@olivervea/pipelines 2.0.0-beta.3 → 2.0.0-beta.31

package/src/core/matrix.ts

@@ -0,0 +1,150 @@
+import { isModel, type AnyModel, type Infer } from './models.ts';
+import type { Simplify } from './types.ts';
+
+/** Axis name → its values, in order. Object key order is the axis order. */
+export type Axes = { readonly [axis: string]: readonly string[] };
+/** One combination of axis values. */
+export type Cell = Readonly<Record<string, string>>;
+/** The cell type of a step whose axes are `Ax`. */
+export type CellOfAxes<Ax extends Axes> = Simplify<{
+  readonly [K in keyof Ax as string extends K ? never : K]: Ax[K][number];
+}>;
+
+/** What the step's other cells do when one fails. */
+export type FailureStrategy =
+  { readonly kind: 'keepRunning' } | { readonly kind: 'cascadeFailure' };
+
+/** Every cell runs to the end (the default). */
+export function keepRunning(): FailureStrategy {
+  return Object.freeze({ kind: 'keepRunning' as const });
+}
+/** The first failed cell cancels the cells still running or waiting. */
+export function cascadeFailure(): FailureStrategy {
+  return Object.freeze({ kind: 'cascadeFailure' as const });
+}
+
+export interface MatrixDef<Ax extends Axes> {
+  /** The cells are the cross product of the axes, first axis outermost. */
+  axes: Ax;
+  /** Each entry names axes with one of their values; a cell matching all of them is left out. */
+  exclude?: readonly NoInfer<Partial<CellOfAxes<Ax>>>[];
+  /** Default `keepRunning()`. */
+  failure?: FailureStrategy;
+  /** At most this many of the step's cells running at once in a run. */
+  maxParallel?: number;
+}
+
+/** A matrix step's matrix, as the step carries it. */
+export interface Matrix<Ax extends Axes = Axes> {
+  readonly axes: Ax;
+  readonly exclude: readonly Cell[];
+  readonly failure: FailureStrategy;
+  readonly maxParallel?: number;
+}
+
+export const AXIS_NAME = /^[a-z][a-zA-Z0-9]{0,30}$/;
+export const AXIS_VALUE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
+export const MAX_AXES = 4;
+export const MAX_CELLS = 64;
+
+export function makeMatrix(def: MatrixDef<Axes>): Matrix {
+  return Object.freeze({
+    axes: Object.freeze(
+      Object.fromEntries(
+        Object.entries(def.axes ?? {}).map(([k, v]) => [
+          k,
+          Object.freeze(Array.isArray(v) ? [...v] : v),
+        ]),
+      ),
+    ),
+    exclude: Object.freeze((def.exclude ?? []).map((e) => Object.freeze({ ...e }))),
+    failure: def.failure ?? keepRunning(),
+    ...(def.maxParallel !== undefined ? { maxParallel: def.maxParallel } : {}),
+  }) as Matrix;
+}
+
+const matches = (cell: Cell, x: Cell) =>
+  Object.entries(x).every(([k, v]) => cell[k] === v);
+
+/** The cells in order: the cross product in axis order (first axis outermost) minus the excludes. */
+export function matrixCells(m: Matrix): Cell[] {
+  let cells: Record<string, string>[] = [{}];
+  for (const [axis, values] of Object.entries(m.axes))
+    cells = cells.flatMap((c) =>
+      (Array.isArray(values) ? values : []).map((v) => ({ ...c, [axis]: v })),
+    );
+  return cells.filter((c) => !m.exclude.some((x) => matches(c, x)));
+}
+
+/** `build-cli[os=linux,arch=x64]`: the name a cell's attempts, files and address use. */
+export function cellName(step: string, cell: Cell): string {
+  return `${step}[${Object.entries(cell)
+    .map(([k, v]) => `${k}=${v}`)
+    .join(',')}]`;
+}
+
+/** The cell `raw` (JSON text, as in `OLVE_CELL`) names, in axis order, or what is wrong. */
+export function parseCell(
+  step: string,
+  m: Matrix,
+  raw: string | undefined,
+): { ok: true; cell: Cell } | { ok: false; message: string } {
+  const axes = Object.keys(m.axes);
+  const example = JSON.stringify(matrixCells(m)[0] ?? {});
+  if (raw === undefined || raw === '')
+    return {
+      ok: false,
+      message: `step '${step}' is a matrix step: OLVE_CELL must name the cell to run, e.g. ${example}`,
+    };
+  let v: unknown;
+  try {
+    v = JSON.parse(raw);
+  } catch (e) {
+    return { ok: false, message: `OLVE_CELL is not JSON: ${(e as Error).message}` };
+  }
+  if (typeof v !== 'object' || v === null || Array.isArray(v))
+    return {
+      ok: false,
+      message: `OLVE_CELL must be a JSON object of axis values, e.g. ${example}`,
+    };
+  const given = v as Record<string, unknown>;
+  const ordered: Record<string, string> = {};
+  for (const a of axes) {
+    if (typeof given[a] !== 'string') break;
+    ordered[a] = given[a] as string;
+  }
+  const exact =
+    Object.keys(given).length === axes.length &&
+    Object.keys(ordered).length === axes.length;
+  const all = matrixCells(m);
+  if (exact && all.some((c) => cellName(step, c) === cellName(step, ordered)))
+    return { ok: true, cell: Object.freeze(ordered) };
+  return {
+    ok: false,
+    message: `OLVE_CELL ${raw} is not a cell of step '${step}' (cells: ${all.map((c) => cellName(step, c)).join(', ')})`,
+  };
+}
+
+// ─── cells(): reading a matrix step ──────────────────────────────────────────────────────────
+
+/** A step input that reads every cell of a matrix step whose output is `model`. */
+export interface Cells<M extends AnyModel = AnyModel> {
+  readonly kind: 'cells';
+  readonly model: M;
+}
+export function cells<M extends AnyModel>(model: M): Cells<M> {
+  return Object.freeze({ kind: 'cells' as const, model });
+}
+export function isCells(v: unknown): v is Cells {
+  return (
+    typeof v === 'object' &&
+    v !== null &&
+    (v as { kind?: unknown }).kind === 'cells' &&
+    isModel((v as { model?: unknown }).model)
+  );
+}
+/** One entry of a `cells` input, in cell order. */
+export interface CellOutput<M extends AnyModel, C extends Cell = Cell> {
+  readonly cell: C;
+  readonly output: Infer<M>;
+}

package/src/core/models.ts

@@ -1,30 +1,40 @@
-import { z } from "zod";
-import type { ModelBrand } from "./brands.ts";
+import { z } from 'zod';
+import type { ModelBrand } from './brands.ts';
 
 /** A named, nominal zod schema. The name is its identity in the manifest (one schema per name). */
 export interface Model<N extends string = string, S extends z.ZodType = z.ZodType> {
-  readonly kind: "model";
+  readonly kind: 'model';
   readonly name: N;
   readonly schema: S;
 }
 export type AnyModel = Model<string, z.ZodType>;
 
 /** Output view of a model (`z.output`), nominally branded with the model name. The brand is optional, so plain literals still assign. */
-export type Infer<M extends AnyModel> = z.output<M["schema"]> & { readonly [ModelBrand]?: M["name"] };
+export type Infer<M extends AnyModel> = z.output<M['schema']> & {
+  readonly [ModelBrand]?: M['name'];
+};
 /** Input view of a model (`z.input`: fields with defaults are optional). What trigger mappers produce. */
-export type InferInput<M extends AnyModel> = z.input<M["schema"]>;
+export type InferInput<M extends AnyModel> = z.input<M['schema']>;
 /** Output view without the nominal brand. */
-export type Plain<M extends AnyModel> = z.output<M["schema"]>;
+export type Plain<M extends AnyModel> = z.output<M['schema']>;
 
 /** Model names: identifier-like, so they are safe as JSON keys, C# names and URL segments. */
 export const MODEL_NAME = /^[A-Za-z][A-Za-z0-9_]*$/;
 
-export function model<const N extends string, S extends z.ZodType>(name: N, schema: S): Model<N, S> {
-  return Object.freeze({ kind: "model" as const, name, schema });
+export function model<const N extends string, S extends z.ZodType>(
+  name: N,
+  schema: S,
+): Model<N, S> {
+  return Object.freeze({ kind: 'model' as const, name, schema });
 }
 
 export function isModel(v: unknown): v is AnyModel {
-  return typeof v === "object" && v !== null && (v as { kind?: unknown }).kind === "model" && (v as { schema?: unknown }).schema instanceof z.ZodType;
+  return (
+    typeof v === 'object' &&
+    v !== null &&
+    (v as { kind?: unknown }).kind === 'model' &&
+    (v as { schema?: unknown }).schema instanceof z.ZodType
+  );
 }
 
 // ─── File references ─────────────────────────────────────────────────────────────────────────
@@ -36,17 +46,24 @@ export function isModel(v: unknown): v is AnyModel {
 const SEGMENT = String.raw`(?!\.\.?(?:/|$))[^/\\\x00]+`;
 export const FILE_PATH_PATTERN = `^(?:${SEGMENT}/)*${SEGMENT}/?$`;
 export const FILE_PATH = new RegExp(FILE_PATH_PATTERN);
+/** Step names: lower-case kebab, ≤ 63 chars (usable as K8s label values, URL segments and storage paths). */
+export const STEP_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const CELL_PART = String.raw`[a-z][a-zA-Z0-9]{0,30}=[A-Za-z0-9][A-Za-z0-9._-]{0,62}`;
+/** A step name, or a matrix cell's name (`build-cli[os=linux,arch=x64]`): what a file reference's `step` holds. */
+export const ATTEMPT_STEP = new RegExp(
+  String.raw`^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\[${CELL_PART}(?:,${CELL_PART})*\])?$`,
+);
 
 const FileRefSchema = z
   .object({
     run: z.number().int().nonnegative(),
-    step: z.string().min(1),
+    step: z.string().regex(ATTEMPT_STEP),
     attempt: z.number().int().positive(),
     path: z.string().regex(FILE_PATH),
     sha256: z.string().regex(/^[0-9a-f]{64}$/),
   })
-  .brand<"FileRef">()
-  .meta({ "x-olve-kind": "fileRef" });
+  .brand<'FileRef'>()
+  .meta({ 'x-olve-kind': 'fileRef' });
 
 /** A file or directory in some step attempt's output (`runs/<p>/<run>/<step>/<attempt>/files/<path>`). Branded: only `ctx.output.*` or a mapper ref produce one. */
 export type FileRef = z.output<typeof FileRefSchema>;
@@ -58,12 +75,17 @@ export const fileRefSchema = FileRefSchema;
 
 /** A step input that may be missing because its producer was *maybe skipped* (inside a `when`). There must still be a producer. */
 export interface Optional<M extends AnyModel = AnyModel> {
-  readonly kind: "optional";
+  readonly kind: 'optional';
   readonly model: M;
 }
 export function optional<M extends AnyModel>(model: M): Optional<M> {
-  return Object.freeze({ kind: "optional" as const, model });
+  return Object.freeze({ kind: 'optional' as const, model });
 }
 export function isOptional(v: unknown): v is Optional {
-  return typeof v === "object" && v !== null && (v as { kind?: unknown }).kind === "optional" && isModel((v as { model?: unknown }).model);
+  return (
+    typeof v === 'object' &&
+    v !== null &&
+    (v as { kind?: unknown }).kind === 'optional' &&
+    isModel((v as { model?: unknown }).model)
+  );
 }

package/src/core/secrets.ts

@@ -1,6 +1,6 @@
 /** A named pipeline secret. Steps (and poll triggers) declare the secrets they use; only those are mounted. */
 export interface Secret<N extends string = string> {
-  readonly kind: "secret";
+  readonly kind: 'secret';
   readonly name: N;
   readonly description: string;
 }
@@ -8,6 +8,6 @@ export interface Secret<N extends string = string> {
 export const SECRET_NAME = /^[A-Z_][A-Z0-9_]*$/;
 
 export function secret<const N extends string>(name: N, description: string): Secret<N> {
-  return Object.freeze({ kind: "secret" as const, name, description });
+  return Object.freeze({ kind: 'secret' as const, name, description });
 }
 export type DeclaredSecrets<N extends string> = { readonly [K in N]: string };

package/src/core/steps.ts

@@ -1,29 +1,55 @@
-import type { z } from "zod";
-import { STEP, type StepBrand } from "./brands.ts";
-import type { AnyModel, Infer, Optional } from "./models.ts";
-import type { Secret } from "./secrets.ts";
-import type { Simplify } from "./types.ts";
+import type { z } from 'zod';
+import { STEP, type StepBrand } from './brands.ts';
+import type { AnyModel, Infer, Optional } from './models.ts';
+import type { External } from './external.ts';
+import type { AnyConfigEntry } from './config.ts';
+import { configRefsIn } from './config-refs.ts';
+import type { Secret } from './secrets.ts';
+import type { Simplify } from './types.ts';
+import {
+  makeMatrix,
+  type Axes,
+  type CellOfAxes,
+  type CellOutput,
+  type Cells,
+  type Matrix,
+  type MatrixDef,
+} from './matrix.ts';
 
-/** A step input entry: a model (matchable by model), `optional(model)`, or a plain zod schema (mapper required). */
-export type InputEntry = AnyModel | Optional | z.ZodType;
+/**
+ * A step input entry: a model (matchable by model), `optional(model)`, `cells(model)` (every cell of a
+ * matrix step), a plain zod schema (mapper required), or `external(model, …)`, answered from outside the run.
+ */
+export type InputEntry = AnyModel | Optional | Cells | External | z.ZodType;
 export type InputSpec = { readonly [key: string]: InputEntry };
 
 export type InferEntry<E> =
-  E extends Optional<infer M> ? Infer<M> | undefined
-  : E extends AnyModel ? Infer<E>
-  : E extends z.ZodType ? z.output<E>
-  : never;
+  E extends Optional<infer M>
+    ? Infer<M> | undefined
+    : E extends Cells<infer M>
+      ? CellOutput<M>[]
+      : E extends External<infer M>
+        ? Infer<M>
+        : E extends AnyModel
+          ? Infer<E>
+          : E extends z.ZodType
+            ? z.output<E>
+            : never;
 /** What a handler receives: the output view of every input entry. */
 export type StepInput<I> = Simplify<{ -readonly [K in keyof I]: InferEntry<I[K]> }>;
 
-/** `custom` steps have a handler file; the others are library steps implemented by the SDK. */
-export type StepKind = "custom" | "script" | "gitHubSource" | "imageBuild" | "helmDeployOverSsh";
+/**
+ * A label for what a step is, shown in the UI. `custom` is the default; a reusable step names its
+ * kind, e.g. `gitHubSource`. Packages prefix theirs (`acme/deploy`).
+ */
+export type StepKind = string;
 
 export interface Step<
   N extends string = string,
   I extends InputSpec = InputSpec,
   O extends AnyModel | null = AnyModel | null,
   Sec extends string = string,
+  Cfg extends AnyConfigEntry = never,
 > {
   readonly [StepBrand]: true;
   readonly kind: StepKind;
@@ -33,35 +59,48 @@ export interface Step<
   readonly input: I;
   readonly output: O;
   readonly secrets: readonly Secret<Sec>[];
+  /** Config entries the step receives as `ctx.config`. */
+  readonly config: readonly Cfg[];
   readonly timeoutSeconds?: number;
   readonly retries?: number;
-  /** Library steps carry their own implementation and config. */
-  readonly builtin?: LibraryImplementation;
-}
-/** Runtime part of a library step (not part of the public contract). */
-export interface LibraryImplementation {
-  /** Config as emitted in the manifest (JSON only; must not contain paths). */
-  readonly manifestConfig: () => Record<string, unknown>;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  readonly run: (input: any, ctx: any) => Promise<unknown>;
+  /** The step pod gets the instance's step ServiceAccount token (`Kubernetes:StepServiceAccount`). */
+  readonly clusterAccess?: boolean;
+  /** How the step is set up, as written in the definition (may hold config references). */
+  readonly settings?: Readonly<Record<string, unknown>>;
+  /** Set on a matrix step: it runs once per cell. */
+  readonly matrix?: Matrix;
 }
-export type LibraryStep = { readonly builtin: LibraryImplementation };
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-export type AnyStep = Step<string, any, AnyModel | null, any>;
+export type AnyStep = Step<string, any, AnyModel | null, any, any>;
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
-export type SecretsOf<S> = S extends Step<any, any, any, infer Sec> ? Sec : never;
-export type OutputValue<S extends AnyStep> = S["output"] extends AnyModel ? Infer<S["output"]> : void;
+export type SecretsOf<S> = S extends Step<any, any, any, infer Sec, any> ? Sec : never;
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export type ConfigOf<S> = S extends Step<any, any, any, any, infer C> ? C : never;
+/** The cell type of a matrix step (`never` for any other step). */
+export type CellOf<S> = S extends { readonly matrix: Matrix<infer Ax> }
+  ? CellOfAxes<Ax>
+  : never;
+export type OutputValue<S extends AnyStep> = S['output'] extends AnyModel
+  ? Infer<S['output']>
+  : void;
 
 /** Step names must be literals (identity, duplicate detection and mapper keys depend on it). */
-export type LiteralName<N extends string> = N & (string extends N ? "❌ step name must be a string literal" : unknown);
+export type LiteralName<N extends string> = N &
+  (string extends N ? '❌ step name must be a string literal' : unknown);
 
-/** Step names: lower-case kebab, ≤ 63 chars (usable as K8s label values and URL segments). */
-export const STEP_NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+export { STEP_NAME } from './models.ts';
 /** Names that cannot be steps: `input` is the pipeline input's root in mappings. */
-export const RESERVED_STEP_NAMES: readonly string[] = ["input"];
+export const RESERVED_STEP_NAMES: readonly string[] = ['input'];
 
-export interface StepDef<N extends string, I extends InputSpec, O extends AnyModel | null, Sec extends readonly Secret[]> {
+export interface StepDef<
+  N extends string,
+  I extends InputSpec,
+  O extends AnyModel | null,
+  Sec extends readonly Secret[],
+  Cfg extends readonly AnyConfigEntry[] = [],
+  Ax extends Axes = never,
+> {
   name: LiteralName<N>;
   /** What the step does, shown in the UI. Required; may be empty. */
   description: string;
@@ -70,38 +109,74 @@ export interface StepDef<N extends string, I extends InputSpec, O extends AnyMod
   input?: I;
   output?: O;
   secrets?: Sec;
+  /** Config entries delivered as `ctx.config` (typed to exactly these). */
+  config?: Cfg;
   timeoutSeconds?: number;
   /** Automatic retries (an idempotency claim). Default 0. */
   retries?: number;
+  /**
+   * Ask for a Kubernetes API token in the step pod: the instance's step ServiceAccount
+   * (`Kubernetes:StepServiceAccount`), if it grants one. Default false (no token).
+   */
+  clusterAccess?: boolean;
+  /** A label for the step's kind (default `custom`). */
+  kind?: StepKind;
+  /**
+   * How the step is set up, shown in the manifest and part of the step's identity: the parameters of
+   * a reusable step. JSON values and config references (`target.prod.host`); every config entry it
+   * references is delivered to the step, and `resolveConfigRefs(value, ctx.config)` resolves them.
+   */
+  settings?: Readonly<Record<string, unknown>>;
+  /** Run the step once per cell of these axes; the handler reads its cell from `ctx.cell`. */
+  matrix?: MatrixDef<Ax>;
 }
 
-export function makeStep(kind: StepKind, def: Record<string, unknown>, builtin?: LibraryImplementation): AnyStep {
+function makeStep(def: Record<string, unknown>): AnyStep {
+  const config = new Map<string, AnyConfigEntry>();
+  for (const e of (def.config as readonly AnyConfigEntry[] | undefined) ?? [])
+    if (!config.has(e.name)) config.set(e.name, e);
+  configRefsIn(def.settings, config);
   const s = {
     [STEP]: true,
-    kind,
+    kind: def.kind ?? 'custom',
     name: def.name,
     description: def.description,
     image: def.image,
     input: Object.freeze({ ...((def.input as object | undefined) ?? {}) }),
     output: def.output ?? null,
     secrets: Object.freeze([...((def.secrets as readonly Secret[] | undefined) ?? [])]),
+    config: Object.freeze([...config.values()]),
     ...(def.timeoutSeconds !== undefined ? { timeoutSeconds: def.timeoutSeconds } : {}),
     ...(def.retries !== undefined ? { retries: def.retries } : {}),
-    ...(builtin ? { builtin } : {}),
+    ...(def.clusterAccess === true ? { clusterAccess: true } : {}),
+    ...(def.settings !== undefined ? { settings: def.settings } : {}),
+    ...(def.matrix !== undefined
+      ? { matrix: makeMatrix(def.matrix as MatrixDef<Axes>) }
+      : {}),
   };
   return Object.freeze(s) as unknown as AnyStep;
 }
 
 export function isStep(v: unknown): v is AnyStep {
-  return typeof v === "object" && v !== null && (v as Record<symbol, unknown>)[STEP] === true;
+  return (
+    typeof v === 'object' && v !== null && (v as Record<symbol, unknown>)[STEP] === true
+  );
 }
 
-/** Define a custom step: a contract (name, image, inputs, output, secrets). Its handler lives in `handlers/<name>.ts`. */
+/**
+ * Define a step: a contract (name, image, inputs, output, secrets). `implement(step, fn)` gives it
+ * its handler; that is what a pipeline stages.
+ */
 export function step<
   const N extends string,
   const I extends InputSpec = {},
   O extends AnyModel | null = null,
   const Sec extends readonly Secret[] = [],
->(def: StepDef<N, I, O, Sec>): Step<N, I, O, Sec[number]["name"]> {
-  return makeStep("custom", def as never) as never;
+  const Cfg extends readonly AnyConfigEntry[] = [],
+  const Ax extends Axes = never,
+>(
+  def: StepDef<N, I, O, Sec, Cfg, Ax>,
+): Step<N, I, O, Sec[number]['name'], Cfg[number]> &
+  ([Ax] extends [never] ? unknown : { readonly matrix: Matrix<Ax> }) {
+  return makeStep(def as never) as never;
 }

package/src/core/types.ts

@@ -1,6 +1,10 @@
 export type Primitive = string | number | boolean | bigint | null | undefined;
 export type Simplify<T> = { [K in keyof T]: T[K] } & {};
 export type Awaitable<T> = T | Promise<T>;
-export type IsUnion<T, U = T> = T extends unknown ? ([U] extends [T] ? false : true) : never;
+export type IsUnion<T, U = T> = T extends unknown
+  ? [U] extends [T]
+    ? false
+    : true
+  : never;
 /** `Ok` when there is no error, else the error (a readable string-literal type). */
 export type OrError<Err, Ok> = [Err] extends [never] ? Ok : Err;

package/src/core/webhooks.ts

@@ -1,23 +1,37 @@
-import type { Secret } from "./secrets.ts";
+import type { Secret } from './secrets.ts';
 
 /** How a webhook trigger authenticates deliveries. Build one with `hmacSha256`, `githubSignature` or `bearer`. */
 export type WebhookVerify =
-  | { readonly scheme: "hmac-sha256"; readonly secret: Secret; readonly header: string; readonly prefix: string }
-  | { readonly scheme: "bearer"; readonly secret: Secret };
+  | {
+      readonly scheme: 'hmac-sha256';
+      readonly secret: Secret;
+      readonly header: string;
+      readonly prefix: string;
+    }
+  | { readonly scheme: 'bearer'; readonly secret: Secret };
 
 /** HMAC-SHA256 of the raw body keyed by `secret`, hex, in `header` after `prefix`. */
-export function hmacSha256(o: { secret: Secret; header: string; prefix?: string }): WebhookVerify {
-  return Object.freeze({ scheme: "hmac-sha256", secret: o.secret, header: o.header, prefix: o.prefix ?? "" });
+export function hmacSha256(o: {
+  secret: Secret;
+  header: string;
+  prefix?: string;
+}): WebhookVerify {
+  return Object.freeze({
+    scheme: 'hmac-sha256',
+    secret: o.secret,
+    header: o.header,
+    prefix: o.prefix ?? '',
+  });
 }
 
 /** GitHub's delivery signature: `X-Hub-Signature-256: sha256=<hex>`. */
 export function githubSignature(secret: Secret): WebhookVerify {
-  return hmacSha256({ secret, header: "X-Hub-Signature-256", prefix: "sha256=" });
+  return hmacSha256({ secret, header: 'X-Hub-Signature-256', prefix: 'sha256=' });
 }
 
 /** `Authorization: Bearer <secret>`. */
 export function bearer(secret: Secret): WebhookVerify {
-  return Object.freeze({ scheme: "bearer", secret });
+  return Object.freeze({ scheme: 'bearer', secret });
 }
 
 /**