Harden CLI lane filtering and diagnostics redaction

internal/core/config/redaction.go

@@ -1,5 +1,7 @@
 package config
 
+import "gitea.maximumdirect.net/eric/notarius/internal/framework/pipeline"
+
 const redactedSecret = "[REDACTED]"
 
 func (c Config) Redacted() Config {
@@ -12,3 +14,44 @@ func (c Config) Redacted() Config {
 	}
 	return redacted
 }
+
+func (c Config) RedactedDiagnosticsPayload() any {
+	return c.Redacted()
+}
+
+func (e EffectiveConfig) RedactedDiagnosticsPayload() any {
+	return EffectiveConfig{
+		Config:           e.Config.Redacted(),
+		PipelineID:       e.PipelineID,
+		Only:             append([]string(nil), e.Only...),
+		ResolvedPipeline: cloneResolvedPipeline(e.ResolvedPipeline),
+	}
+}
+
+func cloneResolvedPipeline(in pipeline.ResolvedPipeline) pipeline.ResolvedPipeline {
+	out := in
+	out.Input = cloneModuleBinding(in.Input)
+	out.Chunk = cloneModuleBinding(in.Chunk)
+	out.Output = cloneModuleBinding(in.Output)
+	if len(in.ArtifactLanes) > 0 {
+		out.ArtifactLanes = make([]pipeline.ResolvedArtifactLane, len(in.ArtifactLanes))
+		for i, lane := range in.ArtifactLanes {
+			out.ArtifactLanes[i] = cloneResolvedArtifactLane(lane)
+		}
+	}
+	return out
+}
+
+func cloneResolvedArtifactLane(in pipeline.ResolvedArtifactLane) pipeline.ResolvedArtifactLane {
+	out := in
+	out.Extract = cloneModuleBinding(in.Extract)
+	out.Merge = cloneModuleBinding(in.Merge)
+	out.Normalize = cloneModuleBinding(in.Normalize)
+	if len(in.Validators) > 0 {
+		out.Validators = make([]pipeline.ModuleBinding, len(in.Validators))
+		for i, binding := range in.Validators {
+			out.Validators[i] = cloneModuleBinding(binding)
+		}
+	}
+	return out
+}