@intentius/chant 0.124.30 → 0.124.31

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AA+sCzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EAkMvC,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AA6uCzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EAsMvC,CAAC"}

package/dist/cli/main.js

@@ -241,7 +241,9 @@ CI:
               [--events-json] [--report-url <url>] [--image <image>]
               [--before-script <line>]... [--pr-build]
               [--pr-build-command <line>] [--chant <command>]
-              [--pass-env <NAME>]... [--key <runner key.pem>] [-o <dir>]
+              [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>]
+              [-o <dir>]
+              [--no-status] [--status-url <url template>]
                         Run the pull-request pipeline's plan or apply job as
                         a pipeline Op in a fresh worktree of --commit (default
                         HEAD) with a clean environment. --base and --pr stand
@@ -249,10 +251,23 @@ CI:
                         the job's build and lint lines first. Records the run as
                         pr-plan or pr-apply on chant/lifecycle, signed with
                         --key or CHANT_RUNNER_KEY, so ci tick from runs counts
-                        it, and copies the report to -o (default .chant/pr).
+                        it, and copies the report to -o (default .chant/pr). With a forge
+                        token it sets a chant/pr-plan or chant/pr-apply commit
+                        status (pending, then success or failure); --no-status
+                        turns that off, and --status-url links it.
+                        --secrets (or CHANT_CI_SECRETS) names a dotenv or
+                        JSON file only its owner can read whose values the
+                        job gets, and which are shown as *** in the events,
+                        the record, the report and the output.
+                        With --report-url it also adds the run to
+                        <url>/runs/index.json, newest first, cut to the
+                        newest --run-index-limit entries (default 200).
+  ci runs --report-url <url> [--json]
+                        List the runs in the index at the report URL, newest
+                        first.
   ci serve --forge forgejo|github --repo <owner/repo> --env <env>
               [--interval <s>] [--max-jobs <n>] [--state <dir>]
-              [--author <login>]... [--once] [--rerun-failed]
+              [--author <login>]... [--once] [--rerun-failed] [--unsigned]
               [ci run's job flags]
                         Poll the forge for open pull requests and the target
                         branch's head, and run ci run plan for each new pull
@@ -262,7 +277,15 @@ CI:
                         each apply's resume record there, and runs at most
                         --max-jobs (default 1) jobs at once. --once runs one
                         poll and waits for its jobs. --rerun-failed runs a
-                        failed apply or plan again.
+                        failed apply or plan again. Refuses to start when its
+                        runner key is not listed in .chant/trust.json at the
+                        target's head, unless --unsigned
+  ci serve|run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]
+                        Make the host's runner key (Ed25519, mode 0600) in the
+                        state directory when there is none and print its public
+                        key. --trust commits its runner entry on a branch of its
+                        own and pushes it for review; the target branch is never
+                        written
   ci workflow [--workflow <name>]... [--output <file>]  Write
               [--chant <command>] [--install <command>]
               [--token-secret <NAME> | --app-id-var <VAR> --app-key-secret <NAME>]
@@ -688,6 +711,13 @@ Workspace (level 1, #2524):
                         threshold of the old one. A commit an agent run made
                         is attested by the run's signed statement; with
                         attested-runs, only those commits must be
+  workspace trust runner add <principal> --key <ssh-ed25519 line or file> [--class runner|service] [--by <principal>] [--expect <digest>] [--dry-run]
+  workspace trust runner remove <principal> [--by <principal>] [--expect <digest>] [--dry-run]
+                        List a runner's key under runners in .chant/trust.json,
+                        granting a runner the runner role, or take both away,
+                        editing the file in place. --expect refuses the write
+                        when the file's digest has changed. Prints the
+                        trust-write document and the new digest; never commits
   workspace signers [--json] [rotate [--threshold <n>] | sign --key <file>]
                         Show the signer history at base, or propose the next
                         signer set and sign it with a current signer's key
@@ -1318,6 +1348,8 @@ export const commandRegistry = [
     { name: "ci workflow", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-green-cli.js")).runCiWorkflow(ctx) },
     // #4094: one pull-request job as a pipeline Op in a fresh checkout, the chant runner's first slice.
     { name: "ci run", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-run.js")).runCiRun(ctx) },
+    // #4098: the run index at the report URL.
+    { name: "ci runs", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-run-index.js")).runCiRuns(ctx) },
     { name: "ci serve", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/ci-serve.js")).runCiServe(ctx) },
     // #4026: the release cut from a green commit (ws-104). Imported on first use.
     { name: "release cut", runsNoConfig: true, handler: async (ctx) => (await import("./handlers/release.js")).runReleaseCut(ctx) },
@@ -1417,6 +1449,8 @@ export const commandRegistry = [
     // #2548 — an agent session's member, write scope and spec, for a session that resumes.
     { name: "workspace agent", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/agent-cli.js")).runWorkspaceAgent(ctx) },
     { name: "workspace verify", handler: async (ctx) => (await import("../workspace/trust/verify-cli.js")).runWorkspaceVerify(ctx) },
+    // #3510 — a runner entry of .chant/trust.json, written through chant so a box repo never edits it by hand (ws-074).
+    { name: "workspace trust", runsNoConfig: true, handler: async (ctx) => (await import("../workspace/trust/trust-write.js")).runWorkspaceTrust(ctx) },
     { name: "workspace signers", handler: async (ctx) => (await import("../workspace/trust/signers-cli.js")).runWorkspaceSigners(ctx) },
     { name: "workspace evidence", handler: async (ctx) => (await import("../workspace/trust/evidence-cli.js")).runWorkspaceEvidence(ctx) },
     // State subcommands

package/dist/cli/parse-args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-args.d.ts","sourceRoot":"","sources":["../../src/cli/parse-args.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAmF7C;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA8xBpD"}
+{"version":3,"file":"parse-args.d.ts","sourceRoot":"","sources":["../../src/cli/parse-args.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAsF7C;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CA+zBpD"}

package/dist/cli/parse-args.js

@@ -64,6 +64,9 @@ const BOOLEAN_FLAGS = new Set([
     "--confirm-prod",
     "--once",
     "--rerun-failed",
+    "--setup-key",
+    "--trust",
+    "--unsigned",
     "--expire",
     "--check-live",
     "--check-snapshot",
@@ -491,6 +494,16 @@ export function parseArgs(args) {
                 throw new Error("--report-url needs a URL: --report-url s3://<bucket>/<prefix> or file://<directory>");
             result.reportUrl = url;
         }
+        else if (arg === "--no-status") {
+            // `chant ci run|serve --no-status` (#4097): post no commit status for the job.
+            result.noStatus = true;
+        }
+        else if (arg === "--status-url") {
+            // `chant ci run|serve --status-url <template>` (#4097): the link a job's status carries, in place of an https --report-url.
+            result.statusUrl = args[++i];
+            if (!result.statusUrl || result.statusUrl.startsWith("-"))
+                throw new Error("--status-url needs a URL template: --status-url https://host/reports/{key}");
+        }
         else if (arg === "--allow-unsigned") {
             // `chant release publish --allow-unsigned` (#4049).
             result.allowUnsigned = true;
@@ -703,12 +716,25 @@ export function parseArgs(args) {
                 throw new Error("--pass-env needs a variable's name, such as AWS_PROFILE: --pass-env <NAME>");
             (result.passEnv ?? (result.passEnv = [])).push(name);
         }
+        else if (arg === "--secrets") {
+            // `chant ci run|serve --secrets <file>` (#4096): the host's secrets file, readable only by its owner.
+            result.ciSecrets = args[++i];
+            if (!result.ciSecrets || result.ciSecrets.startsWith("-"))
+                throw new Error("--secrets needs the host's secrets file, a dotenv or JSON file only its owner can read: --secrets <file>");
+        }
         else if (arg === "--repo") {
             // `chant ci serve --repo <owner/repo>` (#4095): the repository whose pull requests and target branch it polls.
             result.ciRepo = args[++i];
             if (!result.ciRepo || !/^[^/\s-][^/\s]*\/[^/\s]+$/.test(result.ciRepo))
                 throw new Error("--repo needs the repository as owner/name: --repo <owner/repo>");
         }
+        else if (arg === "--run-index-limit") {
+            // `chant ci run --run-index-limit <n>` (#4098): how many runs the index at the report URL keeps.
+            const n = Number(args[++i]);
+            if (!Number.isInteger(n) || n < 1)
+                throw new Error("--run-index-limit needs a whole number of runs, 1 or more: --run-index-limit <n>");
+            result.runIndexLimit = n;
+        }
         else if (arg === "--max-jobs") {
             // `chant ci serve --max-jobs <n>` (#4095): how many jobs run at once.
             const n = Number(args[++i]);
@@ -762,6 +788,12 @@ export function parseArgs(args) {
             if (!result.verdict || result.verdict.startsWith("-"))
                 throw new Error("--verdict needs agree, dissent or abstain");
         }
+        else if (arg === "--class") {
+            // `chant workspace trust runner add <principal> --class runner|service` (#3510).
+            result.runnerClass = args[++i];
+            if (!result.runnerClass || result.runnerClass.startsWith("-"))
+                throw new Error("--class needs runner or service: --class <class>");
+        }
         else if (arg === "--by") {
             // `chant workspace records review <id> --by <principal>` (#2670): whoever the caller says.
             result.by = args[++i];
@@ -1001,6 +1033,24 @@ export function parseArgs(args) {
         else if (arg === "--once") {
             result.once = true;
         }
+        else if (arg === "--setup-key") {
+            // `chant ci serve|run --setup-key` (#4099): make the host's runner key and print its public half.
+            result.setupKey = true;
+        }
+        else if (arg === "--trust") {
+            // `chant ci serve|run --setup-key --trust` (#4099): list the key in .chant/trust.json on a branch.
+            result.trustKey = true;
+        }
+        else if (arg === "--unsigned") {
+            // `chant ci serve --unsigned` (#4099): serve without a runner key listed at the target's head.
+            result.unsigned = true;
+        }
+        else if (arg === "--principal") {
+            // `chant ci serve|run --setup-key --trust --principal <name>` (#4099): the runner's principal.
+            result.ciPrincipal = args[++i];
+            if (!result.ciPrincipal || result.ciPrincipal.startsWith("-"))
+                throw new Error("--principal needs the runner's principal: --principal <name>");
+        }
         else if (arg === "--work") {
             // `chant run <op> --work <id>` (#2748)
             const value = args[++i];

package/dist/cli/registry.d.ts

@@ -461,8 +461,16 @@ export interface ParsedArgs {
     commit?: string;
     /** `chant ci run --pass-env <NAME>`, repeatable (#4094): a variable of the runner's environment the job gets, beside the few it always gets. */
     passEnv?: string[];
+    /** `chant ci run|serve --secrets <file>` (#4096): the host's secrets file. Default the file `CHANT_CI_SECRETS` names. */
+    ciSecrets?: string;
     /** `chant ci workflow --chant <command>` (#3573): the command the tick step runs chant with, in place of the npx pin. Also `chant ci run --chant` (#4094): what runs chant in the job. */
     ciChant?: string;
+    /** `chant ci run|serve --no-status` (#4097): post no commit status for the job. */
+    noStatus?: boolean;
+    /** `chant ci run|serve --status-url <template>` (#4097): the link a job's status carries. `{key}` is `<pr>/<commit>[/<member>]`, as `--report-url` keys it. */
+    statusUrl?: string;
+    /** `chant ci run --run-index-limit <n>` (#4098): how many runs the index at the report URL keeps. Default 200. */
+    runIndexLimit?: number;
     /** `chant ci serve --repo <owner/repo>` (#4095): the repository it polls. */
     ciRepo?: string;
     /** `chant ci serve --max-jobs <n>` (#4095): how many jobs run at once. Default 1. */
@@ -489,6 +497,16 @@ export interface ParsedArgs {
      * `records-write.ts`.
      */
     by?: string;
+    /** `chant ci serve|run --setup-key` (#4099): make the host's runner key in the state directory and print its public half. */
+    setupKey?: boolean;
+    /** `chant ci serve|run --setup-key --trust` (#4099): list the runner key in .chant/trust.json on a branch pushed for review. */
+    trustKey?: boolean;
+    /** `chant ci serve --unsigned` (#4099): start without a runner key listed in .chant/trust.json at the target's head. */
+    unsigned?: boolean;
+    /** `chant ci serve|run --setup-key --trust --principal <name>` (#4099): the principal the runner key is listed for. */
+    ciPrincipal?: string;
+    /** `chant workspace trust runner add <principal> --class runner|service` (#3510): the runner entry's class. */
+    runnerClass?: string;
     /**
      * `chant workspace records review <id> --sign [<key file>]` (#2687): the key that seals the verdict, or true for git's user.signingkey.
      * On `records new` and `records amend`, the key that seals the record's author (#2688).

package/dist/cli/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mJAAmJ;IACnJ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8GAA8G;IAC9G,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qHAAqH;IACrH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mKAAmK;IACnK,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,6GAA6G;IAC7G,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uGAAuG;IACvG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iIAAiI;IACjI,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;0DACsD;IACtD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,uIAAuI;IACvI,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;+CAE2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uIAAuI;IACvI,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kLAAkL;IAClL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uIAAuI;IACvI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mIAAmI;IACnI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gIAAgI;IAChI,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;oFACgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;2EAGuE;IACvE,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC;;;;;;;;;2DASuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;wEAGoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;mDAE+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sJAAsJ;IACtJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wIAAwI;IACxI,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+HAA+H;IAC/H,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kHAAkH;IAClH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yIAAyI;IACzI,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC1B,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qGAAqG;IACrG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2JAA2J;IAC3J,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8KAA8K;IAC9K,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sHAAsH;IACtH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8GAA8G;IAC9G,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qHAAqH;IACrH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gIAAgI;IAChI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6LAA6L;IAC7L,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qIAAqI;IACrI,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6IAA6I;IAC7I,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6HAA6H;IAC7H,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gHAAgH;IAChH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gJAAgJ;IAChJ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,0LAA0L;IAC1L,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+HAA+H;IAC/H,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iHAAiH;IACjH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uHAAuH;IACvH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kIAAkI;IAClI,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8HAA8H;IAC9H,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iHAAiH;IACjH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6MAA6M;IAC7M,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uKAAuK;IACvK,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mPAAmP;IACnP,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8SAA8S;IAC9S,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4bAA4b;IAC5b,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2WAA2W;IAC3W,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4LAA4L;IAC5L,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wIAAwI;IACxI,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kMAAkM;IAClM,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oTAAoT;IACpT,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wZAAwZ;IACxZ,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8RAA8R;IAC9R,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wRAAwR;IACxR,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8NAA8N;IAC9N,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0VAA0V;IAC1V,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uTAAuT;IACvT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,geAAge;IAChe,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wWAAwW;IACxW,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gUAAgU;IAChU,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oYAAoY;IACpY,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,ySAAyS;IACzS,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0SAA0S;IAC1S,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uJAAuJ;IACvJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;yDAIqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qHAAqH;IACrH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sJAAsJ;IACtJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4KAA4K;IAC5K,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yHAAyH;IACzH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+IAA+I;IAC/I,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iNAAiN;IACjN,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yIAAyI;IACzI,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mQAAmQ;IACnQ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8JAA8J;IAC9J,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mLAAmL;IACnL,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+VAA+V;IAC/V,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iLAAiL;IACjL,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,6RAA6R;IAC7R,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4VAA4V;IAC5V,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC;IACzD,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/cli/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mJAAmJ;IACnJ,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;;;;OAYG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8GAA8G;IAC9G,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gHAAgH;IAChH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oFAAoF;IACpF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qHAAqH;IACrH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mKAAmK;IACnK,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,6GAA6G;IAC7G,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,wGAAwG;IACxG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6FAA6F;IAC7F,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,uGAAuG;IACvG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iIAAiI;IACjI,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;0DACsD;IACtD,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,uIAAuI;IACvI,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;+CAE2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uIAAuI;IACvI,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kLAAkL;IAClL,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;mFAC+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uIAAuI;IACvI,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iJAAiJ;IACjJ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qGAAqG;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mIAAmI;IACnI,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gIAAgI;IAChI,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;8DAC0D;IAC1D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;oFACgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;2EAGuE;IACvE,aAAa,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAClC;;;;;;;;;2DASuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;iFAC6E;IAC7E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;wEAGoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;mDAE+C;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,+EAA+E;IAC/E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;uFACmF;IACnF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sJAAsJ;IACtJ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kGAAkG;IAClG,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,wIAAwI;IACxI,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,qFAAqF;IACrF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;OAIG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+HAA+H;IAC/H,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2FAA2F;IAC3F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gGAAgG;IAChG,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,qGAAqG;IACrG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,kHAAkH;IAClH,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,8EAA8E;IAC9E,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mIAAmI;IACnI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yIAAyI;IACzI,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC1B,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qGAAqG;IACrG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,0HAA0H;IAC1H,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2JAA2J;IAC3J,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8KAA8K;IAC9K,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sHAAsH;IACtH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,gGAAgG;IAChG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8GAA8G;IAC9G,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qHAAqH;IACrH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gIAAgI;IAChI,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iGAAiG;IACjG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6HAA6H;IAC7H,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6LAA6L;IAC7L,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qIAAqI;IACrI,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6IAA6I;IAC7I,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6HAA6H;IAC7H,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gHAAgH;IAChH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2IAA2I;IAC3I,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gJAAgJ;IAChJ,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,yHAAyH;IACzH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0LAA0L;IAC1L,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+JAA+J;IAC/J,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kHAAkH;IAClH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0GAA0G;IAC1G,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,+HAA+H;IAC/H,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,iHAAiH;IACjH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uHAAuH;IACvH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kIAAkI;IAClI,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,8HAA8H;IAC9H,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,6HAA6H;IAC7H,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gIAAgI;IAChI,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,wHAAwH;IACxH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uHAAuH;IACvH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iHAAiH;IACjH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6MAA6M;IAC7M,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8FAA8F;IAC9F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sHAAsH;IACtH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+GAA+G;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,mFAAmF;IACnF,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kHAAkH;IAClH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sJAAsJ;IACtJ,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uKAAuK;IACvK,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mPAAmP;IACnP,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8SAA8S;IAC9S,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4bAA4b;IAC5b,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,2WAA2W;IAC3W,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4LAA4L;IAC5L,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wIAAwI;IACxI,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kMAAkM;IAClM,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,uGAAuG;IACvG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oTAAoT;IACpT,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wZAAwZ;IACxZ,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,oJAAoJ;IACpJ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8RAA8R;IAC9R,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,wRAAwR;IACxR,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8NAA8N;IAC9N,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0VAA0V;IAC1V,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uTAAuT;IACvT,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,geAAge;IAChe,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,wWAAwW;IACxW,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gUAAgU;IAChU,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,oYAAoY;IACpY,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,ySAAyS;IACzS,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,0SAA0S;IAC1S,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,uJAAuJ;IACvJ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;yDAIqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qHAAqH;IACrH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sJAAsJ;IACtJ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yFAAyF;IACzF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0GAA0G;IAC1G,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uHAAuH;IACvH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4KAA4K;IAC5K,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yHAAyH;IACzH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6GAA6G;IAC7G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+IAA+I;IAC/I,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gJAAgJ;IAChJ,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,iNAAiN;IACjN,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6IAA6I;IAC7I,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yIAAyI;IACzI,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mQAAmQ;IACnQ,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,8JAA8J;IAC9J,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,mLAAmL;IACnL,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,+VAA+V;IAC/V,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iLAAiL;IACjL,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,6RAA6R;IAC7R,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8GAA8G;IAC9G,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4VAA4V;IAC5V,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC;IACzD,0CAA0C;IAC1C,OAAO,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,UAAU,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,UAAU,CAAC;IAChB,4FAA4F;IAC5F,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD,wBAAgB,cAAc,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,eAAe,GAAG,IAAI,CAiB/F"}

package/dist/op/local-executor.d.ts

@@ -33,6 +33,7 @@ import { type WaitingPoint } from "./steward-points.js";
 import type { OpRunRecord } from "./runtime.js";
 import { type WorkLeaseRunResult } from "./work-lease-run.js";
 import { type RunOrigin } from "../lifecycle/release-ledger.js";
+import { type Redact } from "./redact.js";
 import { type RunEventKind, type RunEventRuntime } from "../run-event.js";
 import type { ActivityContract } from "./activity-contract.js";
 export { parseDuration } from "./duration.js";
@@ -354,6 +355,17 @@ export interface RunOpOptions {
      * needs one. The local runtime passes the configured lexicons' contracts.
      */
     contracts?: ReadonlyMap<string, ActivityContract>;
+    /**
+     * Redacts secret values (#4096) from what the run writes about itself:
+     * each {@link runEvents} line and each line kept on this host, each
+     * {@link stepOutput} line and step label, and the run record, its step
+     * records and its `failure`, before {@link signRecord} signs it and the
+     * ledger stores it. The step records on the result are redacted too. This
+     * is the one place a run's writes pass through, so a writer added here
+     * later is redacted with the rest. `chant ci run` passes one built from
+     * the host's secrets file (../workspace/ci-secrets.ts).
+     */
+    redact?: Redact;
 }
 /**
  * Execute an Op locally.

package/dist/op/local-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-executor.d.ts","sourceRoot":"","sources":["../../src/op/local-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAmB,YAAY,EAAwC,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAQ7F,OAAO,EAAuF,KAAK,cAAc,EAAE,MAAM,QAAQ,CAAC;AAIlI,OAAO,EAA8C,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAInG,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAsE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAK/H,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAyB,KAAK,YAAY,EAAE,KAAK,eAAe,EAA2B,MAAM,cAAc,CAAC;AAKvH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;WAGG;QACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;QACxD,6EAA6E;QAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,oIAAoI;QACpI,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,6HAA6H;QAC7H,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC1F,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,KAAK;aAKnB,MAAM,EAAE,WAAW;IAJrC,gFAAgF;IAChF,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhC,YACkB,MAAM,EAAE,WAAW,EACnC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAO9B;CACF;AA6ID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAa7E;AA81BD,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAChG;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;IAChF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,iGAAiG;IACjG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACzC,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,CAAC,CAkDtB"}
+{"version":3,"file":"local-executor.d.ts","sourceRoot":"","sources":["../../src/op/local-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAmB,YAAY,EAAwC,MAAM,SAAS,CAAC;AAC7G,OAAO,EAAmB,KAAK,UAAU,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAQ7F,OAAO,EAAuF,KAAK,cAAc,EAAE,MAAM,QAAQ,CAAC;AAIlI,OAAO,EAA8C,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAInG,OAAO,KAAK,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAIlE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAsE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAK/H,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAA0B,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAC/D,OAAO,EAAyB,KAAK,YAAY,EAAE,KAAK,eAAe,EAA2B,MAAM,cAAc,CAAC;AAKvH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C;;;;;;;;;GASG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;IAC3C,4GAA4G;IAC5G,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4FAA4F;IAC5F,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb;;;WAGG;QACH,GAAG,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;QACxD,6EAA6E;QAC7E,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;QACrB,oIAAoI;QACpI,MAAM,CAAC,EAAE,aAAa,CAAC;QACvB,6HAA6H;QAC7H,WAAW,CAAC,EAAE,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KAC1F,CAAC;IACF;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC;;;;OAIG;IACH,OAAO,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;OAMG;IACH,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB;;;;OAIG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,MAAM,EAAE,WAAW,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAID;;;;;;;;;;;GAWG;AACH,qBAAa,YAAa,SAAQ,KAAK;aAKnB,MAAM,EAAE,WAAW;IAJrC,gFAAgF;IAChF,SAAgB,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhC,YACkB,MAAM,EAAE,WAAW,EACnC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAO9B;CACF;AA6ID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAa7E;AA81BD,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,eAAe,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;IAChG;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,OAAO,EAAE,eAAe,CAAC;QAAC,SAAS,EAAE,SAAS,CAAA;KAAE,CAAC;IAChF;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,KAAK,WAAW,CAAC,SAAS,CAAC,CAAC;IAC7E;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1B;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;IACvC,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,iGAAiG;IACjG,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/C;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,iGAAiG;IACjG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAClD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,QAAQ,EAChB,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACnC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,EACzC,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,WAAW,CAAC,CAsDtB"}

package/dist/op/local-executor.js

@@ -50,6 +50,7 @@ import { LiveRun, currentLiveRun, withLiveRun } from "./run-live.js";
 import { runEnvOf } from "../lifecycle/run-ledger.js";
 import { resolveCommitSha } from "../lifecycle/commit-sha.js";
 import { resolveCiRun } from "../lifecycle/release-ledger.js";
+import { redactDeep, redactText } from "./redact.js";
 import { runEventsOfStepRecord } from "../run-event.js";
 import { openRunEventStore, teeLines } from "../run-event-store.js";
 import { openRunEventStream, runEventRunOf } from "../run-event-stream.js";
@@ -1015,7 +1016,11 @@ export async function runOpLocally(config, activities, profiles, signal, options
     const events = {};
     try {
         const stepConsole = options.stepOutput
-            ? { write: options.stepOutput, ...(options.stepHeartbeatMs !== undefined ? { heartbeatMs: options.stepHeartbeatMs } : {}) }
+            ? {
+                write: options.stepOutput,
+                ...(options.stepHeartbeatMs !== undefined ? { heartbeatMs: options.stepHeartbeatMs } : {}),
+                ...(options.redact ? { redact: options.redact } : {}),
+            }
             : undefined;
         return await withLiveRun(live, () => withRunConsole(stepConsole, () => withOpRunContext(run, () => runOpInTurn(config, activities, profiles, signal, { ...options, runId, ...(steward ? { steward } : {}) }, run, events))));
     }
@@ -1043,7 +1048,10 @@ async function runOpInTurn(config, activities, profiles, signal, options, run, e
     const store = options.ledger
         ? await openRunEventStore(options.ledger.cwd ?? options.cwd ?? process.cwd(), runId)
         : undefined;
-    const eventsWrite = teeLines(options.runEvents?.write, store?.write.bind(store));
+    const teed = teeLines(options.runEvents?.write, store?.write.bind(store));
+    // #4096: every event line, to the caller and to this host's store alike, is redacted once, here.
+    const redact = options.redact;
+    const eventsWrite = teed && redact ? (line) => teed(redactText(line, redact)) : teed;
     const stream = eventsWrite
         ? openRunEventStream(runEventRunOf({
             kind: options.runner?.kind ?? "op",
@@ -1168,7 +1176,7 @@ async function runOpInTurn(config, activities, profiles, signal, options, run, e
      */
     const settle = async (settled, status, gate, point) => {
         const ended = options.now ?? new Date().toISOString();
-        const input = buildRunRecord(config, settled, {
+        let input = buildRunRecord(config, settled, {
             started: startedAt,
             ended,
             status,
@@ -1187,6 +1195,17 @@ async function runOpInTurn(config, activities, profiles, signal, options, run, e
             if (failure)
                 input.failure = failure;
         }
+        // #4096: the record is redacted before it is signed, so the stored record is the one the statement covers.
+        // The step records on the result are redacted in place, so a caller printing them prints no secret.
+        if (redact) {
+            input = redactDeep(input, redact);
+            for (const r of settled) {
+                if (r.error !== undefined)
+                    r.error = redact(r.error);
+                if (r.args)
+                    r.args = redactDeep(r.args, redact);
+            }
+        }
         let record = { version: 1, ...input, id: runId };
         if (options.signRecord) {
             try {

package/dist/op/redact.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Redaction of secret values (#4096): what a run writes about itself, with
+ * each secret value replaced by `***`.
+ *
+ * The executor (./local-executor.ts) takes a {@link Redact} and applies it
+ * where a run writes: each run-event line, each line a step prints, and the
+ * run record before it is signed and stored. `chant ci run` builds one from
+ * the host's secrets file and the job's secret-looking variables
+ * (../workspace/ci-secrets.ts).
+ *
+ * A value shorter than {@link REDACT_MIN_LENGTH} characters is not
+ * redacted: a two- or three-character value matches too much ordinary text.
+ */
+/** What every redacted value is replaced with. */
+export declare const REDACTED = "***";
+/** The shortest value redacted. Shorter values are left as they are. */
+export declare const REDACT_MIN_LENGTH = 4;
+/** A text with every secret value it contains replaced by {@link REDACTED}. */
+export type Redact = (text: string) => string;
+/**
+ * The redactor for `values`, or undefined when none is long enough to
+ * redact. A value that spans lines is also redacted line by line, since
+ * step output reaches a reader one line at a time.
+ */
+export declare function redactorOf(values: Iterable<string>): Redact | undefined;
+/** `value` with `redact` applied to every string in it, keys included. Numbers, booleans and nulls are kept. */
+export declare function redactDeep<T>(value: T, redact: Redact): T;
+/**
+ * A file's or line's text redacted: a JSON document as JSON, each line of a
+ * JSON Lines text as JSON, and any other text, or line, as text. The text
+ * comes back unchanged when it holds no secret.
+ */
+export declare function redactText(text: string, redact: Redact): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/op/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/op/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,kDAAkD;AAClD,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAE9B,wEAAwE;AACxE,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,+EAA+E;AAC/E,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;AAI9C;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAgBvE;AAED,gHAAgH;AAChH,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CASzD;AAqBD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ/D"}

package/dist/op/redact.js

@@ -0,0 +1,94 @@
+/**
+ * Redaction of secret values (#4096): what a run writes about itself, with
+ * each secret value replaced by `***`.
+ *
+ * The executor (./local-executor.ts) takes a {@link Redact} and applies it
+ * where a run writes: each run-event line, each line a step prints, and the
+ * run record before it is signed and stored. `chant ci run` builds one from
+ * the host's secrets file and the job's secret-looking variables
+ * (../workspace/ci-secrets.ts).
+ *
+ * A value shorter than {@link REDACT_MIN_LENGTH} characters is not
+ * redacted: a two- or three-character value matches too much ordinary text.
+ */
+/** What every redacted value is replaced with. */
+export const REDACTED = "***";
+/** The shortest value redacted. Shorter values are left as they are. */
+export const REDACT_MIN_LENGTH = 4;
+const escapeRegExp = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * The redactor for `values`, or undefined when none is long enough to
+ * redact. A value that spans lines is also redacted line by line, since
+ * step output reaches a reader one line at a time.
+ */
+export function redactorOf(values) {
+    const all = new Set();
+    const add = (v) => {
+        if (v.length < REDACT_MIN_LENGTH)
+            return;
+        all.add(v);
+        // As a JSON string spells it, for a value with a quote, a backslash or a control character in it.
+        all.add(JSON.stringify(v).slice(1, -1));
+    };
+    for (const value of values) {
+        add(value);
+        if (value.includes("\n"))
+            for (const line of value.split(/\r?\n/))
+                add(line.trim());
+    }
+    if (all.size === 0)
+        return undefined;
+    // Longest first, so a value that contains another is replaced whole.
+    const pattern = new RegExp([...all].sort((a, b) => b.length - a.length).map(escapeRegExp).join("|"), "g");
+    return (text) => (typeof text === "string" && text.length >= REDACT_MIN_LENGTH ? text.replace(pattern, REDACTED) : text);
+}
+/** `value` with `redact` applied to every string in it, keys included. Numbers, booleans and nulls are kept. */
+export function redactDeep(value, redact) {
+    if (typeof value === "string")
+        return redact(value);
+    if (Array.isArray(value))
+        return value.map((v) => redactDeep(v, redact));
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [k, v] of Object.entries(value))
+            out[redact(k)] = redactDeep(v, redact);
+        return out;
+    }
+    return value;
+}
+/**
+ * A JSON value's text, as `JSON.stringify` wrote it, with `redact` applied to
+ * its strings: parsed, redacted and written again, so a short value such as
+ * `true` that is also a secret doesn't break the document. Undefined when
+ * `text` is not JSON.
+ */
+function redactJsonText(text, redact) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+    if (parsed === null || typeof parsed !== "object")
+        return undefined;
+    const indent = /^[[{]\r?\n(\s+)/.exec(text)?.[1]?.length;
+    const trailing = /\s*$/.exec(text)?.[0] ?? "";
+    return `${JSON.stringify(redactDeep(parsed, redact), null, indent)}${trailing}`;
+}
+/**
+ * A file's or line's text redacted: a JSON document as JSON, each line of a
+ * JSON Lines text as JSON, and any other text, or line, as text. The text
+ * comes back unchanged when it holds no secret.
+ */
+export function redactText(text, redact) {
+    if (redact(text) === text)
+        return text;
+    const whole = redactJsonText(text, redact);
+    if (whole !== undefined)
+        return whole;
+    return text
+        .split("\n")
+        .map((line) => (redact(line) === line ? line : (redactJsonText(line, redact) ?? redact(line))))
+        .join("\n");
+}

package/dist/op/step-console.d.ts

@@ -28,6 +28,8 @@ export declare const STEP_HEARTBEAT_ENV = "CHANT_STEP_HEARTBEAT";
 export interface RunConsole {
     write: (line: string) => void;
     heartbeatMs?: number;
+    /** Applied to each line before it is written, and to a step's call before it is cut to a label (#4096). */
+    redact?: (text: string) => string;
 }
 /** Run `fn` as a run whose steps print through `run`. Without one, steps get no console. */
 export declare function withRunConsole<T>(run: RunConsole | undefined, fn: () => Promise<T>): Promise<T>;

package/dist/op/step-console.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"step-console.d.ts","sourceRoot":"","sources":["../../src/op/step-console.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AASzD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAKD,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE/F;AAQD,oGAAoG;AACpG,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAIxF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA6BjH;AAED,sGAAsG;AACtG,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAE,CAmBtF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAU9G"}
+{"version":3,"file":"step-console.d.ts","sourceRoot":"","sources":["../../src/op/step-console.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,+EAA+E;AAC/E,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,yBAAyB,CAAC;AASzD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2GAA2G;IAC3G,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;CACnC;AAKD,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAE/F;AAQD,oGAAoG;AACpG,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAOxF;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CA6BjH;AAED,sGAAsG;AACtG,wBAAgB,cAAc,IAAI,OAAO,CAExC;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,IAAI;IAAE,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAAC,GAAG,IAAI,IAAI,CAAA;CAAE,CAmBtF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAU9G"}

package/dist/op/step-console.js

@@ -43,7 +43,10 @@ function formatArgs(args) {
 export function stepLabel(fn, args, id) {
     if (id)
         return id;
-    const call = `${fn}(${formatArgs(args)})`.replace(/\s+/g, " ");
+    // A secret in the call is redacted before the label is cut, so a cut never leaves part of one.
+    const redact = runStore.getStore()?.redact;
+    const raw = `${fn}(${formatArgs(args)})`;
+    const call = (redact ? redact(raw) : raw).replace(/\s+/g, " ");
     return call.length > MAX_LABEL ? `${call.slice(0, MAX_LABEL - 4)}...)` : call;
 }
 /**
@@ -55,7 +58,7 @@ export async function withStepConsole(opts, fn) {
     const run = runStore.getStore();
     if (!run)
         return fn();
-    const { write } = run;
+    const write = run.redact ? (line) => run.write(run.redact(line)) : run.write;
     const prefix = `[${opts.phase}] ${opts.label}`;
     const started = Date.now();
     let spoke = false;

package/dist/pr-forge.d.ts

@@ -59,6 +59,15 @@ export interface ForgeStatus {
     /** GitLab only: the pipeline the status belongs to. */
     pipelineId?: number;
 }
+/** A runner job's commit status (#4097): the states GitHub and Forgejo both keep. */
+export interface CommitStatus {
+    context: string;
+    state: "pending" | "success" | "failure" | "error";
+    /** Cut to 140 characters. */
+    description: string;
+    /** Where the status links to. Omitted from the request when absent. */
+    targetUrl?: string;
+}
 /** A commit status's state, as a caller names it. */
 export type ForgeStatusState = "pending" | "running" | "success" | "failed" | "failure" | "canceled" | "error";
 /** Every {@link ForgeStatusState}, for a caller that reads one from its own input. */
@@ -257,6 +266,14 @@ export interface PrForge {
      */
     addComment(pr: number, body: string): Promise<AddedComment>;
     setStatus(sha: string, status: ForgeStatus): Promise<void>;
+    /**
+     * GitHub and Forgejo (#4097): set a commit status from a runner's job, one
+     * of `pending`, `success`, `failure` or `error`. The request is the one
+     * {@link setStatus} sends (`POST /repos/{owner}/{repo}/statuses/{sha}`), with
+     * the description cut to 140 characters and `target_url` only when given.
+     * `chant ci run` posts a job's progress through it.
+     */
+    setCommitStatus?(sha: string, status: CommitStatus): Promise<void>;
     /**
      * Keep one OPEN tracking issue for `marker` in line with `finding`: open
      * it, update its title and body, or, when `finding` is `null` and