rampway 0.2.5 → 0.3.0

package/build/src/core/release-manager.d.ts

@@ -46,4 +46,15 @@ export function previousRelease(transport: import("#types").Transport, stage: im
  * @returns {Promise<string|null>}
  */
 export function currentReleaseId(transport: import("#types").Transport, stage: import("#types").StageConfig): Promise<string | null>;
+/**
+ * Strictly resolves the active release for an executable operation.
+ *
+ * @param {import('#types').Transport} transport
+ * @param {import('#types').StageConfig} stage
+ * @returns {Promise<{releaseId: string, releasePath: string}>}
+ */
+export function requireCurrentRelease(transport: import("#types").Transport, stage: import("#types").StageConfig): Promise<{
+    releaseId: string;
+    releasePath: string;
+}>;
 //# sourceMappingURL=release-manager.d.ts.map

package/build/src/core/release-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager.d.ts","sourceRoot":"","sources":["../../../src/core/release-manager.js"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,0CAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,IAAI,CAAC,CAQzB;AAED;;;;;GAKG;AACH,8CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,eAC5B,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAwBzB;AAWD;;;;;GAKG;AACH,0CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,eAC5B,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAOzB;AAED;;;;GAIG;AACH,wCAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAK7B;AAED;;;;;GAKG;AACH,2CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,aAC5B;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GACb,OAAO,CAAC,MAAM,EAAE,CAAC,CAU7B;AAED;;;;;GAKG;AACH,2CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,mBAC5B,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAOrC;AAED;;;;GAIG;AACH,4CAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAMhC"}
+{"version":3,"file":"release-manager.d.ts","sourceRoot":"","sources":["../../../src/core/release-manager.js"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,0CAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,IAAI,CAAC,CAQzB;AAED;;;;;GAKG;AACH,8CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,eAC5B,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAwBzB;AAWD;;;;;GAKG;AACH,0CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,eAC5B,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAOzB;AAED;;;;GAIG;AACH,wCAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAK7B;AAED;;;;;GAKG;AACH,2CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,aAC5B;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAC,GACb,OAAO,CAAC,MAAM,EAAE,CAAC,CAU7B;AAED;;;;;GAKG;AACH,2CALW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,mBAC5B,MAAM,GAAC,IAAI,GACT,OAAO,CAAC,MAAM,GAAC,SAAS,CAAC,CAOrC;AAED;;;;GAIG;AACH,4CAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC,MAAM,GAAC,IAAI,CAAC,CAMhC;AAED;;;;;;GAMG;AACH,iDAJW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAC,CAAC,CAe7D"}

package/build/src/core/release-manager.js

@@ -112,4 +112,26 @@ export async function currentReleaseId(transport, stage) {
         return null;
     return path.basename(await transport.readlink(currentPath));
 }
+/**
+ * Strictly resolves the active release for an executable operation.
+ *
+ * @param {import('#types').Transport} transport
+ * @param {import('#types').StageConfig} stage
+ * @returns {Promise<{releaseId: string, releasePath: string}>}
+ */
+export async function requireCurrentRelease(transport, stage) {
+    const paths = deployPaths(stage);
+    if (!await transport.exists(paths.currentPath))
+        throw new Error(`No current release exists at ${paths.currentPath}.`);
+    const target = await transport.readlink(paths.currentPath);
+    const releasesPath = path.resolve(paths.releasesPath);
+    const releasePath = path.resolve(path.dirname(paths.currentPath), target);
+    const relative = path.relative(releasesPath, releasePath);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative) || relative.includes(path.sep)) {
+        throw new Error(`Current release target must resolve to one direct child of ${releasesPath}.`);
+    }
+    if (!await transport.exists(releasePath))
+        throw new Error(`Current release '${relative}' does not exist at ${releasePath}.`);
+    return { releaseId: relative, releasePath };
+}
 //# sourceMappingURL=release-manager.js.map

package/build/src/core/release-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-manager.js","sourceRoot":"","sources":["../../../src/core/release-manager.js"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAC,WAAW,EAAC,MAAM,YAAY,CAAA;AAEtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAS,EAAE,KAAK;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC1C,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IACtD,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW;IACpE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACvE,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;QACjC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAA;YACtF,SAAQ;QACV,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACvD,MAAM,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;QACjC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAK;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAC,CAAA;IACnE,OAAO,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAC,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACnE,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAS,EAAE,KAAK;IACjD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAA;IACtE,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,EAAC,IAAI,GAAG,KAAK,CAAC,YAAY,EAAC,GAAG,EAAE;IACtF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACrD,IAAI,cAAc,GAAG,IAAI,CAAA;IACzB,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1H,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,cAAc,CAAC,CAAA;IACtH,KAAK,MAAM,OAAO,IAAI,SAAS;QAAE,MAAM,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAC3E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,cAAc,IAAI,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC1E,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAClE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAS,EAAE,KAAK;IACrD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,CAAA;IAClD,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7D,CAAC"}
+{"version":3,"file":"release-manager.js","sourceRoot":"","sources":["../../../src/core/release-manager.js"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAC,WAAW,EAAC,MAAM,YAAY,CAAA;AAEtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAS,EAAE,KAAK;IACnD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IAC1C,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAA;IACtD,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW;IACpE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACvE,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QACpC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;QACtD,MAAM,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;QACjC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,CAAA;IAC7D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACxE,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1C,IAAI,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,YAAY,EAAE,CAAC,CAAA;YACtF,SAAQ;QACV,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACvD,MAAM,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,CAAA;QACjC,MAAM,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;QACnD,MAAM,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAK;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAC,CAAA;IACnE,OAAO,EAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAC,CAAA;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW;IAChE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IACnE,MAAM,SAAS,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACpD,MAAM,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAAS,EAAE,KAAK;IACjD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAA;IACtE,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,EAAC,IAAI,GAAG,KAAK,CAAC,YAAY,EAAC,GAAG,EAAE;IACtF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACrD,IAAI,cAAc,GAAG,IAAI,CAAA;IACzB,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1H,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,cAAc,CAAC,CAAA;IACtH,KAAK,MAAM,OAAO,IAAI,SAAS;QAAE,MAAM,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAS,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI;IAC3E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,cAAc,IAAI,MAAM,gBAAgB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC1E,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;IAClE,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAS,EAAE,KAAK;IACrD,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,WAAW,CAAA;IAClD,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAA;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,SAAS,EAAE,KAAK;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;IAChC,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAA;IAErH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;IAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;IACrD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvI,MAAM,IAAI,KAAK,CAAC,8DAA8D,YAAY,GAAG,CAAC,CAAA;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,uBAAuB,WAAW,GAAG,CAAC,CAAA;IAC5H,OAAO,EAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAC,CAAA;AAC3C,CAAC"}

package/build/src/core/reporter.d.ts

@@ -26,13 +26,14 @@ export function jsonReporter(): Reporter;
  */
 export class Reporter {
     /**
-     * @param {{lifecycle?: boolean, streamCommands?: boolean, out?: import('node:stream').Writable, err?: import('node:stream').Writable}} [opts]
+     * @param {{lifecycle?: boolean, streamCommands?: boolean, out?: import('node:stream').Writable, err?: import('node:stream').Writable, logStream?: import('node:stream').Writable|null}} [opts]
      */
-    constructor({ lifecycle, streamCommands, out, err }?: {
+    constructor({ lifecycle, streamCommands, out, err, logStream }?: {
         lifecycle?: boolean;
         streamCommands?: boolean;
         out?: import("node:stream").Writable;
         err?: import("node:stream").Writable;
+        logStream?: import("node:stream").Writable | null;
     });
     /** @type {boolean} */
     lifecycleEnabled: boolean;
@@ -42,26 +43,56 @@ export class Reporter {
     out: import("node:stream").Writable;
     /** @type {import('node:stream').Writable} */
     err: import("node:stream").Writable;
+    /**
+     * Optional persistent per-deploy log. When attached, every lifecycle line
+     * and streamed command chunk is tee'd here in addition to the live
+     * stdout/stderr contract, so a full deploy transcript survives on disk.
+     *
+     * @type {import('node:stream').Writable|null}
+     */
+    logStream: import("node:stream").Writable | null;
     /**
      * Whether live command stdout/stderr should be streamed as it arrives.
      *
      * @returns {boolean}
      */
     get streamsCommands(): boolean;
+    /**
+     * Whether the transport should feed redacted command output to the reporter at
+     * all — either to live-stream it or to persist it to the deploy log. This is
+     * decoupled from {@link streamsCommands} so a `--json` deploy still records a
+     * full command transcript in its log even though nothing is streamed live.
+     *
+     * @returns {boolean}
+     */
+    get capturesCommands(): boolean;
+    /**
+     * Attaches a persistent per-deploy log stream after construction. The deploy
+     * command builds the reporter before the config (and therefore the log path)
+     * is known, so the log is tee'd in once resolved.
+     *
+     * @param {import('node:stream').Writable|null} stream
+     * @returns {void}
+     */
+    attachLogStream(stream: import("node:stream").Writable | null): void;
     /**
      * Prints a Capistrano-style lifecycle line in human mode; no-op otherwise.
+     * The line is always tee'd to the persistent log (when attached) so the log
+     * stays readable even for a `--json` automation deploy.
      *
      * @param {string} message
      * @returns {void}
      */
     line(message: string): void;
     /**
-     * Writes already-redacted streamed command output to the error stream. The
-     * error stream is used so human deploy stdout stays reserved for lifecycle
-     * progress and the final summary, and JSON stdout stays clean.
+     * Records already-redacted command output. It is always tee'd to the deploy
+     * log when one is attached, so the log is a full transcript regardless of
+     * output mode. It is streamed live to the error stream only when
+     * {@link streamsCommands} is set (human mode) — the error stream keeps human
+     * stdout reserved for lifecycle progress and JSON stdout clean.
      *
      * @param {string} text
-     * @returns {boolean}
+     * @returns {boolean} Backpressure signal: `false` asks the caller to pause. Only the live stream can request a pause; log-only writes never do.
      */
     writeCommandOutput(text: string): boolean;
 }

package/build/src/core/reporter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../../src/core/reporter.js"],"names":[],"mappings":"AA+DA;;;;GAIG;AACH,iCAFa,QAAQ,CAIpB;AAED;;;;;GAKG;AACH,gCAFa,QAAQ,CAIpB;AA9ED;;;;;;;;GAQG;AAEH;;;GAGG;AACH;IACE;;OAEG;IACH,sDAFW;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,aAAa,EAAE,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,aAAa,EAAE,QAAQ,CAAA;KAAC,EAWrI;IARC,sBAAsB;IACtB,kBADW,OAAO,CACe;IACjC,sBAAsB;IACtB,gBADW,OAAO,CACkB;IACpC,6CAA6C;IAC7C,KADW,OAAO,aAAa,EAAE,QAAQ,CAC3B;IACd,6CAA6C;IAC7C,KADW,OAAO,aAAa,EAAE,QAAQ,CAC3B;IAGhB;;;;OAIG;IACH,uBAFa,OAAO,CAInB;IAED;;;;;OAKG;IACH,cAHW,MAAM,GACJ,IAAI,CAIhB;IAED;;;;;;;OAOG;IACH,yBAHW,MAAM,GACJ,OAAO,CAInB;CACF"}
+{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../../src/core/reporter.js"],"names":[],"mappings":"AAsGA;;;;GAIG;AACH,iCAFa,QAAQ,CAIpB;AAED;;;;;GAKG;AACH,gCAFa,QAAQ,CAIpB;AArHD;;;;;;;;GAQG;AAEH;;;GAGG;AACH;IACE;;OAEG;IACH,iEAFW;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,aAAa,EAAE,QAAQ,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,aAAa,EAAE,QAAQ,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,aAAa,EAAE,QAAQ,GAAC,IAAI,CAAA;KAAC,EAmBtL;IAhBC,sBAAsB;IACtB,kBADW,OAAO,CACe;IACjC,sBAAsB;IACtB,gBADW,OAAO,CACkB;IACpC,6CAA6C;IAC7C,KADW,OAAO,aAAa,EAAE,QAAQ,CAC3B;IACd,6CAA6C;IAC7C,KADW,OAAO,aAAa,EAAE,QAAQ,CAC3B;IACd;;;;;;OAMG;IACH,WAFU,OAAO,aAAa,EAAE,QAAQ,GAAC,IAAI,CAEnB;IAG5B;;;;OAIG;IACH,uBAFa,OAAO,CAInB;IAED;;;;;;;OAOG;IACH,wBAFa,OAAO,CAInB;IAED;;;;;;;OAOG;IACH,wBAHW,OAAO,aAAa,EAAE,QAAQ,GAAC,IAAI,GACjC,IAAI,CAIhB;IAED;;;;;;;OAOG;IACH,cAHW,MAAM,GACJ,IAAI,CAKhB;IAED;;;;;;;;;OASG;IACH,yBAHW,MAAM,GACJ,OAAO,CAMnB;CACF"}

package/build/src/core/reporter.js

@@ -14,9 +14,9 @@
  */
 export class Reporter {
     /**
-     * @param {{lifecycle?: boolean, streamCommands?: boolean, out?: import('node:stream').Writable, err?: import('node:stream').Writable}} [opts]
+     * @param {{lifecycle?: boolean, streamCommands?: boolean, out?: import('node:stream').Writable, err?: import('node:stream').Writable, logStream?: import('node:stream').Writable|null}} [opts]
      */
-    constructor({ lifecycle = true, streamCommands = true, out = process.stdout, err = process.stderr } = {}) {
+    constructor({ lifecycle = true, streamCommands = true, out = process.stdout, err = process.stderr, logStream = null } = {}) {
         /** @type {boolean} */
         this.lifecycleEnabled = lifecycle;
         /** @type {boolean} */
@@ -25,6 +25,14 @@ export class Reporter {
         this.out = out;
         /** @type {import('node:stream').Writable} */
         this.err = err;
+        /**
+         * Optional persistent per-deploy log. When attached, every lifecycle line
+         * and streamed command chunk is tee'd here in addition to the live
+         * stdout/stderr contract, so a full deploy transcript survives on disk.
+         *
+         * @type {import('node:stream').Writable|null}
+         */
+        this.logStream = logStream;
     }
     /**
      * Whether live command stdout/stderr should be streamed as it arrives.
@@ -34,8 +42,32 @@ export class Reporter {
     get streamsCommands() {
         return this.streamCommands;
     }
+    /**
+     * Whether the transport should feed redacted command output to the reporter at
+     * all — either to live-stream it or to persist it to the deploy log. This is
+     * decoupled from {@link streamsCommands} so a `--json` deploy still records a
+     * full command transcript in its log even though nothing is streamed live.
+     *
+     * @returns {boolean}
+     */
+    get capturesCommands() {
+        return this.streamCommands || this.logStream !== null;
+    }
+    /**
+     * Attaches a persistent per-deploy log stream after construction. The deploy
+     * command builds the reporter before the config (and therefore the log path)
+     * is known, so the log is tee'd in once resolved.
+     *
+     * @param {import('node:stream').Writable|null} stream
+     * @returns {void}
+     */
+    attachLogStream(stream) {
+        this.logStream = stream;
+    }
     /**
      * Prints a Capistrano-style lifecycle line in human mode; no-op otherwise.
+     * The line is always tee'd to the persistent log (when attached) so the log
+     * stays readable even for a `--json` automation deploy.
      *
      * @param {string} message
      * @returns {void}
@@ -43,16 +75,24 @@ export class Reporter {
     line(message) {
         if (this.lifecycleEnabled)
             this.out.write(`${message}\n`);
+        if (this.logStream)
+            this.logStream.write(`${message}\n`);
     }
     /**
-     * Writes already-redacted streamed command output to the error stream. The
-     * error stream is used so human deploy stdout stays reserved for lifecycle
-     * progress and the final summary, and JSON stdout stays clean.
+     * Records already-redacted command output. It is always tee'd to the deploy
+     * log when one is attached, so the log is a full transcript regardless of
+     * output mode. It is streamed live to the error stream only when
+     * {@link streamsCommands} is set (human mode) — the error stream keeps human
+     * stdout reserved for lifecycle progress and JSON stdout clean.
      *
      * @param {string} text
-     * @returns {boolean}
+     * @returns {boolean} Backpressure signal: `false` asks the caller to pause. Only the live stream can request a pause; log-only writes never do.
      */
     writeCommandOutput(text) {
+        if (this.logStream)
+            this.logStream.write(text);
+        if (!this.streamCommands)
+            return true;
         return this.err.write(text);
     }
 }

package/build/src/core/reporter.js.map

@@ -1 +1 @@
-{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/core/reporter.js"],"names":[],"mappings":"AAAA,YAAY;AAEZ;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,OAAO,QAAQ;IACnB;;OAEG;IACH,YAAY,EAAC,SAAS,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAC,GAAG,EAAE;QACpG,sBAAsB;QACtB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAA;QACjC,sBAAsB;QACtB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,6CAA6C;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,6CAA6C;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED;;;;OAIG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;OAKG;IACH,IAAI,CAAC,OAAO;QACV,IAAI,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;IAC3D,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAAC,IAAI;QACrB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAC,CAAC,CAAA;AAChE,CAAC"}
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/core/reporter.js"],"names":[],"mappings":"AAAA,YAAY;AAEZ;;;;;;;;GAQG;AAEH;;;GAGG;AACH,MAAM,OAAO,QAAQ;IACnB;;OAEG;IACH,YAAY,EAAC,SAAS,GAAG,IAAI,EAAE,cAAc,GAAG,IAAI,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,EAAC,GAAG,EAAE;QACtH,sBAAsB;QACtB,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAA;QACjC,sBAAsB;QACtB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAA;QACpC,6CAA6C;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd,6CAA6C;QAC7C,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;QACd;;;;;;WAMG;QACH,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAED;;;;OAIG;IACH,IAAI,eAAe;QACjB,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,gBAAgB;QAClB,OAAO,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAA;IACvD,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,MAAM;QACpB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAA;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO;QACV,IAAI,IAAI,CAAC,gBAAgB;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;QACzD,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAA;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,kBAAkB,CAAC,IAAI;QACrB,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAA;QACrC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAC,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAC,CAAC,CAAA;AAChE,CAAC"}

package/build/src/core/task-runner.d.ts

@@ -30,12 +30,14 @@ export function normalizeTask(name: string, entry: string | import("#types").Tas
  * @param {import('#types').Transport} transport
  * @param {import('#types').TaskEntry} task
  * @param {string} cwd
- * @param {{previousReleasePath?: string|null, reporter?: Reporter}} [opts]
+ * @param {{previousReleasePath?: string|null, reporter?: Reporter, secretEnv?: Record<string, string>, strictCwd?: boolean}} [opts]
  * @returns {Promise<import('#types').TaskResult>}
  */
-export function runTask(transport: import("#types").Transport, task: import("#types").TaskEntry, cwd: string, { previousReleasePath, reporter }?: {
+export function runTask(transport: import("#types").Transport, task: import("#types").TaskEntry, cwd: string, { previousReleasePath, reporter, secretEnv, strictCwd }?: {
     previousReleasePath?: string | null;
     reporter?: Reporter;
+    secretEnv?: Record<string, string>;
+    strictCwd?: boolean;
 }): Promise<import("#types").TaskResult>;
 import { Reporter } from "./reporter.js";
 //# sourceMappingURL=task-runner.d.ts.map

package/build/src/core/task-runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../../../src/core/task-runner.js"],"names":[],"mappings":"AAKA;;;GAGG;AACH,oCAHW,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,QAAQ,EAAE,SAAS,EAAE,CAQxC;AAED;;;;;;GAMG;AACH,oCANW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,eAC5B,MAAM,sCACN;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAC,GACtD,OAAO,CAAC,OAAO,QAAQ,EAAE,UAAU,EAAE,CAAC,CAQlD;AAED;;;;GAIG;AACH,yCAJW,MAAM,WACN,MAAM,GAAC,OAAO,QAAQ,EAAE,SAAS,GAAC,KAAK,CAAC,MAAM,GAAC,OAAO,QAAQ,EAAE,SAAS,CAAC,GACxE,OAAO,QAAQ,EAAE,SAAS,EAAE,CASxC;AAED;;;;GAIG;AACH,oCAJW,MAAM,SACN,MAAM,GAAC,OAAO,QAAQ,EAAE,SAAS,GAC/B,OAAO,QAAQ,EAAE,SAAS,CAOtC;AAED;;;;;;GAMG;AACH,mCANW,OAAO,QAAQ,EAAE,SAAS,QAC1B,OAAO,QAAQ,EAAE,SAAS,OAC1B,MAAM,sCACN;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAC,GACtD,OAAO,CAAC,OAAO,QAAQ,EAAE,UAAU,CAAC,CAyBhD;yBAtFsB,eAAe"}
+{"version":3,"file":"task-runner.d.ts","sourceRoot":"","sources":["../../../src/core/task-runner.js"],"names":[],"mappings":"AAMA;;;GAGG;AACH,oCAHW,OAAO,QAAQ,EAAE,WAAW,GAC1B,OAAO,QAAQ,EAAE,SAAS,EAAE,CAQxC;AAED;;;;;;GAMG;AACH,oCANW,OAAO,QAAQ,EAAE,SAAS,SAC1B,OAAO,QAAQ,EAAE,WAAW,eAC5B,MAAM,sCACN;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAA;CAAC,GACtD,OAAO,CAAC,OAAO,QAAQ,EAAE,UAAU,EAAE,CAAC,CAQlD;AAED;;;;GAIG;AACH,yCAJW,MAAM,WACN,MAAM,GAAC,OAAO,QAAQ,EAAE,SAAS,GAAC,KAAK,CAAC,MAAM,GAAC,OAAO,QAAQ,EAAE,SAAS,CAAC,GACxE,OAAO,QAAQ,EAAE,SAAS,EAAE,CASxC;AAED;;;;GAIG;AACH,oCAJW,MAAM,SACN,MAAM,GAAC,OAAO,QAAQ,EAAE,SAAS,GAC/B,OAAO,QAAQ,EAAE,SAAS,CAOtC;AAED;;;;;;GAMG;AACH,mCANW,OAAO,QAAQ,EAAE,SAAS,QAC1B,OAAO,QAAQ,EAAE,SAAS,OAC1B,MAAM,4DACN;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAC,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAC,GAC/G,OAAO,CAAC,OAAO,QAAQ,EAAE,UAAU,CAAC,CAgChD;yBA7FsB,eAAe"}

package/build/src/core/task-runner.js

@@ -1,4 +1,5 @@
 // @ts-check
+import path from "node:path";
 import { redactText } from "./redaction.js";
 import { Reporter } from "./reporter.js";
 import { pathsChanged } from "./path-change-gate.js";
@@ -58,10 +59,10 @@ export function normalizeTask(name, entry) {
  * @param {import('#types').Transport} transport
  * @param {import('#types').TaskEntry} task
  * @param {string} cwd
- * @param {{previousReleasePath?: string|null, reporter?: Reporter}} [opts]
+ * @param {{previousReleasePath?: string|null, reporter?: Reporter, secretEnv?: Record<string, string>, strictCwd?: boolean}} [opts]
  * @returns {Promise<import('#types').TaskResult>}
  */
-export async function runTask(transport, task, cwd, { previousReleasePath, reporter = new Reporter({ lifecycle: false }) } = {}) {
+export async function runTask(transport, task, cwd, { previousReleasePath, reporter = new Reporter({ lifecycle: false }), secretEnv, strictCwd = false } = {}) {
     if (task.onlyIfChanged && previousReleasePath) {
         const changed = await pathsChanged(transport, previousReleasePath, cwd, task.onlyIfChanged);
         if (!changed) {
@@ -69,22 +70,47 @@ export async function runTask(transport, task, cwd, { previousReleasePath, repor
             return taskResult(task, task.optional === true, "skipped", undefined, "no paths changed");
         }
     }
-    const taskCwd = task.cwd ? `${cwd}/${task.cwd}` : cwd;
+    const taskCwd = resolveTaskCwd(cwd, task.cwd, strictCwd);
     const optional = task.optional === true;
-    reporter.line(`  * Running task ${task.name}: ${redactText(task.command)}`);
+    const knownSecrets = Object.values(secretEnv ?? {});
+    reporter.line(`  * Running task ${task.name}: ${redactText(task.command, knownSecrets)}`);
     try {
-        await transport.run(task.command, { cwd: taskCwd, env: task.env ?? {} });
+        const runOptions = {
+            cwd: taskCwd,
+            env: task.env ?? {},
+            ...(secretEnv === undefined ? {} : { secretEnv })
+        };
+        await transport.run(task.command, runOptions);
         return taskResult(task, optional, "passed", undefined);
     }
     catch (error) {
         if (optional) {
             const err = /** @type {Error} */ (error);
-            reporter.line(`  * Optional task '${task.name}' failed: ${err.message}`);
-            return taskResult(task, optional, "failed", err);
+            const redactedError = new Error(redactText(err.message, knownSecrets));
+            reporter.line(`  * Optional task '${task.name}' failed: ${redactedError.message}`);
+            return taskResult(task, optional, "failed", redactedError);
         }
         const err = /** @type {Error} */ (error);
-        throw new Error(`Task '${task.name}' failed while running ${redactText(task.command)}: ${err.message}`);
+        throw new Error(`Task '${task.name}' failed while running ${redactText(task.command, knownSecrets)}: ${redactText(err.message, knownSecrets)}`);
+    }
+}
+/**
+ * @param {string} releasePath
+ * @param {string|undefined} taskCwd
+ * @param {boolean} strict
+ * @returns {string}
+ */
+function resolveTaskCwd(releasePath, taskCwd, strict) {
+    if (!taskCwd)
+        return releasePath;
+    if (!strict)
+        return `${releasePath}/${taskCwd}`;
+    const resolved = path.resolve(releasePath, taskCwd);
+    const relative = path.relative(path.resolve(releasePath), resolved);
+    if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+        throw new Error(`Task working directory '${taskCwd}' escapes active release ${releasePath}.`);
     }
+    return resolved;
 }
 /**
  * @param {import('#types').TaskEntry} task

package/build/src/core/task-runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"task-runner.js","sourceRoot":"","sources":["../../../src/core/task-runner.js"],"names":[],"mappings":"AAAA,YAAY;AACZ,OAAO,EAAC,UAAU,EAAC,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAA;AACtC,OAAO,EAAC,YAAY,EAAC,MAAM,uBAAuB,CAAA;AAElD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAK;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAA;IACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAC,mBAAmB,EAAE,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK,EAAC,CAAC,EAAC,GAAG,EAAE;IACnI,MAAM,OAAO,GAAG,EAAE,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAC,mBAAmB,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAI,EAAE,OAAO;IAC9C,MAAM,QAAQ,GAAG,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAI,EAAE,KAAK;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,uDAAuD,CAAC,CAAA;IACtJ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAA;IAC1H,OAAO,EAAC,IAAI,EAAE,GAAG,KAAK,EAAC,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,mBAAmB,EAAE,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK,EAAC,CAAC,EAAC,GAAG,EAAE;IACzH,IAAI,IAAI,CAAC,aAAa,IAAI,mBAAmB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAA;IACvC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC3E,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE,EAAC,CAAC,CAAA;QACtE,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAA;YACxC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACxE,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QAClD,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,0BAA0B,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;IACzG,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU;IAC3D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAA;AACH,CAAC"}
+{"version":3,"file":"task-runner.js","sourceRoot":"","sources":["../../../src/core/task-runner.js"],"names":[],"mappings":"AAAA,YAAY;AACZ,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAC,UAAU,EAAC,MAAM,gBAAgB,CAAA;AACzC,OAAO,EAAC,QAAQ,EAAC,MAAM,eAAe,CAAA;AACtC,OAAO,EAAC,YAAY,EAAC,MAAM,uBAAuB,CAAA;AAElD;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAK;IAChC,MAAM,QAAQ,GAAG,EAAE,CAAA;IACnB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,QAAQ,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,EAAC,mBAAmB,EAAE,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK,EAAC,CAAC,EAAC,GAAG,EAAE;IACnI,MAAM,OAAO,GAAG,EAAE,CAAA;IAClB,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,EAAC,mBAAmB,EAAE,QAAQ,EAAC,CAAC,CAAC,CAAA;IAC5F,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAI,EAAE,OAAO;IAC9C,MAAM,QAAQ,GAAG,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACzD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAI,EAAE,KAAK;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAC,CAAA;IAC5D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,uDAAuD,CAAC,CAAA;IACtJ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAA;IAC1H,OAAO,EAAC,IAAI,EAAE,GAAG,KAAK,EAAC,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,EAAC,mBAAmB,EAAE,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAC,SAAS,EAAE,KAAK,EAAC,CAAC,EAAE,SAAS,EAAE,SAAS,GAAG,KAAK,EAAC,GAAG,EAAE;IACvJ,IAAI,IAAI,CAAC,aAAa,IAAI,mBAAmB,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,CAAC,CAAA;QAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAA;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;IACnD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;IACzF,IAAI,CAAC;QACH,MAAM,UAAU,GAAG;YACjB,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,EAAE;YACnB,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAC,SAAS,EAAC,CAAC;SAChD,CAAA;QACD,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;QAC7C,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAA;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAA;YACxC,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;YACtE,QAAQ,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,IAAI,aAAa,aAAa,CAAC,OAAO,EAAE,CAAC,CAAA;YAClF,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAA;QAC5D,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,IAAI,0BAA0B,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC,CAAA;IACjJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,WAAW,CAAA;IAChC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,WAAW,IAAI,OAAO,EAAE,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAA;IACnE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,4BAA4B,WAAW,GAAG,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU;IAC3D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAC,UAAU,EAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAA;AACH,CAAC"}

package/build/src/transports/local-transport.d.ts

@@ -46,6 +46,22 @@ export class LocalTransport {
      * @returns {Promise<void>}
      */
     writeFile(filePath: string, content: string): Promise<void>;
+    /**
+     * @param {string} filePath
+     * @param {string} content
+     * @returns {Promise<boolean>}
+     */
+    writeFileExclusive(filePath: string, content: string): Promise<boolean>;
+    /**
+     * Removes a file only while it still contains the exact expected content.
+     * Conditional removers are serialized by a kernel-owned advisory lock, which
+     * is released if the remover is interrupted.
+     *
+     * @param {string} filePath
+     * @param {string} expectedContent
+     * @returns {Promise<boolean>}
+     */
+    removeFileIfContent(filePath: string, expectedContent: string): Promise<boolean>;
     /**
      * @param {string} filePath
      * @returns {Promise<string>}
@@ -64,12 +80,13 @@ export class LocalTransport {
     copyDir(from: string, to: string): Promise<void>;
     /**
      * @param {string} command
-     * @param {{cwd?: string, env?: Record<string, string>}} [opts]
+     * @param {{cwd?: string, env?: Record<string, string>, secretEnv?: Record<string, string>}} [opts]
      * @returns {Promise<import('#types').SpawnResult>}
      */
-    run(command: string, { cwd, env }?: {
+    run(command: string, { cwd, env, secretEnv }?: {
         cwd?: string;
         env?: Record<string, string>;
+        secretEnv?: Record<string, string>;
     }): Promise<import("#types").SpawnResult>;
 }
 //# sourceMappingURL=local-transport.d.ts.map

package/build/src/transports/local-transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-transport.d.ts","sourceRoot":"","sources":["../../../src/transports/local-transport.js"],"names":[],"mappings":"AAOA;IACE;;OAEG;IACH,2BAFW;QAAC,QAAQ,CAAC,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;KAAC,EAK7D;IAFC,qDAAqD;IACrD,UADW,OAAO,qBAAqB,EAAE,QAAQ,CACzB;IAG1B;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,OAAO,CAAC,CAW5B;IAED;;;;;OAKG;IACH,gBALW,MAAM,YACN,MAAM,SACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CAI3B;IAED;;;OAGG;IACH,eAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;;OAIG;IACH,aAJW,MAAM,MACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;;OAIG;IACH,oBAJW,MAAM,WACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CAI3B;IAED;;;OAGG;IACH,iBAHW,MAAM,GACJ,OAAO,CAAC,MAAM,EAAE,CAAC,CAU7B;IAED;;;;OAIG;IACH,cAJW,MAAM,MACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;;OAIG;IACH,aAJW,MAAM,iBACN;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAC,GAC1C,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAqCjD;CACF"}
+{"version":3,"file":"local-transport.d.ts","sourceRoot":"","sources":["../../../src/transports/local-transport.js"],"names":[],"mappings":"AAOA;IACE;;OAEG;IACH,2BAFW;QAAC,QAAQ,CAAC,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;KAAC,EAK7D;IAFC,qDAAqD;IACrD,UADW,OAAO,qBAAqB,EAAE,QAAQ,CACzB;IAG1B;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,OAAO,CAAC,CAW5B;IAED;;;;;OAKG;IACH,gBALW,MAAM,YACN,MAAM,SACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CAI3B;IAED;;;OAGG;IACH,eAHW,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;;OAIG;IACH,aAJW,MAAM,MACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;;OAIG;IACH,oBAJW,MAAM,WACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAKzB;IAED;;;;OAIG;IACH,6BAJW,MAAM,WACN,MAAM,GACJ,OAAO,CAAC,OAAO,CAAC,CAY5B;IAED;;;;;;;;OAQG;IACH,8BAJW,MAAM,mBACN,MAAM,GACJ,OAAO,CAAC,OAAO,CAAC,CAc5B;IAED;;;OAGG;IACH,mBAHW,MAAM,GACJ,OAAO,CAAC,MAAM,CAAC,CAI3B;IAED;;;OAGG;IACH,iBAHW,MAAM,GACJ,OAAO,CAAC,MAAM,EAAE,CAAC,CAU7B;IAED;;;;OAIG;IACH,cAJW,MAAM,MACN,MAAM,GACJ,OAAO,CAAC,IAAI,CAAC,CAIzB;IAED;;;;OAIG;IACH,aAJW,MAAM,4BACN;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAC,GAC9E,OAAO,CAAC,OAAO,QAAQ,EAAE,WAAW,CAAC,CAuCjD;CACF"}

package/build/src/transports/local-transport.js

@@ -2,7 +2,7 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { spawn } from "node:child_process";
-import { redactText, StreamingRedactor } from "../core/redaction.js";
+import { isValidEnvironmentName, redactText, StreamingRedactor } from "../core/redaction.js";
 import { Reporter } from "../core/reporter.js";
 export class LocalTransport {
     /**
@@ -75,6 +75,45 @@ export class LocalTransport {
         await fs.mkdir(path.dirname(filePath), { recursive: true });
         await fs.writeFile(filePath, content);
     }
+    /**
+     * @param {string} filePath
+     * @param {string} content
+     * @returns {Promise<boolean>}
+     */
+    async writeFileExclusive(filePath, content) {
+        await fs.mkdir(path.dirname(filePath), { recursive: true });
+        try {
+            await fs.writeFile(filePath, content, { flag: "wx" });
+            return true;
+        }
+        catch (error) {
+            const err = /** @type {{code?: string}} */ (error);
+            if (err.code === "EEXIST")
+                return false;
+            throw error;
+        }
+    }
+    /**
+     * Removes a file only while it still contains the exact expected content.
+     * Conditional removers are serialized by a kernel-owned advisory lock, which
+     * is released if the remover is interrupted.
+     *
+     * @param {string} filePath
+     * @param {string} expectedContent
+     * @returns {Promise<boolean>}
+     */
+    async removeFileIfContent(filePath, expectedContent) {
+        const guardPath = `${filePath}.rampway-remove`;
+        await fs.mkdir(guardPath, { recursive: true });
+        const exitCode = await runConditionalRemove(path.join(guardPath, "guard.lock"), filePath, expectedContent);
+        if (exitCode === 0)
+            return true;
+        if (exitCode === 75)
+            throw new Error(`File ownership removal is already in progress: ${filePath}`);
+        if (exitCode === 76)
+            return false;
+        throw new Error(`Conditional file removal failed with exit ${exitCode ?? "unknown"}: ${filePath}`);
+    }
     /**
      * @param {string} filePath
      * @returns {Promise<string>}
@@ -107,19 +146,21 @@ export class LocalTransport {
     }
     /**
      * @param {string} command
-     * @param {{cwd?: string, env?: Record<string, string>}} [opts]
+     * @param {{cwd?: string, env?: Record<string, string>, secretEnv?: Record<string, string>}} [opts]
      * @returns {Promise<import('#types').SpawnResult>}
      */
-    async run(command, { cwd, env = {} } = {}) {
-        const shouldStream = this.reporter.streamsCommands;
+    async run(command, { cwd, env = {}, secretEnv = {} } = {}) {
+        validateEnvironment(env, secretEnv);
+        const knownSecrets = Object.values(secretEnv);
+        const shouldCapture = this.reporter.capturesCommands;
         return await new Promise((resolve, reject) => {
-            const child = spawn(command, { cwd, env: { ...process.env, ...env }, shell: true });
+            const child = spawn(command, { cwd, env: { ...process.env, ...env, ...secretEnv }, shell: true });
             let output = "";
-            const redactor = new StreamingRedactor();
+            const redactor = new StreamingRedactor({ knownSecrets });
             const emit = /** @param {Buffer|string} chunk */ /** @param {Buffer|string} chunk */ chunk => {
                 const text = chunk.toString();
                 output += text;
-                if (!shouldStream)
+                if (!shouldCapture)
                     return;
                 const safe = redactor.push(text);
                 if (safe && !this.reporter.writeCommandOutput(safe)) {
@@ -132,7 +173,7 @@ export class LocalTransport {
                 }
             };
             const flush = () => {
-                if (!shouldStream)
+                if (!shouldCapture)
                     return;
                 const rest = redactor.flush();
                 if (rest)
@@ -140,16 +181,63 @@ export class LocalTransport {
             };
             child.stdout.on("data", emit);
             child.stderr.on("data", emit);
-            child.on("error", /** @param {Error} error */ /** @param {Error} error */ error => { flush(); reject(error); });
+            child.on("error", /** @param {Error} error */ /** @param {Error} error */ error => { flush(); reject(new Error(redactText(error.message, knownSecrets))); });
             child.on("close", /** @param {number|null} code */ /** @param {number|null} code */ code => {
                 flush();
                 if (code === 0)
-                    resolve({ code, output: redactText(output) });
+                    resolve({ code, output: redactText(output, knownSecrets) });
                 else
-                    reject(new Error(`Command failed with exit ${code}: ${redactText(command)}
-${redactText(output)}`));
+                    reject(new Error(`Command failed with exit ${code}: ${redactText(command, knownSecrets)}
+${redactText(output, knownSecrets)}`));
             });
         });
     }
 }
+/**
+ * @param {string} guardLockPath
+ * @param {string} filePath
+ * @param {string} expectedContent
+ * @returns {Promise<number|null>}
+ */
+async function runConditionalRemove(guardLockPath, filePath, expectedContent) {
+    const script = 'if ! test -f "$1"; then exit 76; fi; cmp -s "$1" -; status=$?; if test "$status" -eq 1; then exit 76; elif test "$status" -ne 0; then exit 74; fi; rm -f "$1" || exit 74';
+    return await new Promise((resolve, reject) => {
+        const child = spawn("flock", ["-n", "-E", "75", "--", guardLockPath, "sh", "-c", script, "rampway-remove", filePath]);
+        let settled = false;
+        const fail = /** @param {Error} error */ /** @param {Error} error */ error => {
+            if (settled)
+                return;
+            settled = true;
+            reject(error);
+        };
+        child.on("error", fail);
+        child.stdin.on("error", error => {
+            if ( /** @type {{code?: string}} */(error).code !== "EPIPE")
+                fail(error);
+        });
+        child.stderr.resume();
+        child.on("close", code => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(code);
+        });
+        child.stdin.end(expectedContent);
+    });
+}
+/**
+ * @param {Record<string, string>} env
+ * @param {Record<string, string>} secretEnv
+ * @returns {void}
+ */
+function validateEnvironment(env, secretEnv) {
+    for (const name of [...Object.keys(env), ...Object.keys(secretEnv)]) {
+        if (!isValidEnvironmentName(name))
+            throw new Error(`Invalid environment variable name: ${name}`);
+    }
+    for (const [name, value] of Object.entries(secretEnv)) {
+        if (value.includes("\0"))
+            throw new Error(`Secret environment variable '${name}' contains NUL and cannot be transported.`);
+    }
+}
 //# sourceMappingURL=local-transport.js.map

package/build/src/transports/local-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"local-transport.js","sourceRoot":"","sources":["../../../src/transports/local-transport.js"],"names":[],"mappings":"AAAA,YAAY;AACZ,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAC,KAAK,EAAC,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAC,UAAU,EAAE,iBAAiB,EAAC,MAAM,sBAAsB,CAAA;AAClE,OAAO,EAAC,QAAQ,EAAC,MAAM,qBAAqB,CAAA;AAE5C,MAAM,OAAO,cAAc;IACzB;;OAEG;IACH,YAAY,EAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,EAAC,GAAG,EAAE;QAC1C,qDAAqD;QACrD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,UAAU;QACrB,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;IAC/C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,UAAU;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAC1B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,CAAA;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YACvC,MAAM,GAAG,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,SAAS;QAC9C,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACrB,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,UAAU;QACjB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACrB,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,UAAU;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,CAAA;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAA;YACpC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAC,CAAC,CAAA;IAC5E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAC,GAAG,EAAE;QACrC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAA;QAClD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAC,GAAG,EAAE,GAAG,EAAE,EAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAC,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAA;YAC/E,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,MAAM,QAAQ,GAAG,IAAI,iBAAiB,EAAE,CAAA;YACxC,MAAM,IAAI,GAAG,mCAAmC,CAAC,AAApC,mCAAmC,CAAC,KAAK,CAAC,EAAE;gBACvD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;gBAC7B,MAAM,IAAI,IAAI,CAAA;gBACd,IAAI,CAAC,YAAY;oBAAE,OAAM;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;oBACpB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;oBACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;wBACnC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;wBACrB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;oBACvB,CAAC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC,CAAA;YACD,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,CAAC,YAAY;oBAAE,OAAM;gBACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAA;gBAC7B,IAAI,IAAI;oBAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;YAClD,CAAC,CAAA;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC,AAA5B,2BAA2B,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAClF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC,AAAjC,gCAAgC,CAAC,IAAI,CAAC,EAAE;gBACxD,KAAK,EAAE,CAAA;gBACP,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,EAAC,CAAC,CAAA;;oBACtD,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC;EACpF,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;YAClB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"local-transport.js","sourceRoot":"","sources":["../../../src/transports/local-transport.js"],"names":[],"mappings":"AAAA,YAAY;AACZ,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACjC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAC,KAAK,EAAC,MAAM,oBAAoB,CAAA;AACxC,OAAO,EAAC,sBAAsB,EAAE,UAAU,EAAE,iBAAiB,EAAC,MAAM,sBAAsB,CAAA;AAC1F,OAAO,EAAC,QAAQ,EAAC,MAAM,qBAAqB,CAAA;AAE5C,MAAM,OAAO,cAAc;IACzB;;OAEG;IACH,YAAY,EAAC,QAAQ,GAAG,IAAI,QAAQ,EAAE,EAAC,GAAG,EAAE;QAC1C,qDAAqD;QACrD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC1B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,UAAU;QACrB,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;IAC/C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,UAAU;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAC1B,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,CAAA;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YACvC,MAAM,GAAG,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAG,SAAS;QAC9C,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACrB,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,UAAU;QACjB,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAA;IACzD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC3B,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO;QAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO;QACxC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAC,IAAI,EAAE,IAAI,EAAC,CAAC,CAAA;YACnD,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,CAAA;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAA;YACvC,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,mBAAmB,CAAC,QAAQ,EAAE,eAAe;QACjD,MAAM,SAAS,GAAG,GAAG,QAAQ,iBAAiB,CAAA;QAC9C,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAClC,QAAQ,EACR,eAAe,CAChB,CAAA;QACD,IAAI,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC/B,IAAI,QAAQ,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAA;QAClG,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,KAAK,CAAA;QACjC,MAAM,IAAI,KAAK,CAAC,6CAA6C,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC,CAAA;IACpG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,QAAQ;QACrB,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,UAAU;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,8BAA8B,CAAC,CAAC,KAAK,CAAC,CAAA;YAClD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAA;YACpC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAC,CAAC,CAAA;IAC5E,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAC,GAAG,EAAE;QACrD,mBAAmB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QACnC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAA;QACpD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAC,GAAG,EAAE,GAAG,EAAE,EAAC,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,SAAS,EAAC,EAAE,KAAK,EAAE,IAAI,EAAC,CAAC,CAAA;YAC7F,IAAI,MAAM,GAAG,EAAE,CAAA;YACf,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAC,YAAY,EAAC,CAAC,CAAA;YACtD,MAAM,IAAI,GAAG,mCAAmC,CAAC,AAApC,mCAAmC,CAAC,KAAK,CAAC,EAAE;gBACvD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAA;gBAC7B,MAAM,IAAI,IAAI,CAAA;gBACd,IAAI,CAAC,aAAa;oBAAE,OAAM;gBAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;oBACpB,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;oBACpB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;wBACnC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;wBACrB,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;oBACvB,CAAC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC,CAAA;YACD,MAAM,KAAK,GAAG,GAAG,EAAE;gBACjB,IAAI,CAAC,aAAa;oBAAE,OAAM;gBAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,CAAA;gBAC7B,IAAI,IAAI;oBAAE,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAA;YAClD,CAAC,CAAA;YACD,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC7B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,2BAA2B,CAAC,AAA5B,2BAA2B,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;YAC/H,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,gCAAgC,CAAC,AAAjC,gCAAgC,CAAC,IAAI,CAAC,EAAE;gBACxD,KAAK,EAAE,CAAA;gBACP,IAAI,IAAI,KAAK,CAAC;oBAAE,OAAO,CAAC,EAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAC,CAAC,CAAA;;oBACpE,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC;EAClG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;YAChC,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,aAAa,EAAE,QAAQ,EAAE,eAAe;IAC1E,MAAM,MAAM,GAAG,0KAA0K,CAAA;IACzL,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAA;QACrH,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,IAAI,GAAG,2BAA2B,CAAC,AAA5B,2BAA2B,CAAC,KAAK,CAAC,EAAE;YAC/C,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,KAAK,CAAC,CAAA;QACf,CAAC,CAAA;QACD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACvB,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE;YAC9B,KAAI,8BAA+B,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO;gBAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1E,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;QACrB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE;YACvB,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,CAAC,IAAI,CAAC,CAAA;QACf,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAG,EAAE,SAAS;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAA;IAClG,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,2CAA2C,CAAC,CAAA;IAC5H,CAAC;AACH,CAAC"}