@sanoma-ai/workflows 0.8.2 → 0.9.1

package/src/config.ts

@@ -41,7 +41,7 @@ import { type CedarPolicySource, policyAt } from "./cedar.ts";
 import type { Policy } from "./policy.ts";
 import { type Resource, resourceTypesOf, withoutWriteOnly } from "./resource.ts";
 import { APPLY_WORKFLOW, BUILT_IN_WORKFLOWS, CALL_WORKFLOW, CHANGE_WORKFLOW, DATA_VENDOR } from "./shared.ts";
-import { type RemoteHalf, sourceDriver, sourceOps } from "./source.ts";
+import { fakeSourceDriver, type RemoteHalf, SOURCE_RESOLVE, sourceDriver, sourceOps } from "./source.ts";
 import { appsListDriver, appsListOps } from "./apps-list.ts";
 import type { Steps } from "./steps.ts";
 import { checkSchedule } from "./schedules.ts";
@@ -114,43 +114,6 @@ export interface SanomaConfig {
    * that sets it and declares a wakeup of its own.
    */
   wakeup?: true;
-  /** How this repo runs as a demo (`sanoma demo`, or `SANOMA_DEMO=1` on a host). */
-  demo?: DemoConfig;
-}
-
-/** A demo's settings (`SanomaConfig.demo`). */
-export interface DemoConfig {
-  /**
-   * The URL the banner's "Start with these apps" opens, such as the hosted wizard with the demo's
-   * apps chosen; without one, the banner has no such link.
-   */
-  start?: string;
-  /**
-   * A session per visitor: each visitor gets a copy of the seeded database and a process of their
-   * own over it, so the moments wait for them alone and nothing they type reaches another. At most
-   * this many at once, or with `true` as many as the machine's memory and Postgres's connections
-   * hold; past it, visitors share one demo instance. Without it, every visitor shares that instance.
-   */
-  sessions?: true | number;
-  /** Minutes a visitor's session lives unused before it is dropped. Default 30. */
-  idle?: number;
-  /** Minutes between seeds of the demo afresh (its shared instance, or the sessions' seed). Default 60. */
-  reseed?: number;
-}
-
-/** Refuses a `demo` whose numbers make no demo: `sessions` `true` or a whole number above 0, `idle` and `reseed` minutes above 0. */
-function checkDemo(demo: DemoConfig | undefined): void {
-  const { sessions, idle, reseed } = demo ?? {};
-  if (sessions !== undefined && sessions !== true && !(Number.isInteger(sessions) && sessions > 0)) {
-    throw new Error(
-      `The config's \`demo.sessions\` is \`true\` or how many at once, a whole number above 0, not ${JSON.stringify(sessions)}`,
-    );
-  }
-  for (const [key, minutes] of Object.entries({ idle, reseed })) {
-    if (minutes !== undefined && !(typeof minutes === "number" && minutes > 0)) {
-      throw new Error(`The config's \`demo.${key}\` is minutes, a number above 0, not ${JSON.stringify(minutes)}`);
-    }
-  }
 }
 
 /** A config, checked, with everything a worker, client or app derives from it. */
@@ -180,18 +143,8 @@ export interface ResolvedConfig {
    * `connectors` order: what `drivers` indexes and the credentials are read from (`credentialsOf`).
    */
   driversByVendor: Map<string, Driver>;
-  /**
-   * The makers of the fakes the connectors attach, by vendor id in `connectors` order: each
-   * sandbox run makes its own. Resolved with `fakes: "instance"`, each gives its vendor's
-   * instance fake (`instanceFakes`).
-   */
+  /** The makers of the fakes the connectors attach, by vendor id in `connectors` order: each sandbox run makes its own. */
   fakes: Map<string, () => Fake<any, any>>;
-  /**
-   * Resolved with `fakes: "instance"` (a demo): each vendor's one fake, by vendor id, made once
-   * for this resolution. Each is its vendor's driver (`driversByVendor`), so live runs, sandbox
-   * runs and direct calls all call it, and the world's Givens seed it (`applyGivens`).
-   */
-  instanceFakes?: ReadonlyMap<string, Fake<any, any>>;
   /** The makers of the login halves the connectors attach, by vendor id in `connectors` order: the app makes one per public site that names it. */
   logins: ReadonlyMap<string, NonNullable<ConnectorSetup["login"]>>;
   /** The makers of the model halves the connectors attach, by vendor id in `connectors` order: the app makes each once for its model registry. */
@@ -288,17 +241,6 @@ export function rootOf(config: Pick<SanomaConfig, "root" | "file">): string | un
       : undefined;
 }
 
-/** What `resolveConfig` is given besides the config. */
-export interface ResolveOptions {
-  /**
-   * `"instance"`: run the whole instance on the connectors' fakes, as a demo does: each vendor's
-   * driver is one fake made for this resolution (`instanceFakes`), which every run and call
-   * shares. The collections stay on the config's database. Refused for a vendor whose connector
-   * attaches a driver and no fake, which would otherwise run live.
-   */
-  fakes?: "instance";
-}
-
 /**
  * Checks a config and derives what the runtime needs from it: the drivers and fakes from the
  * connectors' setups (`withSetup`), the collections' operations, driver and fake, and from
@@ -309,7 +251,7 @@ export interface ResolveOptions {
  * `root`. Each entry point resolves once: the worker and the client when they start, the app at
  * `startApp`, the `sanoma` bin when it loads the config.
  */
-export function resolveConfig(config: SanomaConfig, options: ResolveOptions = {}): ResolvedConfig {
+export function resolveConfig(config: SanomaConfig): ResolvedConfig {
   if (!Array.isArray(config.connectors)) {
     throw new Error("The config needs `connectors`: the connectors its workflows call, as their packages export them");
   }
@@ -326,7 +268,6 @@ export function resolveConfig(config: SanomaConfig, options: ResolveOptions = {}
   if (config.policy !== undefined) {
     throw new Error("The config's `policy` is gone: the policy is policies/*.cedar in the root; leave it out");
   }
-  checkDemo(config.demo);
   const collections = collectionsOf(config);
   const ledger = ledgerOf(config);
   const root = rootOf(config);
@@ -352,22 +293,19 @@ export function resolveConfig(config: SanomaConfig, options: ResolveOptions = {}
   ]);
   checkWakeupOps(types, ops);
   checkDatabaseOps(types, ops);
-  const fakes = makersOf(running, "fake");
-  const instanceFakes = options.fakes === "instance" ? instanceFakesOf(running, fakes) : undefined;
-  const driversByVendor = instanceFakes
-    ? new Map([...instanceFakes].map(([vendor, fake]) => [vendor, fake.driver]))
-    : new Map([...makersOf(running, "driver")].map(([vendor, make]) => [vendor, make()]));
+  const driversByVendor = new Map([...makersOf(running, "driver")].map(([vendor, make]) => [vendor, make()]));
   const remotes = new Map([...makersOf(config.connectors, "remote")].map(([vendor, make]) => [vendor, make()]));
   const drivers = indexDrivers(
     [
       ...driversByVendor.values(),
       changeDriver(remotes),
-      ...sandboxDrivers,
+      appsListDriver,
       ...(hostTyped ? [sourceDriver] : []),
       ...(dataStore ? [collectionsDriver(declared, dataStore)] : []),
     ],
     ops,
   );
+  const fakes = makersOf(running, "fake");
   if (dataStore) fakes.set(DATA_VENDOR, () => collectionsFake(declared));
   const names = new Map<string, WorkflowDefinition<any, any>>();
   for (const wf of config.workflows ?? []) {
@@ -415,7 +353,6 @@ export function resolveConfig(config: SanomaConfig, options: ResolveOptions = {}
     drivers,
     driversByVendor,
     fakes,
-    ...(instanceFakes && { instanceFakes }),
     logins: makersOf(config.connectors, "login"),
     models: makersOf(config.connectors, "model"),
     remotes,
@@ -459,10 +396,15 @@ function collectionsOf(config: SanomaConfig): Map<string, Collection> {
 }
 
 /**
- * The built-in drivers no fake implements that a sandbox run calls beside its fakes (`seedSandbox`):
- * those that need no credentials and change nothing, as `sanoma.apps.list` (GitHub's public search).
+ * The built-in drivers a sandbox run calls beside its fakes (`seedSandbox`), for the built-in
+ * operations among `ops` that no fake implements: `sanoma.apps.list`'s own, which needs no
+ * credentials and changes nothing (GitHub's public search), and `sanoma.source.resolve`'s fake
+ * (`fakeSourceDriver`), for a config with a host type.
  */
-export const sandboxDrivers: readonly Driver[] = [appsListDriver];
+export const sandboxDrivers = (ops: ReadonlyMap<string, unknown>): Driver[] => [
+  appsListDriver,
+  ...(ops.has(SOURCE_RESOLVE) ? [fakeSourceDriver] : []),
+];
 
 /**
  * `sanoma.wakeup`, the runtime's own: the type's operations and `sanoma.wakeup.register` (effect
@@ -515,25 +457,6 @@ function makersOf<K extends keyof ConnectorSetup>(
   return makers;
 }
 
-/**
- * Each vendor's one fake, made now, for `resolveConfig`'s `fakes: "instance"`; `fakes` (the
- * makers) then give these. Refuses a connector that attaches a driver and no fake.
- */
-function instanceFakesOf(
-  connectors: readonly Connector<any, any>[],
-  fakes: Map<string, () => Fake<any, any>>,
-): Map<string, Fake<any, any>> {
-  const live = [...makersOf(connectors, "driver").keys()].filter((vendor) => !fakes.has(vendor));
-  if (live.length) {
-    throw new Error(
-      `The instance runs on fakes, but the connector of ${live.join(", ")} attaches no fake, so it would run live; attach one (\`withSetup\`) or leave it out`,
-    );
-  }
-  const made = new Map([...fakes].map(([vendor, make]) => [vendor, make()]));
-  for (const [vendor, fake] of made) fakes.set(vendor, () => fake);
-  return made;
-}
-
 /**
  * The `name` of `<root>/package.json`, kept whole (`@acme/ops`), when that file exists and names
  * one; else "sanoma", as for a config with no `root`. Never a `package.json` above the root: a

package/src/cucumber.ts

@@ -173,7 +173,8 @@ const literal = (path: string) => path.replaceAll(/[*?[\]()+@]/g, "[$&]").replac
  * examples row at that line. `makeWorld` makes each scenario's World, given the report so far
  * (every file and pickle, read before the first scenario starts). A dry run matches the steps
  * and runs none. A step's error that is a bug in code (`isBug`) is rethrown once the run is
- * over, rather than reported as the step's failure.
+ * over, rather than reported as the step's failure. `timeoutMs` is how long a step may take
+ * (Cucumber's 5 s by default).
  */
 export async function runFeatures(
   library: ISupportCodeLibrary,
@@ -184,7 +185,15 @@ export async function runFeatures(
     line,
     dryRun = false,
     isBug,
-  }: { cwd: string; files: string[]; line?: number; dryRun?: boolean; isBug: (err: unknown) => boolean },
+    timeoutMs,
+  }: {
+    cwd: string;
+    files: string[];
+    line?: number;
+    dryRun?: boolean;
+    isBug: (err: unknown) => boolean;
+    timeoutMs?: number;
+  },
 ): Promise<Report> {
   const report: Report = { query: new Query(), texts: new Map(), parseErrors: [] };
   let bug: unknown;
@@ -200,7 +209,11 @@ export async function runFeatures(
   }
   const configuration: IRunOptions = {
     sources: { defaultDialect: "en", paths: files.map(literal), names: [], tagExpression: "", order: "defined" },
-    support: { ...library, World } as ISupportCodeLibrary,
+    support: {
+      ...library,
+      World,
+      ...(timeoutMs !== undefined && { defaultTimeout: timeoutMs }),
+    } as ISupportCodeLibrary,
     runtime: {
       dryRun,
       failFast: false,

package/src/db.ts

@@ -81,20 +81,12 @@ const MADE_ALREADY = new Set(["23505", "42P04", "42P07", "42710"]);
 /** True for the failure of a create that another process won: what was to be made is there. */
 export const madeAlready = (err: unknown): boolean => MADE_ALREADY.has(pgCode(err));
 
-/**
- * `SANOMA_POOL_SIZE`, read once: the most connections each Postgres pool of the process opens, its
- * pg pools' and DBOS's system pool alike; unset, theirs (10 each). `sanoma demo`'s session host sets
- * it low for each visitor's process, so a session costs a few connections, not a dozen.
- */
-const askedPoolSize = Number(process.env.SANOMA_POOL_SIZE);
-const POOL_SIZE = Number.isInteger(askedPoolSize) && askedPoolSize > 0 ? askedPoolSize : undefined;
-
 /**
  * A pool on the config's database for `what` (a word for the messages). An idle connection that
  * drops (Postgres restarted) is replaced on the next query; unheard, it would end the process.
  */
 export function openPool(databaseUrl: string, what: string): Pool {
-  const pool = new Pool({ connectionString: databaseUrl, ...(POOL_SIZE !== undefined && { max: POOL_SIZE }) });
+  const pool = new Pool({ connectionString: databaseUrl });
   pool.on("error", (err) => warn(`a ${what} connection failed: ${errorMessage(err)}`));
   return pool;
 }
@@ -107,10 +99,7 @@ export function openPool(databaseUrl: string, what: string): Pool {
  * queries at once on one client, which pg deprecates. `prepareDatabase` sets the same 60 s guard
  * on the database instead. Remove the switch when DBOS awaits its `SET`.
  */
-export const DBOS_DATABASE_OPTIONS = {
-  systemDatabaseIdleTransactionTimeoutMs: 0,
-  ...(POOL_SIZE !== undefined && { systemDatabasePoolSize: POOL_SIZE }),
-} as const;
+export const DBOS_DATABASE_OPTIONS = { systemDatabaseIdleTransactionTimeoutMs: 0 } as const;
 
 /**
  * Stamps the change runs `ids` still unfinished on another version with the application version

package/src/fake.ts

@@ -7,7 +7,6 @@ import {
   DriverError,
   type OpIdOf,
   type Specs,
-  withSetup,
 } from "./op.ts";
 import { fail, type Instance, UNREGISTERED, type WakeupApi, wakeupCalls } from "./wakeup-driver.ts";
 import { INSTANCE_TOKEN, instanceUrl } from "./wakeup-service.ts";
@@ -73,7 +72,7 @@ type Fault =
   | { kind: "hold"; released: Promise<void> };
 
 /**
- * Builds a fake vendor for a connector, for tests and demos. `ops` implements the operations
+ * Builds a fake vendor for a connector, for tests and sandbox runs. `ops` implements the operations
  * against `state`, typed by the connector as `defineDriver` does. The fake adds what a real
  * vendor does around them: a repeated idempotency key gets the first reply and changes
  * nothing. A test can make the next call fail, lose its reply, hit a rate limit or wait.
@@ -159,17 +158,6 @@ export function defineFake<V extends string, S extends Specs, T extends Record<s
   };
 }
 
-/**
- * `connector` set up with this fake instead of the one its package attaches, for a test or a demo
- * that seeds or reads the fake its runs call: live runs call its driver, and sandbox runs call it
- * too, since its maker gives this very one. A driver swap alone is `withSetup(connector, { driver })`,
- * which keeps the package's fake, so each sandbox run has one of its own. The operations are the
- * same.
- */
-export function withFake<C extends Connector<any, any>>(connector: C, fake: Fake<any, any>): C {
-  return withSetup(connector, { driver: () => fake.driver, fake: () => fake });
-}
-
 // The built-in `sanoma.wakeup`'s fake: an in-memory wakeup service that calls the host's `/wake`.
 
 /** An instance of the fake wakeup service, as it keeps one. */

package/src/index.ts

@@ -55,7 +55,6 @@ export {
 } from "./resource.ts";
 export {
   declaredWakeup,
-  type DemoConfig,
   defineConfig,
   resolveConfig,
   resolveDatabaseUrl,

package/src/resource.ts

@@ -1,8 +1,10 @@
 import { z } from "zod";
 import { checkDatabase, type DatabaseSpec } from "./database.ts";
+import { isRunControlError } from "./errors.ts";
 import { checkHost, type HostSpec } from "./host.ts";
 import { type Connector, type OpSpec, RESOURCE, VENDOR } from "./op.ts";
 import { isSanomaSecret, isSecret, type Secret } from "./secret.ts";
+import { errorMessage } from "./shared.ts";
 import { checkWakeup, type WakeupSpec } from "./wakeup.ts";
 
 /** Which fields of a resource are flagged, by dotted path (`pages.html_url`; a list's items have no index). */
@@ -123,6 +125,47 @@ export interface AfterCreate {
   until?: (output: any) => boolean;
 }
 
+/** How long apply waits between calls of an `afterCreate` operation with `until`, and how many calls it makes. */
+export const AFTER_CREATE_SECONDS = 5;
+export const AFTER_CREATE_CALLS = 120;
+/** How long an `afterCreate` operation may be polled, in all, in milliseconds. */
+export const AFTER_CREATE_MS = AFTER_CREATE_SECONDS * AFTER_CREATE_CALLS * 1000;
+
+/** Why an `afterCreate` operation with `until` did not pass: the time it was given, and its last call's error if that failed. */
+export const afterCreateStuck = (op: string, failed: unknown): string =>
+  `${op} did not pass in ${AFTER_CREATE_MS / 60_000} minutes` +
+  (failed === undefined ? "" : `; its last call failed: ${errorMessage(failed)}`);
+
+/**
+ * Calls one `afterCreate` operation for a new object as apply does: with `until`, again every
+ * few seconds until its output passes, a call that fails meanwhile being one that did not pass;
+ * without, once, a failure thrown. Returns why it did not pass, if it did not. Apply inlines the
+ * same loop in its `run`, which may not close over its `ctx`; an operation's own test calls this.
+ */
+export async function callAfterCreate(
+  hook: AfterCreate,
+  made: { id: string; export: string },
+  call: (op: string, input: unknown) => Promise<unknown>,
+  sleep: (seconds: number) => Promise<void>,
+): Promise<string | undefined> {
+  const given = hook.input(made);
+  let output: unknown;
+  let failed: unknown;
+  for (let n = 0; n < AFTER_CREATE_CALLS && (n === 0 || (hook.until && !hook.until(output))); n++) {
+    if (n > 0) await sleep(AFTER_CREATE_SECONDS);
+    try {
+      output = await call(hook.op, given);
+      failed = undefined;
+    } catch (err) {
+      if (isRunControlError(err) || !hook.until) throw err;
+      output = undefined;
+      failed = err;
+    }
+  }
+  if (hook.until && !hook.until(output)) return afterCreateStuck(hook.op, failed);
+  return undefined;
+}
+
 /**
  * Where a declared resource keeps its brand, its type's `<vendor>.<type>`: a symbol, so a field
  * holding a resource is told from data; a registered one (`Symbol.for`), so a copy of this

package/src/run.ts

@@ -46,8 +46,6 @@ export interface WorkerState {
   drivers: Map<string, DriverFn>;
   /** The makers of the config's fake vendors, by vendor id: a sandbox run makes its own of each when it is seeded. */
   fakes: Map<string, () => Fake<any, any>>;
-  /** The instance's fakes, by vendor id, when it runs on them (`fakes: "instance"`): its sandbox runs seed and call these, not fakes of their own. */
-  instanceFakes?: ReadonlyMap<string, Fake<any, any>>;
   /** Where sandbox runs' scenarios are, the resource types their steps may name, and the steps the connectors ship. */
   scenarios?: URL;
   /** The worker's `source`, when it was given one. */

package/src/sandbox.ts

@@ -4,7 +4,7 @@ import { opIdsOf } from "./define.ts";
 import { SanomaError } from "./errors.ts";
 import type { Fake, ResourceFake } from "./fake.ts";
 import { entry, type LedgerRecord, write } from "./ledger.ts";
-import type { CallContext, DriverFn, Op } from "./op.ts";
+import type { DriverFn } from "./op.ts";
 import type { Run } from "./run.ts";
 import { memorySecrets } from "./secret.ts";
 import { type Given, loadScenarios, type Scenario } from "./scenario.ts";
@@ -58,7 +58,7 @@ export function seedResource(
   scenario: string,
   copy: ResourceFake,
   given: Extract<Given, { resource: string }>,
-): Seeds[number] {
+): Extract<LedgerRecord, { type: "scenario.seeded" }>["seeds"][number] {
   const { resource, type, name } = given;
   try {
     if ("gone" in given) {
@@ -77,81 +77,16 @@ export function seedResource(
   }
 }
 
-/** What a scenario's `Given` steps seeded, as its `scenario.seeded` record has it. */
-export type Seeds = Extract<LedgerRecord, { type: "scenario.seeded" }>["seeds"];
-
-/**
- * Where a scenario's `Given` steps go (`applyGivens`): a sandbox run's own fakes (`run`), or the
- * instance a demo runs (`instance`), its collections in the config's database and every vendor
- * on its one fake, which every run shares, so a fault, injected into a call some other run would
- * make, is refused there.
- */
-export interface GivenTarget {
-  kind: "run" | "instance";
-  /** What a `Given` operation is called through, by operation id. */
-  drivers: ReadonlyMap<string, DriverFn>;
-  /** The fakes, by vendor id: what a `Given` resource is put in, and a `run`'s faults injected into. */
-  fakes: ReadonlyMap<string, Fake<unknown>>;
-  /** The operations by id, for a fault's vendor. */
-  ops: ReadonlyMap<string, Op>;
-  /** The context of the call the `i`th `Given` makes. */
-  call(i: number, op: string): CallContext;
-}
-
-/**
- * Applies the scenario's `Given` steps to the target: calls each operation through its drivers,
- * puts or removes each resource in its vendor's fake, then, for a `run`, injects the faults.
- * Checks first that every operation it seeds has a driver there, that every resource's vendor has
- * a fake holding resources, and, for an `instance`, that it injects no fault. Returns what it
- * seeded, in order.
- */
-export async function applyGivens(scenario: Pick<Scenario, "name" | "given">, target: GivenTarget): Promise<Seeds> {
-  const { name, given } = scenario;
-  const fault = given.find((g) => "fault" in g);
-  if (fault && target.kind === "instance") {
-    throw new SanomaError(
-      "invalid_input",
-      `Scenario "${name}" injects a fault ("${fault.step}"), but its Givens go to the instance, whose fakes every run shares`,
-      { scenario: name, step: fault.step },
-    );
-  }
-  const missing = [...new Set(given.flatMap((g) => ("op" in g && !target.drivers.has(g.op) ? [g.op] : [])))];
-  if (missing.length) {
-    throw new SanomaError(
-      "invalid_input",
-      `Scenario "${name}" seeds ${missing.join(", ")}, but no fake its connectors attach implements ${missing.length > 1 ? "them" : "it"}`,
-      { scenario: name, missing },
-    );
-  }
-  const plain = missingResourceFake(scenario, target.fakes);
-  if (plain) throw plain;
-  const seeded: Seeds = [];
-  for (const [i, g] of given.entries()) {
-    if ("fault" in g) continue;
-    if ("op" in g) {
-      const output = await target.drivers.get(g.op)!(g.input, target.call(i, g.op));
-      seeded.push({ op: g.op, input: g.input, output });
-      continue;
-    }
-    // Checked above: the vendor's fake holds resources.
-    seeded.push(seedResource(name, target.fakes.get(g.vendor) as Fake<unknown> & ResourceFake, g));
-  }
-  for (const g of given) {
-    if ("fault" in g) target.fakes.get(target.ops.get(g.op)!.vendor)![g.fault](g.op);
-  }
-  return seeded;
-}
-
 /**
  * Seeds a sandbox run of the scenario `name`, from the worker, in one step: reads the scenario,
- * checks that it runs this workflow, picks the run's fakes, checks that every operation the
- * workflow uses has one, then applies the scenario's `Given` steps to them
- * (`applyGivens`) and puts their functions on the run. The run then calls those only. Its fakes
- * are its own (each vendor's maker, called once for the run), so sandbox runs share no state when
- * the makers make a new fake each; on an instance that runs on fakes (`instanceFakes`) they are
- * the instance's, which its sandbox runs share, as its live drivers are. The step's checkpoint
- * never stands in for a run's own: a run whose seeding is replayed from it has none, and fails,
- * since a sandbox run does not survive a worker restart; on an instance's fakes it goes on with them.
+ * checks that it runs this workflow, makes the run's own fakes (each vendor's maker, called once
+ * for the run), checks that every operation the workflow uses or the scenario seeds has one and
+ * that every resource it seeds has a fake holding resources, calls each `Given` operation
+ * through them, puts or removes each `Given` resource in them, injects the faults into them,
+ * then puts their functions on the run. The run then calls those only, so sandbox runs share no
+ * state when the makers make a new fake each. The step's checkpoint never stands in for them: a
+ * run whose seeding is replayed from it has none, and fails, since a sandbox run does not
+ * survive a worker restart.
  */
 export async function seedSandbox(run: Run, name: string): Promise<void> {
   const { state } = run;
@@ -168,19 +103,20 @@ export async function seedSandbox(run: Run, name: string): Promise<void> {
         throw new SanomaError("invalid_input", `No scenario named "${name}"${why}`, { scenario: name });
       }
       if (scenario.workflow !== run.workflow) {
-        const runs = scenario.workflow === undefined ? "is a world, which runs nothing" : `runs ${scenario.workflow}`;
-        throw new SanomaError("invalid_input", `Scenario "${name}" ${runs}, not ${run.workflow}`, {
+        throw new SanomaError("invalid_input", `Scenario "${name}" runs ${scenario.workflow}, not ${run.workflow}`, {
           scenario: name,
-          ...(scenario.workflow !== undefined && { workflow: scenario.workflow }),
+          workflow: scenario.workflow,
         });
       }
-      const instance = state.instanceFakes;
-      const fakes = instance ?? new Map([...state.fakes].map(([vendor, make]) => [vendor, make()]));
-      const drivers = instance
-        ? state.drivers
-        : indexDrivers([...Array.from(fakes.values(), (f) => f.driver), ...sandboxDrivers], state.ops);
-      // What the scenario seeds is checked by `applyGivens`.
-      const missing = opIdsOf(state.workflows.get(run.workflow)!).filter((id) => !drivers.has(id));
+      const fakes = new Map([...state.fakes].map(([vendor, make]) => [vendor, make()]));
+      // The built-ins first, so a connector's fake that implements one of their operations wins.
+      const drivers = indexDrivers(
+        [...sandboxDrivers(state.ops), ...Array.from(fakes.values(), (f) => f.driver)],
+        state.ops,
+      );
+      const uses = opIdsOf(state.workflows.get(run.workflow)!);
+      const seeding = scenario.given.flatMap((g) => ("op" in g ? [g.op] : []));
+      const missing = [...new Set([...uses, ...seeding])].filter((id) => !drivers.has(id));
       if (missing.length) {
         throw new SanomaError(
           "invalid_input",
@@ -188,20 +124,28 @@ export async function seedSandbox(run: Run, name: string): Promise<void> {
           { scenario: name, missing },
         );
       }
-      const seeded = await applyGivens(scenario, {
-        kind: instance ? "instance" : "run",
-        drivers,
-        fakes,
-        ops: state.ops,
-        call: (i, opId) => ({ idempotencyKey: `${run.id}:seed:${i}`, runId: run.id, opId, attempt: 1, secrets }),
-      });
+      const plain = missingResourceFake(scenario, fakes);
+      if (plain) throw plain;
+      const seeded: Extract<LedgerRecord, { type: "scenario.seeded" }>["seeds"] = [];
+      for (const [i, given] of scenario.given.entries()) {
+        if ("fault" in given) continue;
+        if ("op" in given) {
+          const call = { idempotencyKey: `${run.id}:seed:${i}`, runId: run.id, opId: given.op, attempt: 1, secrets };
+          const output = await drivers.get(given.op)!(given.input, call);
+          seeded.push({ op: given.op, input: given.input, output });
+          continue;
+        }
+        // Checked above: the vendor's fake holds resources.
+        seeded.push(seedResource(name, fakes.get(given.vendor) as Fake<unknown> & ResourceFake, given));
+      }
+      for (const given of scenario.given) {
+        if ("fault" in given) fakes.get(state.ops.get(given.op)!.vendor)![given.fault](given.op);
+      }
       copies = drivers;
       return { seeds: seeded };
     },
     { name: "sandbox:seed" },
   );
-  // Replayed on an instance that runs on fakes: they are the instance's, still there in this process.
-  if (!copies && state.instanceFakes) copies = state.drivers;
   if (!copies) {
     // Replayed from its checkpoint (after a worker restart, or in a fork), so the run has no fakes.
     // The records written before the restart hold the seqs from here on: the failure goes after them.