@olivervea/pipelines 2.0.0-beta.3 → 2.0.0-beta.31

package/src/harness/main.ts

@@ -2,29 +2,42 @@
 //   describe [--sentinels]   → manifest (canonical JSON) on stdout
 //   run <step>               → $OLVE_DIR/input.json → handler → $OLVE_DIR/work/output.json (+ result upload)
 //   map-trigger <trigger>    → $OLVE_DIR/input.json (event) → pipeline input → $OLVE_DIR/work/output.json
-import { mkdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
-import { isImplementation } from "../core/handlers.ts";
-import type { AnyStep } from "../core/steps.ts";
-import type { WebhookEvent } from "../core/webhooks.ts";
-import { pipelineData, type PipelineData, type StageNode } from "../builder/pipeline.ts";
-import { createCtx, formatLog } from "../ctx/index.ts";
-import { DescribeError, describePipeline, manifestText } from "../describe/describe.ts";
-import type { HarnessInfo } from "../util/handler-hash.ts";
-import { ENV, paths, runInfoFromEnv } from "./env.ts";
-import { EXIT } from "./exit.ts";
-import { executeStep, type Envelope, type Execution, type StepFunction } from "./execute.ts";
-import { MANIFEST_BEGIN, MANIFEST_END, packResult, removeStale, sentinelBlock, uploadFile, writeEnvelope } from "./result.ts";
-import { formatIssues, parseStrict } from "./validate.ts";
-
-/** step name → lazy import of `handlers/<name>.ts`. Literal import() paths so Bun bundles them. */
-export type HandlerRegistry = Readonly<Record<string, () => Promise<{ default: unknown }>>>;
+import { mkdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { isImplementation } from '../core/handlers.ts';
+import { configRefPath, isConfigRef, unionAt } from '../core/config.ts';
+import type { AnyStep } from '../core/steps.ts';
+import { cellName, parseCell } from '../core/matrix.ts';
+import { installMasking, maskEnvelope, maskPatterns, maskText } from './mask.ts';
+import type { WebhookEvent } from '../core/webhooks.ts';
+import { pipelineData, type PipelineData, type StageNode } from '../builder/pipeline.ts';
+import { createCtx, formatLog } from '../ctx/index.ts';
+import { DescribeError, describePipeline, manifestText } from '../describe/describe.ts';
+import type { HarnessInfo } from '../util/code-hash.ts';
+import { callbackUrlsFromEnv, ENV, paths, runInfoFromEnv } from './env.ts';
+import { EXIT } from './exit.ts';
+import {
+  executeStep,
+  type Envelope,
+  type Execution,
+  type StepFunction,
+} from './execute.ts';
+import {
+  MANIFEST_BEGIN,
+  MANIFEST_END,
+  packResult,
+  removeStale,
+  sentinelBlock,
+  uploadFile,
+  writeEnvelope,
+} from './result.ts';
+import { formatIssues, parseStrict } from './validate.ts';
 
 export interface HarnessConfig {
-  /** Default export of pipeline.ts. */
+  /** Default export of the entry point. */
   pipeline: unknown;
-  handlers: HandlerRegistry;
-  handlerHashes: Readonly<Record<string, string>>;
+  /** Hash of the build (from the build; includes the harness identity). */
+  codeHash?: string;
   harness: HarnessInfo;
 }
 
@@ -38,57 +51,78 @@ export const defaultIO: HarnessIO = {
     await Bun.write(Bun.stdout, text);
   },
   stderr: (line) => {
-    process.stderr.write(line.endsWith("\n") ? line : line + "\n");
+    process.stderr.write(line.endsWith('\n') ? line : line + '\n');
   },
 };
 
-const USAGE = "usage: step describe [--sentinels] | step run <step> | step map-trigger <trigger>";
+const USAGE =
+  'usage: step describe [--sentinels] | step run <step> | step map-trigger <trigger>';
 
-export function allSteps(data: PipelineData): AnyStep[] {
-  const out: AnyStep[] = [];
-  const walk = (nodes: readonly StageNode[]) => {
-    for (const n of nodes) n.kind === "stage" ? out.push(...n.steps.map((s) => s.step)) : walk(n.nodes);
+/** Every step with the `select` case conditions (`<ref>.<discriminator>=<value>`) it sits in. */
+export function stepsWithCases(data: PipelineData): { step: AnyStep; cases: string[] }[] {
+  const out: { step: AnyStep; cases: string[] }[] = [];
+  const walk = (nodes: readonly StageNode[], cases: string[]) => {
+    for (const n of nodes) {
+      if (n.kind === 'stage') out.push(...n.steps.map((s) => ({ step: s.step, cases })));
+      else if (n.kind === 'when') walk(n.nodes, cases);
+      else {
+        const union = isConfigRef(n.on) ? unionAt(n.on) : undefined;
+        for (const [value, inner] of Object.entries(n.cases))
+          walk(
+            inner,
+            union
+              ? [...cases, `${configRefPath(n.on)}.${union.discriminator}=${value}`]
+              : cases,
+          );
+      }
+    }
   };
-  walk(data.nodes);
-  for (const fh of data.failureHandlers) if (!out.includes(fh.step)) out.push(fh.step);
+  walk(data.nodes, []);
+  for (const fh of data.failureHandlers) out.push({ step: fh.step, cases: [] });
   return out;
 }
 
+/** The step `run <name>` executes: the only one so named, or the one in the cases the service selected (`OLVE_CASES`). */
+export function findStep(
+  data: PipelineData,
+  name: string,
+  selected: readonly string[],
+): AnyStep | string {
+  const candidates = stepsWithCases(data).filter((c) => c.step.name === name);
+  const distinct = candidates.filter(
+    (c, i) => candidates.findIndex((d) => d.step === c.step) === i,
+  );
+  if (distinct.length === 0) return `unknown step '${name}'`;
+  if (distinct.length === 1) return distinct[0]!.step;
+  const chosen = distinct.filter((c) => c.cases.every((k) => selected.includes(k)));
+  if (chosen.length === 1) return chosen[0]!.step;
+  return `step '${name}' is in several select cases; ${ENV_CASES} must name the selected one (got ${JSON.stringify(selected)})`;
+}
+
+/** The select case conditions of the step being run (JSON array), set by the service for steps inside a select. */
+export const ENV_CASES = 'OLVE_CASES';
+
 /** Installs SIGTERM/SIGINT handlers that abort the returned signal (PID 1 ignores signals without them). */
 export function cancellation(): { signal: AbortSignal; dispose(): void } {
   const ac = new AbortController();
-  const onTerm = () => ac.abort("SIGTERM");
-  const onInt = () => (ac.signal.aborted ? process.exit(EXIT.sigint) : ac.abort("SIGINT"));
-  process.on("SIGTERM", onTerm);
-  process.on("SIGINT", onInt);
+  const onTerm = () => ac.abort('SIGTERM');
+  const onInt = () =>
+    ac.signal.aborted ? process.exit(EXIT.sigint) : ac.abort('SIGINT');
+  process.on('SIGTERM', onTerm);
+  process.on('SIGINT', onInt);
   return {
     signal: ac.signal,
     dispose() {
-      process.off("SIGTERM", onTerm);
-      process.off("SIGINT", onInt);
+      process.off('SIGTERM', onTerm);
+      process.off('SIGINT', onInt);
     },
   };
 }
 
-/** Resolves the function that implements `step` (library or handler module). */
-export async function resolveStepFunction(step: AnyStep, handlers: HandlerRegistry): Promise<StepFunction | string> {
-  if (step.kind !== "custom") {
-    if (!step.builtin) return `library step '${step.name}' (${step.kind}) has no implementation`;
-    return step.builtin.run as StepFunction;
-  }
-  const load = handlers[step.name];
-  if (!load) return `step '${step.name}' has no handler`;
-  let mod: { default: unknown };
-  try {
-    mod = await load();
-  } catch (e) {
-    return `the handler of step '${step.name}' failed to load: ${(e as Error)?.stack ?? String(e)}`;
-  }
-  const impl = mod.default;
-  if (!isImplementation(impl)) return `the handler of step '${step.name}' must default-export implement(<step '${step.name}'>, …)`;
-  if (impl.step !== step)
-    return `the handler of step '${step.name}' implements a different step object (it must be implement(<the '${step.name}' step from pipeline.ts>, …))`;
-  return impl.handler as unknown as StepFunction;
+/** The function `step` carries, or what is wrong. */
+export function resolveStepFunction(step: AnyStep): StepFunction | string {
+  if (isImplementation(step)) return step.handler as unknown as StepFunction;
+  return `step '${step.name}' has no implementation (stage implement(step({...}), fn))`;
 }
 
 /** Writes output.json, prints the sentinel block and uploads result.tar.gz when OLVE_RESULT_URL is set. */
@@ -100,7 +134,7 @@ export async function finish(exec: Execution, io: HarnessIO): Promise<number> {
   if (!url) return exec.exitCode;
   try {
     mkdirSync(p.tmp, { recursive: true });
-    const archive = join(p.tmp, "result.tar.gz");
+    const archive = join(p.tmp, 'result.tar.gz');
     await packResult(p.work, archive);
     await uploadFile(url, archive, io.stderr);
   } catch (e) {
@@ -110,18 +144,29 @@ export async function finish(exec: Execution, io: HarnessIO): Promise<number> {
   return exec.exitCode;
 }
 
-function readJson(path: string): { ok: true; value: unknown } | { ok: false; message: string } {
+function readJson(
+  path: string,
+): { ok: true; value: unknown } | { ok: false; message: string } {
   try {
-    return { ok: true, value: JSON.parse(readFileSync(path, "utf8")) };
+    return { ok: true, value: JSON.parse(readFileSync(path, 'utf8')) };
   } catch (e) {
     return { ok: false, message: `cannot read ${path}: ${(e as Error).message}` };
   }
 }
 
-async function describeMode(cfg: HarnessConfig, args: string[], io: HarnessIO): Promise<number> {
-  const sentinels = args.includes("--sentinels");
+async function describeMode(
+  cfg: HarnessConfig,
+  args: string[],
+  io: HarnessIO,
+): Promise<number> {
+  const sentinels = args.includes('--sentinels');
   try {
-    const text = manifestText(describePipeline(cfg.pipeline, { handlerNames: Object.keys(cfg.handlers), handlerHashes: cfg.handlerHashes, harness: cfg.harness }));
+    const text = manifestText(
+      describePipeline(cfg.pipeline, {
+        codeHash: cfg.codeHash,
+        harness: cfg.harness,
+      }),
+    );
     await io.stdout(sentinels ? `${MANIFEST_BEGIN}\n${text}${MANIFEST_END}\n` : text);
     return EXIT.ok;
   } catch (e) {
@@ -133,95 +178,187 @@ async function describeMode(cfg: HarnessConfig, args: string[], io: HarnessIO):
   }
 }
 
-async function runMode(cfg: HarnessConfig, name: string | undefined, io: HarnessIO): Promise<number> {
-  if (!name) return io.stderr(USAGE), EXIT.usage;
+async function runMode(
+  cfg: HarnessConfig,
+  name: string | undefined,
+  io: HarnessIO,
+): Promise<number> {
+  if (!name) return (io.stderr(USAGE), EXIT.usage);
   const data = pipelineData(cfg.pipeline);
-  const step = allSteps(data).find((s) => s.name === name);
-  if (!step) return io.stderr(`unknown step '${name}'`), EXIT.usage;
-  const fn = await resolveStepFunction(step, cfg.handlers);
-  if (typeof fn === "string") return io.stderr(fn), EXIT.configInvalid;
+  const step = findStep(data, name, selectedCases());
+  if (typeof step === 'string') return (io.stderr(step), EXIT.usage);
+  const fn = resolveStepFunction(step);
+  if (typeof fn === 'string') return (io.stderr(fn), EXIT.configInvalid);
 
   const p = paths();
   removeStale(p.work);
   mkdirSync(p.files, { recursive: true });
   mkdirSync(p.tmp, { recursive: true });
   const raw = readJson(p.input);
+  const cell = step.matrix
+    ? parseCell(step.name, step.matrix, process.env[ENV.cell])
+    : undefined;
   const cancel = cancellation();
+  const masks = maskPatterns(step.secrets.map((s) => process.env[s.name]));
+  const unmask = masks.length > 0 ? installMasking(masks) : () => {};
+  if (masks.length > 0) {
+    const stderr = io.stderr;
+    io = { ...io, stderr: (line) => stderr(maskText(line, masks)) };
+  }
   try {
     let exec: Execution;
-    if (!raw.ok) {
-      io.stderr(raw.message);
-      exec = { envelope: { status: "failed", error: { kind: "input", message: raw.message } }, exitCode: EXIT.inputInvalid };
+    if (!raw.ok || (cell && !cell.ok)) {
+      const message = !raw.ok ? raw.message : cell && !cell.ok ? cell.message : '';
+      io.stderr(message);
+      exec = {
+        envelope: { status: 'failed', error: { kind: 'input', message } },
+        exitCode: EXIT.inputInvalid,
+      };
     } else {
-      const run = runInfoFromEnv(step.name);
-      const ctx = createCtx({ run, secrets: step.secrets, paths: { root: p.root, workFiles: p.files, tmp: p.tmp }, signal: cancel.signal, logSink: io.stderr });
-      exec = await executeStep({ step, fn, rawInput: raw.value, ctx, workFiles: p.files, log: io.stderr });
+      const run = runInfoFromEnv(cell?.ok ? cellName(step.name, cell.cell) : step.name);
+      const ctx = createCtx({
+        run,
+        secrets: step.secrets,
+        paths: { root: p.root, workFiles: p.files, tmp: p.tmp },
+        signal: cancel.signal,
+        logSink: io.stderr,
+        callbackUrls: callbackUrlsFromEnv(),
+        ...(cell?.ok ? { cell: cell.cell } : {}),
+        pipeOutput: masks.length > 0,
+      });
+      exec = await executeStep({
+        step,
+        fn,
+        rawInput: raw.value,
+        ctx,
+        workFiles: p.files,
+        log: io.stderr,
+      });
     }
-    return await finish(exec, io);
+    unmask();
+    return await finish({ ...exec, envelope: maskEnvelope(exec.envelope, masks) }, io);
   } finally {
+    unmask();
     cancel.dispose();
   }
 }
 
 function isWebhookEvent(v: unknown): boolean {
-  if (typeof v !== "object" || v === null || Array.isArray(v) || !("body" in v)) return false;
+  if (typeof v !== 'object' || v === null || Array.isArray(v) || !('body' in v))
+    return false;
   const headers = (v as { headers?: unknown }).headers;
-  return typeof headers === "object" && headers !== null && !Array.isArray(headers);
+  return typeof headers === 'object' && headers !== null && !Array.isArray(headers);
 }
 
-async function mapTriggerMode(cfg: HarnessConfig, name: string | undefined, io: HarnessIO): Promise<number> {
-  if (!name) return io.stderr(USAGE), EXIT.usage;
+async function mapTriggerMode(
+  cfg: HarnessConfig,
+  name: string | undefined,
+  io: HarnessIO,
+): Promise<number> {
+  if (!name) return (io.stderr(USAGE), EXIT.usage);
   const data = pipelineData(cfg.pipeline);
   const trigger = data.triggers.find((t) => t.name === name);
-  if (!trigger) return io.stderr(`unknown trigger '${name}' (known: ${data.triggers.map((t) => t.name).join(", ") || "none"})`), EXIT.usage;
+  if (!trigger)
+    return (
+      io.stderr(
+        `unknown trigger '${name}' (known: ${data.triggers.map((t) => t.name).join(', ') || 'none'})`,
+      ),
+      EXIT.usage
+    );
   const p = paths();
   removeStale(p.work);
   mkdirSync(p.work, { recursive: true });
   const raw = readJson(p.input);
-  const fail = (kind: "input" | "output" | "handler", message: string, exitCode: number): Execution => {
+  const fail = (
+    kind: 'input' | 'output' | 'handler',
+    message: string,
+    exitCode: number,
+  ): Execution => {
     io.stderr(message);
-    return { envelope: { status: "failed", error: { kind, message } }, exitCode };
+    return { envelope: { status: 'failed', error: { kind, message } }, exitCode };
   };
   let exec: Execution;
-  if (!raw.ok) exec = fail("input", raw.message, EXIT.inputInvalid);
-  else if (trigger.kind === "poll" && (typeof raw.value !== "object" || raw.value === null || typeof (raw.value as { value?: unknown }).value !== "string"))
-    exec = fail("input", `poll trigger '${name}': the event must be {"value": "<string>"}`, EXIT.inputInvalid);
-  else if (trigger.kind === "push" && (typeof raw.value !== "object" || raw.value === null || Array.isArray(raw.value)))
-    exec = fail("input", `push trigger: the event must be the webhook payload object`, EXIT.inputInvalid);
-  else if (trigger.kind === "webhook" && !isWebhookEvent(raw.value))
-    exec = fail("input", `webhook trigger '${name}': the event must be {"headers": {...}, "body": ...}`, EXIT.inputInvalid);
+  if (!raw.ok) exec = fail('input', raw.message, EXIT.inputInvalid);
+  else if (
+    trigger.kind === 'poll' &&
+    (typeof raw.value !== 'object' ||
+      raw.value === null ||
+      typeof (raw.value as { value?: unknown }).value !== 'string')
+  )
+    exec = fail(
+      'input',
+      `poll trigger '${name}': the event must be {"value": "<string>"}`,
+      EXIT.inputInvalid,
+    );
+  else if (
+    trigger.kind === 'push' &&
+    (typeof raw.value !== 'object' || raw.value === null || Array.isArray(raw.value))
+  )
+    exec = fail(
+      'input',
+      `push trigger: the event must be the webhook payload object`,
+      EXIT.inputInvalid,
+    );
+  else if (trigger.kind === 'webhook' && !isWebhookEvent(raw.value))
+    exec = fail(
+      'input',
+      `webhook trigger '${name}': the event must be {"headers": {...}, "body": ...}`,
+      EXIT.inputInvalid,
+    );
   else {
     let mapped: unknown;
     let threw: unknown = undefined;
     try {
       mapped =
-        trigger.kind === "poll" ? await trigger.map((raw.value as { value: string }).value)
-        : trigger.kind === "webhook" ? await trigger.map(raw.value as WebhookEvent)
-        : await trigger.map(raw.value);
+        trigger.kind === 'poll'
+          ? await trigger.map((raw.value as { value: string }).value)
+          : trigger.kind === 'webhook'
+            ? await trigger.map(raw.value as WebhookEvent)
+            : await trigger.map(raw.value);
     } catch (e) {
-      threw = e ?? new Error("undefined");
+      threw = e ?? new Error('undefined');
     }
-    if (threw !== undefined) exec = fail("handler", `trigger '${name}' mapper threw: ${(threw as Error)?.message ?? String(threw)}`, EXIT.handlerFailed);
-    else if (mapped === null && trigger.kind === "webhook") exec = { envelope: { status: "skipped", reason: `trigger '${name}' ignored the delivery` }, exitCode: EXIT.ok };
+    if (threw !== undefined)
+      exec = fail(
+        'handler',
+        `trigger '${name}' mapper threw: ${(threw as Error)?.message ?? String(threw)}`,
+        EXIT.handlerFailed,
+      );
+    else if (mapped === null && trigger.kind === 'webhook')
+      exec = {
+        envelope: { status: 'skipped', reason: `trigger '${name}' ignored the delivery` },
+        exitCode: EXIT.ok,
+      };
     else {
-      const r = parseStrict(data.input.schema, mapped, "input");
+      const r = parseStrict(data.input.schema, mapped, 'input');
       exec = r.ok
-        ? { envelope: { status: "succeeded", output: r.value } satisfies Envelope, exitCode: EXIT.ok }
-        : fail("output", `trigger '${name}': mapped input does not match ${data.input.name}:\n  ${r.issues.join("\n  ")}`, EXIT.outputInvalid);
+        ? {
+            envelope: { status: 'succeeded', output: r.value } satisfies Envelope,
+            exitCode: EXIT.ok,
+          }
+        : fail(
+            'output',
+            `trigger '${name}': mapped input does not match ${data.input.name}:\n  ${r.issues.join('\n  ')}`,
+            EXIT.outputInvalid,
+          );
     }
   }
   return finish(exec, io);
 }
 
 /** Entry point of the compiled binary (and the dev runner). Returns the exit code. */
-export async function runHarness(cfg: HarnessConfig, argv: readonly string[], io: HarnessIO = defaultIO): Promise<number> {
+export async function runHarness(
+  cfg: HarnessConfig,
+  argv: readonly string[],
+  io: HarnessIO = defaultIO,
+): Promise<number> {
   const [mode, ...rest] = argv;
   switch (mode) {
-    case "describe":
+    case 'describe':
       return describeMode(cfg, rest, io);
-    case "run":
+    case 'run':
       return runMode(cfg, rest[0], io);
-    case "map-trigger":
+    case 'map-trigger':
       return mapTriggerMode(cfg, rest[0], io);
     default:
       io.stderr(USAGE);
@@ -230,3 +367,12 @@ export async function runHarness(cfg: HarnessConfig, argv: readonly string[], io
 }
 
 export { formatIssues, formatLog };
+
+function selectedCases(): string[] {
+  try {
+    const v = JSON.parse(process.env[ENV_CASES] ?? '[]') as unknown;
+    return Array.isArray(v) ? v.filter((x): x is string => typeof x === 'string') : [];
+  } catch {
+    return [];
+  }
+}

package/src/harness/mask.ts

@@ -0,0 +1,98 @@
+import { format } from 'node:util';
+import type { Envelope } from './execute.ts';
+
+/**
+ * Masks the step's declared secret values in what it writes to stdout and stderr. Output is masked a
+ * line at a time, so a value split across two writes is still found; a multi-line value (a key file)
+ * is masked line by line.
+ */
+
+export const MASK = '***';
+/** Shorter values (and lines of multi-line values) are left alone: they would mask ordinary text. */
+export const MIN_MASKED_LENGTH = 4;
+/** A line longer than this is masked and written without waiting for its end. */
+const MAX_PENDING = 64 * 1024;
+
+/** The strings to mask for these secret values, longest first. */
+export function maskPatterns(values: readonly (string | undefined)[]): string[] {
+  const patterns = new Set<string>();
+  for (const value of values)
+    for (const line of (value ?? '').split(/\r?\n/))
+      if (line.trim().length >= MIN_MASKED_LENGTH) patterns.add(line.trim());
+  return [...patterns].sort((a, b) => b.length - a.length);
+}
+
+export function maskText(text: string, patterns: readonly string[]): string {
+  let out = text;
+  for (const p of patterns) if (out.includes(p)) out = out.split(p).join(MASK);
+  return out;
+}
+
+/** A writer that masks complete lines and holds back the unfinished one until it ends or `flush`. */
+export function lineMasker(patterns: readonly string[], write: (text: string) => void) {
+  const decoder = new TextDecoder();
+  let pending = '';
+  return {
+    write(chunk: string | Uint8Array) {
+      pending +=
+        typeof chunk === 'string' ? chunk : decoder.decode(chunk, { stream: true });
+      const end = Math.max(pending.lastIndexOf('\n'), pending.lastIndexOf('\r'));
+      if (end >= 0) {
+        write(maskText(pending.slice(0, end + 1), patterns));
+        pending = pending.slice(end + 1);
+      }
+      if (pending.length > MAX_PENDING) this.flush();
+    },
+    flush() {
+      pending += decoder.decode();
+      if (pending) write(maskText(pending, patterns));
+      pending = '';
+    },
+  };
+}
+
+/** The envelope with its failure message or skip reason masked; outputs are data and stay as they are. */
+export function maskEnvelope(envelope: Envelope, patterns: readonly string[]): Envelope {
+  if (envelope.status === 'failed')
+    return {
+      ...envelope,
+      error: { ...envelope.error, message: maskText(envelope.error.message, patterns) },
+    };
+  if (envelope.status === 'skipped')
+    return { ...envelope, reason: maskText(envelope.reason, patterns) };
+  return envelope;
+}
+
+type Write = typeof process.stdout.write;
+
+/**
+ * Routes process.stdout and process.stderr through maskers until the returned function is called,
+ * which flushes them and restores the streams.
+ */
+export function installMasking(patterns: readonly string[]): () => void {
+  const streams = [process.stdout, process.stderr];
+  const originals = streams.map((s) => s.write.bind(s) as Write);
+  const maskers = originals.map((original) =>
+    lineMasker(patterns, (text) => void original(text)),
+  );
+  streams.forEach((s, i) => {
+    s.write = ((chunk: string | Uint8Array, a?: unknown, b?: unknown) => {
+      maskers[i]!.write(chunk);
+      const callback = typeof a === 'function' ? a : typeof b === 'function' ? b : null;
+      if (callback) queueMicrotask(() => (callback as () => void)());
+      return true;
+    }) as Write;
+  });
+  // Bun's console writes natively, past process.stdout.write.
+  const methods = ['log', 'info', 'debug', 'warn', 'error'] as const;
+  const consoleOriginals = methods.map((m) => console[m]);
+  methods.forEach((m) => {
+    const stream = m === 'warn' || m === 'error' ? process.stderr : process.stdout;
+    console[m] = (...args: unknown[]) => void stream.write(format(...args) + '\n');
+  });
+  return () => {
+    maskers.forEach((m) => m.flush());
+    streams.forEach((s, i) => (s.write = originals[i]!));
+    methods.forEach((m, i) => (console[m] = consoleOriginals[i]!));
+  };
+}