@sanoma-ai/workflows 0.4.2 → 0.5.0

package/src/policy.ts

@@ -1,5 +1,6 @@
 import { type ApprovalState, type Approver, type Principal, sameApprover } from "./define.ts";
 import type { Effect, Op } from "./op.ts";
+import { CALL_WORKFLOW, isVisitor } from "./shared.ts";
 
 /** An operation as a policy sees it: plain data, without its schemas. */
 export type PolicyOp = Pick<Op, "id" | "vendor" | "resource" | "name" | "effect">;
@@ -96,6 +97,8 @@ export interface PreviewRequest {
   principal: Principal;
   action: { id: string; effect?: Effect };
   resource?: string;
+  /** Asked of an operation inside a run the principal started, not of a direct call: a visitor's permit is at the start. */
+  inRun?: boolean;
 }
 
 /**
@@ -108,20 +111,36 @@ export interface PreviewAnswer {
   approver?: Approver;
 }
 
-/** A policy that decides every call and start as `decide` does, and previews each as `answer`. */
-const decidingAll = (decide: () => Decision, answer: "allow" | "deny"): Policy =>
-  Object.freeze(
+/** Why a visitor is refused what no policy permits it: the runtime's own permit leaves visitors out. */
+export const VISITOR_DENIED = "A visitor may do nothing until a policy permits it";
+
+/**
+ * Allows every operation call and run start but a visitor's (`isVisitor`): the policy of a repo
+ * with no `policies/**\/*.cedar`. A visitor is refused a start and a direct call (a call of the
+ * `call` workflow), as the runtime's permit refuses them, and allowed every call inside a run.
+ */
+export const allowAll: Policy = Object.freeze(
+  Object.assign(
+    (call: PolicyCall): Decision =>
+      isVisitor(call.actor) && call.run.workflow === CALL_WORKFLOW ? deny(VISITOR_DENIED) : allow(),
+    {
+      start: (actor: Principal): Decision => (isVisitor(actor) ? deny(VISITOR_DENIED) : allow()),
+      preview: (requests: readonly PreviewRequest[]): PreviewAnswer[] =>
+        requests.map(({ principal, inRun }) => ({ answer: isVisitor(principal) && !inRun ? "deny" : "allow" })),
+    },
+  ),
+);
+
+/** Refuses every operation call and run start, and previews each as a deny, saying `reason`. */
+export const denyAll = (reason: string): Policy => {
+  const decide = () => deny(reason);
+  return Object.freeze(
     Object.assign(decide, {
       start: decide,
-      preview: (requests: readonly PreviewRequest[]): PreviewAnswer[] => requests.map(() => ({ answer })),
+      preview: (requests: readonly PreviewRequest[]): PreviewAnswer[] => requests.map(() => ({ answer: "deny" })),
     }),
   );
-
-/** Allows every operation call and run start: the policy of a repo with no `policies/**\/*.cedar`. */
-export const allowAll: Policy = decidingAll(() => allow(), "allow");
-
-/** Refuses every operation call and run start, and previews each as a deny, saying `reason`. */
-export const denyAll = (reason: string): Policy => decidingAll(() => deny(reason), "deny");
+};
 
 /**
  * True when an approval in the run was approved, covers the operation, and was addressed to

package/src/resources.ts

@@ -19,12 +19,16 @@ import { Principal } from "./define.ts";
 import { NotAdmittedError } from "./errors.ts";
 import {
   AGENTS,
+  ANONYMOUS,
+  ANONYMOUS_PRINCIPAL,
   declaresPeople,
+  isVisitor,
   type PeopleResource,
   personOf,
   principalOf,
   problemLine,
   RUNTIME_AGENTS,
+  VISITORS,
 } from "./shared.ts";
 
 /** A resource a data file declares, as read from the file without running it. */
@@ -122,6 +126,13 @@ const filesStamp = (root: string) =>
     })
     .join("\n");
 
+/** The names no data file may give a group: what each is already. */
+const RESERVED_GROUPS: ReadonlyMap<string, string> = new Map([
+  [AGENTS, "the group every agent is in"],
+  [VISITORS, "the group every visitor is in"],
+  [ANONYMOUS, "who a public page runs as when nobody is signed in"],
+]);
+
 /**
  * The people, agents and groups the data files under `root` declare (`sanoma.person`, `.agent`,
  * `.group`), read without running them, as `principalOf` takes them, with what is wrong in their
@@ -140,22 +151,21 @@ export function readPeople(root: string | undefined): DeclaredPeople {
   const ids = new Map<string, DeclaredResource>();
   for (const r of people) {
     if (r.type === "group") {
-      if (r.name === AGENTS) {
-        own.push({
-          file: r.file,
-          message: `${r.id} is named "${AGENTS}", the group every agent is in: give it another name`,
-        });
-      }
+      const reserved = RESERVED_GROUPS.get(r.name);
+      if (reserved)
+        own.push({ file: r.file, message: `${r.id} is named "${r.name}", ${reserved}: give it another name` });
       continue;
     }
     const id = r.name;
     const other = ids.get(id);
-    if (other || RUNTIME_AGENTS.includes(id)) {
+    if (other || RUNTIME_AGENTS.includes(id) || isVisitor({ id })) {
       own.push({
         file: r.file,
         message: other
           ? `${r.id} has the id "${id}", which ${other.id} has: give each person and agent their own`
-          : `${r.id} has the id "${id}", one of the runtime's own agents': give it another`,
+          : isVisitor({ id })
+            ? `${r.id} has the id "${id}", a visitor's (\`anonymous\` or \`visitor:<login>:<subject>\`): give it another`
+            : `${r.id} has the id "${id}", one of the runtime's own agents': give it another`,
       });
     }
     ids.set(id, r);
@@ -169,8 +179,10 @@ export function readPeople(root: string | undefined): DeclaredPeople {
  * Who `asking` is admitted as, by the people the data files declare (`readPeople`): the declared
  * principal (`principalOf`) of the id it names, a person's or an agent's; for a sign-in
  * (`signIn`), of the person it matches (`personOf`: email, GitHub login, then id), never an agent.
- * While no person is declared, whoever names an id is taken as given. Throws `NotAdmittedError`
- * for anyone else, and for everyone while the people's files have problems.
+ * While no person is declared, whoever names an id is taken as given. A visitor's id (`isVisitor`)
+ * is taken whatever the files say, with the groups stamped here (`visitors`, or none for
+ * `anonymous`), never through a sign-in: the staff logins admit no visitor. Throws
+ * `NotAdmittedError` for anyone else, and for everyone while the people's files have problems.
  */
 export function admit(
   asking: { id?: string; email?: string; github?: string; groups?: string[]; onBehalfOf?: string },
@@ -178,6 +190,10 @@ export function admit(
   signIn = false,
 ): Principal {
   const who = asking.github ?? asking.id ?? asking.email ?? "This sign-in";
+  if (asking.id !== undefined && isVisitor({ id: asking.id })) {
+    if (signIn) throw new NotAdmittedError(who);
+    return asking.id === ANONYMOUS ? ANONYMOUS_PRINCIPAL : { id: asking.id, groups: [VISITORS] };
+  }
   if (problems.length) {
     // The runtime's own agents are declared by no file, so a broken one does not stop them (`check`'s scenarios).
     if (!signIn && asking.id !== undefined && RUNTIME_AGENTS.includes(asking.id)) {

package/src/scenario.ts

@@ -50,6 +50,7 @@ import {
   principalIdsOf,
   problemLine,
   RUNTIME_AGENTS,
+  visitorPrincipal,
 } from "./shared.ts";
 import type { Call, RunView, Seed } from "./steps.ts";
 
@@ -143,7 +144,7 @@ export interface Scenario {
   text: string;
   /** Every step in order, for a list and for marking graph nodes. */
   steps: ScenarioStep[];
-  /** Who starts the run, by id, when a `Given <who> is acting` says: a declared person or agent. */
+  /** Who starts the run, by id, when a `Given <who> is acting` says: a declared person or agent, `anonymous` or a visitor. */
   startedBy?: string;
   given: Given[];
   input: unknown;
@@ -404,7 +405,7 @@ function rulesOf(scope: Scope): { rules: Rule[]; parameterTypes: ParameterTypeSp
   const workflowOf = (name: unknown) => scope.workflows.get(name as string)!;
   // The people as the root's data files declare them when a step names one (`readPeople`, read
   // again only once a file changed): while they declare no one, any id and any group go.
-  /** `who`, as a run's start admits them (`admit`): a declared person or agent. */
+  /** `who`, as a run's start admits them (`admit`): a declared person or agent, or `anonymous`. */
   const actorNamed = (who: string) => {
     const declared = readPeople(scope.root);
     try {
@@ -434,6 +435,8 @@ function rulesOf(scope: Scope): { rules: Rule[]; parameterTypes: ParameterTypeSp
   };
   const rules: Rule[] = [
     { kind: "actor", source: "{who} is acting", read: ([who]) => actorNamed(who as string) },
+    // A visitor of a public site, as a login would vouch for one; `anonymous` is a `{who}`.
+    { kind: "actor", source: "a visitor is acting", read: () => visitorPrincipal("scenario", "visitor").id },
     {
       kind: "given",
       source: "{op} was called with",

package/src/schema.ts

@@ -67,7 +67,7 @@ const WRITES = new Set(["save", "delete"]);
 /**
  * The Cedar schema for a resolved config and its people, namespace `Sanoma`:
  *
- * - `entity Group enum [...]`, the declared groups and `agents`, so a policy naming another fails
+ * - `entity Group enum [...]`, the declared groups, `agents` and `visitors`, so a policy naming another fails
  *   validation; `entity Principal in [Group] { onBehalfOf?: Principal }`; `Collection`;
  *   `Target in [Collection]`; `Workflow`;
  * - an action per operation id, in its effect's group (`effect:money`), on a `Target`, with

package/src/shared.ts

@@ -55,6 +55,34 @@ export const WORKFLOW_ACTION = "workflow:";
 /** A site's folder name under `sites/`, its URL segment: what the app mounts and `readSites` reads. */
 export const SITE_NAME = /^[a-z][a-z0-9-]*$/;
 
+/** A public site's domain: a host name of two labels or more, lowercase (`sanoma.example`). */
+export const DOMAIN_NAME = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+
+/**
+ * The public sites' domains as a host hands them to the app in `SANOMA_DOMAINS` (`HostSpec`'s
+ * `domains`): `<site>=<hostname>`, comma-separated, by site name.
+ */
+export const domainsText = (domains: Readonly<Record<string, string>>): string =>
+  Object.keys(domains)
+    .toSorted()
+    .map((site) => `${site}=${domains[site]}`)
+    .join(",");
+
+/** The domains `domainsText` wrote, by site name; throws for a pair that is not `<site>=<hostname>`, or a site named twice. */
+export function domainsOf(text: string): Record<string, string> {
+  const domains: Record<string, string> = {};
+  for (const pair of text.split(",")) {
+    const [site = "", domain = "", ...rest] = pair.trim().split("=");
+    if (!SITE_NAME.test(site) || !DOMAIN_NAME.test(domain) || rest.length || Object.hasOwn(domains, site)) {
+      throw new Error(
+        `SANOMA_DOMAINS has "${pair}": write <site>=<hostname>, each site once, such as www=sanoma.example`,
+      );
+    }
+    domains[site] = domain;
+  }
+  return domains;
+}
+
 /**
  * A record of a collection as `get`, `list` and `save` answer it: its key, the record, and when
  * and by whom it was last saved (`updatedBy`: a person's id, or `run:<id>` for a run). A record
@@ -196,6 +224,7 @@ export function refusalOf(
   run: DecidedRun,
   people: readonly PeopleResource[],
 ): string | undefined {
+  if (isVisitor(by)) return "a visitor decides no approval";
   if (typeof approver === "string") {
     return approver === by.id ? undefined : `${by.id} is not the approver; ${approverLabel(approver)} is`;
   }
@@ -213,6 +242,34 @@ export type PeopleResource = Pick<DeclaredResource, "vendor" | "type" | "desired
 /** The group every agent is in, the runtime's own among them: no data file declares it. */
 export const AGENTS = "agents";
 
+/** The group every visitor of a public site is in: no data file declares it. */
+export const VISITORS = "visitors";
+
+/** The principal a public page runs as when nobody is signed in: no groups. */
+export const ANONYMOUS = "anonymous";
+
+/** `visitor:<login connector's vendor>:<provider subject>`: the only form a visitor's id takes. */
+const VISITOR_ID = /^visitor:[^\s:]+:\S+$/;
+
+/**
+ * True for `anonymous` and for a visitor's id: a principal no data file declares and the staff
+ * logins never admit. Marked by the id alone, since a principal crosses to the worker as JSON.
+ */
+export const isVisitor = (p: Pick<Principal, "id">): boolean => p.id === ANONYMOUS || VISITOR_ID.test(p.id);
+
+/**
+ * The visitor a public site's login vouches for: `subject` from the provider behind the `login`
+ * connector, in `visitors`. Throws for a login or subject that would make an id `isVisitor` does not tell.
+ */
+export function visitorPrincipal(login: string, subject: string): Principal {
+  const id = `visitor:${login}:${subject}`;
+  if (!VISITOR_ID.test(id)) throw new Error(`"${id}" is not a visitor's id: visitor:<login connector>:<subject>`);
+  return { id, groups: [VISITORS] };
+}
+
+/** Who a public page runs as when nobody is signed in. */
+export const ANONYMOUS_PRINCIPAL: Principal = Object.freeze({ id: ANONYMOUS, groups: [] });
+
 /** The runtime's own agents (scenarios, the host check, scheduled runs), declared whether a data file names them or not. */
 export const RUNTIME_AGENTS: readonly string[] = ["scenarios", "host-check", "schedule"];
 
@@ -224,9 +281,9 @@ type PersonFields = { id: string; name?: string; email?: string; github?: string
 type AgentFields = { id: string; onBehalfOf?: string };
 type GroupFields = { name: string; members: string[] };
 
-/** The groups a policy may name and a principal may be in: the declared ones and `agents`, sorted. */
+/** The groups a policy may name and a principal may be in: the declared ones, `agents` and `visitors`, sorted. */
 export const groupNamesOf = (resources: readonly PeopleResource[]): string[] =>
-  [...new Set([...peopleOfType<GroupFields>(resources, "group").map((g) => g.name), AGENTS])].toSorted();
+  [...new Set([...peopleOfType<GroupFields>(resources, "group").map((g) => g.name), AGENTS, VISITORS])].toSorted();
 
 /** The declared people (`sanoma.person`), in the order declared: not agents, who never sign in. */
 export const personsOf = (resources: readonly PeopleResource[]): PersonFields[] =>
@@ -261,9 +318,10 @@ export function principalOf(id: string, resources: readonly PeopleResource[]): P
 
 /**
  * Who `name` is as an approver: a declared group's name (or `agents`) as `{ group }`, else a
- * declared person's or agent's id; undefined when it is neither.
+ * declared person's or agent's id; undefined when it is neither, and for `visitors`, who decide nothing.
  */
 export function approverOf(name: string, resources: readonly PeopleResource[]): Approver | undefined {
+  if (name === VISITORS) return undefined;
   if (groupNamesOf(resources).includes(name)) return { group: name };
   return principalOf(name, resources) && name;
 }

package/src/sites.ts

@@ -1,11 +1,21 @@
 import { existsSync, readdirSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 import { childrenOf, type LintProblem, type Node, readSource, type SourceFile } from "./ast.ts";
+import { type CedarPolicySource, visitorPermits } from "./cedar.ts";
 import { keyName } from "./datafile.ts";
 import type { ConfigDescription } from "./describe.ts";
 import { stringValue, unwrap } from "./outline.ts";
 import { filesUnder, isDirectory } from "./paths.ts";
-import { apiNameOf, DATA_VENDOR, SITE_NAME } from "./shared.ts";
+import { START } from "./schema.ts";
+import {
+  ANONYMOUS,
+  apiNameOf,
+  BUILT_IN_WORKFLOWS,
+  DATA_VENDOR,
+  SITE_NAME,
+  VISITORS,
+  WORKFLOW_ACTION,
+} from "./shared.ts";
 
 // What a company's sites call, read from their source with oxc and never run: the reverse index
 // a workflow's page shows as Used by, and the names `sanoma check` holds to the config.
@@ -19,7 +29,13 @@ export interface SiteCall {
    * `api` gives; that name itself when none is), the collection's name, or the operation's id.
    */
   target: string;
-  /** `<RunForm workflow="…" />` from `@sanoma-ai/app/ui`, or a call on `api` from `sanoma/site`. */
+  /**
+   * What it calls of the workflow (`start`, or a read of its runs: `result`, `latest`, …) or the
+   * collection (`list`, `save`, …), as written; absent for a workflow called as itself or by
+   * `RunForm`, which starts it, and for an operation.
+   */
+  method?: string;
+  /** `<RunForm workflow="…" />` or a call on `api`, from `sanoma/site`. */
   via: "RunForm" | "api";
   /** The file, relative to the config's root, with `/`: `sites/sales/routes/index.tsx`. */
   file: string;
@@ -41,17 +57,26 @@ export interface SiteEntry {
   name: string;
   /** `defineSite({ title })` in its `site.ts`, when that is a string literal. */
   title?: string;
+  /** `defineSite({ public: true })`: served to visitors, not people. */
+  public?: true;
+  /** `defineSite({ login })`, the connector whose login half signs visitors in, as written: one that names none is among `problems`. */
+  login?: string;
+  /** The host a public site answers on: set by `startApp` from its `domains`, never by `readSites`. */
+  domain?: string;
   /** Its calls, by file and then in the file's order. */
   calls: SiteCall[];
-  /** Each call to a workflow, a collection or an operation the config does not have, or to an operation a page may not call directly, at its file. */
+  /**
+   * Each call to a workflow, a collection or an operation the config does not have, or to an
+   * operation a page may not call directly, or, on a public site, that no policy lets a visitor
+   * make, at its file; then what is wrong in its `site.ts`.
+   */
   problems: (LintProblem & { file: string })[];
 }
 
 /** Where a site's code is: its pages and its components. */
 const SITE_DIRS = ["routes", "components"];
-/** Where `api` and `defineSite` come from: `sanoma/site`, which re-exports the app's. */
+/** Where `api`, `RunForm` and `defineSite` come from: `sanoma/site`, which re-exports the app's. */
 const SITE_SOURCES: ReadonlySet<string> = new Set(["sanoma/site", "@sanoma-ai/app/site"]);
-const UI_SOURCES: ReadonlySet<string> = new Set(["@sanoma-ai/app/ui"]);
 const KIND_NAMES = { workflow: "workflow", collection: "collection", op: "operation" } as const;
 /** What makes a route from its id, whose first argument is the id. */
 const ROUTE_MAKERS: ReadonlySet<string> = new Set(["createFileRoute", "createLazyFileRoute"]);
@@ -60,17 +85,25 @@ const ROUTE_MAKERS: ReadonlySet<string> = new Set(["createFileRoute", "createLaz
  * The sites under `root`: each folder of `sites/` with a `routes/` whose name is a URL segment,
  * by name (as `@sanoma-ai/app/build`'s `sitesOf` mounts them). Reads `routes/**` and
  * `components/**` (`.ts` and `.tsx`, less tests and declarations) of each with oxc, never running
- * them: each `<RunForm workflow="…" />` whose `RunForm` is imported from `@sanoma-ai/app/ui`, and
- * each use of `api` imported from `sanoma/site`, called or passed on (`queryFn: api.data.leads.list`):
+ * them: each `<RunForm workflow="…" />` and each use of `api`, both imported from `sanoma/site`,
+ * called or passed on (`queryFn: api.data.leads.list`):
  * `api.<name>` and `api.<name>.<method>` are a workflow, `api.data.<collection>.<op>` a collection,
  * and `api.<vendor>.<resource>.<op>` an operation. A name that is not written out (a variable, a
  * template with holes, a computed member) is skipped, as is a use through a namespace import or a
  * destructured `api`. A call to what `description` does not have, or to an operation a page may
- * not call directly, is a problem.
+ * not call directly, is a problem. So is a `login` in `site.ts` that does not name one of
+ * `connectors.logins` (the vendors whose connector has a login half) on a public site. Given the
+ * company's `policies` (undefined while they have problems, which refuse every call), so is a
+ * public site's start or direct call that no company `permit` could let a visitor make
+ * (`visitorPermits`): one for `anonymous`, or on a site with a login, one for `anonymous` or the
+ * `visitors`, whatever its conditions. Whatever the policies, so is a public site's call of a
+ * built-in workflow, and its read of a workflow's runs but `.result`, which `callApi` refuses a visitor.
  */
 export function readSites(
   root: string | undefined,
   description: Pick<ConfigDescription, "workflows" | "collections" | "ops">,
+  connectors: SiteConnectors,
+  policies?: readonly CedarPolicySource[],
 ): SiteEntry[] {
   if (root === undefined) return [];
   const dir = join(root, "sites");
@@ -80,6 +113,40 @@ export function readSites(
   const ops = new Map(description.ops.map((op) => [op.id, op]));
   // A workflow's api name to its name: two of one api name are a problem on the workflows.
   const byApiName = new Map(description.workflows.map((wf) => [apiNameOf(wf.name), wf.name]));
+  const permits = policies && visitorPermits(policies);
+
+  /**
+   * Why a visitor's `call`, which exists, is certainly refused on a public site that has `login`:
+   * as `callApi` refuses it whatever the policy says, or as no permit could allow it.
+   */
+  const refused = (call: SiteCall, login: string | undefined): string | undefined => {
+    const why = `a visitor's call to ${KIND_NAMES[call.kind]} "${call.target}" is refused`;
+    let action: string;
+    let group: string;
+    if (call.kind === "workflow") {
+      if (BUILT_IN_WORKFLOWS.has(call.target)) return `${why}: a visitor may not start the runtime's own workflows`;
+      if (call.method === "result") return undefined;
+      if (call.method !== undefined && call.method !== "start") {
+        return `${why}: a visitor reads only the result of a run it started`;
+      }
+      [action, group] = [`${WORKFLOW_ACTION}${call.target}`, START];
+    } else {
+      action = call.kind === "op" ? call.target : `${DATA_VENDOR}.${call.target}.${call.method}`;
+      const op = ops.get(action);
+      if (!op) return undefined;
+      group = `effect:${op.effect}`;
+    }
+    if (!permits) return undefined;
+    const [scopes, principal] =
+      login === undefined
+        ? [[ANONYMOUS], `== Sanoma::Principal::"${ANONYMOUS}"`]
+        : [[ANONYMOUS, VISITORS], `in Sanoma::Group::"${VISITORS}"`];
+    if (permits(new Set(scopes), action, group)) return undefined;
+    return (
+      `${why}: no permit in policies/ names ${scopes.join(" or ")} for ${action}. ` +
+      `Add: permit (principal ${principal}, action == Sanoma::Action::"${action}", resource);`
+    );
+  };
 
   /** A call as written, resolved as the app's `callApi` resolves it, with why it would fail. */
   const resolve = ({ kind, name, via, ...at }: Written): { call: SiteCall; problem?: string } => {
@@ -110,12 +177,17 @@ export function readSites(
         const file = readSource(path);
         return typeof file === "string" ? [] : usesIn(file, relative(root, path).split(sep).join("/")).map(resolve);
       });
-      const title = titleOf(join(dir, name, "site.ts"));
+      const siteFile = `sites/${name}/site.ts`;
+      const { problems: optionProblems, ...options } = siteOptionsOf(join(root, siteFile), connectors);
       const calls = resolved.map((r) => r.call);
-      const problems = resolved.flatMap(({ call: { file, line, column }, problem }) =>
-        problem === undefined ? [] : [{ file, line, column, message: problem }],
-      );
-      return { name, ...(title !== undefined && { title }), calls, problems };
+      const problems = [
+        ...resolved.flatMap(({ call, problem }) => {
+          const message = problem ?? (options.public ? refused(call, options.login) : undefined);
+          return message === undefined ? [] : [{ file: call.file, line: call.line, column: call.column, message }];
+        }),
+        ...optionProblems.map((p) => ({ file: siteFile, ...p })),
+      ];
+      return { name, ...options, calls, problems };
     });
 }
 
@@ -125,7 +197,7 @@ type Written = Omit<SiteCall, "target"> & { name: string };
 /** The uses in one file, in its order. */
 function usesIn({ program, at }: SourceFile, file: string): Written[] {
   const api = importedAs(program, SITE_SOURCES, "api");
-  const runForm = importedAs(program, UI_SOURCES, "RunForm");
+  const runForm = importedAs(program, SITE_SOURCES, "RunForm");
   if (!api.size && !runForm.size) return [];
   const found: Omit<Written, "page">[] = [];
   let page: string | undefined;
@@ -156,7 +228,7 @@ function usesIn({ program, at }: SourceFile, file: string): Written[] {
 }
 
 /** What a member path on `api` names; undefined for a path on anything else, a name not written out, or no name. */
-function apiPath(member: Node, api: ReadonlySet<string>): Pick<Written, "kind" | "name"> | undefined {
+function apiPath(member: Node, api: ReadonlySet<string>): Pick<Written, "kind" | "name" | "method"> | undefined {
   const path: string[] = [];
   let node = member;
   while (node?.type === "MemberExpression") {
@@ -166,10 +238,12 @@ function apiPath(member: Node, api: ReadonlySet<string>): Pick<Written, "kind" |
     node = unwrap(node.object);
   }
   if (node?.type !== "Identifier" || !api.has(node.name)) return undefined;
-  const [first, second] = path as [string, ...string[]];
-  if (first === DATA_VENDOR) return path.length === 3 ? { kind: "collection", name: second! } : undefined;
+  const [first, second, third] = path as [string, ...string[]];
+  if (first === DATA_VENDOR)
+    return path.length === 3 ? { kind: "collection", name: second!, method: third } : undefined;
   if (path.length === 3) return { kind: "op", name: path.join(".") };
-  return path.length <= 2 ? { kind: "workflow", name: first } : undefined;
+  if (path.length > 2) return undefined;
+  return { kind: "workflow", name: first, ...(second !== undefined && { method: second }) };
 }
 
 /** The local names `imported` has in the file, imported as a value from one of `sources`. */
@@ -187,22 +261,80 @@ function importedAs(program: Node, sources: ReadonlySet<string>, imported: strin
   return names;
 }
 
-/** A site's title: the string `title` its `site.ts` exports by default through `defineSite`. */
-function titleOf(path: string): string | undefined {
+/** The connectors a site's `login` is checked against: the config's vendors, and those with a login half. */
+type SiteConnectors = { vendors: ReadonlySet<string>; logins: ReadonlySet<string> };
+
+/** A property of an object literal that is written out: not a spread, its name not computed. */
+const isWritten = (p: Node) => p.type === "Property" && !p.computed;
+
+/** What `site.ts` that `sanoma` cannot read without running it is told. */
+const unread = (what: string, as: string) => `${what} is read without running site.ts: write it as ${as}`;
+
+/**
+ * What `site.ts` says of its site, read without running it, and what is wrong there: its default
+ * export must be `defineSite({ … })` written out, so it can be read at all; then `title` when it is
+ * a string, `public` and `login`, which must be literals. `login` is kept as written; one on a
+ * site that is not public, or naming no connector of the config with a login half, is a problem.
+ */
+function siteOptionsOf(
+  path: string,
+  connectors: SiteConnectors,
+): Pick<SiteEntry, "title" | "public" | "login"> & { problems: LintProblem[] } {
   const file = readSource(path);
-  if (typeof file === "string") return undefined;
-  const defineSite = importedAs(file.program, SITE_SOURCES, "defineSite");
-  const exported = file.program.body.find((s: Node) => s.type === "ExportDefaultDeclaration")?.declaration;
-  const call = unwrap(exported);
+  if (typeof file === "string") return { problems: [] };
+  const problems: LintProblem[] = [...file.problems];
+  const problem = (at: Node, message: string) => void problems.push({ ...file.at(at.start), message });
+  const exported = file.program.body.find((s: Node) => s.type === "ExportDefaultDeclaration");
+  if (!exported) return { problems };
+  const call = unwrap(exported.declaration);
   const callee = unwrap(call?.callee);
   const options = unwrap(call?.arguments?.[0]);
-  if (call?.type !== "CallExpression" || callee?.type !== "Identifier" || !defineSite.has(callee.name))
+  const defineSite = importedAs(file.program, SITE_SOURCES, "defineSite");
+  // Anything not written out (a variable, a spread, a computed key) could make the site public unseen.
+  const written =
+    call?.type === "CallExpression" &&
+    callee?.type === "Identifier" &&
+    defineSite.has(callee.name) &&
+    (options === undefined || options.type === "ObjectExpression");
+  if (!written) {
+    problem(
+      exported,
+      unread("its default export", '`defineSite({ … })` from "sanoma/site", its options an object literal'),
+    );
+    return { problems };
+  }
+  for (const p of options?.properties ?? []) {
+    if (!isWritten(p)) problem(p, unread("each of `defineSite`'s options", "a property with its name"));
+  }
+  // The last of a name, as the object it makes has.
+  const property = (name: string): Node =>
+    options?.properties.findLast((p: Node) => isWritten(p) && keyName(p.key) === name);
+
+  const title = stringValue(property("title")?.value);
+  const publicAt = property("public");
+  const flag = unwrap(publicAt?.value);
+  const isPublic = flag?.type === "Literal" && flag.value === true;
+  const publicUnread = publicAt !== undefined && !(flag?.type === "Literal" && typeof flag.value === "boolean");
+  if (publicUnread) problem(publicAt, unread("`public`", "`true` or `false`"));
+
+  const loginAt = property("login");
+  const login = stringValue(loginAt?.value);
+  const loginProblem = (): string | undefined => {
+    if (login === undefined) return unread("`login`", "a string");
+    // When `public` is what is wrong, it is said there.
+    if (!isPublic && !publicUnread) return "a login is for a public site: add `public: true`, or remove `login`";
+    if (!connectors.vendors.has(login)) return `login names "${login}", which is not a connector in sanoma.config.ts`;
+    if (!connectors.logins.has(login)) return `login names "${login}", whose connector has no login half`;
     return undefined;
-  if (options?.type !== "ObjectExpression") return undefined;
-  const title = options.properties.find(
-    (p: Node) => p.type === "Property" && !p.computed && keyName(p.key) === "title",
-  );
-  return stringValue(title?.value);
+  };
+  const message = loginAt && loginProblem();
+  if (message) problem(loginAt, message);
+  return {
+    ...(title !== undefined && { title }),
+    ...(isPublic && { public: true as const }),
+    ...(login !== undefined && { login }),
+    problems,
+  };
 }
 
 /**

package/src/version.ts

@@ -5,8 +5,10 @@ import { dirname, join } from "node:path";
 import { jsonSchemaOf, opIdsOf, type WorkflowDefinition } from "./define.ts";
 import { upFrom } from "./paths.ts";
 
-/** This package's version. A unit test keeps it equal to package.json. */
-export const RUNTIME_VERSION = "0.4.2";
+/** This package's version, from its package.json: one level above `src/` and `dist/` alike. */
+export const RUNTIME_VERSION = (
+  JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { version: string }
+).version;
 
 /**
  * The sequence of DBOS calls the runtime makes around each `ctx` call: policy step, approval