@sanoma-ai/workflows 0.4.2 → 0.6.0

package/src/sites.ts

@@ -1,11 +1,22 @@
 import { existsSync, readdirSync } from "node:fs";
 import { join, relative, sep } from "node:path";
 import { childrenOf, type LintProblem, type Node, readSource, type SourceFile } from "./ast.ts";
+import { type CedarPolicySource, visitorPermits } from "./cedar.ts";
 import { keyName } from "./datafile.ts";
 import type { ConfigDescription } from "./describe.ts";
 import { stringValue, unwrap } from "./outline.ts";
 import { filesUnder, isDirectory } from "./paths.ts";
-import { apiNameOf, DATA_VENDOR, SITE_NAME } from "./shared.ts";
+import { START } from "./schema.ts";
+import {
+  ANONYMOUS,
+  apiNameOf,
+  BUILT_IN_WORKFLOWS,
+  DATA_VENDOR,
+  LOCALE,
+  SITE_NAME,
+  VISITORS,
+  WORKFLOW_ACTION,
+} from "./shared.ts";
 
 // What a company's sites call, read from their source with oxc and never run: the reverse index
 // a workflow's page shows as Used by, and the names `sanoma check` holds to the config.
@@ -19,7 +30,13 @@ export interface SiteCall {
    * `api` gives; that name itself when none is), the collection's name, or the operation's id.
    */
   target: string;
-  /** `<RunForm workflow="…" />` from `@sanoma-ai/app/ui`, or a call on `api` from `sanoma/site`. */
+  /**
+   * What it calls of the workflow (`start`, or a read of its runs: `result`, `latest`, …) or the
+   * collection (`list`, `save`, …), as written; absent for a workflow called as itself or by
+   * `RunForm`, which starts it, and for an operation.
+   */
+  method?: string;
+  /** `<RunForm workflow="…" />` or a call on `api`, from `sanoma/site`. */
   via: "RunForm" | "api";
   /** The file, relative to the config's root, with `/`: `sites/sales/routes/index.tsx`. */
   file: string;
@@ -35,24 +52,59 @@ export interface SiteCall {
   page?: string;
 }
 
+/** A page of a site: a route file's path, and for a page per content entry the kind it reads. */
+export interface SitePage {
+  /** As `SiteCall.page` has it: `/sites/www`, `/sites/www/blog/$slug`. */
+  path: string;
+  /**
+   * For a path with one parameter (`$slug`), the content kind whose entries are its pages: the one
+   * kind its file reads by that parameter, `content.<kind>.get(params.slug)` (or `slug`,
+   * destructured) with `content` from `sanoma/site`.
+   */
+  content?: string;
+}
+
 /** A site, `sites/<name>/`, and what it calls. */
 export interface SiteEntry {
   /** Its folder's name, where it is mounted: `/sites/<name>`. */
   name: string;
   /** `defineSite({ title })` in its `site.ts`, when that is a string literal. */
   title?: string;
+  /** `defineSite({ public: true })`: served to visitors, not people. */
+  public?: true;
+  /** `defineSite({ login })`, the connector whose login half signs visitors in, as written: one that names none is among `problems`. */
+  login?: string;
+  /**
+   * `defineSite({ locales })`, a public site's languages, the first its default: kept only when
+   * every one is a `LOCALE`, written once, on a public site with no login; else a problem.
+   */
+  locales?: string[];
+  /** The host a public site answers on: set by `startApp` from its `domains`, never by `readSites`. */
+  domain?: string;
+  /** Its pages, by path: one for each path its `routes/` files give (a layout and its index are one). */
+  pages: SitePage[];
   /** Its calls, by file and then in the file's order. */
   calls: SiteCall[];
-  /** Each call to a workflow, a collection or an operation the config does not have, or to an operation a page may not call directly, at its file. */
+  /**
+   * Each call to a workflow, a collection or an operation the config does not have, or to an
+   * operation a page may not call directly, or, on a public site, that no policy lets a visitor
+   * make, at its file; then what is wrong in its `site.ts`.
+   */
   problems: (LintProblem & { file: string })[];
+  /**
+   * On a public site, each page with one parameter whose file reads content the sitemap cannot
+   * tie to it (`SitePage.content`), so the sitemap lists none of its pages: at the first read.
+   */
+  warnings: (LintProblem & { file: string })[];
 }
 
 /** Where a site's code is: its pages and its components. */
 const SITE_DIRS = ["routes", "components"];
-/** Where `api` and `defineSite` come from: `sanoma/site`, which re-exports the app's. */
+/** Where `api`, `RunForm` and `defineSite` come from: `sanoma/site`, which re-exports the app's. */
 const SITE_SOURCES: ReadonlySet<string> = new Set(["sanoma/site", "@sanoma-ai/app/site"]);
-const UI_SOURCES: ReadonlySet<string> = new Set(["@sanoma-ai/app/ui"]);
 const KIND_NAMES = { workflow: "workflow", collection: "collection", op: "operation" } as const;
+/** What a route's loader and head name its path's parameters by. */
+const PARAMS: ReadonlySet<string> = new Set(["params"]);
 /** What makes a route from its id, whose first argument is the id. */
 const ROUTE_MAKERS: ReadonlySet<string> = new Set(["createFileRoute", "createLazyFileRoute"]);
 
@@ -60,26 +112,67 @@ const ROUTE_MAKERS: ReadonlySet<string> = new Set(["createFileRoute", "createLaz
  * The sites under `root`: each folder of `sites/` with a `routes/` whose name is a URL segment,
  * by name (as `@sanoma-ai/app/build`'s `sitesOf` mounts them). Reads `routes/**` and
  * `components/**` (`.ts` and `.tsx`, less tests and declarations) of each with oxc, never running
- * them: each `<RunForm workflow="…" />` whose `RunForm` is imported from `@sanoma-ai/app/ui`, and
- * each use of `api` imported from `sanoma/site`, called or passed on (`queryFn: api.data.leads.list`):
+ * them: each page (`SitePage`, from a route's id), each `<RunForm workflow="…" />` and each use of `api`, both imported from `sanoma/site`,
+ * called or passed on (`queryFn: api.data.leads.list`):
  * `api.<name>` and `api.<name>.<method>` are a workflow, `api.data.<collection>.<op>` a collection,
  * and `api.<vendor>.<resource>.<op>` an operation. A name that is not written out (a variable, a
  * template with holes, a computed member) is skipped, as is a use through a namespace import or a
  * destructured `api`. A call to what `description` does not have, or to an operation a page may
- * not call directly, is a problem.
+ * not call directly, is a problem. So is a `login` in `site.ts` that does not name one of
+ * `connectors.logins` (the vendors whose connector has a login half) on a public site. Given the
+ * company's `policies` (undefined while they have problems, which refuse every call), so is a
+ * public site's start or direct call that no company `permit` could let a visitor make
+ * (`visitorPermits`): one for `anonymous`, or on a site with a login, one for `anonymous` or the
+ * `visitors`, whatever its conditions. Whatever the policies, so is a public site's call of a
+ * built-in workflow, and its read of a workflow's runs but `.result`, which `callApi` refuses a visitor.
  */
 export function readSites(
   root: string | undefined,
   description: Pick<ConfigDescription, "workflows" | "collections" | "ops">,
+  connectors: SiteConnectors,
+  policies?: readonly CedarPolicySource[],
 ): SiteEntry[] {
   if (root === undefined) return [];
   const dir = join(root, "sites");
-  if (!isDirectory(dir)) return [];
   const workflows = new Set(description.workflows.map((wf) => wf.name));
   const collections = new Set(description.collections.map((c) => c.name));
   const ops = new Map(description.ops.map((op) => [op.id, op]));
   // A workflow's api name to its name: two of one api name are a problem on the workflows.
   const byApiName = new Map(description.workflows.map((wf) => [apiNameOf(wf.name), wf.name]));
+  const permits = policies && visitorPermits(policies);
+
+  /**
+   * Why a visitor's `call`, which exists, is certainly refused on a public site that has `login`:
+   * as `callApi` refuses it whatever the policy says, or as no permit could allow it.
+   */
+  const refused = (call: SiteCall, login: string | undefined): string | undefined => {
+    const why = `a visitor's call to ${KIND_NAMES[call.kind]} "${call.target}" is refused`;
+    let action: string;
+    let group: string;
+    if (call.kind === "workflow") {
+      if (BUILT_IN_WORKFLOWS.has(call.target)) return `${why}: a visitor may not start the runtime's own workflows`;
+      if (call.method === "result") return undefined;
+      if (call.method !== undefined && call.method !== "start") {
+        return `${why}: a visitor reads only the result of a run it started`;
+      }
+      [action, group] = [`${WORKFLOW_ACTION}${call.target}`, START];
+    } else {
+      action = call.kind === "op" ? call.target : `${DATA_VENDOR}.${call.target}.${call.method}`;
+      const op = ops.get(action);
+      if (!op) return undefined;
+      group = `effect:${op.effect}`;
+    }
+    if (!permits) return undefined;
+    const [scopes, principal] =
+      login === undefined
+        ? [[ANONYMOUS], `== Sanoma::Principal::"${ANONYMOUS}"`]
+        : [[ANONYMOUS, VISITORS], `in Sanoma::Group::"${VISITORS}"`];
+    if (permits(new Set(scopes), action, group)) return undefined;
+    return (
+      `${why}: no permit in policies/ names ${scopes.join(" or ")} for ${action}. ` +
+      `Add: permit (principal ${principal}, action == Sanoma::Action::"${action}", resource);`
+    );
+  };
 
   /** A call as written, resolved as the app's `callApi` resolves it, with why it would fail. */
   const resolve = ({ kind, name, via, ...at }: Written): { call: SiteCall; problem?: string } => {
@@ -100,34 +193,105 @@ export function readSites(
     return { call: { kind, target, via, ...at }, ...(problem && { problem }) };
   };
 
-  return readdirSync(dir, { withFileTypes: true })
-    .filter((d) => d.isDirectory() && SITE_NAME.test(d.name) && existsSync(join(dir, d.name, "routes")))
-    .map((d) => d.name)
+  return siteNames(dir).map((name) => {
+    const read = readSiteFiles(root, name);
+    const resolved = read.flatMap(({ uses }) => uses.map(resolve));
+    const pages = pagesOf(read);
+    const siteFile = `sites/${name}/site.ts`;
+    const { problems: optionProblems, ...options } = siteOptionsOf(join(root, siteFile), connectors);
+    const calls = resolved.map((r) => r.call);
+    const problems = [
+      ...resolved.flatMap(({ call, problem }) => {
+        const message = problem ?? (options.public ? refused(call, options.login) : undefined);
+        return message === undefined ? [] : [{ file: call.file, line: call.line, column: call.column, message }];
+      }),
+      ...optionProblems.map((p) => ({ file: siteFile, ...p })),
+    ];
+    const sorted = [...pages.keys()].toSorted().map((path) => pages.get(path)!);
+    // A page's file it warns of, unless another of its files (a lazy one, its layout) gives its kind.
+    const warnings = options.public
+      ? read.flatMap(({ route, warning }) => (warning && !pages.get(route!.path)?.content ? [warning] : []))
+      : [];
+    return { name, ...options, pages: sorted, calls, problems, warnings };
+  });
+}
+
+/** A site's pages, by path, from its files: a layout's and its index's (one path) merged. */
+function pagesOf(read: readonly { route?: SitePage }[]): Map<string, SitePage> {
+  const pages = new Map<string, SitePage>();
+  for (const { route } of read) {
+    if (route) pages.set(route.path, { ...pages.get(route.path), ...route });
+  }
+  return pages;
+}
+
+/** Each of site `name`'s files under `root`, as `readSiteFile` reads it, by path. */
+const readSiteFiles = (root: string, name: string) =>
+  SITE_DIRS.flatMap((sub) => filesUnder(join(root, "sites", name, sub), isSource))
     .toSorted()
-    .map((name) => {
-      const files = SITE_DIRS.flatMap((sub) => filesUnder(join(dir, name, sub), isSource)).toSorted();
-      const resolved = files.flatMap((path) => {
-        const file = readSource(path);
-        return typeof file === "string" ? [] : usesIn(file, relative(root, path).split(sep).join("/")).map(resolve);
-      });
-      const title = titleOf(join(dir, name, "site.ts"));
-      const calls = resolved.map((r) => r.call);
-      const problems = resolved.flatMap(({ call: { file, line, column }, problem }) =>
-        problem === undefined ? [] : [{ file, line, column, message: problem }],
-      );
-      return { name, ...(title !== undefined && { title }), calls, problems };
+    .flatMap((path) => {
+      const file = readSource(path);
+      return typeof file === "string" ? [] : [readSiteFile(file, relative(root, path).split(sep).join("/"))];
     });
+
+/**
+ * Each site's pages under `root` whose entries are a content kind's (`SitePage.content`), path to
+ * kind: what the app's build gives its router (`virtual:sanoma/locales`), so a page lists only the
+ * languages its entry is in. Read as `readSites` reads them, never run.
+ */
+export function siteContentPages(root: string): Record<string, string> {
+  return Object.fromEntries(
+    siteNames(join(root, "sites")).flatMap((name) =>
+      [...pagesOf(readSiteFiles(root, name)).values()].flatMap(({ path, content }) =>
+        content ? [[path, content]] : [],
+      ),
+    ),
+  );
 }
 
+/**
+ * Each site's languages (`defineSite({ locales })`, the first its default) under `root`, by name,
+ * for the sites whose `site.ts` gives them without a problem there: what the app's build gives
+ * its router (`virtual:sanoma/locales`). Read as `readSites` reads them, never run.
+ */
+export function siteLocales(root: string): Record<string, string[]> {
+  const none = new Set<string>();
+  return Object.fromEntries(
+    siteNames(join(root, "sites")).flatMap((name) => {
+      const { locales } = siteOptionsOf(join(root, "sites", name, "site.ts"), { vendors: none, logins: none });
+      return locales ? [[name, locales]] : [];
+    }),
+  );
+}
+
+/** The sites in `dir`: each folder with a `routes/` whose name is a URL segment, sorted. */
+const siteNames = (dir: string): string[] =>
+  isDirectory(dir)
+    ? readdirSync(dir, { withFileTypes: true })
+        .filter((d) => d.isDirectory() && SITE_NAME.test(d.name) && existsSync(join(dir, d.name, "routes")))
+        .map((d) => d.name)
+        .toSorted()
+    : [];
+
 /** A use of `api` or a `RunForm`, as written: the name it gives, before it is resolved. */
 type Written = Omit<SiteCall, "target"> & { name: string };
 
-/** The uses in one file, in its order. */
-function usesIn({ program, at }: SourceFile, file: string): Written[] {
+/**
+ * What one file holds: its uses, in its order, and the page it is, from its route's id, with the
+ * content kind whose entry its one parameter names (`SitePage.content`). A file under `routes/` is
+ * read whole; any other only when it imports `api` or `RunForm`.
+ */
+function readSiteFile(
+  { program, at }: SourceFile,
+  file: string,
+): { uses: Written[]; route?: SitePage; warning?: LintProblem & { file: string } } {
   const api = importedAs(program, SITE_SOURCES, "api");
-  const runForm = importedAs(program, UI_SOURCES, "RunForm");
-  if (!api.size && !runForm.size) return [];
+  const runForm = importedAs(program, SITE_SOURCES, "RunForm");
+  const content = importedAs(program, SITE_SOURCES, "content");
+  if (!api.size && !runForm.size && !file.includes("/routes/")) return { uses: [] };
   const found: Omit<Written, "page">[] = [];
+  /** Each `content.<kind>.get(arg)`: its kind, its argument and where it is. */
+  const gets: { kind: string; arg: Node; start: number }[] = [];
   let page: string | undefined;
   const visit = (node: Node) => {
     if (!node) return;
@@ -135,12 +299,14 @@ function usesIn({ program, at }: SourceFile, file: string): Written[] {
       const named = apiPath(node, api);
       // The outermost member of a path on `api`: what it names, called or not; its inner members are not visited.
       if (named) return void found.push({ ...named, via: "api", file, ...at(node.start) });
-    } else if (node.type === "CallExpression" && page === undefined) {
+    } else if (node.type === "CallExpression") {
       const callee = unwrap(node.callee);
-      if (callee?.type === "Identifier" && ROUTE_MAKERS.has(callee.name)) {
+      if (callee?.type === "Identifier" && ROUTE_MAKERS.has(callee.name) && page === undefined) {
         const id = stringValue(node.arguments[0]);
         if (id !== undefined) page = pageOf(id);
       }
+      const kind = contentKind(callee, content);
+      if (kind !== undefined) gets.push({ kind, arg: unwrap(node.arguments[0]), start: node.start });
     } else if (node.type === "JSXOpeningElement" && node.name.type === "JSXIdentifier" && runForm.has(node.name.name)) {
       const attribute = node.attributes.find(
         (a: Node) => a.type === "JSXAttribute" && a.name.type === "JSXIdentifier" && a.name.name === "workflow",
@@ -152,11 +318,46 @@ function usesIn({ program, at }: SourceFile, file: string): Written[] {
     for (const child of childrenOf(node)) visit(child);
   };
   visit(program);
-  return found.map((use) => (page === undefined ? use : { ...use, page }));
+  const uses = found.map((use) => (page === undefined ? use : { ...use, page }));
+  if (page === undefined) return { uses };
+  // The one parameter's name (not a splat's), and the kinds whose `get` is given it (`params.slug`, or `slug` destructured).
+  const params = page.split("/").filter((segment) => segment.startsWith("$"));
+  if (params.length !== 1 || params[0] === "$") return { uses, route: { path: page } };
+  const param = params[0]!.slice(1);
+  const kinds = new Set(
+    gets
+      .filter(({ arg }) =>
+        arg?.type === "Identifier"
+          ? arg.name === param
+          : arg?.type === "MemberExpression" && memberPath(arg, PARAMS)?.join(".") === param,
+      )
+      .map(({ kind }) => kind),
+  );
+  if (kinds.size === 1) return { uses, route: { path: page, content: [...kinds][0]! } };
+  // A read by the parameter in a form the sitemap does not follow (`params.id.toLowerCase()`, two kinds).
+  const unfollowed = gets.find(({ arg }) => mentions(arg, param));
+  if (!unfollowed) return { uses, route: { path: page } };
+  const message =
+    `the sitemap lists none of this page's entries: it reads content by the page's parameter in a way it cannot follow. ` +
+    `Read one kind by it as written, \`content.<kind>.get(params.${param})\` (or \`${param}\` destructured)`;
+  return { uses, route: { path: page }, warning: { file, ...at(unfollowed.start), message } };
 }
 
-/** What a member path on `api` names; undefined for a path on anything else, a name not written out, or no name. */
-function apiPath(member: Node, api: ReadonlySet<string>): Pick<Written, "kind" | "name"> | undefined {
+/** Whether `node` reads the parameter `param` anywhere in it: `params.<param>`, or `param` destructured (not another parameter, nor a property's name, `post.slug` or `{ slug: x }`). */
+const mentions = (node: Node, param: string): boolean => {
+  if (!node) return false;
+  if (node.type === "Identifier") return node.name === param;
+  if (node.type === "Property" && !node.computed) return mentions(node.value, param);
+  if (node.type === "MemberExpression") {
+    const path = memberPath(node, PARAMS);
+    if (path) return path[0] === param;
+    if (!node.computed) return mentions(node.object, param);
+  }
+  return childrenOf(node).some((child) => mentions(child, param));
+};
+
+/** The names of a member path on one of `roots` (`api.data.leads.list` is `data`, `leads`, `list`); undefined for a path on anything else or a name not written out. */
+function memberPath(member: Node, roots: ReadonlySet<string>): string[] | undefined {
   const path: string[] = [];
   let node = member;
   while (node?.type === "MemberExpression") {
@@ -165,11 +366,25 @@ function apiPath(member: Node, api: ReadonlySet<string>): Pick<Written, "kind" |
     path.unshift(key);
     node = unwrap(node.object);
   }
-  if (node?.type !== "Identifier" || !api.has(node.name)) return undefined;
-  const [first, second] = path as [string, ...string[]];
-  if (first === DATA_VENDOR) return path.length === 3 ? { kind: "collection", name: second! } : undefined;
+  return node?.type === "Identifier" && roots.has(node.name) ? path : undefined;
+}
+
+/** The kind of `content.<kind>.get`, a callee on `content` imported from `sanoma/site`; undefined for any other. */
+function contentKind(callee: Node, content: ReadonlySet<string>): string | undefined {
+  const path = callee?.type === "MemberExpression" ? memberPath(callee, content) : undefined;
+  return path?.length === 2 && path[1] === "get" ? path[0] : undefined;
+}
+
+/** What a member path on `api` names; undefined for a path on anything else, a name not written out, or no name. */
+function apiPath(member: Node, api: ReadonlySet<string>): Pick<Written, "kind" | "name" | "method"> | undefined {
+  const path = memberPath(member, api);
+  if (!path?.length) return undefined;
+  const [first, second, third] = path as [string, ...string[]];
+  if (first === DATA_VENDOR)
+    return path.length === 3 ? { kind: "collection", name: second!, method: third } : undefined;
   if (path.length === 3) return { kind: "op", name: path.join(".") };
-  return path.length <= 2 ? { kind: "workflow", name: first } : undefined;
+  if (path.length > 2) return undefined;
+  return { kind: "workflow", name: first, ...(second !== undefined && { method: second }) };
 }
 
 /** The local names `imported` has in the file, imported as a value from one of `sources`. */
@@ -187,22 +402,104 @@ function importedAs(program: Node, sources: ReadonlySet<string>, imported: strin
   return names;
 }
 
-/** A site's title: the string `title` its `site.ts` exports by default through `defineSite`. */
-function titleOf(path: string): string | undefined {
+/** The connectors a site's `login` is checked against: the config's vendors, and those with a login half. */
+type SiteConnectors = { vendors: ReadonlySet<string>; logins: ReadonlySet<string> };
+
+/** A property of an object literal that is written out: not a spread, its name not computed. */
+const isWritten = (p: Node) => p.type === "Property" && !p.computed;
+
+/** What `site.ts` that `sanoma` cannot read without running it is told. */
+const unread = (what: string, as: string) => `${what} is read without running site.ts: write it as ${as}`;
+
+/**
+ * What `site.ts` says of its site, read without running it, and what is wrong there: its default
+ * export must be `defineSite({ … })` written out, so it can be read at all; then `title` when it is
+ * a string, `public`, `login` and `locales`, which must be literals. `login` is kept as written; one on a
+ * site that is not public, or naming no connector of the config with a login half, is a problem.
+ * `locales` is kept only when it has no problem.
+ */
+function siteOptionsOf(
+  path: string,
+  connectors: SiteConnectors,
+): Pick<SiteEntry, "title" | "public" | "login" | "locales"> & { problems: LintProblem[] } {
   const file = readSource(path);
-  if (typeof file === "string") return undefined;
-  const defineSite = importedAs(file.program, SITE_SOURCES, "defineSite");
-  const exported = file.program.body.find((s: Node) => s.type === "ExportDefaultDeclaration")?.declaration;
-  const call = unwrap(exported);
+  if (typeof file === "string") return { problems: [] };
+  const problems: LintProblem[] = [...file.problems];
+  const problem = (at: Node, message: string) => void problems.push({ ...file.at(at.start), message });
+  const exported = file.program.body.find((s: Node) => s.type === "ExportDefaultDeclaration");
+  if (!exported) return { problems };
+  const call = unwrap(exported.declaration);
   const callee = unwrap(call?.callee);
   const options = unwrap(call?.arguments?.[0]);
-  if (call?.type !== "CallExpression" || callee?.type !== "Identifier" || !defineSite.has(callee.name))
+  const defineSite = importedAs(file.program, SITE_SOURCES, "defineSite");
+  // Anything not written out (a variable, a spread, a computed key) could make the site public unseen.
+  const written =
+    call?.type === "CallExpression" &&
+    callee?.type === "Identifier" &&
+    defineSite.has(callee.name) &&
+    (options === undefined || options.type === "ObjectExpression");
+  if (!written) {
+    problem(
+      exported,
+      unread("its default export", '`defineSite({ … })` from "sanoma/site", its options an object literal'),
+    );
+    return { problems };
+  }
+  for (const p of options?.properties ?? []) {
+    if (!isWritten(p)) problem(p, unread("each of `defineSite`'s options", "a property with its name"));
+  }
+  // The last of a name, as the object it makes has.
+  const property = (name: string): Node =>
+    options?.properties.findLast((p: Node) => isWritten(p) && keyName(p.key) === name);
+
+  const title = stringValue(property("title")?.value);
+  const publicAt = property("public");
+  const flag = unwrap(publicAt?.value);
+  const isPublic = flag?.type === "Literal" && flag.value === true;
+  const publicUnread = publicAt !== undefined && !(flag?.type === "Literal" && typeof flag.value === "boolean");
+  if (publicUnread) problem(publicAt, unread("`public`", "`true` or `false`"));
+
+  const loginAt = property("login");
+  const login = stringValue(loginAt?.value);
+  const loginProblem = (): string | undefined => {
+    if (login === undefined) return unread("`login`", "a string");
+    // When `public` is what is wrong, it is said there.
+    if (!isPublic && !publicUnread) return "a login is for a public site: add `public: true`, or remove `login`";
+    if (!connectors.vendors.has(login)) return `login names "${login}", which is not a connector in sanoma.config.ts`;
+    if (!connectors.logins.has(login)) return `login names "${login}", whose connector has no login half`;
     return undefined;
-  if (options?.type !== "ObjectExpression") return undefined;
-  const title = options.properties.find(
-    (p: Node) => p.type === "Property" && !p.computed && keyName(p.key) === "title",
-  );
-  return stringValue(title?.value);
+  };
+  const message = loginAt && loginProblem();
+  if (message) problem(loginAt, message);
+
+  const localesAt = property("locales");
+  const list = unwrap(localesAt?.value);
+  // A hole or a spread is no string.
+  const tags: (string | undefined)[] | undefined =
+    list?.type === "ArrayExpression" ? list.elements.map((e: Node) => stringValue(e)) : undefined;
+  const locales = tags?.every((tag): tag is string => tag !== undefined) ? tags : undefined;
+  const localesProblem = (): string | undefined => {
+    if (locales === undefined) return unread("`locales`", "an array of strings");
+    if (!locales.length) return "`locales` names a site's languages, its default first: give one or more, or remove it";
+    const bad = locales.find((locale) => !LOCALE.test(locale));
+    if (bad !== undefined) return `"${bad}" is not a language tag such as "en", "fr" or "pt-BR"`;
+    const twice = locales.find((locale, i) => locales.indexOf(locale) !== i);
+    if (twice !== undefined) return `"${twice}" is in \`locales\` twice`;
+    // When `public` is what is wrong, it is said there.
+    if ((!isPublic && !publicUnread) || loginAt) {
+      return "`locales` are for a public site with no login: add `public: true`, or remove `locales`";
+    }
+    return undefined;
+  };
+  const localesMessage = localesAt && localesProblem();
+  if (localesMessage) problem(localesAt, localesMessage);
+  return {
+    ...(title !== undefined && { title }),
+    ...(isPublic && { public: true as const }),
+    ...(login !== undefined && { login }),
+    ...(localesAt && !localesMessage && isPublic && !loginAt && { locales }),
+    problems,
+  };
 }
 
 /**

package/src/version.ts

@@ -5,8 +5,10 @@ import { dirname, join } from "node:path";
 import { jsonSchemaOf, opIdsOf, type WorkflowDefinition } from "./define.ts";
 import { upFrom } from "./paths.ts";
 
-/** This package's version. A unit test keeps it equal to package.json. */
-export const RUNTIME_VERSION = "0.4.2";
+/** This package's version, from its package.json: one level above `src/` and `dist/` alike. */
+export const RUNTIME_VERSION = (
+  JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")) as { version: string }
+).version;
 
 /**
  * The sequence of DBOS calls the runtime makes around each `ctx` call: policy step, approval