@olivervea/pipelines 2.0.0-beta.24 → 2.0.0-beta.26

package/README.md

@@ -141,7 +141,7 @@ Library steps carry their own implementation and image; they take typed settings
 | `steps.gitHubSource` | `alpine:3.22` (work happens in the harness) | `{ repo: "owner/name", sha }` (plain schemas: needs a mapper) → `Source` | `token?: Secret` (sent as `Authorization: Bearer` when set; unset = anonymous; becomes the step's secret), `apiUrl?` (default `https://api.github.com`) |
 | `steps.imageBuild` | `gcr.io/kaniko-project/executor:v1.24.0-debug`, pinned by digest | `{ source: Source }` → `BuiltImage { repository, tag, digest, tar }`; with `push`: `PushedImage { repository, tag, digest, cached }` | `repository` (image name; tag = run version, `-attempt<n>` on reruns), `context?` (dir in the source tree with the `Dockerfile`; default the root), `push?` (push to `repository` instead of a tarball), `contentTag?` (with `push`: tag `src-<hash>` of the context and the build recipe; skip when the registry has it, with `cached: true`), `registryMap?` (kaniko `--registry-map`: registry → mirror prefix; default none), `stallTimeoutSeconds?` (default 300, 0 = off), `retries?` (default 2), `registryAuth?` (`{ username, password: Secret }`: log in to the `repository` registry; or a config reference to `{ username, password: { secret: NAME } }`, with `NAME` in `secrets`), `insecureRegistry?` (that registry is plain HTTP), `secrets?` (declared secrets a config `registryAuth` may name), `enabled?` (`false` skips the step) |
 | `steps.helmDeployOverSsh` | `alpine:3.22` (+ `apk add openssh-client` at run time) | `{ source: Source, <key>: BuiltImage }` per `images` (`PushedImage` with `fromRegistry`) → `HelmRelease { release, namespace, image? }` (`image`: the first image; absent without images) | `host` (`user@host`), `sshKey: Secret`, `release`, `namespace`, `chart` (dir in the source), `values?` (chart-relative `-f`), `set?`, `images?` (input key → values prefix; default `{ image: "image" }`; `{}` = the chart alone), `fromRegistry?`, `imageRefs?` (`PushedImage` input key → values prefix: set as `<prefix>.repository`/`.tag`/`.digest`, not pulled; works next to tarball `images`), `deployments?` (default `[release]`, none without images), `rolloutTimeoutSeconds?` (default 120), `dependencies?` (pull `Chart.yaml`'s dependencies on the host), `helmWait?` / `atomic?` (`helm --wait` / `--atomic`), `healthUrl?` (URL or `{ url, attempts?, delaySeconds? }`) |
-| `steps.helmDeployInCluster` (and the `target` form of `helmDeployOverSsh`) | `alpine/helm:3.16.2` (ssh: `alpine:3.22`) | `{ source: Source, <key>: PushedImage }` per `images`, `<key>: optional(PushedImage)` per `imageRefs` → `HelmRelease` (`image`: `repository:tag@digest` of the first image) | `target` (a `select` case's reference to a `helmTarget()` variant: `{ kind: "inCluster", namespace, release, values, set, url? }` for helmDeployInCluster, the same plus `host` with `kind: "ssh"` for helmDeployOverSsh; `url` is where step pods reach the release, default its in-cluster Service URL, and is passed on in `HelmRelease.url`), `sshKey: Secret` (ssh only), `chart`, `inlineValues?` (objects written as values files after the target's), `images?`, `imageRefs?`, `deployments?` (ssh), `rolloutTimeoutSeconds?` (default 120), `healthPath?`; helmDeployInCluster declares `clusterAccess` |
+| `steps.helmDeployInCluster` (and the `target` form of `helmDeployOverSsh`) | `alpine/helm:3.16.2` (ssh: `alpine:3.22`) | `{ source: Source, <key>: PushedImage }` per `images`, `<key>: optional(PushedImage)` per `imageRefs` → `HelmRelease` (`image`: `repository:tag@digest` of the first image) | `target` (a `select` case's reference to a `helmTarget()` variant: `{ kind: "inCluster", namespace, release, values, set, url? }` for helmDeployInCluster, the same plus `host` with `kind: "ssh"` for helmDeployOverSsh; `url` is where step pods reach the release, default its in-cluster Service URL, and is passed on in `HelmRelease.url`), `sshKey: Secret` (ssh only), `chart`, `inlineValues?` (objects written as values files after the target's; a resolved `secretRef`, `{ secret: NAME }`, becomes that secret's value, and the file holding it is deleted after the upgrade), `secrets?` (the secrets those `secretRef`s name; the step declares them), `images?`, `imageRefs?`, `deployments?` (ssh), `rolloutTimeoutSeconds?` (default 120), `healthPath?`; helmDeployInCluster declares `clusterAccess` |
 | `steps.composeDeploy` | `alpine:3.22` (work happens in the harness) | `{ image: PushedImage }` → `HelmRelease { release: <service>, namespace: "compose", image: <repository>@<digest> }` | `target` (a `select` case's reference to the compose variant of `deployTarget()`: `{ kind: "compose", deployerUrl, service, token: { secret }, healthUrl? }`), `token: Secret` (must be the secret the target names; the step's only secret), `timeoutSeconds?` |
 
 - `gitHubSource` downloads `<apiUrl>/repos/<repo>/tarball/<sha>` (retrying 5xx), strips the top-level directory and outputs it as `tree`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@olivervea/pipelines",
-  "version": "2.0.0-beta.24",
+  "version": "2.0.0-beta.26",
   "description": "Olve.Pipelines v2 SDK: typed pipeline authoring, the step harness, and the build tool.",
   "type": "module",
   "license": "MIT",

package/src/build/build.ts

@@ -6,7 +6,7 @@ import { sha256File } from '../util/hash.ts';
 import type { HarnessInfo } from '../util/code-hash.ts';
 import { writeTarZst } from '../util/tar.ts';
 import { MANIFEST_BEGIN, MANIFEST_END, uploadFile } from '../harness/result.ts';
-import { GLIBC_INTERP, MUSL_INTERP, readInterpreter } from './elf.ts';
+import { loaderProblem } from './elf.ts';
 import { codeHash } from './hashes.ts';
 import { harnessInfo, loadProject, relPosix, type Project } from './project.ts';
 
@@ -112,14 +112,9 @@ export async function build(dir: string, opts: BuildOptions): Promise<BuildResul
     `olve-build: compiled ${target} in ${((performance.now() - t1) / 1000).toFixed(2)}s`,
   );
 
-  // 2. loader check: the harness launches the binary through /olve/lib/<loader>; a musl binary
-  //    (e.g. compiled on alpine, where bun-linux-x64 silently yields musl) would not start.
-  const expected = target === 'bun-linux-x64' ? GLIBC_INTERP : MUSL_INTERP;
-  const interp = readInterpreter(binary);
-  if (interp !== expected)
-    throw new BuildError(
-      `compiled binary has PT_INTERP ${interp ?? '(none)'}, expected ${expected} — compile on a glibc Bun image (oven/bun:<version>-slim), not alpine`,
-    );
+  // 2. loader check: on alpine, bun-linux-x64 silently yields a musl binary, which would not start.
+  const problem = loaderProblem(binary, target);
+  if (problem) throw new BuildError(problem);
 
   // 3. describe (runs the real binary: the manifest is exactly what the step pods will see)
   const d = Bun.spawnSync([binary, 'describe'], {

package/src/build/elf.ts

@@ -34,3 +34,11 @@ export function readInterpreter(path: string): string | null {
     closeSync(fd);
   }
 }
+
+/** Why `binary` won't start through `target`'s loader (the harness runs it via /olve/lib/<loader>), or undefined. */
+export function loaderProblem(binary: string, target: string): string | undefined {
+  const expected = target === 'bun-linux-x64' ? GLIBC_INTERP : MUSL_INTERP;
+  const interp = readInterpreter(binary);
+  if (interp === expected) return undefined;
+  return `compiled binary has PT_INTERP ${interp ?? '(none)'}, expected ${expected} — compile on a glibc Bun image (oven/bun:<version>-slim), not alpine`;
+}

package/src/ctx/files.ts

@@ -37,6 +37,8 @@ export interface FilesDeps {
   root: string;
   signal: AbortSignal;
   log: (message: string, fields?: Record<string, unknown>) => void;
+  /** Backoff between download retries (default: real sleep). */
+  sleep?: (ms: number) => Promise<void>;
 }
 
 function checkName(name: string, what: string): void {
@@ -122,6 +124,7 @@ async function download(
   headers: Record<string, string>,
   signal: AbortSignal,
   log: FilesDeps['log'],
+  sleep: (ms: number) => Promise<void>,
 ): Promise<void> {
   const attempts = 4;
   for (let i = 1; ; i++) {
@@ -143,13 +146,14 @@ async function download(
         attempt: i,
         error: (e as Error).message,
       });
-      await Bun.sleep(1000 * 2 ** (i - 1));
+      await sleep(1000 * 2 ** (i - 1));
     }
   }
 }
 
 export function createFetch(deps: FilesDeps) {
   const cache = new Map<string, string>();
+  const sleep = deps.sleep ?? ((ms: number) => Bun.sleep(ms));
   return async (input: FileRef): Promise<string> => {
     const parsed = fileRefSchema.safeParse(input);
     if (!parsed.success)
@@ -181,7 +185,8 @@ export function createFetch(deps: FilesDeps) {
     const baseUrl = process.env[ENV.filesBaseUrl];
     if (own && existsSync(join(deps.workFiles, obj)))
       copyFileSync(join(deps.workFiles, obj), objFile);
-    else if (urls[key]) await download(urls[key], objFile, {}, deps.signal, deps.log);
+    else if (urls[key])
+      await download(urls[key], objFile, {}, deps.signal, deps.log, sleep);
     else if (
       localDir &&
       existsSync(
@@ -201,6 +206,7 @@ export function createFetch(deps: FilesDeps) {
         token ? { authorization: `Bearer ${token}` } : {},
         deps.signal,
         deps.log,
+        sleep,
       );
     } else {
       throw new Error(

package/src/ctx/index.ts

@@ -89,9 +89,25 @@ export function createHttp(signal: AbortSignal): Http {
   };
 }
 
+/** Waits `ms`, or rejects at once when the step is cancelled. */
+function cancellableSleep(ms: number, signal: AbortSignal): Promise<void> {
+  return new Promise<void>((res, rej) => {
+    const t = setTimeout(() => {
+      signal.removeEventListener('abort', onAbort);
+      res();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(t);
+      rej(new Error('retry cancelled: the step was cancelled'));
+    };
+    signal.addEventListener('abort', onAbort, { once: true });
+  });
+}
+
 export function createRetry(
   signal: AbortSignal,
   log: (m: string, f?: Record<string, unknown>) => void,
+  sleep: (ms: number, signal: AbortSignal) => Promise<void> = cancellableSleep,
 ) {
   return async <T>(
     opts: RetryOptions,
@@ -110,17 +126,7 @@ export function createRetry(
           of: opts.attempts,
           error: (e as Error)?.message ?? String(e),
         });
-        await new Promise<void>((res, rej) => {
-          const t = setTimeout(() => {
-            signal.removeEventListener('abort', onAbort);
-            res();
-          }, delay);
-          const onAbort = () => {
-            clearTimeout(t);
-            rej(new Error('retry cancelled: the step was cancelled'));
-          };
-          signal.addEventListener('abort', onAbort, { once: true });
-        });
+        await sleep(delay, signal);
         delay *= opts.backoff ?? 1;
       }
     }

package/src/describe/describe.ts

@@ -806,7 +806,7 @@ export function describePipeline(pipeline: unknown, opts: DescribeOptions): Mani
 export const manifestText = (m: ManifestT): string => canonicalJson(m);
 
 /**
- * The schemas at `path` inside an entry's schema: every union branch that has the field, except where
+ * The schemas at `path` inside an entry's schema (through properties and records): every union branch that has the field, except where
  * `kase` (`<entry>.<path>.<discriminator>=<value>`) narrows a union to one branch.
  */
 export function subSchemas(
@@ -848,6 +848,8 @@ export function subSchemas(
     const props = o.properties as Record<string, JsonSchema> | undefined;
     if (props && Object.hasOwn(props, rest[0]!))
       return walk(props[rest[0]!], rest.slice(1), `${here}.${rest[0]}`);
+    if (o.additionalProperties && typeof o.additionalProperties === 'object')
+      return walk(o.additionalProperties, rest.slice(1), `${here}.${rest[0]}`);
     return [];
   };
   return walk(schema, path, entry);

package/src/describe/mapper-source.ts

@@ -131,8 +131,8 @@ function tokenize(src: string): Tok[] {
       i = e + 2;
       continue;
     }
-    if (c === '`') throw new MapperError('mapper uses a template string');
-    if (c === '"' || c === "'") {
+    // Bun prints a string constant holding a newline or both quote kinds as a template literal.
+    if (c === '"' || c === "'" || c === '`') {
       let j = i + 1;
       let v = '';
       for (;;) {
@@ -140,6 +140,8 @@ function tokenize(src: string): Tok[] {
           throw new MapperError('mapper source has an unterminated string');
         const d = src[j]!;
         if (d === c) break;
+        if (c === '`' && d === '$' && src[j + 1] === '{')
+          throw new MapperError('mapper uses a template string');
         if (d === '\\') {
           v += src.slice(j, j + 2);
           j += 2;

package/src/harness/index.ts

@@ -2,7 +2,6 @@
 export {
   runHarness,
   defaultIO,
-  allSteps,
   resolveStepFunction,
   type HarnessConfig,
   type HarnessIO,

package/src/harness/main.ts

@@ -56,12 +56,6 @@ export const defaultIO: HarnessIO = {
 const USAGE =
   'usage: step describe [--sentinels] | step run <step> | step map-trigger <trigger>';
 
-export function allSteps(data: PipelineData): AnyStep[] {
-  const out: AnyStep[] = [];
-  for (const { step } of stepsWithCases(data)) if (!out.includes(step)) out.push(step);
-  return out;
-}
-
 /** Every step with the `select` case conditions (`<ref>.<discriminator>=<value>`) it sits in. */
 export function stepsWithCases(data: PipelineData): { step: AnyStep; cases: string[] }[] {
   const out: { step: AnyStep; cases: string[] }[] = [];

package/src/harness/result.ts

@@ -53,10 +53,15 @@ export async function uploadFile(
   url: string,
   file: string,
   log: (line: string) => void,
-  opts: { attempts?: number; baseDelayMs?: number } = {},
+  opts: {
+    attempts?: number;
+    baseDelayMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+  } = {},
 ): Promise<void> {
   const attempts = opts.attempts ?? 5;
   const base = opts.baseDelayMs ?? 1000;
+  const sleep = opts.sleep ?? ((ms: number) => Bun.sleep(ms));
   for (let i = 1; ; i++) {
     let status = 0;
     let detail: string;
@@ -73,7 +78,7 @@ export async function uploadFile(
     if (!transient || i >= attempts)
       throw new Error(`upload to ${redactUrl(url)} failed: ${detail}`);
     log(`upload to ${redactUrl(url)} failed (${detail}); retry ${i}/${attempts - 1}`);
-    await Bun.sleep(base * 2 ** (i - 1));
+    await sleep(base * 2 ** (i - 1));
   }
 }
 

package/src/library/helm-deploy-ssh.ts

@@ -275,6 +275,8 @@ export async function deployOverSsh(
     rolloutTimeoutSeconds: number;
     dependencies?: readonly ChartDependency[];
     wait?: HelmWait;
+    /** Files in the chart holding secret values: deleted from the host after the upgrade, also when it fails (a successful upgrade removes the whole chart). */
+    secretFiles?: readonly string[];
   },
 ): Promise<void> {
   const ssh = await sshSession(ctx, { host: o.host, key: o.key });
@@ -306,15 +308,22 @@ export async function deployOverSsh(
     });
     await ssh.run(helmPullCommand(dep, remoteChart));
   }
-  await ssh.run(
-    helmUpgradeCommand({
-      ...o.flags,
-      remoteChart,
-      release: o.release,
-      namespace: o.namespace,
-      ...(o.wait ? { wait: o.wait } : {}),
-    }),
-  );
+  try {
+    await ssh.run(
+      helmUpgradeCommand({
+        ...o.flags,
+        remoteChart,
+        release: o.release,
+        namespace: o.namespace,
+        ...(o.wait ? { wait: o.wait } : {}),
+      }),
+    );
+  } finally {
+    if (o.secretFiles?.length)
+      await ssh.run(
+        `rm -f ${o.secretFiles.map((f) => shq(`${remoteChart}/${f}`)).join(' ')}`,
+      );
+  }
   for (const d of o.deployments) {
     const target = d.includes('/') ? d : `deploy/${d}`;
     ctx.log('waiting for rollout', { deployment: target });

package/src/library/helm-deploy.ts

@@ -1,7 +1,7 @@
 // Helm deploys to a target from config (`helmTarget()`): steps.helmDeployInCluster runs helm in the step
 // pod against its own cluster; steps.helmDeployOverSsh({ target, … }) runs it on a k3s host. Pick one
 // per target kind with `select`. Images come from a registry, pinned by digest.
-import { existsSync, writeFileSync } from 'node:fs';
+import { existsSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { z } from 'zod';
 import type { Ctx } from '../ctx/types.ts';
@@ -191,6 +191,13 @@ export interface HelmTargetDeployDef<
    * overrides only when set.
    */
   inlineValues?: readonly Readonly<Record<string, unknown>>[];
+  /**
+   * Secrets the `secretRef`s in `inlineValues` may name; the step declares them. Each `{ secret: NAME }`
+   * in the resolved values becomes the secret's value, so a chart can render its own Secret from a
+   * pipeline secret. The values files holding one are deleted after the upgrade (helm's release record
+   * keeps the values, as for any Helm value).
+   */
+  secrets?: readonly Secret[];
   /**
    * The images to deploy: step input key → the chart's values prefix. Each input is a `PushedImage`;
    * the step sets `<prefix>.repository`, `.tag`, `.digest` and `.pullPolicy=IfNotPresent`. `{}` deploys
@@ -274,6 +281,7 @@ interface AnyTargetDef {
   chart: string;
   target: unknown;
   inlineValues?: readonly Readonly<Record<string, unknown>>[];
+  secrets?: readonly Secret[];
   images?: Readonly<Record<string, string>>;
   imageRefs?: Readonly<Record<string, string>>;
   rolloutTimeoutSeconds?: number;
@@ -308,6 +316,11 @@ function targetDeploy(
     ...Object.fromEntries(refEntries.map(([key]) => [key, optional(PushedImage)])),
   };
   const configurable = { target: def.target, inlineValues: def.inlineValues ?? [] };
+  const declaredSecrets = [
+    ...(sshKey ? [sshKey] : []),
+    ...(def.secrets ?? []).filter((s) => s.name !== sshKey?.name),
+  ];
+  const valueSecrets = new Set((def.secrets ?? []).map((s) => s.name));
 
   const contract = step({
     name: def.name,
@@ -316,7 +329,7 @@ function targetDeploy(
     image: inCluster ? HELM_IMAGE : HELM_DEPLOY_IMAGE,
     input,
     output: HelmRelease,
-    secrets: sshKey ? [sshKey] : [],
+    secrets: declaredSecrets,
     timeoutSeconds: def.timeoutSeconds,
     ...(inCluster ? { clusterAccess: true } : {}),
     settings: {
@@ -349,11 +362,27 @@ function targetDeploy(
       );
     const chartDir = chartDirectory(await ctx.files.fetch(input.source.tree), def.chart);
 
+    const secretFiles: string[] = [];
     const generated = inlineValues.map((values, i) => {
       const file = `olve-values-${i}.json`;
-      writeFileSync(join(chartDir, file), JSON.stringify(values));
+      const resolved = resolveSecretRefs(values, (name) => {
+        if (!valueSecrets.has(name))
+          throw new Error(
+            `${kind} '${def.name}': inlineValues names secret ${name}, which the step does not declare (add it to secrets)`,
+          );
+        const value = (ctx.secrets as Record<string, string | undefined>)[name];
+        if (!value) throw new Error(`secret ${name} (inlineValues) is not set`);
+        return value;
+      });
+      if (resolved.secret) secretFiles.push(file);
+      writeFileSync(join(chartDir, file), JSON.stringify(resolved.value), {
+        mode: resolved.secret ? 0o600 : 0o644,
+      });
       return file;
     });
+    const removeSecretFiles = () => {
+      for (const file of secretFiles) rmSync(join(chartDir, file), { force: true });
+    };
     const flags: HelmImageFlags[] = imageEntries.map(([key, prefix]) => {
       const image = input[key]!;
       return {
@@ -395,7 +424,8 @@ function targetDeploy(
         flags: helm,
         deployments: deployments ?? (imageEntries.length ? [release] : []),
         rolloutTimeoutSeconds: rolloutTimeout,
-      });
+        secretFiles,
+      }).finally(removeSecretFiles);
     } else {
       if (!existsSync(SERVICE_ACCOUNT_TOKEN))
         throw new Error(
@@ -407,29 +437,33 @@ function targetDeploy(
         namespace,
         images: flags.map((f) => `${f.repository}@${f.digest}`).join(' '),
       });
-      await ctx.exec(
-        [
-          'helm',
-          'upgrade',
-          '--install',
-          release,
-          '.',
-          '-n',
-          namespace,
-          ...helmFlags(helm),
-          '--wait',
-          `--timeout=${rolloutTimeout}s`,
-        ],
-        {
-          cwd: chartDir,
-          env: {
-            HOME: home,
-            HELM_CACHE_HOME: join(home, 'cache'),
-            HELM_CONFIG_HOME: join(home, 'config'),
-            HELM_DATA_HOME: join(home, 'data'),
+      try {
+        await ctx.exec(
+          [
+            'helm',
+            'upgrade',
+            '--install',
+            release,
+            '.',
+            '-n',
+            namespace,
+            ...helmFlags(helm),
+            '--wait',
+            `--timeout=${rolloutTimeout}s`,
+          ],
+          {
+            cwd: chartDir,
+            env: {
+              HOME: home,
+              HELM_CACHE_HOME: join(home, 'cache'),
+              HELM_CONFIG_HOME: join(home, 'config'),
+              HELM_DATA_HOME: join(home, 'data'),
+            },
           },
-        },
-      );
+        );
+      } finally {
+        removeSecretFiles();
+      }
     }
 
     const url = (target.url ?? serviceUrl({ release, namespace })).replace(/\/+$/, '');
@@ -447,3 +481,35 @@ function targetDeploy(
     } as never;
   }) as never;
 }
+
+/**
+ * `v` with every `{ secret: NAME }` (a resolved `secretRef`) replaced by `lookup(NAME)`; `secret` says
+ * whether there was one.
+ */
+export function resolveSecretRefs(
+  v: unknown,
+  lookup: (name: string) => string,
+): { value: unknown; secret: boolean } {
+  let secret = false;
+  const walk = (x: unknown): unknown => {
+    if (Array.isArray(x)) return x.map(walk);
+    if (
+      x !== null &&
+      typeof x === 'object' &&
+      Object.getPrototypeOf(x) === Object.prototype
+    ) {
+      const entries = Object.entries(x as Record<string, unknown>);
+      if (
+        entries.length === 1 &&
+        entries[0]![0] === 'secret' &&
+        typeof entries[0]![1] === 'string'
+      ) {
+        secret = true;
+        return lookup(entries[0]![1]);
+      }
+      return Object.fromEntries(entries.map(([k, y]) => [k, walk(y)]));
+    }
+    return x;
+  };
+  return { value: walk(v), secret };
+}

package/src/util/tar.ts

@@ -20,7 +20,6 @@ import { createGzip } from 'node:zlib';
 
 export type TarEntry =
   | { path: string; type: 'file'; mode: number; source: string }
-  | { path: string; type: 'bytes'; mode: number; data: Uint8Array }
   | { path: string; type: 'dir'; mode: number }
   | { path: string; type: 'symlink'; target: string };
 
@@ -88,7 +87,6 @@ export function writeTar(out: string, entries: readonly TarEntry[]): void {
       const link = e.type === 'symlink' ? e.target : '';
       let size = 0;
       if (e.type === 'file') size = lstatSync(e.source).size;
-      else if (e.type === 'bytes') size = e.data.length;
       const pax: string[] = [];
       if (enc.encode(name).length > 100) pax.push(paxRecord('path', name));
       if (enc.encode(link).length > 100) pax.push(paxRecord('linkpath', link));
@@ -104,10 +102,7 @@ export function writeTar(out: string, entries: readonly TarEntry[]): void {
       write(
         header(shortName, size, mode, flag, link.length > 100 ? link.slice(0, 99) : link),
       );
-      if (e.type === 'bytes') {
-        write(e.data);
-        pad(size);
-      } else if (e.type === 'file') {
+      if (e.type === 'file') {
         const src = openSync(e.source, 'r');
         try {
           const buf = new Uint8Array(1 << 20);