@sanoma-ai/workflows 0.5.0 → 0.7.0

package/src/host.ts

@@ -4,8 +4,17 @@ import type { z } from "zod";
 // a Fly app) declares about itself, so hosts are swappable and one conformance kit decides
 // whether one works. A host is a resource type like any other; this is what sets it apart.
 
-/** How a host keeps the runtime up: `long-lived`, or (later) woken on a schedule. */
-export type HostLifetime = "long-lived" | "wake-on-schedule";
+/**
+ * How a host keeps the runtime up:
+ * - `long-lived`: the process is restarted if it exits, and never stopped for being quiet (Docker).
+ * - `stops-on-exit`: the host stops the instance when its process exits, and starts it again on
+ *   the next request (Fly).
+ * - `stops-when-quiet`: the host stops the instance after a while without inbound requests, and
+ *   starts it again on the next request (a free Render service, Cloudflare Containers).
+ *
+ * A host that stops needs a declared `Wakeup` for what is due at a time while it is stopped.
+ */
+export type HostLifetime = "long-lived" | "stops-on-exit" | "stops-when-quiet";
 
 /** What a host can do, for choosing one. */
 export interface HostCapabilities {
@@ -53,10 +62,10 @@ export interface HostSpec {
   outputs: (state: Record<string, unknown>) => HostOutputs;
 }
 
-const LIFETIMES: readonly HostLifetime[] = ["long-lived", "wake-on-schedule"];
+const LIFETIMES: readonly HostLifetime[] = ["long-lived", "stops-on-exit", "stops-when-quiet"];
 
 /** True when `schema` has a field at the dotted `path`, looking through optional, nullable and default wrappers. */
-function hasPath(schema: z.ZodType, path: string): boolean {
+export function hasPath(schema: z.ZodType, path: string): boolean {
   let at: z.ZodType | undefined = schema;
   for (const key of path.split(".")) {
     at = unwrap(at);

package/src/index.ts

@@ -14,6 +14,7 @@ export {
   isSvgElement,
   type LoginContext,
   type LoginHalf,
+  type ModelContext,
   type Op,
   type OpSpec,
   type ResourceGroup,
@@ -33,6 +34,7 @@ export {
   type Ctx,
   type SleepRequest,
   type StepOptions,
+  type Trigger,
   type Use,
   type WorkflowDefinition,
 } from "./define.ts";
@@ -51,7 +53,14 @@ export {
   type ResourceSpec,
   withoutWriteOnly,
 } from "./resource.ts";
-export { defineConfig, resolveConfig, resolveDatabaseUrl, type ResolvedConfig, type SanomaConfig } from "./config.ts";
+export {
+  declaredWakeup,
+  defineConfig,
+  resolveConfig,
+  resolveDatabaseUrl,
+  type ResolvedConfig,
+  type SanomaConfig,
+} from "./config.ts";
 // `sanoma` itself (the people types' constructors) is at `@sanoma-ai/workflows/resources`, for data files.
 // `collection()` itself is at `@sanoma-ai/workflows/data`, for `resources/data.ts`; this tells one apart, as the launcher does.
 export { isCollection } from "./collection.ts";
@@ -66,6 +75,16 @@ export {
   type PlanStep,
 } from "./apply.ts";
 export { CALL_WORKFLOW, CallInput } from "./call-workflow.ts";
+export {
+  type ChangeEvent,
+  ChangeFacts,
+  ChangeInput,
+  changeOps,
+  type ChangeReport,
+  type ChangeState,
+  runtimeHold,
+  touchesOf,
+} from "./change.ts";
 export { isDirect } from "./direct.ts";
 export {
   DRIFT_WORKFLOW,
@@ -113,6 +132,7 @@ export {
   PolicyDeniedError,
   RejectedError,
   SanomaError,
+  WithdrawnError,
 } from "./errors.ts";
 export {
   jsonlLedger,
@@ -123,10 +143,15 @@ export {
   type LedgerRecord,
   type LedgerStore,
 } from "./ledger.ts";
-export { ApprovalMessage, APPROVALS_EVENT, decisionEventOf } from "./approvals.ts";
+export { ApprovalMessage, APPROVALS_EVENT, ApprovalWithdrawal, decisionEventOf } from "./approvals.ts";
 export { RUNTIME_VERSION } from "./version.ts";
 export type { RunArgs } from "./run.ts";
 export { startWorker, type Worker, type WorkerOptions } from "./worker.ts";
+export { superviseWorker, type Supervisor, type SupervisorOptions } from "./supervisor.ts";
+export type { DeadlineSource, Deadlines, SelfStop, Wait } from "./deadlines.ts";
+// Whether a wake is the one the instance's worker last registered, for the `/wake` route.
+export { shouldWake } from "./db.ts";
+export { nextFire, nextScheduledFire } from "./schedules.ts";
 // `secret` itself is at `@sanoma-ai/workflows/resources`, for data files; this is the drivers' side.
 export {
   generateSecret,
@@ -137,10 +162,36 @@ export {
   type Secret,
   type Secrets,
 } from "./secret.ts";
-export { resolveRevision, SOURCE_RESOLVE, type Source } from "./source.ts";
+export {
+  type CheckResult,
+  type Draft,
+  type DraftDiff,
+  resolveRevision,
+  SOURCE_RESOLVE,
+  type Source,
+} from "./source.ts";
 export type { HostCapabilities, HostLifetime, HostOutputs, HostSpec } from "./host.ts";
+export {
+  checkDatabase,
+  type DatabaseCapabilities,
+  type DatabaseOutputs,
+  type DatabaseSpec,
+  databaseUrlSecret,
+  storeDatabaseUrl,
+} from "./database.ts";
+export type { Chat, Chats } from "./chats.ts";
+export {
+  checkWakeup,
+  type DeclaredWakeup,
+  type WakeupOutputs,
+  type WakeupRegistration,
+  type WakeupSpec,
+  wakeGeneration,
+  wakeupHostTypes,
+} from "./wakeup.ts";
 export {
   type CallOptions,
+  type ClientOptions,
   SanomaClient,
   type RunsFilter,
   type RunSummary,
@@ -156,11 +207,18 @@ export {
   ANONYMOUS_PRINCIPAL,
   approverLabel,
   approverOf,
+  CHANGE_CLOSE,
+  CHANGE_EVENT,
+  CHANGE_MERGE,
+  CHANGE_OPEN,
+  CHANGE_REVIEW,
+  CHANGE_WORKFLOW,
   declaresPeople,
   type PeopleResource,
   personOf,
   principalOf,
   RUNTIME_AGENTS,
+  SCHEDULE_AGENT,
   credentialReady,
   DEFAULT_SLEEP_NAME,
   ENDED_STATUSES,
@@ -175,6 +233,7 @@ export {
   type RunStatus,
   VISITORS,
   visitorPrincipal,
+  warningLine,
 } from "./shared.ts";
 // describeConfig, with the outline and every problem lintWorkflow finds, lives at
 // `@sanoma-ai/workflows/describe`: what a UI renders from, apart from what runs. The worker reads

package/src/ledger.ts

@@ -17,7 +17,7 @@ import { errorMessage } from "./shared.ts";
  * decision, every approval, and how it ended. Records are append-only.
  *
  * `id` is deterministic (`<runId>:<type>:<seq>`, `<runId>:<type>:<approvalId>` for an
- * approval requested or decided, `<runId>:approval.refused:<approvalId>:refused:<n>` for
+ * approval requested, decided or withdrawn, `<runId>:approval.refused:<approvalId>:refused:<n>` for
  * the nth message an approval ignored) so that when DBOS replays a run after a restart,
  * the records it writes again have the same ids and the store skips them. `seq` orders a
  * run's records. `v` is the record format's version; `app` is the config's `appName`.
@@ -34,7 +34,12 @@ export type LedgerRecord = {
   /** Set on every record written while a `ctx.all` member runs; absent outside one. */
   group?: LedgerGroup;
 } & (
-  | { type: "run.started"; input: unknown }
+  | {
+      type: "run.started";
+      input: unknown;
+      /** For a run its schedule started (`trigger: { schedule }`): the tick's time, ISO 8601, which may be before `at`. */
+      scheduledFor?: string;
+    }
   | {
       type: "op.called";
       op: string;
@@ -61,7 +66,7 @@ export type LedgerRecord = {
       durationMs: number;
       /** Which try produced the output or the final error, from 1. Idempotent operations are retried. */
       attempt?: number;
-      /** The approval that held the call, when its rejection stopped it. */
+      /** The approval that held the call, when its rejection or withdrawal stopped it. */
       approval?: string;
     }
   | {
@@ -94,6 +99,13 @@ export type LedgerRecord = {
       /** Set when `by` started the run: nobody else could decide (`mayDecide`). */
       alone?: true;
     }
+  /** The approval no longer stands: withdrawn while pending, or retired by its run once approved. */
+  | {
+      type: "approval.withdrawn";
+      approval: string;
+      /** Who withdrew it, when someone did rather than its run. */ by?: string;
+      reason: string;
+    }
   /**
    * A `ctx.sleep` began; `until` is when it ends, in ms since the epoch: the time asked for, or
    * for a duration the record's `at` plus the duration, as the runtime saw it. Written

package/src/lint.ts

@@ -55,7 +55,7 @@ const NOT_ALLOWED =
  * copy, which is no instance of them, so a branch on it goes another way than the first time
  * and the run's steps fall out of step. Read the code with `errorCode(err)` instead.
  */
-const ERROR_CLASSES = new Set(["DriverError", "SanomaError", "PolicyDeniedError", "RejectedError"]);
+const ERROR_CLASSES = new Set(["DriverError", "SanomaError", "PolicyDeniedError", "RejectedError", "WithdrawnError"]);
 
 /**
  * Checks a workflow file. Imports allowed: the names in `WORKFLOW_IMPORTS` and any

package/src/op.ts

@@ -1,3 +1,4 @@
+import type { ProviderV4 } from "@ai-sdk/provider";
 import type { z } from "zod";
 import type { Fake } from "./fake.ts";
 import type { Secrets } from "./secret.ts";
@@ -306,8 +307,8 @@ export interface Driver {
  * What a connector package attaches to its connector (`withSetup`), for the config's resolver
  * to call: the config then names the connector alone, and never a driver, a fake, steps or a
  * login. Any may be missing: a workflow using an operation of a connector with no driver is
- * refused, a connector with no fake has none for sandbox runs, and one with no login half signs
- * no visitor in.
+ * refused, a connector with no fake has none for sandbox runs, one with no login half signs no
+ * visitor in, and one with no model half gives the app no models.
  */
 export interface ConnectorSetup {
   /** Makes the live driver, which reads its credentials from the environment when called: once per resolved config. */
@@ -321,8 +322,20 @@ export interface ConnectorSetup {
    * starts; a login that needs tables migrates them here (serialized, idempotent).
    */
   login?: (context: LoginContext) => LoginHalf | Promise<LoginHalf>;
+  /**
+   * Makes the connector's AI SDK provider, the vendor's adapter as the transport: by the app,
+   * once per resolved config and client (again after one that throws), whose registry names its
+   * models `<vendor>/<model-id>`. It answers `languageModel("default")` with the connector's own
+   * default model, and reads its credentials through `context.secrets` when a model is called, so
+   * a key set on the connector page later is used (unless the environment sets one, which wins),
+   * and a missing one fails that call.
+   */
+  model?: (context: ModelContext) => ProviderV4 | Promise<ProviderV4>;
 }
 
+/** What the app gives a connector's model half (`ConnectorSetup.model`): the secrets, as a login half reads them. */
+export type ModelContext = Pick<LoginContext, "secrets">;
+
 /** What the app gives a connector's login half (`ConnectorSetup.login`) when it makes it for a public site. */
 export interface LoginContext {
   /** The company's database (`resolved.databaseUrl`), where a login like Better Auth keeps its users. */

package/src/policy.ts

@@ -32,6 +32,11 @@ export interface PolicyCall {
   run: { id: string; workflow: string; approvals: readonly ApprovalState[] };
   /** For a collection's `save` or `delete`: the record as it was, when there was one. */
   before?: unknown;
+  /**
+   * The attributes of the entity the call acts on, when its action is on one with attributes: a
+   * `sanoma.change.merge`'s `Sanoma::Change`, the change's facts (`ChangeFacts`).
+   */
+  entity?: Record<string, unknown>;
 }
 
 /**
@@ -145,7 +150,8 @@ export const denyAll = (reason: string): Policy => {
 /**
  * True when an approval in the run was approved, covers the operation, and was addressed to
  * `approver`. Check all three: a workflow can request an approval covering any operation from
- * anyone it names, so an approval's `covers` alone does not say the right person approved.
+ * anyone it names, so an approval's `covers` alone does not say the right person approved. A
+ * withdrawn approval is no longer approved, so it lifts nothing.
  */
 export function approvedFor(approvals: readonly ApprovalState[], opId: string, approver: Approver): boolean {
   return approvals.some(

package/src/resource.ts

@@ -1,7 +1,9 @@
 import { z } from "zod";
+import { checkDatabase, type DatabaseSpec } from "./database.ts";
 import { checkHost, type HostSpec } from "./host.ts";
 import { type Connector, type OpSpec, RESOURCE, VENDOR } from "./op.ts";
 import { isSanomaSecret, isSecret, type Secret } from "./secret.ts";
+import { checkWakeup, type WakeupSpec } from "./wakeup.ts";
 
 /** Which fields of a resource are flagged, by dotted path (`pages.html_url`; a list's items have no index). */
 export interface ResourceFields {
@@ -79,6 +81,16 @@ export interface ResourceSpec<S extends z.ZodObject = z.ZodObject> {
   writable?: boolean;
   /** Set when the type meets the `Host` contract: it runs the company. Such a type is `writable` and `stateless`. */
   host?: HostSpec;
+  /**
+   * Set when the type meets the `Wakeup` contract: it wakes a stopped instance at a time. Such a
+   * type is `writable`, and its connector has the operation `register` names.
+   */
+  wakeup?: WakeupSpec;
+  /**
+   * Set when the type meets the `Database` contract: it holds the company's database. Such a type
+   * is `writable`, not `stateless`, and its `afterCreate` calls the operation `storeUrl` names.
+   */
+  database?: DatabaseSpec;
   /**
    * True when its objects hold no data, so one gone at the vendor is created again by apply
    * without asking (a host running the company's code); otherwise apply asks first, as a
@@ -269,10 +281,13 @@ export interface Resource<
   extends
     Readonly<
       Required<
-        Omit<ResourceSpec<S>, "identity" | "find" | "writable" | "host" | "stateless" | "afterCreate" | "vendorless">
+        Omit<
+          ResourceSpec<S>,
+          "identity" | "find" | "writable" | "host" | "wakeup" | "database" | "stateless" | "afterCreate" | "vendorless"
+        >
       >
     >,
-    Readonly<Pick<ResourceSpec<S>, "identity" | "find" | "host" | "afterCreate">> {
+    Readonly<Pick<ResourceSpec<S>, "identity" | "find" | "host" | "wakeup" | "database" | "afterCreate">> {
   (desired: Declaring<z.input<S>, R>): Declared<Id, z.input<S>>;
   /** `read` and `import`, each effect `read`, idempotent, with the id as `target`; for a writable type, the change operations too. */
   readonly ops: ResourceOps<S, W>;
@@ -536,10 +551,12 @@ export function defineResource<
 >(
   spec: ResourceSpec<S> & { vendor: V; type: T; fields: { references?: R }; writable?: W },
 ): Resource<S, `${V}.${T}`, R, W> {
-  const { vendor, type, schema, fields, find, identity, host } = spec;
+  const { vendor, type, schema, fields, find, identity, host, wakeup, database } = spec;
   const writable = (spec.writable ?? false) as W;
   const what: `${V}.${T}` = `${vendor}.${type}`;
   if (host) checkHost(what, host, spec);
+  if (wakeup) checkWakeup(what, wakeup, spec);
+  if (database) checkDatabase(what, database, spec);
   if (spec.vendorless && (writable || host))
     throw new Error(`${what}: a vendorless type has no object to change or host`);
   const title = spec.title.toLowerCase();
@@ -677,6 +694,8 @@ export function defineResource<
     normalize: spec.normalize ?? ((state: State, desired: z.input<S>) => compareDeclared(fields, state, desired)),
     writable,
     ...(host && { host }),
+    ...(wakeup && { wakeup }),
+    ...(database && { database }),
     stateless: spec.stateless ?? host !== undefined,
     vendorless: spec.vendorless ?? false,
     ...(spec.afterCreate && { afterCreate: spec.afterCreate }),

package/src/resources.ts

@@ -112,7 +112,7 @@ export interface DeclaredPeople {
 }
 
 /** A file that imports the runtime's constructors, `sanoma` (by any local name): the files `readPeople` reads. */
-const DECLARES_PEOPLE = /\{[^}]*\bsanoma\b[^}]*\}\s*from\s*["'](?:sanoma|@sanoma-ai\/workflows)\/resources["']/;
+export const DECLARES_PEOPLE = /\{[^}]*\bsanoma\b[^}]*\}\s*from\s*["'](?:sanoma|@sanoma-ai\/workflows)\/resources["']/;
 /** The last read of the people under each root, by what its data files were then (`filesStamp`). */
 const peopleRead = new Map<string, { stamp: string; read: DeclaredPeople }>();
 
@@ -424,6 +424,17 @@ export function readDataFiles(
       done.set(id, undefined);
     }
   }
+  // An instance registers with one wakeup: several are each a problem, and left out, as is any that names one.
+  const wakeups = [...declarations].filter(
+    ([, { file, exp }]) => types.get(`${vendors.get(file)!.get(exp.vendor)}.${exp.type}`)?.wakeup,
+  );
+  if (wakeups.length > 1) {
+    for (const [id, { file, exp }] of wakeups) {
+      const others = wakeups.filter(([other]) => other !== id).map(([other]) => other);
+      file.problem(exp.start, `an instance has one wakeup: leave out this one or ${others.join(", ")}`);
+      done.set(id, undefined);
+    }
+  }
   const keys = new Set([...files.values()].flatMap((f) => f.data.declared.map((name) => `${f.rel}#${name}`)));
   const orphans = Object.entries(lock.bindings)
     .filter(([key]) => !keys.has(key))

package/src/run.ts

@@ -1,5 +1,6 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import type { Collection } from "./collection.ts";
+import type { DeadlineRegistry } from "./deadlines.ts";
 import type { ApprovalState, Approver, Principal, WorkflowDefinition } from "./define.ts";
 import type { Fake } from "./fake.ts";
 import type { LedgerStore } from "./ledger.ts";
@@ -45,6 +46,8 @@ export interface WorkerState {
   drivers: Map<string, DriverFn>;
   /** The makers of the config's fake vendors, by vendor id: a sandbox run makes its own of each when it is seeded. */
   fakes: Map<string, () => Fake<any, any>>;
+  /** The instance's fakes, by vendor id, when it runs on them (`fakes: "instance"`): its sandbox runs seed and call these, not fakes of their own. */
+  instanceFakes?: ReadonlyMap<string, Fake<any, any>>;
   /** Where sandbox runs' scenarios are, the resource types their steps may name, and the steps the connectors ship. */
   scenarios?: URL;
   /** The worker's `source`, when it was given one. */
@@ -75,6 +78,8 @@ export interface WorkerState {
    * how it really ends (see `isInfrastructureError`).
    */
   stopped: boolean;
+  /** Which of its runs are executing and which wait, until when: what the worker's `idle` reads. */
+  deadlines: DeadlineRegistry;
 }
 
 /** What a run keeps in memory. Rebuilt the same way when DBOS replays the run. */

package/src/sandbox.ts

@@ -4,7 +4,7 @@ import { opIdsOf } from "./define.ts";
 import { SanomaError } from "./errors.ts";
 import type { Fake, ResourceFake } from "./fake.ts";
 import { entry, type LedgerRecord, write } from "./ledger.ts";
-import type { DriverFn } from "./op.ts";
+import type { CallContext, DriverFn, Op } from "./op.ts";
 import type { Run } from "./run.ts";
 import { memorySecrets } from "./secret.ts";
 import { type Given, loadScenarios, type Scenario } from "./scenario.ts";
@@ -58,7 +58,7 @@ export function seedResource(
   scenario: string,
   copy: ResourceFake,
   given: Extract<Given, { resource: string }>,
-): Extract<LedgerRecord, { type: "scenario.seeded" }>["seeds"][number] {
+): Seeds[number] {
   const { resource, type, name } = given;
   try {
     if ("gone" in given) {
@@ -77,16 +77,81 @@ export function seedResource(
   }
 }
 
+/** What a scenario's `Given` steps seeded, as its `scenario.seeded` record has it. */
+export type Seeds = Extract<LedgerRecord, { type: "scenario.seeded" }>["seeds"];
+
+/**
+ * Where a scenario's `Given` steps go (`applyGivens`): a sandbox run's own fakes (`run`), or the
+ * instance a demo runs (`instance`), its collections in the config's database and every vendor
+ * on its one fake, which every run shares, so a fault, injected into a call some other run would
+ * make, is refused there.
+ */
+export interface GivenTarget {
+  kind: "run" | "instance";
+  /** What a `Given` operation is called through, by operation id. */
+  drivers: ReadonlyMap<string, DriverFn>;
+  /** The fakes, by vendor id: what a `Given` resource is put in, and a `run`'s faults injected into. */
+  fakes: ReadonlyMap<string, Fake<unknown>>;
+  /** The operations by id, for a fault's vendor. */
+  ops: ReadonlyMap<string, Op>;
+  /** The context of the call the `i`th `Given` makes. */
+  call(i: number, op: string): CallContext;
+}
+
+/**
+ * Applies the scenario's `Given` steps to the target: calls each operation through its drivers,
+ * puts or removes each resource in its vendor's fake, then, for a `run`, injects the faults.
+ * Checks first that every operation it seeds has a driver there, that every resource's vendor has
+ * a fake holding resources, and, for an `instance`, that it injects no fault. Returns what it
+ * seeded, in order.
+ */
+export async function applyGivens(scenario: Pick<Scenario, "name" | "given">, target: GivenTarget): Promise<Seeds> {
+  const { name, given } = scenario;
+  const fault = given.find((g) => "fault" in g);
+  if (fault && target.kind === "instance") {
+    throw new SanomaError(
+      "invalid_input",
+      `Scenario "${name}" injects a fault ("${fault.step}"), but its Givens go to the instance, whose fakes every run shares`,
+      { scenario: name, step: fault.step },
+    );
+  }
+  const missing = [...new Set(given.flatMap((g) => ("op" in g && !target.drivers.has(g.op) ? [g.op] : [])))];
+  if (missing.length) {
+    throw new SanomaError(
+      "invalid_input",
+      `Scenario "${name}" seeds ${missing.join(", ")}, but no fake its connectors attach implements ${missing.length > 1 ? "them" : "it"}`,
+      { scenario: name, missing },
+    );
+  }
+  const plain = missingResourceFake(scenario, target.fakes);
+  if (plain) throw plain;
+  const seeded: Seeds = [];
+  for (const [i, g] of given.entries()) {
+    if ("fault" in g) continue;
+    if ("op" in g) {
+      const output = await target.drivers.get(g.op)!(g.input, target.call(i, g.op));
+      seeded.push({ op: g.op, input: g.input, output });
+      continue;
+    }
+    // Checked above: the vendor's fake holds resources.
+    seeded.push(seedResource(name, target.fakes.get(g.vendor) as Fake<unknown> & ResourceFake, g));
+  }
+  for (const g of given) {
+    if ("fault" in g) target.fakes.get(target.ops.get(g.op)!.vendor)![g.fault](g.op);
+  }
+  return seeded;
+}
+
 /**
  * Seeds a sandbox run of the scenario `name`, from the worker, in one step: reads the scenario,
- * checks that it runs this workflow, makes the run's own fakes (each vendor's maker, called once
- * for the run), checks that every operation the workflow uses or the scenario seeds has one and
- * that every resource it seeds has a fake holding resources, calls each `Given` operation
- * through them, puts or removes each `Given` resource in them, injects the faults into them,
- * then puts their functions on the run. The run then calls those only, so sandbox runs share no
- * state when the makers make a new fake each. The step's checkpoint never stands in for them: a
- * run whose seeding is replayed from it has none, and fails, since a sandbox run does not
- * survive a worker restart.
+ * checks that it runs this workflow, picks the run's fakes, checks that every operation the
+ * workflow uses has one, then applies the scenario's `Given` steps to them
+ * (`applyGivens`) and puts their functions on the run. The run then calls those only. Its fakes
+ * are its own (each vendor's maker, called once for the run), so sandbox runs share no state when
+ * the makers make a new fake each; on an instance that runs on fakes (`instanceFakes`) they are
+ * the instance's, which its sandbox runs share, as its live drivers are. The step's checkpoint
+ * never stands in for a run's own: a run whose seeding is replayed from it has none, and fails,
+ * since a sandbox run does not survive a worker restart; on an instance's fakes it goes on with them.
  */
 export async function seedSandbox(run: Run, name: string): Promise<void> {
   const { state } = run;
@@ -103,19 +168,22 @@ export async function seedSandbox(run: Run, name: string): Promise<void> {
         throw new SanomaError("invalid_input", `No scenario named "${name}"${why}`, { scenario: name });
       }
       if (scenario.workflow !== run.workflow) {
-        throw new SanomaError("invalid_input", `Scenario "${name}" runs ${scenario.workflow}, not ${run.workflow}`, {
+        const runs = scenario.workflow === undefined ? "is a world, which runs nothing" : `runs ${scenario.workflow}`;
+        throw new SanomaError("invalid_input", `Scenario "${name}" ${runs}, not ${run.workflow}`, {
           scenario: name,
-          workflow: scenario.workflow,
+          ...(scenario.workflow !== undefined && { workflow: scenario.workflow }),
         });
       }
-      const fakes = new Map([...state.fakes].map(([vendor, make]) => [vendor, make()]));
-      const drivers = indexDrivers(
-        [...fakes.values()].map((f) => f.driver),
-        state.ops,
-      );
-      const uses = opIdsOf(state.workflows.get(run.workflow)!);
-      const seeding = scenario.given.flatMap((g) => ("op" in g ? [g.op] : []));
-      const missing = [...new Set([...uses, ...seeding])].filter((id) => !drivers.has(id));
+      const instance = state.instanceFakes;
+      const fakes = instance ?? new Map([...state.fakes].map(([vendor, make]) => [vendor, make()]));
+      const drivers = instance
+        ? state.drivers
+        : indexDrivers(
+            [...fakes.values()].map((f) => f.driver),
+            state.ops,
+          );
+      // What the scenario seeds is checked by `applyGivens`.
+      const missing = opIdsOf(state.workflows.get(run.workflow)!).filter((id) => !drivers.has(id));
       if (missing.length) {
         throw new SanomaError(
           "invalid_input",
@@ -123,28 +191,20 @@ export async function seedSandbox(run: Run, name: string): Promise<void> {
           { scenario: name, missing },
         );
       }
-      const plain = missingResourceFake(scenario, fakes);
-      if (plain) throw plain;
-      const seeded: Extract<LedgerRecord, { type: "scenario.seeded" }>["seeds"] = [];
-      for (const [i, given] of scenario.given.entries()) {
-        if ("fault" in given) continue;
-        if ("op" in given) {
-          const call = { idempotencyKey: `${run.id}:seed:${i}`, runId: run.id, opId: given.op, attempt: 1, secrets };
-          const output = await drivers.get(given.op)!(given.input, call);
-          seeded.push({ op: given.op, input: given.input, output });
-          continue;
-        }
-        // Checked above: the vendor's fake holds resources.
-        seeded.push(seedResource(name, fakes.get(given.vendor) as Fake<unknown> & ResourceFake, given));
-      }
-      for (const given of scenario.given) {
-        if ("fault" in given) fakes.get(state.ops.get(given.op)!.vendor)![given.fault](given.op);
-      }
+      const seeded = await applyGivens(scenario, {
+        kind: instance ? "instance" : "run",
+        drivers,
+        fakes,
+        ops: state.ops,
+        call: (i, opId) => ({ idempotencyKey: `${run.id}:seed:${i}`, runId: run.id, opId, attempt: 1, secrets }),
+      });
       copies = drivers;
       return { seeds: seeded };
     },
     { name: "sandbox:seed" },
   );
+  // Replayed on an instance that runs on fakes: they are the instance's, still there in this process.
+  if (!copies && state.instanceFakes) copies = state.drivers;
   if (!copies) {
     // Replayed from its checkpoint (after a worker restart, or in a fork), so the run has no fakes.
     // The records written before the restart hold the seqs from here on: the failure goes after them.