@intentius/chant 0.124.28 → 0.124.30

package/dist/lifecycle/release-revocation.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Which releases are revoked (#4033, ws-105 question 2).
+ *
+ * A release traces to one commit (ws-104), and a commit is revoked when it
+ * carries a `ci/revoked/<sha>` tag that counts (ws-103). So a release is
+ * revoked exactly when its commit is, and this module derives that at read
+ * time from the tags. Nothing is written when a commit is revoked: the tag is
+ * the record, `chant ci tick` makes it once, and every reader below judges it
+ * the same way.
+ *
+ * The tags are judged as `release cut` judges them (#4031): with
+ * `ci.green.signedSince` declared, a revoked tag without a valid runner
+ * statement is ignored and revokes nothing. The declaration and the runner
+ * keys are read at base, the green branch's tip on `origin` (or the local
+ * branch, or `HEAD`). Only local tags are read; nothing is fetched.
+ *
+ * The readers:
+ *
+ * - `chant approve` refuses a release gate whose release is revoked
+ *   (`release-revoked`), and `chant components promote --release` refuses to
+ *   deploy one, so a pending gate for it can never pass.
+ * - `chant workspace status --json` reads such a gate as `superseded` and
+ *   flags a component whose environment runs a revoked release, with the
+ *   rollback line.
+ * - `chant release list` marks a revoked release.
+ */
+import type { CiGreen } from "../workspace/declaration.js";
+import type { CiTags, RevokedTagView } from "../workspace/ci-green.js";
+/** A revoked release: the commit it was cut from and the revoked tag on it, as `ci list` shows the tag. */
+export interface ReleaseRevocation extends RevokedTagView {
+    /** The release's commit, which the tag names. */
+    commit: string;
+}
+/** The stable code `approve` and `promote --release` refuse a revoked release with. */
+export declare const RELEASE_REVOKED_CODE = "release-revoked";
+/**
+ * The ci tags at `top`, judged against `green` at base: the green branch's
+ * tip on `origin`, else the local branch, else `HEAD`. With no `ci.green`
+ * every tag counts. Throws `WorkspaceReadError` (`declaration-invalid`) when
+ * `ci.green.signedSince` names no commit here.
+ */
+export declare function judgedCiTags(top: string, green: CiGreen | null): Promise<CiTags>;
+/**
+ * Every revoked commit in the repository holding `cwd`, keyed by its full
+ * sha, with the declaration's `ci.green` read at base as `release cut` reads
+ * it. Empty outside a git repository. Throws `WorkspaceReadError`
+ * (`declaration-invalid`) when the tags can't be judged.
+ */
+export declare function readRevokedCommits(cwd: string): Promise<Map<string, ReleaseRevocation>>;
+/** {@link readRevokedCommits} for a caller that has the git top and the declaration's `ci.green` at base already. */
+export declare function revokedCommitsAt(top: string, green: CiGreen | null): Promise<Map<string, ReleaseRevocation>>;
+/** What a reader prints for a release it found revoked: the revocation, the release and its label. */
+export interface RevokedRelease extends ReleaseRevocation {
+    releaseDigest: string;
+    /** The release's label, or null when its cuts gave it none. */
+    label: string | null;
+}
+/**
+ * A memoised lookup from a release digest to its revocation, for the member
+ * whose ledger is read from `memberDir`: null when the release is not
+ * revoked, or its file can't be read. `revoked` is called on the first
+ * lookup only, so a reader that meets no release reads no tags, and no
+ * release file is read while no commit is revoked.
+ */
+export declare function revokedReleaseLookup(memberDir: string, revoked: () => Promise<ReadonlyMap<string, ReleaseRevocation>>): (releaseDigest: string) => Promise<RevokedRelease | null>;
+/** Whether `release` is revoked: its commit's revoked tag, or null. */
+export declare function revocationOf(release: {
+    commit: string;
+}, revoked: ReadonlyMap<string, ReleaseRevocation>): ReleaseRevocation | null;
+/** What failed, in words: `phase e2e failed in deploy-smoke (Op run r-12 in staging)`. */
+export declare function describeRevocation(r: ReleaseRevocation): string;
+/** The refusal `approve` and `promote --release` print for a revoked release, and the line that fixes it. */
+export declare function revokedRefusal(release: {
+    releaseDigest: string;
+    label: string | null;
+}, r: ReleaseRevocation, fix: string): {
+    message: string;
+    hint: string;
+};
+//# sourceMappingURL=release-revocation.d.ts.map

package/dist/lifecycle/release-revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-revocation.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEpE,2GAA2G;AAC3G,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAUtD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtF;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAK7F;AAED,qHAAqH;AACrH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAKlH;AAED,sGAAsG;AACtG,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,aAAa,EAAE,MAAM,CAAC;IACtB,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,GAC7D,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAqB3D;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,GAAG,iBAAiB,GAAG,IAAI,CAEnI;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,iBAAiB,GAAG,MAAM,CAK/D;AAED,6GAA6G;AAC7G,wBAAgB,cAAc,CAAC,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAAE,CAAC,EAAE,iBAAiB,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAO7J"}

package/dist/lifecycle/release-revocation.js

@@ -0,0 +1,123 @@
+/**
+ * Which releases are revoked (#4033, ws-105 question 2).
+ *
+ * A release traces to one commit (ws-104), and a commit is revoked when it
+ * carries a `ci/revoked/<sha>` tag that counts (ws-103). So a release is
+ * revoked exactly when its commit is, and this module derives that at read
+ * time from the tags. Nothing is written when a commit is revoked: the tag is
+ * the record, `chant ci tick` makes it once, and every reader below judges it
+ * the same way.
+ *
+ * The tags are judged as `release cut` judges them (#4031): with
+ * `ci.green.signedSince` declared, a revoked tag without a valid runner
+ * statement is ignored and revokes nothing. The declaration and the runner
+ * keys are read at base, the green branch's tip on `origin` (or the local
+ * branch, or `HEAD`). Only local tags are read; nothing is fetched.
+ *
+ * The readers:
+ *
+ * - `chant approve` refuses a release gate whose release is revoked
+ *   (`release-revoked`), and `chant components promote --release` refuses to
+ *   deploy one, so a pending gate for it can never pass.
+ * - `chant workspace status --json` reads such a gate as `superseded` and
+ *   flags a component whose environment runs a revoked release, with the
+ *   rollback line.
+ * - `chant release list` marks a revoked release.
+ */
+import { execFileSync } from "node:child_process";
+/** The stable code `approve` and `promote --release` refuse a revoked release with. */
+export const RELEASE_REVOKED_CODE = "release-revoked";
+function tryGit(top, args) {
+    try {
+        return execFileSync("git", args, { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The ci tags at `top`, judged against `green` at base: the green branch's
+ * tip on `origin`, else the local branch, else `HEAD`. With no `ci.green`
+ * every tag counts. Throws `WorkspaceReadError` (`declaration-invalid`) when
+ * `ci.green.signedSince` names no commit here.
+ */
+export async function judgedCiTags(top, green) {
+    const { readCiTags } = await import("../workspace/ci-green.js");
+    const base = green
+        ? (tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/remotes/origin/${green.branch}^{commit}`]) ??
+            tryGit(top, ["rev-parse", "--verify", "--quiet", `refs/heads/${green.branch}^{commit}`]) ??
+            tryGit(top, ["rev-parse", "HEAD"]))
+        : null;
+    return readCiTags(top, green, base);
+}
+/**
+ * Every revoked commit in the repository holding `cwd`, keyed by its full
+ * sha, with the declaration's `ci.green` read at base as `release cut` reads
+ * it. Empty outside a git repository. Throws `WorkspaceReadError`
+ * (`declaration-invalid`) when the tags can't be judged.
+ */
+export async function readRevokedCommits(cwd) {
+    const top = tryGit(cwd, ["rev-parse", "--show-toplevel"]);
+    if (!top)
+        return new Map();
+    const { scopeSource } = await import("../workspace/write-scope.js");
+    return revokedCommitsAt(top, scopeSource(cwd).declaration?.ci?.green ?? null);
+}
+/** {@link readRevokedCommits} for a caller that has the git top and the declaration's `ci.green` at base already. */
+export async function revokedCommitsAt(top, green) {
+    const { revokedTagView } = await import("../workspace/ci-green.js");
+    const out = new Map();
+    for (const [sha, counted] of (await judgedCiTags(top, green)).revoked)
+        out.set(sha, { commit: sha, ...revokedTagView(sha, counted) });
+    return out;
+}
+/**
+ * A memoised lookup from a release digest to its revocation, for the member
+ * whose ledger is read from `memberDir`: null when the release is not
+ * revoked, or its file can't be read. `revoked` is called on the first
+ * lookup only, so a reader that meets no release reads no tags, and no
+ * release file is read while no commit is revoked.
+ */
+export function revokedReleaseLookup(memberDir, revoked) {
+    const seen = new Map();
+    let labels;
+    return (releaseDigest) => {
+        let found = seen.get(releaseDigest);
+        if (!found) {
+            found = (async () => {
+                const commits = await revoked();
+                if (commits.size === 0)
+                    return null;
+                const { readRelease, readCuts, labelsByDigest } = await import("./release-store.js");
+                const loc = { cwd: memberDir };
+                const release = await readRelease(releaseDigest, loc).catch(() => null);
+                const r = release ? revocationOf(release, commits) : null;
+                if (!r)
+                    return null;
+                labels ?? (labels = readCuts(loc).then((c) => labelsByDigest(c.cuts), () => new Map()));
+                return { ...r, releaseDigest, label: (await labels).get(releaseDigest) ?? null };
+            })();
+            seen.set(releaseDigest, found);
+        }
+        return found;
+    };
+}
+/** Whether `release` is revoked: its commit's revoked tag, or null. */
+export function revocationOf(release, revoked) {
+    return revoked.get(release.commit) ?? null;
+}
+/** What failed, in words: `phase e2e failed in deploy-smoke (Op run r-12 in staging)`. */
+export function describeRevocation(r) {
+    const run = r.run
+        ? ` in ${r.run.name}${r.run.opRun ? ` (Op run ${r.run.opRun.id} in ${r.run.opRun.env})` : r.run.id !== null ? ` (run ${r.run.id})` : ""}`
+        : "";
+    return r.phase !== null ? `phase ${r.phase} failed${run}` : `a required phase failed${run}`;
+}
+/** The refusal `approve` and `promote --release` print for a revoked release, and the line that fixes it. */
+export function revokedRefusal(release, r, fix) {
+    return {
+        message: `release ${release.label ?? release.releaseDigest} was cut from commit ${r.commit.slice(0, 12)}, which ${r.tag} revokes ` +
+            `(${describeRevocation(r)}), so it is not deployed and no approval of it counts [${RELEASE_REVOKED_CODE}]`,
+        hint: fix,
+    };
+}

package/dist/lifecycle/release-store.d.ts

@@ -89,7 +89,16 @@ export interface ReleaseCut {
     label: string | null;
     actor: string;
     timestamp: string;
-    /** The CI run the cut ran in, or null outside CI. */
+    /**
+     * The run the cut ran in (#4027): the CI run's id in CI, or an id minted on
+     * the machine that cut (`local-<epoch ms>`). Null on every cut written
+     * before 0.124.29.
+     */
+    runId: string | null;
+    /**
+     * Where that run ran: the CI run's origin, or `{ forge: "local" }` for a
+     * minted id (#4027). A cut written before 0.124.29 holds null outside CI.
+     */
     runOrigin: RunOrigin | null;
     /**
      * The cut's signature (#4031): an armored ssh signature by the actor's key
@@ -172,8 +181,9 @@ export type CutOutcome = {
  * cut, and cutting a digest under a label other than its own, or under a
  * label another digest has, throws {@link ReleaseLabelError}. Does not push.
  */
-export declare function appendCut(input: Omit<ReleaseCut, "version" | "signature"> & {
+export declare function appendCut(input: Omit<ReleaseCut, "version" | "signature" | "runId"> & {
     signature?: string | null;
+    runId?: string | null;
 }, opts?: {
     cwd?: string;
 }): Promise<CutOutcome>;

package/dist/lifecycle/release-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-store.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,+CAA+C;AAC/C,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,0GAA0G;AAC1G,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAIhG,qKAAqK;AACrK,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAgBxE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAQjE;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAG5D;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AASD,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9D;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB;IAD7F,YACW,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB,EAC3F,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BtD;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CA2BzD;AAED,kIAAkI;AAClI,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAMhG;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAyBxF;AAED,+BAA+B;AAC/B,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAExG;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AACrC,iGAAiG;GAC/F;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI9C;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAChF,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAgDrB;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAQnI"}
+{"version":3,"file":"release-store.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAKH,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,OAAO,CAAC;AACf,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,uFAAuF;AACvF,eAAO,MAAM,YAAY,cAAc,CAAC;AACxC,+CAA+C;AAC/C,eAAO,MAAM,SAAS,eAAe,CAAC;AACtC,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAE5C,0GAA0G;AAC1G,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,6FAA6F;AAC7F,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;IACxB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,0GAA0G;AAC1G,MAAM,WAAW,eAAe;IAC9B,qFAAqF;IACrF,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;IACjC,+FAA+F;IAC/F,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,MAAM,EAAE,YAAY,EAAE,CAAC;CACxB;AAED,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,wGAAwG;IACxG,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB;;;OAGG;IACH,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IAC5B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,wDAAwD;AACxD,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC,CAAC;AAIhG,qKAAqK;AACrK,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,cAAc,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAgBxE;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAQjE;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,CAEpE;AAED,iEAAiE;AACjE,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAG5D;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AASD,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9D;AAED,gFAAgF;AAChF,qBAAa,iBAAkB,SAAQ,KAAK;IAExC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB;IAD7F,YACW,IAAI,EAAE,qBAAqB,GAAG,0BAA0B,GAAG,uBAAuB,EAC3F,OAAO,EAAE,MAAM,EAIhB;CACF;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,SAAS,EAAE,SAAS,eAAe,EAAE,EACrC,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA4BtD;AAED,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CA2BzD;AAED,kIAAkI;AAClI,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAMhG;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAWhH;AAED,wFAAwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA0BxF;AAED,+BAA+B;AAC/B,wBAAsB,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAExG;AAED,6DAA6D;AAC7D,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAI/E;AAED,kCAAkC;AAClC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,UAAU,CAAA;CAAE;AACrC,iGAAiG;GAC/F;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI9C;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjH,IAAI,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GACtB,OAAO,CAAC,UAAU,CAAC,CAiDrB;AAED,iEAAiE;AACjE,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvG;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAAC,CAQnI"}

package/dist/lifecycle/release-store.js

@@ -211,12 +211,13 @@ export function parseCuts(text) {
                 typeof c.actor === "string" &&
                 typeof c.timestamp === "string" &&
                 (c.runOrigin === null || (typeof c.runOrigin === "object" && typeof c.runOrigin?.forge === "string")) &&
-                (c.signature === null || c.signature === undefined || typeof c.signature === "string");
+                (c.signature === null || c.signature === undefined || typeof c.signature === "string") &&
+                (c.runId === null || c.runId === undefined || typeof c.runId === "string");
             if (!ok) {
                 malformed++;
                 continue;
             }
-            cuts.push({ ...c, signature: c.signature ?? null });
+            cuts.push({ ...c, runId: c.runId ?? null, signature: c.signature ?? null });
         }
         catch {
             malformed++;
@@ -278,6 +279,7 @@ export async function appendCut(input, opts) {
             label: input.label,
             actor: input.actor,
             timestamp: input.timestamp,
+            runId: input.runId ?? null,
             runOrigin: input.runOrigin,
             signature: input.signature ?? null,
         };

package/dist/lifecycle/release-verify.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `chant release verify <label|digest>` (#4049): whether a release was
+ * signed by a key `.chant/allowed_signers` lists, checked offline.
+ *
+ * It reads the release and its cuts from the local `chant/lifecycle` branch,
+ * and the signers file, its signed history (#2553) and the declaration at the
+ * release's own commit, as `chant workspace evidence verify` reads the policy
+ * at the revision it is given. It fetches nothing and needs no key. A release
+ * verifies when its file's digest is the digest of what it holds and one of
+ * its cuts carries a signature in the `chant-release` namespace that verifies
+ * for the cut's actor, over the release digest, the label, the actor and the
+ * time (`releaseSealPayload`), and, when the declaration at that commit has an
+ * `identity.gates.release` entry naming a class, the actor is in it.
+ *
+ * Reading the signers at the release's commit means a key added later does
+ * not make an old release verify, and one removed later does not unmake it.
+ */
+import type { ReleaseSignatureCheck } from "../workspace/identity-gate-rule.js";
+import type { ReleaseCut } from "./release-store.js";
+/** What `release verify --json` prints. */
+export interface ReleaseVerification {
+    releaseDigest: string;
+    label: string | null;
+    member: string | null;
+    commit: string;
+    /** Where the signers were read: the signers file's path and the commit. */
+    signers: {
+        path: string;
+        at: string;
+        active: boolean;
+    };
+    /** True when the release file's digest is the digest of what it holds. */
+    digestMatches: boolean;
+    /** `verified` when a cut's signature verifies; `unsigned` when no cut carries one; `unverified` otherwise. */
+    status: "verified" | "unsigned" | "unverified";
+    /** The cut whose signature verified, or null. */
+    verifiedBy: {
+        actor: string;
+        key: string | null;
+    } | null;
+    reason: string;
+    cuts: Array<Pick<ReleaseCut, "label" | "actor" | "timestamp" | "runId"> & {
+        signatureCheck: ReleaseSignatureCheck;
+    }>;
+}
+/** Why a release could not be checked at all. */
+export interface ReleaseVerifyError {
+    code: "release-not-found" | "release-commit-missing" | "trust-policy-unreadable" | "not-a-git-repository";
+    message: string;
+    fix?: string;
+}
+/** The exit-1 codes of a release that was checked and did not verify. */
+export declare function verificationCode(v: ReleaseVerification): "release-digest-mismatch" | "release-unsigned" | "release-signature-unverified" | null;
+/** Check the release `ref` names in the member at `cwd`. Reads only the local repository. */
+export declare function verifyRelease(req: {
+    cwd: string;
+    ref: string;
+}): Promise<ReleaseVerification | {
+    error: ReleaseVerifyError;
+}>;
+//# sourceMappingURL=release-verify.d.ts.map

package/dist/lifecycle/release-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-verify.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE3D,2CAA2C;AAC3C,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC;IACvD,0EAA0E;IAC1E,aAAa,EAAE,OAAO,CAAC;IACvB,8GAA8G;IAC9G,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;IAC/C,iDAAiD;IACjD,UAAU,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG;QAAE,cAAc,EAAE,qBAAqB,CAAA;KAAE,CAAC,CAAC;CACtH;AAED,iDAAiD;AACjD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,mBAAmB,GAAG,wBAAwB,GAAG,yBAAyB,GAAG,sBAAsB,CAAC;IAC1G,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,mBAAmB,GAAG,yBAAyB,GAAG,kBAAkB,GAAG,8BAA8B,GAAG,IAAI,CAI/I;AAED,6FAA6F;AAC7F,wBAAsB,aAAa,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,mBAAmB,GAAG;IAAE,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC,CAiEnI"}

package/dist/lifecycle/release-verify.js

@@ -0,0 +1,92 @@
+/**
+ * `chant release verify <label|digest>` (#4049): whether a release was
+ * signed by a key `.chant/allowed_signers` lists, checked offline.
+ *
+ * It reads the release and its cuts from the local `chant/lifecycle` branch,
+ * and the signers file, its signed history (#2553) and the declaration at the
+ * release's own commit, as `chant workspace evidence verify` reads the policy
+ * at the revision it is given. It fetches nothing and needs no key. A release
+ * verifies when its file's digest is the digest of what it holds and one of
+ * its cuts carries a signature in the `chant-release` namespace that verifies
+ * for the cut's actor, over the release digest, the label, the actor and the
+ * time (`releaseSealPayload`), and, when the declaration at that commit has an
+ * `identity.gates.release` entry naming a class, the actor is in it.
+ *
+ * Reading the signers at the release's commit means a key added later does
+ * not make an old release verify, and one removed later does not unmake it.
+ */
+/** The exit-1 codes of a release that was checked and did not verify. */
+export function verificationCode(v) {
+    if (!v.digestMatches)
+        return "release-digest-mismatch";
+    if (v.status === "verified")
+        return null;
+    return v.status === "unsigned" ? "release-unsigned" : "release-signature-unverified";
+}
+/** Check the release `ref` names in the member at `cwd`. Reads only the local repository. */
+export async function verifyRelease(req) {
+    const { resolveRelease, readCuts, verifyReleaseDigest } = await import("./release-store.js");
+    const { gitRoot } = await import("../workspace/record-source.js");
+    const { resolveBase } = await import("../workspace/trust/provenance.js");
+    const { scopeSource } = await import("../workspace/write-scope.js");
+    const { releaseRuleFrom } = await import("../workspace/identity.js");
+    const { checkReleaseSignature } = await import("../workspace/identity-gate-rule.js");
+    const { cwd, ref } = req;
+    const top = gitRoot(cwd);
+    if (!top)
+        return { error: { code: "not-a-git-repository", message: "a release is checked against the signers file at its commit, and this directory is not in a git repository" } };
+    const found = await resolveRelease(ref, { cwd });
+    if (!found)
+        return { error: { code: "release-not-found", message: `no release is labelled or digested "${ref}" in this member`, fix: "Fetch chant/lifecycle (git fetch origin chant/lifecycle:chant/lifecycle), then list them with: chant release list" } };
+    const release = found.release;
+    const at = resolveBase(top, release.commit).commit;
+    if (!at) {
+        return {
+            error: {
+                code: "release-commit-missing",
+                message: `the release's commit ${release.commit} is not in this clone, so the signers file at it can't be read`,
+                fix: `Fetch it: git fetch origin ${release.commit}`,
+            },
+        };
+    }
+    const source = scopeSource(cwd, at);
+    if (source.policy.problems.length > 0) {
+        return { error: { code: "trust-policy-unreadable", message: `the signers at ${at.slice(0, 12)} can't be read: ${source.policy.problems.join("; ")}` } };
+    }
+    const read = releaseRuleFrom(source);
+    // A declaration read from the working tree is not the commit's, so its class does not apply.
+    const rule = source.from === "base" ? read.rule : { ...read.rule, class: null };
+    const own = (await readCuts({ cwd })).cuts.filter((c) => c.releaseDigest === release.releaseDigest);
+    // The check words where it read the signers as "at base"; here that is the release's commit.
+    const atCommit = (check) => ({ ...check, reason: check.reason.split(`${rule.signers.signersPath} at base`).join(`${rule.signers.signersPath} at ${at.slice(0, 12)}`) });
+    const cuts = own.map((c) => ({
+        label: c.label,
+        actor: c.actor,
+        timestamp: c.timestamp,
+        runId: c.runId ?? null,
+        signatureCheck: atCommit(checkReleaseSignature(rule, { releaseDigest: c.releaseDigest, label: c.label, actor: c.actor, timestamp: c.timestamp, signature: c.signature })),
+    }));
+    const verified = cuts.find((c) => c.signatureCheck.status === "verified");
+    const digestMatches = verifyReleaseDigest(release);
+    const status = verified ? "verified" : cuts.every((c) => c.signatureCheck.status === "unsigned") ? "unsigned" : "unverified";
+    const where = `${rule.signers.signersPath} at ${at.slice(0, 12)}`;
+    const reason = !digestMatches
+        ? `the release file's digest ${release.releaseDigest} is not the digest of what it holds, so it was changed after the cut`
+        : verified
+            ? `${verified.signatureCheck.reason}, checked against ${where}`
+            : status === "unsigned"
+                ? `no cut of the release carries a signature`
+                : cuts.map((c) => c.signatureCheck.reason).join("; ");
+    return {
+        releaseDigest: release.releaseDigest,
+        label: found.label,
+        member: release.member,
+        commit: release.commit,
+        signers: { path: rule.signers.signersPath, at, active: rule.signers.active },
+        digestMatches,
+        status: digestMatches ? status : "unverified",
+        verifiedBy: digestMatches && verified ? { actor: verified.actor, key: verified.signatureCheck.key } : null,
+        reason,
+        cuts,
+    };
+}

package/dist/lifecycle/release-workstation.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Cutting a release from a workstation as from CI (#4027).
+ *
+ * `chant release cut` runs the same steps wherever it runs. What differs
+ * between a laptop and a CI job is read here, from git and the process
+ * environment, so the CLI and its tests resolve it the same way:
+ *
+ * - trunk: the branch `ci.green.branch` names in the declaration at base,
+ *   else the branch `origin/HEAD` points at, else `main`. The commit must be
+ *   reachable from `origin/<branch>` as this clone last fetched it, so a
+ *   commit that is on the local branch only is refused as not pushed. Nothing
+ *   is fetched: a stale `origin/<branch>` can only refuse a commit that was
+ *   pushed since, never admit one that wasn't.
+ * - a clean tree: no tracked change and no untracked file that git does not
+ *   ignore, since the compile reads the directory and a new
+ *   `*.component.ts` would be compiled into the release.
+ * - the actor: `--actor`, else the principal the signers file at base lists
+ *   for the signing key, else the CI's actor, else git's `user.email`, else
+ *   `$USER`.
+ * - the tag: `release/<label>`, or `release/<member>/<label>` in a workspace
+ *   member, an annotated tag on the commit that is created locally and never
+ *   pushed by chant.
+ */
+import type { Signer } from "../workspace/trust/trust-files.js";
+export type WorkstationCheckCode = "release-commit-not-on-trunk" | "release-commit-not-pushed" | "release-worktree-dirty" | "release-tag-taken" | "release-tag-invalid";
+/** A refusal before anything is compiled or written. */
+export declare class WorkstationCheckError extends Error {
+    readonly code: WorkstationCheckCode;
+    readonly fix?: string | undefined;
+    constructor(code: WorkstationCheckCode, message: string, fix?: string | undefined);
+}
+/** The remote a release's commit must be pushed to. */
+export declare const RELEASE_REMOTE = "origin";
+/** The trunk branch, and where its name came from. */
+export interface Trunk {
+    remote: string;
+    branch: string;
+    from: "ci.green.branch" | "origin/HEAD" | "default";
+}
+/** The trunk of the repository at `cwd`: `ci.green.branch` when declared, else what `origin/HEAD` names, else `main`. */
+export declare function resolveTrunk(cwd: string, greenBranch: string | null): Trunk;
+/**
+ * Refuse `commit` unless it is reachable from `<remote>/<branch>` as this
+ * clone knows it. A commit on the local branch only is `release-commit-not-pushed`;
+ * any other is `release-commit-not-on-trunk`.
+ */
+export declare function checkOnTrunk(cwd: string, commit: string, trunk: Trunk): void;
+/** Refuse a tree with a tracked change or an untracked file git does not ignore. */
+export declare function checkCleanTree(cwd: string, commit: string): void;
+/** Where the actor came from. */
+export type ActorSource = "flag" | "signer" | "ci" | "git" | "user";
+/** The public key `keyFile` holds or names, as `<type> <base64>`, or null when it can't be read without a passphrase. */
+export declare function publicKeyOf(keyFile: string): string | null;
+/** The one principal `signers` lists for `publicKey`, or null for none or several. */
+export declare function signerPrincipal(publicKey: string, signers: readonly Signer[]): string | null;
+/**
+ * Who cut the release, and where the name came from: `--actor`, else the
+ * signer the signers file at base lists for the signing key, else the CI's
+ * actor (`GITHUB_ACTOR`, `GITLAB_USER_LOGIN`), else git's `user.email`, else
+ * `$USER`. Undefined when none is set.
+ */
+export declare function resolveCutActor(req: {
+    cwd: string;
+    explicit?: string;
+    /** The signing key's public half, when the cut is signed and it could be read. */
+    publicKey?: string | null;
+    signers?: readonly Signer[];
+    env?: NodeJS.ProcessEnv;
+}): {
+    actor: string;
+    source: ActorSource;
+} | undefined;
+/** The tag a labelled release gets: `release/<label>`, or `release/<member>/<label>` for a workspace member. */
+export declare function releaseTagName(member: string | null, label: string): string;
+/**
+ * Whether `tag` can name `commit`: `absent` (the cut creates it), `present`
+ * (it already names the commit), or a {@link WorkstationCheckError} for a
+ * tag that names another commit or is not a valid tag name.
+ */
+export declare function checkReleaseTag(cwd: string, tag: string, commit: string): "absent" | "present";
+/**
+ * Create `tag` on `commit` as an annotated tag whose message names the
+ * release. Local only. A clone with no git identity tags as chant, as the ci
+ * tags are made.
+ */
+export declare function createReleaseTag(cwd: string, tag: string, commit: string, release: {
+    releaseDigest: string;
+    label: string;
+    member: string | null;
+}): void;
+//# sourceMappingURL=release-workstation.d.ts.map

package/dist/lifecycle/release-workstation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-workstation.d.ts","sourceRoot":"","sources":["../../src/lifecycle/release-workstation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAC;AAE7D,MAAM,MAAM,oBAAoB,GAAG,6BAA6B,GAAG,2BAA2B,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,qBAAqB,CAAC;AAExK,wDAAwD;AACxD,qBAAa,qBAAsB,SAAQ,KAAK;IAE5C,QAAQ,CAAC,IAAI,EAAE,oBAAoB;IAEnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM;IAHvB,YACW,IAAI,EAAE,oBAAoB,EACnC,OAAO,EAAE,MAAM,EACN,GAAG,CAAC,EAAE,MAAM,YAAA,EAItB;CACF;AAaD,uDAAuD;AACvD,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,sDAAsD;AACtD,MAAM,WAAW,KAAK;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,GAAG,aAAa,GAAG,SAAS,CAAC;CACrD;AAED,yHAAyH;AACzH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,CAM3E;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAwB5E;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAehE;AAED,iCAAiC;AACjC,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC;AAEpE,yHAAyH;AACzH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAmB1D;AAED,sFAAsF;AACtF,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAG5F;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG,SAAS,CAarD;AAED,gHAAgH;AAChH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAY9F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAMzJ"}