@sanoma-ai/workflows 0.10.2 → 0.10.6

package/src/drift.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { defineWorkflow, type WorkflowDefinition } from "./define.ts";
 import { isRunControlError } from "./errors.ts";
 import type { Op } from "./op.ts";
-import { type DriftField, diffDeclared, fieldPathOf, type Resource, valueAt } from "./resource.ts";
+import { type DriftField, diffDeclared, fieldPathOf, type Resource, valueAt, withFrom } from "./resource.ts";
 import type { DeclaredResource, ResourceProblem } from "./resources.ts";
 import { type DRIFT_WORKFLOW, errorMessage } from "./shared.ts";
 import { SOURCE_RESOLVE, type sourceOps } from "./source.ts";
@@ -128,8 +128,10 @@ export const observed = (out: { gone: boolean; state?: State }): Found =>
  * Each declared resource against what its import `found`: `error`, `absent` (unbound, with the
  * binding id of what its identity found as `found`), `gone`, else the state and the declared
  * fields compared by `diffDeclared`, a reference against the state of the resource it names
- * (so GitHub's node id for a repository counts as its name). A host with a `revisions` entry
- * also compares its revision against the commit its ref names now (or is that entry's `error`).
+ * (so GitHub's node id for a repository counts as its name), and a `from` reference's field
+ * against that resource's state at its path, left out while that resource is absent, gone or
+ * unreadable (its own row says so). A host with a `revisions` entry also compares its revision
+ * against the commit its ref names now (or is that entry's `error`).
  */
 export function compare(
   types: ReadonlyMap<string, Resource>,
@@ -137,6 +139,12 @@ export function compare(
   found: ReadonlyMap<string, Found>,
   revisions: ReadonlyMap<string, Revision> = new Map(),
 ): DriftResult[] {
+  const bound = new Set(resources.filter((r) => r.binding !== undefined).map((r) => r.id));
+  // A resource's state as a `from` reference takes it: only a bound one's, read in this run.
+  const stateOf = (target: string) => {
+    const now = found.get(target);
+    return bound.has(target) && now && "state" in now ? now.state : undefined;
+  };
   return resources.map(({ id, vendor, type, name, binding, desired, refs }): DriftResult => {
     const row = { id, type, vendor, name, ...(binding !== undefined && { binding }) };
     const now = found.get(id)!;
@@ -158,7 +166,8 @@ export function compare(
       const named = found.get(target);
       if (named && "state" in named) accept[at] = by.map((field) => named.state[field]).filter((v) => v != null);
     }
-    const fields = diffDeclared(resource, now.state, desired, accept);
+    const declared = withFrom(resource.fields.references, desired, refs, stateOf, "drop").desired;
+    const fields = diffDeclared(resource, now.state, declared, accept);
     const resolved = revisions.get(id);
     if (resolved && "error" in resolved) return { ...row, status: "error", fields: [], error: resolved.error };
     // A host whose state does not say which commit it runs is not compared.

package/src/host.ts

@@ -46,8 +46,11 @@ export interface HostSpec {
     source: string;
     /** The branch (or tag) it runs: `main`, never a commit. */
     ref: string;
-    /** The secrets it passes the runtime (`SANOMA_DATABASE_URL`, `SANOMA_SECRETS_KEY`): a write-only field. */
-    secrets: string;
+    /**
+     * The secrets it passes the runtime (`SANOMA_DATABASE_URL`, `SANOMA_SECRETS_KEY`): a write-only
+     * field. Absent for a host that binds its own bootstrap (`bindsBootstrap`).
+     */
+    secrets?: string;
     /** The port the app listens on. */
     port: string;
     /** A public site's domain, by site name: the app serves each site at the root of its domain (`SANOMA_DOMAINS`). */
@@ -58,6 +61,11 @@ export interface HostSpec {
    * file may not declare it, so a merge to `ref` is a change to the host.
    */
   revision: string;
+  /**
+   * True for a host whose vendor mints the instance's bootstrap (its database URL, keys and
+   * tokens) and binds it itself, as Sanoma Cloud's does: such a type takes no `secrets`.
+   */
+  bindsBootstrap?: boolean;
   outputs: (state: Record<string, unknown>) => HostOutputs;
 }
 
@@ -83,8 +91,9 @@ function unwrap(schema: z.ZodType): z.ZodType {
 
 /**
  * Throws what is wrong with a resource type's `host`: an input or `revision` that names no field,
- * `secrets` that is not write-only, a `revision` that is, an unknown lifetime, a type apply cannot
- * change (not `writable`).
+ * `secrets` that is not write-only, missing (unless the host binds its own bootstrap) or given
+ * beside `bindsBootstrap`, a `revision` that is write-only, an unknown lifetime, a type apply
+ * cannot change (not `writable`).
  */
 export function checkHost(
   what: string,
@@ -96,10 +105,17 @@ export function checkHost(
   if (!LIFETIMES.includes(host.capabilities?.lifetime)) {
     problems.push(`capabilities.lifetime is one of ${LIFETIMES.join(", ")}`);
   }
-  for (const [input, path] of [...Object.entries(host.inputs ?? {}), ["revision", host.revision] as const]) {
+  // An input given as undefined is one not given.
+  const given = Object.entries(host.inputs ?? {}).filter(([, path]) => path !== undefined);
+  for (const [input, path] of [...given, ["revision", host.revision] as const]) {
     if (typeof path !== "string" || !hasPath(type.schema, path)) problems.push(`${input} names no field (${path})`);
   }
-  if (!type.fields.writeOnly.includes(host.inputs?.secrets)) problems.push("inputs.secrets must be a write-only field");
+  const secrets = host.inputs?.secrets;
+  if (host.bindsBootstrap) {
+    if (secrets !== undefined) problems.push("inputs.secrets is not taken by a host that binds its own bootstrap");
+  } else if (secrets === undefined || !type.fields.writeOnly.includes(secrets)) {
+    problems.push("inputs.secrets must be a write-only field, unless the host binds its own bootstrap");
+  }
   if (type.fields.writeOnly.includes(host.revision)) problems.push("revision must not be write-only: drift reads it");
   if (typeof host.outputs !== "function") problems.push("outputs must be a function of the state");
   if (problems.length) throw new Error(`${what}: its host: ${problems.join("; ")}`);

package/src/identity-broker.ts

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import type { IdentityEnrollment, IdentityEnrollments, IdentityAudit } from "./cloud-identity.ts";
+
+const CREDENTIAL = /^[A-Za-z0-9_-]{43}$/;
+const ACCOUNT = /^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/;
+const credentialHash = (credential: string) => createHash("sha256").update(credential).digest("hex");
+
+const validEnrollment = (e: IdentityEnrollment | undefined): e is IdentityEnrollment =>
+  !!e &&
+  [e.deployment, e.company, e.environment].every((v) => typeof v === "string" && v.length > 0 && v.length <= 256) &&
+  ACCOUNT.test(e.serviceAccount) &&
+  Number.isSafeInteger(e.generation) &&
+  e.generation > 0;
+const reply = (status: number, body: unknown) =>
+  Response.json(body, {
+    status,
+    headers: { "Cache-Control": "no-store", Pragma: "no-cache" },
+  });
+
+// Node/edge adapters can represent an empty POST as a stream. Reject actual bytes,
+// without buffering attacker-controlled input or waiting indefinitely for its end.
+async function hasBody(request: Request): Promise<boolean> {
+  if (!request.body) return false;
+  const reader = request.body.getReader();
+  let timeout: ReturnType<typeof setTimeout> | undefined;
+  try {
+    const first = await Promise.race([
+      reader.read(),
+      new Promise<never>((_, reject) => {
+        timeout = setTimeout(() => reject(new Error("Invalid broker request")), 5_000);
+      }),
+    ]);
+    return !first.done;
+  } finally {
+    clearTimeout(timeout);
+    void reader.cancel().catch(() => {});
+  }
+}
+
+/** Shared server-only issuance boundary. Public factories fix the route, audience and token kind. */
+export function enrollmentBroker<T extends { expiresAt: number }>(options: {
+  path: string;
+  method: "GET" | "POST";
+  enrollments: IdentityEnrollments;
+  accept(enrollment: IdentityEnrollment): boolean;
+  issue(enrollment: IdentityEnrollment): Promise<T>;
+  valid(token: T, now: number): boolean;
+  body(token: T): unknown;
+  audit(event: IdentityAudit): Promise<void>;
+}): (request: Request) => Promise<Response> {
+  return async (request) => {
+    let enrollment: IdentityEnrollment | undefined;
+    try {
+      const url = new URL(request.url);
+      if (url.pathname !== options.path || request.method !== options.method) return reply(404, { error: "not_found" });
+      if (url.search || (await hasBody(request))) return reply(400, { error: "invalid_request" });
+      const authorization = request.headers.get("authorization") ?? "";
+      const credential = authorization.startsWith("Bearer ") ? authorization.slice(7) : "";
+      const hash = CREDENTIAL.test(credential) ? credentialHash(credential) : undefined;
+      enrollment = hash ? await options.enrollments.active(hash) : undefined;
+      if (!validEnrollment(enrollment) || !options.accept(enrollment)) {
+        await options.audit({ result: "denied" });
+        return reply(401, { error: "unauthorized" });
+      }
+      // Copy authoritative values before any awaits; caller fields never select a target or lifetime.
+      enrollment = {
+        deployment: enrollment.deployment,
+        company: enrollment.company,
+        environment: enrollment.environment,
+        serviceAccount: enrollment.serviceAccount,
+        generation: enrollment.generation,
+      };
+      const token = await options.issue(enrollment);
+      if (!options.valid(token, Date.now())) throw new Error("Invalid issued token");
+      const current = await options.enrollments.active(hash!);
+      if (
+        !current ||
+        (Object.keys(enrollment) as (keyof IdentityEnrollment)[]).some((key) => current[key] !== enrollment![key])
+      ) {
+        await options.audit({ result: "denied", enrollment });
+        return reply(401, { error: "unauthorized" });
+      }
+      await options.audit({ result: "issued", enrollment, expiresAt: token.expiresAt });
+      return reply(200, options.body(token));
+    } catch {
+      try {
+        await options.audit({ result: "unavailable", ...(enrollment && { enrollment }) });
+      } catch {
+        /* fail closed */
+      }
+      return reply(503, { error: "unavailable" });
+    }
+  };
+}

package/src/identity-provisioning.ts

@@ -0,0 +1,208 @@
+import type { Pool, PoolClient } from "pg";
+import type { IdentityEnrollment } from "./cloud-identity.ts";
+
+export type DeploymentIdentity = Omit<IdentityEnrollment, "generation">;
+export interface EnrollIdentity extends IdentityEnrollment {
+  hash: string;
+  validUntil: string;
+}
+
+/** Provisioning authority only. The serving broker receives the separate read-only interface. */
+export interface IdentityProvisioning {
+  enroll(input: EnrollIdentity): Promise<void>;
+  retire(input: DeploymentIdentity & { generation: number; validUntil: string }): Promise<void>;
+  revoke(input: DeploymentIdentity): Promise<void>;
+}
+
+export class IdentityProvisioningError extends Error {
+  readonly retryable: boolean;
+  readonly code: "invalid" | "conflict" | "unavailable";
+  constructor(code: "invalid" | "conflict" | "unavailable") {
+    super(`Identity provisioning: ${code}`);
+    this.name = "IdentityProvisioningError";
+    this.code = code;
+    this.retryable = code === "unavailable";
+  }
+}
+
+/** Recognize another package copy without ever forwarding arbitrary messages or code strings. */
+export function identityProvisioningCode(error: unknown): IdentityProvisioningError["code"] | undefined {
+  if (!error || typeof error !== "object" || !("name" in error) || error.name !== "IdentityProvisioningError") return;
+  if (!("code" in error)) return;
+  switch (error.code) {
+    case "invalid":
+      return "invalid";
+    case "conflict":
+      return "conflict";
+    case "unavailable":
+      return "unavailable";
+  }
+}
+
+function fail(code: "invalid" | "conflict"): never {
+  throw new IdentityProvisioningError(code);
+}
+const sameIdentity = (a: DeploymentIdentity, b: DeploymentIdentity) =>
+  a.deployment === b.deployment &&
+  a.company === b.company &&
+  a.environment === b.environment &&
+  a.serviceAccount === b.serviceAccount;
+const checkIdentity = (input: DeploymentIdentity) => {
+  if (
+    ![input.deployment, input.company, input.environment].every(
+      (s) => typeof s === "string" && s.length > 0 && s.length <= 256 && !s.includes("\0"),
+    ) ||
+    !/^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/.test(input.serviceAccount)
+  )
+    fail("invalid");
+};
+const generationOf = (generation: number) => {
+  if (!Number.isSafeInteger(generation) || generation <= 0) fail("invalid");
+};
+const deadlineOf = (value: string) => {
+  const time = Date.parse(value);
+  if (!Number.isFinite(time)) fail("invalid");
+  return time;
+};
+
+/** Caller owns a dedicated writer pool; never give this pool to the broker or company code. */
+export function postgresIdentityProvisioning(
+  database: () => Promise<Pick<Pool, "connect">>,
+  options: { maxValidityMs: number },
+): IdentityProvisioning {
+  const maximum = options.maxValidityMs;
+  if (!Number.isSafeInteger(maximum) || maximum <= 0) fail("invalid");
+  async function transaction(
+    input: DeploymentIdentity,
+    create: boolean,
+    run: (db: PoolClient, enabled: boolean, now: number) => Promise<void>,
+  ) {
+    checkIdentity(input);
+    let db: PoolClient | undefined;
+    try {
+      db = await (await database()).connect();
+      await db.query("BEGIN");
+      if (create)
+        await db.query(
+          `INSERT INTO sanoma_identity.deployments (id, company, environment, service_account)
+          VALUES ($1,$2,$3,$4) ON CONFLICT (id) DO NOTHING`,
+          [input.deployment, input.company, input.environment, input.serviceAccount],
+        );
+      // Every writer takes the deployment row lock: enrollment cannot race revocation/retirement.
+      const { rows } = await db.query<DeploymentIdentity & { enabled: boolean }>(
+        `SELECT id AS deployment, company, environment, service_account AS "serviceAccount", enabled
+          FROM sanoma_identity.deployments WHERE id=$1 FOR UPDATE`,
+        [input.deployment],
+      );
+      const row = rows[0];
+      if (!row || !sameIdentity(row, input)) fail("conflict");
+      const clock = await db.query<{ now: Date }>("SELECT clock_timestamp() AS now");
+      await run(db, row.enabled, clock.rows[0]!.now.getTime());
+      await db.query("COMMIT");
+    } catch (error) {
+      await db?.query("ROLLBACK").catch(() => {});
+      const code = identityProvisioningCode(error);
+      if (code) throw new IdentityProvisioningError(code);
+      if ((error as { code?: string })?.code === "23505") throw new IdentityProvisioningError("conflict");
+      throw new IdentityProvisioningError("unavailable");
+    } finally {
+      db?.release();
+    }
+  }
+  return {
+    async enroll(input) {
+      generationOf(input.generation);
+      const until = deadlineOf(input.validUntil);
+      if (!/^[0-9a-f]{64}$/.test(input.hash)) fail("invalid");
+      await transaction(input, true, async (db, enabled, now) => {
+        if (!enabled) fail("conflict");
+        if (until <= now || until - now > maximum) fail("invalid");
+        const { rows } = await db.query<{ generation: string; hash: string; valid_until: Date; revoked: boolean }>(
+          `SELECT generation, hash, valid_until, revoked FROM sanoma_identity.credentials
+            WHERE deployment=$1 ORDER BY generation DESC`,
+          [input.deployment],
+        );
+        const existing = rows.find((r) => Number(r.generation) === input.generation);
+        if (existing) {
+          // An exact retry is safe. Never extend a retired generation or revive a revoked one.
+          if (existing.hash !== input.hash || existing.revoked || existing.valid_until.getTime() !== until)
+            fail("conflict");
+          return;
+        }
+        if (rows[0] && Number(rows[0].generation) >= input.generation) fail("conflict");
+        await db.query(
+          `INSERT INTO sanoma_identity.credentials (hash, deployment, generation, valid_until)
+            VALUES ($1,$2,$3,$4)`,
+          [input.hash, input.deployment, input.generation, new Date(until)],
+        );
+      });
+    },
+    async retire(input) {
+      generationOf(input.generation);
+      const until = deadlineOf(input.validUntil);
+      await transaction(input, false, async (db) => {
+        // Retirement only shortens access. The predicate protects the schema's finite interval.
+        const result = await db.query(
+          `UPDATE sanoma_identity.credentials SET
+            revoked=revoked OR $3::timestamptz <= clock_timestamp(),
+            valid_until=CASE WHEN $3::timestamptz > valid_from THEN LEAST(valid_until,$3::timestamptz) ELSE valid_until END
+            WHERE deployment=$1 AND generation=$2`,
+          [input.deployment, input.generation, new Date(until)],
+        );
+        if (!result.rowCount) fail("conflict");
+      });
+    },
+    async revoke(input) {
+      await transaction(input, false, async (db) => {
+        // Terminal for this deployment id. A new enrollment cannot silently re-enable it.
+        await db.query("UPDATE sanoma_identity.deployments SET enabled=false WHERE id=$1", [input.deployment]);
+      });
+    },
+  };
+}
+
+/** Run-local sandbox authority: never reads or mutates the live enrollment database. */
+export function memoryIdentityProvisioning(): IdentityProvisioning {
+  const deployments = new Map<
+    string,
+    { identity: DeploymentIdentity; enabled: boolean; credentials: Map<number, EnrollIdentity> }
+  >();
+  const hashes = new Set<string>();
+  const find = (input: DeploymentIdentity) => {
+    checkIdentity(input);
+    const found = deployments.get(input.deployment);
+    if (!found || !sameIdentity(found.identity, input)) return fail("conflict");
+    return found;
+  };
+  return {
+    async enroll(input) {
+      checkIdentity(input);
+      generationOf(input.generation);
+      if (deadlineOf(input.validUntil) <= Date.now() || !/^[0-9a-f]{64}$/.test(input.hash)) fail("invalid");
+      const found = deployments.get(input.deployment);
+      if (found && (!sameIdentity(found.identity, input) || !found.enabled)) fail("conflict");
+      const current = found?.credentials.get(input.generation);
+      if (current) {
+        if (current.hash !== input.hash || deadlineOf(current.validUntil) !== deadlineOf(input.validUntil))
+          fail("conflict");
+        return;
+      }
+      if (hashes.has(input.hash) || (found && [...found.credentials.keys()].some((g) => g >= input.generation)))
+        fail("conflict");
+      const row = found ?? { identity: { ...input }, enabled: true, credentials: new Map<number, EnrollIdentity>() };
+      row.credentials.set(input.generation, { ...input });
+      hashes.add(input.hash);
+      deployments.set(input.deployment, row);
+    },
+    async retire(input) {
+      generationOf(input.generation);
+      const deadline = deadlineOf(input.validUntil);
+      const current = find(input).credentials.get(input.generation);
+      if (!current) return fail("conflict");
+      current.validUntil = new Date(Math.min(deadlineOf(current.validUntil), deadline)).toISOString();
+    },
+    async revoke(input) {
+      find(input).enabled = false;
+    },
+  };
+}

package/src/identity-service.ts

@@ -0,0 +1,179 @@
+import { createServer } from "node:http";
+import type { AddressInfo } from "node:net";
+import { Pool } from "pg";
+import { NodeRequest, sendNodeResponse } from "srvx/node";
+import {
+  identityBroker,
+  postgresIdentityEnrollments,
+  attachedGoogleTokenIssuer,
+  provisioningIdentityBroker,
+  attachedGoogleIdTokenIssuer,
+  type ProvisioningIdentity,
+  type IdentityAudit,
+} from "./cloud-identity.ts";
+
+/** Install with administrative authority in the audit database, separately from the serving process. */
+export const CLOUD_IDENTITY_AUDIT_SQL = `
+CREATE SCHEMA IF NOT EXISTS sanoma_identity;
+REVOKE ALL ON SCHEMA sanoma_identity FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS sanoma_identity.audit_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  recorded_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  result text NOT NULL CHECK (result IN ('issued', 'denied', 'unavailable')),
+  deployment text, company text, environment text, service_account text,
+  generation bigint, expires_at timestamptz
+);
+REVOKE ALL ON sanoma_identity.audit_events FROM PUBLIC;
+`;
+
+export interface IdentityServiceOptions {
+  /** Explicit broker database login with SELECT only on the enrollment tables. */
+  enrollmentDatabaseUrl: string;
+  /** Explicit audit database login with INSERT only on audit_events. */
+  auditDatabaseUrl: string;
+  mode: { type: "runtime" } | { type: "provisioning"; identity: ProvisioningIdentity };
+  /** Cloud Run terminates TLS. Keep this service behind the deployment's HTTPS ingress. */
+  host?: string;
+  port?: number;
+  /** Bound in-flight issuance work and database waiters; excess requests receive 429. */
+  maxConcurrentRequests?: number;
+}
+
+const unavailable = () => new Error("Identity service unavailable");
+const poolFor = (connectionString: string) => {
+  if (!connectionString) throw unavailable();
+  const pool = new Pool({
+    connectionString,
+    max: 5,
+    connectionTimeoutMillis: 10_000,
+    query_timeout: 10_000,
+    statement_timeout: 10_000,
+  });
+  // Never forward database diagnostics: they can contain connection information.
+  pool.on("error", () => {});
+  return pool;
+};
+
+async function checkRoles(reader: Pool, audit: Pool): Promise<void> {
+  const read = await reader.query<{ allowed: boolean }>(`SELECT
+    has_schema_privilege('sanoma_identity', 'USAGE') AND
+    NOT has_schema_privilege('sanoma_identity', 'CREATE') AND
+    NOT EXISTS (SELECT FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole OR rolcreatedb OR rolbypassrls)) AND
+    has_table_privilege('sanoma_identity.deployments', 'SELECT') AND
+    has_table_privilege('sanoma_identity.credentials', 'SELECT') AND
+    NOT has_table_privilege('sanoma_identity.deployments', 'INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AND
+    NOT has_table_privilege('sanoma_identity.credentials', 'INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AS allowed`);
+  const write = await audit.query<{ allowed: boolean }>(`SELECT
+    has_schema_privilege('sanoma_identity', 'USAGE') AND
+    NOT has_schema_privilege('sanoma_identity', 'CREATE') AND
+    NOT EXISTS (SELECT FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole OR rolcreatedb OR rolbypassrls)) AND
+    has_table_privilege('sanoma_identity.audit_events', 'INSERT') AND
+    NOT has_table_privilege('sanoma_identity.audit_events', 'SELECT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AS allowed`);
+  if (read.rows[0]?.allowed !== true || write.rows[0]?.allowed !== true) throw unavailable();
+}
+
+/** Starts a standalone broker without loading company code, starting a worker or installing schemas. */
+export async function startIdentityService(options: IdentityServiceOptions): Promise<{
+  url: string;
+  stop(): Promise<void>;
+}> {
+  let reader: Pool | undefined, audit: Pool | undefined;
+  const server = createServer();
+  let closing: Promise<void> | undefined;
+  const close = () =>
+    (closing ??= (async () => {
+      await new Promise<void>((resolve) => {
+        server.close(() => resolve());
+        server.closeAllConnections();
+      });
+      await Promise.all([reader?.end(), audit?.end()]);
+    })());
+  try {
+    const limit = options.maxConcurrentRequests ?? 32;
+    if (!Number.isInteger(limit) || limit < 1 || limit > 256) throw unavailable();
+    let active = 0;
+    reader = poolFor(options.enrollmentDatabaseUrl);
+    audit = poolFor(options.auditDatabaseUrl);
+    await checkRoles(reader, audit);
+    const record = async (event: IdentityAudit) => {
+      const e = event.enrollment;
+      // Fixed columns only: no tokens, hashes, headers or arbitrary caller fields.
+      await audit!.query(
+        `INSERT INTO sanoma_identity.audit_events
+        (result, deployment, company, environment, service_account, generation, expires_at)
+        VALUES ($1,$2,$3,$4,$5,$6,$7)`,
+        [
+          event.result,
+          e?.deployment ?? null,
+          e?.company ?? null,
+          e?.environment ?? null,
+          e?.serviceAccount ?? null,
+          e?.generation ?? null,
+          event.expiresAt === undefined ? null : new Date(event.expiresAt),
+        ],
+      );
+    };
+    const enrollments = postgresIdentityEnrollments(async () => reader!);
+    const handle =
+      options.mode.type === "runtime"
+        ? identityBroker({ enrollments, issue: attachedGoogleTokenIssuer(), audit: record })
+        : options.mode.type === "provisioning"
+          ? provisioningIdentityBroker({
+              identity: options.mode.identity,
+              enrollments,
+              issue: attachedGoogleIdTokenIssuer(options.mode.identity),
+              audit: record,
+            })
+          : (() => {
+              throw unavailable();
+            })();
+    server.requestTimeout = 15_000;
+    server.headersTimeout = 10_000;
+    server.on("request", (req, res) => {
+      // Fetch Request adapters may hide a GET body. Refuse it at the HTTP boundary.
+      if (
+        req.method === "GET" &&
+        (req.headers["transfer-encoding"] || (req.headers["content-length"] ?? "0") !== "0")
+      ) {
+        res.writeHead(400, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+        res.end('{"error":"invalid_request"}');
+        return;
+      }
+      if (req.url === "/healthz" && (req.method === "GET" || req.method === "HEAD")) {
+        res.writeHead(200, { "Content-Type": "text/plain", "Cache-Control": "no-store" });
+        res.end("ok\n");
+        return;
+      }
+      if (active >= limit) {
+        res.writeHead(429, { "Content-Type": "application/json", "Cache-Control": "no-store", "Retry-After": "1" });
+        res.end('{"error":"busy"}');
+        return;
+      }
+      active++;
+      Promise.resolve()
+        .then(() => handle(new NodeRequest({ req, res })))
+        .then((response) => sendNodeResponse(res, response))
+        .catch(() => {
+          if (res.headersSent) res.destroy();
+          else {
+            res.writeHead(503, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+            res.end('{"error":"unavailable"}');
+          }
+        })
+        .finally(() => {
+          active--;
+        });
+    });
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(options.port ?? 8080, options.host ?? "127.0.0.1", resolve);
+    });
+    const { address, family, port } = server.address() as AddressInfo;
+    const hostname =
+      address === "0.0.0.0" || address === "::" ? "localhost" : family === "IPv6" ? `[${address}]` : address;
+    return { url: `http://${hostname}:${port}`, stop: close };
+  } catch {
+    await close().catch(() => {});
+    throw unavailable();
+  }
+}

package/src/index.ts

@@ -1,6 +1,8 @@
 export {
   type CallContext,
   CLIENT_IP_HEADER,
+  requestOrigin,
+  sameOrigin,
   type Connector,
   type ConnectorSetup,
   type ConnectorVendor,
@@ -12,13 +14,18 @@ export {
   type Effect,
   isOp,
   isSvgElement,
+  INVITE_SECONDS,
   type LoginContext,
   type LoginHalf,
+  type LoginIdentity,
+  type LoginMethod,
   type ModelContext,
   type Op,
   type OpSpec,
   type ResourceGroup,
   retryableStatus,
+  type SignInMethod,
+  type SocialClients,
   type VendorInfo,
   withSetup,
 } from "./op.ts";
@@ -33,6 +40,7 @@ export {
   type Builtin,
   type Ctx,
   type SleepRequest,
+  type StartedBy,
   type StepOptions,
   type Trigger,
   type Use,
@@ -53,9 +61,11 @@ export {
   type ResourceSpec,
   withoutWriteOnly,
 } from "./resource.ts";
+export { type DnsRecord, dnsRecord } from "./dns.ts";
 export {
   declaredWakeup,
   defineConfig,
+  envWakeup,
   resolveConfig,
   resolveDatabaseUrl,
   type ResolvedConfig,
@@ -201,9 +211,16 @@ export {
   storeDatabaseUrl,
 } from "./database.ts";
 export type { Chat, Chats } from "./chats.ts";
+export type { Tokens } from "./tokens.ts";
+export { type InviteRequest, openInvite, sealInvite, sealLoginCode } from "./seal.ts";
+export { postInvite, sanoma } from "./runtime-ops.ts";
+export { sourceKeyPair, sshPublicKey } from "./ssh-key.ts";
 export {
   checkWakeup,
   type DeclaredWakeup,
+  type EnvWakeup,
+  HOST_URL,
+  WAKE_PATH,
   type WakeupOutputs,
   type WakeupRegistration,
   type WakeupSpec,
@@ -243,6 +260,8 @@ export {
   principalOf,
   RUNTIME_AGENTS,
   HOST_CHECK_AGENT,
+  LOGIN_AGENT,
+  LOGIN_CODE_WORKFLOW,
   SCHEDULE_AGENT,
   credentialReady,
   DEFAULT_SLEEP_NAME,
@@ -298,7 +317,7 @@ export {
 export { checkSecretStore, type SecretStoreCheck } from "./secret-store-check.ts";
 
 export { postgresSecretStore } from "./credentials.ts";
-export { deploymentKey } from "./deployment-key.ts";
+export { deploymentKey, signingKeyFor } from "./deployment-key.ts";
 
 export {
   defineConnection,