@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/builtin-actions.js

@@ -0,0 +1,484 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.builtinActionFor = builtinActionFor;
+exports.hostFileSystem = hostFileSystem;
+exports.containerFileSystem = containerFileSystem;
+exports.collectFiles = collectFiles;
+exports.uploadArtifact = uploadArtifact;
+exports.downloadArtifact = downloadArtifact;
+exports.runCacheAction = runCacheAction;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const hash_files_1 = require("./hash-files");
+/** Which built-in, if any, handles a `uses:` reference. */
+function builtinActionFor(uses) {
+    const match = uses.match(/^actions\/(upload-artifact|download-artifact|cache(?:\/restore|\/save)?)@/i);
+    if (!match)
+        return undefined;
+    return match[1].toLowerCase().replace('/', '-');
+}
+/** A step file system for steps running directly on the host. */
+function hostFileSystem(workspace) {
+    return {
+        workspace,
+        home: os.homedir(),
+        path: path,
+        readable: async (logical) => (fs.existsSync(logical) ? logical : null),
+        writeInto: async (logical, fill) => {
+            fs.mkdirSync(logical, { recursive: true });
+            fill(logical);
+        },
+        cleanup: () => undefined
+    };
+}
+/** A step file system for steps running in a job container. */
+function containerFileSystem(access) {
+    const p = path.posix;
+    const temps = [];
+    const tempDir = () => {
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-files-'));
+        temps.push(dir);
+        return dir;
+    };
+    const inWorkspace = (logical) => logical === access.workspace || logical.startsWith(access.workspace + '/');
+    const toHost = (logical) => path.join(access.hostWorkspace, ...p.relative(access.workspace, logical).split('/'));
+    return {
+        workspace: access.workspace,
+        home: access.home,
+        path: p,
+        readable: async (logical) => {
+            if (inWorkspace(logical)) {
+                const host = toHost(logical);
+                return fs.existsSync(host) ? host : null;
+            }
+            const target = path.join(tempDir(), 'copy');
+            return (await access.copyFrom(logical, target)) ? target : null;
+        },
+        writeInto: async (logical, fill) => {
+            if (inWorkspace(logical)) {
+                const host = toHost(logical);
+                fs.mkdirSync(host, { recursive: true });
+                fill(host);
+                return;
+            }
+            const stage = tempDir();
+            fill(stage);
+            await access.mkdir(logical);
+            if (!(await access.copyTo(`${stage}${path.sep}.`, logical))) {
+                throw new Error(`Could not copy files into the container at ${logical}`);
+            }
+        },
+        cleanup: () => {
+            for (const dir of temps.splice(0)) {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+        }
+    };
+}
+function listFiles(hostRoot, base = '') {
+    const stat = fs.statSync(hostRoot);
+    if (stat.isFile())
+        return [base];
+    const files = [];
+    for (const entry of fs.readdirSync(hostRoot, { withFileTypes: true })) {
+        const rel = base ? `${base}/${entry.name}` : entry.name;
+        const full = path.join(hostRoot, entry.name);
+        if (entry.isDirectory())
+            files.push(...listFiles(full, rel));
+        else if (entry.isFile())
+            files.push(rel);
+    }
+    return files;
+}
+/** Expand a leading `~` and resolve against the workspace. */
+function resolveLogical(fsys, raw) {
+    const expanded = raw === '~' || raw.startsWith('~/')
+        ? fsys.path.join(fsys.home, raw.slice(1))
+        : raw;
+    return fsys.path.resolve(fsys.workspace, expanded);
+}
+function commonAncestor(p, dirs) {
+    let common = dirs[0].split(p.sep);
+    for (const dir of dirs.slice(1)) {
+        const parts = dir.split(p.sep);
+        let i = 0;
+        while (i < common.length && i < parts.length && common[i] === parts[i]) {
+            i++;
+        }
+        common = common.slice(0, i);
+    }
+    return common.join(p.sep) || p.sep;
+}
+/**
+ * Files matching multi-line path patterns, the way upload-artifact and
+ * cache read them: each line is a file, a directory (all files under it)
+ * or a glob (`*`, `**`, `?`); `!pattern` excludes. `root` is the least
+ * common ancestor of the search paths, which file paths are relative to.
+ */
+async function collectFiles(fsys, patterns, options) {
+    const p = fsys.path;
+    const lines = patterns
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const excludes = lines
+        .filter((line) => line.startsWith('!'))
+        .map((line) => (0, hash_files_1.globToRegExp)(resolveLogical(fsys, line.slice(1).trim())));
+    const searchPaths = [];
+    const found = new Map();
+    for (const line of lines.filter((l) => !l.startsWith('!'))) {
+        const pattern = resolveLogical(fsys, line);
+        const globAt = pattern.search(/[*?[]/);
+        const searchPath = globAt === -1
+            ? pattern
+            : pattern.slice(0, pattern.lastIndexOf('/', globAt)) || p.sep;
+        const host = await fsys.readable(searchPath);
+        if (!host)
+            continue;
+        const isFile = fs.statSync(host).isFile();
+        searchPaths.push(isFile ? p.dirname(searchPath) : searchPath);
+        const matcher = globAt === -1 ? undefined : (0, hash_files_1.globToRegExp)(pattern);
+        for (const rel of listFiles(host)) {
+            const logical = rel ? p.join(searchPath, rel) : searchPath;
+            if (matcher && !matcher.test(logical))
+                continue;
+            found.set(logical, {
+                logical,
+                host: rel ? path.join(host, ...rel.split('/')) : host
+            });
+        }
+    }
+    const root = searchPaths.length
+        ? commonAncestor(p, searchPaths)
+        : fsys.workspace;
+    const files = [...found.values()].filter((file) => !excludes.some((re) => re.test(file.logical)) &&
+        (options.includeHidden ||
+            !p
+                .relative(root, file.logical)
+                .split('/')
+                .some((part) => part.startsWith('.'))));
+    return { root, files };
+}
+function copyFile(from, to) {
+    fs.mkdirSync(path.dirname(to), { recursive: true });
+    fs.copyFileSync(from, to);
+}
+function copyTree(from, to) {
+    fs.cpSync(from, to, { recursive: true });
+}
+function secureciDir(...parts) {
+    const home = process.env.HOME || process.env.USERPROFILE || os.tmpdir();
+    return path.join(home, '.secureci', ...parts);
+}
+const ok = (output, outputs = {}) => ({
+    success: true,
+    output,
+    outputs
+});
+const fail = (error) => ({
+    success: false,
+    output: '',
+    outputs: {},
+    error
+});
+const isTrue = (value) => value?.trim().toLowerCase() === 'true';
+/** Artifacts are kept per run, for 7 days. */
+const ARTIFACT_RETENTION_MS = 7 * 24 * 60 * 60 * 1000;
+function artifactsDir(runId) {
+    return secureciDir('artifacts', runId.replace(/[^\w.-]/g, '_'));
+}
+function pruneOldArtifacts() {
+    const base = secureciDir('artifacts');
+    let runs;
+    try {
+        runs = fs.readdirSync(base);
+    }
+    catch {
+        return;
+    }
+    for (const run of runs) {
+        const dir = path.join(base, run);
+        try {
+            if (Date.now() - fs.statSync(dir).mtimeMs > ARTIFACT_RETENTION_MS) {
+                fs.rmSync(dir, { recursive: true, force: true });
+            }
+        }
+        catch {
+            // Best effort
+        }
+    }
+}
+/**
+ * GitHub's invalid artifact-name characters, plus anything that would let a
+ * crafted name escape the per-run store (`/`, `\\`, `..`). The store path
+ * is built from the name, so an unchecked name like `../../../.ssh` would
+ * write onto the host even from a fully containerized job.
+ */
+function safeName(name) {
+    try {
+        assertSafeArtifactName(name);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function assertSafeArtifactName(name) {
+    if (name === '' ||
+        name === '.' ||
+        name === '..' ||
+        /[\\/"<>|:*?\r\n]/.test(name)) {
+        throw new Error(`Invalid artifact name: "${name}". Artifact names cannot be empty or contain any of: \\ / " < > | : * ? or line breaks.`);
+    }
+}
+/** `actions/upload-artifact`. */
+async function uploadArtifact(fsys, inputs, runId) {
+    const name = inputs.name || 'artifact';
+    try {
+        assertSafeArtifactName(name);
+    }
+    catch (error) {
+        return fail(error instanceof Error ? error.message : String(error));
+    }
+    if (!inputs.path)
+        return fail('Input required and not supplied: path');
+    const { root, files } = await collectFiles(fsys, inputs.path, {
+        includeHidden: isTrue(inputs['include-hidden-files'])
+    });
+    if (files.length === 0) {
+        const mode = (inputs['if-no-files-found'] || 'warn').toLowerCase();
+        const message = `No files were found with the provided path: ${inputs.path.trim()}. No artifacts will be uploaded.`;
+        if (mode === 'error')
+            return fail(message);
+        return { ...ok(''), ...(mode === 'ignore' ? {} : { warning: message }) };
+    }
+    pruneOldArtifacts();
+    const target = path.join(artifactsDir(runId), name);
+    if (fs.existsSync(target)) {
+        if (!isTrue(inputs.overwrite)) {
+            return fail(`An artifact with the name "${name}" already exists in this run; set overwrite: true to replace it`);
+        }
+        fs.rmSync(target, { recursive: true, force: true });
+    }
+    const digest = crypto.createHash('sha256');
+    for (const file of files.sort((a, b) => a.logical.localeCompare(b.logical))) {
+        const rel = fsys.path.relative(root, file.logical) ||
+            fsys.path.basename(file.logical);
+        copyFile(file.host, path.join(target, ...rel.split('/')));
+        digest.update(rel).update(fs.readFileSync(file.host));
+    }
+    const id = String(parseInt(crypto.createHash('sha1').update(target).digest('hex').slice(0, 8), 16));
+    return ok(`Uploaded ${files.length} file(s) as artifact "${name}" to ${target}`, {
+        'artifact-id': id,
+        'artifact-url': '',
+        'artifact-digest': digest.digest('hex')
+    });
+}
+/** `actions/download-artifact`. */
+async function downloadArtifact(fsys, inputs, runId) {
+    const store = artifactsDir(runId);
+    const available = fs.existsSync(store) ? fs.readdirSync(store).sort() : [];
+    const dest = resolveLogical(fsys, inputs.path || '.');
+    let names;
+    if (inputs.name) {
+        try {
+            assertSafeArtifactName(inputs.name);
+        }
+        catch (error) {
+            return fail(error instanceof Error ? error.message : String(error));
+        }
+        if (!available.includes(inputs.name)) {
+            return fail(`Artifact not found for name: ${inputs.name}`);
+        }
+        names = [inputs.name];
+    }
+    else {
+        const pattern = inputs.pattern ? (0, hash_files_1.globToRegExp)(inputs.pattern) : undefined;
+        names = available.filter((name) => safeName(name) && (!pattern || pattern.test(name)));
+    }
+    // A single named artifact, or merge-multiple, goes straight into path;
+    // otherwise each artifact gets its own <path>/<name> directory.
+    const flat = !!inputs.name || isTrue(inputs['merge-multiple']);
+    await fsys.writeInto(dest, (hostDest) => {
+        for (const name of names) {
+            copyTree(path.join(store, name), flat ? hostDest : path.join(hostDest, name));
+        }
+    });
+    return ok(`Downloaded ${names.length} artifact(s) to ${dest}${names.length ? `: ${names.join(', ')}` : ''}`, { 'download-path': dest });
+}
+function cacheScope(repository) {
+    return secureciDir('step-cache', repository.replace(/[^\w.-]+/g, '_') || 'default');
+}
+/** Caches are versioned by their paths, as on GitHub. */
+function cacheVersion(paths) {
+    return crypto
+        .createHash('sha256')
+        .update(paths
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean)
+        .join('\n'))
+        .digest('hex');
+}
+function cacheEntryDir(scope, version, key) {
+    return path.join(scope, crypto.createHash('sha256').update(`${version}\0${key}`).digest('hex'));
+}
+function findCache(scope, version, key, restoreKeys) {
+    const exact = cacheEntryDir(scope, version, key);
+    if (fs.existsSync(path.join(exact, 'meta.json'))) {
+        return { dir: exact, key, created: 0 };
+    }
+    let entries = [];
+    try {
+        entries = fs
+            .readdirSync(scope)
+            .map((name) => {
+            try {
+                const meta = JSON.parse(fs.readFileSync(path.join(scope, name, 'meta.json'), 'utf8'));
+                return meta.version === version
+                    ? {
+                        dir: path.join(scope, name),
+                        key: meta.key,
+                        created: meta.created
+                    }
+                    : undefined;
+            }
+            catch {
+                return undefined;
+            }
+        })
+            .filter((entry) => !!entry);
+    }
+    catch {
+        return undefined;
+    }
+    for (const prefix of restoreKeys) {
+        const match = entries
+            .filter((entry) => entry.key.startsWith(prefix))
+            .sort((a, b) => b.created - a.created)[0];
+        if (match)
+            return match;
+    }
+    return undefined;
+}
+/** Where a cached file is stored: relative to the workspace, home, or /. */
+function cachedLocation(fsys, logical) {
+    const p = fsys.path;
+    for (const [area, base] of [
+        ['workspace', fsys.workspace],
+        ['home', fsys.home]
+    ]) {
+        const rel = p.relative(base, logical);
+        if (rel && !rel.startsWith('..') && !p.isAbsolute(rel))
+            return `${area}/${rel}`;
+    }
+    return `root/${logical.replace(/^\/+/, '')}`;
+}
+async function restoreCache(fsys, entryDir) {
+    const files = path.join(entryDir, 'files');
+    for (const [area, base] of [
+        ['workspace', fsys.workspace],
+        ['home', fsys.home],
+        ['root', '/']
+    ]) {
+        const from = path.join(files, area);
+        if (fs.existsSync(from)) {
+            await fsys.writeInto(base, (hostDir) => copyTree(from, hostDir));
+        }
+    }
+}
+async function saveCache(fsys, scope, key, paths) {
+    const version = cacheVersion(paths);
+    const dir = cacheEntryDir(scope, version, key);
+    if (fs.existsSync(path.join(dir, 'meta.json'))) {
+        return ok(`Cache for key "${key}" already exists; not saving`);
+    }
+    const { files } = await collectFiles(fsys, paths, { includeHidden: true });
+    if (files.length === 0) {
+        return {
+            ...ok(''),
+            warning: 'Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.'
+        };
+    }
+    const staging = `${dir}.tmp-${process.pid}`;
+    fs.rmSync(staging, { recursive: true, force: true });
+    for (const file of files) {
+        copyFile(file.host, path.join(staging, 'files', ...cachedLocation(fsys, file.logical).split('/')));
+    }
+    fs.writeFileSync(path.join(staging, 'meta.json'), JSON.stringify({ key, version, created: Date.now() }));
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    fs.renameSync(staging, dir);
+    return ok(`Cache saved with key: ${key} (${files.length} file(s))`);
+}
+/** `actions/cache`, `actions/cache/restore` and `actions/cache/save`. */
+async function runCacheAction(kind, fsys, inputs, repository) {
+    const key = (inputs.key || '').trim();
+    const paths = inputs.path || '';
+    if (!key)
+        return fail('Input required and not supplied: key');
+    if (!paths.trim())
+        return fail('Input required and not supplied: path');
+    const scope = cacheScope(repository);
+    if (kind === 'cache-save')
+        return saveCache(fsys, scope, key, paths);
+    const restoreKeys = (inputs['restore-keys'] || '')
+        .split('\n')
+        .map((line) => line.trim())
+        .filter(Boolean);
+    const found = findCache(scope, cacheVersion(paths), key, restoreKeys);
+    const exact = found?.key === key;
+    if (!found && isTrue(inputs['fail-on-cache-miss'])) {
+        return fail(`Failed to restore cache entry. Exiting as fail-on-cache-miss is set. Input key: ${key}`);
+    }
+    if (found && !isTrue(inputs['lookup-only'])) {
+        await restoreCache(fsys, found.dir);
+    }
+    const outputs = { 'cache-primary-key': key };
+    if (found) {
+        outputs['cache-hit'] = String(exact);
+        outputs['cache-matched-key'] = found.key;
+    }
+    const result = ok(found
+        ? `Cache ${isTrue(inputs['lookup-only']) ? 'found' : 'restored'} from key: ${found.key}`
+        : `Cache not found for input keys: ${[key, ...restoreKeys].join(', ')}`, outputs);
+    if (kind === 'cache' && !exact && !isTrue(inputs['lookup-only'])) {
+        result.post = (postFs) => saveCache(postFs, scope, key, paths);
+    }
+    return result;
+}
+//# sourceMappingURL=builtin-actions.js.map

package/dist/runner/checkout.js

@@ -0,0 +1,142 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.copyWorkingCopy = copyWorkingCopy;
+exports.isLocalCheckout = isLocalCheckout;
+exports.localCheckout = localCheckout;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const logger_1 = require("../utils/logger");
+const expression_1 = require("./expression");
+/** Marks a `path:` copy made by localCheckout, so it may be replaced. */
+const CHECKOUT_MARKER = '.secureci-checkout';
+/**
+ * Copy `srcDir` into `dstDir`, skipping `exclude` (the copy's own location,
+ * which may lie inside `srcDir`) and earlier local checkout copies.
+ */
+function copyWorkingCopy(srcDir, dstDir, exclude) {
+    fs.mkdirSync(dstDir, { recursive: true });
+    for (const entry of fs.readdirSync(srcDir, { withFileTypes: true })) {
+        const src = path.join(srcDir, entry.name);
+        const dst = path.join(dstDir, entry.name);
+        if (src === exclude)
+            continue;
+        if (entry.isDirectory()) {
+            if (fs.existsSync(path.join(src, CHECKOUT_MARKER)))
+                continue;
+            if (exclude.startsWith(src + path.sep)) {
+                copyWorkingCopy(src, dst, exclude);
+                continue;
+            }
+        }
+        fs.cpSync(src, dst, {
+            recursive: true,
+            verbatimSymlinks: true,
+            filter: (file) => !fs.existsSync(path.join(file, CHECKOUT_MARKER))
+        });
+    }
+}
+/**
+ * Whether a step is `actions/checkout` of the repository being run (no
+ * `repository:` input, or the current one in any case), which is served
+ * from the local working copy rather than cloned.
+ */
+function isLocalCheckout(uses, withValues, ctx) {
+    if (!/^actions\/checkout@/i.test(uses))
+        return false;
+    const repository = (0, expression_1.substituteRecord)(withValues, ctx).repository ?? '';
+    return (repository === '' ||
+        repository.toLowerCase() === String(ctx.github.repository).toLowerCase());
+}
+/**
+ * `actions/checkout` of the current repository: the workspace already is
+ * the user's working copy (uncommitted changes included), so nothing is
+ * cloned and `.git` is never touched. With `path:`, the working copy is
+ * copied into that subdirectory and the copy is removed at job end.
+ */
+function localCheckout(step, ctx, runtime, startTime) {
+    const withValues = (0, expression_1.substituteRecord)(step.with, ctx);
+    const outputs = {
+        ref: String(ctx.github.ref ?? ''),
+        commit: String(ctx.github.sha ?? '')
+    };
+    const fail = (error) => {
+        logger_1.logger.error(error);
+        return { step, success: false, error, duration: Date.now() - startTime };
+    };
+    const ref = withValues.ref;
+    if (ref &&
+        ![ctx.github.ref, ctx.github.ref_name, ctx.github.sha].includes(ref)) {
+        logger_1.logger.warn(`actions/checkout: ignoring ref "${ref}"; using the local working copy (pass --no-local-checkout to run the real action)`);
+    }
+    const workspace = process.cwd();
+    const dest = path.resolve(workspace, withValues.path || '.');
+    const relative = path.relative(workspace, dest);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        return fail(`actions/checkout: path "${withValues.path}" is outside the workspace`);
+    }
+    let output = 'Using local working copy';
+    if (relative !== '') {
+        if (fs.existsSync(dest)) {
+            if (fs.existsSync(path.join(dest, CHECKOUT_MARKER))) {
+                fs.rmSync(dest, { recursive: true, force: true });
+            }
+            else if (fs.readdirSync(dest).length > 0) {
+                return fail(`actions/checkout: path "${withValues.path}" already exists in the working copy; remove it or pass --no-local-checkout`);
+            }
+        }
+        copyWorkingCopy(workspace, dest, dest);
+        fs.writeFileSync(path.join(dest, CHECKOUT_MARKER), '');
+        output = `Using local working copy (copied to ${relative})`;
+        const postStep = { name: `Post ${step.name || step.uses}` };
+        runtime.postSteps.push({
+            step: postStep,
+            condition: 'always()',
+            run: async () => {
+                fs.rmSync(dest, { recursive: true, force: true });
+                return { step: postStep, success: true, duration: 0 };
+            }
+        });
+    }
+    logger_1.logger.info(output);
+    return {
+        step,
+        success: true,
+        output,
+        outputs,
+        duration: Date.now() - startTime
+    };
+}
+//# sourceMappingURL=checkout.js.map