,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO;QACzB,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;AACxG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjF,sFAAsF;IACtF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IAEnD,OAAO;QACL,MAAM,CAAC,MAAM;YACX,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;iBACjD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;iBACf,IAAI,CAAC,KAAK,IAAI,EAAE;gBACf,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvD,IAAI,MAAM;oBAAE,OAAO,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACjD,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACzB,IAAI,CAAC,WAAW,IAAI,yDAAyD,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC1F,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC/B,CAAC,CAAC,CAAC;YACL,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACzB,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACxC,uFAAuF;YACvF,kEAAkE;YAClE,kEAAkE;YAClE,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAE7C,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;YAC7B,IAAI,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO;YAC7C,kEAAkE;YAClE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAA2B,sBAAsB,KAAK,gBAAgB,EAAE;gBACvG,MAAM,CAAC,EAAE;aACV,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,CAAC,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CACrB,MAAM,IAAI,CAAC,EAAE,EAAE,CAChB,CAAC,KAAK,CAA2B,sBAAsB,KAAK,oCAAoC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5G,iFAAiF;YACjF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAM,EAAE,MAAoB;IAC7D,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,KAAK,CACJ,eAAe,KAAK,mGAAmG,EACvH,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CACtD;SACA,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrC,MAAM,KAAK,CAAC,iBAAiB,MAAM,CAAC,EAAE,qBAAqB,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IACL,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,YAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqC,CAAC;IAC1D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,MAAM;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,MAAM;gBAAE,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;;gBACrC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC;AAOD,uHAAuH;AACvH,MAAM,UAAU,KAAK,CACnB,GAAQ,EACR,IAAgB,EAChB,IAAI,GAAgD,EAAE;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG;QACb,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG;QAClB,EAAE,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE;QAC/C,KAAK,EAAE,GAAG,CAAC,EAAE;QACb,GAAG;QACH,EAAE,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;QACzB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,GAAG,IAAI;KACQ,CAAC;IAClB,MAAM,KAAK,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,IAAI,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IAChC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,MAAM,eAAe,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEvC,KAAK,UAAU,MAAM,CAAC,GAAQ,EAAE,MAAoB;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAClD,IAAI,CAAC,qBAAqB,MAAM,CAAC,EAAE,YAAY,YAAY,CAAC,GAAG,CAAC,sBAAsB,IAAI,KAAK,CAAC,CAAC;YACjG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAQ,EAAE,MAAoB;IACxD,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAQ,EAAE,MAAoB,EAAE,QAAiB;IAClF,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,MAAM,QAAQ,CACZ,IAAI,cAAc,CAChB,CAAC,QAAQ,EAAE,WAAW,CAAC,EACvB,GAAG,YAAY,CAAC,QAAQ,CAAC,qCAAqC,MAAM,CAAC,EAAE,KAAK,YAAY,CAAC,WAAW,CAAC,GAAG,EACxG,EAAE,KAAK,EAAE,WAAW,EAAE,CACvB,EACD,QAAQ,CACT,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,MAAoB,EAAE,GAAW;IACvD,IAAI,CAAC,iBAAiB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/login-code.d.ts

@@ -0,0 +1,17 @@
+import { z } from "zod";
+import { type WorkflowDefinition } from "./define.ts";
+import type { Op } from "./op.ts";
+/** The workflow's input: to whom, and the code, sealed. */
+declare const LoginCodeInput: z.ZodObject<{
+    to: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strip>;
+/** What a sign-in code is sent as, for checks before any is: a sender must take it, and the policy is asked about it. */
+export declare const CODE_MAIL: {
+    to: string;
+    subject: string;
+    text: string;
+};
+/** The login-code workflow for a config: it sends through `sender`, saying it is `company`'s. */
+export declare function loginCodeWorkflow(sender: Op, company: string): WorkflowDefinition<readonly Op[], typeof LoginCodeInput>;
+export {};

package/dist/login-code.js

@@ -0,0 +1,32 @@
+import { z } from "zod";
+import { defineWorkflow } from "./define.js";
+import { openLoginCode } from "./seal.js";
+/** The workflow's input: to whom, and the code, sealed. */
+const LoginCodeInput = z.object({ to: z.string().min(1), code: z.string().min(1) });
+/** What a sign-in code is sent as, for checks before any is: a sender must take it, and the policy is asked about it. */
+export const CODE_MAIL = { to: "person@example.com", subject: "Your sign-in code", text: "<text>" };
+/** The mail's text: the code, what it is for, and how long it lasts; nothing else, and no link. */
+const textOf = (company, code) => `Your sign-in code for ${company} is ${code}.\n\n` +
+    "It works once, for five minutes. If you did not ask for it, ignore this mail.\n";
+/** The login-code workflow for a config: it sends through `sender`, saying it is `company`'s. */
+export function loginCodeWorkflow(sender, company) {
+    return defineWorkflow({
+        // The literal, held to the one name: the outline finds a workflow by a string, or a const of its own file.
+        name: "login-code",
+        title: "Send a sign-in code",
+        trigger: "manual",
+        input: LoginCodeInput,
+        uses: [sender],
+        run: async (ctx, input) => {
+            const { vendor, resource, name } = sender;
+            const mail = {
+                to: input.to,
+                subject: `Your ${company} sign-in code`,
+                text: textOf(company, openLoginCode(input.code, input.to)),
+            };
+            // `ctx` called directly, so the outline places the call.
+            return ctx[vendor][resource][name](mail);
+        },
+    });
+}
+//# sourceMappingURL=login-code.js.map

package/dist/login-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-code.js","sourceRoot":"","sources":["../src/login-code.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAA2B,MAAM,aAAa,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAY1C,2DAA2D;AAC3D,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpF,yHAAyH;AACzH,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,EAAE,EAAE,oBAAoB,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAEpG,mGAAmG;AACnG,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,EAAE,CAC/C,yBAAyB,OAAO,OAAO,IAAI,OAAO;IAClD,iFAAiF,CAAC;AAEpF,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAC/B,MAAU,EACV,OAAe;IAEf,OAAO,cAAc,CAAC;QACpB,2GAA2G;QAC3G,IAAI,EAAE,YAAiD;QACvD,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,QAAQ;QACjB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;YAC1C,MAAM,IAAI,GAAG;gBACX,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,OAAO,EAAE,QAAQ,OAAO,eAAe;gBACvC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aAC3D,CAAC;YACF,yDAAyD;YACzD,OAAQ,GAAyE,CAAC,MAAM,CAAE,CAAC,QAAQ,CAAE,CAAC,IAAI,CAAE,CAC1G,IAAI,CACL,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/op.d.ts

@@ -263,12 +263,28 @@ export interface ConnectorSetup {
 }
 /** What the app gives a connector's model half (`ConnectorSetup.model`): the secrets, as a login half reads them. */
 export type ModelContext = Pick<LoginContext, "secrets">;
-/** What the app gives a connector's login half (`ConnectorSetup.login`) when it makes it for a public site. */
+/**
+ * What a login vouches for about who is asking: a name they gave (`id`, the loopback's), a
+ * verified email, a GitHub login. The app admits the declared person they match (`personOf`).
+ */
+export interface LoginIdentity {
+    id?: string;
+    email?: string;
+    github?: string;
+}
+/** How a login half lets a person in: an email code, GitHub, an invite link, an email and a password. */
+export type LoginMethod = "code" | "github" | "invite" | "password";
+/** How a person signed in to the staff login, which the ledger records (`signin.recorded`): all but a password. */
+export type SignInMethod = Exclude<LoginMethod, "password">;
+/**
+ * What the app gives a connector's login half (`ConnectorSetup.login`) when it makes it: for a
+ * public site, once per site; for the staff login, once, with `staff`.
+ */
 export interface LoginContext {
     /** The company's database (`resolved.databaseUrl`), where a login like Better Auth keeps its users. */
     databaseUrl: string;
     /**
-     * A 32-byte key derived from the deployment's `SANOMA_SECRETS_KEY` for this login (HKDF-SHA256,
+     * A 32-byte key derived from the deployment's `SANOMA_SIGNING_KEY` for this login (HKDF-SHA256,
      * purpose `login <connector>`), hex; a login signs its cookies with it and never asks a person for a secret.
      */
     key: string;
@@ -280,9 +296,29 @@ export interface LoginContext {
     /**
      * The origins the site answers on, scheme included and `:*` for any port:
      * `["http://www.localhost:*", "https://sanoma.example"]`; a login needs the protocol for its
-     * cookies and allowed hosts.
+     * cookies and allowed hosts. Empty for the staff login, which answers on any host the app does.
      */
     origins: readonly string[];
+    /**
+     * Sends a sign-in code to an email, through the config's `login.sender` (a run of the built-in
+     * `login-code` workflow, as the runtime's agent `login`); absent when the config names no
+     * sender, and then the login offers no code.
+     */
+    sendCode?(email: string, code: string): Promise<void>;
+    /** For the staff login only: who it may let in, the company's social clients, and where it tells of a sign-in. */
+    staff?: {
+        /** Whether the people files declare the person `identity` names; a login never makes a user for anyone else. */
+        admits(identity: LoginIdentity): boolean;
+        /** The company's own OAuth clients, each a method when given. */
+        social: {
+            github?: {
+                clientId: string;
+                clientSecret: string;
+            };
+        };
+        /** Tells the app of a sign-in by `method` of the person `identity` names, which the ledger records. Must not throw. */
+        record(method: SignInMethod, identity: LoginIdentity): Promise<void>;
+    };
 }
 /**
  * The app sets this header on every request to a public site from the socket's address,
@@ -291,24 +327,56 @@ export interface LoginContext {
  */
 export declare const CLIENT_IP_HEADER = "x-sanoma-client-ip";
 /**
- * A connector's login half: how a public site tells who a visitor is. The app makes one with
- * `login(context)` once per public site, when it starts; a login that keeps tables in the
- * database migrates them itself there, serialized and idempotent. It answers the provider's
- * subject only; the app makes the principal from it (`visitor:<connector>:<subject>`, in
- * `visitors`), so a connector never sets a visitor's groups. A visitor's address, for rate
- * limits, is the `CLIENT_IP_HEADER` header.
+ * A request's origin, https when a proxy that ends TLS says so (`x-forwarded-proto: https`), as
+ * Start's `getRequestUrl({ xForwardedProto: true })` reads it: the absolute URLs a page or an invite writes, and a login's cookies, take it.
+ */
+export declare function requestOrigin(request: Request): string;
+/** Whether a change comes from the page's own origin (a login's CSRF check): the browser says so, or its `Origin` names the request's host. */
+export declare function sameOrigin(request: Request): boolean;
+/**
+ * A connector's login half: how a public site tells who a visitor is, and, made with
+ * `LoginContext.staff`, how the app's staff sign in. The app makes one with `login(context)` once
+ * per public site (and once for staff), when it starts; a login that keeps tables in the database
+ * migrates them itself there, serialized and idempotent. It answers the provider's subject and
+ * what it verified; the app makes the principal from it (`visitor:<connector>:<subject>`, in
+ * `visitors`, or the declared person the identity matches), so a connector never sets groups. A
+ * visitor's address, for rate limits, is the `CLIENT_IP_HEADER` header.
  */
 export interface LoginHalf {
-    /** Who signed in, as the provider's stable subject, or null; never throws for a missing or bad cookie. */
+    /**
+     * Who signed in, as the provider's stable subject, with their email when the provider verified
+     * it and their GitHub login when they signed in with GitHub; null for a missing or bad cookie,
+     * for which it never throws.
+     */
     verify(request: Request): Promise<{
         subject: string;
+        email?: string;
+        github?: string;
     } | null>;
     /** Answers its own routes, `/auth/<vendor>/*`; undefined for any other request. */
     handle(request: Request): Promise<Response | undefined>;
     /** The path a page POSTs to sign out, which `handle` serves; the app's own Sign out POSTs it with no body. */
     signOut?: string;
+    /** How a person may sign in now: what the sign-in page offers. */
+    methods?: readonly LoginMethod[];
+    /**
+     * A staff login's invite for `email`, a declared person's: a one-use token, good for
+     * `INVITE_SECONDS`, which replaces the last one minted for that email. `request` is the
+     * request that asked for it, on the host the invite is for.
+     */
+    invite?(email: string, request: Request): Promise<string>;
+    /**
+     * The invite a token is, while it is good: for whom, and the path (on the login's routes) that
+     * signs them in with it, using it up.
+     */
+    invitation?(token: string): Promise<{
+        email: string;
+        path: string;
+    } | undefined>;
     close?(): Promise<void>;
 }
+/** How long an invite lasts: 24 hours. */
+export declare const INVITE_SECONDS: number;
 /**
  * The connector with `setup` laid over what it already carries, as a connector package exports
  * it: `export const ghost = withSetup(ghostOps, { driver: ghostDriver, fake: fakeGhost, steps: ghostSteps })`. A

package/dist/op.js

@@ -126,6 +126,26 @@ export function retryableStatus(status) {
  * limits), never from `X-Forwarded-For`.
  */
 export const CLIENT_IP_HEADER = "x-sanoma-client-ip";
+/**
+ * A request's origin, https when a proxy that ends TLS says so (`x-forwarded-proto: https`), as
+ * Start's `getRequestUrl({ xForwardedProto: true })` reads it: the absolute URLs a page or an invite writes, and a login's cookies, take it.
+ */
+export function requestOrigin(request) {
+    const url = new URL(request.url);
+    if (request.headers.get("x-forwarded-proto") === "https")
+        url.protocol = "https:";
+    return url.origin;
+}
+/** Whether a change comes from the page's own origin (a login's CSRF check): the browser says so, or its `Origin` names the request's host. */
+export function sameOrigin(request) {
+    const site = request.headers.get("sec-fetch-site");
+    if (site !== null)
+        return site === "same-origin";
+    const origin = URL.parse(request.headers.get("origin") ?? "");
+    return origin !== null && origin.host === request.headers.get("host");
+}
+/** How long an invite lasts: 24 hours. */
+export const INVITE_SECONDS = 24 * 60 * 60;
 /**
  * The connector with `setup` laid over what it already carries, as a connector package exports
  * it: `export const ghost = withSetup(ghostOps, { driver: ghostDriver, fake: fakeGhost, steps: ghostSteps })`. A

package/dist/op.js.map

@@ -1 +1 @@
-{"version":3,"file":"op.js","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAoEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAkBrE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAcjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAiClC,uFAAuF;AACvF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9G,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACjE,CAAC,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC1D,KAAK,KAAK,IAAI;IACb,KAAgC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,KAAQ,EACR,IAAiB;IAEjB,qGAAqG;IACrG,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,YAAY,OAAO,sDAAsD,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAA0B,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,uGAAuG;IACvG,MAAM,QAAQ,GAAY,UAAU,EAAE,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,KAAK,QAAQ,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,mCAAmC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,GAAqC,KAA+B,CAAC;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,OAAO,QAAQ,0BAA0B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,yBAAyB,KAAK,CAAC,IAAI,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAI,EAAE;gBACnC,MAAM;gBACN,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK;gBACpC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;aACP,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,uGAAuG;IACvG,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,+HAA+H,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAuB,MAAM,CAAC,MAAM,CAAC;QAC9C,MAAM,EAAE,gBAAgB;QACxB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAgC,CAAC;AACnE,CAAC;AAgCD;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,eAAwB,CAAC;IAChC,SAAS,CAAU;IACnB,MAAM,CAAU;IAChB,UAAU,CAAU;IAE7B,YAAY,OAAe,EAAE,OAAsF;QACjH,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC7E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AAyFD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAoBrD;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAgC,SAAY,EAAE,KAA8B;IACnG,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,SAAS;QACZ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,IAAI,MAAM,EAAE,MAAM,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,KAAK,GAAG,2DAA2D,CAAC;IAC1E,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,gIAAgI,KAAK,GAAG;QAC1I,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,kEAAkE,KAAK,EAAE,CACvG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAA8B,EAAkB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AAEzG,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AACxE,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA0B,EAC1B,IAA4D,EAC5D,OAAO,GAA4D,EAAE;IAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAoD,CAAC,EAAE,CAAC;QAC3F,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACpC,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,wFAAwF;QACxF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+C,CAAC,EAAE,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;iBAClD,IAAI,OAAO,EAAE,KAAK,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAc,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"op.js","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAoEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAkBrE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAcjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAiClC,uFAAuF;AACvF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9G,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACjE,CAAC,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC1D,KAAK,KAAK,IAAI;IACb,KAAgC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,KAAQ,EACR,IAAiB;IAEjB,qGAAqG;IACrG,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,YAAY,OAAO,sDAAsD,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAA0B,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,uGAAuG;IACvG,MAAM,QAAQ,GAAY,UAAU,EAAE,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,KAAK,QAAQ,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,mCAAmC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,GAAqC,KAA+B,CAAC;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,OAAO,QAAQ,0BAA0B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,yBAAyB,KAAK,CAAC,IAAI,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAI,EAAE;gBACnC,MAAM;gBACN,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK;gBACpC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;aACP,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,uGAAuG;IACvG,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,+HAA+H,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAuB,MAAM,CAAC,MAAM,CAAC;QAC9C,MAAM,EAAE,gBAAgB;QACxB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAgC,CAAC;AACnE,CAAC;AAgCD;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,eAAwB,CAAC;IAChC,SAAS,CAAU;IACnB,MAAM,CAAU;IAChB,UAAU,CAAU;IAE7B,YAAY,OAAe,EAAE,OAAsF;QACjH,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC7E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AA2HD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,+IAA+I;AAC/I,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,aAAa,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAsCD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAgC,SAAY,EAAE,KAA8B;IACnG,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,SAAS;QACZ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,IAAI,MAAM,EAAE,MAAM,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,KAAK,GAAG,2DAA2D,CAAC;IAC1E,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,gIAAgI,KAAK,GAAG;QAC1I,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,kEAAkE,KAAK,EAAE,CACvG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAA8B,EAAkB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AAEzG,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AACxE,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA0B,EAC1B,IAA4D,EAC5D,OAAO,GAA4D,EAAE;IAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAoD,CAAC,EAAE,CAAC;QAC3F,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACpC,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,wFAAwF;QACxF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+C,CAAC,EAAE,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;iBAClD,IAAI,OAAO,EAAE,KAAK,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAc,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC"}

package/dist/outline.js

@@ -102,7 +102,7 @@ function withPaths(nodes, prefix) {
 const span = (node) => [node.start, node.end];
 const PARAM = "run must take ctx as its first parameter, by one name: destructured, its calls cannot be read into the graph";
 const CTX_USE = "ctx is only called, directly (`await ctx.<vendor>.<resource>.<op>(…)`, `ctx.approval(…)`, `ctx.sleep(…)`, " +
-    "`ctx.all([…])`) or read for ctx.runId: passed on, aliased or destructured, its calls are not in the graph";
+    "`ctx.all([…])`) or read for ctx.runId or ctx.startedBy: passed on, aliased or destructured, its calls are not in the graph";
 const CTX_CALL = (what) => `ctx.${what} is not a call the graph can draw: an operation is ctx.<vendor>.<resource>.<op>(…), ` +
     "and the built-ins are ctx.approval(…), ctx.sleep(…), ctx.all([…]) and ctx.now()";
 const ALL_MEMBERS = "ctx.all's members must be written in the call, so the graph shows what each does: a list, " +
@@ -124,7 +124,7 @@ const OP_ID = new RegExp(String.raw `^([\w-]+(\.[\w-]+){2}|${DATA_VENDOR}(\.[\w-
 /** Where a function's body starts: its own statement rules, nothing of the caller's. */
 const bodyOf = (fn) => ({ fn, inCatch: false });
 /** The members of `ctx` that are read, not placed: no record, no node. */
-const READS = new Set(["now", "runId"]);
+const READS = new Set(["now", "runId", "startedBy"]);
 /**
  * The nodes of `fn`'s body (`run`'s, or a callback's the outline reads), each with an empty `path`
  * for `withPaths` to fill, and the problems: what the body does that the graph could not show.
@@ -172,7 +172,7 @@ export function outlineBody(fn, { consts, source }) {
             functionsUsing.set(node, (uses = childrenOf(node).some(usesCtx)));
         return uses;
     };
-    /** `ctx.runId`, read. */
+    /** `ctx.runId` or `ctx.startedBy`, read. */
     const isRead = (member) => !member.computed &&
         unwrap(member.object)?.type === "Identifier" &&
         unwrap(member.object).name === ctx &&