@sanoma-ai/workflows 0.11.12 → 0.11.14

package/src/db.ts

@@ -1,110 +1,63 @@
 import { DBOS, DBOSClient } from "@dbos-inc/dbos-sdk";
 import { setTimeout as delay } from "node:timers/promises";
-import { Client, escapeIdentifier, Pool } from "pg";
+import { and, eq, inArray, lte, ne, sql } from "drizzle-orm";
+import { DrizzleQueryError } from "drizzle-orm/errors";
+import { drizzle, type NodePgClient, type NodePgQueryResultHKT } from "drizzle-orm/node-postgres";
+import { type PgDatabase, PgPreparedQuery } from "drizzle-orm/pg-core";
+import { Client, Pool } from "pg";
+import { inviteRequests } from "./db/company.ts";
+import { workflowStatus } from "./db/dbos.ts";
+import { applyMigrations, COMPANY_MIGRATIONS, migrationsApplied } from "./db/migrate.ts";
 import { warn } from "./log.ts";
 import { errorMessage } from "./shared.ts";
 
-// The runtime's own tables live in the config's database, beside DBOS's: the credentials, the
-// ledger, the collections' records, the wakeup's row, the operator agent's chats and the api tokens. What they
-// share is here: the one preparation of a database, a pool that opens once it is prepared and
-// survives a dropped connection, and a table creation two processes may race.
+// The runtime's own tables live in the config's database, beside DBOS's (`db/company.ts`). What
+// the stores share is here: Drizzle over a `pg` pool or connection (`databaseOn`), the one
+// preparation of a database, which applies the generated migrations under a lock, and a pool that
+// opens once it is prepared and survives a dropped connection.
 
-/** A connection or a pool: what the queries take. */
-export type Db = Pick<Pool | Client, "query">;
+/**
+ * A database, or a transaction on one (`db.transaction`): what every store takes, so a store runs
+ * inside a caller's transaction as it runs on its own. Made by `databaseOn`.
+ */
+export type Db = PgDatabase<NodePgQueryResultHKT>;
 
-/** Where the credentials set from the app live. */
-export const CREDENTIALS_TABLE = "sanoma_credentials";
-/** Where the Postgres ledger keeps its records. */
-export const LEDGER_TABLE = "sanoma_ledger";
-/** Where the collections keep their records (`collection.ts`): one row per collection and key, the record as JSON. */
-export const DATA_TABLE = "sanoma_data";
 /**
- * The instance's side of its wakeup: one row, made with the table. `at` is the deadline last
- * registered, `stopped_at` when the worker last stopped itself (the schedules backfill from it),
- * `last_error` why the last registration failed.
+ * Drizzle over `client`, a `pg` pool or connection the caller owns and ends (`db.$client`). Column
+ * names are the schema's properties in snake_case (`casing`), as the generated migrations write them.
+ *
+ * A statement that fails throws the `pg` error itself, as `client.query` would, not Drizzle's
+ * `DrizzleQueryError`, whose message carries the statement and its parameters (a credential's
+ * sealed value, a person's email, a record): `pgCode` reads the code, and no message or log
+ * repeats what was sent. `db.test.ts` holds Drizzle to this with a sentinel parameter.
  */
-export const WAKEUP_TABLE = "sanoma_wakeup";
-/** The operator agent's chats (`chats.ts`): who each is for, its engine and its draft. */
-export const CHATS_TABLE = "sanoma_chats";
-/** Each chat's messages, the AI SDK's UI messages as JSON, in `seq` order. */
-export const CHAT_MESSAGES_TABLE = "sanoma_chat_messages";
-/** The api tokens (`tokens.ts`): each one's SHA-256, never the token, whom it acts for, its groups, and when it was revoked. */
-export const API_TOKENS_TABLE = "sanoma_api_tokens";
+export function databaseOn<C extends NodePgClient>(client: C) {
+  rethrowCause();
+  return drizzle(client, { casing: "snake_case" });
+}
 
-/** The runtime's tables, each with the word the messages name it by. */
-const TABLES: readonly [what: string, ddl: string][] = [
-  [
-    "connection health",
-    `CREATE TABLE IF NOT EXISTS sanoma_connection_health (
-      connection_id text PRIMARY KEY, revision text NOT NULL, health text NOT NULL,
-      credential_version text, externally_renewed boolean NOT NULL, checked_at timestamptz NOT NULL DEFAULT now())`,
-  ],
-  [
-    "connection setup receipts",
-    `CREATE TABLE IF NOT EXISTS sanoma_connection_setups (
-      connection_id text NOT NULL, revision text NOT NULL, credential_version text NOT NULL,
-      PRIMARY KEY(connection_id, revision))`,
-  ],
-  [
-    "connections",
-    `CREATE TABLE IF NOT EXISTS sanoma_connections (
-    id text PRIMARY KEY, vendor text NOT NULL, method text NOT NULL, owner text, rule text,
-    account text NOT NULL, scopes jsonb NOT NULL, revision text NOT NULL, definition text NOT NULL,
-    credential text, location jsonb, status text NOT NULL DEFAULT 'connected', updated_by text NOT NULL,
-    updated_at timestamptz NOT NULL DEFAULT now());
-    ALTER TABLE sanoma_connections ADD COLUMN IF NOT EXISTS location jsonb`,
-  ],
-  [
-    "credentials",
-    // A table from before 0.10.0 (one row per name, each value sealed to its name alone) holds
-    // nothing 0.10.0 can read: it goes, and its credentials are set again.
-    // One table for the look and the drop: the one the name resolves to.
-    `DO $$ BEGIN
-      IF to_regclass('${CREDENTIALS_TABLE}') IS NOT NULL AND NOT EXISTS (
-        SELECT FROM pg_attribute
-        WHERE attrelid = to_regclass('${CREDENTIALS_TABLE}') AND attname = 'namespace' AND NOT attisdropped
-      ) THEN
-        DROP TABLE ${CREDENTIALS_TABLE};
-      END IF;
-    END $$; ` +
-      `CREATE TABLE IF NOT EXISTS ${CREDENTIALS_TABLE} (namespace text NOT NULL, name text NOT NULL, value text NOT NULL, ` +
-      "version text NOT NULL, set_by text NOT NULL, set_at timestamptz NOT NULL DEFAULT now(), PRIMARY KEY(namespace, name))",
-  ],
-  [
-    "ledger",
-    // `n` is the write order, `id` the record's, which the first write of takes, and `seq` the
-    // record's place in its run: a run reads in `seq` order, then write order.
-    `CREATE TABLE IF NOT EXISTS ${LEDGER_TABLE} (n bigserial PRIMARY KEY, id text NOT NULL UNIQUE, ` +
-      `run_id text NOT NULL, seq integer NOT NULL, record jsonb NOT NULL); ` +
-      `CREATE INDEX IF NOT EXISTS ${LEDGER_TABLE}_run_seq ON ${LEDGER_TABLE} (run_id, seq, n)`,
-  ],
-  [
-    "data",
-    `CREATE TABLE IF NOT EXISTS ${DATA_TABLE} (collection text NOT NULL, key text NOT NULL, record jsonb NOT NULL, ` +
-      "updated_at timestamptz NOT NULL DEFAULT now(), updated_by text NOT NULL, PRIMARY KEY (collection, key))",
-  ],
-  [
-    "wakeup",
-    `CREATE TABLE IF NOT EXISTS ${WAKEUP_TABLE} (id integer PRIMARY KEY CHECK (id = 1), at timestamptz, ` +
-      `stopped_at timestamptz, last_error text); INSERT INTO ${WAKEUP_TABLE} (id) VALUES (1) ON CONFLICT (id) DO NOTHING`,
-  ],
-  [
-    "chats",
-    `CREATE TABLE IF NOT EXISTS ${CHATS_TABLE} (id text PRIMARY KEY, person text NOT NULL, engine text NOT NULL, ` +
-      "draft_id text, title text NOT NULL, created_at timestamptz NOT NULL DEFAULT now()); " +
-      `CREATE INDEX IF NOT EXISTS ${CHATS_TABLE}_person ON ${CHATS_TABLE} (person, created_at)`,
-  ],
-  [
-    "chat messages",
-    `CREATE TABLE IF NOT EXISTS ${CHAT_MESSAGES_TABLE} (chat_id text NOT NULL REFERENCES ${CHATS_TABLE} (id) ` +
-      "ON DELETE CASCADE, id text NOT NULL, seq integer NOT NULL, message jsonb NOT NULL, PRIMARY KEY (chat_id, id))",
-  ],
-  [
-    "api tokens",
-    `CREATE TABLE IF NOT EXISTS ${API_TOKENS_TABLE} (id text PRIMARY KEY, hash text NOT NULL UNIQUE, ` +
-      "subject text NOT NULL, groups jsonb NOT NULL, created_at timestamptz NOT NULL DEFAULT now(), revoked_at timestamptz)",
-  ],
-];
+let rethrowing = false;
+
+/**
+ * Makes every prepared query of this copy of Drizzle throw the driver's error in place of
+ * `DrizzleQueryError` (drizzle-orm 0.45.4 wraps in `PgPreparedQuery.queryWithCache`, the one
+ * place every query passes). Once per copy of the module.
+ */
+function rethrowCause(): void {
+  if (rethrowing) return;
+  rethrowing = true;
+  const prototype = PgPreparedQuery.prototype as unknown as {
+    queryWithCache(this: unknown, ...args: unknown[]): Promise<unknown>;
+  };
+  const wrapped = prototype.queryWithCache;
+  prototype.queryWithCache = async function (...args) {
+    try {
+      return await wrapped.apply(this, args);
+    } catch (err) {
+      throw err instanceof DrizzleQueryError && err.cause !== undefined ? err.cause : err;
+    }
+  };
+}
 
 /** The Postgres error code of `err`, or an empty string when it has none. */
 export const pgCode = (err: unknown): string => (err as { code?: unknown } | null)?.code?.toString() ?? "";
@@ -145,22 +98,27 @@ export const DBOS_DATABASE_OPTIONS = { systemDatabaseIdleTransactionTimeoutMs: 0
  * `version`, so DBOS gives them to a worker of that version: those it stamped, each with its status
  * (a PENDING one is the caller's to queue again). DBOS has no call for it (a run's version is set at
  * its start, `forkWorkflow` makes a new id, `rewindWorkflow` takes only an ended run), so this is the
- * runtime's one write to DBOS's own tables, in its schema `dbos` (dbos-sdk 5.2.11). One statement:
- * of two workers stamping a run, one does.
+ * runtime's one write to DBOS's own tables (`db/dbos.ts`, dbos-sdk 5.2.11). One statement: of two
+ * workers stamping a run, one does.
  */
 export async function stampVersion(
   db: Db,
   ids: readonly string[],
   version: string,
 ): Promise<{ id: string; pending: boolean }[]> {
-  const { rows } = await db.query<{ workflow_uuid: string; status: string }>(
-    `UPDATE dbos.workflow_status SET application_version = $1
-     WHERE workflow_uuid = ANY($2) AND name = 'change' AND status IN ('PENDING', 'ENQUEUED')
-       AND application_version <> $1
-     RETURNING workflow_uuid, status`,
-    [version, ids],
-  );
-  return rows.map((r) => ({ id: r.workflow_uuid, pending: r.status === "PENDING" }));
+  const stamped = await db
+    .update(workflowStatus)
+    .set({ applicationVersion: version })
+    .where(
+      and(
+        inArray(workflowStatus.workflowUuid, [...ids]),
+        eq(workflowStatus.name, "change"),
+        inArray(workflowStatus.status, ["PENDING", "ENQUEUED"]),
+        ne(workflowStatus.applicationVersion, version),
+      ),
+    )
+    .returning({ id: workflowStatus.workflowUuid, status: workflowStatus.status });
+  return stamped.map((r) => ({ id: r.id, pending: r.status === "PENDING" }));
 }
 
 /**
@@ -187,37 +145,45 @@ const INSUFFICIENT_PRIVILEGE = "42501";
 /** Postgres's code for a database that is not there (`invalid_catalog_name`). */
 const NO_DATABASE = "3D000";
 
-/** A pool opened on first use, once its database is prepared, and ended by `close`. */
-export interface LazyPool {
-  db(): Promise<Pool>;
+/** A database opened on first use, once prepared, and ended by `close`. */
+export interface LazyDb {
+  db(): Promise<Db>;
+  /** The pool `db()` runs on, once the database is prepared. */
+  pool(): Promise<Pool>;
   close(): Promise<void>;
 }
 
 /**
- * A pool for `what` on the database at `databaseUrl`, opened on the first `db()` once the
- * database is prepared (`prepareDatabase`). A preparation that fails lets the pool go, so the
- * next `db()` tries again. `close` ends the pool, for good: a `db()` after it is refused.
+ * A database for `what` on a pool at `databaseUrl`, opened on the first `db()` (or `pool()`) once
+ * the database is prepared (`prepareDatabase`). A preparation that fails lets the pool go, so the
+ * next call tries again. `close` ends the pool, for good: a call after it is refused.
  */
-export function lazyPool(databaseUrl: string, what: string): LazyPool {
+export function lazyDb(databaseUrl: string, what: string): LazyDb {
   let pool: Pool | undefined;
+  let db: Db | undefined;
   let closed = false;
+  async function opened(): Promise<Pool> {
+    if (closed) throw new Error(`the ${what} store is closed`);
+    const current = (pool ??= openPool(databaseUrl, what));
+    try {
+      await prepareDatabase(databaseUrl);
+    } catch (err) {
+      if (pool === current) pool = db = undefined;
+      await current.end().catch(() => undefined);
+      throw err;
+    }
+    return current;
+  }
   return {
     async db() {
-      if (closed) throw new Error(`the ${what} store is closed`);
-      const current = (pool ??= openPool(databaseUrl, what));
-      try {
-        await prepareDatabase(databaseUrl);
-      } catch (err) {
-        if (pool === current) pool = undefined;
-        await current.end().catch(() => undefined);
-        throw err;
-      }
-      return current;
+      const current = await opened();
+      return (db ??= databaseOn(current));
     },
+    pool: opened,
     async close() {
       closed = true;
       const current = pool;
-      pool = undefined;
+      pool = db = undefined;
       await current?.end();
     },
   };
@@ -243,9 +209,10 @@ export function checkPreparedOnly(by: string): void {
  * Makes the database at `databaseUrl` ready for the runtime, once per process and URL: the
  * database itself and DBOS's tables when they are not there yet (as a worker's launch makes
  * them; credentials may be set, and a ledger read, before any worker has run), then the
- * credentials, ledger, data, wakeup and chat tables, and its idle-transaction timeout (`guardIdleTransactions`).
- * Two processes preparing one database both succeed: the second waits for the first
- * (`lockPreparation`). A preparation that fails is forgotten, so the next call tries again.
+ * runtime's tables, by the migrations the database has not had (`COMPANY_MIGRATIONS`), and its
+ * idle-transaction timeout (`guardIdleTransactions`). Two processes preparing one database both
+ * succeed: the second waits for the first (`lockPreparation`). A preparation that fails is
+ * forgotten, so the next call tries again.
  */
 export function prepareDatabase(databaseUrl: string): Promise<void> {
   let preparing = prepared.get(databaseUrl);
@@ -265,33 +232,48 @@ const unprepared = (err: unknown): Error =>
   new Error(`could not prepare the database: ${errorMessage(err)}`, { cause: err });
 
 async function prepare(databaseUrl: string): Promise<void> {
-  const conn = await lockPreparation(databaseUrl).catch((err: unknown) => {
-    throw unprepared(err);
-  });
-  try {
+  await underPreparationLock(databaseUrl, async (db) => {
     await DBOS.migrate(databaseUrl).catch((err: unknown) => {
       // A DBOS table made meanwhile by a release from before the lock, mid-upgrade: it is there.
       if (!madeAlready(err)) throw unprepared(err);
     });
-    for (const [what, ddl] of TABLES) await createTable(conn, ddl, what);
-    await guardIdleTransactions(conn);
+    await applyMigrations(db, COMPANY_MIGRATIONS).catch((err: unknown) => {
+      throw unprepared(err);
+    });
+    await guardIdleTransactions(db);
+  });
+}
+
+/**
+ * Runs `make` on a connection holding the preparation's session lock of the database at
+ * `databaseUrl` (made first when missing), so a second process waits, then finds everything made.
+ * For what makes a database's tables: `prepareDatabase`, and the wakeup service's own.
+ */
+export async function underPreparationLock<T>(databaseUrl: string, make: (db: Db) => Promise<T>): Promise<T> {
+  const db = await lockPreparation(databaseUrl).catch((err: unknown) => {
+    throw unprepared(err);
+  });
+  try {
+    return await make(db);
   } finally {
     // Ending the session releases the lock; a failure to end it must not hide the preparation's.
-    await conn.end().catch(() => undefined);
+    await db.$client.end().catch(() => undefined);
   }
 }
 
-/** The last of the runtime's tables a preparation makes (`TABLES`), so its being there says they all are. */
-const LAST_TABLE = API_TOKENS_TABLE;
-
-/** Refuses when the database at `databaseUrl` lacks DBOS's tables or the runtime's: `by` makes them, not this process. */
+/**
+ * Refuses when the database at `databaseUrl` lacks DBOS's tables or the runtime's (every
+ * migration of `COMPANY_MIGRATIONS`, by its journal): `by` makes them, not this process.
+ */
 async function checkPrepared(databaseUrl: string, by: string): Promise<void> {
   const conn = await connect(databaseUrl);
   try {
-    const { rows } = await conn.query<{ dbos: boolean; ours: boolean }>(
-      `SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS dbos, to_regclass('${LAST_TABLE}') IS NOT NULL AS ours`,
+    const db = databaseOn(conn);
+    const { rows } = await db.execute<{ dbos: boolean }>(
+      sql`SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS dbos`,
     );
-    const { dbos, ours } = rows[0]!;
+    const dbos = rows[0]?.dbos === true;
+    const ours = await migrationsApplied(db, COMPANY_MIGRATIONS);
     if (!dbos || !ours) {
       const missing = [...(dbos ? [] : ["DBOS's"]), ...(ours ? [] : ["Sanoma's"])].join(" and ");
       throw new Error(`the database has no ${missing} tables yet: ${by} makes them, and this process never does`);
@@ -304,19 +286,20 @@ async function checkPrepared(databaseUrl: string, by: string): Promise<void> {
 /**
  * A connection to the database at `databaseUrl` (made first when missing) holding the
  * preparation's session lock until it ends, so a second process waits, then finds everything
- * made. Racing `DBOS.migrate`s lose to each other in many ways (40P01, XX000), so the race is
- * prevented rather than each loss forgiven. The lock is polled, never waited for by a blocked
- * statement: `CREATE INDEX CONCURRENTLY` waits on that statement's snapshot, a deadlock Postgres
- * cannot see (the lock's holder is this connection, not the migration's).
+ * made. Racing `DBOS.migrate`s lose to each other in many ways (40P01, XX000), and Drizzle's
+ * migrator takes no lock of its own, so the race is prevented rather than each loss forgiven.
+ * The lock is polled, never waited for by a blocked statement: `CREATE INDEX CONCURRENTLY` waits
+ * on that statement's snapshot, a deadlock Postgres cannot see (the lock's holder is this
+ * connection, not the migration's).
  */
-async function lockPreparation(databaseUrl: string): Promise<Client> {
-  const conn = await connectMaking(databaseUrl);
+async function lockPreparation(databaseUrl: string) {
+  const db = databaseOn(await connectMaking(databaseUrl));
   try {
-    const ask = "SELECT pg_try_advisory_lock(hashtext('sanoma.prepareDatabase')) AS locked";
-    while (!(await conn.query<{ locked: boolean }>(ask)).rows[0]!.locked) await delay(50);
-    return conn;
+    const ask = sql`SELECT pg_try_advisory_lock(hashtext('sanoma.prepareDatabase')) AS locked`;
+    while ((await db.execute<{ locked: boolean }>(ask)).rows[0]?.locked !== true) await delay(50);
+    return db;
   } catch (err) {
-    await conn.end().catch(() => undefined);
+    await db.$client.end().catch(() => undefined);
     throw err;
   }
 }
@@ -348,7 +331,7 @@ async function createDatabase(databaseUrl: string): Promise<void> {
   url.pathname = "/postgres";
   const admin = await connect(url.toString());
   try {
-    await admin.query(`CREATE DATABASE ${escapeIdentifier(name)}`);
+    await databaseOn(admin).execute(sql`CREATE DATABASE ${sql.identifier(name)}`);
   } catch (err) {
     if (!madeAlready(err)) throw err;
   } finally {
@@ -364,13 +347,13 @@ async function createDatabase(databaseUrl: string): Promise<void> {
  */
 async function guardIdleTransactions(db: Db): Promise<void> {
   try {
-    await db.query(`DO $$ BEGIN
+    await db.execute(sql`DO $$ BEGIN
       IF current_setting('idle_in_transaction_session_timeout') = '0' AND NOT EXISTS (
         SELECT FROM pg_db_role_setting s JOIN pg_database d ON d.oid = s.setdatabase, unnest(s.setconfig) c
         WHERE d.datname = current_database() AND s.setrole = 0 AND c LIKE 'idle_in_transaction_session_timeout=%'
       ) THEN
         EXECUTE format('ALTER DATABASE %I SET idle_in_transaction_session_timeout = %L', current_database(),
-          '${IDLE_IN_TRANSACTION_TIMEOUT}');
+          ${sql.raw(`'${IDLE_IN_TRANSACTION_TIMEOUT}'`)});
       END IF;
     END $$`);
   } catch (err) {
@@ -379,32 +362,18 @@ async function guardIdleTransactions(db: Db): Promise<void> {
 }
 
 /**
- * Runs `ddl` (`CREATE TABLE IF NOT EXISTS`, and the like) on `db`. Two processes racing to create
- * the same table both succeed; any other failure names the `what` table, with its cause.
+ * Marks a sealed invite request's `nonce` spent until `expiresAt`, when the row goes: true the
+ * first time, false for one spent already, whichever process asks. A row, not memory: the app
+ * keeps nothing across requests.
  */
-export async function createTable(db: Db, ddl: string, what: string): Promise<void> {
-  try {
-    await db.query(ddl);
-  } catch (err) {
-    if (madeAlready(err)) return;
-    throw new Error(`could not prepare the ${what} table: ${errorMessage(err)}`, { cause: err });
-  }
-}
-
-// The wakeup row's writes: one worker registers per instance (the supervisor runs one at a time,
-// and a deploy stops the old container before the new one starts), so none names a worker.
-
-/** Records that the wakeup took `at`. */
-export async function recordWakeupRegistration(db: Db, at: string): Promise<void> {
-  await db.query(`UPDATE ${WAKEUP_TABLE} SET at = $1, last_error = NULL WHERE id = 1`, [at]);
-}
-
-/** Records why the last registration failed. */
-export async function recordWakeupError(db: Db, error: string): Promise<void> {
-  await db.query(`UPDATE ${WAKEUP_TABLE} SET last_error = $1 WHERE id = 1`, [error]);
-}
-
-/** Records that the worker stops itself now. */
-export async function recordWakeupStop(db: Db): Promise<void> {
-  await db.query(`UPDATE ${WAKEUP_TABLE} SET stopped_at = now() WHERE id = 1`);
+export async function spendInviteRequest(db: Db, nonce: string, expiresAt: Date): Promise<boolean> {
+  // Rows go an hour after they expire, not at it: the app's clock decides when a request is
+  // past, and a database clock ahead of it must not forget a nonce the app still accepts.
+  await db.delete(inviteRequests).where(lte(inviteRequests.expiresAt, sql`now() - interval '1 hour'`));
+  const spent = await db
+    .insert(inviteRequests)
+    .values({ nonce, expiresAt })
+    .onConflictDoNothing({ target: inviteRequests.nonce })
+    .returning({ nonce: inviteRequests.nonce });
+  return spent.length === 1;
 }

package/src/deadlines.ts

@@ -1,8 +1,10 @@
 import { randomUUID } from "node:crypto";
 import { DBOS } from "@dbos-inc/dbos-sdk";
 import { dbosStatusesOf } from "./client.ts";
+import { eq, sql } from "drizzle-orm";
+import type { PgUpdateSetSource } from "drizzle-orm/pg-core";
 import type { Db } from "./db.ts";
-import { recordWakeupError, recordWakeupRegistration, recordWakeupStop } from "./db.ts";
+import { wakeup as wakeupRow } from "./db/company.ts";
 import type { ResolvedConfig } from "./config.ts";
 import { warn } from "./log.ts";
 import type { CallContext, DriverFn, Op } from "./op.ts";
@@ -171,22 +173,26 @@ export function stopWhenIdle(rule: StopRule): { close(): void } {
     if (!(await rule.idle())) return false;
     const next = rule.deadlines.nextDeadline();
     const at = next?.toISOString() ?? null;
+    // The wakeup row's writes: one worker registers per instance (the supervisor runs one at a
+    // time, and a deploy stops the old container before the new one starts), so none names a worker.
     const db = await rule.db();
+    const record = (set: PgUpdateSetSource<typeof wakeupRow>) =>
+      db.update(wakeupRow).set(set).where(eq(wakeupRow.id, 1));
     if (at !== null) {
       try {
         await rule.register({ at });
       } catch (err) {
         const message = errorMessage(err);
-        await recordWakeupError(db, message);
+        await record({ lastError: message });
         problem(`could not register the wakeup at ${at}, so the worker keeps running: ${message}`);
         return false;
       }
-      await recordWakeupRegistration(db, at);
+      await record({ at: new Date(at), lastError: null });
     }
     lastProblem = undefined;
     if (closed || !(await rule.idle()) || rule.deadlines.nextDeadline()?.toISOString() !== next?.toISOString())
       return false;
-    await recordWakeupStop(db);
+    await record({ stoppedAt: sql`now()` });
     await rule.stop().catch((err: unknown) => warn(`the worker could not stop cleanly: ${errorMessage(err)}`));
     rule.onStopped?.({ at });
     return true;

package/src/deployment-key.ts

@@ -1,19 +1,27 @@
 import { hkdfSync } from "node:crypto";
-import { readFileSync } from "node:fs";
 
 /** The deployment's own keys: bound only to the environment or bootstrap, never written by the runtime. */
 export const DEPLOYMENT_KEYS: readonly string[] = ["SANOMA_SIGNING_KEY", "SANOMA_SECRETS_KEY"];
 export type DeploymentKeyName = "SANOMA_SIGNING_KEY" | "SANOMA_SECRETS_KEY";
 
-/** Bootstrap only: never resolves through the secret store that the key unlocks. */
+/**
+ * Bootstrap only: never resolves through the secret store that the key unlocks. `<name>` from the
+ * environment, or the file `<name>_FILE` names where there is a file system.
+ */
 export function deploymentKey(name: DeploymentKeyName, env: NodeJS.ProcessEnv = process.env): Buffer {
   const value = env[name];
   const file = env[`${name}_FILE`];
   if (value && file) throw new Error(`Set only one of ${name} and ${name}_FILE`);
   let encoded = value;
   if (file) {
+    // Node's `fs` where there is a file system (Node), found at the call rather than imported:
+    // workerd has no files to mount a key in, so there a `_FILE` input is refused.
+    const fs = (globalThis.process as { getBuiltinModule?: (id: string) => unknown } | undefined)?.getBuiltinModule?.(
+      "node:fs",
+    ) as typeof import("node:fs") | undefined;
+    if (!fs) throw new Error(`${name}_FILE names a file, and this host has no file system: set ${name}`);
     try {
-      encoded = readFileSync(file, "utf8").trim();
+      encoded = fs.readFileSync(file, "utf8").trim();
     } catch {
       throw new Error(`${name}_FILE could not be read`);
     }

package/src/host-derive.ts

@@ -418,9 +418,28 @@ async function publicOnGithub(repository: string): Promise<boolean | undefined>
   }
 }
 
+/** What `hostFacts` reads from the company's root: the installed `sanoma`, `origin` and the public sites' domains. */
+export type HostRootFacts = Pick<HostFacts, "version" | "origin" | "domains">;
+
 /**
- * What the declared hosts that derive (`deriveHosts`) are filled from, read now: the installed
- * `sanoma`, `origin`, the public sites' domains, and of `secrets` (none outside a run) which
+ * The root's part of the hosts' facts (`HostRootFacts`), read now: the `sanoma` the repository
+ * installs, `origin` (git, with no credentials) and the public sites' domains. Node only, where
+ * the root is; a bundle carries them as read (the app's snapshot).
+ */
+export async function hostRootFacts(root: string): Promise<HostRootFacts> {
+  const { siteDomains } = await import("./sites.ts");
+  const [version, origin] = await Promise.all([installedSanoma(root), originUrl(root)]);
+  return {
+    ...(version !== undefined && { version }),
+    ...(origin !== undefined && { origin }),
+    domains: siteDomains(root),
+  };
+}
+
+/**
+ * What the declared hosts that derive (`deriveHosts`) are filled from: the root's facts
+ * (`rootFacts`, asked only when a declared host derives: `hostRootFacts`, or a snapshot's), and of
+ * `secrets` (none outside a run) which
  * optional credentials, App keys and source key are stored, and which credentials the drivers
  * read from this machine's environment alone (`unbound`). With `mint` (apply, never drift or a
  * sandbox run), the source key (where the config has the deploy-key type) and, when a wakeup is
@@ -429,7 +448,7 @@ async function publicOnGithub(repository: string): Promise<boolean | undefined>
  * Undefined when no declared host derives.
  */
 export async function hostFacts(options: {
-  root: string;
+  rootFacts: () => Promise<HostRootFacts>;
   resources: readonly DeclaredResource[];
   types: ReadonlyMap<string, Resource>;
   drivers: ReadonlyMap<string, Driver>;
@@ -441,7 +460,7 @@ export async function hostFacts(options: {
   sender?: string;
   mint: boolean;
 }): Promise<HostFacts | undefined> {
-  const { root, resources, types, drivers, secrets, mint } = options;
+  const { rootFacts, resources, types, drivers, secrets, mint } = options;
   const typeOf = (r: DeclaredResource) => types.get(`${r.vendor}.${r.type}`);
   const deriving = resources.filter((r) => typeOf(r)?.host?.derives);
   if (!deriving.length) return undefined;
@@ -466,10 +485,8 @@ export async function hostFacts(options: {
   const githubApp = [...(await stored(Object.values(GITHUB_APP)))];
   if (mint && secrets && hosts.some((h) => wokenBy(h, resources, types))) await mintWakeupToken(secrets);
   const keyed = types.has(DEPLOY_KEY_TYPE);
-  const { siteDomains } = await import("./sites.ts");
-  const [version, origin, sourceKey] = await Promise.all([
-    installedSanoma(root),
-    originUrl(root),
+  const [{ version, origin, domains }, sourceKey] = await Promise.all([
+    rootFacts(),
     secrets && hosts.length && keyed ? sourceKeyOf(secrets, mint) : undefined,
   ]);
   // What a host may clone: `origin`, else the `source` it declares (with no deploy-key type, no
@@ -489,7 +506,7 @@ export async function hostFacts(options: {
   return {
     ...(version !== undefined && { version }),
     ...(origin !== undefined && { origin }),
-    domains: siteDomains(root),
+    domains,
     builtInStore: options.builtInStore,
     carried,
     ...(unbound.size > 0 && { unbound }),