@toa.io/extensions.exposition 1.0.0-alpha.30 → 1.0.0-alpha.301

package/components/identity.grants/source/exchange.ts

@@ -0,0 +1,134 @@
+import { identify, spend, verifies } from './lib/index.ts'
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Code, Context } from './lib/index.ts'
+
+/**
+ * The token endpoint, RFC 6749 §4.1.3. Anonymous, because the clients this server knows are
+ * public ones with no secret to authenticate with: what stands in for that is PKCE, since
+ * only the client that began the flow holds the verifier the challenge was made from.
+ *
+ * Every failure here is `invalid_grant` without saying which check failed. A code that was
+ * replayed, a verifier that does not match and a redirect that was swapped are all the same
+ * answer, and telling them apart would say whether a stolen code was still live.
+ */
+export class Effect implements Operation {
+  private context!: Context
+
+  public mount(context: Context): void {
+    this.context = context
+  }
+
+  public async execute(input: Input): Promise<Maybe<Output>> {
+    const { authority } = input
+
+    if (input.grant_type !== AUTHORIZATION_CODE)
+      return invalid(
+        'unsupported_grant_type',
+        'Only the authorization code grant is supported'
+      )
+
+    if (input.code === undefined || input.code_verifier === undefined)
+      return invalid('invalid_request', 'A code and a code verifier are required')
+
+    // spent first: a wrong verifier burns the code, which is what stops it being guessed at
+    const code = await spend(authority, input.code, this.context)
+
+    if (code === null || !this.redeemable(code, input))
+      return invalid('invalid_grant', 'The authorization code is not redeemable')
+
+    // `aud` binds the token to `code.resource` — the entry it may be presented at,
+    // which `preflight` reads. A fork MCP or RPC makes is not that entry.
+    const issued = await this.context.remote.identity.tokens.issue({
+      input: {
+        authority,
+        identity: code.identity,
+        label: label(code.client),
+        lifetime: this.context.configuration.token,
+        ...(code.scope.length === 0 ? {} : { scopes: code.scope }),
+        ...(code.resource.length === 0 ? {} : { audience: code.resource })
+      }
+    })
+
+    // the only refusal `issue` makes is a scope the consenting identity does not hold, and
+    // what it says about that is its own; the client is told what it may act on
+    if (issued instanceof Error)
+      return invalid('invalid_scope', 'The requested scope is not one the identity holds')
+
+    // the key the token was issued under, so revoking the grant revokes the token. The token
+    // is already out, so a grant that fails to record it is logged rather than unwound — it
+    // costs the user the ability to revoke, and refusing here would cost them the token too
+    const grant = await this.context.local.transit({
+      query: { id: identify(authority, code.identity, code.client) },
+      input: {
+        authority,
+        identity: code.identity,
+        client: code.client,
+        scope: code.scope,
+        resource: code.resource,
+        kid: issued.kid
+      }
+    })
+
+    if (grant instanceof Error)
+      this.context.logs.error('Grant not recorded for an issued token', {
+        client: code.client,
+        kid: issued.kid
+      })
+
+    return {
+      // RFC 6749 §5.1 asks for 200, where a POST would otherwise answer 201
+      status: OK,
+      access_token: issued.token,
+      token_type: 'Bearer',
+      ...(issued.exp === undefined
+        ? {}
+        : { expires_in: Math.floor((issued.exp - Date.now()) / 1000) }),
+      ...(code.scope.length === 0 ? {} : { scope: code.scope.join(' ') })
+    }
+  }
+
+  private redeemable(code: Code, input: Input): boolean {
+    if (!verifies(code.challenge, input.code_verifier!)) return false
+
+    // RFC 6749 §4.1.3: what was sent to `authorize` must be sent again
+    if (input.redirect_uri !== undefined && input.redirect_uri !== code.redirect)
+      return false
+
+    return input.client_id === undefined || input.client_id === code.client
+  }
+}
+
+/** `identity.tokens` requires one, and it is what a user sees when listing what they issued. */
+function label(client: string): string {
+  return client.slice(0, LABEL)
+}
+
+function invalid(error: string, description: string): Output {
+  return { status: BAD_REQUEST, error, error_description: description }
+}
+
+const AUTHORIZATION_CODE = 'authorization_code'
+const OK = 200
+const BAD_REQUEST = 400
+const LABEL = 64
+
+interface Input {
+  authority: string
+  grant_type: string
+  code?: string
+  code_verifier?: string
+  redirect_uri?: string
+  client_id?: string
+  resource?: string | string[]
+}
+
+interface Output {
+  status?: number
+  access_token?: string
+  token_type?: string
+  expires_in?: number
+  scope?: string
+  error?: string
+  error_description?: string
+}

package/components/identity.grants/source/lib/code.ts

@@ -0,0 +1,51 @@
+import { createHash, randomBytes } from 'node:crypto'
+import type { Code, Context } from '../../types/index.d.ts'
+
+/**
+ * An authorization code is a bearer credential that lives for seconds. It is held under a
+ * hash of itself, so a dump of the store hands out none of them, and redeemed with `GETDEL`,
+ * so it is spent once however many requests arrive at once — the property the whole flow
+ * rests on, since a replayed code is a stolen grant.
+ */
+export async function hold(
+  authority: string,
+  code: Code,
+  context: Context
+): Promise<string> {
+  const value = randomBytes(32).toString('base64url')
+
+  await context.stash.set(
+    key(authority, value),
+    JSON.stringify(code),
+    'EX',
+    context.configuration.lifetime
+  )
+
+  return value
+}
+
+export async function spend(
+  authority: string,
+  value: string,
+  context: Context
+): Promise<Code | null> {
+  const held = await context.stash.getdel(key(authority, value))
+
+  return held === null ? null : (JSON.parse(held) as Code)
+}
+
+/**
+ * PKCE, RFC 7636: the client kept a verifier and sent its hash, and only the client that
+ * began the flow can present the verifier now. `S256` alone — `plain` proves nothing.
+ */
+export function verifies(challenge: string, verifier: string): boolean {
+  return digest(verifier) === challenge
+}
+
+export function digest(verifier: string): string {
+  return createHash('sha256').update(verifier).digest('base64url')
+}
+
+function key(authority: string, value: string): string {
+  return `oauth:code:${authority}:${createHash('sha256').update(value).digest('hex')}`
+}

package/components/identity.grants/source/lib/identify.ts

@@ -0,0 +1,16 @@
+import { createHash } from 'node:crypto'
+
+/**
+ * A user holds one grant per client, so the record is addressed by the three things that
+ * say which: authorizing again replaces what is there rather than leaving another row, and
+ * revoking has one thing to revoke.
+ */
+export function identify(authority: string, identity: string, client: string): string {
+  return createHash('sha256')
+    .update(JSON.stringify([authority, identity, client]))
+    .digest('hex')
+    .slice(0, LENGTH)
+}
+
+/** What the entity prototype accepts as an id. */
+const LENGTH = 32

package/components/identity.grants/source/lib/index.ts

@@ -0,0 +1,3 @@
+export * from './code.ts'
+export * from './identify.ts'
+export type * from '../../types/index.d.ts'

package/components/identity.grants/source/list.ts

@@ -0,0 +1,28 @@
+import { quote } from '@toa.io/generic'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context, Entity } from './lib/index.ts'
+
+/** What a user has allowed, for a screen that lets them take it back. */
+export class Computation implements Operation {
+  private enumerate!: Context['local']['enumerate']
+
+  public mount(context: Context): void {
+    this.enumerate = context.local.enumerate
+  }
+
+  public async execute(input: Input): Promise<Entity[]> {
+    return await this.enumerate({
+      query: {
+        criteria: `authority==${quote(input.authority)};identity==${quote(input.identity)}`,
+        limit: LIMIT
+      }
+    })
+  }
+}
+
+const LIMIT = 256
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.grants/source/revoke.ts

@@ -0,0 +1,40 @@
+import type { Maybe } from '@toa.io/core/types'
+import type { Operation } from '@toa.io/bridges.node'
+import type { Context, Entity } from './lib/index.ts'
+
+/**
+ * Taking back what was allowed. The token itself is not deleted — it is out in the world —
+ * so what is revoked is the key it was issued under, which is what `identity.tokens` reads
+ * it with. It stops being a token within `identity.tokens.cache.ttl`.
+ */
+export class Transition implements Operation {
+  private keys!: Context['remote']['identity']['keys']
+
+  public mount(context: Context): void {
+    this.keys = context.remote.identity.keys
+  }
+
+  public async execute(input: Input, object: Entity): Promise<Maybe<void>> {
+    // the id is a route parameter, so a grant of another identity is asked for by anyone
+    // who guesses one; the authority and the identity are what say it is theirs
+    if (
+      object.VERSION === 0 ||
+      object.authority !== input.authority ||
+      object.identity !== input.identity
+    )
+      return ERR_NOT_FOUND
+
+    if (object.kid !== undefined) await this.keys.disable({ query: { id: object.kid } })
+
+    object.revokedAt = Date.now()
+  }
+}
+
+const ERR_NOT_FOUND = new (class NotFoundError extends Error {
+  public readonly code = 'NOT_FOUND'
+})()
+
+interface Input {
+  authority: string
+  identity: string
+}

package/components/identity.grants/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.grants/types/index.d.ts

@@ -0,0 +1,60 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.
+
+import type { Query } from '@toa.io/core/types'
+export type { Query } from '@toa.io/core/types'
+import type { Logs } from '@toa.io/extensions.telemetry'
+import type { Stash } from '@toa.io/extensions.stash'
+import type { Component, Configuration } from './toa.d.ts'
+
+/** A client as `identity.clients` describes it. */
+export interface Client {
+  client_id: string
+  client_name?: string
+  redirect_uris: string[]
+  permitted?: boolean
+}
+
+/** What is held against an authorization code until it is redeemed. */
+export interface Code {
+  identity: string
+  client: string
+  redirect: string
+  challenge: string
+  scope: string[]
+  resource: string[]
+}
+
+/** What this component is given: its own operations, and the three it grants through. */
+export interface Context {
+  stash: Stash
+  logs: Logs
+  local: Component
+  remote: {
+    identity: {
+      clients: {
+        describe: (request: {
+          input: { authority: string; id: string; redirect?: string }
+        }) => Promise<Client>
+      }
+      tokens: {
+        issue: (request: {
+          input: {
+            authority: string
+            identity: string
+            label: string
+            lifetime?: number
+            scopes?: string[]
+            audience?: string[]
+            permissions?: Record<string, string[]>
+          }
+        }) => Promise<{ kid: string; exp?: number; token: string }>
+      }
+      keys: {
+        disable: (request: { query: Query }) => Promise<null>
+      }
+    }
+  }
+  configuration: Configuration
+}

package/components/identity.grants/types/toa.d.ts

@@ -0,0 +1,109 @@
+// Written by `toa types`. Every run rewrites it.
+// What a manifest does not state belongs in a file of your own.
+
+import type { Options, Query, RemoteError } from '@toa.io/core/types'
+import type { FetchInit } from '@toa.io/extensions.fetch'
+import type { Stash } from '@toa.io/extensions.stash'
+import type { Logs, Span } from '@toa.io/extensions.telemetry'
+import type { Readable } from 'node:stream'
+
+export interface Entity {
+  authority: string
+  identity: string
+  client: string
+  scope?: string[]
+  resource?: string[]
+  /** The identity.keys record backing the access token, revoked with the grant */
+  kid?: string
+  revokedAt?: number
+  id: string
+  VERSION: number
+  CREATED: number
+  UPDATED: number
+  DELETED: number | null
+  REGION: number
+}
+
+export type TransitInput = {
+  authority: string
+  identity: string
+  client: string
+  scope?: string[]
+  resource?: string[]
+  kid?: string
+}
+
+export type AuthorizeInput = {
+  authority: string
+  identity: string
+  client: string
+  redirect: string
+  /** PKCE code challenge, S256 of the verifier */
+  challenge: string
+  method: string
+  scope?: string[]
+  resource?: string[]
+}
+
+export type AuthorizeOutput = {
+  /** Read and removed by `io:status` */
+  status?: number
+  code?: string
+  expires_in?: number
+  error?: string
+  error_description?: string
+}
+
+export type ExchangeInput = {
+  authority: string
+  grant_type: string
+  code?: string
+  code_verifier?: string
+  redirect_uri?: string
+  client_id?: string
+  /** A form repeats a name to say a list, so either shape arrives */
+  resource?: string | unknown[]
+}
+
+export type ExchangeOutput = {
+  status?: number
+  access_token?: string
+  token_type?: string
+  expires_in?: number
+  scope?: string
+  error?: string
+  error_description?: string
+}
+
+export type ListInput = {
+  authority: string
+  identity: string
+}
+
+export type RevokeInput = {
+  authority: string
+  identity: string
+}
+
+export type RevokeOutput = null
+
+export interface Component {
+  transit: (request: { input: TransitInput, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  authorize: (request: { input: AuthorizeInput, task?: boolean }, options?: Options) => Promise<AuthorizeOutput>
+  exchange: (request: { input: ExchangeInput, task?: boolean }, options?: Options) => Promise<ExchangeOutput>
+  list: (request: { input: ListInput, task?: boolean }, options?: Options) => Promise<unknown>
+  revoke: (request: { input: RevokeInput, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<RevokeOutput | RemoteError<"NOT_FOUND">>
+  assign: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  ensure: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+  enumerate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity[]>
+  observe: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity | null>
+  stream: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Readable>
+  terminate: (request: { input?: null, query?: Query<Entity>, task?: boolean }, options?: Options) => Promise<Entity>
+}
+
+export interface Configuration {
+  /** Seconds an authorization code may be redeemed within */
+  lifetime: number
+  /** Seconds an access token is valid for; 0 is until it is revoked */
+  token: number
+}

package/components/identity.keys/manifest.toa.yaml

@@ -0,0 +1,79 @@
+namespace: identity
+name: keys
+
+entity:
+  properties:
+    identity:
+      type: string
+    key:
+      type: string
+    label:
+      type: string
+      minLength: 1
+      maxLength: 64
+    expires:
+      type: number
+    revokedAt:
+      type: integer
+  required:
+    - identity
+    - key
+    - label
+
+operations:
+  create:
+    query: false
+    input:
+      properties:
+        identity:
+          type: string
+        label:
+          type: string
+          minLength: 1
+          maxLength: 64
+        expires:
+          type: number
+      required:
+        - identity
+        - label
+      type: object
+    output:
+      properties:
+        id:
+          type: string
+        key:
+          type: string
+      required:
+        - id
+        - key
+      type: object
+  revoke:
+    output: { type: 'null' }
+    input:
+      properties:
+        identity:
+          type: string
+      required:
+        - identity
+      type: object
+  disable:
+    concurrency: retry
+
+receivers:
+  identity.bans.created: revoke
+  identity.bans.updated: revoke
+  identity.roles.deleted: revoke
+
+exposition:
+  /:identity:
+    auth:id: identity
+    auth:role: system:identity:keys
+    GET:
+      io:output: [id, label, expires, revokedAt, CREATED]
+      query:
+        sort: CREATED:desc
+      endpoint: enumerate
+    /:id:
+      DELETE:
+        io:output: false
+        endpoint: terminate

package/components/identity.keys/migrations/0002-indexes.yaml

@@ -0,0 +1,4 @@
+- index:
+    name: index_identity
+    keys:
+      identity: asc

package/components/identity.keys/operations/create.js

@@ -0,0 +1,12 @@
+import { randomBytes } from 'node:crypto';
+export class Transition {
+    async execute(input, object) {
+        object.key = randomBytes(32).toString('base64url');
+        object.identity = input.identity;
+        object.label = input.label;
+        if (input.expires !== undefined)
+            object.expires = input.expires;
+        return { id: object.id, label: object.label, key: object.key };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY3JlYXRlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL2NyZWF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sYUFBYSxDQUFBO0FBR3pDLE1BQU0sT0FBTyxVQUFVO0lBQ2QsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFZLEVBQUUsTUFBVztRQUM1QyxNQUFNLENBQUMsR0FBRyxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLENBQUE7UUFDbEQsTUFBTSxDQUFDLFFBQVEsR0FBRyxLQUFLLENBQUMsUUFBUSxDQUFBO1FBQ2hDLE1BQU0sQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDLEtBQUssQ0FBQTtRQUUxQixJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssU0FBUztZQUFFLE1BQU0sQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQTtRQUUvRCxPQUFPLEVBQUUsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQTtJQUNoRSxDQUFDO0NBQ0YifQ==

package/components/identity.keys/operations/disable.js

@@ -0,0 +1,5 @@
+export function transition(_, object) {
+    object.revokedAt ??= Date.now();
+    return object;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGlzYWJsZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3NvdXJjZS9kaXNhYmxlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE1BQU0sVUFBVSxVQUFVLENBQUMsQ0FBVSxFQUFFLE1BQVc7SUFDaEQsTUFBTSxDQUFDLFNBQVMsS0FBSyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUE7SUFFL0IsT0FBTyxNQUFNLENBQUE7QUFDZixDQUFDIn0=

package/components/identity.keys/operations/revoke.js

@@ -0,0 +1,12 @@
+import { quote } from '@toa.io/generic';
+export async function effect({ identity }, context) {
+    const keys = await context.local.enumerate({
+        query: {
+            criteria: `identity==${quote(identity)}`,
+            limit: LIMIT
+        }
+    });
+    await Promise.all(keys.map(async ({ id }) => context.local.disable({ query: { id } })));
+}
+const LIMIT = 1024;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmV2b2tlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc291cmNlL3Jldm9rZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQUUsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQUE7QUFHdkMsTUFBTSxDQUFDLEtBQUssVUFBVSxNQUFNLENBQUMsRUFBRSxRQUFRLEVBQVMsRUFBRSxPQUFnQjtJQUNoRSxNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDO1FBQ3pDLEtBQUssRUFBRTtZQUNMLFFBQVEsRUFBRSxhQUFhLEtBQUssQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUN4QyxLQUFLLEVBQUUsS0FBSztTQUNiO0tBQ0YsQ0FBQyxDQUFBO0lBRUYsTUFBTSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQTtBQUN6RixDQUFDO0FBRUQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFBIn0=

package/components/identity.keys/receivers/identity.bans.created.js

@@ -0,0 +1 @@
+export const request = (payload) => ({ input: { identity: payload.id } })

package/components/identity.keys/receivers/identity.bans.updated.js

@@ -0,0 +1 @@
+export const request = (payload) => ({ input: { identity: payload.id } })

package/components/identity.keys/receivers/identity.roles.deleted.js

@@ -0,0 +1 @@
+export const request = (payload) => ({ input: { identity: payload.identity } })

package/components/identity.keys/source/create.ts

@@ -0,0 +1,34 @@
+import { randomBytes } from 'node:crypto'
+import type { Operation } from '@toa.io/bridges.node'
+
+export class Transition implements Operation {
+  public async execute(input: Input, object: Key): Promise<Output> {
+    object.key = randomBytes(32).toString('base64url')
+    object.identity = input.identity
+    object.label = input.label
+
+    if (input.expires !== undefined) object.expires = input.expires
+
+    return { id: object.id, label: object.label, key: object.key }
+  }
+}
+
+interface Input {
+  identity: string
+  label: string
+  expires?: number
+}
+
+interface Output {
+  id: string
+  label: string
+  key: string
+}
+
+interface Key {
+  id: string
+  identity: string
+  key: string
+  label: string
+  expires?: number
+}

package/components/identity.keys/source/disable.ts

@@ -0,0 +1,9 @@
+export function transition(_: unknown, object: Key): Key {
+  object.revokedAt ??= Date.now()
+
+  return object
+}
+
+interface Key {
+  revokedAt?: number
+}

package/components/identity.keys/source/revoke.ts

@@ -0,0 +1,30 @@
+import { quote } from '@toa.io/generic'
+import type { Call, Observation } from '@toa.io/core/types'
+
+export async function effect({ identity }: Input, context: Context): Promise<void> {
+  const keys = await context.local.enumerate({
+    query: {
+      criteria: `identity==${quote(identity)}`,
+      limit: LIMIT
+    }
+  })
+
+  await Promise.all(keys.map(async ({ id }) => context.local.disable({ query: { id } })))
+}
+
+const LIMIT = 1024
+
+interface Input {
+  identity: string
+}
+
+interface Key {
+  id: string
+}
+
+interface Context {
+  local: {
+    enumerate: Observation<Key[], never, Key>
+    disable: Call<void>
+  }
+}

package/components/identity.keys/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../../../tsconfig.component.json",
+  "compilerOptions": {
+    "outDir": "./operations",
+    "rootDir": "./source"
+  },
+  "include": [
+    "source"
+  ]
+}

package/components/identity.keys/types/index.d.ts

@@ -0,0 +1,3 @@
+export * from './toa.d.ts'
+
+// What a manifest does not state belongs here, and every run keeps it.