@olivervea/pipelines 2.0.0-beta.17 → 2.0.0-beta.19

package/src/core/origin.ts

@@ -1,20 +1,23 @@
-import { ORIGIN } from "./brands.ts";
+import { ORIGIN } from './brands.ts';
 
 /**
  * The file that called the function calling this one, from the stack. A tail call drops its caller's
  * frame, so this can name a module further up; the build only uses it to choose what to hash.
  */
 export function callerFile(): string | undefined {
-  const files = (new Error().stack ?? "").split("\n").slice(1).map((f) => f.match(FRAME)?.[1]);
+  const files = (new Error().stack ?? '')
+    .split('\n')
+    .slice(1)
+    .map((f) => f.match(FRAME)?.[1]);
   const own = files[0];
   const callee = files[1];
   const file = files.slice(2).find((f) => f && f !== own && f !== callee) ?? undefined;
-  return file?.startsWith("file://") ? new URL(file).pathname : file;
+  return file?.startsWith('file://') ? new URL(file).pathname : file;
 }
 const FRAME = /\(?((?:file:\/\/)?\/[^()]*?):\d+(?::\d+)?\)?\s*$/;
 
 /** The modules that defined and implemented a step (where `step` and `implement` were called). */
 export function originsOf(v: unknown): string[] {
   const o = (v as Record<symbol, unknown>)[ORIGIN];
-  return Array.isArray(o) ? o.filter((x): x is string => typeof x === "string") : [];
+  return Array.isArray(o) ? o.filter((x): x is string => typeof x === 'string') : [];
 }

package/src/core/secrets.ts

@@ -1,6 +1,6 @@
 /** A named pipeline secret. Steps (and poll triggers) declare the secrets they use; only those are mounted. */
 export interface Secret<N extends string = string> {
-  readonly kind: "secret";
+  readonly kind: 'secret';
   readonly name: N;
   readonly description: string;
 }
@@ -8,6 +8,6 @@ export interface Secret<N extends string = string> {
 export const SECRET_NAME = /^[A-Z_][A-Z0-9_]*$/;
 
 export function secret<const N extends string>(name: N, description: string): Secret<N> {
-  return Object.freeze({ kind: "secret" as const, name, description });
+  return Object.freeze({ kind: 'secret' as const, name, description });
 }
 export type DeclaredSecrets<N extends string> = { readonly [K in N]: string };

package/src/core/steps.ts

@@ -1,12 +1,12 @@
-import type { z } from "zod";
-import { ORIGIN, STEP, type StepBrand } from "./brands.ts";
-import { callerFile } from "./origin.ts";
-import type { AnyModel, Infer, Optional } from "./models.ts";
-import type { External } from "./external.ts";
-import type { AnyConfigEntry } from "./config.ts";
-import { configRefsIn } from "./config-refs.ts";
-import type { Secret } from "./secrets.ts";
-import type { Simplify } from "./types.ts";
+import type { z } from 'zod';
+import { ORIGIN, STEP, type StepBrand } from './brands.ts';
+import { callerFile } from './origin.ts';
+import type { AnyModel, Infer, Optional } from './models.ts';
+import type { External } from './external.ts';
+import type { AnyConfigEntry } from './config.ts';
+import { configRefsIn } from './config-refs.ts';
+import type { Secret } from './secrets.ts';
+import type { Simplify } from './types.ts';
 
 /**
  * A step input entry: a model (matchable by model), `optional(model)`, a plain zod schema (mapper required),
@@ -16,11 +16,15 @@ export type InputEntry = AnyModel | Optional | External | z.ZodType;
 export type InputSpec = { readonly [key: string]: InputEntry };
 
 export type InferEntry<E> =
-  E extends Optional<infer M> ? Infer<M> | undefined
-  : E extends External<infer M> ? Infer<M>
-  : E extends AnyModel ? Infer<E>
-  : E extends z.ZodType ? z.output<E>
-  : never;
+  E extends Optional<infer M>
+    ? Infer<M> | undefined
+    : E extends External<infer M>
+      ? Infer<M>
+      : E extends AnyModel
+        ? Infer<E>
+        : E extends z.ZodType
+          ? z.output<E>
+          : never;
 /** What a handler receives: the output view of every input entry. */
 export type StepInput<I> = Simplify<{ -readonly [K in keyof I]: InferEntry<I[K]> }>;
 
@@ -62,16 +66,25 @@ export type AnyStep = Step<string, any, AnyModel | null, any, any>;
 export type SecretsOf<S> = S extends Step<any, any, any, infer Sec, any> ? Sec : never;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type ConfigOf<S> = S extends Step<any, any, any, any, infer C> ? C : never;
-export type OutputValue<S extends AnyStep> = S["output"] extends AnyModel ? Infer<S["output"]> : void;
+export type OutputValue<S extends AnyStep> = S['output'] extends AnyModel
+  ? Infer<S['output']>
+  : void;
 
 /** Step names must be literals (identity, duplicate detection and mapper keys depend on it). */
-export type LiteralName<N extends string> = N & (string extends N ? "❌ step name must be a string literal" : unknown);
+export type LiteralName<N extends string> = N &
+  (string extends N ? '❌ step name must be a string literal' : unknown);
 
-export { STEP_NAME } from "./models.ts";
+export { STEP_NAME } from './models.ts';
 /** Names that cannot be steps: `input` is the pipeline input's root in mappings. */
-export const RESERVED_STEP_NAMES: readonly string[] = ["input"];
+export const RESERVED_STEP_NAMES: readonly string[] = ['input'];
 
-export interface StepDef<N extends string, I extends InputSpec, O extends AnyModel | null, Sec extends readonly Secret[], Cfg extends readonly AnyConfigEntry[] = []> {
+export interface StepDef<
+  N extends string,
+  I extends InputSpec,
+  O extends AnyModel | null,
+  Sec extends readonly Secret[],
+  Cfg extends readonly AnyConfigEntry[] = [],
+> {
   name: LiteralName<N>;
   /** What the step does, shown in the UI. Required; may be empty. */
   description: string;
@@ -102,11 +115,12 @@ export interface StepDef<N extends string, I extends InputSpec, O extends AnyMod
 
 function makeStep(def: Record<string, unknown>, origin: string | undefined): AnyStep {
   const config = new Map<string, AnyConfigEntry>();
-  for (const e of (def.config as readonly AnyConfigEntry[] | undefined) ?? []) if (!config.has(e.name)) config.set(e.name, e);
+  for (const e of (def.config as readonly AnyConfigEntry[] | undefined) ?? [])
+    if (!config.has(e.name)) config.set(e.name, e);
   configRefsIn(def.settings, config);
   const s = {
     [STEP]: true,
-    kind: def.kind ?? "custom",
+    kind: def.kind ?? 'custom',
     name: def.name,
     description: def.description,
     image: def.image,
@@ -124,7 +138,9 @@ function makeStep(def: Record<string, unknown>, origin: string | undefined): Any
 }
 
 export function isStep(v: unknown): v is AnyStep {
-  return typeof v === "object" && v !== null && (v as Record<symbol, unknown>)[STEP] === true;
+  return (
+    typeof v === 'object' && v !== null && (v as Record<symbol, unknown>)[STEP] === true
+  );
 }
 
 /**
@@ -137,6 +153,6 @@ export function step<
   O extends AnyModel | null = null,
   const Sec extends readonly Secret[] = [],
   const Cfg extends readonly AnyConfigEntry[] = [],
->(def: StepDef<N, I, O, Sec, Cfg>): Step<N, I, O, Sec[number]["name"], Cfg[number]> {
+>(def: StepDef<N, I, O, Sec, Cfg>): Step<N, I, O, Sec[number]['name'], Cfg[number]> {
   return makeStep(def as never, callerFile()) as never;
 }

package/src/core/types.ts

@@ -1,6 +1,10 @@
 export type Primitive = string | number | boolean | bigint | null | undefined;
 export type Simplify<T> = { [K in keyof T]: T[K] } & {};
 export type Awaitable<T> = T | Promise<T>;
-export type IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;
+export type IsUnion<T, U = T> = T extends unknown
+  ? [U] extends [T]
+    ? false
+    : true
+  : never;
 /** `Ok` when there is no error, else the error (a readable string-literal type). */
 export type OrError<Err, Ok> = [Err] extends [never] ? Ok : Err;

package/src/core/webhooks.ts

@@ -1,23 +1,37 @@
-import type { Secret } from "./secrets.ts";
+import type { Secret } from './secrets.ts';
 
 /** How a webhook trigger authenticates deliveries. Build one with `hmacSha256`, `githubSignature` or `bearer`. */
 export type WebhookVerify =
-  | { readonly scheme: "hmac-sha256"; readonly secret: Secret; readonly header: string; readonly prefix: string }
-  | { readonly scheme: "bearer"; readonly secret: Secret };
+  | {
+      readonly scheme: 'hmac-sha256';
+      readonly secret: Secret;
+      readonly header: string;
+      readonly prefix: string;
+    }
+  | { readonly scheme: 'bearer'; readonly secret: Secret };
 
 /** HMAC-SHA256 of the raw body keyed by `secret`, hex, in `header` after `prefix`. */
-export function hmacSha256(o: { secret: Secret; header: string; prefix?: string }): WebhookVerify {
-  return Object.freeze({ scheme: "hmac-sha256", secret: o.secret, header: o.header, prefix: o.prefix ?? "" });
+export function hmacSha256(o: {
+  secret: Secret;
+  header: string;
+  prefix?: string;
+}): WebhookVerify {
+  return Object.freeze({
+    scheme: 'hmac-sha256',
+    secret: o.secret,
+    header: o.header,
+    prefix: o.prefix ?? '',
+  });
 }
 
 /** GitHub's delivery signature: `X-Hub-Signature-256: sha256=<hex>`. */
 export function githubSignature(secret: Secret): WebhookVerify {
-  return hmacSha256({ secret, header: "X-Hub-Signature-256", prefix: "sha256=" });
+  return hmacSha256({ secret, header: 'X-Hub-Signature-256', prefix: 'sha256=' });
 }
 
 /** `Authorization: Bearer <secret>`. */
 export function bearer(secret: Secret): WebhookVerify {
-  return Object.freeze({ scheme: "bearer", secret });
+  return Object.freeze({ scheme: 'bearer', secret });
 }
 
 /**

package/src/ctx/files.ts

@@ -4,19 +4,31 @@
 // `path` minus the trailing "/" plus ".tar" for directories (a deterministic tar). The step writes
 // objects to `$OLVE_DIR/work/files/<object path>`; the service stores them under
 // `runs/<p>/<run>/<step>/<attempt>/files/<object path>`.
-import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { basename, dirname, join, resolve } from "node:path";
-import { fileRefSchema, FILE_PATH, type FileRef } from "../core/models.ts";
-import { ENV } from "../harness/env.ts";
-import { sha256File } from "../util/hash.ts";
-import { dirEntries, extractTar, writeTar } from "../util/tar.ts";
-import type { OutputFileOptions, RunInfo } from "./types.ts";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from 'node:fs';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileRefSchema, FILE_PATH, type FileRef } from '../core/models.ts';
+import { ENV } from '../harness/env.ts';
+import { sha256File } from '../util/hash.ts';
+import { dirEntries, extractTar, writeTar } from '../util/tar.ts';
+import type { OutputFileOptions, RunInfo } from './types.ts';
 
-export const objectPath = (refPath: string): string => (refPath.endsWith("/") ? refPath.slice(0, -1) + ".tar" : refPath);
-export const fileKey = (ref: Pick<FileRef, "run" | "step" | "attempt" | "path">): string => `${ref.run}/${ref.step}/${ref.attempt}/${ref.path}`;
+export const objectPath = (refPath: string): string =>
+  refPath.endsWith('/') ? refPath.slice(0, -1) + '.tar' : refPath;
+export const fileKey = (
+  ref: Pick<FileRef, 'run' | 'step' | 'attempt' | 'path'>,
+): string => `${ref.run}/${ref.step}/${ref.attempt}/${ref.path}`;
 
 /** Strips everything from `?` on (pre-signed credentials). */
-export const redactUrl = (url: string): string => url.replace(/[?#].*$/, "?…");
+export const redactUrl = (url: string): string => url.replace(/[?#].*$/, '?…');
 
 export interface FilesDeps {
   run: RunInfo;
@@ -28,42 +40,54 @@ export interface FilesDeps {
 }
 
 function checkName(name: string, what: string): void {
-  if (!FILE_PATH.test(name) || name.endsWith("/")) throw new Error(`${what}: '${name}' is not a valid relative file name (no leading '/', no '..', no trailing '/')`);
+  if (!FILE_PATH.test(name) || name.endsWith('/'))
+    throw new Error(
+      `${what}: '${name}' is not a valid relative file name (no leading '/', no '..', no trailing '/')`,
+    );
 }
 
 export function createOutput(deps: FilesDeps) {
   const used = new Set<string>();
   const claim = (obj: string) => {
-    if (used.has(obj) || existsSync(join(deps.workFiles, obj))) throw new Error(`output file '${obj}' already exists`);
+    if (used.has(obj) || existsSync(join(deps.workFiles, obj)))
+      throw new Error(`output file '${obj}' already exists`);
     used.add(obj);
     const dest = join(deps.workFiles, obj);
     mkdirSync(dirname(dest), { recursive: true });
     return dest;
   };
   const ref = (path: string, dest: string): FileRef =>
-    ({ run: deps.run.number, step: deps.run.step, attempt: deps.run.attempt, path, sha256: sha256File(dest) }) as FileRef;
+    ({
+      run: deps.run.number,
+      step: deps.run.step,
+      attempt: deps.run.attempt,
+      path,
+      sha256: sha256File(dest),
+    }) as FileRef;
 
   return {
     async file(path: string, opts: OutputFileOptions = {}): Promise<FileRef> {
       const src = resolve(path);
-      if (!statSync(src).isFile()) throw new Error(`ctx.output.file: '${path}' is not a file`);
+      if (!statSync(src).isFile())
+        throw new Error(`ctx.output.file: '${path}' is not a file`);
       const name = opts.name ?? basename(src);
-      checkName(name, "ctx.output.file");
+      checkName(name, 'ctx.output.file');
       const dest = claim(name);
       copyFileSync(src, dest);
       return ref(name, dest);
     },
     async dir(path: string, opts: OutputFileOptions = {}): Promise<FileRef> {
       const src = resolve(path);
-      if (!statSync(src).isDirectory()) throw new Error(`ctx.output.dir: '${path}' is not a directory`);
+      if (!statSync(src).isDirectory())
+        throw new Error(`ctx.output.dir: '${path}' is not a directory`);
       const name = opts.name ?? basename(src);
-      checkName(name, "ctx.output.dir");
-      const dest = claim(objectPath(name + "/"));
+      checkName(name, 'ctx.output.dir');
+      const dest = claim(objectPath(name + '/'));
       writeTar(dest, dirEntries(src));
-      return ref(name + "/", dest);
+      return ref(name + '/', dest);
     },
     async write(name: string, content: string | Uint8Array): Promise<FileRef> {
-      checkName(name, "ctx.output.write");
+      checkName(name, 'ctx.output.write');
       const dest = claim(name);
       writeFileSync(dest, content);
       return ref(name, dest);
@@ -72,20 +96,33 @@ export function createOutput(deps: FilesDeps) {
 }
 
 function urlMap(root: string): Record<string, string> {
-  const raw = process.env[ENV.fileUrls] ?? (existsSync(join(root, "files.json")) ? readFileSync(join(root, "files.json"), "utf8") : undefined);
+  const raw =
+    process.env[ENV.fileUrls] ??
+    (existsSync(join(root, 'files.json'))
+      ? readFileSync(join(root, 'files.json'), 'utf8')
+      : undefined);
   if (!raw) return {};
   try {
     const m = JSON.parse(raw) as unknown;
-    if (typeof m !== "object" || m === null || Array.isArray(m)) throw new Error("not an object");
+    if (typeof m !== 'object' || m === null || Array.isArray(m))
+      throw new Error('not an object');
     return m as Record<string, string>;
   } catch (e) {
-    throw new Error(`${ENV.fileUrls} / files.json is not a JSON object of file key → URL (${(e as Error).message})`);
+    throw new Error(
+      `${ENV.fileUrls} / files.json is not a JSON object of file key → URL (${(e as Error).message})`,
+    );
   }
 }
 
 const TRANSIENT = (status: number) => status >= 500 || status === 408 || status === 429;
 
-async function download(url: string, dest: string, headers: Record<string, string>, signal: AbortSignal, log: FilesDeps["log"]): Promise<void> {
+async function download(
+  url: string,
+  dest: string,
+  headers: Record<string, string>,
+  signal: AbortSignal,
+  log: FilesDeps['log'],
+): Promise<void> {
   const attempts = 4;
   for (let i = 1; ; i++) {
     let status = 0;
@@ -93,14 +130,19 @@ async function download(url: string, dest: string, headers: Record<string, strin
       const res = await fetch(url, { headers, signal });
       status = res.status;
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
-      await Bun.write(dest + ".partial", res);
-      renameSync(dest + ".partial", dest);
+      await Bun.write(dest + '.partial', res);
+      renameSync(dest + '.partial', dest);
       return;
     } catch (e) {
-      rmSync(dest + ".partial", { force: true });
+      rmSync(dest + '.partial', { force: true });
       const transient = status === 0 || TRANSIENT(status);
-      if (signal.aborted || !transient || i >= attempts) throw new Error(`download of ${redactUrl(url)} failed: ${(e as Error).message}`);
-      log("download failed, retrying", { url: redactUrl(url), attempt: i, error: (e as Error).message });
+      if (signal.aborted || !transient || i >= attempts)
+        throw new Error(`download of ${redactUrl(url)} failed: ${(e as Error).message}`);
+      log('download failed, retrying', {
+        url: redactUrl(url),
+        attempt: i,
+        error: (e as Error).message,
+      });
       await Bun.sleep(1000 * 2 ** (i - 1));
     }
   }
@@ -110,29 +152,56 @@ export function createFetch(deps: FilesDeps) {
   const cache = new Map<string, string>();
   return async (input: FileRef): Promise<string> => {
     const parsed = fileRefSchema.safeParse(input);
-    if (!parsed.success) throw new Error(`ctx.files.fetch: not a valid file reference: ${JSON.stringify(input)}`);
+    if (!parsed.success)
+      throw new Error(
+        `ctx.files.fetch: not a valid file reference: ${JSON.stringify(input)}`,
+      );
     const ref = parsed.data;
     const key = fileKey(ref);
     const hit = cache.get(key);
     if (hit) return hit;
 
     const obj = objectPath(ref.path);
-    const base = join(deps.tmpDir, "files", String(ref.run), ref.step, String(ref.attempt));
-    const objFile = join(base, ".objects", obj);
+    const base = join(
+      deps.tmpDir,
+      'files',
+      String(ref.run),
+      ref.step,
+      String(ref.attempt),
+    );
+    const objFile = join(base, '.objects', obj);
     mkdirSync(dirname(objFile), { recursive: true });
 
-    const own = ref.run === deps.run.number && ref.step === deps.run.step && ref.attempt === deps.run.attempt;
+    const own =
+      ref.run === deps.run.number &&
+      ref.step === deps.run.step &&
+      ref.attempt === deps.run.attempt;
     const urls = urlMap(deps.root);
     const localDir = process.env[ENV.filesDir];
     const baseUrl = process.env[ENV.filesBaseUrl];
-    if (own && existsSync(join(deps.workFiles, obj))) copyFileSync(join(deps.workFiles, obj), objFile);
+    if (own && existsSync(join(deps.workFiles, obj)))
+      copyFileSync(join(deps.workFiles, obj), objFile);
     else if (urls[key]) await download(urls[key], objFile, {}, deps.signal, deps.log);
-    else if (localDir && existsSync(join(localDir, String(ref.run), ref.step, String(ref.attempt), "files", obj)))
-      copyFileSync(join(localDir, String(ref.run), ref.step, String(ref.attempt), "files", obj), objFile);
+    else if (
+      localDir &&
+      existsSync(
+        join(localDir, String(ref.run), ref.step, String(ref.attempt), 'files', obj),
+      )
+    )
+      copyFileSync(
+        join(localDir, String(ref.run), ref.step, String(ref.attempt), 'files', obj),
+        objFile,
+      );
     else if (baseUrl) {
       const token = process.env[ENV.filesToken];
-      const url = `${baseUrl.replace(/\/+$/, "")}/${ref.run}/${encodeURIComponent(ref.step)}/${ref.attempt}/${obj.split("/").map(encodeURIComponent).join("/")}`;
-      await download(url, objFile, token ? { authorization: `Bearer ${token}` } : {}, deps.signal, deps.log);
+      const url = `${baseUrl.replace(/\/+$/, '')}/${ref.run}/${encodeURIComponent(ref.step)}/${ref.attempt}/${obj.split('/').map(encodeURIComponent).join('/')}`;
+      await download(
+        url,
+        objFile,
+        token ? { authorization: `Bearer ${token}` } : {},
+        deps.signal,
+        deps.log,
+      );
     } else {
       throw new Error(
         `ctx.files.fetch: no source for ${key} (set ${ENV.fileUrls} / $OLVE_DIR/files.json, ${ENV.filesBaseUrl} or ${ENV.filesDir})`,
@@ -142,10 +211,12 @@ export function createFetch(deps: FilesDeps) {
     const actual = sha256File(objFile);
     if (actual !== ref.sha256) {
       rmSync(objFile, { force: true });
-      throw new Error(`ctx.files.fetch: ${key} has sha256 ${actual}, expected ${ref.sha256}`);
+      throw new Error(
+        `ctx.files.fetch: ${key} has sha256 ${actual}, expected ${ref.sha256}`,
+      );
     }
     let result = objFile;
-    if (ref.path.endsWith("/")) {
+    if (ref.path.endsWith('/')) {
       result = join(base, ref.path.slice(0, -1));
       rmSync(result, { recursive: true, force: true });
       mkdirSync(result, { recursive: true });

package/src/ctx/index.ts

@@ -1,10 +1,10 @@
-import { mkdirSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { skipped } from "../core/handlers.ts";
-import type { Secret } from "../core/secrets.ts";
-import { createFetch, createOutput, redactUrl } from "./files.ts";
-import { createSh } from "./sh.ts";
-import type { Ctx, Http, RetryOptions, RunInfo } from "./types.ts";
+import { mkdirSync, readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { skipped } from '../core/handlers.ts';
+import type { Secret } from '../core/secrets.ts';
+import { createFetch, createOutput, redactUrl } from './files.ts';
+import { createSh } from './sh.ts';
+import type { Ctx, Http, RetryOptions, RunInfo } from './types.ts';
 
 export interface CtxOptions {
   run: RunInfo;
@@ -23,18 +23,27 @@ export interface CtxOptions {
 }
 
 export function formatLog(message: string, fields?: Record<string, unknown>): string {
-  const parts = Object.entries(fields ?? {}).map(([k, v]) => `${k}=${typeof v === "string" && !/\s|"/.test(v) ? v : JSON.stringify(v)}`);
-  return parts.length ? `${message} ${parts.join(" ")}` : message;
+  const parts = Object.entries(fields ?? {}).map(
+    ([k, v]) =>
+      `${k}=${typeof v === 'string' && !/\s|"/.test(v) ? v : JSON.stringify(v)}`,
+  );
+  return parts.length ? `${message} ${parts.join(' ')}` : message;
 }
 
-export function createSecrets(declared: readonly Secret[], values?: Readonly<Record<string, string>>): Record<string, string> {
+export function createSecrets(
+  declared: readonly Secret[],
+  values?: Readonly<Record<string, string>>,
+): Record<string, string> {
   const obj: Record<string, string> = {};
   for (const s of declared) {
     Object.defineProperty(obj, s.name, {
       enumerable: true,
       get() {
         const v = values?.[s.name] ?? process.env[s.name];
-        if (v === undefined) throw new Error(`secret ${s.name} is not set (the harness reads it from the environment variable ${s.name})`);
+        if (v === undefined)
+          throw new Error(
+            `secret ${s.name} is not set (the harness reads it from the environment variable ${s.name})`,
+          );
         return v;
       },
     });
@@ -43,52 +52,74 @@ export function createSecrets(declared: readonly Secret[], values?: Readonly<Rec
 }
 
 async function httpError(res: Response, url: string): Promise<Error> {
-  let body = "";
+  let body = '';
   try {
     body = (await res.text()).slice(0, 500);
   } catch {
     /* ignore */
   }
-  return new Error(`HTTP ${res.status} ${res.statusText} from ${redactUrl(url)}${body ? `: ${body}` : ""}`);
+  return new Error(
+    `HTTP ${res.status} ${res.statusText} from ${redactUrl(url)}${body ? `: ${body}` : ''}`,
+  );
 }
 
 export function createHttp(signal: AbortSignal): Http {
-  const f = (url: string, init?: RequestInit) => fetch(url, { ...init, signal: init?.signal ?? signal });
+  const f = (url: string, init?: RequestInit) =>
+    fetch(url, { ...init, signal: init?.signal ?? signal });
   return {
     fetch: f,
-    async getJson<T>(url: string, init?: { headers?: Record<string, string> }): Promise<T> {
-      const res = await f(url, { headers: { accept: "application/json", ...init?.headers } });
+    async getJson<T>(
+      url: string,
+      init?: { headers?: Record<string, string> },
+    ): Promise<T> {
+      const res = await f(url, {
+        headers: { accept: 'application/json', ...init?.headers },
+      });
       if (!res.ok) throw await httpError(res, url);
       return (await res.json()) as T;
     },
-    async expectOk(url: string, init?: { headers?: Record<string, string>; method?: string }): Promise<Response> {
-      const res = await f(url, { method: init?.method ?? "GET", headers: init?.headers });
+    async expectOk(
+      url: string,
+      init?: { headers?: Record<string, string>; method?: string },
+    ): Promise<Response> {
+      const res = await f(url, { method: init?.method ?? 'GET', headers: init?.headers });
       if (!res.ok) throw await httpError(res, url);
       return res;
     },
   };
 }
 
-export function createRetry(signal: AbortSignal, log: (m: string, f?: Record<string, unknown>) => void) {
-  return async <T>(opts: RetryOptions, fn: (attempt: number) => Promise<T>): Promise<T> => {
-    if (!(Number.isInteger(opts.attempts) && opts.attempts >= 1)) throw new Error("retry: attempts must be a positive integer");
+export function createRetry(
+  signal: AbortSignal,
+  log: (m: string, f?: Record<string, unknown>) => void,
+) {
+  return async <T>(
+    opts: RetryOptions,
+    fn: (attempt: number) => Promise<T>,
+  ): Promise<T> => {
+    if (!(Number.isInteger(opts.attempts) && opts.attempts >= 1))
+      throw new Error('retry: attempts must be a positive integer');
     let delay = Math.max(0, opts.delaySeconds) * 1000;
     for (let attempt = 1; ; attempt++) {
       try {
         return await fn(attempt);
       } catch (e) {
         if (attempt >= opts.attempts || signal.aborted) throw e;
-        log("retrying", { attempt, of: opts.attempts, error: (e as Error)?.message ?? String(e) });
+        log('retrying', {
+          attempt,
+          of: opts.attempts,
+          error: (e as Error)?.message ?? String(e),
+        });
         await new Promise<void>((res, rej) => {
           const t = setTimeout(() => {
-            signal.removeEventListener("abort", onAbort);
+            signal.removeEventListener('abort', onAbort);
             res();
           }, delay);
           const onAbort = () => {
             clearTimeout(t);
-            rej(new Error("retry cancelled: the step was cancelled"));
+            rej(new Error('retry cancelled: the step was cancelled'));
           };
-          signal.addEventListener("abort", onAbort, { once: true });
+          signal.addEventListener('abort', onAbort, { once: true });
         });
         delay *= opts.backoff ?? 1;
       }
@@ -100,17 +131,25 @@ export function createRetry(signal: AbortSignal, log: (m: string, f?: Record<str
 export function createCtx(o: CtxOptions): Ctx {
   mkdirSync(o.paths.tmp, { recursive: true });
   mkdirSync(o.paths.workFiles, { recursive: true });
-  const sink = o.logSink ?? ((line: string) => process.stderr.write(line + "\n"));
-  const log = (message: string, fields?: Record<string, unknown>) => sink(formatLog(message, fields));
+  const sink = o.logSink ?? ((line: string) => process.stderr.write(line + '\n'));
+  const log = (message: string, fields?: Record<string, unknown>) =>
+    sink(formatLog(message, fields));
   const { sh, exec } = createSh({ tmpDir: o.paths.tmp, signal: o.signal });
-  const filesDeps = { run: o.run, workFiles: o.paths.workFiles, tmpDir: o.paths.tmp, root: o.paths.root, signal: o.signal, log };
+  const filesDeps = {
+    run: o.run,
+    workFiles: o.paths.workFiles,
+    tmpDir: o.paths.tmp,
+    root: o.paths.root,
+    signal: o.signal,
+    log,
+  };
   return {
-    secrets: createSecrets(o.secrets, o.secretValues) as Ctx["secrets"],
-    config: Object.freeze({ ...o.config }) as Ctx["config"],
+    secrets: createSecrets(o.secrets, o.secretValues) as Ctx['secrets'],
+    config: Object.freeze({ ...o.config }) as Ctx['config'],
     sh,
     exec,
-    readText: async (p) => readFileSync(resolve(p), "utf8"),
-    readJson: async <T>(p: string) => JSON.parse(readFileSync(resolve(p), "utf8")) as T,
+    readText: async (p) => readFileSync(resolve(p), 'utf8'),
+    readJson: async <T>(p: string) => JSON.parse(readFileSync(resolve(p), 'utf8')) as T,
     files: { fetch: createFetch(filesDeps) },
     output: createOutput(filesDeps),
     http: createHttp(o.signal),
@@ -121,10 +160,12 @@ export function createCtx(o: CtxOptions): Ctx {
     tmpDir: o.paths.tmp,
     skip: skipped,
     inputUrl: (step, input) => {
-      const name = typeof step === "string" ? step : step.name;
+      const name = typeof step === 'string' ? step : step.name;
       const url = o.callbackUrls?.[`${name}/${input}`];
       if (!url)
-        throw new Error(`no callback URL for input '${input}' of step '${name}': it must list callback() in from, and the instance needs a public base URL`);
+        throw new Error(
+          `no callback URL for input '${input}' of step '${name}': it must list callback() in from, and the instance needs a public base URL`,
+        );
       return url;
     },
   };