@intentius/chant 0.124.13 → 0.124.15

package/dist/workspace/trust/signers-cli.js

@@ -0,0 +1,152 @@
+/**
+ * `chant workspace signers [rotate [--threshold <n>] | sign --key <file>]`
+ * (#2553): show the signer history, and propose a new signer set.
+ *
+ * Rotating is three steps: edit the signers file, run `rotate` to write the
+ * rotation file for the next version, and have a threshold of the current
+ * signers each run `sign` with their own key. `chant workspace verify` then
+ * checks the result against the set at base.
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { formatError, formatSuccess } from "../../cli/format.js";
+import { readerVersion } from "../declaration.js";
+import { gitRoot } from "../record-source.js";
+import { parseAllowedSigners, readTrustPolicy } from "./policy.js";
+import { resolveBase } from "./provenance.js";
+import { gitRevisionSource } from "../record-source.js";
+import { distinctHolders, rotationFileSchema, rotationPath, rotationStatement, ROTATION_NAMESPACE, signerHistory, signersDigest, } from "./rotation.js";
+import { verifySshSignature } from "./ssh-commit.js";
+const USAGE = "chant workspace signers [--base <rev>] [--json] | signers rotate [--threshold <n>] | signers sign --key <ssh private key>";
+export const SIGNERS_CONTRACT_VERSION = 1;
+export const SIGNERS_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/signers/v1/signers.schema.json";
+/** Why `chant workspace signers` prints no history. Each is in `reason-codes.ts` and `signers.schema.json`. */
+export const SIGNERS_ERROR_CODES = ["not-a-git-repository", "revision-unknown", "signers-file-missing"];
+function head() {
+    return { $schema: SIGNERS_OUTPUT_SCHEMA_ID, contract: SIGNERS_CONTRACT_VERSION, chant: readerVersion() };
+}
+/** The signer history at `base` as the `--json` document. */
+export function signersDocument(repo, base, signersPath, history) {
+    return {
+        ...head(),
+        base,
+        signersPath,
+        versions: history.versions.map((v) => ({
+            version: v.version,
+            commit: v.commit,
+            digest: v.version === 0 ? null : v.digest,
+            threshold: v.threshold,
+            principals: [...new Set(v.signers.map((s) => s.principal))].sort(),
+            signedBy: v.signedBy,
+        })),
+        broken: history.broken ? { commit: history.broken.commit, code: history.broken.code, message: history.broken.reason } : null,
+    };
+}
+function fail(message) {
+    console.error(formatError({ message, hint: USAGE }));
+    return 1;
+}
+export async function runWorkspaceSigners(ctx) {
+    const { args } = ctx;
+    const sub = args.extraPositional;
+    const refuse = (code, message) => {
+        if (args.json && !sub)
+            console.log(JSON.stringify({ ...head(), error: { code, message } }, null, 2));
+        else
+            console.error(formatError({ message, hint: USAGE }));
+        return 1;
+    };
+    const repo = gitRoot(process.cwd());
+    if (!repo)
+        return refuse("not-a-git-repository", "signer history is read from git, and this directory is not in a git repository");
+    const base = resolveBase(repo, args.base);
+    if (!base.commit)
+        return refuse("revision-unknown", base.problem ?? "no base revision");
+    // The policy as written at base; its history is checked below, not taken on trust.
+    const policy = readTrustPolicy(gitRevisionSource(repo, base.commit), base.commit);
+    if (!policy.active)
+        return refuse("signers-file-missing", `there is no signers file (${policy.signersPath}) at base ${base.commit.slice(0, 8)}`);
+    const history = signerHistory(repo, base.commit, policy.signersPath);
+    const latest = history.versions.at(-1);
+    if (!sub) {
+        if (args.json) {
+            console.log(JSON.stringify(signersDocument(repo, base.commit, policy.signersPath, history), null, 2));
+            return history.broken ? 1 : 0;
+        }
+        for (const v of history.versions) {
+            if (v.version === 0) {
+                console.log(`  ${v.commit?.slice(0, 8)}  signers file removed`);
+                continue;
+            }
+            const by = v.signedBy.length ? `, signed by ${v.signedBy.join(", ")}` : ", the first version";
+            console.log(`  ${v.commit?.slice(0, 8)}  version ${v.version}: ${new Set(v.signers.map((s) => s.principal)).size} signers, threshold ${v.threshold}${by}`);
+        }
+        if (history.broken)
+            return fail(`the history breaks at ${history.broken.commit?.slice(0, 8)} (${history.broken.code}): ${history.broken.reason}`);
+        return 0;
+    }
+    if (history.broken || !latest || latest.version === 0)
+        return fail("the signer history at base is not valid, so there is no version to rotate from");
+    const signersFile = join(repo, policy.signersPath);
+    const rotationFile = join(repo, rotationPath(policy.signersPath));
+    const text = readFileSync(signersFile, "utf-8");
+    if (sub === "rotate") {
+        const threshold = args.threshold !== undefined ? Number(args.threshold) : latest.threshold;
+        if (!Number.isInteger(threshold) || threshold < 1)
+            return fail("--threshold takes a whole number of at least 1");
+        const holders = distinctHolders(parseAllowedSigners(text).signers);
+        if (threshold > holders)
+            return fail(`--threshold ${threshold} is more than the ${holders} distinct signers in the new set`);
+        const rotation = { schema: 1, version: latest.version + 1, previous: latest.digest, threshold, signatures: [] };
+        writeFileSync(rotationFile, JSON.stringify(rotation, null, 2) + "\n");
+        console.log(formatSuccess(`wrote ${rotationPath(policy.signersPath)} for version ${rotation.version}; ${latest.threshold} of the version ${latest.version} signers must now run chant workspace signers sign --key <their key>`));
+        return 0;
+    }
+    if (sub === "sign") {
+        if (!args.key)
+            return fail("--key <ssh private key> is required");
+        if (!existsSync(rotationFile))
+            return fail(`there is no ${rotationPath(policy.signersPath)}; run chant workspace signers rotate first`);
+        let raw;
+        try {
+            raw = JSON.parse(readFileSync(rotationFile, "utf-8"));
+        }
+        catch {
+            return fail(`${rotationPath(policy.signersPath)} is not JSON`);
+        }
+        const parsed = rotationFileSchema.safeParse(raw);
+        if (!parsed.success)
+            return fail(`${rotationPath(policy.signersPath)} is invalid`);
+        if (parsed.data.version !== latest.version + 1 || parsed.data.previous !== latest.digest) {
+            return fail(`${rotationPath(policy.signersPath)} is not the next version after version ${latest.version} at base; run chant workspace signers rotate again`);
+        }
+        const rotation = parsed.data;
+        const statement = rotationStatement(rotation, signersDigest(text));
+        let pub;
+        try {
+            pub = execFileSync("ssh-keygen", ["-y", "-f", args.key], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }).trim().split(/\s+/).slice(0, 2).join(" ");
+        }
+        catch (err) {
+            return fail(`ssh-keygen could not read ${args.key}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+        }
+        const me = latest.signers.find((s) => s.key === pub);
+        if (!me)
+            return fail(`this key is not in version ${latest.version} of the signer set, so its signature would not count`);
+        let sig;
+        try {
+            sig = execFileSync("ssh-keygen", ["-q", "-Y", "sign", "-n", ROTATION_NAMESPACE, "-f", args.key], { input: statement, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        }
+        catch (err) {
+            return fail(`ssh-keygen could not sign with ${args.key}: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`);
+        }
+        const check = verifySshSignature([me], statement, sig, ROTATION_NAMESPACE);
+        if (!check.ok)
+            return fail(`the signature did not verify: ${check.reason}`);
+        rotation.signatures = [...rotation.signatures.filter((s) => s.principal !== me.principal), { principal: me.principal, signature: sig }];
+        writeFileSync(rotationFile, JSON.stringify(rotation, null, 2) + "\n");
+        console.log(formatSuccess(`signed version ${rotation.version} as ${me.principal} (${rotation.signatures.length} of ${latest.threshold} needed)`));
+        return 0;
+    }
+    return fail(`Unknown signers subcommand: ${sub}`);
+}

package/dist/workspace/trust/ssh-commit.js

@@ -0,0 +1,178 @@
+/**
+ * The first attestor: ssh-signed commits, checked against the signers the
+ * base policy lists (#2524 D5, ws-001).
+ *
+ * It does not ask `git verify-commit`. That would read `gpg.ssh.program`,
+ * `gpg.ssh.allowedSignersFile` and the rest from git config, which whoever
+ * controls the machine can set, and it passes the commit's own date to
+ * ssh-keygen as the verification time. Instead it takes the signature and the
+ * signed payload out of the commit object itself and hands them to
+ * `ssh-keygen -Y verify` with a signers file built from the base policy, in
+ * the `git` namespace.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { renderAllowedSigners } from "./policy.js";
+const NAME = "ssh-commit";
+/**
+ * Split a raw commit object. `header` is `gpgsig` in a SHA-1 repository and
+ * `gpgsig-sha256` in a SHA-256 one; git removes exactly that header, with its
+ * continuation lines, to get the bytes it signed.
+ */
+export function splitSignedCommit(raw, header = "gpgsig") {
+    const end = raw.indexOf("\n\n");
+    const headEnd = end < 0 ? raw.length : end;
+    const head = raw.subarray(0, headEnd).toString("latin1").split("\n");
+    const kept = [];
+    const sig = [];
+    let inSig = false;
+    for (const line of head) {
+        if (inSig && line.startsWith(" ")) {
+            sig.push(line.slice(1));
+            continue;
+        }
+        inSig = false;
+        if (sig.length === 0 && line.startsWith(`${header} `)) {
+            inSig = true;
+            sig.push(line.slice(header.length + 1));
+            continue;
+        }
+        kept.push(line);
+    }
+    const payload = Buffer.concat([Buffer.from(kept.join("\n"), "latin1"), raw.subarray(headEnd)]);
+    return { payload, signature: sig.length > 0 ? sig.join("\n") + "\n" : undefined };
+}
+function objectFormat(repo) {
+    try {
+        return execFileSync("git", ["rev-parse", "--show-object-format"], { cwd: repo, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    }
+    catch {
+        return "sha1";
+    }
+}
+/** Run ssh-keygen; `missing` is true when it is not installed. Shared with the verdict seals (./seal.ts). */
+export function sshKeygen(args, input) {
+    const r = spawnSync("ssh-keygen", args, { input, encoding: "buffer", timeout: 30000 });
+    const missing = r.error?.code === "ENOENT";
+    return { status: r.status, stdout: r.stdout?.toString("utf-8") ?? "", stderr: r.stderr?.toString("utf-8") ?? "", missing };
+}
+const cache = new Map();
+/**
+ * Check a detached ssh signature over `payload` in `namespace` against
+ * `signers`. Shared with the rotation check (#2553), which signs signer sets
+ * in their own namespace so a commit signature can never stand in for one.
+ */
+export function verifySshSignature(signers, payload, signature, namespace) {
+    if (signers.length === 0)
+        return { ok: false, missing: false, reason: "the policy lists no usable signer" };
+    const dir = mkdtempSync(join(tmpdir(), "chant-trust-"));
+    try {
+        const allowed = join(dir, "allowed_signers");
+        const sigFile = join(dir, "signature");
+        writeFileSync(allowed, renderAllowedSigners(signers));
+        writeFileSync(sigFile, signature);
+        const found = sshKeygen(["-Y", "find-principals", "-f", allowed, "-s", sigFile]);
+        if (found.missing)
+            return { ok: false, missing: true, reason: "ssh-keygen is not installed here" };
+        const principals = found.status === 0 ? found.stdout.split("\n").map((l) => l.trim()).filter(Boolean) : [];
+        if (principals.length === 0)
+            return { ok: false, missing: false, reason: "signed by a key the policy at base does not list" };
+        for (const principal of principals) {
+            const v = sshKeygen(["-Y", "verify", "-f", allowed, "-I", principal, "-n", namespace, "-s", sigFile], payload);
+            if (v.status === 0) {
+                const key = /key (SHA256:[A-Za-z0-9+/=]+)/.exec(v.stdout + v.stderr)?.[1];
+                return { ok: true, principal, ...(key ? { key } : {}) };
+            }
+        }
+        return { ok: false, missing: false, reason: `the signature does not verify in the ${namespace} namespace for a key the policy lists` };
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+export const sshCommitAttestor = {
+    name: NAME,
+    attestCommit(ctx, commit) {
+        const signers = ctx.policy.signers;
+        const memo = `${ctx.repo}\0${commit}\0${renderAllowedSigners(signers)}`;
+        const hit = cache.get(memo);
+        if (hit)
+            return hit;
+        const raw = execFileSync("git", ["cat-file", "commit", commit], { cwd: ctx.repo, maxBuffer: 64 * 1024 * 1024 });
+        const answer = judgeRaw(raw, objectFormat(ctx.repo) === "sha256" ? "gpgsig-sha256" : "gpgsig", signers);
+        cache.set(memo, answer);
+        return answer;
+    },
+    attestRaw(ctx, raw) {
+        // A commit from another repository: its object format shows in its tree line.
+        const tree = /^tree ([0-9a-f]+)$/m.exec(raw.subarray(0, 200).toString("latin1"))?.[1];
+        return judgeRaw(raw, tree?.length === 64 ? "gpgsig-sha256" : "gpgsig", ctx.policy.signers);
+    },
+};
+function judgeRaw(raw, header, signers) {
+    const { payload, signature } = splitSignedCommit(raw, header);
+    if (!signature)
+        return { level: "unattested", attestor: NAME, reason: "the commit is not signed" };
+    if (!signature.startsWith("-----BEGIN SSH SIGNATURE-----")) {
+        const format = signature.startsWith("-----BEGIN PGP SIGNATURE-----") ? "an OpenPGP" : "a non-ssh";
+        return { level: "attested-unverifiable-here", attestor: NAME, reason: `the commit carries ${format} signature, which this attestor does not check` };
+    }
+    const r = verifySshSignature(signers, payload, signature, "git");
+    if (r.ok)
+        return { level: "attested", attestor: NAME, principal: r.principal, ...(r.key ? { key: r.key } : {}), reason: `signed by ${r.principal}` };
+    if (r.missing)
+        return { level: "attested-unverifiable-here", attestor: NAME, reason: r.reason };
+    return { level: "unattested", attestor: NAME, reason: r.reason };
+}
+/**
+ * The public key inside an armored ssh signature (the SSHSIG format), as
+ * `<type> <base64>`, or undefined when the text is not one. The key is what
+ * made the signature; whether anyone trusts it is a separate question.
+ */
+export function sshSignatureKey(signature) {
+    const body = signature
+        .replace(/-----BEGIN SSH SIGNATURE-----/, "")
+        .replace(/-----END SSH SIGNATURE-----/, "")
+        .replace(/\s+/g, "");
+    let buf;
+    try {
+        buf = Buffer.from(body, "base64");
+    }
+    catch {
+        return undefined;
+    }
+    if (buf.length < 14 || buf.subarray(0, 6).toString("latin1") !== "SSHSIG")
+        return undefined;
+    const len = buf.readUInt32BE(10);
+    const blob = buf.subarray(14, 14 + len);
+    if (blob.length !== len || len < 4)
+        return undefined;
+    const typeLen = blob.readUInt32BE(0);
+    const type = blob.subarray(4, 4 + typeLen).toString("latin1");
+    if (!/^[a-z0-9@.-]+$/.test(type))
+        return undefined;
+    return `${type} ${blob.toString("base64")}`;
+}
+/**
+ * Whether an ssh signature over `payload` in `namespace` is intact, whoever
+ * made it (`ssh-keygen -Y check-novalidate`). Returns the key's fingerprint,
+ * false when it does not check, or null when ssh-keygen is not installed.
+ */
+export function sshSignatureIntact(payload, signature, namespace) {
+    const dir = mkdtempSync(join(tmpdir(), "chant-intact-"));
+    try {
+        const sigFile = join(dir, "signature");
+        writeFileSync(sigFile, signature);
+        const r = sshKeygen(["-Y", "check-novalidate", "-n", namespace, "-s", sigFile], payload);
+        if (r.missing)
+            return null;
+        if (r.status !== 0)
+            return false;
+        return /key (SHA256:[A-Za-z0-9+/=]+)/.exec(r.stdout + r.stderr)?.[1] ?? "";
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}

package/dist/workspace/trust/test-repo.js

@@ -0,0 +1,118 @@
+/**
+ * Test support for the trust modules: throwaway git repositories whose commits
+ * are signed with throwaway ssh keys. Isolated from the user's git config, so a
+ * developer's own signing setup never leaks into a test.
+ */
+import { execFileSync, spawnSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { ROTATION_NAMESPACE, rotationStatement, signersDigest } from "./rotation.js";
+export const hasSshKeygen = spawnSync("ssh-keygen", ["-Y"], { stdio: "ignore" }).error === undefined;
+export class TestRepo {
+    constructor(label) {
+        this.scratch = mkdtempSync(join(tmpdir(), `chant-2547-${label}-`));
+        this.dir = join(this.scratch, "repo");
+        this.home = join(this.scratch, "home");
+        mkdirSync(this.dir);
+        mkdirSync(this.home);
+        this.git(["init", "-q", "-b", "main"]);
+    }
+    env(extra = {}) {
+        return {
+            PATH: process.env.PATH ?? "",
+            HOME: this.home,
+            GIT_CONFIG_GLOBAL: join(this.home, "gitconfig"),
+            GIT_CONFIG_NOSYSTEM: "1",
+            GIT_AUTHOR_NAME: "t",
+            GIT_AUTHOR_EMAIL: "t@example.test",
+            GIT_COMMITTER_NAME: "t",
+            GIT_COMMITTER_EMAIL: "t@example.test",
+            ...extra,
+        };
+    }
+    git(args, opts = {}) {
+        return execFileSync("git", args, { cwd: this.dir, env: this.env(opts.env), input: opts.input, encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    }
+    key(name) {
+        const file = join(this.scratch, `key-${name}`);
+        execFileSync("ssh-keygen", ["-q", "-t", "ed25519", "-N", "", "-C", name, "-f", file]);
+        const pub = readFileSync(`${file}.pub`, "utf-8").trim().split(" ").slice(0, 2).join(" ");
+        return { name, file, pub };
+    }
+    write(path, text) {
+        mkdirSync(dirname(join(this.dir, path)), { recursive: true });
+        writeFileSync(join(this.dir, path), text);
+    }
+    /** Stage everything and commit, signed with `key` when given. Returns the commit id. */
+    commit(message, key, env = {}) {
+        this.git(["add", "-A"]);
+        const sign = key ? ["-c", "gpg.format=ssh", "-c", `user.signingkey=${key.file}`, "commit", "-S"] : ["commit", "--no-gpg-sign"];
+        this.git([...sign, "-q", "--allow-empty", "-m", message], { env });
+        return this.head();
+    }
+    head() {
+        return this.git(["rev-parse", "HEAD"]).trim();
+    }
+    /**
+     * Write a commit object by hand: the current index's tree, `HEAD` as parent,
+     * and `signature` spliced in as the gpgsig header. Returns the new commit,
+     * which HEAD then points at.
+     */
+    forgeCommit(message, sign) {
+        this.git(["add", "-A"]);
+        const tree = this.git(["write-tree"]).trim();
+        const parent = this.head();
+        const payload = Buffer.from(`tree ${tree}\nparent ${parent}\nauthor t <t@example.test> 1700000000 +0000\ncommitter t <t@example.test> 1700000000 +0000\n\n${message}\n`);
+        const sig = sign(payload).trimEnd().split("\n");
+        const head = payload.toString("latin1").split("\n\n")[0];
+        const body = payload.toString("latin1").slice(head.length);
+        const raw = `${head}\ngpgsig ${sig[0]}\n${sig.slice(1).map((l) => ` ${l}`).join("\n")}${body}`;
+        const commit = this.git(["hash-object", "-t", "commit", "-w", "--stdin"], { input: Buffer.from(raw, "latin1") }).trim();
+        this.git(["update-ref", "HEAD", commit]);
+        return commit;
+    }
+    /** An ssh signature over `payload` in `namespace`, by `key`. */
+    sshSign(key, payload, namespace) {
+        const f = join(this.scratch, `payload-${Math.random().toString(36).slice(2)}`);
+        writeFileSync(f, payload);
+        execFileSync("ssh-keygen", ["-q", "-Y", "sign", "-n", namespace, "-f", key.file, f], { stdio: "ignore" });
+        return readFileSync(`${f}.sig`, "utf-8");
+    }
+    cleanup() {
+        rmSync(this.scratch, { recursive: true, force: true });
+    }
+}
+/**
+ * Write `<signers>.rotation.json` for the signers file now in the working
+ * tree, as the next version after `previousText`, signed by `by` in the
+ * rotation namespace (#2553).
+ */
+export function writeRotation(repo, opts) {
+    const path = opts.signersPath ?? ".chant/allowed_signers";
+    const text = readFileSync(join(repo.dir, path), "utf-8");
+    const rotation = { version: opts.version, previous: signersDigest(opts.previousText), threshold: opts.threshold ?? 1 };
+    const statement = rotationStatement(rotation, signersDigest(text));
+    const signatures = opts.by.map(([principal, key]) => ({ principal, signature: repo.sshSign(key, statement, opts.namespace ?? ROTATION_NAMESPACE) }));
+    repo.write(`${path}.rotation.json`, JSON.stringify({ schema: 1, ...rotation, signatures }, null, 2));
+}
+/** A record kind reading `records/*.md`, and its schema, written into `repo`. */
+export function writeRecordKind(repo) {
+    repo.write("kinds/note.kind.mjs", `export const recordKind = {
+  name: "note",
+  location: { dir: "../records", match: "\\\\.md$" },
+  format: "markdown-front-matter",
+  schema: { id: "urn:test:note:1", path: "note.schema.json" },
+  idField: "id",
+  stateField: "state",
+  states: ["open", "closed"],
+  closedStates: ["closed"],
+  supersedes: { field: "supersedes", key: "note" },
+};
+`);
+    repo.write("kinds/note.schema.json", JSON.stringify({ $id: "urn:test:note:1", type: "object", required: ["id", "state"], properties: { id: { type: "string" }, state: { type: "string" } } }));
+    return "kinds/note.kind.mjs";
+}
+export function note(id, body = "") {
+    return `---\nid: ${id}\nstate: open\n---\n${body}\n`;
+}

package/dist/workspace/trust/trust-files.js

@@ -0,0 +1,193 @@
+/**
+ * The trust files' plain readers (#3763): the signers file's parser, and a
+ * check of `.chant/trust.json` that says what `./policy.ts`'s zod schema
+ * says, so a bundle can read both without zod. `./policy.ts` re-exports the
+ * parser; `trust-files.test.ts` holds the check to the schema.
+ */
+import { posix } from "node:path";
+/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
+export const TRUST_CONFIG_PATH = ".chant/trust.json";
+/** Where the signers are when `trust.json` names no other path. */
+export const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
+// ── allowed_signers ──────────────────────────────────────────────────────────
+/** Key types ssh-keygen accepts in an allowed_signers line. */
+const KEY_TYPES = new Set([
+    "ssh-ed25519",
+    "ssh-rsa",
+    "ecdsa-sha2-nistp256",
+    "ecdsa-sha2-nistp384",
+    "ecdsa-sha2-nistp521",
+    "sk-ssh-ed25519@openssh.com",
+    "sk-ecdsa-sha2-nistp256@openssh.com",
+]);
+/**
+ * Split one line into fields. Double quotes group, so an option such as
+ * `namespaces="git,file"` stays one field.
+ */
+function fields(line) {
+    const out = [];
+    let cur = "";
+    let quoted = false;
+    let any = false;
+    for (const ch of line) {
+        if (ch === '"') {
+            quoted = !quoted;
+            cur += ch;
+            any = true;
+        }
+        else if (!quoted && (ch === " " || ch === "\t")) {
+            if (any)
+                out.push(cur);
+            cur = "";
+            any = false;
+        }
+        else {
+            cur += ch;
+            any = true;
+        }
+    }
+    if (any)
+        out.push(cur);
+    return out;
+}
+/** `a="x,y",b` as `{ a: "x,y", b: "" }`. */
+function options(field) {
+    const opts = new Map();
+    let cur = "";
+    let quoted = false;
+    const flush = () => {
+        if (!cur)
+            return;
+        const eq = cur.indexOf("=");
+        const name = (eq < 0 ? cur : cur.slice(0, eq)).toLowerCase();
+        const value = eq < 0 ? "" : cur.slice(eq + 1).replace(/^"|"$/g, "");
+        opts.set(name, value);
+        cur = "";
+    };
+    for (const ch of field) {
+        if (ch === '"')
+            quoted = !quoted;
+        if (ch === "," && !quoted)
+            flush();
+        else
+            cur += ch;
+    }
+    flush();
+    return opts;
+}
+/**
+ * Parse an allowed_signers file, keeping only lines whose meaning does not
+ * depend on anything the signer controls.
+ *
+ * Refused, each with a reason, rather than passed to ssh-keygen:
+ *
+ * - `valid-after` and `valid-before`. git checks them against the commit's own
+ *   date, which whoever makes the commit sets. A backdated commit would pass a
+ *   window its key has left. Revocation is by position in history (#2553),
+ *   never by date.
+ * - `cert-authority`. A certificate's validity is also a date, and a CA key
+ *   vouches for keys this file never names.
+ * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
+ *   principal, so role grants can name it.
+ */
+export function parseAllowedSigners(text) {
+    const signers = [];
+    const excluded = [];
+    const lines = text.replace(/\r\n?/g, "\n").split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = i + 1;
+        const raw = lines[i].trim();
+        if (!raw || raw.startsWith("#"))
+            continue;
+        const f = fields(raw);
+        if (f.length < 3) {
+            excluded.push({ line, reason: "expected principals, optional options, a key type and a key" });
+            continue;
+        }
+        const [principals, second] = f;
+        const hasOptions = !KEY_TYPES.has(second);
+        const type = hasOptions ? f[2] : second;
+        const blob = hasOptions ? f[3] : f[2];
+        if (!KEY_TYPES.has(type) || !blob || !/^[A-Za-z0-9+/]+={0,2}$/.test(blob)) {
+            excluded.push({ line, reason: `no supported public key (${type ?? "none"})` });
+            continue;
+        }
+        const opts = hasOptions ? options(second) : new Map();
+        const timed = ["valid-after", "valid-before"].filter((o) => opts.has(o));
+        if (timed.length > 0) {
+            excluded.push({
+                line,
+                reason: `${timed.join(" and ")} is checked against the commit's own date, which its author sets; revoke a key by removing it`,
+            });
+            continue;
+        }
+        if (opts.has("cert-authority")) {
+            excluded.push({ line, reason: "cert-authority keys are not supported: a certificate's validity is a date the signer controls" });
+            continue;
+        }
+        const unknown = [...opts.keys()].filter((o) => o !== "namespaces");
+        if (unknown.length > 0) {
+            excluded.push({ line, reason: `unknown option ${unknown.join(", ")}` });
+            continue;
+        }
+        const names = principals.replace(/^"|"$/g, "").split(",").filter(Boolean);
+        const pattern = names.find((p) => /[*?!]/.test(p));
+        if (pattern !== undefined || names.length === 0) {
+            excluded.push({ line, reason: `principal ${JSON.stringify(pattern ?? principals)} is a pattern; name one signer exactly` });
+            continue;
+        }
+        for (const principal of names) {
+            signers.push({ principal, key: `${type} ${blob}`, namespaces: opts.get("namespaces"), line });
+        }
+    }
+    return { signers, excluded };
+}
+/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
+export function renderAllowedSigners(signers) {
+    return (signers
+        .map((s) => `${JSON.stringify(s.principal)}${s.namespaces !== undefined ? ` namespaces=${JSON.stringify(s.namespaces)}` : ""} ${s.key}`)
+        .join("\n") + "\n");
+}
+// ── trust.json, without zod ──────────────────────────────────────────────────
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const FULL_COMMIT = /^[0-9a-f]{40}([0-9a-f]{24})?$/;
+const SSH_ED25519 = /^ssh-ed25519 [A-Za-z0-9+/]+={0,2}$/;
+const SSH_KEY = /^(ssh-ed25519|ssh-rsa|ecdsa-sha2-nistp(256|384|521)|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com) [A-Za-z0-9+/]+={0,2}$/;
+/** A repository-relative path: no `..`, not absolute, `/` separators. */
+export function isRepoPath(p) {
+    return typeof p === "string" && p.length > 0 && !p.startsWith("/") && !p.includes("\\") && posix.normalize(p) === p && !p.split("/").includes("..");
+}
+/** Whether `o` holds only `keys`, as zod's `.strict()` requires. */
+const only = (o, keys) => Object.keys(o).every((k) => keys.includes(k));
+const optional = (v, ok) => v === undefined || ok(v);
+const nonEmpty = (v) => typeof v === "string" && v.length > 0;
+/**
+ * What is wrong with a parsed `.chant/trust.json`, one line per field, or an
+ * empty list when it is valid. It accepts exactly what `trustConfigSchema`
+ * in `./policy.ts` accepts, so a reader without zod treats a file as chant
+ * does: an invalid one turns attestation off.
+ */
+export function trustConfigProblems(raw) {
+    if (!isObject(raw))
+        return ["/: expected an object"];
+    const problems = [];
+    const check = (field, ok, message) => {
+        if (!ok)
+            problems.push(`${field}: ${message}`);
+    };
+    check("/", only(raw, ["schema", "signers", "roles", "adopted", "runners", "admitted"]), "unknown key");
+    check("schema", raw.schema === 1, "expected 1");
+    check("signers", optional(raw.signers, isRepoPath), "a path inside the repository, with / separators and no ..");
+    check("roles", optional(raw.roles, (r) => isObject(r) && Object.entries(r).every(([k, v]) => /^[a-z][a-z0-9-]*$/.test(k) && Array.isArray(v) && v.every(nonEmpty))), "role names to lists of principals");
+    check("adopted", optional(raw.adopted, (a) => Array.isArray(a) &&
+        a.every((e) => isObject(e) && only(e, ["from", "to", "note"]) && optional(e.from, (f) => typeof f === "string" && FULL_COMMIT.test(f)) && typeof e.to === "string" && FULL_COMMIT.test(e.to) && optional(e.note, (n) => typeof n === "string"))), "commit ranges of full commit ids");
+    check("runners", optional(raw.runners, (a) => Array.isArray(a) &&
+        a.every((e) => isObject(e) && only(e, ["principal", "class", "key"]) && nonEmpty(e.principal) && (e.class === "runner" || e.class === "service") && typeof e.key === "string" && SSH_ED25519.test(e.key))), "runner keys: a principal, a class and an ssh-ed25519 key");
+    check("admitted", optional(raw.admitted, (a) => Array.isArray(a) &&
+        a.every((e) => isObject(e) && only(e, ["return", "signers", "note"]) &&
+            typeof e.return === "string" && /^ret-[0-9a-f]{12}$/.test(e.return) &&
+            optional(e.note, (n) => typeof n === "string") &&
+            Array.isArray(e.signers) && e.signers.length > 0 &&
+            e.signers.every((s) => isObject(s) && only(s, ["principal", "key"]) && nonEmpty(s.principal) && typeof s.key === "string" && SSH_KEY.test(s.key)))), "admitted signers, by return id");
+    return problems;
+}