@olivervea/pipelines 2.0.0-beta.15 → 2.0.0-beta.17

package/README.md

@@ -103,7 +103,7 @@ Rules:
 - **Trigger mappers** produce `z.input`, so fields with defaults may be left out. **Handlers, mapper refs and `when`** see `z.output`.
 - A **plain-schema input** has no model to match on, so the step needs a mapper.
 - **`optional(M)`** means "maybe skipped": `M` must still have an earlier producer.
-- **`external(M, { title, description?, from? })`** is answered from outside the run (`from`: `person()`, the default). It needs no producer and no mapper entry; the step waits until it is answered, then the value (validated against `M`) is in its input like any other. Failure handlers can't have one.
+- **`external(M, { title, description?, from? })`** is answered from outside the run; `from` lists `callback()` (another system POSTs to the URL an earlier step gets from `ctx.inputUrl(step, input)`), `poll({ url, valuePath, intervalSeconds? })` and `person()` (the default). It needs no producer and no mapper entry; the step waits until it is answered, then the value (validated against `M`) is in its input like any other. Failure handlers can't have one.
 
 ### Config
 
@@ -146,14 +146,14 @@ Library steps carry their own implementation and image; they take typed settings
 | Step | Image | Input → output | Config |
 |---|---|---|---|
 | `steps.gitHubSource` | `alpine:3.22` (work happens in the harness) | `{ repo: "owner/name", sha }` (plain schemas: needs a mapper) → `Source` | `token?: Secret` (sent as `Authorization: Bearer` when set; unset = anonymous; becomes the step's secret), `apiUrl?` (default `https://api.github.com`) |
-| `steps.imageBuild` | `gcr.io/kaniko-project/executor:debug` | `{ source: Source }` → `BuiltImage { repository, tag, digest, tar }`; with `push`: `PushedImage { repository, tag, digest }` | `repository` (image name; tag = run version, `-attempt<n>` on reruns), `context?` (dir in the source tree with the `Dockerfile`; default the root), `push?` (push to `repository` instead of a tarball), `contentTag?` (with `push`: tag `src-<context hash>`, skip when the registry has it), `registryMap?` (kaniko `--registry-map`: registry → mirror prefix; default: the homelab pull-through caches, `{}` = off), `stallTimeoutSeconds?` (default 300, 0 = off), `retries?` (default 2), `registryAuth?` (`{ username, password: Secret }`: log in to the `repository` registry; or a config reference to `{ username, password: { secret: NAME } }`, with `NAME` in `secrets`), `insecureRegistry?` (that registry is plain HTTP), `secrets?` (declared secrets a config `registryAuth` may name), `enabled?` (`false` skips the step) |
+| `steps.imageBuild` | `gcr.io/kaniko-project/executor:debug` | `{ source: Source }` → `BuiltImage { repository, tag, digest, tar }`; with `push`: `PushedImage { repository, tag, digest }` | `repository` (image name; tag = run version, `-attempt<n>` on reruns), `context?` (dir in the source tree with the `Dockerfile`; default the root), `push?` (push to `repository` instead of a tarball), `contentTag?` (with `push`: tag `src-<context hash>`, skip when the registry has it), `registryMap?` (kaniko `--registry-map`: registry → mirror prefix; default none), `stallTimeoutSeconds?` (default 300, 0 = off), `retries?` (default 2), `registryAuth?` (`{ username, password: Secret }`: log in to the `repository` registry; or a config reference to `{ username, password: { secret: NAME } }`, with `NAME` in `secrets`), `insecureRegistry?` (that registry is plain HTTP), `secrets?` (declared secrets a config `registryAuth` may name), `enabled?` (`false` skips the step) |
 | `steps.helmDeployOverSsh` | `alpine:3.22` (+ `apk add openssh-client` at run time) | `{ source: Source, <key>: BuiltImage }` per `images` (`PushedImage` with `fromRegistry`) → `HelmRelease { release, namespace, image? }` (`image`: the first image; absent without images) | `host` (`user@host`), `sshKey: Secret`, `release`, `namespace`, `chart` (dir in the source), `values?` (chart-relative `-f`), `set?`, `images?` (input key → values prefix; default `{ image: "image" }`; `{}` = the chart alone), `fromRegistry?`, `imageRefs?` (`PushedImage` input key → values prefix: set as `<prefix>.repository`/`.tag`/`.digest`, not pulled; works next to tarball `images`), `deployments?` (default `[release]`, none without images), `rolloutTimeoutSeconds?` (default 120), `dependencies?` (pull `Chart.yaml`'s dependencies on the host), `helmWait?` / `atomic?` (`helm --wait` / `--atomic`), `healthUrl?` (URL or `{ url, attempts?, delaySeconds? }`) |
 | `steps.helmDeployInCluster` (and the `target` form of `helmDeployOverSsh`) | `alpine/helm:3.16.2` (ssh: `alpine:3.22`) | `{ source: Source, <key>: PushedImage }` per `images`, `<key>: optional(PushedImage)` per `imageRefs` → `HelmRelease` (`image`: `repository:tag@digest` of the first image) | `target` (a `select` case's reference to a `helmTarget()` variant: `{ kind: "inCluster", namespace, release, values, set, url? }` for helmDeployInCluster, the same plus `host` with `kind: "ssh"` for helmDeployOverSsh; `url` is where step pods reach the release, default its in-cluster Service URL, and is passed on in `HelmRelease.url`), `sshKey: Secret` (ssh only), `chart`, `inlineValues?` (objects written as values files after the target's), `images?`, `imageRefs?`, `deployments?` (ssh), `rolloutTimeoutSeconds?` (default 120), `healthPath?`; helmDeployInCluster declares `clusterAccess` |
 | `steps.composeDeploy` | `alpine:3.22` (work happens in the harness) | `{ image: PushedImage }` → `HelmRelease { release: <service>, namespace: "compose", image: <repository>@<digest> }` | `target` (a `select` case's reference to the compose variant of `deployTarget()`: `{ kind: "compose", deployerUrl, service, token: { secret }, healthUrl? }`), `token: Secret` (must be the secret the target names; the step's only secret), `timeoutSeconds?` |
 
 - `gitHubSource` downloads `<apiUrl>/repos/<repo>/tarball/<sha>` (retrying 5xx), strips the top-level directory and outputs it as `tree`.
 - `imageBuild` copies the tree to `/kaniko/build-context` (kaniko wipes other directories between multi-stage builds), builds `--context=/kaniko/build-context[/<context>] --dockerfile=<that>/Dockerfile` with `--no-push --tar-path --digest-file`, and outputs the tarball. A missing context or Dockerfile fails the step before kaniko starts. `repository` in the output is fully qualified the way a runtime names a loaded image (`x` → `docker.io/library/x`). A **stall watchdog** kills kaniko when it prints nothing for `stallTimeoutSeconds` (a base-image pull can stall on an idle connection at "Unpacking rootfs", and kaniko has no read timeout), failing the attempt; `retries` then starts a fresh attempt. The retry is deliberately a new pod, never a second kaniko in the same container: kaniko unpacks the base image over the container root and does not clean up when killed.
-- **Caches never block a build.** `registryMap` defaults to the homelab pull-through caches (`DEFAULT_REGISTRY_MAP`: `mcr.microsoft.com` → `mcr-cache.ovea.pro`, `index.docker.io` → `hub-cache.ovea.pro`; kaniko under gVisor stalls pulling from mcr.microsoft.com directly). A map you pass replaces the default; `{}` turns mapping off. Before kaniko starts, every mirror host gets a 5 s `GET https://<host>/v2/` (200 or 401 = up); one that doesn't answer is dropped with a log line (`mcr-cache.ovea.pro unreachable; pulling from mcr.microsoft.com directly`). After that, kaniko itself copes: it falls back to the original registry when a mirror can't serve an image's manifest (`RetrieveRemoteImage`; `--skip-default-registry-fallback` is never set). A cache that dies mid-download (after the manifest came from it) fails or stalls the attempt; `retries` starts a fresh one, which probes again.
+- **Caches never block a build.** `registryMap` maps registries to pull-through caches (e.g. `{ "mcr.microsoft.com": "mcr-cache.example.com" }`; kaniko under gVisor can stall pulling from mcr.microsoft.com directly, a nearby cache doesn't). There is none by default. Before kaniko starts, every mirror host gets a 5 s `GET https://<host>/v2/` (200 or 401 = up); one that doesn't answer is dropped with a log line (`<cache> unreachable; pulling from <registry> directly`). After that, kaniko itself copes: it falls back to the original registry when a mirror can't serve an image's manifest (`RetrieveRemoteImage`; `--skip-default-registry-fallback` is never set). A cache that dies mid-download (after the manifest came from it) fails or stalls the attempt; `retries` starts a fresh one, which probes again.
 - **Registry mode** (`push: true`, for images too big for the step's ~1 GiB scratch space and Garage): kaniko runs without `--no-push`/`--tar-path`, pushes to `repository` (it must start with a registry host; anonymous unless `registryAuth`) and the output is a `PushedImage` with the digest from `--digest-file`. With `contentTag`, the tag is `src-` + the first 12 hex of the sha256 of the context directory's deterministic tar (the bytes `ctx.output.dir` would write), computed from the fetched tree; a `HEAD https://<host>/v2/<path>/manifests/<tag>` (answering a Basic or Bearer challenge: anonymous token, or the `registryAuth` login; an anonymous lookup that is denied counts as "not there") that answers a `Docker-Content-Digest` skips kaniko and outputs that digest. With `registryAuth`, the step declares the password secret and writes `$DOCKER_CONFIG/config.json` (`/kaniko/.docker` in the kaniko image) for that registry before kaniko runs, so pushes and base-image pulls from it are logged in. `insecureRegistry` makes the lookups plain HTTP and adds kaniko `--insecure --insecure-registry=<host>`.
 - `helmDeployOverSsh` gets each image into the host's **k3s** containerd: a `BuiltImage` tar is streamed in (`nerdctl --address /run/k3s/containerd/containerd.sock --namespace k8s.io load`), a `PushedImage` (`fromRegistry`) is pulled there (`… pull -q`, so the rollout doesn't wait on the pull). It copies the chart to `/tmp/<release>-helm-<namespace>`, runs `helm upgrade --install` from inside it (values, then `set`, then per image `<prefix>.repository`/`.tag`/`.pullPolicy` — `Never` for tarballs, `IfNotPresent` for registry images — which always win), waits for `kubectl rollout status` of each of `deployments` in order (`deploy/<name>` for a bare name), and with `healthUrl` polls it (5 × 5 s unless given) from the harness. `images: {}` deploys the chart alone: the step's only input is `source`, no image is imported and no image flag set, and nothing is waited on unless `deployments` names it. `dependencies: true` runs `helm pull <name> --repo <repository> --version <version>` (or the `oci://` reference) into the copied chart's `charts/` for each dependency in `Chart.yaml`; `helmWait` / `atomic` add `--wait` / `--atomic` with `--timeout=<rolloutTimeoutSeconds>s` and make `deployments` default to none. Several images (one chart, two Deployments):
 
@@ -309,11 +309,12 @@ This section is everything the C# side needs in order to run the binary.
 | `OLVE_CASES` | run | Only for a step inside a `select`: a JSON array of the case conditions it sits in (`["target.prod.kind=ssh"]`); `run <step>` uses it to pick the variant of a name several cases use. |
 | `<SECRET_NAME>` | per step | Each declared secret as an env var of the **same name**: `secretKeyRef` key = name. Mount only the step's `secrets` (for poll triggers, the poll's `secrets`). Child processes inherit them. The mount is optional: an unset secret leaves the variable unset and `ctx.secrets.<NAME>` throws on access, so a handler can check `process.env.<NAME>` first and skip. |
 | `OLVE_RESULT_URL` | optional | Pre-signed **PUT** for `result.tar.gz` (see below). Unset means no upload. |
+| `OLVE_CALLBACK_URLS` | optional | JSON object mapping `<step>/<input>` → this run's callback URL of that external input (`ctx.inputUrl`). Set when the pipeline has `callback()` inputs and the instance has a public base URL. |
 | `OLVE_FILE_URLS` | optional | JSON object mapping file key → pre-signed **GET** URL, one entry per file ref in the input. The key is `<run>/<step>/<attempt>/<path>` (`path` exactly as in the ref, including a trailing `/` for directories). The URL points at the stored object (see the storage rule). |
 | `OLVE_FILES_BASE_URL` (+ `OLVE_FILES_TOKEN`) | optional | Fallback: `GET <base>/<run>/<step>/<attempt>/<object path>` with an optional `Authorization: Bearer <token>`. |
 | `OLVE_FILES_DIR` | dev | Local pool laid out as `<run>/<step>/<attempt>/files/<object path>`. |
 
-`OLVE_RESULT_URL`, `OLVE_FILE_URLS` and `OLVE_FILES_TOKEN` are removed from the environment of child processes. URLs are never logged past `?`.
+`OLVE_RESULT_URL`, `OLVE_FILE_URLS`, `OLVE_FILES_TOKEN` and `OLVE_CALLBACK_URLS` are removed from the environment of child processes. URLs are never logged past `?`.
 
 `ctx.files.fetch` looks for a file in this order:
 
@@ -384,7 +385,7 @@ Exact format: [`manifest.schema.json`](manifest.schema.json) (JSON Schema 2020-1
   - a nested object of mappings.
 
   An object whose only key is `ref` (with a string value) or `const` is a tag. Describe never emits a nested object with exactly that key set. Model-matched inputs are emitted already resolved (`{"ref": "build"}`).
-- **Step `externalInputs`** (when present) maps each external input key to `{model, title, description, from: [{kind: "person"}]}`. Those keys are not in `input` or `inputTypes`; the service merges the answers into `input.json`.
+- **Step `externalInputs`** (when present) maps each external input key to `{model, title, description, from}`, `from` being `{kind: "person"}`, `{kind: "callback"}` or `{kind: "poll", url, valuePath, intervalSeconds}`. Those keys are not in `input` or `inputTypes`; the service merges the answers into `input.json`.
 - **`inputTypes`** declares each input key: `{model, optional}`, or `{schema: {output, input?}}` for a plain schema.
 - **`handlerHash`** is the step's implementation identity. A step version can be computed from image + `inputTypes`/model versions + `output` model version + `secrets` + `configEntries` (and those entries' schemas) + `input` mappings + `handlerHash`. Stage placement, `when` and the step's `description` are not part of it.
   - Custom steps: `sha256(canonical {bundle, harness})`. `bundle` hashes the handler bundled on its own, with `pipeline.ts`, `models.ts` and `@olivervea/pipelines` external. It is tree-shaken and includes embedded scripts, so it changes only when that handler's code (or code it uses) changes.

package/manifest.schema.json

@@ -411,17 +411,64 @@
               "from": {
                 "description": "Who or what may answer.",
                 "items": {
-                  "additionalProperties": false,
-                  "properties": {
-                    "kind": {
-                      "const": "person",
-                      "type": "string"
+                  "oneOf": [
+                    {
+                      "additionalProperties": false,
+                      "properties": {
+                        "kind": {
+                          "const": "person",
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "kind"
+                      ],
+                      "type": "object"
+                    },
+                    {
+                      "additionalProperties": false,
+                      "properties": {
+                        "kind": {
+                          "const": "callback",
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "kind"
+                      ],
+                      "type": "object"
+                    },
+                    {
+                      "additionalProperties": false,
+                      "properties": {
+                        "intervalSeconds": {
+                          "maximum": 9007199254740991,
+                          "minimum": 10,
+                          "type": "integer"
+                        },
+                        "kind": {
+                          "const": "poll",
+                          "type": "string"
+                        },
+                        "url": {
+                          "description": "GET while waiting; {run.id} and {run.number} are filled in.",
+                          "type": "string"
+                        },
+                        "valuePath": {
+                          "description": "Dot path to the value; '.' is the whole body.",
+                          "minLength": 1,
+                          "type": "string"
+                        }
+                      },
+                      "required": [
+                        "kind",
+                        "url",
+                        "valuePath",
+                        "intervalSeconds"
+                      ],
+                      "type": "object"
                     }
-                  },
-                  "required": [
-                    "kind"
-                  ],
-                  "type": "object"
+                  ]
                 },
                 "minItems": 1,
                 "type": "array"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olivervea/pipelines",
-  "version": "2.0.0-beta.15",
+  "version": "2.0.0-beta.17",
   "description": "Olve.Pipelines v2 SDK: typed pipeline authoring, the step harness, and the build tool.",
   "type": "module",
   "license": "MIT",

package/src/core/external.ts

@@ -1,13 +1,38 @@
 import { isModel, type AnyModel } from "./models.ts";
 
 /** Who or what may supply an external input's value. */
-export type ExternalSource = { readonly kind: "person" };
+export type ExternalSource =
+  | { readonly kind: "person" }
+  | { readonly kind: "callback" }
+  | { readonly kind: "poll"; readonly url: string; readonly valuePath: string; readonly intervalSeconds: number };
 
 /** A signed-in user answers, in the UI or with `pl input`. */
 export function person(): ExternalSource {
   return Object.freeze({ kind: "person" as const });
 }
 
+/**
+ * Another system answers by POSTing to this run's callback URL for the input, which an earlier step hands it
+ * with `ctx.inputUrl(step, input)`. The body is the value as JSON, or `{"$decline": "reason"}`.
+ */
+export function callback(): ExternalSource {
+  return Object.freeze({ kind: "callback" as const });
+}
+
+export interface PollOptions {
+  /** GET while the step waits; `{run.id}` and `{run.number}` are filled in. */
+  url: string;
+  /** Dot path to the value in the JSON response; `.` is the whole body. */
+  valuePath: string;
+  /** Default 30; at least 10. */
+  intervalSeconds?: number;
+}
+
+/** The service polls `url` while the step waits and answers with the value at `valuePath` once it validates. */
+export function poll(options: PollOptions): ExternalSource {
+  return Object.freeze({ kind: "poll" as const, url: options.url, valuePath: options.valuePath, intervalSeconds: options.intervalSeconds ?? 30 });
+}
+
 /**
  * A step input whose value comes from outside the run. The step waits until it is answered (the value is
  * validated against `model`), then runs with the value in its input like any other.

package/src/ctx/index.ts

@@ -18,6 +18,8 @@ export interface CtxOptions {
   signal: AbortSignal;
   /** Where log lines go (default stderr). */
   logSink?: (line: string) => void;
+  /** `<step>/<input>` → callback URL (`ctx.inputUrl`). */
+  callbackUrls?: Readonly<Record<string, string>>;
 }
 
 export function formatLog(message: string, fields?: Record<string, unknown>): string {
@@ -118,5 +120,12 @@ export function createCtx(o: CtxOptions): Ctx {
     run: Object.freeze({ ...o.run }),
     tmpDir: o.paths.tmp,
     skip: skipped,
+    inputUrl: (step, input) => {
+      const name = typeof step === "string" ? step : step.name;
+      const url = o.callbackUrls?.[`${name}/${input}`];
+      if (!url)
+        throw new Error(`no callback URL for input '${input}' of step '${name}': it must list callback() in from, and the instance needs a public base URL`);
+      return url;
+    },
   };
 }

package/src/ctx/types.ts

@@ -113,4 +113,9 @@ export interface Ctx<Sec extends string = string, Cfg extends AnyConfigEntry = n
   readonly tmpDir: string;
   /** Runtime escape hatch: produce no output. Prefer `when` blocks. */
   skip(reason: string): Skipped;
+  /**
+   * This run's callback URL for an external input with `from: [callback()]` (of any step of the pipeline):
+   * hand it to the system that will answer. POST the value as JSON, or `{"$decline": "reason"}`.
+   */
+  inputUrl(step: string | { readonly name: string }, input: string): string;
 }

package/src/describe/describe.ts

@@ -197,11 +197,20 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
       if (failureHandler) problems.push(`${at}: failure handlers run unattended and cannot wait for input ('${key}')`);
       if (typeof e.title !== "string" || e.title.trim() === "") problems.push(`${at} external input '${key}': title must not be empty`);
       if (e.from.length === 0) problems.push(`${at} external input '${key}': from must list at least one source`);
+      if (new Set(e.from.map((f) => f.kind)).size !== e.from.length) problems.push(`${at} external input '${key}': each source kind may be listed once`);
+      if (e.from.some((f) => f.kind === "callback") && !/^[A-Za-z0-9_-]+$/.test(key))
+        problems.push(`${at} external input '${key}': a callback input's key must be letters, digits, '_' or '-' (it is part of the URL)`);
+      for (const f of e.from) {
+        if (f.kind !== "poll") continue;
+        if (!/^https?:\/\//.test(f.url)) problems.push(`${at} external input '${key}': poll url must be an absolute http(s) URL`);
+        if (!Number.isInteger(f.intervalSeconds) || f.intervalSeconds < 10) problems.push(`${at} external input '${key}': poll intervalSeconds must be an integer of at least 10`);
+        if (f.valuePath.trim() === "") problems.push(`${at} external input '${key}': poll valuePath must not be empty`);
+      }
       externalInputs[key] = {
         model: useModel(e.model, `${at} external input '${key}'`),
         title: e.title,
         description: e.description,
-        from: e.from.map((f) => ({ kind: f.kind })),
+        from: e.from.map((f) => ({ ...f })),
       };
     }
     const entries = allEntries.filter(([, e]) => !isExternal(e));

package/src/describe/manifest-schema.ts

@@ -79,7 +79,21 @@ export const StepDescriptor = z
           model: modelName.describe("The value is validated against this model's input view."),
           title: z.string().min(1).describe("What is asked, shown to whoever answers."),
           description: z.string(),
-          from: z.array(z.strictObject({ kind: z.literal("person") })).min(1).describe("Who or what may answer."),
+          from: z
+            .array(
+              z.discriminatedUnion("kind", [
+                z.strictObject({ kind: z.literal("person") }),
+                z.strictObject({ kind: z.literal("callback") }),
+                z.strictObject({
+                  kind: z.literal("poll"),
+                  url: z.string().describe("GET while waiting; {run.id} and {run.number} are filled in."),
+                  valuePath: z.string().min(1).describe("Dot path to the value; '.' is the whole body."),
+                  intervalSeconds: z.int().min(10),
+                }),
+              ]),
+            )
+            .min(1)
+            .describe("Who or what may answer."),
         }),
       )
       .optional()

package/src/harness/env.ts

@@ -13,6 +13,8 @@ export const ENV = {
   resultUrl: "OLVE_RESULT_URL",
   /** JSON object: file key (`<run>/<step>/<attempt>/<path>`) → pre-signed GET URL. Optional. */
   fileUrls: "OLVE_FILE_URLS",
+  /** JSON object: `<step>/<input>` → callback URL of that external input in this run (`ctx.inputUrl`). Optional. */
+  callbackUrls: "OLVE_CALLBACK_URLS",
   /** Base URL for file downloads: GET `<base>/<run>/<step>/<attempt>/<object path>`. Optional. */
   filesBaseUrl: "OLVE_FILES_BASE_URL",
   /** Bearer token sent with OLVE_FILES_BASE_URL requests. Optional. */
@@ -22,7 +24,19 @@ export const ENV = {
 } as const;
 
 /** Env vars never passed to child processes (they carry credentials for the harness only). */
-export const PRIVATE_ENV: readonly string[] = [ENV.resultUrl, ENV.fileUrls, ENV.filesToken];
+export const PRIVATE_ENV: readonly string[] = [ENV.resultUrl, ENV.fileUrls, ENV.filesToken, ENV.callbackUrls];
+
+/** `OLVE_CALLBACK_URLS`, parsed; empty when unset or malformed. */
+export function callbackUrlsFromEnv(): Record<string, string> {
+  const raw = process.env[ENV.callbackUrls];
+  if (!raw) return {};
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? (parsed as Record<string, string>) : {};
+  } catch {
+    return {};
+  }
+}
 
 export const olveDir = () => process.env[ENV.dir] || "/olve";
 export const paths = () => {

package/src/harness/main.ts

@@ -12,7 +12,7 @@ import { pipelineData, type PipelineData, type StageNode } from "../builder/pipe
 import { createCtx, formatLog } from "../ctx/index.ts";
 import { DescribeError, describePipeline, manifestText } from "../describe/describe.ts";
 import type { HarnessInfo } from "../util/handler-hash.ts";
-import { ENV, paths, runInfoFromEnv } from "./env.ts";
+import { callbackUrlsFromEnv, ENV, paths, runInfoFromEnv } from "./env.ts";
 import { EXIT } from "./exit.ts";
 import { executeStep, type Envelope, type Execution, type StepFunction } from "./execute.ts";
 import { MANIFEST_BEGIN, MANIFEST_END, packResult, removeStale, sentinelBlock, uploadFile, writeEnvelope } from "./result.ts";
@@ -183,7 +183,7 @@ async function runMode(cfg: HarnessConfig, name: string | undefined, io: Harness
       exec = { envelope: { status: "failed", error: { kind: "input", message: raw.message } }, exitCode: EXIT.inputInvalid };
     } else {
       const run = runInfoFromEnv(step.name);
-      const ctx = createCtx({ run, secrets: step.secrets, paths: { root: p.root, workFiles: p.files, tmp: p.tmp }, signal: cancel.signal, logSink: io.stderr });
+      const ctx = createCtx({ run, secrets: step.secrets, paths: { root: p.root, workFiles: p.files, tmp: p.tmp }, signal: cancel.signal, logSink: io.stderr, callbackUrls: callbackUrlsFromEnv() });
       exec = await executeStep({ step, fn, rawInput: raw.value, ctx, workFiles: p.files, log: io.stderr });
     }
     return await finish(exec, io);

package/src/index.ts

@@ -6,7 +6,7 @@ export { secret, type Secret, type DeclaredSecrets } from "./core/secrets.ts";
 export { config, secretRef, isConfigRef, type ConfigEntry, type AnyConfigEntry, type ConfigValues, type ConfigRef, type ConfigNode, type Configurable, type DiscriminatorOf, type VariantOf } from "./core/config.ts";
 export { hmacSha256, githubSignature, bearer, type WebhookVerify, type WebhookEvent } from "./core/webhooks.ts";
 export { resolveConfigRefs, isLiteral, type Resolved } from "./core/config-refs.ts";
-export { external, person, type External, type ExternalOptions, type ExternalSource } from "./core/external.ts";
+export { callback, external, person, poll, type External, type ExternalOptions, type ExternalSource, type PollOptions } from "./core/external.ts";
 export { step, type Step, type AnyStep, type StepDef, type StepInput, type StepKind, type ConfigOf, type InputEntry, type InputSpec, type LiteralName, type OutputValue } from "./core/steps.ts";
 export type { Simplify } from "./core/types.ts";
 export { implement, type Implementation, type Handler, type HandlerResult, type Skipped } from "./core/handlers.ts";

package/src/library/image-build.ts

@@ -102,14 +102,8 @@ export interface ImageBuildPushDef<N extends string, K extends string = never> e
   contentTag?: boolean;
 }
 
-/**
- * Default `registryMap`: pull-through caches for mcr.microsoft.com and Docker Hub. kaniko under gVisor
- * can stall forever pulling from mcr.microsoft.com directly.
- */
-export const DEFAULT_REGISTRY_MAP: Readonly<Record<string, string>> = {
-  "mcr.microsoft.com": "mcr-cache.ovea.pro",
-  "index.docker.io": "hub-cache.ovea.pro",
-};
+/** Default `registryMap`: none, kaniko pulls from the registries themselves. */
+export const DEFAULT_REGISTRY_MAP: Readonly<Record<string, string>> = {};
 
 /** How long a cache registry gets to answer `GET /v2/` before the build goes without it. */
 export const CACHE_PROBE_TIMEOUT_MS = 5000;

package/src/testing/index.ts

@@ -23,6 +23,8 @@ export interface TestHandlerOptions<S extends AnyStep> {
   dir?: string;
   /** Abort signal handed to ctx.signal. */
   signal?: AbortSignal;
+  /** `<step>/<input>` → URL returned by `ctx.inputUrl`. */
+  callbackUrls?: Record<string, string>;
 }
 
 export type TestResult<S extends AnyStep> = {
@@ -62,6 +64,7 @@ export async function testHandler<S extends AnyStep>(
     paths: { root: dir, workFiles: filesDir, tmp: join(dir, "tmp") },
     signal: opts.signal ?? new AbortController().signal,
     logSink: (l) => logs.push(l),
+    callbackUrls: opts.callbackUrls,
   });
   const ctx = { ...real, ...opts.ctx } as Ctx;
   // Round-trip through JSON like input.json does (drops undefined, rejects non-JSON values early).