@sanoma-ai/workflows 0.11.2 → 0.11.4

package/src/apply-steps.ts

@@ -46,19 +46,19 @@ async function lastWritten(appName: string): Promise<Bindings | undefined> {
 
 /**
  * The apply workflow's steps for a config: `read`, the data files and the lockfile as drift reads
- * them, under `root`; `appName` scopes the search for the lockfile apply last wrote.
+ * them, under `root`, minting what a deriving host is given; `appName` scopes the search for the lockfile apply last wrote.
  */
 export function applySteps(
   appName: string,
   root: string | undefined,
-  read: () => Promise<Omit<ApplyDeclared, "rebinds">>,
+  read: (options?: { mint?: boolean }) => Promise<Omit<ApplyDeclared, "rebinds">>,
 ): ApplySteps {
   return {
     // The data files, and the lockfile against the one apply last wrote: a change someone else made.
     declared: () =>
       DBOS.runStep(
         async () => {
-          const declared = await read();
+          const declared = await read({ mint: true });
           const before = await lastWritten(appName);
           return { ...declared, rebinds: before ? diffLockfiles(before, declared.bindings) : [] };
         },
@@ -86,7 +86,7 @@ export function applySteps(
     // The one binding changed on the lockfile as it is now, written whole, then committed, in one
     // step whose output is what it wrote. A sandbox run keeps its lockfile in memory: the run's
     // report has it.
-    write: async (key: string, binding: Binding | undefined, message: string) => {
+    write: async (key: string, binding: Binding | undefined, message: string, moved?: string) => {
       const run = runNow();
       if (run.sandbox !== undefined || root === undefined) return { written: false };
       const { source } = run.state;
@@ -95,6 +95,7 @@ export function applySteps(
           const now = readLockfile(root);
           if (now.problems.length) throw new Error(`${LOCKFILE} cannot be updated: ${now.problems[0]!.message}`);
           const { [key]: _, ...others } = now.bindings;
+          if (moved !== undefined) delete others[moved];
           const bindings = binding ? { ...others, [key]: binding } : others;
           writeLockfile(root, bindings);
           const paths = [

package/src/apply.ts

@@ -10,12 +10,13 @@ import {
   importsOf,
   observeBy,
   observed,
+  refOf,
   type ResolveOp,
   type Revision,
   sourceUrl,
 } from "./drift.ts";
 import { isRunControlError } from "./errors.ts";
-import { type HostOutputs, wakeUrlOf } from "./host.ts";
+import { detaching, type HostOutputs, wakeUrlOf } from "./host.ts";
 import type { Binding, Bindings, Rebind } from "./lockfile.ts";
 import type { Op } from "./op.ts";
 import {
@@ -72,7 +73,13 @@ export type ApplyInput = z.infer<typeof ApplyInput>;
 export type PlanStep = { id: string; vendor: string; type: string; connection?: ConnectionRef } & (
   | { action: "create"; planned: Record<string, unknown>; unknown: string[] }
   | { action: "update" | "replace"; binding: string; fields: DriftField[]; replace: string[]; unknown?: string[] }
-  | { action: "bind"; binding: string; source: "found" | "given" }
+  | {
+      action: "bind";
+      binding: string;
+      source: "found" | "given";
+      /** The orphaned lockfile key that held the object found, whose binding the declaration takes over. */
+      from?: string;
+    }
   | { action: "gone"; binding: string; answer?: PlanAnswer }
   | { action: "orphan"; key: string; binding: string; answer?: PlanAnswer }
   | { action: "none"; binding: string }
@@ -113,6 +120,8 @@ export interface ApplyReport {
 export interface ApplyDeclared extends DriftDeclared {
   bindings: Bindings;
   orphans: (Binding & { key: string })[];
+  /** The declarations left out with a problem (a host that derives, which apply cannot give all it needs), which an input may still name. */
+  leftOut?: string[];
   rebinds: Rebind[];
 }
 
@@ -133,7 +142,13 @@ export interface ApplySteps {
    * another run made since this one read it stays, and commits it with `message`; a sandbox run
    * writes nothing.
    */
-  write(key: string, binding: Binding | undefined, message: string): Promise<{ written: boolean; revision?: string }>;
+  /** Writes `key`'s binding (none: removed), and removes `moved`, the key it moved from, in the same commit. */
+  write(
+    key: string,
+    binding: Binding | undefined,
+    message: string,
+    moved?: string,
+  ): Promise<{ written: boolean; revision?: string }>;
 }
 
 type State = Record<string, unknown>;
@@ -193,7 +208,7 @@ interface Known {
   /** The lockfile's bindings, as the run has changed them so far. */
   bindings: Bindings;
   /** The clone URL and commit a host wanted runs. */
-  hosts: ReadonlyMap<string, { source: string; revision: string }>;
+  hosts: ReadonlyMap<string, { source: string; revision: string; ref: string }>;
   /** Where each host's wakeup reaches it, as its state says (`wakeUrl`, else `url`). */
   urls: ReadonlyMap<string, string>;
   /**
@@ -232,11 +247,12 @@ function desiredOf(
     const named = holderOf(out, wakeup.inputs.host);
     if (url && named) named.holder[named.key] = url;
   }
-  // A host is given its source's clone URL and the commit its ref names now.
+  // A host is given its source's clone URL, its ref (the default branch when it names none) and the commit it names now.
   const run = hosts.get(r.id);
   if (host && run) {
     for (const [path, value] of [
       [host.inputs.source, run.source],
+      [host.inputs.ref, run.ref],
       [host.revision, run.revision],
     ] as const) {
       const place = holderOf(out, path);
@@ -263,7 +279,7 @@ const cannotChange = (type: Pick<Resource, "vendor" | "type" | "writable"> | und
 const unknown = (what: string, list: readonly string[], known: (id: string) => boolean): ResourceProblem[] =>
   list.filter((id) => !known(id)).map((id) => ({ message: `${what}: ${id} is no declared resource` }));
 
-/** What the input names that is neither declared nor an orphaned binding. */
+/** What the input names that is neither declared nor an orphaned binding (nor a declaration left out with a problem). */
 function inputProblems(
   input: ApplyInput,
   ids: ReadonlyMap<string, unknown>,
@@ -352,6 +368,32 @@ function fromPlan(
   return { problem: problemOf(r.id, `the vendor plans to ${p.action} it, which apply does not do here`) };
 }
 
+/**
+ * An object found by its identity that an orphaned binding holds is that binding moved (an export
+ * renamed, a deploy key apply declares now): its `bind` step takes the binding over (`from`), and
+ * the orphan is none. The orphaned keys taken over.
+ */
+function takeOver(
+  planned: PlanStep[],
+  orphans: ApplyDeclared["orphans"],
+  types: ReadonlyMap<string, Resource>,
+): Set<string> {
+  const taken = new Set<string>();
+  for (const step of planned) {
+    if (step.action !== "bind" || step.source !== "found") continue;
+    const type = `${step.vendor}.${step.type}`;
+    const held = orphans.find(
+      (o) =>
+        !taken.has(o.key) && o.id === step.binding && (o.type === type || types.get(type)?.formerly?.includes(o.type)),
+    );
+    if (held) {
+      step.from = held.key;
+      taken.add(held.key);
+    }
+  }
+  return taken;
+}
+
 /** Each orphaned binding the input wants, after the declarations, and the answers that cannot be done. */
 function orphansOf(
   orphans: ApplyDeclared["orphans"],
@@ -444,8 +486,9 @@ const exportOf = (key: string) => key.slice(key.indexOf("#") + 1);
 function messageOf(step: PlanStep, before: Binding | undefined, after: Binding | undefined): string {
   const key = keyOf(step);
   if (!after) return `Apply: unbind ${key} (${before?.type} ${before?.id})`;
-  const what = runOf(step) === "create" ? "create" : before ? "rebind" : "bind";
-  return `Apply: ${what} ${key} (${after.type} ${after.id})`;
+  const from = step.action === "bind" ? step.from : undefined;
+  const what = runOf(step) === "create" ? "create" : before || from ? "rebind" : "bind";
+  return `Apply: ${what} ${key} (${after.type} ${after.id})${from ? `, from ${from}` : ""}`;
 }
 
 /**
@@ -518,10 +561,11 @@ export function applyWorkflow(
       ...(hooks.length ? (["sleep"] as const) : []),
     ],
     run: async (ctx, input) => {
-      const { resources, problems: read, bindings: locked, orphans, rebinds } = await steps.declared();
+      const { resources, problems: read, bindings: locked, orphans, rebinds, leftOut } = await steps.declared();
       const wanted = (id: string) => input.only === undefined || input.only.includes(id);
       const declarations = new Map(resources.map((r) => [r.id, r]));
-      const problems = [...read, ...inputProblems(input, declarations, new Set(orphans.map((o) => o.key)))];
+      const nameable = new Set([...orphans.map((o) => o.key), ...(leftOut ?? [])]);
+      const problems = [...read, ...inputProblems(input, declarations, nameable)];
       // Observed as drift does, every import first, by the binding given before the lockfile's.
       const found = new Map<string, Found>();
       for (const resource of resources) {
@@ -566,19 +610,19 @@ export function applyWorkflow(
       // A host wanted runs the commit its ref names now, resolved before planning: a merge is a change
       // to it. One bound by the input needs none.
       const revisions = new Map<string, Revision>();
-      const hosts = new Map<string, { source: string; revision: string }>();
+      const hosts = new Map<string, { source: string; revision: string; ref: string }>();
       for (const { id, vendor, type, desired, refs } of resources.filter(
         (r) => wanted(r.id) && input.bind?.[r.id] === undefined,
       )) {
         const resource = types.get(`${vendor}.${type}`);
         const host = resource?.host;
         const source = host && sourceUrl(desired, refs[host.inputs.source], resource, found);
-        const ref = host && valueAt(desired, host.inputs.ref);
-        if (host && source !== undefined && typeof ref === "string" && ref) {
+        const ref = host && refOf(desired, host);
+        if (host && source !== undefined && ref !== undefined) {
           try {
-            const { revision } = await ctx.sanoma!.source!.resolve({ url: source, ref });
-            revisions.set(id, { revision });
-            hosts.set(id, { source, revision });
+            const resolved = await ctx.sanoma!.source!.resolve({ url: source, ...(ref ? { ref } : {}) });
+            revisions.set(id, { revision: resolved.revision });
+            hosts.set(id, { source, ...resolved });
           } catch (err) {
             if (isRunControlError(err)) throw err;
             revisions.set(id, { error: errorMessage(err) });
@@ -633,10 +677,19 @@ export function applyWorkflow(
         if (left.length < unfilled.length) awaited.add(resource.id);
         const unresolved = revisions.get(resource.id);
         // A host whose ref could not be resolved has no commit to run (compare says so only for one it found).
-        const next =
-          unresolved && "error" in unresolved && result.status !== "error"
+        const now = found.get(resource.id)!;
+        const host = types.get(`${resource.vendor}.${resource.type}`)?.host;
+        const attached = host && "state" in now ? detaching(host, fields, now.state) : [];
+        const next = attached.length
+          ? {
+              problem: problemOf(
+                resource.id,
+                `${attached.join(", ")} ${attached.length > 1 ? "are" : "is"} attached and no site declares a domain, so a change would detach ${attached.length > 1 ? "them" : "it"}: put \`domain\` on each site, \`defineSite({ public: true, domain })\` in sites/<site>/site.ts`,
+              ),
+            }
+          : unresolved && "error" in unresolved && result.status !== "error"
             ? { problem: problemOf(resource.id, unresolved.error) }
-            : decide(resource, result, found.get(resource.id)!, input, fields, types, usable);
+            : decide(resource, result, now, input, fields, types, usable);
         if (next.ask !== undefined) {
           try {
             const answered = await ctx[resource.vendor]![resource.type]!.plan(next.ask, {
@@ -653,7 +706,14 @@ export function applyWorkflow(
         if (next.step) add(next.step);
         if (next.problem) problems.push(next.problem);
       }
-      const orphaned = orphansOf(orphans, input, wanted, usable, types);
+      const taken = takeOver(planned, orphans, types);
+      const orphaned = orphansOf(
+        orphans.filter((o) => !taken.has(o.key)),
+        input,
+        wanted,
+        usable,
+        types,
+      );
       const plan: ApplyPlan = {
         problems: [...problems, ...orphaned.problems],
         rebinds,
@@ -734,13 +794,16 @@ export function applyWorkflow(
           } else if (todo === "delete") {
             await ctx[step.vendor]![step.type]!.delete({ id: binding }, { connection: step.connection });
             delete bindings[key];
-          } else if (todo === "bind")
+          } else if (todo === "bind") {
             bindings[key] = { type, id: binding, ...(step.connection && { connection: step.connection }) };
-          else if (todo === "forget") delete bindings[key];
+            if (step.action === "bind" && step.from) delete bindings[step.from];
+          } else if (todo === "forget") delete bindings[key];
           if (state && declared) keep(declared, state);
           const after = bindings[key];
-          if (after?.id !== before?.id) {
-            const wrote = await steps.write(key, after, messageOf(step, before, after));
+          // A new id, or the same object under its type's new name (`formerly`): written.
+          if (after?.id !== before?.id || (after && before && after.type !== before.type)) {
+            const moved = step.action === "bind" ? step.from : undefined;
+            const wrote = await steps.write(key, after, messageOf(step, before, after), moved);
             written ||= wrote.written;
             revision = wrote.revision ?? revision;
           }

package/src/bundled.ts

@@ -0,0 +1,42 @@
+import type { DeclaredPeople } from "./resources.ts";
+
+// What the runtime reads from a company's root that a bundle carries where the root's files are
+// not: the Cloudflare host's Worker, which serves the public sites without the working tree. Read
+// once beside the files (`readRootSnapshot` in `config.ts`), bundled as data, and registered for
+// the root it was read from (`useRootSnapshot`); `readPeople`, `readPolicyFiles`, the app's name
+// and its versions then answer from it for that root, and never read a file there.
+
+/** A root's people, policies, app name and versions, as read where its files are. */
+export interface RootSnapshot {
+  /** The app's name, from the root's `package.json` (`sanoma` without one). */
+  appName: string;
+  /** `ResolvedConfig.version`: a hash of the workflows' source, which a bundle's code is not, so a run it queues is its worker's. */
+  version: string;
+  /** `ResolvedConfig.changeCode`, for the same reason. */
+  changeCode: string;
+  /** `readPolicyFiles`: each `.cedar` file under `policies/` (and an app's), by path from the root. */
+  policies: { file: string; text: string }[];
+  /** `readPeople`: the people, agents and groups the data files declare, with their problems. */
+  people: DeclaredPeople;
+}
+
+const snapshots = new Map<string, RootSnapshot>();
+
+/** From now on, `root`'s people, policies, app name and versions are `snapshot`'s, not its files'. */
+export function useRootSnapshot(root: string, snapshot: RootSnapshot): void {
+  snapshots.set(root, snapshot);
+}
+
+/** The snapshot registered for `root`, if any. */
+export const rootSnapshot = (root: string | undefined): RootSnapshot | undefined =>
+  root === undefined ? undefined : snapshots.get(root);
+
+/**
+ * Where a bundle says which company file it is evaluating (the Worker's build sets it at the top
+ * of each), for `callerFile` where V8's call sites name no file: a workflow's `file`, and a
+ * collection's app, are the file's that defined them.
+ */
+export const BUNDLED_FILE: unique symbol = Symbol.for("sanoma.file") as never;
+
+/** The company file a bundle is evaluating now, if it says. */
+export const bundledFile = (): string | undefined => (globalThis as { [BUNDLED_FILE]?: string })[BUNDLED_FILE];

package/src/cedar.ts

@@ -20,6 +20,7 @@ import {
   type PreviewRequest,
   VISITOR_DENIED,
 } from "./policy.ts";
+import { rootSnapshot } from "./bundled.ts";
 import { admit, readPeople } from "./resources.ts";
 import { cedarValue, cedarWasm, contextTypeOf, messageOf, NAMESPACE, schemaOf, shapeOf } from "./schema.ts";
 import {
@@ -89,8 +90,13 @@ const ON_BEHALF_OF = "on-behalf-of";
 
 type Place = { line: number; column: number };
 
-/** `<root>/policies/**\/*.cedar`, then each app's `apps/<app>/policies/**\/*.cedar`, sorted by path in each, each relative to the root with `/` between its parts. */
+/**
+ * `<root>/policies/**\/*.cedar`, then each app's `apps/<app>/policies/**\/*.cedar`, sorted by path in
+ * each, each relative to the root with `/` between its parts; a bundled snapshot's (`useRootSnapshot`).
+ */
 export function readPolicyFiles(root: string): { file: string; text: string }[] {
+  const bundled = rootSnapshot(root);
+  if (bundled) return bundled.policies;
   return kindDirs(root, POLICIES_DIR)
     .flatMap((dir) => filesUnder(dir, (name) => name.endsWith(".cedar")))
     .map((path) => ({

package/src/config.ts

@@ -57,7 +57,8 @@ import {
   VENDOR,
   withSetup,
 } from "./op.ts";
-import { type CedarPolicySource, policyAt } from "./cedar.ts";
+import { rootSnapshot, type RootSnapshot } from "./bundled.ts";
+import { type CedarPolicySource, policyAt, readPolicyFiles } from "./cedar.ts";
 import type { Policy } from "./policy.ts";
 import { checkFromRefs, type Resource, resourceTypesOf, withoutWriteOnly } from "./resource.ts";
 import { codeMail, loginCodeWorkflow } from "./login-code.ts";
@@ -76,7 +77,7 @@ import { tokenStore } from "./tokens.ts";
 import type { Steps } from "./steps.ts";
 import { checkSchedule } from "./schedules.ts";
 import { changeCodeOf, computeVersion } from "./version.ts";
-import type { DeclaredResource, ResourceProblem } from "./resources.ts";
+import { type DeclaredResource, readPeople, type ResourceProblem } from "./resources.ts";
 import { checkWakeupOps, type DeclaredWakeup, type EnvWakeup, HOST_URL } from "./wakeup.ts";
 import { instanceUrl, WAKEUP_TOKEN } from "./wakeup-service.ts";
 import { sanomaWakeupDriver, wakeupSteps } from "./wakeup-driver.ts";
@@ -405,7 +406,14 @@ export function resolveConfig(config: SanomaConfig): ResolvedConfig {
   const connectors = connectorsOf(config);
   // The types the data files may declare: the vendors' and the people's, whose resources are left out.
   const declarable = resourceTypesOf(connectors);
-  const read = () => readDeclared(root, connectors, declarable, types, connections);
+  const read = (options: ReadOptions = {}) =>
+    readDeclared(root, connectors, declarable, types, connections, {
+      ...options,
+      drivers: driversByVendor,
+      builtInStore: !config.secrets?.store,
+      signingKeyBound: config.secrets?.bindings?.SANOMA_SIGNING_KEY !== undefined,
+      ...(isOp(config.login?.sender) && { sender: config.login.sender.vendor }),
+    });
   if (types.size) {
     names.set(
       DRIFT_WORKFLOW,
@@ -414,8 +422,13 @@ export function resolveConfig(config: SanomaConfig): ResolvedConfig {
     names.set(APPLY_WORKFLOW, applyWorkflow(types, ops, drivers, applySteps(appName, root, read)));
   }
   // Built-in, in every config: the life of a change, which deploys to the declared hosts after its merge.
-  const hosts = async () =>
-    (await read()).resources.filter((r) => types.get(`${r.vendor}.${r.type}`)?.host).map((r) => r.id);
+  // The declared hosts' ids, as the files say them: nothing derived, nothing minted.
+  const hosts = async () => {
+    const { loadDataFiles } = await import("./resources.ts");
+    return loadDataFiles(root, connectors, declarable)
+      .resources.filter((r) => types.get(`${r.vendor}.${r.type}`)?.host)
+      .map((r) => r.id);
+  };
   names.set(CHANGE_WORKFLOW, changeWorkflow(changeOps, changeSteps({ remotes, hosts })));
   const declaredObjects = () => readDeclaredObjects(root, connectors, declarable);
   // Built-in: a direct call the policy holds for an approval, made a run, when any operation may be called directly.
@@ -425,6 +438,7 @@ export function resolveConfig(config: SanomaConfig): ResolvedConfig {
   const login = config.login && checkLogin(config.login, ops, drivers, appName);
   if (login) names.set(LOGIN_CODE_WORKFLOW, loginCodeWorkflow(login, appName));
   const { policy, policies, problems: policyProblems } = policyAt(root, { ops, workflows: names, collections });
+  const bundled = rootSnapshot(root);
   return {
     secrets: config.secrets ?? {},
     connections,
@@ -432,9 +446,10 @@ export function resolveConfig(config: SanomaConfig): ResolvedConfig {
     identityProvisioning,
     appName,
     databaseUrl,
-    // The built-in's code and operations are part of the app's version, like the config's own.
-    version: computeVersion({ appName, workflows: [...names.values()] }),
-    changeCode: changeCodeOf(names.get(CHANGE_WORKFLOW)!),
+    // The built-in's code and operations are part of the app's version, like the config's own. A
+    // bundle's code is not the source's: it carries the hashes of the root it was read from.
+    version: bundled?.version ?? computeVersion({ appName, workflows: [...names.values()] }),
+    changeCode: bundled?.changeCode ?? changeCodeOf(names.get(CHANGE_WORKFLOW)!),
     queueName: `sanoma:${appName}`,
     ...(login && { login }),
     ops,
@@ -593,12 +608,26 @@ function makersOf<K extends keyof ConnectorSetup>(
   return makers;
 }
 
+/**
+ * What the runtime reads from `config`'s root that a bundle carries where the files are not
+ * (`useRootSnapshot`): the app's name and versions as `resolved` has them, the policy files and
+ * the people the data files declare.
+ */
+export function readRootSnapshot(config: SanomaConfig, resolved: ResolvedConfig = resolveConfig(config)): RootSnapshot {
+  const root = rootOf(config);
+  if (root === undefined) throw new Error("A config with no root has no files to carry");
+  const { appName, version, changeCode } = resolved;
+  return { appName, version, changeCode, policies: readPolicyFiles(root), people: readPeople(root) };
+}
+
 /**
  * The `name` of `<root>/package.json`, kept whole (`@acme/ops`), when that file exists and names
  * one; else "sanoma", as for a config with no `root`. Never a `package.json` above the root: a
  * parent project's name must not become the app's. A file that is not JSON is refused, naming it.
  */
 function appNameAt(root: string | undefined): string {
+  const bundled = rootSnapshot(root);
+  if (bundled) return bundled.appName;
   const file = root === undefined ? undefined : join(root, "package.json");
   if (file === undefined || !existsSync(file)) return "sanoma";
   let manifest: unknown;
@@ -689,6 +718,11 @@ async function readDeclaredObjects(
   return { keys: new Map([...named, ...bound]), problems };
 }
 
+/** How a run reads the data files: `mint`, apply's, mints the keys a deriving host is given (`hostFacts`). */
+export interface ReadOptions {
+  mint?: boolean;
+}
+
 /**
  * The data files under `root` and the lockfile beside them, in one read, as a drift or apply run
  * records them: each resource with its binding, without its write-only values (a secret marker
@@ -701,12 +735,48 @@ async function readDeclared(
   declarable: ReadonlyMap<string, Resource>,
   types: ReadonlyMap<string, Resource>,
   connections: ConnectionRegistry,
+  options: ReadOptions & {
+    drivers: ReadonlyMap<string, Driver>;
+    builtInStore: boolean;
+    signingKeyBound: boolean;
+    sender?: string;
+  },
 ): Promise<Omit<ApplyDeclared, "rebinds">> {
   // Loaded when a run reads the files, not with the worker.
   const { loadDataFiles } = await import("./resources.ts");
   const { resources, bindings, orphans, problems } = loadDataFiles(root, connectors, declarable);
-  // Read inside the data-file durable step: every operation of the plan uses one pinned account.
   const run = currentRun.getStore();
+  // A host that derives is filled with what it is not told (`deriveHosts`), before it is checked
+  // or pinned: the deploy key it clones with among them. Minted only by a live apply.
+  const keep = new Set<string>();
+  const leftOut = new Set<string>();
+  if (root !== undefined) {
+    const { deriveHosts, hostFacts } = await import("./host-derive.ts");
+    const facts = await hostFacts({
+      root,
+      resources,
+      types,
+      drivers: options.drivers,
+      ...(run && { secrets: run.state.secrets }),
+      builtInStore: options.builtInStore,
+      signingKeyBound: options.signingKeyBound,
+      ...(options.sender !== undefined && { sender: options.sender }),
+      mint: !!options.mint && !!run && !run.sandbox,
+    });
+    if (facts) problems.push(...deriveHosts(resources, types, bindings, facts, { keep, leftOut }));
+  }
+  // A host apply cannot give all it needs is left out, with what names it (its wakeup), and what
+  // names that in turn: its problem says why, and nothing of it changes until it is fixed.
+  for (let grew = leftOut.size > 0; grew;) {
+    const before = leftOut.size;
+    for (const o of resources) if (Object.values(o.refs).some((id) => leftOut.has(id))) leftOut.add(o.id);
+    grew = leftOut.size > before;
+  }
+  for (const r of resources.filter((o) => leftOut.has(o.id))) resources.splice(resources.indexOf(r), 1);
+  // A host's deploy key apply declares, or cannot tell yet, is no orphan.
+  const declaredIds = new Set(resources.map((r) => r.id));
+  const kept = orphans.filter((o) => !declaredIds.has(o.key) && !keep.has(o.key));
+  // Read inside the data-file durable step: every operation of the plan uses one pinned account.
   if (run && !run.sandbox) {
     for (const resource of resources.filter((r) => types.has(`${r.vendor}.${r.type}`))) {
       try {
@@ -743,7 +813,8 @@ async function readDeclared(
         ...(connection && { connection }),
       })),
     bindings,
-    orphans,
+    orphans: kept,
+    ...(leftOut.size > 0 && { leftOut: [...leftOut] }),
     problems,
   };
 }

package/src/db.ts

@@ -226,6 +226,19 @@ export function lazyPool(databaseUrl: string, what: string): LazyPool {
 /** Each database prepared, or being prepared, by its URL. A failed preparation is forgotten. */
 const prepared = new Map<string, Promise<void>>();
 
+/** What prepares the databases instead of this process (`checkPreparedOnly`), which a refusal names. */
+let preparedBy: string | undefined;
+
+/**
+ * From now on, `prepareDatabase` makes nothing: it only checks that DBOS's tables and the
+ * runtime's are there, and refuses, naming `by`, what prepares them, when they are not. For a
+ * process beside the one that prepares the database, which must never migrate it: the Cloudflare
+ * host's Worker, whose container prepares it at its start.
+ */
+export function checkPreparedOnly(by: string): void {
+  preparedBy = by;
+}
+
 /**
  * Makes the database at `databaseUrl` ready for the runtime, once per process and URL: the
  * database itself and DBOS's tables when they are not there yet (as a worker's launch makes
@@ -237,7 +250,8 @@ const prepared = new Map<string, Promise<void>>();
 export function prepareDatabase(databaseUrl: string): Promise<void> {
   let preparing = prepared.get(databaseUrl);
   if (!preparing) {
-    preparing = prepare(databaseUrl).catch((err: unknown) => {
+    const made = preparedBy === undefined ? prepare(databaseUrl) : checkPrepared(databaseUrl, preparedBy);
+    preparing = made.catch((err: unknown) => {
       if (prepared.get(databaseUrl) === preparing) prepared.delete(databaseUrl);
       throw err;
     });
@@ -267,6 +281,26 @@ async function prepare(databaseUrl: string): Promise<void> {
   }
 }
 
+/** The last of the runtime's tables a preparation makes (`TABLES`), so its being there says they all are. */
+const LAST_TABLE = API_TOKENS_TABLE;
+
+/** Refuses when the database at `databaseUrl` lacks DBOS's tables or the runtime's: `by` makes them, not this process. */
+async function checkPrepared(databaseUrl: string, by: string): Promise<void> {
+  const conn = await connect(databaseUrl);
+  try {
+    const { rows } = await conn.query<{ dbos: boolean; ours: boolean }>(
+      `SELECT to_regclass('dbos.workflow_status') IS NOT NULL AS dbos, to_regclass('${LAST_TABLE}') IS NOT NULL AS ours`,
+    );
+    const { dbos, ours } = rows[0]!;
+    if (!dbos || !ours) {
+      const missing = [...(dbos ? [] : ["DBOS's"]), ...(ours ? [] : ["Sanoma's"])].join(" and ");
+      throw new Error(`the database has no ${missing} tables yet: ${by} makes them, and this process never does`);
+    }
+  } finally {
+    await conn.end().catch(() => undefined);
+  }
+}
+
 /**
  * A connection to the database at `databaseUrl` (made first when missing) holding the
  * preparation's session lock until it ends, so a second process waits, then finds everything

package/src/define.ts

@@ -1,3 +1,4 @@
+import { bundledFile } from "./bundled.ts";
 import type { ConnectionRef } from "./connection.ts";
 import type { WorkflowEntry } from "./description.ts";
 import { fileURLToPath } from "node:url";
@@ -396,11 +397,12 @@ const isTimeZone = (zone: unknown): boolean => {
 
 /**
  * The file of the code that called the function calling this one (`defineWorkflow`'s caller),
- * from V8's call sites, as a path; undefined where there is none.
+ * from V8's call sites, as a path; where they name none, the file a bundle says it is evaluating
+ * (`bundledFile`); undefined where there is neither.
  */
 export function callerFile(): string | undefined {
   // Frame 0 is this function, frame 1 its caller, frame 2 theirs: by index, since a bundle may hold all three.
-  return scriptPath(getCallSites(3)[2]?.scriptName);
+  return scriptPath(getCallSites(3)[2]?.scriptName) ?? bundledFile();
 }
 
 /** A V8 script name (a `file:` URL for a module, a path for a script) as a path; undefined for none. */

package/src/definitions.ts

@@ -23,6 +23,11 @@ export interface SiteDefinition {
   public?: boolean;
   login?: string;
   locales?: readonly [string, ...string[]];
+  /**
+   * A public site's domain (`www.acme.example`): the production host attaches it and serves the
+   * site at its root there; in a preview and locally the site stays at `/sites/<name>`.
+   */
+  domain?: string;
 }
 
 /** Declares a site in its folder's `site.ts`, its default export: `defineSite({ title: "Help desk" })`. */