@sanoma-ai/workflows 0.10.3 → 0.10.6

package/dist/identity-service.js

@@ -0,0 +1,148 @@
+import { createServer } from "node:http";
+import { Pool } from "pg";
+import { NodeRequest, sendNodeResponse } from "srvx/node";
+import { identityBroker, postgresIdentityEnrollments, attachedGoogleTokenIssuer, provisioningIdentityBroker, attachedGoogleIdTokenIssuer, } from "./cloud-identity.js";
+/** Install with administrative authority in the audit database, separately from the serving process. */
+export const CLOUD_IDENTITY_AUDIT_SQL = `
+CREATE SCHEMA IF NOT EXISTS sanoma_identity;
+REVOKE ALL ON SCHEMA sanoma_identity FROM PUBLIC;
+CREATE TABLE IF NOT EXISTS sanoma_identity.audit_events (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  recorded_at timestamptz NOT NULL DEFAULT clock_timestamp(),
+  result text NOT NULL CHECK (result IN ('issued', 'denied', 'unavailable')),
+  deployment text, company text, environment text, service_account text,
+  generation bigint, expires_at timestamptz
+);
+REVOKE ALL ON sanoma_identity.audit_events FROM PUBLIC;
+`;
+const unavailable = () => new Error("Identity service unavailable");
+const poolFor = (connectionString) => {
+    if (!connectionString)
+        throw unavailable();
+    const pool = new Pool({
+        connectionString,
+        max: 5,
+        connectionTimeoutMillis: 10_000,
+        query_timeout: 10_000,
+        statement_timeout: 10_000,
+    });
+    // Never forward database diagnostics: they can contain connection information.
+    pool.on("error", () => { });
+    return pool;
+};
+async function checkRoles(reader, audit) {
+    const read = await reader.query(`SELECT
+    has_schema_privilege('sanoma_identity', 'USAGE') AND
+    NOT has_schema_privilege('sanoma_identity', 'CREATE') AND
+    NOT EXISTS (SELECT FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole OR rolcreatedb OR rolbypassrls)) AND
+    has_table_privilege('sanoma_identity.deployments', 'SELECT') AND
+    has_table_privilege('sanoma_identity.credentials', 'SELECT') AND
+    NOT has_table_privilege('sanoma_identity.deployments', 'INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AND
+    NOT has_table_privilege('sanoma_identity.credentials', 'INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AS allowed`);
+    const write = await audit.query(`SELECT
+    has_schema_privilege('sanoma_identity', 'USAGE') AND
+    NOT has_schema_privilege('sanoma_identity', 'CREATE') AND
+    NOT EXISTS (SELECT FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole OR rolcreatedb OR rolbypassrls)) AND
+    has_table_privilege('sanoma_identity.audit_events', 'INSERT') AND
+    NOT has_table_privilege('sanoma_identity.audit_events', 'SELECT,UPDATE,DELETE,TRUNCATE,REFERENCES,TRIGGER') AS allowed`);
+    if (read.rows[0]?.allowed !== true || write.rows[0]?.allowed !== true)
+        throw unavailable();
+}
+/** Starts a standalone broker without loading company code, starting a worker or installing schemas. */
+export async function startIdentityService(options) {
+    let reader, audit;
+    const server = createServer();
+    let closing;
+    const close = () => (closing ??= (async () => {
+        await new Promise((resolve) => {
+            server.close(() => resolve());
+            server.closeAllConnections();
+        });
+        await Promise.all([reader?.end(), audit?.end()]);
+    })());
+    try {
+        const limit = options.maxConcurrentRequests ?? 32;
+        if (!Number.isInteger(limit) || limit < 1 || limit > 256)
+            throw unavailable();
+        let active = 0;
+        reader = poolFor(options.enrollmentDatabaseUrl);
+        audit = poolFor(options.auditDatabaseUrl);
+        await checkRoles(reader, audit);
+        const record = async (event) => {
+            const e = event.enrollment;
+            // Fixed columns only: no tokens, hashes, headers or arbitrary caller fields.
+            await audit.query(`INSERT INTO sanoma_identity.audit_events
+        (result, deployment, company, environment, service_account, generation, expires_at)
+        VALUES ($1,$2,$3,$4,$5,$6,$7)`, [
+                event.result,
+                e?.deployment ?? null,
+                e?.company ?? null,
+                e?.environment ?? null,
+                e?.serviceAccount ?? null,
+                e?.generation ?? null,
+                event.expiresAt === undefined ? null : new Date(event.expiresAt),
+            ]);
+        };
+        const enrollments = postgresIdentityEnrollments(async () => reader);
+        const handle = options.mode.type === "runtime"
+            ? identityBroker({ enrollments, issue: attachedGoogleTokenIssuer(), audit: record })
+            : options.mode.type === "provisioning"
+                ? provisioningIdentityBroker({
+                    identity: options.mode.identity,
+                    enrollments,
+                    issue: attachedGoogleIdTokenIssuer(options.mode.identity),
+                    audit: record,
+                })
+                : (() => {
+                    throw unavailable();
+                })();
+        server.requestTimeout = 15_000;
+        server.headersTimeout = 10_000;
+        server.on("request", (req, res) => {
+            // Fetch Request adapters may hide a GET body. Refuse it at the HTTP boundary.
+            if (req.method === "GET" &&
+                (req.headers["transfer-encoding"] || (req.headers["content-length"] ?? "0") !== "0")) {
+                res.writeHead(400, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                res.end('{"error":"invalid_request"}');
+                return;
+            }
+            if (req.url === "/healthz" && (req.method === "GET" || req.method === "HEAD")) {
+                res.writeHead(200, { "Content-Type": "text/plain", "Cache-Control": "no-store" });
+                res.end("ok\n");
+                return;
+            }
+            if (active >= limit) {
+                res.writeHead(429, { "Content-Type": "application/json", "Cache-Control": "no-store", "Retry-After": "1" });
+                res.end('{"error":"busy"}');
+                return;
+            }
+            active++;
+            Promise.resolve()
+                .then(() => handle(new NodeRequest({ req, res })))
+                .then((response) => sendNodeResponse(res, response))
+                .catch(() => {
+                if (res.headersSent)
+                    res.destroy();
+                else {
+                    res.writeHead(503, { "Content-Type": "application/json", "Cache-Control": "no-store" });
+                    res.end('{"error":"unavailable"}');
+                }
+            })
+                .finally(() => {
+                active--;
+            });
+        });
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(options.port ?? 8080, options.host ?? "127.0.0.1", resolve);
+        });
+        const { address, family, port } = server.address();
+        const hostname = address === "0.0.0.0" || address === "::" ? "localhost" : family === "IPv6" ? `[${address}]` : address;
+        return { url: `http://${hostname}:${port}`, stop: close };
+    }
+    catch {
+        await close().catch(() => { });
+        throw unavailable();
+    }
+}
+//# sourceMappingURL=identity-service.js.map

package/dist/identity-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-service.js","sourceRoot":"","sources":["../src/identity-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,GAG5B,MAAM,qBAAqB,CAAC;AAE7B,wGAAwG;AACxG,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;CAWvC,CAAC;AAeF,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,gBAAwB,EAAE,EAAE;IAC3C,IAAI,CAAC,gBAAgB;QAAE,MAAM,WAAW,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC;QACpB,gBAAgB;QAChB,GAAG,EAAE,CAAC;QACN,uBAAuB,EAAE,MAAM;QAC/B,aAAa,EAAE,MAAM;QACrB,iBAAiB,EAAE,MAAM;KAC1B,CAAC,CAAC;IACH,+EAA+E;IAC/E,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CAAC,MAAY,EAAE,KAAW;IACjD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAuB;;;;;;;0HAOkE,CAAC,CAAC;IAC1H,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAuB;;;;;2HAKmE,CAAC,CAAC;IAC3H,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI;QAAE,MAAM,WAAW,EAAE,CAAC;AAC7F,CAAC;AAED,wGAAwG;AACxG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA+B;IAIxE,IAAI,MAAwB,EAAE,KAAuB,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,OAAkC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,EAAE,CACjB,CAAC,OAAO,KAAK,CAAC,KAAK,IAAI,EAAE;QACvB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG;YAAE,MAAM,WAAW,EAAE,CAAC;QAC9E,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAChD,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC1C,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,EAAE,KAAoB,EAAE,EAAE;YAC5C,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;YAC3B,6EAA6E;YAC7E,MAAM,KAAM,CAAC,KAAK,CAChB;;sCAE8B,EAC9B;gBACE,KAAK,CAAC,MAAM;gBACZ,CAAC,EAAE,UAAU,IAAI,IAAI;gBACrB,CAAC,EAAE,OAAO,IAAI,IAAI;gBAClB,CAAC,EAAE,WAAW,IAAI,IAAI;gBACtB,CAAC,EAAE,cAAc,IAAI,IAAI;gBACzB,CAAC,EAAE,UAAU,IAAI,IAAI;gBACrB,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;aACjE,CACF,CAAC;QACJ,CAAC,CAAC;QACF,MAAM,WAAW,GAAG,2BAA2B,CAAC,KAAK,IAAI,EAAE,CAAC,MAAO,CAAC,CAAC;QACrE,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS;YAC7B,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACpF,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,cAAc;gBACpC,CAAC,CAAC,0BAA0B,CAAC;oBACzB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ;oBAC/B,WAAW;oBACX,KAAK,EAAE,2BAA2B,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;oBACzD,KAAK,EAAE,MAAM;iBACd,CAAC;gBACJ,CAAC,CAAC,CAAC,GAAG,EAAE;oBACJ,MAAM,WAAW,EAAE,CAAC;gBACtB,CAAC,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAC/B,MAAM,CAAC,cAAc,GAAG,MAAM,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAChC,8EAA8E;YAC9E,IACE,GAAG,CAAC,MAAM,KAAK,KAAK;gBACpB,CAAC,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EACpF,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBACxF,GAAG,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,IAAI,GAAG,CAAC,GAAG,KAAK,UAAU,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;gBAClF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAChB,OAAO;YACT,CAAC;YACD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;gBACpB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC5G,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBAC5B,OAAO;YACT,CAAC;YACD,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,OAAO,EAAE;iBACd,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;iBACjD,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;iBACnD,KAAK,CAAC,GAAG,EAAE;gBACV,IAAI,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,OAAO,EAAE,CAAC;qBAC9B,CAAC;oBACJ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;oBACxF,GAAG,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC,CAAC;iBACD,OAAO,CAAC,GAAG,EAAE;gBACZ,MAAM,EAAE,CAAC;YACX,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;QAClE,MAAM,QAAQ,GACZ,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;QACzG,OAAO,EAAE,GAAG,EAAE,UAAU,QAAQ,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC9B,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-export { type CallContext, CLIENT_IP_HEADER, requestOrigin, sameOrigin, type Connector, type ConnectorSetup, type ConnectorVendor, type Driver, type DriverEnv, type DriverFn, defineConnector, DriverError, type Effect, isOp, isSvgElement, INVITE_SECONDS, type LoginContext, type LoginHalf, type LoginIdentity, type LoginMethod, type ModelContext, type Op, type OpSpec, type ResourceGroup, retryableStatus, type SignInMethod, type VendorInfo, withSetup, } from "./op.ts";
+export { type CallContext, CLIENT_IP_HEADER, requestOrigin, sameOrigin, type Connector, type ConnectorSetup, type ConnectorVendor, type Driver, type DriverEnv, type DriverFn, defineConnector, DriverError, type Effect, isOp, isSvgElement, INVITE_SECONDS, type LoginContext, type LoginHalf, type LoginIdentity, type LoginMethod, type ModelContext, type Op, type OpSpec, type ResourceGroup, retryableStatus, type SignInMethod, type SocialClients, type VendorInfo, withSetup, } from "./op.ts";
 export { SanomaPackageField, vendorInfo } from "./vendor-info.ts";
 export { defineWorkflow, Principal, type ApprovalRequest, type ApprovalResult, type ApprovalState, type Approver, type Builtin, type Ctx, type SleepRequest, type StartedBy, type StepOptions, type Trigger, type Use, type WorkflowDefinition, } from "./define.ts";
 export { compareDeclared, type Declared, type Declaring, defineResource, diffDeclared, type FieldReference, type PlanAction, type References, type Resource, type ResourceFields, type ResourceOps, type ResourceSpec, withoutWriteOnly, } from "./resource.ts";
+export { type DnsRecord, dnsRecord } from "./dns.ts";
 export { declaredWakeup, defineConfig, envWakeup, resolveConfig, resolveDatabaseUrl, type ResolvedConfig, type SanomaConfig, } from "./config.ts";
 export { type AppEntry, appSourceOf, readApps } from "./apps.ts";
 export { type AppDefinition, defineApp } from "./definitions.ts";

package/dist/index.js

@@ -2,6 +2,7 @@ export { CLIENT_IP_HEADER, requestOrigin, sameOrigin, defineConnector, DriverErr
 export { SanomaPackageField, vendorInfo } from "./vendor-info.js";
 export { defineWorkflow, Principal, } from "./define.js";
 export { compareDeclared, defineResource, diffDeclared, withoutWriteOnly, } from "./resource.js";
+export { dnsRecord } from "./dns.js";
 export { declaredWakeup, defineConfig, envWakeup, resolveConfig, resolveDatabaseUrl, } from "./config.js";
 // An app's `app.ts` (`defineApp`), and where the launcher finds an app's workflows and data file.
 export { appSourceOf, readApps } from "./apps.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,aAAa,EACb,UAAU,EAOV,eAAe,EACf,WAAW,EAEX,IAAI,EACJ,YAAY,EACZ,cAAc,EASd,eAAe,EAGf,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,SAAS,GAaV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,cAAc,EACd,YAAY,EAQZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,aAAa,EACb,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,kGAAkG;AAClG,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxE,2GAA2G;AAC3G,gIAAgI;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,cAAc,EACd,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,KAAK,EAIL,WAAW,EACX,WAAW,EACX,SAAS,EAIT,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,cAAc,GAMf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EAIJ,UAAU,EAIV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EAEX,YAAY,EACZ,YAAY,EAEZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EAET,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAA2C,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,qGAAqG;AACrG,OAAO,EACL,cAAc,EACd,QAAQ,EACR,aAAa,EAEb,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,WAAW,EAEX,OAAO,EAMP,SAAS,EAET,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAIb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAsB,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,WAAW,EAGX,QAAQ,EACR,SAAS,EAIT,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAML,YAAY,GAKb,MAAM,aAAa,CAAC;AACrB,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,4EAA4E;AAC5E,OAAO,EACL,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EAEd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EAEZ,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,kGAAkG;AAClG,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAgC,MAAM,SAAS,CAAC;AACrE,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAoD,MAAM,YAAY,CAAC;AAC3F,8EAA8E;AAC9E,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GASlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,aAAa,GASd,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gBAAgB,EAChB,aAAa,EACb,UAAU,EAOV,eAAe,EACf,WAAW,EAEX,IAAI,EACJ,YAAY,EACZ,cAAc,EASd,eAAe,EAIf,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EACL,cAAc,EACd,SAAS,GAaV,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EAGf,cAAc,EACd,YAAY,EAQZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAkB,SAAS,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EACL,cAAc,EACd,YAAY,EACZ,SAAS,EACT,aAAa,EACb,kBAAkB,GAGnB,MAAM,aAAa,CAAC;AACrB,kGAAkG;AAClG,OAAO,EAAiB,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAsB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACxE,2GAA2G;AAC3G,gIAAgI;AAChI,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAyB,aAAa,EAAE,MAAM,UAAU,CAAC;AAChE,OAAO,EACL,cAAc,EACd,UAAU,GAMX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,KAAK,EAIL,WAAW,EACX,WAAW,EACX,SAAS,EAIT,OAAO,EACP,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,cAAc,GAMf,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,KAAK,EACL,QAAQ,EACR,OAAO,EACP,WAAW,EAEX,IAAI,EAIJ,UAAU,EAIV,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EAEX,YAAY,EACZ,YAAY,EAEZ,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oBAAoB,EACpB,SAAS,EAET,YAAY,EAGZ,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,cAAc,GAKf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAA2C,MAAM,iBAAiB,CAAC;AAE3F,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAC7D,qGAAqG;AACrG,OAAO,EACL,cAAc,EACd,QAAQ,EACR,aAAa,EAEb,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,WAAW,EAEX,OAAO,EAMP,SAAS,EAET,eAAe,EACf,cAAc,GAGf,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAIb,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAsB,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,WAAW,EAGX,QAAQ,EACR,SAAS,EAIT,eAAe,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAML,YAAY,GAKb,MAAM,aAAa,CAAC;AACrB,4FAA4F;AAC5F,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,4EAA4E;AAC5E,OAAO,EACL,MAAM,EACN,SAAS,EACT,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EAEd,QAAQ,EACR,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,OAAO,EACP,UAAU,EACV,SAAS,EACT,SAAS,EACT,SAAS,EACT,WAAW,EACX,YAAY,EAEZ,QAAQ,EACR,gBAAgB,EAChB,WAAW,GACZ,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,kGAAkG;AAClG,uDAAuD;AACvD,OAAO,EAAE,YAAY,EAAgC,MAAM,SAAS,CAAC;AACrE,6FAA6F;AAC7F,OAAO,EAAE,WAAW,EAAoD,MAAM,YAAY,CAAC;AAC3F,8EAA8E;AAC9E,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,wBAAwB,EACxB,iBAAiB,GASlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,mBAAmB,GAMpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAyB,MAAM,yBAAyB,CAAC;AAElF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,aAAa,EACb,aAAa,GASd,MAAM,iBAAiB,CAAC"}

package/dist/op.d.ts

@@ -276,6 +276,13 @@ export interface LoginIdentity {
 export type LoginMethod = "code" | "github" | "invite" | "password";
 /** How a person signed in to the staff login, which the ledger records (`signin.recorded`): all but a password. */
 export type SignInMethod = Exclude<LoginMethod, "password">;
+/** The company's own OAuth clients, as a login takes them: GitHub's is its GitHub App's client. */
+export interface SocialClients {
+    github?: {
+        clientId: string;
+        clientSecret: string;
+    };
+}
 /**
  * What the app gives a connector's login half (`ConnectorSetup.login`) when it makes it: for a
  * public site, once per site; for the staff login, once, with `staff`.
@@ -305,17 +312,17 @@ export interface LoginContext {
      * sender, and then the login offers no code.
      */
     sendCode?(email: string, code: string): Promise<void>;
+    /**
+     * For a public site's login: the company's own OAuth clients (its GitHub App's), each a method
+     * when given, by which a visitor signs in or, signed in, links that account (`LoginIdentity.github`).
+     */
+    social?: SocialClients;
     /** For the staff login only: who it may let in, the company's social clients, and where it tells of a sign-in. */
     staff?: {
         /** Whether the people files declare the person `identity` names; a login never makes a user for anyone else. */
         admits(identity: LoginIdentity): boolean;
         /** The company's own OAuth clients, each a method when given. */
-        social: {
-            github?: {
-                clientId: string;
-                clientSecret: string;
-            };
-        };
+        social: SocialClients;
         /** Tells the app of a sign-in by `method` of the person `identity` names, which the ledger records. Must not throw. */
         record(method: SignInMethod, identity: LoginIdentity): Promise<void>;
     };
@@ -345,8 +352,8 @@ export declare function sameOrigin(request: Request): boolean;
 export interface LoginHalf {
     /**
      * Who signed in, as the provider's stable subject, with their email when the provider verified
-     * it and their GitHub login when they signed in with GitHub; null for a missing or bad cookie,
-     * for which it never throws.
+     * it and their GitHub login when they signed in with GitHub or linked it; null for a missing or
+     * bad cookie, for which it never throws.
      */
     verify(request: Request): Promise<{
         subject: string;

package/dist/op.js.map

@@ -1 +1 @@
-{"version":3,"file":"op.js","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAoEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAkBrE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAcjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAiClC,uFAAuF;AACvF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9G,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACjE,CAAC,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC1D,KAAK,KAAK,IAAI;IACb,KAAgC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,KAAQ,EACR,IAAiB;IAEjB,qGAAqG;IACrG,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,YAAY,OAAO,sDAAsD,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAA0B,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,uGAAuG;IACvG,MAAM,QAAQ,GAAY,UAAU,EAAE,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,KAAK,QAAQ,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,mCAAmC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,GAAqC,KAA+B,CAAC;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,OAAO,QAAQ,0BAA0B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,yBAAyB,KAAK,CAAC,IAAI,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAI,EAAE;gBACnC,MAAM;gBACN,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK;gBACpC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;aACP,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,uGAAuG;IACvG,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,+HAA+H,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAuB,MAAM,CAAC,MAAM,CAAC;QAC9C,MAAM,EAAE,gBAAgB;QACxB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAgC,CAAC;AACnE,CAAC;AAgCD;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,eAAwB,CAAC;IAChC,SAAS,CAAU;IACnB,MAAM,CAAU;IAChB,UAAU,CAAU;IAE7B,YAAY,OAAe,EAAE,OAAsF;QACjH,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC7E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AA2HD;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,+IAA+I;AAC/I,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,aAAa,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAsCD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAgC,SAAY,EAAE,KAA8B;IACnG,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,SAAS;QACZ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,IAAI,MAAM,EAAE,MAAM,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,KAAK,GAAG,2DAA2D,CAAC;IAC1E,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,gIAAgI,KAAK,GAAG;QAC1I,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,kEAAkE,KAAK,EAAE,CACvG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAA8B,EAAkB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AAEzG,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AACxE,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA0B,EAC1B,IAA4D,EAC5D,OAAO,GAA4D,EAAE;IAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAoD,CAAC,EAAE,CAAC;QAC3F,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACpC,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,wFAAwF;QACxF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+C,CAAC,EAAE,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;iBAClD,IAAI,OAAO,EAAE,KAAK,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAc,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"op.js","sourceRoot":"","sources":["../src/op.ts"],"names":[],"mappings":"AAoEA;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAkB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAkBrE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAkB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAcjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAiClC,uFAAuF;AACvF,MAAM,WAAW,GAAG,iCAAiC,CAAC;AAEtD,oFAAoF;AACpF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAY,EAAiB,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE9G,MAAM,eAAe,GAAG,CAAC,KAAc,EAA0B,EAAE,CACjE,CAAC,OAAO,KAAK,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;IAC1D,KAAK,KAAK,IAAI;IACb,KAAgC,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AAEvD;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAS,EACT,KAAQ,EACR,IAAiB;IAEjB,qGAAqG;IACrG,MAAM,IAAI,GACR,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC;IAChH,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,YAAY,OAAO,sDAAsD,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAA0B,EAAE,CAAC,EAAE,CAAC,CAAC;IACzG,uGAAuG;IACvG,MAAM,QAAQ,GAAY,UAAU,EAAE,QAAQ,CAAC;IAC/C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,KAAK,QAAQ,CAAC;QACxG,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,mCAAmC,CAAC,CAAC;IACjF,MAAM,GAAG,GAAuC,EAAE,CAAC;IACnD,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,GAAqC,KAA+B,CAAC;QAC5E,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,OAAO,QAAQ,0BAA0B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,yBAAyB,KAAK,CAAC,IAAI,gBAAgB,QAAQ,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QAClB,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,IAAI;gBACV,EAAE,EAAE,GAAG,MAAM,IAAI,QAAQ,IAAI,IAAI,EAAE;gBACnC,MAAM;gBACN,QAAQ;gBACR,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,KAAK;gBACpC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACnE,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;aACP,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,uGAAuG;IACvG,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,oBAAoB,MAAM,+HAA+H,CAC1J,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAuB,MAAM,CAAC,MAAM,CAAC;QAC9C,MAAM,EAAE,gBAAgB;QACxB,EAAE,EAAE,MAAM;QACV,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAgC,CAAC;AACnE,CAAC;AAgCD;;;;GAIG;AACH,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,eAAwB,CAAC;IAChC,SAAS,CAAU;IACnB,MAAM,CAAU;IAChB,UAAU,CAAU;IAE7B,YAAY,OAAe,EAAE,OAAsF;QACjH,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC/D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAC7E,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC;AAC3D,CAAC;AAqID;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO;QAAE,GAAG,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClF,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,+IAA+I;AAC/I,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,aAAa,CAAC;IACjD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9D,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxE,CAAC;AAsCD,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAgC,SAAY,EAAE,KAA8B;IACnG,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO;QACL,GAAG,SAAS;QACZ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;KAC1F,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAsC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,IAAI,MAAM,EAAE,MAAM,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,KAAK,GAAG,2DAA2D,CAAC;IAC1E,MAAM,IAAI,KAAK,CACb,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,gIAAgI,KAAK,GAAG;QAC1I,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,kEAAkE,KAAK,EAAE,CACvG,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,SAA8B,EAAkB,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AAEzG,MAAM,UAAU,IAAI,CAAC,CAAU;IAC7B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAK,CAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;AACxE,CAAC;AAqBD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,SAA0B,EAC1B,IAA4D,EAC5D,OAAO,GAA4D,EAAE;IAErE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAc,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAoD,CAAC,EAAE,CAAC;QAC3F,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YAAE,IAAI,IAAI,CAAC,EAAE,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;IACpC,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,wFAAwF;QACxF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,MAAM;YACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;SAC9F,CAAC,CAAC;IACL,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+C,CAAC,EAAE,CAAC;QAC9F,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACnD,MAAM,GAAG,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;iBAClD,IAAI,OAAO,EAAE,KAAK,UAAU;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAc,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG;QACf,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrG,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;QACvB,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;KAC9F,CAAC,CAAC;AACL,CAAC"}

package/dist/provisioning-identity.d.ts

@@ -0,0 +1,27 @@
+import type { IdentityAudit, IdentityEnrollments } from "./cloud-identity.ts";
+/** Fixed by the trusted provisioning issuer deployment, never by a request or company config. */
+export interface ProvisioningIdentity {
+    serviceAccount: string;
+    /** Google's immutable numeric uniqueId for the source service account. */
+    subject: string;
+    /** Exact WIF provider audience whose trust condition pins this subject. */
+    audience: string;
+}
+export interface ProvisioningIdToken {
+    idToken: string;
+    expiresAt: number;
+}
+/** Dedicated Cloud Run attached identity with getOpenIdToken on the fixed source account only. */
+export declare function attachedGoogleIdTokenIssuer(configuration: ProvisioningIdentity): () => Promise<ProvisioningIdToken>;
+/**
+ * GET /identity for a separate provisioning credential source. Deploy with its own enrollment
+ * reader and attached issuer, outside the runtime broker. OIDC tokens last up to one hour:
+ * revocation must remove federation/impersonation trust as well as stopping new issuance.
+ */
+export declare function provisioningIdentityBroker(options: {
+    identity: ProvisioningIdentity;
+    enrollments: IdentityEnrollments;
+    /** Trusted Google issuer. The request cannot select subject, audience or token lifetime. */
+    issue(): Promise<ProvisioningIdToken>;
+    audit(event: IdentityAudit): Promise<void>;
+}): (request: Request) => Promise<Response>;

package/dist/provisioning-identity.js

@@ -0,0 +1,81 @@
+import { Compute } from "google-auth-library";
+import { enrollmentBroker } from "./identity-broker.js";
+const ACCOUNT = /^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/;
+const AUDIENCE = /^\/\/iam\.googleapis\.com\/projects\/[1-9][0-9]+\/locations\/global\/workloadIdentityPools\/[a-z][a-z0-9-]+\/providers\/[a-z][a-z0-9-]+$/;
+const SCOPE = "https://www.googleapis.com/auth/cloud-platform";
+const fail = () => new Error("Provisioning identity unavailable");
+function identityOf(identity) {
+    if (!ACCOUNT.test(identity.serviceAccount) ||
+        !/^[1-9][0-9]+$/.test(identity.subject) ||
+        !AUDIENCE.test(identity.audience))
+        throw fail();
+    return { serviceAccount: identity.serviceAccount, subject: identity.subject, audience: identity.audience };
+}
+// The issuer calls Google's authenticated HTTPS endpoint. Check its fixed claims and expiry;
+// signature verification of the returned Google token remains Google's STS responsibility.
+function tokenExpiry(idToken, identity, now) {
+    try {
+        if (typeof idToken !== "string" || idToken.length > 8192)
+            throw fail();
+        const parts = idToken.split(".");
+        if (parts.length !== 3 || !parts.every((part) => /^[A-Za-z0-9_-]+$/.test(part)))
+            throw fail();
+        const claims = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+        if (claims.iss !== "https://accounts.google.com" ||
+            claims.sub !== identity.subject ||
+            claims.aud !== identity.audience ||
+            claims.email !== identity.serviceAccount ||
+            claims.email_verified !== true ||
+            !Number.isSafeInteger(claims.iat) ||
+            !Number.isSafeInteger(claims.exp) ||
+            claims.iat * 1000 > now + 30_000 ||
+            claims.exp <= claims.iat ||
+            claims.exp - claims.iat > 3600 ||
+            claims.exp * 1000 <= now + 60_000 ||
+            claims.exp * 1000 > now + 3_630_000)
+            throw fail();
+        return claims.exp * 1000;
+    }
+    catch {
+        throw fail();
+    }
+}
+/** Dedicated Cloud Run attached identity with getOpenIdToken on the fixed source account only. */
+export function attachedGoogleIdTokenIssuer(configuration) {
+    const identity = identityOf(configuration);
+    const auth = new Compute({ scopes: [SCOPE] });
+    return async () => {
+        try {
+            const response = await auth.request({
+                url: `https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/${identity.serviceAccount}:generateIdToken`,
+                method: "POST",
+                data: { audience: identity.audience, includeEmail: true },
+                timeout: 10_000,
+            });
+            const idToken = response.data.token;
+            return { idToken, expiresAt: tokenExpiry(idToken, identity, Date.now()) };
+        }
+        catch {
+            throw fail();
+        }
+    };
+}
+/**
+ * GET /identity for a separate provisioning credential source. Deploy with its own enrollment
+ * reader and attached issuer, outside the runtime broker. OIDC tokens last up to one hour:
+ * revocation must remove federation/impersonation trust as well as stopping new issuance.
+ */
+export function provisioningIdentityBroker(options) {
+    const identity = identityOf(options.identity);
+    return enrollmentBroker({
+        path: "/identity",
+        method: "GET",
+        enrollments: options.enrollments,
+        accept: (enrollment) => enrollment.serviceAccount === identity.serviceAccount,
+        issue: () => options.issue(),
+        valid: (token, now) => token.expiresAt === tokenExpiry(token.idToken, identity, now),
+        body: (token) => ({ idToken: token.idToken, expiresAt: token.expiresAt }),
+        audit: options.audit,
+    });
+}
+//# sourceMappingURL=provisioning-identity.js.map

package/dist/provisioning-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-identity.js","sourceRoot":"","sources":["../src/provisioning-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAgBxD,MAAM,OAAO,GAAG,8DAA8D,CAAC;AAC/E,MAAM,QAAQ,GACZ,0IAA0I,CAAC;AAC7I,MAAM,KAAK,GAAG,gDAAgD,CAAC;AAC/D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAElE,SAAS,UAAU,CAAC,QAA8B;IAChD,IACE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QACtC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAEjC,MAAM,IAAI,EAAE,CAAC;IACf,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC7G,CAAC;AAED,6FAA6F;AAC7F,2FAA2F;AAC3F,SAAS,WAAW,CAAC,OAAe,EAAE,QAA8B,EAAE,GAAW;IAC/E,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,MAAM,IAAI,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,EAAE,CAAC;QAC9F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChF,IACE,MAAM,CAAC,GAAG,KAAK,6BAA6B;YAC5C,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,OAAO;YAC/B,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ;YAChC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,cAAc;YACxC,MAAM,CAAC,cAAc,KAAK,IAAI;YAC9B,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC;YACjC,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM;YAChC,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG;YACxB,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI;YAC9B,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,GAAG,MAAM;YACjC,MAAM,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,SAAS;YAEnC,MAAM,IAAI,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;AACH,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,2BAA2B,CAAC,aAAmC;IAC7E,MAAM,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAoB;gBACrD,GAAG,EAAE,uEAAuE,QAAQ,CAAC,cAAc,kBAAkB;gBACrH,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE;gBACzD,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAM1C;IACC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,WAAW;QACjB,MAAM,EAAE,KAAK;QACb,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc;QAC7E,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE;QAC5B,KAAK,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC;QACpF,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACzE,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;AACL,CAAC"}

package/dist/resource.d.ts

@@ -33,6 +33,26 @@ export interface FieldReference {
      * declared one. Without it, the field holds the resource's `name`, and is compared as it is.
      */
     readonly by?: readonly string[];
+    /**
+     * A dotted path in that resource's state: apply and drift give this field the named resource's
+     * state at this path, as a whole (a list or an object), read in the same run or made by an
+     * earlier step of it (`records: mail` takes a `resend.domain`'s `dns_records`). A data file may
+     * give a literal value here instead. `desired` holds the resource's `name` until then, which the
+     * schema does not judge. Where the same apply changes that resource at the path (creates or
+     * replaces it, or updates it with the path `unknown` or another value there in its plan), or,
+     * for a create, it has no state yet or nothing at the path, a plan is given `null` there (known
+     * after apply: the type's `plan` must accept it and report the path in `unknown`), so a change it
+     * makes is planned, and approved, up front. A plan of a bound object leaves the field out while
+     * its resource is absent, gone or unreadable and not about to change, as drift does, and its step
+     * runs without it. A step given `null` for the field whose value is still not known (its
+     * resource's step failed or did not run) fails before its driver is called, and drift leaves the
+     * field out. An empty list or object at the path counts as known: a vendor that answers `[]`
+     * while it is still filling the list makes the dependent write an empty one. The path must be a
+     * field of each type it may name (`checkFromRefs`, when a config is resolved). Not on a
+     * write-only field, nor one holding a write-only field (refused). Not yet on a bridge-backed type
+     * (`tfConnector`): an OpenTofu provider's plan reads `null` as unset, not as known after apply.
+     */
+    readonly from?: string;
 }
 /** A resource type's `fields.references`: by dotted path, the resource each names. */
 export type References = {
@@ -166,9 +186,10 @@ export interface Declared<Id extends string = string, T = State> {
 }
 /**
  * What a resource type's constructor takes: its fields, where `R` (its `fields.references`)
- * names a path, a declared resource of that type instead of a value (`repository_id: site`), and
- * where a string goes, a secret (`secret("NAME")`), which the constructor allows at a write-only
- * field only.
+ * names a path, a declared resource of that type instead of a value (`repository_id: site`), in
+ * place of the whole field for a `from` reference (`records: mail`) and of each item for a list
+ * otherwise, and where a string goes, a secret (`secret("NAME")`), which the constructor allows
+ * at a write-only field only.
  */
 export type Declaring<T, R extends References = {}> = [keyof R] extends [never] ? WithSecrets<T> : DeclaringAt<T, R, "">;
 type WithSecrets<V> = V extends string ? V | Secret : V extends readonly (infer I)[] ? WithSecrets<I>[] : V extends object ? {
@@ -177,7 +198,9 @@ type WithSecrets<V> = V extends string ? V | Secret : V extends readonly (infer
 type DeclaringAt<T, R extends References, P extends string> = T extends readonly (infer I)[] ? DeclaringAt<I, R, P>[] : T extends object ? {
     [K in keyof T]: K extends string ? DeclaringField<T[K], R, P extends "" ? K : `${P}.${K}`> : T[K];
 } : WithSecrets<T>;
-type DeclaringField<V, R extends References, P extends string> = P extends keyof R ? V extends readonly (infer I)[] ? (WithSecrets<I> | DeclaredOf<R[P]["type"]>)[] : WithSecrets<V> | DeclaredOf<R[P]["type"]> : [Extract<keyof R, `${P}.${string}`>] extends [never] ? WithSecrets<V> : DeclaringAt<V, R, P>;
+type DeclaringField<V, R extends References, P extends string> = P extends keyof R ? R[P] extends {
+    readonly from: string;
+} ? WithSecrets<V> | DeclaredOf<R[P]["type"]> : V extends readonly (infer I)[] ? (WithSecrets<I> | DeclaredOf<R[P]["type"]>)[] : WithSecrets<V> | DeclaredOf<R[P]["type"]> : [Extract<keyof R, `${P}.${string}`>] extends [never] ? WithSecrets<V> : DeclaringAt<V, R, P>;
 type DeclaredOf<Id> = Id extends string ? Declared<Id> : Id extends readonly (infer E)[] ? DeclaredOf<E> : never;
 /** What a plan of a change says will happen, as `PlanResponse.Action` names it. */
 export declare const PLAN_ACTIONS: readonly ["none", "create", "update", "replace", "delete"];
@@ -366,10 +389,34 @@ export declare function holderOf(value: unknown, path: string): {
     holder: State;
     key: string;
 } | undefined;
+/** What `withFrom` makes of a `from` field it cannot fill: `null` (known after apply), or nothing. */
+export type Missing = "unknown" | "drop";
+/** A `from` reference `withFrom` could not fill: the resource it names has no state, or nothing at its path. */
+export interface Unfilled {
+    at: string;
+    named: string;
+    from: string;
+    /** True when the resource has a state, with nothing at the path. */
+    stated: boolean;
+}
+/**
+ * `desired` with each field a `from` reference names given the state of the resource it names
+ * at that path (a copy), `stateOf` that resource (by what `refs` holds there, and the path read);
+ * and the references it could not fill, where that resource has no state or nothing there, each
+ * such field `null` (`unknown`, a value known after apply) or left out (`drop`), as `missing` says
+ * (for each reference, given a function). A reference with no place in `desired` to fill is
+ * unfilled too. `desired` itself when there is no such field.
+ */
+export declare function withFrom(references: References | undefined, desired: State, refs: Readonly<Record<string, string>>, stateOf: (named: string, from: string) => State | undefined, missing: Missing | ((named: string, from: string) => Missing)): {
+    desired: State;
+    unfilled: Unfilled[];
+};
 /** A field's dotted path as `fields` names it, without a list item's index: `teams.0` is `teams`. */
 export declare const fieldPathOf: (at: string) => string;
 /** The value at a dotted path, a list item's by its index. */
 export declare const valueAt: (value: unknown, path: string) => unknown;
+/** True when the two are the same JSON, where a missing value is `null`. */
+export declare function same(a: unknown, b: unknown): boolean;
 /**
  * `desired` without the values at the fields the type marks write-only (a webhook's `secret`):
  * what a run may record of a declaration. A list's items lose them too. A secret marker
@@ -403,6 +450,12 @@ export declare function withoutWriteOnly(fields: ResourceFields, desired: State)
  * - `update` takes `{ id, state?, handle?, desired, expect? }` and returns the same; given
  *   `expect` (a plan's `action` and `replace`), it refuses a fresh plan that differs
  *   (`DriverError`, `vendorCode` `plan_changed`).
+ *
+ * A type whose fields take a `from` reference (`FieldReference.from`) is given `null` there by
+ * apply's `plan` while the value is known only after apply, so its `plan` must accept `null` and
+ * report the path in `unknown`; and its `update` must treat a field left out of `desired` as
+ * keeping what the vendor holds, since a bound object whose `from` resource is gone is updated
+ * with that field left out.
  * - `delete` takes `{ id, state?, handle? }` and returns `{ id, gone: true }`.
  *
  * `desired` may hold secret markers at write-only fields, which the driver resolves; no output
@@ -415,8 +468,10 @@ export declare function withoutWriteOnly(fields: ResourceFields, desired: State)
  * schema does not have, fields the vendor owns (unless the identity names them), values the
  * schema rejects, and an empty identity. Where `fields.references` allows it, a field may name
  * another declared resource of that type (`repository_id: site`): `desired` holds, and the
- * schema and `find` read, that resource's `name`, and `refs` says where it was named. A type
- * without `find` declares resources without a `name`, found only by their bindings.
+ * schema and `find` read, that resource's `name`, and `refs` says where it was named. A `from`
+ * reference names one in place of the whole field, which apply and drift fill from its state, so
+ * the schema does not judge the name there. A type without `find` declares resources without a
+ * `name`, found only by their bindings.
  */
 export declare function defineResource<S extends z.ZodObject, const V extends string, const T extends string, const R extends References = {}, const W extends boolean = false>(spec: ResourceSpec<S> & {
     vendor: V;
@@ -426,6 +481,12 @@ export declare function defineResource<S extends z.ZodObject, const V extends st
     };
     writable?: W;
 }): Resource<S, `${V}.${T}`, R, W>;
+/**
+ * Throws where a `from` reference (`FieldReference.from`) names a path that a type it may name
+ * has no field at, among `types` (a config's): `dns_record` for `dns_records` would otherwise
+ * fail every create. A type not among them is left to the data files' check.
+ */
+export declare function checkFromRefs(types: ReadonlyMap<string, Resource>): void;
 /** Every resource type the connectors declare, by `<vendor>.<type>`. */
 export declare function resourceTypesOf(connectors: readonly Connector<any, any>[]): Map<string, Resource>;
 export {};