@sanoma-ai/workflows 0.11.1 → 0.11.3

package/src/config.ts

@@ -57,7 +57,8 @@ import {
   VENDOR,
   withSetup,
 } from "./op.ts";
-import { type CedarPolicySource, policyAt } from "./cedar.ts";
+import { rootSnapshot, type RootSnapshot } from "./bundled.ts";
+import { type CedarPolicySource, policyAt, readPolicyFiles } from "./cedar.ts";
 import type { Policy } from "./policy.ts";
 import { checkFromRefs, type Resource, resourceTypesOf, withoutWriteOnly } from "./resource.ts";
 import { codeMail, loginCodeWorkflow } from "./login-code.ts";
@@ -76,7 +77,7 @@ import { tokenStore } from "./tokens.ts";
 import type { Steps } from "./steps.ts";
 import { checkSchedule } from "./schedules.ts";
 import { changeCodeOf, computeVersion } from "./version.ts";
-import type { DeclaredResource, ResourceProblem } from "./resources.ts";
+import { type DeclaredResource, readPeople, type ResourceProblem } from "./resources.ts";
 import { checkWakeupOps, type DeclaredWakeup, type EnvWakeup, HOST_URL } from "./wakeup.ts";
 import { instanceUrl, WAKEUP_TOKEN } from "./wakeup-service.ts";
 import { sanomaWakeupDriver, wakeupSteps } from "./wakeup-driver.ts";
@@ -425,6 +426,7 @@ export function resolveConfig(config: SanomaConfig): ResolvedConfig {
   const login = config.login && checkLogin(config.login, ops, drivers, appName);
   if (login) names.set(LOGIN_CODE_WORKFLOW, loginCodeWorkflow(login, appName));
   const { policy, policies, problems: policyProblems } = policyAt(root, { ops, workflows: names, collections });
+  const bundled = rootSnapshot(root);
   return {
     secrets: config.secrets ?? {},
     connections,
@@ -432,9 +434,10 @@ export function resolveConfig(config: SanomaConfig): ResolvedConfig {
     identityProvisioning,
     appName,
     databaseUrl,
-    // The built-in's code and operations are part of the app's version, like the config's own.
-    version: computeVersion({ appName, workflows: [...names.values()] }),
-    changeCode: changeCodeOf(names.get(CHANGE_WORKFLOW)!),
+    // The built-in's code and operations are part of the app's version, like the config's own. A
+    // bundle's code is not the source's: it carries the hashes of the root it was read from.
+    version: bundled?.version ?? computeVersion({ appName, workflows: [...names.values()] }),
+    changeCode: bundled?.changeCode ?? changeCodeOf(names.get(CHANGE_WORKFLOW)!),
     queueName: `sanoma:${appName}`,
     ...(login && { login }),
     ops,
@@ -593,12 +596,26 @@ function makersOf<K extends keyof ConnectorSetup>(
   return makers;
 }
 
+/**
+ * What the runtime reads from `config`'s root that a bundle carries where the files are not
+ * (`useRootSnapshot`): the app's name and versions as `resolved` has them, the policy files and
+ * the people the data files declare.
+ */
+export function readRootSnapshot(config: SanomaConfig, resolved: ResolvedConfig = resolveConfig(config)): RootSnapshot {
+  const root = rootOf(config);
+  if (root === undefined) throw new Error("A config with no root has no files to carry");
+  const { appName, version, changeCode } = resolved;
+  return { appName, version, changeCode, policies: readPolicyFiles(root), people: readPeople(root) };
+}
+
 /**
  * The `name` of `<root>/package.json`, kept whole (`@acme/ops`), when that file exists and names
  * one; else "sanoma", as for a config with no `root`. Never a `package.json` above the root: a
  * parent project's name must not become the app's. A file that is not JSON is refused, naming it.
  */
 function appNameAt(root: string | undefined): string {
+  const bundled = rootSnapshot(root);
+  if (bundled) return bundled.appName;
   const file = root === undefined ? undefined : join(root, "package.json");
   if (file === undefined || !existsSync(file)) return "sanoma";
   let manifest: unknown;

package/src/db.ts

@@ -226,6 +226,19 @@ export function lazyPool(databaseUrl: string, what: string): LazyPool {
 /** Each database prepared, or being prepared, by its URL. A failed preparation is forgotten. */
 const prepared = new Map<string, Promise<void>>();
 
+/** What prepares the databases instead of this process (`checkPreparedOnly`), which a refusal names. */
+let preparedBy: string | undefined;
+
+/**
+ * From now on, `prepareDatabase` makes nothing: it only checks that DBOS's tables and the
+ * runtime's are there, and refuses, naming `by`, what prepares them, when they are not. For a
+ * process beside the one that prepares the database, which must never migrate it: the Cloudflare
+ * host's Worker, whose container prepares it at its start.
+ */
+export function checkPreparedOnly(by: string): void {
+  preparedBy = by;
+}
+
 /**
  * Makes the database at `databaseUrl` ready for the runtime, once per process and URL: the
  * database itself and DBOS's tables when they are not there yet (as a worker's launch makes
@@ -237,7 +250,8 @@ const prepared = new Map<string, Promise<void>>();
 export function prepareDatabase(databaseUrl: string): Promise<void> {
   let preparing = prepared.get(databaseUrl);
   if (!preparing) {
-    preparing = prepare(databaseUrl).catch((err: unknown) => {
+    const made = preparedBy === undefined ? prepare(databaseUrl) : checkPrepared(databaseUrl, preparedBy);
+    preparing = made.catch((err: unknown) => {
       if (prepared.get(databaseUrl) === preparing) prepared.delete(databaseUrl);
       throw err;
     });
@@ -267,6 +281,26 @@ async function prepare(databaseUrl: string): Promise<void> {
   }
 }
 
+/** The last of the runtime's tables a preparation makes (`TABLES`), so its being there says they all are. */
+const LAST_TABLE = API_TOKENS_TABLE;
+
+/** Refuses when the database at `databaseUrl` lacks DBOS's tables or the runtime's: `by` makes them, not this process. */
+async function checkPrepared(databaseUrl: string, by: string): Promise<void> {
+  const conn = await connect(databaseUrl);
+  try {
+    const { rows } = await conn.query<{ dbos: boolean; ours: boolean }>(
+      `SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS dbos, to_regclass('${LAST_TABLE}') IS NOT NULL AS ours`,
+    );
+    const { dbos, ours } = rows[0]!;
+    if (!dbos || !ours) {
+      const missing = [...(dbos ? [] : ["DBOS's"]), ...(ours ? [] : ["Sanoma's"])].join(" and ");
+      throw new Error(`the database has no ${missing} tables yet: ${by} makes them, and this process never does`);
+    }
+  } finally {
+    await conn.end().catch(() => undefined);
+  }
+}
+
 /**
  * A connection to the database at `databaseUrl` (made first when missing) holding the
  * preparation's session lock until it ends, so a second process waits, then finds everything

package/src/define.ts

@@ -1,3 +1,4 @@
+import { bundledFile } from "./bundled.ts";
 import type { ConnectionRef } from "./connection.ts";
 import type { WorkflowEntry } from "./description.ts";
 import { fileURLToPath } from "node:url";
@@ -396,11 +397,12 @@ const isTimeZone = (zone: unknown): boolean => {
 
 /**
  * The file of the code that called the function calling this one (`defineWorkflow`'s caller),
- * from V8's call sites, as a path; undefined where there is none.
+ * from V8's call sites, as a path; where they name none, the file a bundle says it is evaluating
+ * (`bundledFile`); undefined where there is neither.
  */
 export function callerFile(): string | undefined {
   // Frame 0 is this function, frame 1 its caller, frame 2 theirs: by index, since a bundle may hold all three.
-  return scriptPath(getCallSites(3)[2]?.scriptName);
+  return scriptPath(getCallSites(3)[2]?.scriptName) ?? bundledFile();
 }
 
 /** A V8 script name (a `file:` URL for a module, a path for a script) as a path; undefined for none. */

package/src/describe.ts

@@ -39,6 +39,7 @@ import {
   type PeopleResource,
   principalOf,
   problemLine,
+  siteAtHostname,
 } from "./shared.ts";
 import { readSites, type SiteEntry } from "./sites.ts";
 
@@ -361,8 +362,9 @@ function appClashes(
 
 /**
  * Each site a host's `domains` (its type's `host.inputs.domains`) names that is not a public
- * site, and each domain it gives more than one site, at the host's declaration: the app serves
- * only a public site at a domain, and one site at each.
+ * site, each domain it gives more than one site, and a domain that is the host's `hostname` too,
+ * or another host's hostname or domain, at the host's declaration: the app serves only a public
+ * site at a domain, one site at each, and itself at another, and one host holds each.
  */
 function domainProblems(
   declared: readonly DeclaredResource[],
@@ -371,9 +373,16 @@ function domainProblems(
 ): ResourceProblem[] {
   const isPublic = new Set(sites.filter((site) => site.public).map((site) => site.name));
   const problems: ResourceProblem[] = [];
+  // Each hostname a host serves the app at, and each host's domains, lowercased: one host attaches each.
+  const hostnames: [string, DeclaredResource][] = [];
+  const held = new Map<string, Set<DeclaredResource>>();
+  const hold = (name: string, resource: DeclaredResource) =>
+    held.set(name.toLowerCase(), (held.get(name.toLowerCase()) ?? new Set()).add(resource));
   for (const resource of declared) {
-    const path = types.get(`${resource.vendor}.${resource.type}`)?.host?.inputs.domains;
+    const inputs = types.get(`${resource.vendor}.${resource.type}`)?.host?.inputs;
+    const path = inputs?.domains;
     const domains = (path === undefined ? {} : (valueAt(resource.desired, path) ?? {})) as Record<string, unknown>;
+    const hostname = inputs?.hostname === undefined ? undefined : valueAt(resource.desired, inputs.hostname);
     const messages = Object.keys(domains)
       .filter((name) => !isPublic.has(name))
       .map((name) => `domains names "${name}", which is not a public site (defineSite({ public: true }))`);
@@ -385,7 +394,20 @@ function domainProblems(
       const others = `${names.length === 2 ? "both " : ""}${names.slice(0, -1).join(", ")}`;
       messages.push(`${domain} is the domain of ${others} and ${names.at(-1)}`);
     }
+    const site = typeof hostname === "string" ? siteAtHostname(hostname, domains) : undefined;
+    if (site) messages.push(`${hostname as string} is the app's hostname and the domain of ${site}`);
     problems.push(...messages.map((message) => ({ ...resource.at, message })));
+    for (const [, domain] of named) hold(domain as string, resource);
+    if (typeof hostname === "string") {
+      hostnames.push([hostname, resource]);
+      hold(hostname, resource);
+    }
+  }
+  for (const [hostname, resource] of hostnames) {
+    const others = [...(held.get(hostname.toLowerCase()) ?? [])].filter((other) => other !== resource);
+    if (others.length === 0) continue;
+    const message = `${hostname} is the app's hostname here and is served by ${others.map((o) => o.id).join(", ")} too`;
+    problems.push({ ...resource.at, message });
   }
   return problems;
 }

package/src/host.ts

@@ -29,11 +29,20 @@ export interface HostCapabilities {
 /** What a host's state says of it: where the app answers, which commit it runs, and whether it is up. */
 export interface HostOutputs {
   url: string;
+  /**
+   * Where a wakeup (and a check of its process) reaches it, `url` when left out: the vendor's own
+   * URL of a host whose `url` may be its `hostname`, so a wake never depends on a custom domain's DNS and certificate, and a
+   * hostname declared or dropped leaves its wakeup as it was. Apply gives a wakeup this one.
+   */
+  wakeUrl?: string;
   /** The commit it runs, when its state says. */
   revision?: string;
   healthy: boolean;
 }
 
+/** Where a wakeup, and a check of the host's own process, reaches it: its `wakeUrl`, else its `url`. */
+export const wakeUrlOf = (outputs: HostOutputs): string => outputs.wakeUrl ?? outputs.url;
+
 /**
  * A resource type's `host`: the fields it takes the runtime's inputs in, by dotted path into its
  * declared fields, and how its state reads as `HostOutputs`. A host is drifted when
@@ -55,6 +64,12 @@ export interface HostSpec {
     port: string;
     /** A public site's domain, by site name: the app serves each site at the root of its domain (`SANOMA_DOMAINS`). */
     domains?: string;
+    /**
+     * The hostname the app is served at. A host with one reports `url` as `https://<hostname>` (its
+     * vendor's URL otherwise), so the links made from it use the stable name, and its vendor's URL
+     * as `wakeUrl`, where its wakeup reaches it. It is never one of `domains`' values.
+     */
+    hostname?: string;
   };
   /**
    * The field apply fills with the commit `ref` resolves to, before it plans: hidden, as a data

package/src/index.ts

@@ -67,6 +67,7 @@ export {
   defineConfig,
   envWakeup,
   type Login,
+  readRootSnapshot,
   resolveConfig,
   resolveDatabaseUrl,
   type ResolvedConfig,
@@ -203,6 +204,7 @@ export {
   type SourceHost,
 } from "./source.ts";
 export type { HostCapabilities, HostLifetime, HostOutputs, HostSpec } from "./host.ts";
+export { wakeUrlOf } from "./host.ts";
 export {
   checkDatabase,
   type DatabaseCapabilities,
@@ -241,6 +243,11 @@ export {
 } from "./client.ts";
 // A raw DBOS client on the runtime's database, for tests and tools that read DBOS directly.
 export { dbosClient } from "./db.ts";
+// The runtime bundled where a company's files are not (the Cloudflare host's Worker): the root's
+// people, policies and app name as data, Cedar's web build, and a database it only checks.
+export { type RootSnapshot, useRootSnapshot } from "./bundled.ts";
+export { checkPreparedOnly } from "./db.ts";
+export { type CedarWasm, useCedarWasm } from "./schema.ts";
 // Also at `@sanoma-ai/workflows/shared`, which a browser bundle can import.
 export {
   AGENTS,

package/src/load.ts

@@ -89,7 +89,8 @@ const registry = ((globalThis as Record<symbol, unknown>)[Symbol.for("sanoma.loa
   made: new WeakMap(),
 }) as Registry;
 
-const require = createRequire(import.meta.url);
+/** This module's `require`, made on first use: a bundle with no file URL (the Cloudflare host's Worker) never loads a file. */
+let require: NodeJS.Require | undefined;
 
 /** Where `value` was made, when a company file made it with a constructor the loader served. */
 export const madeOf = (value: unknown): Made | undefined =>
@@ -205,7 +206,9 @@ function loadOne(gen: Generation, file: string, rel: string): Loaded {
   if (done) return done;
   let loaded: Loaded;
   try {
-    const { ns } = require(`${SCHEME}${gen.id}/${pathToFileURL(file).href}`) as { ns: Record<string, unknown> };
+    const { ns } = (require ??= createRequire(import.meta.url))(`${SCHEME}${gen.id}/${pathToFileURL(file).href}`) as {
+      ns: Record<string, unknown>;
+    };
     loaded = { exports: Object.entries(ns) };
   } catch (error) {
     // A file that imports one that threw throws the same object: reported once, where it was thrown.

package/src/resources.ts

@@ -9,6 +9,7 @@ import { APPS_DIR, COLLECTIONS_FILE, filesUnder, kindDirs, relPath } from "./pat
 import { peopleConnector, sanoma } from "./person.ts";
 import { wakeupOps } from "./wakeup-type.ts";
 import { DECLARED, type Declared, isDeclared, isObject, type Resource, resourceTypesOf } from "./resource.ts";
+import { rootSnapshot } from "./bundled.ts";
 import { Principal } from "./define.ts";
 import { NotAdmittedError } from "./errors.ts";
 import {
@@ -89,10 +90,12 @@ export const peopleSources = (root: string): ReadonlySet<string> => filesRead(pe
  * Only the files that may declare them (`mayDeclarePeople`) are loaded, with the people's and the
  * wakeup's constructors, which the same `sanoma` declares; loaded again only when one of them
  * changed (by its size and time), so a new colleague is admitted once their file is saved, and a
- * request costs a `stat` per file.
+ * request costs a `stat` per file. A root with a bundled snapshot (`useRootSnapshot`) answers its people.
  */
 export function readPeople(root: string | undefined): DeclaredPeople {
   if (root === undefined) return { people: [], problems: [] };
+  const bundled = rootSnapshot(root);
+  if (bundled) return bundled.people;
   const loaded = peopleLoad(root);
   const cached = peopleRead.get(loaded);
   if (cached) return cached;

package/src/schema.ts

@@ -19,11 +19,24 @@ import { CHANGE_MERGE, DATA_VENDOR, EFFECTS, groupNamesOf, type PeopleResource,
 // resolved config and the people, in memory for the evaluator, and written as text to
 // `.sanoma/schema.cedarschema` for the policies' author.
 
-const require = createRequire(import.meta.url);
-let wasm: typeof import("@cedar-policy/cedar-wasm/nodejs") | undefined;
+/** Cedar's bindings: its builds (`/nodejs`, `/web`) export the same functions. */
+export type CedarWasm = typeof import("@cedar-policy/cedar-wasm/nodejs");
+let wasm: CedarWasm | undefined;
 
-/** `@cedar-policy/cedar-wasm`'s Node build, loaded (synchronously, once) on first use, so a process that never decides with Cedar never loads it. */
-export const cedarWasm = () => (wasm ??= require("@cedar-policy/cedar-wasm/nodejs") as typeof wasm)!;
+/**
+ * `@cedar-policy/cedar-wasm`'s Node build, loaded (synchronously, once) on first use, so a process
+ * that never decides with Cedar never loads it; or the build `useCedarWasm` gave.
+ */
+export const cedarWasm = (): CedarWasm =>
+  (wasm ??= createRequire(import.meta.url)("@cedar-policy/cedar-wasm/nodejs") as CedarWasm);
+
+/**
+ * From now on, Cedar is `bindings`: its web build, initialised, where the Node build cannot load
+ * (the Cloudflare host's Worker, which bundles the runtime).
+ */
+export function useCedarWasm(bindings: CedarWasm): void {
+  wasm = bindings;
+}
 
 /** The schema as Cedar's JSON format has it. */
 export type CedarSchemaJson = SchemaJson<string>;

package/src/shared.ts

@@ -141,6 +141,33 @@ export const domainsText = (domains: Readonly<Record<string, string>>): string =
     .map((site) => `${site}=${domains[site]}`)
     .join(",");
 
+/**
+ * Where a hosted container answers, with its instance token (`SANOMA_WAKEUP_TOKEN`), the bundle
+ * of its public sites that a host's Worker serves: the Cloudflare host downloads it at a deploy.
+ */
+export const SITES_BUNDLE_PATH = "/__sanoma/sites-bundle";
+/** The header every answer of that route carries: a runtime without the route answers without it. */
+export const SITES_BUNDLE_HEADER = "x-sanoma-sites-bundle";
+
+/** What that route answers: what a host's Worker runs a company's public sites from (`buildWorker` in `@sanoma-ai/app/build`). */
+export interface SitesBundle {
+  /** The sites it serves, by key: public, with a domain and no login. */
+  sites: string[];
+  /** The main module, among `modules`. */
+  mainModule: string;
+  /** The Worker's modules, by name relative to the main module, each base64. */
+  modules: { name: string; type: "esm" | "wasm" | "text" | "data"; content: string }[];
+  /** The Worker's static assets, by path from `/`, each base64: the client build and the prerendered pages. */
+  assets: { path: string; content: string }[];
+}
+
+/** Where a host with a `hostname` serves the app (`HostSpec`'s `hostname`): `https://<hostname>`. */
+export const hostnameUrl = (hostname: string): string => `https://${hostname}`;
+
+/** The site whose domain is also the app's `hostname`, compared in lower case; undefined when none is. */
+export const siteAtHostname = (hostname: string, domains: Readonly<Record<string, unknown>>): string | undefined =>
+  Object.entries(domains).find(([, domain]) => typeof domain === "string" && same(domain, hostname))?.[0];
+
 /** The domains `domainsText` wrote, by site name; throws for a pair that is not `<site>=<hostname>`, or a site named twice. */
 export function domainsOf(text: string): Record<string, string> {
   const domains: Record<string, string> = {};
@@ -469,7 +496,7 @@ export function approverOf(name: string, resources: readonly PeopleResource[]):
   return principalOf(name, resources) && name;
 }
 
-/** True for two strings the same but for case: an email or a GitHub login. */
+/** True for two strings the same but for case: an email, a GitHub login or a hostname. */
 const same = (a: string | undefined, b: string | undefined) =>
   a !== undefined && b !== undefined && a.toLowerCase() === b.toLowerCase();
 

package/src/wakeup-type.ts

@@ -49,7 +49,9 @@ export const wakeup = defineResource({
     immutable: [],
     vendorOwned: ["id", "at", "lastError"],
     writeOnly: [],
-    references: { host: { type: HOSTS, by: ["url"] } },
+    // Where each host's wakeup reaches it, as apply gives it (`wakeUrlOf`): a Cloudflare host's
+    // `worker_url` once its `url` is its hostname, else its `url`.
+    references: { host: { type: HOSTS, by: ["worker_url", "url"] } },
   },
   writable: true,
   // The service holds its registered wake: apply asks before it deletes one.