@sanoma-ai/workflows 0.10.3 → 0.10.7

package/src/resource.ts

@@ -2,7 +2,7 @@ import type { ConnectionRef } from "./connection.ts";
 import { z } from "zod";
 import { checkDatabase, type DatabaseSpec } from "./database.ts";
 import { isRunControlError } from "./errors.ts";
-import { checkHost, type HostSpec } from "./host.ts";
+import { checkHost, hasPath, type HostSpec } from "./host.ts";
 import { type Connector, type OpSpec, RESOURCE, VENDOR } from "./op.ts";
 import { isSanomaSecret, isSecret, type Secret } from "./secret.ts";
 import { errorMessage } from "./shared.ts";
@@ -37,6 +37,26 @@ export interface FieldReference {
    * declared one. Without it, the field holds the resource's `name`, and is compared as it is.
    */
   readonly by?: readonly string[];
+  /**
+   * A dotted path in that resource's state: apply and drift give this field the named resource's
+   * state at this path, as a whole (a list or an object), read in the same run or made by an
+   * earlier step of it (`records: mail` takes a `resend.domain`'s `dns_records`). A data file may
+   * give a literal value here instead. `desired` holds the resource's `name` until then, which the
+   * schema does not judge. Where the same apply changes that resource at the path (creates or
+   * replaces it, or updates it with the path `unknown` or another value there in its plan), or,
+   * for a create, it has no state yet or nothing at the path, a plan is given `null` there (known
+   * after apply: the type's `plan` must accept it and report the path in `unknown`), so a change it
+   * makes is planned, and approved, up front. A plan of a bound object leaves the field out while
+   * its resource is absent, gone or unreadable and not about to change, as drift does, and its step
+   * runs without it. A step given `null` for the field whose value is still not known (its
+   * resource's step failed or did not run) fails before its driver is called, and drift leaves the
+   * field out. An empty list or object at the path counts as known: a vendor that answers `[]`
+   * while it is still filling the list makes the dependent write an empty one. The path must be a
+   * field of each type it may name (`checkFromRefs`, when a config is resolved). Not on a
+   * write-only field, nor one holding a write-only field (refused). Not yet on a bridge-backed type
+   * (`tfConnector`): an OpenTofu provider's plan reads `null` as unset, not as known after apply.
+   */
+  readonly from?: string;
 }
 
 /** A resource type's `fields.references`: by dotted path, the resource each names. */
@@ -196,9 +216,10 @@ export interface Declared<Id extends string = string, T = State> {
 
 /**
  * What a resource type's constructor takes: its fields, where `R` (its `fields.references`)
- * names a path, a declared resource of that type instead of a value (`repository_id: site`), and
- * where a string goes, a secret (`secret("NAME")`), which the constructor allows at a write-only
- * field only.
+ * names a path, a declared resource of that type instead of a value (`repository_id: site`), in
+ * place of the whole field for a `from` reference (`records: mail`) and of each item for a list
+ * otherwise, and where a string goes, a secret (`secret("NAME")`), which the constructor allows
+ * at a write-only field only.
  */
 export type Declaring<T, R extends References = {}> = [keyof R] extends [never]
   ? WithSecrets<T>
@@ -219,9 +240,11 @@ type DeclaringAt<T, R extends References, P extends string> = T extends readonly
     : WithSecrets<T>;
 
 type DeclaringField<V, R extends References, P extends string> = P extends keyof R
-  ? V extends readonly (infer I)[]
-    ? (WithSecrets<I> | DeclaredOf<R[P]["type"]>)[]
-    : WithSecrets<V> | DeclaredOf<R[P]["type"]>
+  ? R[P] extends { readonly from: string }
+    ? WithSecrets<V> | DeclaredOf<R[P]["type"]>
+    : V extends readonly (infer I)[]
+      ? (WithSecrets<I> | DeclaredOf<R[P]["type"]>)[]
+      : WithSecrets<V> | DeclaredOf<R[P]["type"]>
   : [Extract<keyof R, `${P}.${string}`>] extends [never]
     ? WithSecrets<V>
     : DeclaringAt<V, R, P>;
@@ -477,6 +500,65 @@ export function holderOf(value: unknown, path: string): { holder: State; key: st
   return isObject(holder) || Array.isArray(holder) ? { holder: holder as State, key } : undefined;
 }
 
+/**
+ * Each place `refs` (a declaration's, by dotted path to the resource named there) holds a `from`
+ * reference (`FieldReference.from`): its path, the resource it names (`named`), and the path in
+ * that resource's state its value comes from.
+ */
+const fromRefs = (references: References | undefined, refs: Readonly<Record<string, string>>) =>
+  Object.entries(refs).flatMap(([at, named]) => {
+    const from = references?.[fieldPathOf(at)]?.from;
+    return from === undefined ? [] : [{ at, named, from }];
+  });
+
+/** What `withFrom` makes of a `from` field it cannot fill: `null` (known after apply), or nothing. */
+export type Missing = "unknown" | "drop";
+
+/** A `from` reference `withFrom` could not fill: the resource it names has no state, or nothing at its path. */
+export interface Unfilled {
+  at: string;
+  named: string;
+  from: string;
+  /** True when the resource has a state, with nothing at the path. */
+  stated: boolean;
+}
+
+/**
+ * `desired` with each field a `from` reference names given the state of the resource it names
+ * at that path (a copy), `stateOf` that resource (by what `refs` holds there, and the path read);
+ * and the references it could not fill, where that resource has no state or nothing there, each
+ * such field `null` (`unknown`, a value known after apply) or left out (`drop`), as `missing` says
+ * (for each reference, given a function). A reference with no place in `desired` to fill is
+ * unfilled too. `desired` itself when there is no such field.
+ */
+export function withFrom(
+  references: References | undefined,
+  desired: State,
+  refs: Readonly<Record<string, string>>,
+  stateOf: (named: string, from: string) => State | undefined,
+  missing: Missing | ((named: string, from: string) => Missing),
+): { desired: State; unfilled: Unfilled[] } {
+  const taken = fromRefs(references, refs);
+  if (!taken.length) return { desired, unfilled: [] };
+  const out = structuredClone(desired);
+  const unfilled: Unfilled[] = [];
+  for (const { at, named, from } of taken) {
+    const place = holderOf(out, at);
+    const state = stateOf(named, from);
+    const value = state === undefined ? undefined : valueAt(state, from);
+    if (place && value != null) {
+      // A copy: what a driver is given never shares an object with the resource's state.
+      place.holder[place.key] = structuredClone(value);
+      continue;
+    }
+    unfilled.push({ at, named, from, stated: state !== undefined });
+    if (!place) continue;
+    if ((typeof missing === "function" ? missing(named, from) : missing) === "drop") delete place.holder[place.key];
+    else place.holder[place.key] = null;
+  }
+  return { desired: out, unfilled };
+}
+
 /** A field's dotted path as `fields` names it, without a list item's index: `teams.0` is `teams`. */
 export const fieldPathOf = (at: string) => at.replaceAll(/\.\d+(?=\.|$)/g, "");
 
@@ -485,7 +567,7 @@ export const valueAt = (value: unknown, path: string) =>
   path.split(".").reduce<unknown>((v, key) => (isObject(v) || Array.isArray(v) ? (v as State)[key] : undefined), value);
 
 /** True when the two are the same JSON, where a missing value is `null`. */
-function same(a: unknown, b: unknown): boolean {
+export function same(a: unknown, b: unknown): boolean {
   if (a === b || (a == null && b == null)) return true;
   if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((item, i) => same(item, b[i]));
   if (isObject(a) && isObject(b)) return Object.keys({ ...a, ...b }).every((key) => same(a[key], b[key]));
@@ -579,6 +661,12 @@ function pathsIn(value: unknown, paths: ReadonlySet<string>, prefix = ""): strin
  * - `update` takes `{ id, state?, handle?, desired, expect? }` and returns the same; given
  *   `expect` (a plan's `action` and `replace`), it refuses a fresh plan that differs
  *   (`DriverError`, `vendorCode` `plan_changed`).
+ *
+ * A type whose fields take a `from` reference (`FieldReference.from`) is given `null` there by
+ * apply's `plan` while the value is known only after apply, so its `plan` must accept `null` and
+ * report the path in `unknown`; and its `update` must treat a field left out of `desired` as
+ * keeping what the vendor holds, since a bound object whose `from` resource is gone is updated
+ * with that field left out.
  * - `delete` takes `{ id, state?, handle? }` and returns `{ id, gone: true }`.
  *
  * `desired` may hold secret markers at write-only fields, which the driver resolves; no output
@@ -591,8 +679,10 @@ function pathsIn(value: unknown, paths: ReadonlySet<string>, prefix = ""): strin
  * schema does not have, fields the vendor owns (unless the identity names them), values the
  * schema rejects, and an empty identity. Where `fields.references` allows it, a field may name
  * another declared resource of that type (`repository_id: site`): `desired` holds, and the
- * schema and `find` read, that resource's `name`, and `refs` says where it was named. A type
- * without `find` declares resources without a `name`, found only by their bindings.
+ * schema and `find` read, that resource's `name`, and `refs` says where it was named. A `from`
+ * reference names one in place of the whole field, which apply and drift fill from its state, so
+ * the schema does not judge the name there. A type without `find` declares resources without a
+ * `name`, found only by their bindings.
  */
 export function defineResource<
   S extends z.ZodObject,
@@ -672,6 +762,20 @@ export function defineResource<
   const owned = new Set(fields.vendorOwned.filter((path) => !named.has(path)));
   const references: References = fields.references ?? {};
   const writeOnly = new Set(fields.writeOnly);
+  for (const [path, ref] of Object.entries(references)) {
+    if (ref.from !== undefined && ref.by !== undefined)
+      throw new Error(
+        `${what}: the reference at ${path} takes its value from its resource's state or names it by a field, not both`,
+      );
+    // A write-only field holds secret markers only, never a value from another resource's state.
+    if (ref.from !== undefined && underAny(path, writeOnly))
+      throw new Error(`${what}: ${path} is write-only, so it cannot take its value from another resource's state`);
+    const inside = ref.from === undefined ? undefined : fields.writeOnly.find((w) => w.startsWith(`${path}.`));
+    if (inside !== undefined)
+      throw new Error(
+        `${what}: ${inside} is write-only, so ${path}, which holds it, cannot take its value from another resource's state`,
+      );
+  }
   const declare = (
     given: Declaring<z.input<S>, R>,
     options?: { connection?: ConnectionRef },
@@ -684,8 +788,9 @@ export function defineResource<
       throw new Error(`${what}: select a declared connection of this connector`);
     }
     const refs: Record<string, string> = {};
-    // Where a secret is given, with list items' indexes: the schema does not judge its marker.
-    const secrets = new Set<string>();
+    // Where a secret, or a resource a `from` reference takes, is given, with list items' indexes:
+    // the schema does not judge the marker, nor the name that holds the place of the state.
+    const unjudged = new Set<string>();
     // Each resource `given` names, where `references` allows one of its type, replaced by its name.
     // `path` is the field's, as `references` names it; `at` has list items' indexes too.
     const resolve = (value: unknown, path: string, at: string): unknown => {
@@ -697,7 +802,7 @@ export function defineResource<
         if (isSanomaSecret(value.$secret) && !(hostSecrets !== undefined && underAny(path, new Set([hostSecrets])))) {
           throw new Error(`${what}: ${at} names ${value.$secret}, one of sanoma's own: only a host's secrets may`);
         }
-        secrets.add(at);
+        unjudged.add(at);
         return value;
       }
       if (isDeclared(value)) {
@@ -709,10 +814,16 @@ export function defineResource<
           throw new Error(`${what}: ${at} names a resource of type ${types.join(" or ")}, not ${id} (${value.name})`);
         if (value.name === undefined)
           throw new Error(`${what}: ${at} names a ${id}, which has no identity to name it by`);
+        if (wants.from !== undefined) unjudged.add(at);
         refs[at] = `${id}:${value.name}`;
         return value.name;
       }
-      if (Array.isArray(value)) return value.map((item, i) => resolve(item, path, `${at}.${i}`));
+      if (Array.isArray(value)) {
+        const from = references[path]?.from;
+        const listed = from === undefined ? undefined : value.find(isDeclared);
+        if (listed) throw new Error(`${what}: ${path} takes a ${listed[DECLARED]}'s ${from} as a whole, not in a list`);
+        return value.map((item, i) => resolve(item, path, `${at}.${i}`));
+      }
       if (!isObject(value)) return value;
       return Object.fromEntries(
         Object.entries(value).map(([field, v]) => [field, resolve(v, joinPath(path, field), joinPath(at, field))]),
@@ -732,7 +843,7 @@ export function defineResource<
       );
     }
     const parsed = schema.safeParse(desired);
-    const issues = parsed.error?.issues.filter((issue) => !secrets.has(issue.path.join(".")));
+    const issues = parsed.error?.issues.filter((issue) => !unjudged.has(issue.path.join(".")));
     if (issues?.length) throw new Error(`${what}: ${z.prettifyError(new z.ZodError(issues))}`);
     const name = find?.(desired);
     if (find && (typeof name !== "string" || name === "")) throw new Error(`${what}: its ${identity} is missing`);
@@ -770,6 +881,27 @@ export function defineResource<
   return Object.freeze(resource);
 }
 
+/**
+ * Throws where a `from` reference (`FieldReference.from`) names a path that a type it may name
+ * has no field at, among `types` (a config's): `dns_record` for `dns_records` would otherwise
+ * fail every create. A type not among them is left to the data files' check.
+ */
+export function checkFromRefs(types: ReadonlyMap<string, Resource>): void {
+  for (const type of types.values()) {
+    for (const [path, ref] of Object.entries(type.fields.references ?? {})) {
+      const named = ref.from === undefined ? [] : [ref.type].flat();
+      for (const held of named.map((id) => types.get(id)).filter((t) => t !== undefined)) {
+        if (!hasPath(held.schema, ref.from!)) {
+          const shape = (held.schema as Partial<z.ZodObject>).shape ?? {};
+          throw new Error(
+            `${type.vendor}.${type.type}: the reference at ${path} takes ${ref.from} from a ${held.vendor}.${held.type}'s state, which has no such field (its fields: ${Object.keys(shape).join(", ")})`,
+          );
+        }
+      }
+    }
+  }
+}
+
 /** Every resource type the connectors declare, by `<vendor>.<type>`. */
 export function resourceTypesOf(connectors: readonly Connector<any, any>[]): Map<string, Resource> {
   const types = new Map<string, Resource>();

package/src/resources.ts

@@ -140,9 +140,9 @@ export function readPeople(root: string | undefined): DeclaredPeople {
  * While no person is declared, whoever names an id is taken as given. A visitor's id (`isVisitor`)
  * is taken whatever the files say, with the groups stamped here (`visitors`, or none for
  * `anonymous`), never through a sign-in: the staff logins admit no visitor. A visitor keeps the
- * `email` its login verified; a `subject` is never taken from the caller (a token's is its row's,
- * which `SanomaClient.start` reads). Throws `NotAdmittedError` for anyone else, and for
- * everyone while the people's files have problems.
+ * `email` and `github` its login verified; a `subject` is never taken from the caller (a token's
+ * is its row's, which `SanomaClient.start` reads). Throws `NotAdmittedError` for anyone else, and
+ * for everyone while the people's files have problems.
  */
 export function admit(
   asking: { id?: string; email?: string; github?: string; groups?: string[]; onBehalfOf?: string },
@@ -155,7 +155,8 @@ export function admit(
     if (asking.id === ANONYMOUS) return ANONYMOUS_PRINCIPAL;
     // A token's groups are its row's (`SanomaClient.tokens`), which only the public front reads; a visitor's are stamped.
     if (isToken({ id: asking.id })) return { id: asking.id, groups: [...(asking.groups ?? [])] };
-    return { id: asking.id, groups: [VISITORS], ...(asking.email && { email: asking.email }) };
+    const { email, github } = asking;
+    return { id: asking.id, groups: [VISITORS], ...(email && { email }), ...(github && { github }) };
   }
   if (problems.length) {
     // The runtime's own agents are declared by no file, so a broken one does not stop them (`check`'s scenarios).
@@ -167,7 +168,7 @@ export function admit(
   if (!declaresPeople(people)) {
     const given = Principal.safeParse(asking).data;
     if (given) {
-      const { email: _email, subject: _subject, ...principal } = given;
+      const { email: _email, github: _github, subject: _subject, ...principal } = given;
       return principal;
     }
   } else {

package/src/runtime-ops.ts

@@ -7,6 +7,11 @@ import { sealInvite } from "./seal.ts";
 import { errorMessage } from "./shared.ts";
 import { sourceKeyPair, sshPublicKey } from "./ssh-key.ts";
 import { memoryTokens, type Tokens } from "./tokens.ts";
+import {
+  identityProvisioningCode,
+  memoryIdentityProvisioning,
+  type IdentityProvisioning,
+} from "./identity-provisioning.ts";
 
 // What a workflow cannot do itself and the runtime does for it, as operations of the vendor
 // `sanoma` (`sanoma.secret.*`, `sanoma.invite.mint`, `sanoma.token.*`): named in `uses`, decided by
@@ -23,11 +28,60 @@ const SecretName = z
 /** How long an instance gets to answer `POST /auth/invite`. */
 const INVITE_TIMEOUT_MS = 10_000;
 
+const DeploymentIdentity = z.object({
+  deployment: z.string().min(1).max(256),
+  company: z.string().min(1).max(256),
+  environment: z.string().min(1).max(256),
+  serviceAccount: z.string().regex(/^[a-z][a-z0-9-]+@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/),
+});
+const Generation = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+const IdentityTarget = ({ deployment }: { deployment: string }) => deployment;
+
+// Enrollment implementations can see credential hashes and database credentials. Neither their
+// errors nor causes may be captured in durable driver history, including on an uncertain commit.
+async function identityWrite(write: () => Promise<void>): Promise<void> {
+  try {
+    await write();
+  } catch (error) {
+    const code = identityProvisioningCode(error) ?? "unavailable";
+    throw new DriverError(`Identity provisioning: ${code}`, { retryable: code === "unavailable" });
+  }
+}
+
 /**
  * The runtime's own operations a workflow calls: `import { sanoma } from "sanoma"`, then
  * `uses: [sanoma.secret.generate]` and `ctx.sanoma.secret.generate({ name, kind })`.
  */
 export const sanoma = defineConnector("sanoma", {
+  identity: {
+    enroll: {
+      effect: "access",
+      idempotent: true,
+      description:
+        "Enroll a deployment identity, keeping its bootstrap credential in the secret store. A higher generation rotates it; mappings are immutable",
+      input: DeploymentIdentity.extend({ generation: Generation, validUntil: z.iso.datetime(), store: SecretName }),
+      output: z.object({ deployment: z.string(), generation: Generation, store: z.string() }),
+      target: IdentityTarget,
+      createsSecrets: ({ store }: { store: string }) => [store],
+    },
+    retire: {
+      effect: "access",
+      idempotent: true,
+      description:
+        "Shorten an old identity generation's validity after delivering its replacement; never extend access",
+      input: DeploymentIdentity.extend({ generation: Generation, validUntil: z.iso.datetime() }),
+      output: z.object({}),
+      target: IdentityTarget,
+    },
+    revoke: {
+      effect: "access",
+      idempotent: true,
+      description: "Disable all token renewal for a deployment. This deployment id cannot be re-enrolled",
+      input: DeploymentIdentity,
+      output: z.object({}),
+      target: IdentityTarget,
+    },
+  },
   secret: {
     generate: {
       effect: "write",
@@ -156,12 +210,36 @@ export async function postInvite(host: string, request: string): Promise<{ url:
  */
 export function runtimeDriver({
   tokens,
+  identities,
   invite = postInvite,
 }: {
   tokens: Tokens;
+  identities?: IdentityProvisioning;
   invite?: (host: string, request: string, call: CallContext) => Promise<{ url: string }>;
 }) {
   return defineDriver(sanoma, {
+    identity: {
+      async enroll({ store, ...input }, call) {
+        if (!identities) throw refuse("identity provisioning is not configured");
+        // Store before enrolling: a lost DB response retries with the same credential, never a new bearer.
+        const credential = await call.secrets.ensure(store, generateSecret);
+        if (!/^[A-Za-z0-9_-]{43}$/.test(credential)) throw refuse("invalid identity bootstrap credential");
+        await identityWrite(() =>
+          identities.enroll({ ...input, hash: createHash("sha256").update(credential).digest("hex") }),
+        );
+        return { deployment: input.deployment, generation: input.generation, store };
+      },
+      async retire(input) {
+        if (!identities) throw refuse("identity provisioning is not configured");
+        await identityWrite(() => identities.retire(input));
+        return {};
+      },
+      async revoke(input) {
+        if (!identities) throw refuse("identity provisioning is not configured");
+        await identityWrite(() => identities.revoke(input));
+        return {};
+      },
+    },
     secret: {
       async generate({ name, kind }, call) {
         if (kind === "random") {
@@ -230,5 +308,6 @@ export function runtimeDriver({
 export const sandboxRuntimeDriver = () =>
   runtimeDriver({
     tokens: memoryTokens(),
+    identities: memoryIdentityProvisioning(),
     invite: async (host, _request, call) => ({ url: new URL(`/auth/invite/sandbox-${tokenIdOf(call)}`, host).href }),
   });

package/src/scenario.ts

@@ -13,7 +13,7 @@ import {
 } from "@cucumber/messages";
 import type { z } from "zod";
 import type { RunSummary, SanomaClient } from "./client.ts";
-import type { Approver } from "./define.ts";
+import type { Approver, Principal } from "./define.ts";
 import type { ResolvedConfig } from "./config.ts";
 import {
   buildLibrary,
@@ -162,8 +162,11 @@ export interface Scenario {
   text: string;
   /** Every step in order, for a list and for marking graph nodes. */
   steps: ScenarioStep[];
-  /** Who starts the run, by id, when a `Given <who> is acting` says: a declared person or agent, `anonymous` or a visitor. */
-  startedBy?: string;
+  /**
+   * Who starts the run when a `Given … is acting` says: a declared person or agent or `anonymous`
+   * by id, or a visitor, by id or, with the email and GitHub login its login verified, as a principal.
+   */
+  startedBy?: Principal | string;
   given: Given[];
   input: unknown;
   decisions: Decision[];
@@ -208,11 +211,11 @@ interface Then {
 
 /**
  * What a step of each kind reads into; `any` is a decision, which a step of any keyword may make,
- * and `actor` a `Given` saying who starts the run (`{who} is acting`), by id.
+ * and `actor` a `Given` saying who starts the run (`{who} is acting`), by id or as a principal.
  */
 interface Items {
   given: Unstepped<Given>[];
-  actor: string;
+  actor: Principal | string;
   when: When;
   then: Then;
   any: Unstepped<Decision>;
@@ -398,6 +401,12 @@ function builtFor(scope: Scope): Built {
 /** A `Then` step of the generic steps: its expectation, checked against the run's records. */
 const expecting = (expect: CoreExpectation): Then => ({ expect, verify: (run) => detailOf(expect, run.records) });
 
+/** The scenario's visitor (`a visitor is acting`) with what its login verified, as `publicFront` passes it on. */
+const visitorWith = (verified: { email: unknown; github?: unknown }): Principal => ({
+  ...visitorPrincipal("scenario", "visitor"),
+  ...(verified as Pick<Principal, "email" | "github">),
+});
+
 /** The rules a scope has, and the parameter types their expressions use. */
 function rulesOf(scope: Scope): { rules: Rule[]; parameterTypes: ParameterTypeSpec[] } {
   const { types, collections } = scope;
@@ -455,6 +464,13 @@ function rulesOf(scope: Scope): { rules: Rule[]; parameterTypes: ParameterTypeSp
     { kind: "actor", source: "{who} is acting", read: ([who]) => actorNamed(who as string) },
     // A visitor of a public site, as a login would vouch for one; `anonymous` is a `{who}`.
     { kind: "actor", source: "a visitor is acting", read: () => visitorPrincipal("scenario", "visitor").id },
+    // A visitor with the email its login verified, and a GitHub login it linked.
+    { kind: "actor", source: "a visitor {string} is acting", read: ([email]) => visitorWith({ email }) },
+    {
+      kind: "actor",
+      source: "a visitor {string} with GitHub {string} is acting",
+      read: ([email, github]) => visitorWith({ email, github }),
+    },
     {
       kind: "given",
       source: "{op} was called with",
@@ -985,7 +1001,9 @@ function compileWorld(built: Built, specs: Map<string, Spec>) {
         switch (rule.kind) {
           case "actor":
             if (spec.startedBy !== undefined)
-              throw new Error(`${spec.startedBy} is acting already: a run has one actor`);
+              throw new Error(
+                `${typeof spec.startedBy === "string" ? spec.startedBy : spec.startedBy.id} is acting already: a run has one actor`,
+              );
             spec.startedBy = rule.read(args, pickle);
             break;
           case "given": {