@olivervea/pipelines 2.0.0-beta.20 → 2.0.0-beta.22

package/README.md

@@ -47,7 +47,7 @@ bunx olve-build . --out .olve/out
 ```
 
 - The package ships TypeScript sources (Bun runs them directly; `harness.sdkHash` hashes them), so the
-  same version gives the same `sdkHash` and handler hashes from npm or from `file:../src/sdk`.
+  same version gives the same `sdkHash` and `codeHash` from npm or from `file:../src/sdk`.
 - Inside this repo, `.pipelines/` and `.pipelines-test/` use `"@olivervea/pipelines": "file:../src/sdk"`.
 
 ### Releases
@@ -59,17 +59,9 @@ skips when the version exists, or when the pipeline secret `NPM_TOKEN` is unset.
 
 ## Authoring
 
-A pipeline directory (the binding path, `.pipelines/` by default) looks like this:
+A pipeline directory (the binding path, `.pipelines/` by default) is an ordinary Bun package. `main` in `package.json` is required and names the entry point, which default-exports the pipeline; every other name is yours. A step carries its implementation, `implement(step({ … }), fn)`, and is imported and staged like any value.
 
-```
-models.ts                 data models                         (contract file)
-pipeline.ts               steps + `export default pipeline(…)` (contract file)
-handlers/*.ts             one per custom step: `export default implement(step, fn)` (pairs by the step, not the file name)
-handlers/lib/…            shared helpers (not handlers)
-scripts/*.sh              embedded with `import s from "../scripts/x.sh" with { type: "file" }`
-```
-
-Contract files hold contracts only. Describe evaluates them without loading handlers, and they are kept out of every handler's hash.
+Describe evaluates the entry point and everything it imports, so top-level code must be deterministic: no env, time or network. Scripts are embedded with `import s from "./x.sh" with { type: "file" }`.
 
 ### Models, secrets, steps
 
@@ -97,6 +89,7 @@ export const deployBeta = step({
 
 Rules:
 
+- `step()` is the contract. A pipeline stages `implement(step, fn)`; a staged step without an implementation is a describe error.
 - Models are **nominal**: two models with the same shape are not interchangeable.
 - There is **one schema per model name**. Two different schemas registered under the same name is a describe error.
 - **Outputs are validated strictly**: unknown keys are rejected at any depth, not stripped.
@@ -176,13 +169,13 @@ Library steps carry their own implementation and image; they take typed settings
 | `sshSession(ctx, { host, key })` | Installs openssh-client when the image has no ssh (apk or apt-get), writes the key to `<tmpDir>/ssh/id` (trailing newline, mode 600; host key not verified) and returns `{ run(remote), text(remote), copy(local, remote), shell(remote) }`; `shell` is the quoted ssh command for pipes (`ctx.sh(`printf '%s' "$V" \| ${s.shell("kubectl apply -f -")}`)`). `helmDeployOverSsh` uses it. |
 
 ```ts
-import { httpHealthCheck, implement } from "@olivervea/pipelines";
-export default implement(smoke, async (_, ctx) => { await httpHealthCheck(ctx, "http://app.ns.svc.cluster.local/api/health", { attempts: 10 }); });
+import { httpHealthCheck, implement, step } from "@olivervea/pipelines";
+export const smoke = implement(step({ name: "smoke", description: "", image: "alpine:3.22" }), async (_, ctx) => { await httpHealthCheck(ctx, "http://app.ns.svc.cluster.local/api/health", { attempts: 10 }); });
 ```
 
 ### Reusable steps
 
-A step several pipelines use is a function returning `implement(step(…), handler)`, staged directly: it carries its handler, so it has no `handlers/` file. The library steps are written this way, so a module in a repo or a package of its own works the same.
+A step several pipelines use is a function returning `implement(step(…), handler)`, staged directly. The library steps are written this way, so a module in a repo or a package of its own works the same.
 
 ```ts
 import { implement, resolveConfigRefs, serviceUrl, step, HelmRelease, type Configurable, type LiteralName } from "@olivervea/pipelines";
@@ -195,20 +188,17 @@ export function smokeTest<const N extends string>(def: { name: LiteralName<N>; d
 }
 ```
 
-- **`kind`**: a label, required for a step that carries its implementation (`custom` is a step with a handler file). Prefix a package's kinds (`acme/smokeTest`).
+- **`kind`**: a label, `custom` unless the step names one. Prefix a package's kinds (`acme/smokeTest`).
 - **`settings`**: what the step was set up with, recorded as the step's manifest `config` (so part of its version). JSON values and config references; the step receives every entry its settings reference.
-- **Identity**: `implement` and `step` record the module that called them (from the stack; a tail call can name a module further up, which only adds to what is hashed). The build bundles those modules, minus `pipeline.ts` and `models.ts`, like a handler, and the kind's hash (`kindHashes` in the generated `handlers.ts`) goes into each such step's `handlerHash`. A step that carries its implementation and has no other module (defined and implemented in a contract file) is a build error.
-- `implement` refuses a step that already carries an implementation; a `handlers/*.ts` file for such a step is a describe error.
+- `implement` refuses a step that already carries an implementation.
 
 ### Handlers
 
 ```ts
-// handlers/deploy-beta.ts
-import { implement } from "@olivervea/pipelines";
-import { deployBeta } from "../pipeline";
-import deployScript from "../scripts/deploy.sh" with { type: "file" };
+import { implement, step } from "@olivervea/pipelines";
+import deployScript from "./scripts/deploy.sh" with { type: "file" };
 
-export default implement(deployBeta, async ({ artifact }, ctx) => {
+export const deployBeta = implement(step({ name: "deploy-beta", /* … */ }), async ({ artifact }, ctx) => {
   await ctx.sh(deployScript, { env: { IMAGE_TAR: await ctx.files.fetch(artifact.image), CHART_DIR: await ctx.files.fetch(artifact.chart) } });
   await ctx.retry({ attempts: 5, delaySeconds: 5 }, () => ctx.http.expectOk("https://pipelines-beta.ovea.pro/api/health"));
   return { release: "olve-pipelines", version: artifact.version, url: "https://pipelines-beta.ovea.pro" };   // or ctx.skip("reason")
@@ -260,13 +250,13 @@ export default pipeline({ name: "Olve.Pipelines", description: "…", input: M.D
 
 ```ts
 import { testHandler, testFileRef } from "@olivervea/pipelines/testing";
-import deployBeta from "../handlers/deploy-beta";
+import { deployBeta } from "../steps/deploy-beta";
 
 const r = await testHandler(deployBeta, { artifact }, { secrets: { SSH_PRIVATE_KEY: "k" }, config: { target: { host: "h" } }, ctx: { http: fakeHttp }, run: { number: 412 } });
 expect(r).toMatchObject({ status: "succeeded", output: { release: "olve-pipelines" } });   // r.filesDir, r.logs, r.exitCode
 ```
 
-`testHandler` uses the same validation path as a real run. Invalid input gives `status: "failed"` with `kind: "input"`; an invalid return value gives `kind: "output"`. Any part of `ctx` can be replaced; whatever you don't replace is the real implementation. `testHandler` takes any implementation: a handler module's default export, a library step or a reusable step.
+`testHandler` uses the same validation path as a real run. Invalid input gives `status: "failed"` with `kind: "input"`; an invalid return value gives `kind: "output"`. Any part of `ctx` can be replaced; whatever you don't replace is the real implementation. `testHandler` takes any implementation: a custom step, a library step or a reusable step.
 
 ## Harness contract (service ⇄ step binary)
 
@@ -346,7 +336,7 @@ For `map-trigger`, `output` is the pipeline input after it has been parsed by th
 | 65 | `input.json` missing, not JSON, or invalid for the step (or event), including its `$config` | failed / `input` |
 | 66 | the return value failed strict validation, or an own file ref is missing or changed | failed / `output` |
 | 74 | the `result.tar.gz` upload failed after retries. Used only when the step itself succeeded; otherwise the step's own code wins. | yes (printed) |
-| 78 | the pipeline is invalid (describe problems, or a missing or wrong handler module) | none |
+| 78 | the pipeline is invalid (describe problems, or a step without an implementation) | none |
 | 130 / 143 | the handler failed after SIGINT / SIGTERM (cancellation, `activeDeadlineSeconds`) | failed / `handler` |
 
 ### Result upload (`OLVE_RESULT_URL`)
@@ -377,7 +367,7 @@ Exact format: [`manifest.schema.json`](manifest.schema.json) (JSON Schema 2020-1
 - **`apiVersion`** is `"2.0"`.
 - **`harness`** is `{ bun, sdk, sdkHash }`.
 - **`models[name]`** is `{ output, input? }`.
-- **Step `kind`** is `custom` (a handler file) or the kind of a step that carries its implementation (`imageBuild`, `composeDeploy`, a package's `acme/…`). To the service it is a label: any non-empty kind is accepted, so a new library or package step needs no service change.
+- **Step `kind`** is `custom` by default, or what a reusable step names (`imageBuild`, `composeDeploy`, a package's `acme/…`). To the service it is a label: any non-empty kind is accepted, so a new library or package step needs no service change.
   - `output` is the `z.output` view, with `additionalProperties: false` on every object. It validates outputs, the pool and trigger results.
   - `input` is the `z.input` view (defaults optional). Use it for trigger forms and manual input. It is emitted only when it differs from `output` beyond `additionalProperties`.
 - **Step `input`** maps each input key to a mapping:
@@ -388,10 +378,7 @@ Exact format: [`manifest.schema.json`](manifest.schema.json) (JSON Schema 2020-1
   An object whose only key is `ref` (with a string value) or `const` is a tag. Describe never emits a nested object with exactly that key set. Model-matched inputs are emitted already resolved (`{"ref": "build"}`).
 - **Step `externalInputs`** (when present) maps each external input key to `{model, title, description, from}`, `from` being `{kind: "person"}`, `{kind: "callback"}` or `{kind: "poll", url, valuePath, intervalSeconds}`. Those keys are not in `input` or `inputTypes`; the service merges the answers into `input.json`.
 - **`inputTypes`** declares each input key: `{model, optional}`, or `{schema: {output, input?}}` for a plain schema.
-- **`handlerHash`** is the step's implementation identity. A step version can be computed from image + `inputTypes`/model versions + `output` model version + `secrets` + `configEntries` (and those entries' schemas) + `input` mappings + `handlerHash`. Stage placement, `when` and the step's `description` are not part of it.
-  - Custom steps: `sha256(canonical {bundle, harness})`. `bundle` hashes the handler bundled on its own, with `pipeline.ts`, `models.ts` and `@olivervea/pipelines` external. It is tree-shaken and includes embedded scripts, so it changes only when that handler's code (or code it uses) changes.
-  - Steps that carry their implementation: `sha256(canonical {library: kind, config, harness, code})`, `code` being the hash of the modules that define and implement steps of that kind (see [Reusable steps](#reusable-steps)).
-  - Because `harness` is part of both hashes, a Bun or SDK bump changes every handler.
+- **`codeHash`** is the build's identity: `sha256(canonical {bundle, harness})`. `bundle` hashes the entry point bundled with everything it imports, with `@olivervea/pipelines` external. It is tree-shaken and includes embedded scripts and dependencies, so any change to code in use changes it, and with it the manifest, which makes a new pipeline version. A step version covers what the step declares: image, `inputTypes`/model versions, `output` model version, `secrets`, `configEntries` (and those entries' schemas), `input` mappings and `config`.
 - **`stages`** is an array whose items are either `{steps: [Step…]}` (parallel, with a barrier) or `{when: {field: [values]}, stages: [...]}`.
 - **`triggers`**:
   - `{kind: "push", name: "push"}`;
@@ -407,7 +394,7 @@ Describe runs these checks; reconcile should re-run the manifest-level ones:
 
 - step name format and reserved names (`input`, `failure`), and duplicate step names;
 - one schema per model name, and JSON-representable models;
-- missing handler file, a handler file without a step (or for a step that carries its implementation), and a step that carries its implementation without a kind;
+- a staged step without an implementation, and an empty step kind;
 - availability, ambiguity, maybe-available as required, `optional` without a producer, plain schema without a mapper;
 - mapper source analysis and recording, unknown fields in refs, mapper keys that are missing or extra;
 - `when` on an unknown or non-literal field, or with an invalid value;
@@ -420,14 +407,14 @@ Describe runs these checks; reconcile should re-run the manifest-level ones:
 
 ```
 olve-build <pipelineDir> --out <dir> [--target bun-linux-x64|bun-linux-x64-musl] [--upload-url <presigned PUT>] [--sentinels]
-olve-build <pipelineDir> --hash-only          # print handler hashes (diagnostics)
+olve-build <pipelineDir> --hash-only          # print the code hash (diagnostics)
 ```
 
-1. Pair each `handlers/*.ts` with the step its `implement(step, …)` names, and hash it (see `handlerHash`); hash the modules of each kind of step that carries its implementation.
-2. Generate `<pipelineDir>/.olve/gen/handlers.ts` (a registry of literal `import()` paths, plus hashes and harness info) and `entry.ts`. Add `.olve/` to `.gitignore`.
+1. Read the entry point from `main` in `package.json` (a missing `main`, or a `main` whose file is missing, is an error) and hash the build (see `codeHash`).
+2. Generate `<pipelineDir>/.olve/gen/entry.ts`, which imports the pipeline and calls `runHarness` with it, the code hash and the harness info. Add `.olve/` to `.gitignore`.
 3. Run `bun build --compile --target=bun-linux-x64 --no-compile-autoload-dotenv --no-compile-autoload-bunfig --bytecode --format=esm` → `<out>/step`. The output is never minified, because mapper source analysis needs real source.
 4. Check that `PT_INTERP` is `/lib64/ld-linux-x86-64.so.2`. On alpine, Bun silently produces a musl binary; the check fails it.
-5. Run `<out>/step describe` → `<out>/manifest.json`. A describe problem is a build failure with exit 78. **A custom step without a handler file is an error.**
+5. Run `<out>/step describe` → `<out>/manifest.json`. A describe problem is a build failure with exit 78. **A step with no implementation is an error.**
 6. Write `<out>/step.tar.zst` (a deterministic tar, `step` at the root, mode 0755, zstd level 3: it unpacks in the step pod far faster than gzip; harness-base also still unpacks the gzip archives of older SDKs; from 2.0.0-beta.7 the SDK needs an instance whose harness-base unpacks zstd, i.e. one deployed on or after 2026-10-25) and `<out>/build.json` (diagnostics).
 7. With `--upload-url`, PUT `step.tar.zst`, using the same retry rules as the result upload. With `--sentinels`, print the manifest between the manifest sentinels.
 

package/manifest.schema.json

@@ -47,6 +47,11 @@
           "const": "2.0",
           "type": "string"
         },
+        "codeHash": {
+          "description": "Hash of the whole build: the pipeline and its code bundled, plus the harness. Any code change makes a new pipeline version.",
+          "pattern": "^sha256:[0-9a-f]{64}$",
+          "type": "string"
+        },
         "config": {
           "description": "Config entries used by steps, sorted by name (omitted when none). Fields of kind secretRef ({secret: NAME}) name a secret.",
           "items": {
@@ -121,7 +126,7 @@
         },
         "harness": {
           "additionalProperties": false,
-          "description": "Harness identity. Already folded into every handlerHash.",
+          "description": "Harness identity. Already folded into codeHash.",
           "properties": {
             "bun": {
               "description": "Bun runtime version compiled into the binary.",
@@ -227,6 +232,7 @@
         "name",
         "input",
         "harness",
+        "codeHash",
         "models",
         "secrets",
         "triggers",
@@ -404,7 +410,7 @@
           "additionalProperties": {
             "$ref": "#/$defs/Json"
           },
-          "description": "The step's settings (display only; already covered by handlerHash). A config reference is recorded as {\"$config\": \"<entry>.<field>…\"}; the entry is in configEntries.",
+          "description": "The step's settings (display only). A config reference is recorded as {\"$config\": \"<entry>.<field>…\"}; the entry is in configEntries.",
           "propertyNames": {
             "type": "string"
           },
@@ -520,11 +526,6 @@
           },
           "type": "object"
         },
-        "handlerHash": {
-          "description": "Implementation identity: handler bundle (contract files excluded) + harness (bun + sdkHash); for a step that carries its implementation kind + config + harness + the hash of the code of its kind.",
-          "pattern": "^sha256:[0-9a-f]{64}$",
-          "type": "string"
-        },
         "image": {
           "description": "Container image the step runs in.",
           "minLength": 1,
@@ -551,7 +552,7 @@
           "type": "object"
         },
         "kind": {
-          "description": "'custom' = the handler is a handlers/*.ts file; any other kind is a step that carries its implementation (an SDK or package step). A label: the service accepts any kind.",
+          "description": "A label for the step's kind: 'custom' unless the step names one.",
           "minLength": 1,
           "type": "string"
         },
@@ -601,8 +602,7 @@
         "inputTypes",
         "input",
         "output",
-        "secrets",
-        "handlerHash"
+        "secrets"
       ],
       "type": "object"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olivervea/pipelines",
-  "version": "2.0.0-beta.20",
+  "version": "2.0.0-beta.22",
   "description": "Olve.Pipelines v2 SDK: typed pipeline authoring, the step harness, and the build tool.",
   "type": "module",
   "license": "MIT",

package/src/build/build.ts

@@ -3,18 +3,12 @@ import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { canonicalJson } from '../util/canonical.ts';
 import { sha256File } from '../util/hash.ts';
-import type { HarnessInfo } from '../util/handler-hash.ts';
+import type { HarnessInfo } from '../util/code-hash.ts';
 import { writeTarZst } from '../util/tar.ts';
 import { MANIFEST_BEGIN, MANIFEST_END, uploadFile } from '../harness/result.ts';
 import { GLIBC_INTERP, MUSL_INTERP, readInterpreter } from './elf.ts';
-import { handlerHashes, kindHashes, type HandlerHash } from './hashes.ts';
-import {
-  harnessInfo,
-  loadPipeline,
-  loadProject,
-  relPosix,
-  type Project,
-} from './project.ts';
+import { codeHash } from './hashes.ts';
+import { harnessInfo, loadProject, relPosix, type Project } from './project.ts';
 
 export const BUILD_FLAGS = [
   '--no-compile-autoload-dotenv',
@@ -50,42 +44,26 @@ export interface BuildResult {
   archive: string;
   manifestFile: string;
   manifest: string;
-  hashes: Record<string, HandlerHash>;
+  codeHash: string;
   harness: HarnessInfo;
 }
 
-/** Writes `<dir>/.olve/gen/{handlers,entry}.ts`: the literal-import handler registry + binary entry. */
+/** Writes `<dir>/.olve/gen/entry.ts`, the entry point of the step binary. */
 export function generateEntry(
   project: Project,
-  hashes: Record<string, string>,
+  code: string,
   harness: HarnessInfo,
-  kinds: Record<string, string> = {},
 ): string {
   const gen = join(project.dir, '.olve', 'gen');
   mkdirSync(gen, { recursive: true });
-  const registry = project.handlers
-    .map(
-      ([name, file]) =>
-        `  ${JSON.stringify(name)}: () => import(${JSON.stringify(relPosix(gen, file))}),`,
-    )
-    .join('\n');
-  writeFileSync(
-    join(gen, 'handlers.ts'),
-    `// GENERATED by olve-build — do not edit.\n` +
-      `import type { HandlerRegistry, HarnessInfo } from "@olivervea/pipelines/harness";\n\n` +
-      `export const handlers: HandlerRegistry = {\n${registry}\n};\n\n` +
-      `export const handlerHashes: Record<string, string> = ${JSON.stringify(hashes, null, 2)};\n\n` +
-      `export const kindHashes: Record<string, string> = ${JSON.stringify(kinds, null, 2)};\n\n` +
-      `export const harness: HarnessInfo = ${JSON.stringify(harness, null, 2)};\n`,
-  );
   const entry = join(gen, 'entry.ts');
+  const config = `{ pipeline, codeHash: ${JSON.stringify(code)}, harness: ${JSON.stringify(harness)} }`;
   writeFileSync(
     entry,
     `// GENERATED by olve-build — do not edit. Entry point of the step binary.\n` +
       `import pipeline from ${JSON.stringify(relPosix(gen, project.pipelineFile))};\n` +
-      `import { runHarness } from "@olivervea/pipelines/harness";\n` +
-      `import { handlers, handlerHashes, kindHashes, harness } from "./handlers.ts";\n\n` +
-      `process.exit(await runHarness({ pipeline, handlers, handlerHashes, kindHashes, harness }, process.argv.slice(2)));\n`,
+      `import { runHarness } from "@olivervea/pipelines/harness";\n\n` +
+      `process.exit(await runHarness(${config}, process.argv.slice(2)));\n`,
   );
   return entry;
 }
@@ -101,17 +79,9 @@ export async function build(dir: string, opts: BuildOptions): Promise<BuildResul
   const harness = harnessInfo();
 
   const t0 = performance.now();
-  const hashes = await handlerHashes(project, harness);
-  const kinds = await kindHashes(project, await loadPipeline(project));
-  const entry = generateEntry(
-    project,
-    Object.fromEntries(Object.entries(hashes).map(([k, v]) => [k, v.handlerHash])),
-    harness,
-    kinds,
-  );
-  log(
-    `olve-build: ${project.handlers.length} handler(s) hashed in ${((performance.now() - t0) / 1000).toFixed(2)}s`,
-  );
+  const code = await codeHash(project, harness);
+  const entry = generateEntry(project, code, harness);
+  log(`olve-build: hashed the code in ${((performance.now() - t0) / 1000).toFixed(2)}s`);
 
   // 1. compile
   const binary = join(out, 'step');
@@ -178,8 +148,7 @@ export async function build(dir: string, opts: BuildOptions): Promise<BuildResul
       target,
       flags: BUILD_FLAGS,
       harness,
-      handlers: hashes,
-      kinds,
+      codeHash: code,
       binarySha256: sha256File(binary),
       archiveSha256: sha256File(archive),
     }),
@@ -191,5 +160,5 @@ export async function build(dir: string, opts: BuildOptions): Promise<BuildResul
     log('olve-build: uploaded step.tar.zst');
   }
   if (opts.sentinels) await stdout(`${MANIFEST_BEGIN}\n${manifest}${MANIFEST_END}\n`);
-  return { binary, archive, manifestFile, manifest, hashes, harness };
+  return { binary, archive, manifestFile, manifest, codeHash: code, harness };
 }

package/src/build/cli.ts

@@ -3,7 +3,7 @@
 import { parseArgs } from 'node:util';
 import { canonicalJson } from '../util/canonical.ts';
 import { build, BuildError, type Target } from './build.ts';
-import { handlerHashes } from './hashes.ts';
+import { codeHash } from './hashes.ts';
 import { harnessInfo, loadProject, ProjectError } from './project.ts';
 
 const USAGE =
@@ -33,8 +33,11 @@ async function main(): Promise<number> {
   const dir = positionals[0]!;
   try {
     if (values['hash-only']) {
-      const h = await handlerHashes(await loadProject(dir), harnessInfo());
-      await Bun.write(Bun.stdout, canonicalJson({ harness: harnessInfo(), handlers: h }));
+      const code = await codeHash(await loadProject(dir), harnessInfo());
+      await Bun.write(
+        Bun.stdout,
+        canonicalJson({ harness: harnessInfo(), codeHash: code }),
+      );
       return 0;
     }
     if (!values.out) return (console.error(`--out is required\n${USAGE}`), 64);

package/src/build/hashes.ts

@@ -1,61 +1,33 @@
-// Per-handler hashes: bundle each handler on its own with the contract files and the SDK external
-// (tree-shaken → function-level granularity; embedded scripts are bundle outputs too), then hash the
-// outputs. Contract changes are versioned through the manifest's model/step entries, SDK changes
-// through `harness`; both are combined in composeHandlerHash.
-import { dirname, join, relative, resolve } from 'node:path';
+// The build's code hash: everything the pipeline runs, bundled once with the SDK external (the
+// harness identity stands for it).
 import type { BunPlugin } from 'bun';
-import { isImplementation } from '../core/handlers.ts';
-import { originsOf } from '../core/origin.ts';
-import { pipelineData } from '../builder/pipeline.ts';
-import { allSteps } from '../harness/main.ts';
-import { composeHandlerHash, type HarnessInfo } from '../util/handler-hash.ts';
 import { sha256Hex } from '../util/hash.ts';
+import { composeCodeHash, type HarnessInfo } from '../util/code-hash.ts';
 import type { Project } from './project.ts';
 
-export interface HandlerHash {
-  /** Hash of the bundle outputs alone. */
-  bundleHash: string;
-  /** composeHandlerHash(bundleHash, harness) — what the manifest carries. */
-  handlerHash: string;
-  /** Bundle output names (for diagnostics). */
-  outputs: string[];
-}
+const sdkExternal: BunPlugin = {
+  name: 'olve-code-hash-external',
+  setup(b) {
+    b.onResolve({ filter: /^@olivervea\/pipelines(\/.*)?$/ }, (args) => ({
+      path: args.path,
+      external: true,
+    }));
+  },
+};
 
-function externals(project: Project): BunPlugin {
-  const contracts = new Set(project.contractFiles);
-  return {
-    name: 'olve-handler-hash-externals',
-    setup(b) {
-      b.onResolve({ filter: /^@olivervea\/pipelines(\/.*)?$/ }, (args) => ({
-        path: args.path,
-        external: true,
-      }));
-      b.onResolve({ filter: /^\.{1,2}\// }, (args) => {
-        const base = resolve(dirname(args.importer), args.path);
-        for (const cand of [base, `${base}.ts`, join(base, 'index.ts')])
-          if (contracts.has(cand)) return { path: args.path, external: true };
-        return undefined;
-      });
-    },
-  };
-}
-
-export async function bundleHash(
-  project: Project,
-  entry: string,
-): Promise<{ hash: string; outputs: string[] }> {
-  const inside = !relative(project.dir, entry).startsWith('..');
+async function bundleHash(project: Project): Promise<string> {
+  const entry = project.pipelineFile;
   const r = await Bun.build({
     entrypoints: [entry],
     target: 'bun',
     format: 'esm',
-    root: inside ? project.dir : dirname(entry),
+    root: project.dir,
     naming: {
       entry: '[dir]/[name].[ext]',
       chunk: '[dir]/[name].[ext]',
       asset: '[dir]/[name].[ext]',
     },
-    plugins: [externals(project)],
+    plugins: [sdkExternal],
     throw: false,
   });
   if (!r.success)
@@ -64,12 +36,10 @@ export async function bundleHash(
       `bundling ${entry} failed:\n${r.logs.map(String).join('\n')}`,
     );
   const parts: string[] = [];
-  const outputs: string[] = [];
   for (const o of [...r.outputs].sort((a, b) =>
     a.path < b.path ? -1 : a.path > b.path ? 1 : 0,
   )) {
     const name = o.path.replace(/^\.\//, '');
-    outputs.push(name);
     const bytes = new Uint8Array(await o.arrayBuffer());
     // Bun prefixes each module with a `// <path>` comment relative to the *process cwd*; drop those
     // so the hash depends only on code, not on where the repo or the build tool runs.
@@ -78,52 +48,9 @@ export async function bundleHash(
       : bytes;
     parts.push(`${name}\0${sha256Hex(content)}`);
   }
-  return { hash: 'sha256:' + sha256Hex(parts.join('\n')), outputs };
-}
-
-export async function handlerHashes(
-  project: Project,
-  harness: HarnessInfo,
-): Promise<Record<string, HandlerHash>> {
-  const out: Record<string, HandlerHash> = {};
-  for (const [name, file] of project.handlers) {
-    const b = await bundleHash(project, file);
-    out[name] = {
-      bundleHash: b.hash,
-      handlerHash: composeHandlerHash(b.hash, harness),
-      outputs: b.outputs,
-    };
-  }
-  return out;
+  return 'sha256:' + sha256Hex(parts.join('\n'));
 }
 
-/**
- * Kind → hash of the modules that implement the steps of that kind which carry their implementation
- * (each module bundled like a handler: the SDK and contract files external).
- */
-export async function kindHashes(
-  project: Project,
-  pipeline: unknown,
-): Promise<Record<string, string>> {
-  const origins = new Map<string, Set<string>>();
-  for (const s of allSteps(pipelineData(pipeline))) {
-    if (!isImplementation(s)) continue;
-    const files = originsOf(s).filter((f) => !project.contractFiles.includes(f));
-    if (files.length === 0)
-      throw new Error(
-        `step '${s.name}' carries its implementation but is defined in ${project.contractFiles.map((f) => relative(project.dir, f)).join(' or ')}; define and implement it in a module of its own (or a package)`,
-      );
-    const set = origins.get(s.kind) ?? new Set<string>();
-    for (const f of files) set.add(f);
-    origins.set(s.kind, set);
-  }
-  const out: Record<string, string> = {};
-  for (const [kind, files] of [...origins].sort(([a], [b]) =>
-    a < b ? -1 : a > b ? 1 : 0,
-  )) {
-    const parts: string[] = [];
-    for (const f of [...files].sort()) parts.push((await bundleHash(project, f)).hash);
-    out[kind] = 'sha256:' + sha256Hex(parts.join('\n'));
-  }
-  return out;
+export async function codeHash(project: Project, harness: HarnessInfo): Promise<string> {
+  return composeCodeHash(await bundleHash(project), harness);
 }

package/src/build/project.ts

@@ -1,19 +1,14 @@
 // Layout of a pipeline directory and the identity of the SDK building it.
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
-import { isImplementation } from '../core/handlers.ts';
 import { sha256Hex } from '../util/hash.ts';
-import type { HarnessInfo } from '../util/handler-hash.ts';
+import type { HarnessInfo } from '../util/code-hash.ts';
 
 export const SDK_ROOT = resolve(import.meta.dir, '../..');
 
 export interface Project {
   dir: string;
   pipelineFile: string;
-  /** Contract files (excluded from handler bundles): pipeline.ts, models.ts. */
-  contractFiles: string[];
-  /** step name → absolute handler file, sorted by step name. The step is the one the file's `implement(step, …)` names. */
-  handlers: [string, string][];
 }
 
 export class ProjectError extends Error {
@@ -24,35 +19,28 @@ export async function loadProject(dirArg: string): Promise<Project> {
   const dir = resolve(dirArg);
   if (!existsSync(dir) || !statSync(dir).isDirectory())
     throw new ProjectError(`${dirArg} is not a directory`);
-  const pipelineFile = join(dir, 'pipeline.ts');
-  if (!existsSync(pipelineFile))
+  return { dir, pipelineFile: entryOf(dirArg, dir) };
+}
+
+/** The file `main` in the package's package.json names. */
+function entryOf(dirArg: string, dir: string): string {
+  const pkg = join(dir, 'package.json');
+  const main = existsSync(pkg)
+    ? (JSON.parse(readFileSync(pkg, 'utf8')) as { main?: string }).main
+    : undefined;
+  if (!main)
     throw new ProjectError(
-      `${join(dirArg, 'pipeline.ts')} not found (it must default-export pipeline({...}))`,
+      `${join(dirArg, 'package.json')} must name the entry point in \`main\` (a file that default-exports pipeline({...}))`,
     );
-  const contractFiles = ['pipeline.ts', 'models.ts']
-    .map((f) => join(dir, f))
-    .filter((f) => existsSync(f));
-  const hdir = join(dir, 'handlers');
-  const files = existsSync(hdir)
-    ? readdirSync(hdir)
-        .filter(
-          (f) =>
-            f.endsWith('.ts') &&
-            !f.endsWith('.test.ts') &&
-            !f.endsWith('.d.ts') &&
-            statSync(join(hdir, f)).isFile(),
-        )
-        .sort()
-    : [];
-  return {
-    dir,
-    pipelineFile,
-    contractFiles,
-    handlers: await resolveHandlers(hdir, files),
-  };
+  const entry = join(dir, main);
+  if (!existsSync(entry))
+    throw new ProjectError(
+      `${join(dirArg, main)} not found (it must default-export pipeline({...}))`,
+    );
+  return entry;
 }
 
-/** The default export of pipeline.ts. */
+/** The default export of the entry point. */
 export async function loadPipeline(project: Project): Promise<unknown> {
   const mod = (await import(project.pipelineFile)) as { default?: unknown };
   if (!mod.default)
@@ -62,37 +50,6 @@ export async function loadPipeline(project: Project): Promise<unknown> {
   return mod.default;
 }
 
-/** Pairs each handler file with the step its default export implements (file names don't matter). */
-async function resolveHandlers(
-  hdir: string,
-  files: string[],
-): Promise<[string, string][]> {
-  const byStep = new Map<string, string>();
-  for (const f of files) {
-    const file = join(hdir, f);
-    let impl: unknown;
-    try {
-      impl = ((await import(file)) as { default?: unknown }).default;
-    } catch (e) {
-      throw new ProjectError(
-        `handlers/${f} failed to load: ${(e as Error)?.message ?? String(e)}`,
-      );
-    }
-    if (!isImplementation(impl))
-      throw new ProjectError(
-        `handlers/${f} must default-export implement(<step>, …); put shared code in a subfolder such as handlers/lib/`,
-      );
-    const step = (impl.step as { name: string }).name;
-    const other = byStep.get(step);
-    if (other)
-      throw new ProjectError(
-        `handlers/${other.slice(hdir.length + 1)} and handlers/${f} both implement step '${step}'`,
-      );
-    byStep.set(step, file);
-  }
-  return [...byStep].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
-}
-
 function listFiles(dir: string): string[] {
   const out: string[] = [];
   for (const e of readdirSync(dir, { withFileTypes: true })) {

package/src/builder/pipeline.ts

@@ -314,7 +314,7 @@ export function pipelineData(p: unknown): PipelineData {
       : undefined;
   if (!d)
     throw new TypeError(
-      'not a pipeline (pipeline.ts must default-export pipeline({...})...)',
+      'not a pipeline (the entry point must default-export pipeline({...})...)',
     );
   return d as PipelineData;
 }
@@ -553,7 +553,7 @@ export class Pipeline<In extends AnyModel, A extends AvailMap> {
   }
 }
 
-/** Start a pipeline definition. `pipeline.ts` must default-export the result. */
+/** Start a pipeline definition. The entry point must default-export the result. */
 export function pipeline<In extends AnyModel>(
   def: PipelineDef<In>,
 ): Pipeline<In, InitialAvail<In>> {

package/src/core/brands.ts

@@ -2,7 +2,6 @@
 // a dev runner and the user's installed package — still recognise each other's objects.
 export const STEP = Symbol.for('olve.pipelines.step');
 export const IMPLEMENTATION = Symbol.for('olve.pipelines.implementation');
-export const ORIGIN = Symbol.for('olve.pipelines.origin');
 export const SKIPPED = Symbol.for('olve.pipelines.skipped');
 export const PIPELINE = Symbol.for('olve.pipelines.pipeline');
 export const REF_PATH = Symbol.for('olve.pipelines.refPath');

package/src/core/handlers.ts

@@ -1,12 +1,10 @@
 import {
   IMPLEMENTATION,
-  ORIGIN,
   SKIPPED,
   type ImplementationBrand,
   type SkippedBrand,
 } from './brands.ts';
 import type { Ctx } from '../ctx/types.ts';
-import { callerFile, originsOf } from './origin.ts';
 import type { AnyStep, ConfigOf, OutputValue, SecretsOf, StepInput } from './steps.ts';
 import type { Awaitable } from './types.ts';
 
@@ -32,7 +30,7 @@ export type Handler<S extends AnyStep> = (
   ctx: Ctx<SecretsOf<S>, ConfigOf<S>>,
 ) => Awaitable<HandlerResult<S>>;
 
-/** A step with its handler. It is itself a step: stage it directly, or default-export it from `handlers/*.ts`. */
+/** A step with its handler. It is itself a step: stage it like any value. */
 export type Implementation<S extends AnyStep = AnyStep> = S & {
   readonly [ImplementationBrand]: true;
   /** The step as defined. */
@@ -50,8 +48,8 @@ type NoExtraFields<R, T> = R extends Skipped | void
     };
 
 /**
- * Implement a step. Input, ctx and return types come from the step definition alone. Default-export
- * the result from a `handlers/*.ts` file, or stage it directly (a reusable step: give it a `kind`).
+ * Implement a step. Input, ctx and return types come from the step definition alone. Stage the
+ * result directly; a reusable step gives itself a `kind`.
  */
 export function implement<S extends AnyStep, R extends HandlerResult<S>>(
   step: S &
@@ -67,15 +65,9 @@ export function implement<S extends AnyStep, R extends HandlerResult<S>>(
     throw new TypeError(
       `step '${(step as AnyStep).name}' already carries its implementation`,
     );
-  const origins = [
-    ...new Set(
-      [...originsOf(step), callerFile()].filter((f): f is string => f !== undefined),
-    ),
-  ];
   return Object.freeze({
     ...step,
     [IMPLEMENTATION]: true,
-    [ORIGIN]: origins,
     step,
     handler: handler as unknown as Handler<S>,
   }) as unknown as Implementation<S>;

package/src/core/steps.ts

@@ -1,6 +1,5 @@
 import type { z } from 'zod';
-import { ORIGIN, STEP, type StepBrand } from './brands.ts';
-import { callerFile } from './origin.ts';
+import { STEP, type StepBrand } from './brands.ts';
 import type { AnyModel, Infer, Optional } from './models.ts';
 import type { External } from './external.ts';
 import type { AnyConfigEntry } from './config.ts';
@@ -29,8 +28,7 @@ export type InferEntry<E> =
 export type StepInput<I> = Simplify<{ -readonly [K in keyof I]: InferEntry<I[K]> }>;
 
 /**
- * A label for what a step is, shown in the UI. `custom` (the default) is a step whose handler is in
- * `handlers/`; a step that carries its implementation (`implement(step, …)` staged directly) names its
+ * A label for what a step is, shown in the UI. `custom` is the default; a reusable step names its
  * kind, e.g. `gitHubSource`. Packages prefix theirs (`acme/deploy`).
  */
 export type StepKind = string;
@@ -113,7 +111,7 @@ export interface StepDef<
   settings?: Readonly<Record<string, unknown>>;
 }
 
-function makeStep(def: Record<string, unknown>, origin: string | undefined): AnyStep {
+function makeStep(def: Record<string, unknown>): AnyStep {
   const config = new Map<string, AnyConfigEntry>();
   for (const e of (def.config as readonly AnyConfigEntry[] | undefined) ?? [])
     if (!config.has(e.name)) config.set(e.name, e);
@@ -132,7 +130,6 @@ function makeStep(def: Record<string, unknown>, origin: string | undefined): Any
     ...(def.retries !== undefined ? { retries: def.retries } : {}),
     ...(def.clusterAccess === true ? { clusterAccess: true } : {}),
     ...(def.settings !== undefined ? { settings: def.settings } : {}),
-    [ORIGIN]: origin === undefined ? [] : [origin],
   };
   return Object.freeze(s) as unknown as AnyStep;
 }
@@ -144,8 +141,8 @@ export function isStep(v: unknown): v is AnyStep {
 }
 
 /**
- * Define a step: a contract (name, image, inputs, output, secrets). Its handler is a `handlers/*.ts`
- * default-exporting `implement(step, …)`, or, for a reusable step, `implement(step, …)` staged directly.
+ * Define a step: a contract (name, image, inputs, output, secrets). `implement(step, fn)` gives it
+ * its handler; that is what a pipeline stages.
  */
 export function step<
   const N extends string,
@@ -154,5 +151,5 @@ export function step<
   const Sec extends readonly Secret[] = [],
   const Cfg extends readonly AnyConfigEntry[] = [],
 >(def: StepDef<N, I, O, Sec, Cfg>): Step<N, I, O, Sec[number]['name'], Cfg[number]> {
-  return makeStep(def as never, callerFile()) as never;
+  return makeStep(def as never) as never;
 }

package/src/describe/describe.ts

@@ -1,5 +1,4 @@
-// `describe`: evaluates the contracts (models + pipeline, never handlers) into the manifest and runs
-// every describe-time check. All problems are collected and reported together.
+// `describe`: evaluates the pipeline into the manifest and runs every describe-time check. All problems are collected and reported together.
 import { z } from 'zod';
 import { CONFIG_NAME, isConfigEntry, SECRET_REF_KIND } from '../core/config.ts';
 import { CONFIG_CASE_KEY, CONFIG_REF_KEY } from '../core/config-refs.ts';
@@ -18,7 +17,7 @@ import {
 } from '../builder/pipeline.ts';
 import { FailureContext } from '../library/models.ts';
 import { canonicalize, canonicalJson } from '../util/canonical.ts';
-import { libraryHandlerHash, type HarnessInfo } from '../util/handler-hash.ts';
+import type { HarnessInfo } from '../util/code-hash.ts';
 import { analyzeMapperSource } from './mapper-source.ts';
 import { MapperError, recordMapper, type Mapping } from './record.ts';
 import {
@@ -41,12 +40,8 @@ export class DescribeError extends Error {
 }
 
 export interface DescribeOptions {
-  /** Step names that have a handler (a `handlers/*.ts` default-exporting `implement(step, …)`). */
-  handlerNames: Iterable<string>;
-  /** Step name → handler hash (from the build; includes the harness identity). */
-  handlerHashes: Readonly<Record<string, string>>;
-  /** Kind → hash of the code that implements the steps of that kind which carry their implementation (from the build). */
-  kindHashes?: Readonly<Record<string, string>>;
+  /** Hash of the build (from the build; includes the harness identity). */
+  codeHash?: string;
   harness: HarnessInfo;
 }
 
@@ -129,7 +124,6 @@ function literalValues(field: JsonSchema | undefined): unknown[] | undefined {
 export function describePipeline(pipeline: unknown, opts: DescribeOptions): ManifestT {
   const data = pipelineData(pipeline);
   const problems: string[] = [...data.problems];
-  const handlerNames = new Set(opts.handlerNames);
 
   // ── models ──
   const models = new Map<string, { schemas: ModelSchemasT; key: string }>();
@@ -232,20 +226,10 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
     const prev = placements.get(s.name) ?? [];
     if (prev.some((p) => !exclusive(p.cases, cases)))
       problems.push(`duplicate step name '${s.name}'`);
-    else if (prev.length) {
-      if (
-        prev.some(
-          (p) => p.step !== s && !isImplementation(p.step) && !isImplementation(s),
-        )
-      )
-        problems.push(
-          `step '${s.name}': two different steps with handler files share the name across select cases; handlers pair by name, so use one step or different names`,
-        );
-      if (prev.some((p) => (p.step.output?.name ?? null) !== (s.output?.name ?? null)))
-        problems.push(
-          `step '${s.name}': its select cases must give it the same output model`,
-        );
-    }
+    else if (prev.some((p) => (p.step.output?.name ?? null) !== (s.output?.name ?? null)))
+      problems.push(
+        `step '${s.name}': its select cases must give it the same output model`,
+      );
     placements.set(s.name, [...prev, { step: s, cases }]);
     if (!steps.has(s.name)) steps.set(s.name, s);
   };
@@ -439,15 +423,10 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
             `${at}: config '${name}' references secret '${ref}' (secretRef), so the step must declare it in secrets`,
           );
     }
-    let handlerHash: string;
     if (settingsProblem !== undefined)
       problems.push(`${at}: invalid ${s.kind} settings (${settingsProblem})`);
     if (typeof s.kind !== 'string' || s.kind === '')
       problems.push(`${at}: kind must be a non-empty string`);
-    if (carried && s.kind === 'custom')
-      problems.push(
-        `${at} carries its implementation, so it needs a kind (step({ kind: "…", … })); a step with kind custom has its handler in handlers/`,
-      );
     for (const { ref, case: kase } of refs) {
       const [entry, ...path] = ref.split('.') as [string, ...string[]];
       if (kase !== undefined && !cases.some((c) => c.cond === kase))
@@ -463,20 +442,8 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
           `${at}: config reference '${ref}': config '${entry}' has no field '${path.join('.')}'`,
         );
     }
-    if (carried) {
-      const code = opts.kindHashes?.[s.kind];
-      if (opts.kindHashes && !code)
-        problems.push(`${at}: no hash was computed for the code of kind '${s.kind}'`);
-      handlerHash = libraryHandlerHash(s.kind, settings, opts.harness, code);
-    } else {
-      if (!handlerNames.has(s.name))
-        problems.push(
-          `${at} has no handler (add a handlers/*.ts default-exporting implement(${camel(s.name)}, …))`,
-        );
-      handlerHash = opts.handlerHashes[s.name] ?? '';
-      if (handlerNames.has(s.name) && !handlerHash)
-        problems.push(`${at}: no handler hash was computed`);
-    }
+    if (!carried)
+      problems.push(`${at} has no implementation (stage implement(step({...}), fn))`);
     if (typeof s.description !== 'string')
       problems.push(`${at}: description must be a string (it may be empty)`);
     if (
@@ -496,7 +463,6 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
       input,
       output: s.output ? useModel(s.output, `${at} output`) : null,
       secrets: secretNames,
-      handlerHash: handlerHash || 'sha256:' + '0'.repeat(64),
       ...(s.timeoutSeconds !== undefined ? { timeoutSeconds: s.timeoutSeconds } : {}),
       ...(s.retries !== undefined ? { retries: s.retries } : {}),
       ...(settings !== undefined
@@ -737,17 +703,6 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
     })
     .filter((x) => x !== undefined);
 
-  // ── handlers without a step ──
-  for (const h of handlerNames) {
-    const s = steps.get(h);
-    if (!s)
-      problems.push(`a handler implements step '${h}', which is not in the pipeline`);
-    else if (isImplementation(s))
-      problems.push(
-        `a handler implements '${h}', a ${s.kind} step that carries its own implementation`,
-      );
-  }
-
   // ── triggers ──
   const triggerNames = new Set<string>();
   const triggers: TriggerT[] = data.triggers.map((t) => {
@@ -818,6 +773,7 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
     input: inputModel.name,
     ...(Object.keys(retention).length ? { retention } : {}),
     harness: opts.harness,
+    codeHash: opts.codeHash ?? 'sha256:' + '0'.repeat(64),
     models: Object.fromEntries([...models].map(([k, v]) => [k, v.schemas])),
     secrets: [...secrets]
       .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
@@ -948,7 +904,3 @@ interface CaseOf {
   value: string;
   cond: string;
 }
-
-function camel(name: string): string {
-  return name.replace(/-([a-z0-9])/g, (_, c: string) => c.toUpperCase());
-}

package/src/describe/manifest-schema.ts

@@ -94,9 +94,7 @@ export const StepDescriptor = z
     kind: z
       .string()
       .min(1)
-      .describe(
-        "'custom' = the handler is a handlers/*.ts file; any other kind is a step that carries its implementation (an SDK or package step). A label: the service accepts any kind.",
-      ),
+      .describe("A label for the step's kind: 'custom' unless the step names one."),
     image: z.string().min(1).describe('Container image the step runs in.'),
     inputTypes: z
       .record(z.string(), InputType)
@@ -114,16 +112,13 @@ export const StepDescriptor = z
       .describe(
         'Declared secrets (sorted). Mount exactly these, as env vars of the same name.',
       ),
-    handlerHash: hash.describe(
-      'Implementation identity: handler bundle (contract files excluded) + harness (bun + sdkHash); for a step that carries its implementation kind + config + harness + the hash of the code of its kind.',
-    ),
     timeoutSeconds: z.number().int().positive().optional(),
     retries: z.number().int().nonnegative().optional(),
     config: z
       .record(z.string(), Json)
       .optional()
       .describe(
-        'The step\'s settings (display only; already covered by handlerHash). A config reference is recorded as {"$config": "<entry>.<field>…"}; the entry is in configEntries.',
+        'The step\'s settings (display only). A config reference is recorded as {"$config": "<entry>.<field>…"}; the entry is in configEntries.',
       ),
     configEntries: z
       .array(configName)
@@ -276,7 +271,10 @@ export const Manifest = z
         sdk: z.string().describe('@olivervea/pipelines package version.'),
         sdkHash: hash.describe('Hash of the SDK runtime sources + zod version.'),
       })
-      .describe('Harness identity. Already folded into every handlerHash.'),
+      .describe('Harness identity. Already folded into codeHash.'),
+    codeHash: hash.describe(
+      'Hash of the whole build: the pipeline and its code bundled, plus the harness. Any code change makes a new pipeline version.',
+    ),
     models: z
       .record(modelName, ModelSchemas)
       .describe('Every model referenced by the pipeline (input, step inputs/outputs).'),

package/src/dev/cli.ts

@@ -15,7 +15,7 @@ import { join, resolve } from 'node:path';
 import { parseArgs } from 'node:util';
 import { runHarness, type HarnessConfig } from '../harness/main.ts';
 import { EXIT } from '../harness/exit.ts';
-import { handlerHashes, kindHashes } from '../build/hashes.ts';
+import { codeHash } from '../build/hashes.ts';
 import {
   harnessInfo,
   loadPipeline,
@@ -34,19 +34,9 @@ export async function devConfig(
   const project = await loadProject(dir);
   const pipeline = await loadPipeline(project);
   const harness = harnessInfo();
-  const hashes = withHashes ? await handlerHashes(project, harness) : {};
   return {
     pipeline,
-    handlers: Object.fromEntries(
-      project.handlers.map(([name, file]) => [
-        name,
-        () => import(file) as Promise<{ default: unknown }>,
-      ]),
-    ),
-    handlerHashes: Object.fromEntries(
-      Object.entries(hashes).map(([k, v]) => [k, v.handlerHash]),
-    ),
-    ...(withHashes ? { kindHashes: await kindHashes(project, pipeline) } : {}),
+    ...(withHashes ? { codeHash: await codeHash(project, harness) } : {}),
     harness,
   };
 }

package/src/harness/exit.ts

@@ -11,7 +11,7 @@ export const EXIT = {
   outputInvalid: 66,
   /** Uploading result.tar.gz to OLVE_RESULT_URL failed (after retries). The envelope was still printed. */
   uploadFailed: 74,
-  /** The pipeline is invalid: describe problems, missing/invalid handler module. */
+  /** The pipeline is invalid: describe problems, a step without an implementation. */
   configInvalid: 78,
   /** Cancelled by SIGINT / SIGTERM (128 + signal). */
   sigint: 130,

package/src/harness/index.ts

@@ -5,7 +5,6 @@ export {
   allSteps,
   resolveStepFunction,
   type HarnessConfig,
-  type HandlerRegistry,
   type HarnessIO,
 } from './main.ts';
 export { EXIT } from './exit.ts';
@@ -19,4 +18,4 @@ export {
 export { RESULT_BEGIN, RESULT_END, MANIFEST_BEGIN, MANIFEST_END } from './result.ts';
 export { describePipeline, DescribeError, manifestText } from '../describe/describe.ts';
 export type { ManifestT as Manifest } from '../describe/manifest-schema.ts';
-export type { HarnessInfo } from '../util/handler-hash.ts';
+export type { HarnessInfo } from '../util/code-hash.ts';

package/src/harness/main.ts

@@ -11,7 +11,7 @@ import type { WebhookEvent } from '../core/webhooks.ts';
 import { pipelineData, type PipelineData, type StageNode } from '../builder/pipeline.ts';
 import { createCtx, formatLog } from '../ctx/index.ts';
 import { DescribeError, describePipeline, manifestText } from '../describe/describe.ts';
-import type { HarnessInfo } from '../util/handler-hash.ts';
+import type { HarnessInfo } from '../util/code-hash.ts';
 import { callbackUrlsFromEnv, ENV, paths, runInfoFromEnv } from './env.ts';
 import { EXIT } from './exit.ts';
 import {
@@ -31,18 +31,11 @@ import {
 } from './result.ts';
 import { formatIssues, parseStrict } from './validate.ts';
 
-/** step name → lazy import of `handlers/<name>.ts`. Literal import() paths so Bun bundles them. */
-export type HandlerRegistry = Readonly<
-  Record<string, () => Promise<{ default: unknown }>>
->;
-
 export interface HarnessConfig {
-  /** Default export of pipeline.ts. */
+  /** Default export of the entry point. */
   pipeline: unknown;
-  handlers: HandlerRegistry;
-  handlerHashes: Readonly<Record<string, string>>;
-  /** Kind → hash of the code of the steps of that kind that carry their implementation. */
-  kindHashes?: Readonly<Record<string, string>>;
+  /** Hash of the build (from the build; includes the harness identity). */
+  codeHash?: string;
   harness: HarnessInfo;
 }
 
@@ -130,26 +123,10 @@ export function cancellation(): { signal: AbortSignal; dispose(): void } {
   };
 }
 
-/** Resolves the function that implements `step` (carried by the step, or a handler module). */
-export async function resolveStepFunction(
-  step: AnyStep,
-  handlers: HandlerRegistry,
-): Promise<StepFunction | string> {
+/** The function `step` carries, or what is wrong. */
+export function resolveStepFunction(step: AnyStep): StepFunction | string {
   if (isImplementation(step)) return step.handler as unknown as StepFunction;
-  const load = handlers[step.name];
-  if (!load) return `step '${step.name}' has no handler`;
-  let mod: { default: unknown };
-  try {
-    mod = await load();
-  } catch (e) {
-    return `the handler of step '${step.name}' failed to load: ${(e as Error)?.stack ?? String(e)}`;
-  }
-  const impl = mod.default;
-  if (!isImplementation(impl))
-    return `the handler of step '${step.name}' must default-export implement(<step '${step.name}'>, …)`;
-  if (impl.step !== step)
-    return `the handler of step '${step.name}' implements a different step object (it must be implement(<the '${step.name}' step from pipeline.ts>, …))`;
-  return impl.handler as unknown as StepFunction;
+  return `step '${step.name}' has no implementation (stage implement(step({...}), fn))`;
 }
 
 /** Writes output.json, prints the sentinel block and uploads result.tar.gz when OLVE_RESULT_URL is set. */
@@ -190,9 +167,7 @@ async function describeMode(
   try {
     const text = manifestText(
       describePipeline(cfg.pipeline, {
-        handlerNames: Object.keys(cfg.handlers),
-        handlerHashes: cfg.handlerHashes,
-        kindHashes: cfg.kindHashes,
+        codeHash: cfg.codeHash,
         harness: cfg.harness,
       }),
     );
@@ -216,7 +191,7 @@ async function runMode(
   const data = pipelineData(cfg.pipeline);
   const step = findStep(data, name, selectedCases());
   if (typeof step === 'string') return (io.stderr(step), EXIT.usage);
-  const fn = await resolveStepFunction(step, cfg.handlers);
+  const fn = resolveStepFunction(step);
   if (typeof fn === 'string') return (io.stderr(fn), EXIT.configInvalid);
 
   const p = paths();

package/src/testing/index.ts

@@ -46,7 +46,7 @@ export type TestResult<S extends AnyStep> = {
 );
 
 /**
- * Runs an implementation (a handler module's default export, or a step that carries its own) with `input`.
+ * Runs a step that carries its implementation with `input`.
  * Input is validated like `input.json`, the result like a real run: an invalid output gives
  * `{ status: "failed", error: { kind: "output" } }`, a throwing handler `kind: "handler"`.
  */
@@ -57,7 +57,7 @@ export async function testHandler<S extends AnyStep>(
 ): Promise<TestResult<S>> {
   if (!isImplementation(target))
     throw new TypeError(
-      "testHandler expects implement(…): a handler module's default export or a step that carries its implementation",
+      'testHandler expects implement(…): a step that carries its implementation',
     );
   const step: AnyStep = target.step;
   const fn = target.handler as unknown as StepFunction;

package/src/util/code-hash.ts

@@ -0,0 +1,17 @@
+import { canonicalJson } from './canonical.ts';
+import { sha256Hex } from './hash.ts';
+
+/** Identity of the harness compiled into a binary. */
+export interface HarnessInfo {
+  /** Bun version (runtime compiled into the binary). */
+  bun: string;
+  /** @olivervea/pipelines package version. */
+  sdk: string;
+  /** `sha256:` hash over the SDK runtime sources and the zod version. */
+  sdkHash: string;
+}
+
+/** The hash of a whole build: its code bundled with the SDK external, combined with the harness. */
+export function composeCodeHash(bundleHash: string, harness: HarnessInfo): string {
+  return 'sha256:' + sha256Hex(canonicalJson({ bundle: bundleHash, harness }));
+}

package/src/core/origin.ts

@@ -1,23 +0,0 @@
-import { ORIGIN } from './brands.ts';
-
-/**
- * The file that called the function calling this one, from the stack. A tail call drops its caller's
- * frame, so this can name a module further up; the build only uses it to choose what to hash.
- */
-export function callerFile(): string | undefined {
-  const files = (new Error().stack ?? '')
-    .split('\n')
-    .slice(1)
-    .map((f) => f.match(FRAME)?.[1]);
-  const own = files[0];
-  const callee = files[1];
-  const file = files.slice(2).find((f) => f && f !== own && f !== callee) ?? undefined;
-  return file?.startsWith('file://') ? new URL(file).pathname : file;
-}
-const FRAME = /\(?((?:file:\/\/)?\/[^()]*?):\d+(?::\d+)?\)?\s*$/;
-
-/** The modules that defined and implemented a step (where `step` and `implement` were called). */
-export function originsOf(v: unknown): string[] {
-  const o = (v as Record<symbol, unknown>)[ORIGIN];
-  return Array.isArray(o) ? o.filter((x): x is string => typeof x === 'string') : [];
-}

package/src/util/handler-hash.ts

@@ -1,32 +0,0 @@
-import { canonicalJson } from './canonical.ts';
-import { sha256Hex } from './hash.ts';
-
-/** Identity of the harness compiled into a binary. A Bun or SDK bump legitimately bumps every handler. */
-export interface HarnessInfo {
-  /** Bun version (runtime compiled into the binary). */
-  bun: string;
-  /** @olivervea/pipelines package version. */
-  sdk: string;
-  /** `sha256:` hash over the SDK runtime sources and the zod version. */
-  sdkHash: string;
-}
-
-/** Custom step: hash of the handler bundle (contract files + SDK external) combined with the harness. */
-export function composeHandlerHash(bundleHash: string, harness: HarnessInfo): string {
-  return 'sha256:' + sha256Hex(canonicalJson({ bundle: bundleHash, harness }));
-}
-
-/** A step that carries its implementation: kind + canonical settings + harness, and the hash of the code that implements the kind. */
-export function libraryHandlerHash(
-  kind: string,
-  config: unknown,
-  harness: HarnessInfo,
-  code?: string,
-): string {
-  return (
-    'sha256:' +
-    sha256Hex(
-      canonicalJson({ library: kind, config, harness, ...(code ? { code } : {}) }),
-    )
-  );
-}