@hajimism/dek 0.3.3 → 0.5.0

package/src/cli/ls.ts

@@ -1,11 +1,12 @@
 import type { Diagnostic } from "../core/diagnostic.ts";
+import type { HiddenText } from "../core/foreign-text.ts";
 import { lintDeck, lintProject } from "../core/lint.ts";
 import { listSlides, type Project, type ProjectDeck } from "../core/resolve.ts";
 import { slideVideoSeconds, timelineSeconds } from "../core/timeline.ts";
 import { sectionTiming } from "../core/timing.ts";
 import { tryLoadCachedTimeline } from "../core/voice.ts";
 import { type SkippedCheck, skippedChecks } from "./result.ts";
-import type { DecksTarget, RefInfo } from "./scope.ts";
+import { type DecksTarget, hiddenField, hiddenInFiles, type RefInfo } from "./scope.ts";
 
 export type LsListResult = {
   kind: "list";
@@ -46,6 +47,8 @@ export type LsDeckResult = {
   skipped?: SkippedCheck[];
   /** Set when the deck is a ref. */
   ref?: RefInfo;
+  /** A ref's lines of script.md that hold characters a person cannot see. */
+  hidden?: HiddenText[];
 };
 
 /** The one deck in scope, a ref included, or else every deck of the project. */
@@ -58,6 +61,7 @@ export function lsCommand(target: DecksTarget): LsListResult | LsDeckResult {
         { check: "lint", reason: "a ref is read-only; its problems are not yours to fix" },
       ]),
       ref,
+      ...hiddenField(ref, hiddenInFiles(deck.dir, [deck.scriptPath])),
     };
   }
   if (deck) {

package/src/cli/main.ts

@@ -1,8 +1,13 @@
+import { parseCss } from "../core/css.ts";
+import { deckPaths } from "../core/deck-paths.ts";
 import { DekError } from "../core/error.ts";
+import { shellQuote } from "../core/escape.ts";
 import { either } from "../core/prose.ts";
 import { isRefName } from "../core/ref-name.ts";
-import { resolveProject } from "../core/resolve.ts";
-import { addressHint } from "./address.ts";
+import { type ProjectDeck, readDeckFile, resolveProject } from "../core/resolve.ts";
+import { takeUnsandboxed } from "../core/sandbox.ts";
+import { themeFacts } from "../core/theme-facts.ts";
+import { addressHint, deckWord, type HintDeck, withPlaceholderNote } from "./address.ts";
 import {
   type AnySpec,
   type CliResult,
@@ -13,7 +18,6 @@ import {
   subcommandAt,
   subcommandsOf,
 } from "./commands.ts";
-import { shellQuote } from "./files.ts";
 import { type CommandLine, parseCommandLine, wantsJson } from "./flags.ts";
 import { writeFailure, writeSuccess } from "./result.ts";
 import { DeckRequiredError, namesDeck, peelDeckArg, resolveTarget } from "./scope.ts";
@@ -158,7 +162,7 @@ async function run(cwd: string, line: CommandLine): Promise<void> {
   }
   const scope = spec.scope;
   const target = scope
-    ? retypedWithDeck(line, cwd, () =>
+    ? retypedWithDeck(line, cwd, call, () =>
         resolveTarget(cwd, scope, {
           deck: call.deck,
           refs: spec.refs === true,
@@ -170,10 +174,13 @@ async function run(cwd: string, line: CommandLine): Promise<void> {
   const ctx = { cwd, flags: line.values, args: call.args, target };
   const data = await form.run?.(ctx);
   if (spec.kind === "result") {
-    writeSuccess({ command: call.name, data } as CliResult, {
+    // Said on stderr as Chromium drew without its sandbox, and kept here for --json.
+    const drawn = { ...(data as object), ...takeUnsandboxed() };
+    writeSuccess({ command: call.name, data: drawn } as CliResult, {
       json: line.values.json === true,
       format: line.values.format,
       cwd,
+      flags: line.values,
       ...(target?.deck && {
         deck: { name: target.ref?.name ?? target.deck.name, dir: target.deck.dir },
       }),
@@ -186,9 +193,10 @@ const NAMED_DECKS = 3;
 
 /**
  * `resolve`, with a missing deck hinted as the line that was typed, the deck named where the
- * command takes it: one command per deck of the project, so the hint runs as written.
+ * command takes it: one command per deck of the project that has what the line names, so the
+ * hint runs as written.
  */
-function retypedWithDeck<T>(line: CommandLine, cwd: string, resolve: () => T): T {
+function retypedWithDeck<T>(line: CommandLine, cwd: string, call: Call, resolve: () => T): T {
   try {
     return resolve();
   } catch (error) {
@@ -196,16 +204,43 @@ function retypedWithDeck<T>(line: CommandLine, cwd: string, resolve: () => T): T
       throw error;
     }
     const typed = `\`dekc ${line.typed.map(shellQuote).join(" ")}\``;
-    const [first] = error.decks;
-    const hint = !first
-      ? "run `dekc new <name>` to make a deck"
-      : error.decks.length > NAMED_DECKS
-        ? `run ${addressHint(typed, first, cwd)}, or name another deck in place of ${first.name}; \`dekc ls\` lists them`
-        : `run ${either(error.decks.map((deck) => addressHint(typed, deck, cwd)))}`;
-    throw new DekError(error.message, { hint, cause: error });
+    const decks = error.decks.filter((deck) => runsIn(call, deck));
+    const [first] = decks;
+    // Each command is retyped for one deck; where to find a name left as <deck> is said once.
+    const retyped = (deck: HintDeck) => addressHint(typed, deck, cwd, { note: false });
+    const hint =
+      error.decks.length === 0
+        ? "run `dekc new <name>` to make a deck"
+        : !first
+          ? "run `dekc ls`"
+          : decks.length > NAMED_DECKS
+            ? `run ${retyped(first)}, or name another deck in place of ${deckWord(first.name)}; \`dekc ls\` lists them`
+            : `run ${either(decks.map(retyped))}`;
+    throw new DekError(error.message, { hint: withPlaceholderNote(hint), cause: error });
   }
 }
 
+/**
+ * Whether `call` finds in `deck` what it names: a section, the one `dekc mv` renames or the name
+ * script.md already gives it, and a layout of the deck's theme.
+ */
+function runsIn(call: Call, deck: ProjectDeck): boolean {
+  const { slug, old, layout } = call.args;
+  const has = (name: string | undefined) =>
+    deck.deck.sections.some((section) => section.slug === name);
+  return (
+    (slug === undefined || has(slug)) &&
+    (old === undefined || has(old) || has(call.args.new)) &&
+    (layout === undefined || themeLayouts(deck).includes(layout))
+  );
+}
+
+/** The layouts a deck's theme defines; none when it has no theme.css. */
+function themeLayouts(deck: ProjectDeck): string[] {
+  const css = readDeckFile(deck.dir, deckPaths(deck.dir).theme) ?? "";
+  return themeFacts(parseCss(css)).layouts.map((entry) => entry.name);
+}
+
 /** A session prints no result, so --json has nothing to shape, and a reader would wait forever. */
 function sessionJsonError(name: string): DekError {
   return new DekError(`${name} keeps running until stopped and prints no JSON`, {
@@ -218,6 +253,8 @@ function sessionJsonError(name: string): DekError {
  * prints once, here: as JSON when the line asks for it, even a line too broken to parse.
  */
 export async function main(argv: string[], cwd: string): Promise<void> {
+  // What a run before this one in the process drew is its own, even one that failed.
+  takeUnsandboxed();
   let json = wantsJson(argv);
   try {
     const line = parseCommandLine(argv);

package/src/cli/new.ts

@@ -1,13 +1,22 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { loadConfig } from "../core/config.ts";
 import { deckPaths } from "../core/deck-paths.ts";
 import { DekError } from "../core/error.ts";
+import { type HiddenText, hiddenText } from "../core/foreign-text.ts";
 import { DECK_NAME_HINT, isDeckName } from "../core/path.ts";
 import { isRefName } from "../core/ref-name.ts";
+import { readDeckFile } from "../core/resolve.ts";
+import { readSourceIfExists } from "../core/safe-fs.ts";
 import { syncDeck } from "../core/sync.ts";
 import { applyPlan, deckPlan, nextSteps } from "./files.ts";
-import { type RefInfo, requireDeckFromCwd, requireProject, resolveTarget } from "./scope.ts";
+import {
+  hiddenField,
+  type RefInfo,
+  requireDeckFromCwd,
+  requireProject,
+  resolveTarget,
+} from "./scope.ts";
 
 export type NewResult = {
   name: string;
@@ -19,6 +28,11 @@ export type NewResult = {
   next: string[];
   /** Set when the theme came from a ref with no license. */
   warnings: string[];
+  /**
+   * A ref's theme's lines, now the new deck's theme.css, that hold characters a person cannot
+   * see: the copy is the deck's own, so they are its author's to remove.
+   */
+  hidden?: HiddenText[];
 };
 
 export function newCommand(options: { cwd: string; name: string; themeFrom?: string }): NewResult {
@@ -44,12 +58,17 @@ export function newCommand(options: { cwd: string; name: string; themeFrom?: str
       ? resolveTarget(options.cwd, "deck", { refs: true, deck: options.themeFrom })
       : undefined;
   const ref = fromRef?.ref;
-  const themeSource = fromRef
-    ? deckPaths(fromRef.deck.dir).theme
+  const fromDeck = fromRef
+    ? fromRef.deck
     : options.themeFrom
-      ? deckPaths(requireDeckFromCwd(options.cwd, options.themeFrom).deck.dir).theme
-      : join(project.root, "theme.css");
-  if (!existsSync(themeSource)) {
+      ? requireDeckFromCwd(options.cwd, options.themeFrom).deck
+      : undefined;
+  const themeSource = fromDeck ? deckPaths(fromDeck.dir).theme : join(project.root, "theme.css");
+  // What is copied is published with the new deck: a link out of its project is refused.
+  const source = fromDeck
+    ? readDeckFile(fromDeck.dir, themeSource)
+    : readSourceIfExists(themeSource, project.root);
+  if (source === undefined) {
     throw new DekError("theme.css not found", {
       path: themeSource,
       hint: ref
@@ -60,7 +79,7 @@ export function newCommand(options: { cwd: string; name: string; themeFrom?: str
     });
   }
 
-  const theme = `${ref ? provenance(ref) : ""}${readFileSync(themeSource, "utf8")}`;
+  const theme = `${ref ? provenance(ref) : ""}${source}`;
   const { created } = applyPlan(
     deckPlan(project.root, name, theme, loadConfig(project.configPath)),
   );
@@ -80,6 +99,7 @@ export function newCommand(options: { cwd: string; name: string; themeFrom?: str
             `${ref.name} has no license; ask its author before you present or share a deck built on its theme`,
           ]
         : [],
+    ...hiddenField(ref, ref ? hiddenText(theme, deckPaths(dir).theme) : []),
   };
 }
 

package/src/cli/pptx.ts

@@ -1,20 +1,25 @@
-import { pptxDeck } from "../core/pptx.ts";
+import { type PptxLifted, pptxDeck } from "../core/pptx.ts";
 import type { DecksTarget } from "./scope.ts";
 
-/** One file per deck, a single deck included, as `dekc pdf` answers. */
-export type PptxCliResult = { outs: string[] };
+/**
+ * One file per deck, a single deck included, as `dekc pdf` answers, and what each file laid
+ * over its pictures, for the text output alone (`--json` is `outs`).
+ */
+export type PptxCliResult = { outs: string[]; lifted?: PptxLifted[] };
 
 export async function pptxCommand(
   { project, decks }: DecksTarget,
   options: { rootDist?: boolean; public?: boolean } = {},
 ): Promise<PptxCliResult> {
   const outs: string[] = [];
+  const lifted: PptxLifted[] = [];
   for (const entry of decks) {
     const done = await pptxDeck(
       { project, deck: entry },
       { rootDist: options.rootDist, public: options.public },
     );
     outs.push(done.outPath);
+    lifted.push(done.lifted);
   }
-  return { outs };
+  return { outs, lifted };
 }

package/src/cli/ref.ts

@@ -1,7 +1,9 @@
-import { existsSync, lstatSync, readdirSync, readFileSync, rmdirSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+// biome-ignore lint/style/noRestrictedImports: rmdirSync, which takes packs/ and refs/ folders only while empty; removeInside would take what is in them.
+import { existsSync, lstatSync, readdirSync, readFileSync, rmdirSync, statSync } from "node:fs";
+import { dirname, join, relative, resolve, sep } from "node:path";
 import { loadConfig } from "../core/config.ts";
 import { DekError } from "../core/error.ts";
+import { isPlainWord, shellQuote } from "../core/escape.ts";
 import { downloadTarball, resolveRev } from "../core/github.ts";
 import {
   deckOfPack,
@@ -12,15 +14,17 @@ import {
   pickSnapshot,
   readPack,
   readTarball,
+  refDir,
   refLicense,
   refState,
   refTitle,
+  refuseLinkUnderPacks,
+  refuseLinkUnderRefs,
   type Snapshot,
   snapshotDigest,
   writeSnapshot,
 } from "../core/ref.ts";
-import type { FileRefSource, GithubRefSource } from "../core/ref-name.ts";
-import { readTextIfExists } from "../core/resolve.ts";
+import type { FileRefSource, GithubRefSource, RefSource } from "../core/ref-name.ts";
 import { readSourceIfExists, removeInside, requireInside, writeInside } from "../core/safe-fs.ts";
 import { writeAgentsMd } from "../core/sync.ts";
 import { setTableKey } from "../core/toml-keys.ts";
@@ -58,10 +62,12 @@ export type RefCliResult = RefAddResult | RefListResult | RefRmResult;
 export async function restoreRef(cwd: string, arg: string): Promise<void> {
   const source = parseRefSource(arg);
   const project = requireProject(cwd);
-  const { pinned, fetched } = refState(project, source.name);
+  const { pinned, dir, fetched } = refState(project, source.name);
   if (pinned === undefined || fetched) {
     return;
   }
+  // Said before a download that the write would refuse anyway.
+  refuseLinkUnderRefs(project.root, dir);
   if (source.kind === "file") {
     await unpackSnapshot(project.root, source, pinned);
     return;
@@ -88,7 +94,7 @@ async function unpackSnapshot(root: string, source: FileRefSource, pin: string):
   if ((await snapshotDigest(snapshot)) !== pin) {
     throw new DekError(`${rel} is not the pack ${source.name} is pinned to`, {
       path,
-      hint: `run \`dekc ref ${rel}\` to pin the pack that is there, or put back the one dek.toml pins`,
+      hint: `run \`dekc ref ${shellQuote(rel)}\` to pin the pack that is there, or put back the one dek.toml pins`,
     });
   }
   await writeSnapshot(root, source.name, pin, snapshot);
@@ -128,7 +134,10 @@ export async function addRef(cwd: string, arg: string): Promise<RefAddResult> {
     });
   }
   const project = requireProject(cwd);
+  refuseSharedFolders(project, source);
   const { pinned: from, dir, fetched } = refState(project, source.name);
+  // Said before a download that the write would refuse anyway.
+  refuseLinkUnderRefs(project.root, dir);
   const rev =
     source.rev !== undefined && isPinnedRev(source.rev)
       ? source.rev
@@ -141,7 +150,7 @@ export async function addRef(cwd: string, arg: string): Promise<RefAddResult> {
     changed = true;
   }
   if (from !== rev) {
-    const toml = readTextIfExists(project.configPath) ?? "";
+    const toml = readSourceIfExists(project.configPath, project.root) ?? "";
     writeInside(project.configPath, setTableKey(toml, "refs", source.name, rev), project.root);
     changed = true;
   }
@@ -166,6 +175,72 @@ export async function addRef(cwd: string, arg: string): Promise<RefAddResult> {
   };
 }
 
+/**
+ * Refuses a pin whose folders another pin, or a folder already on disk, takes. refs/ and packs/
+ * are named by the ref, and macOS and Windows read a name without its case, so `file/Talk` and
+ * `file/talk` would share one snapshot and one pack, and adding the second would replace the
+ * first's.
+ */
+function refuseSharedFolders(
+  project: { root: string; configPath: string },
+  source: RefSource,
+): void {
+  const { name } = source;
+  const other = Object.keys(loadConfig(project.configPath).refs ?? {}).find(
+    (pinned) => pinned !== name && folded(pinned) === folded(name),
+  );
+  if (other !== undefined) {
+    throw new DekError(`${name} would share its folders with ${other}, which dek.toml pins`, {
+      path: project.configPath,
+      hint: `a ref's folders are named without their case on macOS and Windows; to pin ${name} in its place, run \`dekc ref rm ${shellQuote(other)}\` first`,
+    });
+  }
+  const paths = [relative(project.root, refDir(project.root, name))];
+  if (source.kind === "file") {
+    paths.push(packFile(source.deck));
+  }
+  const left = paths
+    .map((path) => spelledOtherwise(project.root, path))
+    .find((path) => path !== undefined);
+  if (left !== undefined) {
+    const shown = isPlainWord(left) ? left : "another folder";
+    throw new DekError(
+      `${name} would share a folder with ${shown}, which is already in the project`,
+      {
+        path: join(project.root, left),
+        hint: "no ref in dek.toml pins it, so a ref removed by hand left it; delete it and add the ref again",
+      },
+    );
+  }
+}
+
+/** A name as a file system blind to case and form reads it: APFS folds ς as σ, and fi as fi. */
+function folded(name: string): string {
+  return name.normalize("NFKC").toUpperCase().toLowerCase();
+}
+
+/**
+ * The path, under `root`, of a folder or file a file system blind to case and form would read as
+ * `path` though it is spelled otherwise, found segment by segment.
+ */
+function spelledOtherwise(root: string, path: string): string | undefined {
+  let dir = root;
+  const walked: string[] = [];
+  for (const segment of path.split(sep)) {
+    const entries = existsSync(dir) && statSync(dir).isDirectory() ? readdirSync(dir) : [];
+    const other = entries.find((entry) => entry !== segment && folded(entry) === folded(segment));
+    if (other !== undefined) {
+      return join(...walked, other);
+    }
+    if (!entries.includes(segment)) {
+      return undefined;
+    }
+    walked.push(segment);
+    dir = join(dir, segment);
+  }
+  return undefined;
+}
+
 /** An argument that ends in .tgz or .tar.gz is a pack's path, never a ref name. */
 function isPackPath(arg: string): boolean {
   return /\.(tgz|tar\.gz)$/i.test(arg);
@@ -187,9 +262,12 @@ async function addPack(cwd: string, arg: string): Promise<RefAddResult> {
   }
   const read = await readPackFile(given, undefined);
   const { source, bytes } = read;
+  refuseSharedFolders(project, source);
   const rev = await snapshotDigest(read);
   const { pinned: from, dir, fetched } = refState(project, source.name);
   const stored = join(project.root, packFile(source.deck));
+  // Before the first write: the copy below is written by name.
+  refuseLinkUnderPacks(project.root, source.deck);
 
   let changed = false;
   if (!(fetched && from === rev)) {
@@ -201,7 +279,7 @@ async function addPack(cwd: string, arg: string): Promise<RefAddResult> {
     changed = true;
   }
   if (from !== rev) {
-    const toml = readTextIfExists(project.configPath) ?? "";
+    const toml = readSourceIfExists(project.configPath, project.root) ?? "";
     writeInside(project.configPath, setTableKey(toml, "refs", source.name, rev), project.root);
     changed = true;
   }
@@ -264,8 +342,13 @@ export function removeRef(cwd: string, arg: string): RefRmResult {
       hint: "run `dekc ref` to list refs",
     });
   }
+  // Before anything changes: the deletes below must not reach what a link there points to.
+  refuseLinkUnderRefs(project.root, dir);
+  if (source.kind === "file") {
+    refuseLinkUnderPacks(project.root, source.deck);
+  }
   if (pinned !== undefined) {
-    const toml = readFileSync(project.configPath, "utf8");
+    const toml = readSourceIfExists(project.configPath, project.root) ?? "";
     writeInside(
       project.configPath,
       setTableKey(toml, "refs", source.name, undefined),

package/src/cli/result.ts

@@ -1,10 +1,12 @@
 import type { Diagnostic, SkippedCheck } from "../core/diagnostic.ts";
 import { DekError } from "../core/error.ts";
+import { revealHidden } from "../core/foreign-text.ts";
 import { PLAYWRIGHT_INSTALL, type PlaywrightRunner, playwrightReady } from "../core/playwright.ts";
 import { addressHint, deckAround, type HintDeck } from "./address.ts";
 import { type CliResult, outputOf } from "./commands.ts";
+import type { FlagValues } from "./flags.ts";
 import { displayPath, formatError, formatErrorText } from "./format.ts";
-import { shouldColor, terminalSafe } from "./tty.ts";
+import { plainText, shouldColor, terminalSafe } from "./tty.ts";
 
 export type { CliResult, SkippedCheck };
 
@@ -13,15 +15,18 @@ export function skippedChecks(skipped: SkippedCheck[]): { skipped?: SkippedCheck
   return skipped.length > 0 ? { skipped } : {};
 }
 
+/** What `--visual` measures in a browser, as a hint or a reason names it. */
+export const RENDERED_RULES = "overflow, contrast, line breaks, and alignment";
+
 /**
- * The overflow and contrast rules, when a run leaves them out: why, and `rerun`, the command that
+ * The rules a browser measures, when a run leaves them out: why, and `rerun`, the command that
  * measures them. Without Playwright, installing it comes first, whatever the reason was.
  */
 export function visualSkipped(
   rerun: string,
   options: { reason: string; runner?: PlaywrightRunner },
 ): SkippedCheck {
-  const measure = `run \`${rerun}\` to measure overflow and contrast`;
+  const measure = `run \`${rerun}\` to measure ${RENDERED_RULES}`;
   return playwrightReady(options.runner)
     ? { check: "visual", reason: options.reason, hint: measure }
     : {
@@ -38,6 +43,8 @@ export type WriteSuccessOptions = {
   cwd?: string;
   /** The one deck the command worked on, which hints that name no path are about. */
   deck?: HintDeck;
+  /** The flags it ran with, which a failure's rerun repeats where they change what is checked. */
+  flags?: FlagValues;
 };
 
 /** Where a run's hints are read: the directory it ran in, and the deck it worked on, if one. */
@@ -83,7 +90,7 @@ export function writeSuccess(original: CliResult, options: WriteSuccessOptions):
   const { cwd } = options;
   const addressed = cwd === undefined ? original : addressResult(original, { cwd, ...options });
   const result = cwd === undefined ? addressed : displayPaths(addressed, cwd);
-  const failed = output.failure?.(result.data);
+  const failed = output.failure?.(result.data, options.flags ?? {});
   const failure =
     failed?.hint === undefined || cwd === undefined
       ? failed
@@ -95,9 +102,13 @@ export function writeSuccess(original: CliResult, options: WriteSuccessOptions):
     const data = output.json ? output.json(result.data) : (result.data as object);
     process.stdout.write(`${JSON.stringify({ ...envelope, ...data })}\n`);
   } else {
-    const text = formatText(result, shouldColor(process.stdout));
+    const plain = {
+      ...result,
+      data: plainStrings(result.data, isAboutRef(result.data)),
+    } as CliResult;
+    const text = formatText(plain, shouldColor(process.stdout));
     process.stdout.write(`${terminalSafe(text)}\n`);
-    const notes = output.notes?.(result.data, shouldColor(process.stderr));
+    const notes = output.notes?.(plain.data, shouldColor(process.stderr));
     if (notes) {
       process.stderr.write(`${terminalSafe(notes)}\n`);
     }
@@ -123,6 +134,36 @@ export function displayPaths(result: CliResult, cwd: string): CliResult {
   return { ...result, data: paths(result.data, (path) => displayPath(path, cwd)) } as CliResult;
 }
 
+/** A result that read a ref, as `ls`, `show`, and `theme` mark theirs. */
+function isAboutRef(data: unknown): boolean {
+  return typeof data === "object" && data !== null && "ref" in data && data.ref !== undefined;
+}
+
+/**
+ * Every string in a result as plainText, so the text a deck or a ref wrote reaches the terminal
+ * with no escape of its own; the text formatters paint dek's colors after. In a result about a
+ * ref, each character a person cannot see shows as `⟨U+XXXX⟩` too.
+ */
+function plainStrings<T>(value: T, reveal: boolean): T {
+  if (typeof value === "string") {
+    const plain = plainText(value);
+    return (reveal ? revealHidden(plain) : plain) as T;
+  }
+  if (Array.isArray(value)) {
+    return value.map((entry) => plainStrings(entry, reveal)) as T;
+  }
+  if (
+    value !== null &&
+    typeof value === "object" &&
+    Object.getPrototypeOf(value) === Object.prototype
+  ) {
+    return Object.fromEntries(
+      Object.entries(value).map(([key, entry]) => [key, plainStrings(entry, reveal)]),
+    ) as T;
+  }
+  return value;
+}
+
 /** A result as text, without what did not run; see writeSuccess. */
 export function formatText(result: CliResult, color = false): string {
   return outputOf(result.command).text(result.data, color);