@olivervea/pipelines 2.0.0-beta.17 → 2.0.0-beta.19

package/README.md

@@ -253,6 +253,7 @@ export default pipeline({ name: "Olve.Pipelines", description: "…", input: M.D
 - **Describe checks the mapper twice.** It records the mapper with proxies, and it statically analyses the mapper's source. The source must be an object literal of member chains, literals, constant arrays and nested object literals. Ternaries, `&&`, `||`, `??`, `!`, comparisons, arithmetic, template strings, calls, spread and optional chaining are all rejected. Free identifiers such as module constants are allowed; they are recorded as `{const}`.
 - **Triggers.** A pipeline may call `onPush` at most once. Each `onPoll` and `onWebhook` needs a distinct `name` (`onPoll` defaults to `"poll"`). `onWebhook({ name, verify }, ({ headers, body }) => input | null)` maps a delivery to `/api/hooks/<pipeline id>/<name>`; `verify` is `hmacSha256({ secret, header, prefix? })`, `githubSignature(secret)` or `bearer(secret)`, and `null` ignores the delivery.
 - **`select` (branch on config).** `.select(TARGET.prod, { ssh: (p, prod) => p.stage(…), inCluster: (p, prod) => p.stage(…) })`: the first argument references a `z.discriminatedUnion` in a config entry (`DiscriminatorOf<U>` is its one literal field; a union with no or several literal fields is a type error). Cases are exhaustive and checked at compile time; each gets the reference narrowed to its variant (`ConfigNode<VariantOf<U, D, V>>`), recorded as `{"$config": "target.prod", "$case": "target.prod.kind=ssh"}` and usable only inside that case. The manifest records `{select, discriminator, cases}`; the service resolves it per run from the pinned config snapshot (`when` is per run input). The same step name may appear in several cases (same output model; not two different custom steps, since handlers pair by name); a step every case has is definitely available afterwards, one only some have is maybe-available. The harness picks the variant of a same-named step from `OLVE_CASES` (a JSON array of the case conditions the step sits in, set by the service).
+- **Retention.** `pipeline({ …, retention: { keepLatestRuns?, minRunAgeDays?, buildGraceDays? } })` overrides the instance's retention thresholds for this pipeline's runs and binaries, field by field (non-negative integers; unset = the instance's value). Recorded on the manifest root as `retention`; the service applies the active version's.
 - **Failure handlers.** `.onFailure(handler, { steps? })` takes a step whose inputs are all `FailureContext`. When a run fails, the service runs each handler whose scope (default: any step) contains a failed step, once per failure: `run <handler>` in the handler's image with its declared secrets, from the run's pinned binary. It is untracked and best-effort — not an attempt of the run, never retried, and its own failure triggers nothing; its log is kept at `runs/<p>/<run>/_failure/<handler>/<id>/log`. `FailureContext` carries `pipeline {id, name}`, `run {id, number, address, versionStamp, trigger, url}`, `version {number, commit}`, the run's `input`, a one-line `reason`, and `failedSteps[]` (`step, attempt, address, reason, logUrl`) — only the steps in the handler's scope, never empty.
 
 ### Testing handlers
@@ -397,6 +398,7 @@ Exact format: [`manifest.schema.json`](manifest.schema.json) (JSON Schema 2020-1
   - `{kind: "poll", name, url, headers, secrets, valuePath, intervalSeconds}`, where header values may contain `$SECRET:NAME`;
   - `{kind: "webhook", name, verify: {scheme: "hmac-sha256", secret, header, prefix} | {scheme: "bearer", secret}}`. The `map-trigger` event is `{headers, body}`; a `null` mapping yields a `skipped` envelope (the delivery is ignored).
 - **`failureHandlers`** is a list of `{step: Step, steps: [names] | null}`. Each handler's inputs are all FailureContext (`{"ref": "failure"}`).
+- **`retention`** (when present) is `{keepLatestRuns?, minRunAgeDays?, buildGraceDays?}`, non-negative integers that replace the instance's thresholds for this pipeline. Omitted when the definition sets none.
 - **`secrets`** lists every secret used by steps, polls and webhooks, sorted, as `{name, description}`.
 - **`config`** lists every config entry steps declare, sorted by name, as `{name, description, required, schema}`. `schema` is the `z.input` view (defaults listed); it validates the entry's value in the config document. `required` is false when the schema accepts a missing value. A `secretRef` field is marked `"x-olve-kind": "secretRef"`, with the secret's name as `properties.secret.const`. Omitted when there are no entries.
 - **Step `configEntries`** names the entries the step receives (sorted; omitted when none). It is part of the step's content, like `secrets`. The step key `config` is the step's `settings`.

package/manifest.schema.json

@@ -165,6 +165,28 @@
           "minLength": 1,
           "type": "string"
         },
+        "retention": {
+          "additionalProperties": false,
+          "description": "Retention overrides for this pipeline (omitted when none). Each field replaces the instance setting of the same meaning.",
+          "properties": {
+            "buildGraceDays": {
+              "maximum": 9007199254740991,
+              "minimum": 0,
+              "type": "integer"
+            },
+            "keepLatestRuns": {
+              "maximum": 9007199254740991,
+              "minimum": 0,
+              "type": "integer"
+            },
+            "minRunAgeDays": {
+              "maximum": 9007199254740991,
+              "minimum": 0,
+              "type": "integer"
+            }
+          },
+          "type": "object"
+        },
         "secrets": {
           "description": "All declared secrets (steps + poll triggers), sorted by name.",
           "items": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olivervea/pipelines",
-  "version": "2.0.0-beta.17",
+  "version": "2.0.0-beta.19",
   "description": "Olve.Pipelines v2 SDK: typed pipeline authoring, the step harness, and the build tool.",
   "type": "module",
   "license": "MIT",
@@ -50,13 +50,15 @@
     "test": "bun test",
     "check-compile-fail": "bun scripts/check-compile-fail.ts",
     "gen-schema": "bun scripts/gen-manifest-schema.ts",
-    "check": "tsc --noEmit -p . && bun scripts/check-compile-fail.ts && bun test"
+    "check": "prettier --check . && tsc --noEmit -p . && bun scripts/check-compile-fail.ts && bun test",
+    "format": "prettier --write ."
   },
   "dependencies": {
     "zod": "4.6.7"
   },
   "devDependencies": {
     "@types/bun": "1.4.3",
+    "prettier": "^3.5.0",
     "typescript": "7.0.2"
   }
 }

package/src/assets.d.ts

@@ -1,10 +1,10 @@
 // `import script from "./scripts/x.sh" with { type: "file" }` yields a path string
 // (inside the compiled binary it points into the embedded /$bunfs filesystem).
-declare module "*.sh" {
+declare module '*.sh' {
   const path: string;
   export default path;
 }
-declare module "*.bash" {
+declare module '*.bash' {
   const path: string;
   export default path;
 }

package/src/build/build.ts

@@ -1,21 +1,35 @@
 // olve-build: pipeline dir → single executable + step.tar.zst + manifest.json.
-import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-import { canonicalJson } from "../util/canonical.ts";
-import { sha256File } from "../util/hash.ts";
-import type { HarnessInfo } from "../util/handler-hash.ts";
-import { writeTarZst } from "../util/tar.ts";
-import { MANIFEST_BEGIN, MANIFEST_END, uploadFile } from "../harness/result.ts";
-import { GLIBC_INTERP, MUSL_INTERP, readInterpreter } from "./elf.ts";
-import { handlerHashes, kindHashes, type HandlerHash } from "./hashes.ts";
-import { harnessInfo, loadPipeline, loadProject, relPosix, type Project } from "./project.ts";
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { canonicalJson } from '../util/canonical.ts';
+import { sha256File } from '../util/hash.ts';
+import type { HarnessInfo } from '../util/handler-hash.ts';
+import { writeTarZst } from '../util/tar.ts';
+import { MANIFEST_BEGIN, MANIFEST_END, uploadFile } from '../harness/result.ts';
+import { GLIBC_INTERP, MUSL_INTERP, readInterpreter } from './elf.ts';
+import { handlerHashes, kindHashes, type HandlerHash } from './hashes.ts';
+import {
+  harnessInfo,
+  loadPipeline,
+  loadProject,
+  relPosix,
+  type Project,
+} from './project.ts';
 
-export const BUILD_FLAGS = ["--no-compile-autoload-dotenv", "--no-compile-autoload-bunfig", "--bytecode", "--format=esm"] as const;
-export type Target = "bun-linux-x64" | "bun-linux-x64-musl";
+export const BUILD_FLAGS = [
+  '--no-compile-autoload-dotenv',
+  '--no-compile-autoload-bunfig',
+  '--bytecode',
+  '--format=esm',
+] as const;
+export type Target = 'bun-linux-x64' | 'bun-linux-x64-musl';
 
 export class BuildError extends Error {
-  override name = "BuildError";
-  constructor(message: string, readonly exitCode = 1) {
+  override name = 'BuildError';
+  constructor(
+    message: string,
+    readonly exitCode = 1,
+  ) {
     super(message);
   }
 }
@@ -41,12 +55,22 @@ export interface BuildResult {
 }
 
 /** Writes `<dir>/.olve/gen/{handlers,entry}.ts`: the literal-import handler registry + binary entry. */
-export function generateEntry(project: Project, hashes: Record<string, string>, harness: HarnessInfo, kinds: Record<string, string> = {}): string {
-  const gen = join(project.dir, ".olve", "gen");
+export function generateEntry(
+  project: Project,
+  hashes: Record<string, string>,
+  harness: HarnessInfo,
+  kinds: Record<string, string> = {},
+): string {
+  const gen = join(project.dir, '.olve', 'gen');
   mkdirSync(gen, { recursive: true });
-  const registry = project.handlers.map(([name, file]) => `  ${JSON.stringify(name)}: () => import(${JSON.stringify(relPosix(gen, file))}),`).join("\n");
+  const registry = project.handlers
+    .map(
+      ([name, file]) =>
+        `  ${JSON.stringify(name)}: () => import(${JSON.stringify(relPosix(gen, file))}),`,
+    )
+    .join('\n');
   writeFileSync(
-    join(gen, "handlers.ts"),
+    join(gen, 'handlers.ts'),
     `// GENERATED by olve-build — do not edit.\n` +
       `import type { HandlerRegistry, HarnessInfo } from "@olivervea/pipelines/harness";\n\n` +
       `export const handlers: HandlerRegistry = {\n${registry}\n};\n\n` +
@@ -54,7 +78,7 @@ export function generateEntry(project: Project, hashes: Record<string, string>,
       `export const kindHashes: Record<string, string> = ${JSON.stringify(kinds, null, 2)};\n\n` +
       `export const harness: HarnessInfo = ${JSON.stringify(harness, null, 2)};\n`,
   );
-  const entry = join(gen, "entry.ts");
+  const entry = join(gen, 'entry.ts');
   writeFileSync(
     entry,
     `// GENERATED by olve-build — do not edit. Entry point of the step binary.\n` +
@@ -67,9 +91,10 @@ export function generateEntry(project: Project, hashes: Record<string, string>,
 }
 
 export async function build(dir: string, opts: BuildOptions): Promise<BuildResult> {
-  const log = opts.log ?? ((l: string) => process.stderr.write(l + "\n"));
-  const stdout = opts.stdout ?? (async (t: string) => void (await Bun.write(Bun.stdout, t)));
-  const target = opts.target ?? "bun-linux-x64";
+  const log = opts.log ?? ((l: string) => process.stderr.write(l + '\n'));
+  const stdout =
+    opts.stdout ?? (async (t: string) => void (await Bun.write(Bun.stdout, t)));
+  const target = opts.target ?? 'bun-linux-x64';
   const project = await loadProject(dir);
   const out = resolve(opts.out);
   mkdirSync(out, { recursive: true });
@@ -78,49 +103,92 @@ export async function build(dir: string, opts: BuildOptions): Promise<BuildResul
   const t0 = performance.now();
   const hashes = await handlerHashes(project, harness);
   const kinds = await kindHashes(project, await loadPipeline(project));
-  const entry = generateEntry(project, Object.fromEntries(Object.entries(hashes).map(([k, v]) => [k, v.handlerHash])), harness, kinds);
-  log(`olve-build: ${project.handlers.length} handler(s) hashed in ${((performance.now() - t0) / 1000).toFixed(2)}s`);
+  const entry = generateEntry(
+    project,
+    Object.fromEntries(Object.entries(hashes).map(([k, v]) => [k, v.handlerHash])),
+    harness,
+    kinds,
+  );
+  log(
+    `olve-build: ${project.handlers.length} handler(s) hashed in ${((performance.now() - t0) / 1000).toFixed(2)}s`,
+  );
 
   // 1. compile
-  const binary = join(out, "step");
+  const binary = join(out, 'step');
   rmSync(binary, { force: true });
   const t1 = performance.now();
-  const p = Bun.spawnSync([process.execPath, "build", "--compile", `--target=${target}`, ...BUILD_FLAGS, entry, `--outfile=${binary}`], {
-    cwd: project.dir,
-    stdout: "pipe",
-    stderr: "pipe",
-    env: { ...process.env, NO_COLOR: "1" },
-  });
+  const p = Bun.spawnSync(
+    [
+      process.execPath,
+      'build',
+      '--compile',
+      `--target=${target}`,
+      ...BUILD_FLAGS,
+      entry,
+      `--outfile=${binary}`,
+    ],
+    {
+      cwd: project.dir,
+      stdout: 'pipe',
+      stderr: 'pipe',
+      env: { ...process.env, NO_COLOR: '1' },
+    },
+  );
   if (p.exitCode !== 0 || !existsSync(binary))
-    throw new BuildError(`bun build --compile failed (exit ${p.exitCode}):\n${p.stdout.toString()}${p.stderr.toString()}`);
-  log(`olve-build: compiled ${target} in ${((performance.now() - t1) / 1000).toFixed(2)}s`);
+    throw new BuildError(
+      `bun build --compile failed (exit ${p.exitCode}):\n${p.stdout.toString()}${p.stderr.toString()}`,
+    );
+  log(
+    `olve-build: compiled ${target} in ${((performance.now() - t1) / 1000).toFixed(2)}s`,
+  );
 
   // 2. loader check: the harness launches the binary through /olve/lib/<loader>; a musl binary
   //    (e.g. compiled on alpine, where bun-linux-x64 silently yields musl) would not start.
-  const expected = target === "bun-linux-x64" ? GLIBC_INTERP : MUSL_INTERP;
+  const expected = target === 'bun-linux-x64' ? GLIBC_INTERP : MUSL_INTERP;
   const interp = readInterpreter(binary);
   if (interp !== expected)
-    throw new BuildError(`compiled binary has PT_INTERP ${interp ?? "(none)"}, expected ${expected} — compile on a glibc Bun image (oven/bun:<version>-slim), not alpine`);
+    throw new BuildError(
+      `compiled binary has PT_INTERP ${interp ?? '(none)'}, expected ${expected} — compile on a glibc Bun image (oven/bun:<version>-slim), not alpine`,
+    );
 
   // 3. describe (runs the real binary: the manifest is exactly what the step pods will see)
-  const d = Bun.spawnSync([binary, "describe"], { cwd: out, stdout: "pipe", stderr: "pipe", env: { PATH: process.env.PATH ?? "/usr/bin:/bin" } });
-  if (d.exitCode !== 0) throw new BuildError(`describe failed (exit ${d.exitCode}):\n${d.stderr.toString()}`, d.exitCode ?? 1);
+  const d = Bun.spawnSync([binary, 'describe'], {
+    cwd: out,
+    stdout: 'pipe',
+    stderr: 'pipe',
+    env: { PATH: process.env.PATH ?? '/usr/bin:/bin' },
+  });
+  if (d.exitCode !== 0)
+    throw new BuildError(
+      `describe failed (exit ${d.exitCode}):\n${d.stderr.toString()}`,
+      d.exitCode ?? 1,
+    );
   const manifest = d.stdout.toString();
-  const manifestFile = join(out, "manifest.json");
+  const manifestFile = join(out, 'manifest.json');
   writeFileSync(manifestFile, manifest);
 
   // 4. step.tar.zst (deterministic: `step` at the root, 0755, mtime 0)
-  const archive = join(out, "step.tar.zst");
-  await writeTarZst(archive, [{ path: "step", type: "file", mode: 0o755, source: binary }]);
+  const archive = join(out, 'step.tar.zst');
+  await writeTarZst(archive, [
+    { path: 'step', type: 'file', mode: 0o755, source: binary },
+  ]);
   writeFileSync(
-    join(out, "build.json"),
-    canonicalJson({ target, flags: BUILD_FLAGS, harness, handlers: hashes, kinds, binarySha256: sha256File(binary), archiveSha256: sha256File(archive) }),
+    join(out, 'build.json'),
+    canonicalJson({
+      target,
+      flags: BUILD_FLAGS,
+      harness,
+      handlers: hashes,
+      kinds,
+      binarySha256: sha256File(binary),
+      archiveSha256: sha256File(archive),
+    }),
   );
   log(`olve-build: wrote ${archive}`);
 
   if (opts.uploadUrl) {
     await uploadFile(opts.uploadUrl, archive, log);
-    log("olve-build: uploaded step.tar.zst");
+    log('olve-build: uploaded step.tar.zst');
   }
   if (opts.sentinels) await stdout(`${MANIFEST_BEGIN}\n${manifest}${MANIFEST_END}\n`);
   return { binary, archive, manifestFile, manifest, hashes, harness };

package/src/build/cli.ts

@@ -1,12 +1,13 @@
 #!/usr/bin/env bun
 // olve-build <pipelineDir> --out <dir> [--target bun-linux-x64|bun-linux-x64-musl] [--upload-url <url>] [--sentinels] [--hash-only]
-import { parseArgs } from "node:util";
-import { canonicalJson } from "../util/canonical.ts";
-import { build, BuildError, type Target } from "./build.ts";
-import { handlerHashes } from "./hashes.ts";
-import { harnessInfo, loadProject, ProjectError } from "./project.ts";
+import { parseArgs } from 'node:util';
+import { canonicalJson } from '../util/canonical.ts';
+import { build, BuildError, type Target } from './build.ts';
+import { handlerHashes } from './hashes.ts';
+import { harnessInfo, loadProject, ProjectError } from './project.ts';
 
-const USAGE = "usage: olve-build <pipelineDir> --out <dir> [--target bun-linux-x64|bun-linux-x64-musl] [--upload-url <url>] [--sentinels]\n       olve-build <pipelineDir> --hash-only";
+const USAGE =
+  'usage: olve-build <pipelineDir> --out <dir> [--target bun-linux-x64|bun-linux-x64-musl] [--upload-url <url>] [--sentinels]\n       olve-build <pipelineDir> --hash-only';
 
 async function main(): Promise<number> {
   let parsed;
@@ -14,12 +15,12 @@ async function main(): Promise<number> {
     parsed = parseArgs({
       allowPositionals: true,
       options: {
-        out: { type: "string" },
-        target: { type: "string" },
-        "upload-url": { type: "string" },
-        sentinels: { type: "boolean", default: false },
-        "hash-only": { type: "boolean", default: false },
-        help: { type: "boolean", short: "h", default: false },
+        out: { type: 'string' },
+        target: { type: 'string' },
+        'upload-url': { type: 'string' },
+        sentinels: { type: 'boolean', default: false },
+        'hash-only': { type: 'boolean', default: false },
+        help: { type: 'boolean', short: 'h', default: false },
       },
     });
   } catch (e) {
@@ -27,23 +28,29 @@ async function main(): Promise<number> {
     return 64;
   }
   const { values, positionals } = parsed;
-  if (values.help) return console.log(USAGE), 0;
-  if (positionals.length !== 1) return console.error(USAGE), 64;
+  if (values.help) return (console.log(USAGE), 0);
+  if (positionals.length !== 1) return (console.error(USAGE), 64);
   const dir = positionals[0]!;
   try {
-    if (values["hash-only"]) {
+    if (values['hash-only']) {
       const h = await handlerHashes(await loadProject(dir), harnessInfo());
       await Bun.write(Bun.stdout, canonicalJson({ harness: harnessInfo(), handlers: h }));
       return 0;
     }
-    if (!values.out) return console.error(`--out is required\n${USAGE}`), 64;
-    const target = (values.target ?? "bun-linux-x64") as Target;
-    if (target !== "bun-linux-x64" && target !== "bun-linux-x64-musl") return console.error(`unsupported target ${target}`), 64;
-    await build(dir, { out: values.out, target, uploadUrl: values["upload-url"], sentinels: values.sentinels });
+    if (!values.out) return (console.error(`--out is required\n${USAGE}`), 64);
+    const target = (values.target ?? 'bun-linux-x64') as Target;
+    if (target !== 'bun-linux-x64' && target !== 'bun-linux-x64-musl')
+      return (console.error(`unsupported target ${target}`), 64);
+    await build(dir, {
+      out: values.out,
+      target,
+      uploadUrl: values['upload-url'],
+      sentinels: values.sentinels,
+    });
     return 0;
   } catch (e) {
-    if (e instanceof BuildError) return console.error(e.message), e.exitCode;
-    if (e instanceof ProjectError) return console.error(e.message), 78;
+    if (e instanceof BuildError) return (console.error(e.message), e.exitCode);
+    if (e instanceof ProjectError) return (console.error(e.message), 78);
     console.error((e as Error)?.stack ?? String(e));
     return 1;
   }

package/src/build/elf.ts

@@ -1,22 +1,23 @@
-import { closeSync, openSync, readSync } from "node:fs";
+import { closeSync, openSync, readSync } from 'node:fs';
 
-export const GLIBC_INTERP = "/lib64/ld-linux-x86-64.so.2";
-export const MUSL_INTERP = "/lib/ld-musl-x86-64.so.1";
+export const GLIBC_INTERP = '/lib64/ld-linux-x86-64.so.2';
+export const MUSL_INTERP = '/lib/ld-musl-x86-64.so.1';
 
 function read(fd: number, pos: number, len: number): Buffer {
   const b = Buffer.alloc(len);
   const n = readSync(fd, b, 0, len, pos);
-  if (n !== len) throw new Error("truncated ELF file");
+  if (n !== len) throw new Error('truncated ELF file');
   return b;
 }
 
 /** PT_INTERP of an x86-64 ELF executable, or null if it has none (static). */
 export function readInterpreter(path: string): string | null {
-  const fd = openSync(path, "r");
+  const fd = openSync(path, 'r');
   try {
     const h = read(fd, 0, 64);
     if (h.readUInt32BE(0) !== 0x7f454c46) throw new Error(`${path} is not an ELF file`);
-    if (h[4] !== 2 || h[5] !== 1) throw new Error(`${path} is not a 64-bit little-endian ELF file`);
+    if (h[4] !== 2 || h[5] !== 1)
+      throw new Error(`${path} is not a 64-bit little-endian ELF file`);
     const phoff = Number(h.readBigUInt64LE(0x20));
     const phentsize = h.readUInt16LE(0x36);
     const phnum = h.readUInt16LE(0x38);
@@ -25,7 +26,7 @@ export function readInterpreter(path: string): string | null {
       if (ph.readUInt32LE(0) === 3 /* PT_INTERP */) {
         const off = Number(ph.readBigUInt64LE(0x08));
         const size = Number(ph.readBigUInt64LE(0x20));
-        return read(fd, off, size).toString("latin1").replace(/\0+$/, "");
+        return read(fd, off, size).toString('latin1').replace(/\0+$/, '');
       }
     }
     return null;

package/src/build/hashes.ts

@@ -2,15 +2,15 @@
 // (tree-shaken → function-level granularity; embedded scripts are bundle outputs too), then hash the
 // outputs. Contract changes are versioned through the manifest's model/step entries, SDK changes
 // through `harness`; both are combined in composeHandlerHash.
-import { dirname, join, relative, resolve } from "node:path";
-import type { BunPlugin } from "bun";
-import { isImplementation } from "../core/handlers.ts";
-import { originsOf } from "../core/origin.ts";
-import { pipelineData } from "../builder/pipeline.ts";
-import { allSteps } from "../harness/main.ts";
-import { composeHandlerHash, type HarnessInfo } from "../util/handler-hash.ts";
-import { sha256Hex } from "../util/hash.ts";
-import type { Project } from "./project.ts";
+import { dirname, join, relative, resolve } from 'node:path';
+import type { BunPlugin } from 'bun';
+import { isImplementation } from '../core/handlers.ts';
+import { originsOf } from '../core/origin.ts';
+import { pipelineData } from '../builder/pipeline.ts';
+import { allSteps } from '../harness/main.ts';
+import { composeHandlerHash, type HarnessInfo } from '../util/handler-hash.ts';
+import { sha256Hex } from '../util/hash.ts';
+import type { Project } from './project.ts';
 
 export interface HandlerHash {
   /** Hash of the bundle outputs alone. */
@@ -24,49 +24,75 @@ export interface HandlerHash {
 function externals(project: Project): BunPlugin {
   const contracts = new Set(project.contractFiles);
   return {
-    name: "olve-handler-hash-externals",
+    name: 'olve-handler-hash-externals',
     setup(b) {
-      b.onResolve({ filter: /^@olivervea\/pipelines(\/.*)?$/ }, (args) => ({ path: args.path, external: true }));
+      b.onResolve({ filter: /^@olivervea\/pipelines(\/.*)?$/ }, (args) => ({
+        path: args.path,
+        external: true,
+      }));
       b.onResolve({ filter: /^\.{1,2}\// }, (args) => {
         const base = resolve(dirname(args.importer), args.path);
-        for (const cand of [base, `${base}.ts`, join(base, "index.ts")]) if (contracts.has(cand)) return { path: args.path, external: true };
+        for (const cand of [base, `${base}.ts`, join(base, 'index.ts')])
+          if (contracts.has(cand)) return { path: args.path, external: true };
         return undefined;
       });
     },
   };
 }
 
-export async function bundleHash(project: Project, entry: string): Promise<{ hash: string; outputs: string[] }> {
-  const inside = !relative(project.dir, entry).startsWith("..");
+export async function bundleHash(
+  project: Project,
+  entry: string,
+): Promise<{ hash: string; outputs: string[] }> {
+  const inside = !relative(project.dir, entry).startsWith('..');
   const r = await Bun.build({
     entrypoints: [entry],
-    target: "bun",
-    format: "esm",
+    target: 'bun',
+    format: 'esm',
     root: inside ? project.dir : dirname(entry),
-    naming: { entry: "[dir]/[name].[ext]", chunk: "[dir]/[name].[ext]", asset: "[dir]/[name].[ext]" },
+    naming: {
+      entry: '[dir]/[name].[ext]',
+      chunk: '[dir]/[name].[ext]',
+      asset: '[dir]/[name].[ext]',
+    },
     plugins: [externals(project)],
     throw: false,
   });
-  if (!r.success) throw new AggregateError(r.logs, `bundling ${entry} failed:\n${r.logs.map(String).join("\n")}`);
+  if (!r.success)
+    throw new AggregateError(
+      r.logs,
+      `bundling ${entry} failed:\n${r.logs.map(String).join('\n')}`,
+    );
   const parts: string[] = [];
   const outputs: string[] = [];
-  for (const o of [...r.outputs].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))) {
-    const name = o.path.replace(/^\.\//, "");
+  for (const o of [...r.outputs].sort((a, b) =>
+    a.path < b.path ? -1 : a.path > b.path ? 1 : 0,
+  )) {
+    const name = o.path.replace(/^\.\//, '');
     outputs.push(name);
     const bytes = new Uint8Array(await o.arrayBuffer());
     // Bun prefixes each module with a `// <path>` comment relative to the *process cwd*; drop those
     // so the hash depends only on code, not on where the repo or the build tool runs.
-    const content = name.endsWith(".js") ? new TextDecoder().decode(bytes).replace(/^\/\/ \S+\n/gm, "") : bytes;
+    const content = name.endsWith('.js')
+      ? new TextDecoder().decode(bytes).replace(/^\/\/ \S+\n/gm, '')
+      : bytes;
     parts.push(`${name}\0${sha256Hex(content)}`);
   }
-  return { hash: "sha256:" + sha256Hex(parts.join("\n")), outputs };
+  return { hash: 'sha256:' + sha256Hex(parts.join('\n')), outputs };
 }
 
-export async function handlerHashes(project: Project, harness: HarnessInfo): Promise<Record<string, HandlerHash>> {
+export async function handlerHashes(
+  project: Project,
+  harness: HarnessInfo,
+): Promise<Record<string, HandlerHash>> {
   const out: Record<string, HandlerHash> = {};
   for (const [name, file] of project.handlers) {
     const b = await bundleHash(project, file);
-    out[name] = { bundleHash: b.hash, handlerHash: composeHandlerHash(b.hash, harness), outputs: b.outputs };
+    out[name] = {
+      bundleHash: b.hash,
+      handlerHash: composeHandlerHash(b.hash, harness),
+      outputs: b.outputs,
+    };
   }
   return out;
 }
@@ -75,22 +101,29 @@ export async function handlerHashes(project: Project, harness: HarnessInfo): Pro
  * Kind → hash of the modules that implement the steps of that kind which carry their implementation
  * (each module bundled like a handler: the SDK and contract files external).
  */
-export async function kindHashes(project: Project, pipeline: unknown): Promise<Record<string, string>> {
+export async function kindHashes(
+  project: Project,
+  pipeline: unknown,
+): Promise<Record<string, string>> {
   const origins = new Map<string, Set<string>>();
   for (const s of allSteps(pipelineData(pipeline))) {
     if (!isImplementation(s)) continue;
     const files = originsOf(s).filter((f) => !project.contractFiles.includes(f));
     if (files.length === 0)
-      throw new Error(`step '${s.name}' carries its implementation but is defined in ${project.contractFiles.map((f) => relative(project.dir, f)).join(" or ")}; define and implement it in a module of its own (or a package)`);
+      throw new Error(
+        `step '${s.name}' carries its implementation but is defined in ${project.contractFiles.map((f) => relative(project.dir, f)).join(' or ')}; define and implement it in a module of its own (or a package)`,
+      );
     const set = origins.get(s.kind) ?? new Set<string>();
     for (const f of files) set.add(f);
     origins.set(s.kind, set);
   }
   const out: Record<string, string> = {};
-  for (const [kind, files] of [...origins].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))) {
+  for (const [kind, files] of [...origins].sort(([a], [b]) =>
+    a < b ? -1 : a > b ? 1 : 0,
+  )) {
     const parts: string[] = [];
     for (const f of [...files].sort()) parts.push((await bundleHash(project, f)).hash);
-    out[kind] = "sha256:" + sha256Hex(parts.join("\n"));
+    out[kind] = 'sha256:' + sha256Hex(parts.join('\n'));
   }
   return out;
 }