@intentius/chant 0.124.27 → 0.124.29

package/dist/cli/handlers/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAU1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAYlD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAGpE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AA+BjC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GAAG,OAAO,CAMjF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,eAAe,EAAE,OAAO,GAAG,SAAS,EACpC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GACzC,MAAM,CAQR;AAuLD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAuED,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAetE;AA8BD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAenE;AA2CD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvE;AAID,iGAAiG;AACjG,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAsMD,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BhE;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,qBAAqB,EAAE,EAChC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,GAChB,OAAO,CAAC,aAAa,EAAE,CAAC,CA0C1B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAmMD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AA4OD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/run.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmB,KAAK,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhE,OAAO,EAAkD,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAU1G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAWlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAErE,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAIlG;;;;;GAKG;AACH,eAAO,MAAM,eAAe,IAAI,CAAC;AA+BjC;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GAAG,OAAO,CAMjF;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAChC,eAAe,EAAE,OAAO,GAAG,SAAS,EACpC,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,SAAS,GACzC,MAAM,CAQR;AAuLD,wBAAsB,SAAS,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAGpE;AAuED,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAetE;AA8BD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAenE;AA2CD,0FAA0F;AAC1F,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAWrD;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+CtE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6CvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAQvE;AAID,iGAAiG;AACjG,wBAAsB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBtE;AAsMD,wBAAsB,KAAK,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4BhE;AAID;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAEvF;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,qBAAqB,EAAE,EAChC,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,OAAO,EACjB,SAAS,GAAE,SAA8B,EACzC,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,EAAE,CAAC,CA+C1B;AAID;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAuCD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM;;;;GAe5E;AA8MD;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAEnE;AAyPD,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAMjE"}

package/dist/cli/handlers/run.js

@@ -13,7 +13,7 @@ import { pointAnswerCommand, renderHuman, renderJson } from "../../op/local-outp
 import { loadPlugins } from "../plugins.js";
 import { recordGateApproval } from "./operator.js";
 import { formatError, formatWarning, formatSuccess, formatBold, formatInfo } from "../format.js";
-import { resolveCliBuildParams, parseParamFlags } from "../build-params-cli.js";
+import { parseParamFlags } from "../build-params-cli.js";
 import { stewardBesideFor, stewardFormFor, stewardTurnLeaseName, DEFAULT_STEWARD_ENV } from "../../op/steward.js";
 import { holdBesideLease } from "../../op/steward-beside.js";
 import { acquireStewardTurn, STEWARD_TURN_WAIT_MS } from "../../op/operator.js";
@@ -23,9 +23,13 @@ import { LIFECYCLE_LOCAL_NOTE, isLifecycleLocalNote } from "../../lifecycle/loca
 import { ledgerRecordingOff, noRecordEndNote, noRecordStartNote, resetNoRecordLedger, NO_RECORD_ENV } from "../../lifecycle/no-record.js";
 import { renderDriverHuman, renderDriverJson } from "../../components/driver-output.js";
 import { ndjsonProgressSink } from "../../components/run-progress.js";
+import { findStoredRun, readRunEvents } from "../../run-event-store.js";
+import { openCliRunEvents, refusesBothStreams, stdoutLine } from "../run-events.js";
 import { maybeRecordAutoRelease } from "../../components/auto-release.js";
 import { maybePersistBuildManifest } from "../../components/manifest-persistence.js";
 import { isComponentList } from "../../components/cli-support.js";
+import { resolveCiRun } from "../../lifecycle/release-ledger.js";
+import { gateAdmission, gateApprover } from "../../components/promote.js";
 import { runOpGenerate } from "./run-generate.js";
 /**
  * The exit code a run that stopped at an unapproved gate uses (#2119).
@@ -396,6 +400,84 @@ async function runOpLogOnRuntime(ctx, name) {
     }
     return 0;
 }
+// ── chant run events <run> ───────────────────────────────────────────────────
+/** One event as a line for a person: its time, its type, where it is and how it ended. */
+export function humanRunEventLine(e) {
+    const x = e;
+    const where = [x.component, x.phase, x.step].filter((v) => typeof v === "string").join("/");
+    const detail = [
+        where,
+        typeof x.status === "string" ? x.status : "",
+        // A blocked component (#4007) names what held it back.
+        typeof x.blockedBy === "string" ? `by ${x.blockedBy}` : "",
+        typeof x.error === "string" ? x.error : "",
+    ].filter(Boolean).join(" ");
+    return `${String(x.at ?? "")}  ${String(x.type).padEnd(16)}${detail}`.trimEnd();
+}
+/** The exit code a run's verdict maps to: `chant run`'s own (0 ok, 1 failed, 3 waiting on a person). */
+function exitOfSettle(status) {
+    return status === "ok" ? 0 : status === "gated" || status === "waiting" ? 3 : 1;
+}
+/**
+ * `chant run events <run> [--json] [--follow]` (#4042): the events a run on
+ * this host kept, replayed. `<run>` is a run id, or the name of an Op or a
+ * component selection, for which the newest stored run stands. A settled run
+ * and a run in progress both replay what is in the file; `--follow` goes on
+ * from there until the run settles. `--json` prints the stored lines as they
+ * were written; without it each event is one line for a person.
+ *
+ * The exit code is the replayed run's verdict (0, 1, or 3 for a run waiting
+ * on a person). A replay of a run still going, and a follow cut short by
+ * Ctrl-C, exit 0.
+ */
+export async function runOpEvents(ctx) {
+    const ref = ctx.args.extraPositional;
+    if (!ref) {
+        console.error(formatError({ message: "A run id or an Op name is required: chant run events <run>" }));
+        return 1;
+    }
+    if (ctx.args.on !== undefined && ctx.args.on !== "local") {
+        console.error(formatError({
+            message: `run events reads the events kept on this host, so --on ${ctx.args.on} has none to read`,
+            hint: "A run hosted off this host is read once its in-flight state is off-host (#3990).",
+        }));
+        return 1;
+    }
+    const cwd = resolve(".");
+    let stored = await findStoredRun(cwd, ref);
+    if (!stored && ctx.args.follow) {
+        // The run may be starting: give it a moment to open its file.
+        const deadline = Date.now() + RUN_EVENTS_WAIT_MS;
+        while (!stored && Date.now() < deadline) {
+            await new Promise((r) => setTimeout(r, 100));
+            stored = await findStoredRun(cwd, ref);
+        }
+    }
+    if (!stored) {
+        console.error(formatError({
+            message: `No events are kept for "${ref}" on this host`,
+            hint: "A run keeps its events when it records to the ledger (not under --no-record), and a command other than `chant run <op>` keeps them under --events-json. Chant 0.124.28 and newer write them.",
+        }));
+        return 1;
+    }
+    const controller = new AbortController();
+    const onSigint = () => controller.abort();
+    process.on("SIGINT", onSigint);
+    try {
+        const settle = await readRunEvents(stored.file, (event, line) => {
+            if (ctx.args.json)
+                process.stdout.write(line);
+            else
+                console.log(humanRunEventLine(event));
+        }, { follow: ctx.args.follow === true, signal: controller.signal });
+        return settle ? exitOfSettle(settle.status) : 0;
+    }
+    finally {
+        process.removeListener("SIGINT", onSigint);
+    }
+}
+/** How long `--follow` waits for a run's file to appear. */
+const RUN_EVENTS_WAIT_MS = 5000;
 // ── chant run approve <op> <gate> ────────────────────────────────────────────
 /**
  * `chant run approve <op> <gate> [--approver] [--url] [--note]` (#2121) — the
@@ -688,6 +770,8 @@ export async function runOp(ctx) {
         }));
         return 1;
     }
+    if (refusesBothStreams(ctx.args))
+        return 1;
     if (ctx.args.components)
         return runOpComponents(ctx);
     if (ctx.args.report) {
@@ -700,6 +784,15 @@ export async function runOp(ctx) {
     return runOpOnRuntime(ctx);
 }
 // ── Auto-release recording post-run (#597) ──────────────────────────────────
+/**
+ * The run id and origin an auto-recorded release names (#4020): the CI run
+ * when the process is in CI, so the release and the gate it passed (which
+ * records the CI run id) name the same run, else `localId` with the `local`
+ * origin.
+ */
+export function autoReleaseRun(localId) {
+    return resolveCiRun() ?? { runId: localId, runOrigin: { forge: "local" } };
+}
 /**
  * After a successful `chant run --components` (local executor), auto-emit
  * one release record per successfully deployed component that published a
@@ -735,7 +828,7 @@ export async function runOp(ctx) {
  *
  * Returns the records it wrote, for `--digest-file` (#2602).
  */
-export async function recordAutoReleasesForRun(results, env, runId, disabled) {
+export async function recordAutoReleasesForRun(results, env, runId, disabled, runOrigin = { forge: "local" }, releaseDigest) {
     const recorded = [];
     for (const componentResult of results) {
         if (!componentResult.ok)
@@ -746,8 +839,13 @@ export async function recordAutoReleasesForRun(results, env, runId, disabled) {
             success: true,
             records: componentResult.records,
             runId,
-            // A local-executor id resolves nowhere — say so in a field (#2045).
-            runOrigin: { forge: "local" },
+            // A local-executor id resolves nowhere, and says so in a field (#2045). A run in CI names the CI run.
+            runOrigin,
+            // #1035, #4020: who approved at the gate and which resolution admitted the deploy.
+            ...(gateApprover(componentResult) ? { approver: gateApprover(componentResult) } : {}),
+            ...(gateAdmission(componentResult) ? { admission: gateAdmission(componentResult) } : {}),
+            // #4043: the release the deploy was made under, when `--release` named one.
+            ...(releaseDigest !== undefined ? { releaseDigest } : {}),
         }, { disabled });
         if (!outcome.recorded && outcome.reason === "error") {
             console.error(formatWarning({
@@ -850,6 +948,42 @@ function refusesNoRecordOn(runtime) {
     }));
     return true;
 }
+/**
+ * Resolve the release `chant run --components --release` names (#4043), or the
+ * reason it can't be used. The run builds from the checked-out commit, so the
+ * release's commit must be HEAD, and the release needs a target for `env`.
+ */
+export async function resolveRunRelease(ref, env, cwd) {
+    const { fetchLifecycle, getHeadCommit } = await import("../../lifecycle/git.js");
+    const { resolveRelease } = await import("../../lifecycle/release-store.js");
+    const { targetFor } = await import("../../components/release-promote.js");
+    await fetchLifecycle({ cwd }).catch(() => false);
+    const found = await resolveRelease(ref, { cwd });
+    if (!found)
+        return `no release is labelled or digested "${ref}" in this member`;
+    const name = found.label ?? found.release.releaseDigest;
+    const head = await getHeadCommit({ cwd });
+    if (found.release.commit !== head) {
+        return `release ${name} was cut from ${found.release.commit.slice(0, 12)} and this checkout is at ${head.slice(0, 12)}; run builds from the checkout, so check out the release's commit, or deploy it with \`chant components promote --release\``;
+    }
+    const target = targetFor(found.release, env);
+    if ("error" in target)
+        return target.error;
+    return { releaseDigest: found.release.releaseDigest, label: found.label, release: found.release };
+}
+/** A rebuilt image need not digest as the release's own did; say so, as promote does. Never fails the run. */
+async function warnOnArtifactMismatch(release, recorded) {
+    try {
+        const { releaseArtifactMismatches } = await import("../../components/release-promote.js");
+        const { readBuildManifest } = await import("../../lifecycle/build-ledger-store.js");
+        const mismatches = await releaseArtifactMismatches(release, recorded.map((r) => ({ component: r.component, source: r })), (digest) => readBuildManifest(digest).catch(() => null));
+        for (const message of mismatches)
+            console.error(formatWarning({ message }));
+    }
+    catch {
+        // The record is written; a manifest that can't be read is not worth failing the run for.
+    }
+}
 async function runComponentSelection(ctx) {
     const selector = ctx.args.path;
     if (!selector || selector === ".") {
@@ -864,11 +998,13 @@ async function runComponentSelection(ctx) {
         return 1;
     const projectPath = resolve(".");
     const { config } = await loadChantConfig(projectPath).catch(() => ({ config: {} }));
-    const paramsResolution = resolveCliBuildParams(config.buildParams, {
+    // #4024: with --env, a workspace member's flag records back their parameters.
+    const { resolveFlaggedBuildParams } = await import("../../flag-params.js");
+    const paramsResolution = await resolveFlaggedBuildParams(projectPath, config.buildParams, {
         cli: parseParamFlags(ctx.args.param),
         paramsFile: ctx.args.paramsFile,
         verbose: ctx.args.verbose,
-    });
+    }, ctx.args.env);
     if (!paramsResolution.success) {
         for (const message of paramsResolution.errors)
             console.error(message);
@@ -887,6 +1023,19 @@ async function runComponentSelection(ctx) {
         return 1;
     }
     const env = ctx.args.env ?? "local";
+    // #4043: `--release <label|digest>` says this run deploys that release. The
+    // run builds from the checked-out commit, so the release must have been cut
+    // from it, and must have a target for the environment. Both are checked
+    // before anything deploys; nothing is inferred when the flag is absent.
+    let underRelease;
+    if (ctx.args.release) {
+        const refused = await resolveRunRelease(ctx.args.release, env, projectPath);
+        if (typeof refused === "string") {
+            console.error(formatError({ message: refused, hint: "List the releases with: chant release list" }));
+            return 1;
+        }
+        underRelease = refused;
+    }
     // Seed cross-component/cross-stack outputs from upstream jobs' dumped files
     // (`--seed-outputs`), so a single-component run resolves references to a
     // component that ran in an earlier CI job.
@@ -909,6 +1058,10 @@ async function runComponentSelection(ctx) {
     // `undefined` and every `onProgress?.(...)` call in the driver is a no-op —
     // behavior is byte-for-byte unchanged from before this flag existed.
     const onProgress = ctx.args.progressJson ? ndjsonProgressSink() : undefined;
+    // `--events-json` (#4041): the run-event stream instead. The run is named by
+    // the id its release records carry, so the two join.
+    const release = autoReleaseRun(`local-${Date.now()}`);
+    const events = await openCliRunEvents(ctx.args, { kind: "component", name: selector, runId: release.runId, cwd: projectPath });
     // A list (#3950) pulls in what its components depend on; say which ones and
     // in what order before the first one runs. stderr, so --json and
     // --progress-json keep stdout to themselves.
@@ -919,14 +1072,29 @@ async function runComponentSelection(ctx) {
                 console.error(formatInfo(`added as dependencies: ${plan.added.join(", ")}`));
         }
         : undefined;
-    const result = await runtime.runComponents(projectPath, selector, {
-        env: ctx.args.env,
-        componentOutputs: seededOutputs,
-        onProgress,
-        sandbox: ctx.args.sandbox,
-        buildParams: paramsResolution.provenance,
-        ...(onPlan ? { onPlan } : {}),
-    });
+    let result;
+    try {
+        result = await runtime.runComponents(projectPath, selector, {
+            env: ctx.args.env,
+            componentOutputs: seededOutputs,
+            onProgress,
+            ...(events ? { onRunEvent: events.emit } : {}),
+            sandbox: ctx.args.sandbox,
+            buildParams: paramsResolution.provenance,
+            ...(onPlan ? { onPlan } : {}),
+        });
+    }
+    catch (err) {
+        events?.settle("failed", err instanceof Error ? err.message : String(err));
+        throw err;
+    }
+    // A run that never reached its components (a bad selector, a cycle) still ends its stream.
+    if (result.success)
+        events?.settle("ok");
+    else if (result.gated)
+        events?.settle("gated");
+    else
+        events?.settle("failed", result.error);
     // Dump the accumulated outputs for a downstream job to seed from. Written
     // even on failure (partial outputs) so a resumed run still has what completed.
     if (ctx.args.dumpOutputs && result.run) {
@@ -990,7 +1158,9 @@ async function runComponentSelection(ctx) {
     if (result.success && result.run) {
         // #3955: a run that records nothing has no release to report either.
         const disabled = resolveAutoReleaseDisabled(config, ctx.args.noReleaseRecord) || ledgerRecordingOff();
-        const recorded = await recordAutoReleasesForRun(result.run.results, env, `local-${Date.now()}`, disabled);
+        const recorded = await recordAutoReleasesForRun(result.run.results, env, release.runId, disabled, release.runOrigin, underRelease?.releaseDigest);
+        if (underRelease)
+            await warnOnArtifactMismatch(underRelease.release, recorded);
         // `--digest-file` (#2602): the releases this run recorded, one
         // `<component>=<digest>` line each, the form `chant components promote
         // --digest` takes. A generated promote job reads it to promote exactly
@@ -1069,6 +1239,14 @@ async function runOpOnResolvedRuntime(ctx) {
         await stewardGate?.release?.();
         return 1;
     }
+    // #4044: a runner key signs the run's record as it settles, so `ci tick`
+    // can count the run. `--key` must be a runner key; the PEM in
+    // CHANT_RUNNER_KEY that is not one leaves the run unsigned, with a warning.
+    const signRecord = await runSignerFor(ctx);
+    if (signRecord === null) {
+        await stewardGate?.release?.();
+        return 1;
+    }
     // `--progress-json` streams one NDJSON StepRecord per settled step, fed by
     // whatever the runtime reports through `progress`.
     const progress = ctx.args.progressJson ? ndjsonProgressSink() : undefined;
@@ -1103,6 +1281,10 @@ async function runOpOnResolvedRuntime(ctx) {
             ...(params ? { params } : {}),
             ...(ctx.args.profile !== undefined ? { profile: ctx.args.profile } : {}),
             progress,
+            // `--events-json` (#4041): the runtime writes the run's events itself,
+            // since it is the one that knows the run's id and where it ran.
+            ...(ctx.args.eventsJson ? { runEvents: stdoutLine } : {}),
+            ...(signRecord ? { signRecord } : {}),
             signal: controller.signal,
             ...(work ? { work } : {}),
         });
@@ -1249,7 +1431,43 @@ async function resolveRunWork(ctx, config, provider) {
 export function runOpUnknown(ctx) {
     console.error(formatError({
         message: `Unknown run subcommand: ${ctx.args.extraPositional ?? ctx.args.path}`,
-        hint: "Available: chant run <name>, run list, run status, run approve, run cancel, run log",
+        hint: "Available: chant run <name>, run list, run status, run approve, run cancel, run log, run events",
     }));
     return Promise.resolve(1);
 }
+/** The variable a runner key is read from, as PEM, as `chant ci tick` reads it (`RUNNER_KEY_ENV` in ../../workspace/ci-green.ts). */
+const RUNNER_KEY_ENV = "CHANT_RUNNER_KEY";
+/**
+ * What signs the run's record (#4044): the runner key `--key` names, or the
+ * PEM in `CHANT_RUNNER_KEY`, checked against `.chant/trust.json` at `HEAD`.
+ * Undefined when neither is given. Null, after printing why, when `--key`
+ * is not a runner key; an unusable `CHANT_RUNNER_KEY` only warns, since the
+ * variable may be set for `ci tick` in a job that also runs Ops.
+ */
+async function runSignerFor(ctx) {
+    const fromFlag = ctx.args.key !== undefined;
+    let pem;
+    try {
+        pem = fromFlag ? readFileSync(resolve(ctx.args.key), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+    }
+    catch (err) {
+        console.error(formatError({ message: `--key ${ctx.args.key}: ${err instanceof Error ? err.message : String(err)}` }));
+        return null;
+    }
+    if (pem === undefined)
+        return undefined;
+    try {
+        // Loaded only when a key is given, so a run without one loads no workspace code (level 0, #2525).
+        const { opRunSigner } = await import("../../workspace/ci-green.js");
+        return opRunSigner(process.cwd(), pem);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (fromFlag) {
+            console.error(formatError({ message: `the run would not be signed: ${message}` }));
+            return null;
+        }
+        console.error(formatWarning({ message: `${RUNNER_KEY_ENV} is set, and the run will not be signed: ${message}` }));
+        return undefined;
+    }
+}

package/dist/cli/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAwkCzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EA6KvC,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/cli/main.ts"],"names":[],"mappings":";AAKA,OAAO,EAAkB,KAAK,UAAU,EAAmB,MAAM,YAAY,CAAC;AAa9E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAgB,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;AAorCzC;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBzE;AAID;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,EAAE,UAAU,EA+LvC,CAAC"}