@intentius/chant 0.124.30 → 0.124.31

package/dist/workspace/ci-serve.js

@@ -15,6 +15,10 @@
  *   the one `chant operator` holds) named for `prApplyGroup`, renews it while
  *   it runs and releases it after. An apply that finds it held waits for a
  *   later poll, as a forge's concurrency group queues it.
+ * - Merged pull request. An apply asks the forge for the pull request whose
+ *   merge commit the new head is (`pullRequestFor`, as pr-apply does) and
+ *   passes it as `--pr`, so its commit status link and run index use
+ *   `<pr>/<commit>`. With none found it runs without `--pr`.
  * - Resume records. Each apply gets `<state>/resume/<prApplyRecordKey>.json`
  *   as its `--resume` record, so a re-run of a failed apply at the same
  *   commit finishes under the approval it has. This replaces the forge's CI
@@ -33,15 +37,16 @@
  */
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
+import { join, resolve } from "node:path";
 import { prApplyGroup, prApplyRecordKey } from "../components/pr-pipeline.js";
 import { forgeFromEnv } from "../pr-forge.js";
 import { formatError, formatWarning } from "../cli/format.js";
 import { acquireLease, currentHolderId, releaseLease, DEFAULT_LEASE_TTL_MS } from "../lifecycle/lease.js";
 import { parseDuration } from "../op/duration.js";
-import { CI_JOB_OPS, ciJobPlace, ciRun, CiRunError } from "./ci-run.js";
+import { CI_JOB_OPS, ciJobPlace, ciSecretsOf, ciRun, ciStatusFromEnv, CiRunError } from "./ci-run.js";
 import { RUNNER_KEY_ENV } from "./ci-green.js";
 import { gitTop } from "./tree.js";
+import { ciServeRunnerKey, formatRunnerKeySetup, setupRunnerKey } from "./ci-runner-key.js";
 export const newCiServeRuntime = () => ({ inflight: new Map() });
 /** The state key of a job. */
 export function ciServeKey(t) {
@@ -238,10 +243,14 @@ async function runJob(opts, place, t, paths, held) {
         }, Math.max(1000, Math.floor(held.ttlMs / 3)))
         : undefined;
     renew?.unref?.();
+    let merged;
     try {
         // The pull request's head is on the forge's refs/pull/<n>/head, the target's on the branch.
         tryGit(place.top, ["fetch", "--quiet", "--no-tags", "origin", t.job === "plan" ? `refs/pull/${t.pr}/head` : place.branch]);
         const hostEnv = { ...(opts.job?.hostEnv ?? process.env), GITHUB_REPOSITORY: opts.repo };
+        // An apply is for a merge: pass the pull request whose merge commit it is, so the commit status link and the run index use `<pr>/<commit>`. None found, or a forge that errs, is today's behaviour.
+        if (t.job === "apply" && opts.client.pullRequestFor)
+            merged = (await opts.client.pullRequestFor(t.commit).catch(() => null)) ?? undefined;
         const run = opts.run ?? ciRun;
         const r = await run({
             ...opts.job,
@@ -251,17 +260,17 @@ async function runJob(opts, place, t, paths, held) {
             env: opts.env,
             forge: opts.forge,
             base: t.base,
-            ...(t.job === "plan" ? { pr: t.pr } : {}),
+            ...(t.job === "plan" ? { pr: t.pr } : merged !== undefined ? { pr: merged } : {}),
             commit: t.commit,
             output: paths.report,
             runId: paths.runId,
             ...(paths.resume ? { resumeRecord: paths.resume } : {}),
         });
         const why = r.record.failure ? `${r.record.failure.code}: ${r.record.failure.reason}` : r.failure ? `${r.failure.phase}: ${r.failure.error.split("\n")[0]}` : undefined;
-        return { status: r.status === "ok" ? "ok" : "fail", ...(why && r.status !== "ok" ? { failure: why } : {}), ...(r.report ? { report: r.report } : {}) };
+        return { status: r.status === "ok" ? "ok" : "fail", ...(merged !== undefined ? { pr: merged } : {}), ...(why && r.status !== "ok" ? { failure: why } : {}), ...(r.report ? { report: r.report } : {}) };
     }
     catch (err) {
-        return { status: "fail", failure: message(err) };
+        return { status: "fail", ...(merged !== undefined ? { pr: merged } : {}), failure: message(err) };
     }
     finally {
         if (renew)
@@ -324,9 +333,37 @@ export function formatCiServeEvent(e) {
     }
 }
 // ── The command ──────────────────────────────────────────────────────────────
-const USAGE = "chant ci serve --forge forgejo|github --repo <owner/repo> --env <env> [--interval <s>] [--max-jobs <n>] [--state <dir>] " +
-    "[--author <login>]... [--once] [--rerun-failed] [--gate <name>] [--branch <name>] [--events-json] [--report-url <url>] " +
-    "[--image <image>] [--before-script <line>]... [--pr-build] [--pr-build-command <line>] [--chant <command>] [--pass-env <NAME>]... [--key <runner key.pem>]";
+/**
+ * `chant ci serve|run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]` (#4099):
+ * make the host's runner key when there is none, print its public half on
+ * stdout, and say whether the target's head lists it. With --trust, commit
+ * the runner entry on a branch of its own and push it for review.
+ */
+export function runnerKeySetupCommand(ctx) {
+    const { args } = ctx;
+    const cwd = process.cwd();
+    const top = gitTop(cwd);
+    if (!top)
+        throw new CiRunError("the runner key is kept in the repository's git directory, and this directory is not in a git repository");
+    if (args.ciPrincipal !== undefined && !args.trustKey)
+        throw new CiRunError("--principal names who --trust lists the key for; give --trust with it");
+    const branch = args.branch ?? "main";
+    const setup = setupRunnerKey({
+        top,
+        stateDir: args.statePath ? resolve(args.statePath) : defaultCiServeStateDir(cwd),
+        branch,
+        ...(args.ciPrincipal ? { principal: args.ciPrincipal } : {}),
+        ...(args.trustKey ? { trust: true } : {}),
+        ...(args.by ? { by: args.by } : {}),
+    });
+    console.log(setup.key.publicKey);
+    console.error(formatRunnerKeySetup(setup, branch));
+    return 0;
+}
+const USAGE = "chant ci serve --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>] | " +
+    "chant ci serve --forge forgejo|github --repo <owner/repo> --env <env> [--interval <s>] [--max-jobs <n>] [--state <dir>] " +
+    "[--author <login>]... [--once] [--rerun-failed] [--gate <name>] [--branch <name>] [--events-json] [--report-url <url>] [--no-status] [--status-url <url template>] " +
+    "[--image <image>] [--before-script <line>]... [--pr-build] [--pr-build-command <line>] [--chant <command>] [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>] [--unsigned]";
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** `--interval`: seconds, or a duration such as `30s` or `2m`. Default 30 seconds. */
 export function ciServeInterval(value) {
@@ -341,6 +378,8 @@ export function ciServeInterval(value) {
 export async function runCiServe(ctx) {
     const { args } = ctx;
     try {
+        if (args.setupKey)
+            return runnerKeySetupCommand(ctx);
         const forge = args.forge;
         if (forge !== "forgejo" && forge !== "github")
             throw new CiRunError(`--forge names the forge ci serve polls: --forge forgejo|github${forge ? `, not ${JSON.stringify(forge)}` : ""}`);
@@ -352,19 +391,33 @@ export async function runCiServe(ctx) {
             if (!ENV_NAME.test(name))
                 throw new CiRunError(`--pass-env takes a variable's name, not ${JSON.stringify(name)}`);
         const intervalMs = ciServeInterval(args.interval);
-        const fromFlag = args.key !== undefined;
-        const runnerKey = fromFlag ? readFileSync(resolve(args.key), "utf-8") : process.env[RUNNER_KEY_ENV] || undefined;
+        const cwd = process.cwd();
+        const top = gitTop(cwd);
+        if (!top)
+            throw new CiRunError("ci serve runs in a clone of the repository it serves, and this directory is not in a git repository");
+        const stateDir = args.statePath ? resolve(args.statePath) : defaultCiServeStateDir(cwd);
+        const branch = args.branch ?? "main";
+        // #4099: the host's key, checked against .chant/trust.json at the target's head before the first poll.
+        const keyed = ciServeRunnerKey({ top, stateDir, branch, ...(args.key !== undefined ? { keyFile: resolve(args.key) } : {}), envKey: process.env[RUNNER_KEY_ENV] || undefined, unsigned: args.unsigned });
+        const fromFlag = keyed.fromFlag;
+        const runnerKey = keyed.pem;
+        console.error(`ci serve: ${runnerKey === undefined ? "runs are not signed (--unsigned)" : `signing runs with the runner key from ${keyed.source}`}`);
+        // #4096: read once, so a loose or broken secrets file stops the serve before its first poll.
+        const secrets = ciSecretsOf(args.ciSecrets);
         const hostEnv = { ...process.env, GITHUB_REPOSITORY: args.ciRepo };
         const client = forgeFromEnv(forge, hostEnv);
+        const { status, warning } = ciStatusFromEnv({ forge, hostEnv, noStatus: args.noStatus, statusUrl: args.statusUrl });
+        if (warning)
+            console.error(formatWarning({ message: warning }));
         if (!client.openPullRequests || !client.branchHead)
             throw new CiRunError(`the ${forge} client cannot list pull requests`);
         const opts = {
-            cwd: process.cwd(),
+            cwd,
             forge,
             repo: args.ciRepo,
             env: args.env,
-            client: { openPullRequests: client.openPullRequests.bind(client), branchHead: client.branchHead.bind(client) },
-            ...(args.statePath ? { stateDir: isAbsolute(args.statePath) ? args.statePath : resolve(args.statePath) } : {}),
+            client: { openPullRequests: client.openPullRequests.bind(client), branchHead: client.branchHead.bind(client), pullRequestFor: client.pullRequestFor.bind(client) },
+            stateDir,
             ...(args.maxJobs ? { maxJobs: args.maxJobs } : {}),
             ...(args.ciAuthors?.length ? { authors: args.ciAuthors } : {}),
             ...(args.rerunFailed ? { rerunFailed: true } : {}),
@@ -377,10 +430,13 @@ export async function runCiServe(ctx) {
                     ...(args.prBuild ? { build: true } : {}),
                     ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
                 },
+                ...(args.runIndexLimit ? { runIndexLimit: args.runIndexLimit } : {}),
                 ...(args.image ? { image: args.image } : {}),
                 ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),
                 ...(args.ciChant ? { chant: args.ciChant } : {}),
                 ...(args.passEnv?.length ? { passEnv: args.passEnv } : {}),
+                ...(status ? { status } : {}),
+                ...(secrets ? { secrets } : {}),
                 ...(runnerKey !== undefined ? { runnerKey, runnerKeyFromEnv: !fromFlag } : {}),
                 ...(args.eventsJson ? { runEvents: (line) => void process.stdout.write(line) } : {}),
                 hostEnv,

package/dist/workspace/reason-codes.d.ts

@@ -222,6 +222,10 @@ export declare const REASONS: {
     readonly "listing-cover-invalid": "The cover can't be read, is not a PNG, JPEG or WebP picture, is larger than 5 MiB, has a path outside the workspace, or has an extension other than its picture format's.";
     readonly "member-exists": "member add names a member the declaration already has, with an entry other than the one given.";
     readonly "member-unknown": "member remove names a member the declaration does not declare.";
+    readonly "trust-config-invalid": ".chant/trust.json in the working tree is not JSON or does not match its schema, or the write would make it so.";
+    readonly "trust-conflict": "--expect named a digest .chant/trust.json no longer has: another write changed it after the caller read it. The refusal names the digest it has now.";
+    readonly "runner-exists": "trust runner add names a principal .chant/trust.json already lists with another key or class, or gives a key it lists for another principal.";
+    readonly "runner-unknown": "trust runner remove names a principal .chant/trust.json lists no runner for.";
     readonly "factory-member-unknown": "box factory set names a member the declaration does not declare.";
     readonly "factory-box-missing": "box factory set names a member whose entry declares no box block, so it has no factory.";
     readonly "publish-member-unknown": "box publish names a member the declaration does not declare.";
@@ -258,8 +262,8 @@ export declare const REASONS: {
     readonly "evidence-payload-type": "The envelope's payload type is not application/vnd.in-toto+json.";
     readonly "evidence-statement-invalid": "The payload is not an in-toto Statement v1 with chant's runner-evidence predicate, or has a field the predicate does not define.";
     readonly "evidence-runner-mismatch": "The statement names a runner other than the one whose key signed it.";
-    readonly "runner-key-invalid": "The key given to evidence sign or runs sign is not an Ed25519 private key in PEM.";
-    readonly "runner-key-is-signer": "The key given to evidence sign or runs sign is a person's key in the signers file. Evidence and run statements are signed by a service or CI identity.";
+    readonly "runner-key-invalid": "The key given to evidence sign or runs sign is not an Ed25519 private key in PEM, or the key given to trust runner add is not an ssh-ed25519 public key or an Ed25519 key in PEM.";
+    readonly "runner-key-is-signer": "The key given to evidence sign, runs sign or trust runner add is a person's key in the signers file, or trust runner add names a signer. Evidence and run statements are signed by a service or CI identity.";
     readonly "runner-key-unlisted": "The policy at base lists no runner with the key given to evidence sign or runs sign.";
     readonly "lock-invalid": "The lineage lock can't be read.";
     readonly "manual-step-open": "A scope in the lineage lock has an open manual step.";

package/dist/workspace/reason-codes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reason-codes.d.ts","sourceRoot":"","sources":["../../src/workspace/reason-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,sHAAsH;AACtH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,OAAO;aAElB,qBAAqB,EAAE,2EAA2E;aAClG,uBAAuB,EAAE,4DAA4D;aACrF,yBAAyB,EAAE,mEAAmE;aAC9F,qBAAqB,EAAE,wFAAwF;aAC/G,mBAAmB,EAAE,kDAAkD;aACvE,gBAAgB,EAAE,iEAAiE;aACnF,qBAAqB,EAAE,sHAAsH;aAE7I,sBAAsB,EAAE,mEAAmE;aAC3F,kBAAkB,EAAE,uBAAuB;aAC3C,kBAAkB,EAAE,wFAAwF;aAE5G,qBAAqB,EAAE,yDAAyD;aAEhF,aAAa,EAAE,wCAAwC;aACvD,cAAc,EAAE,gEAAgE;aAChF,mBAAmB,EAAE,oDAAoD;aACzE,YAAY,EAAE,gEAAgE;aAE9E,cAAc,EAAE,4EAA4E;aAC5F,gBAAgB,EAAE,2KAA2K;aAC7L,mBAAmB,EAAE,2EAA2E;aAChG,wBAAwB,EAAE,sDAAsD;aAEhF,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,uEAAuE;aAE3F,iBAAiB,EAAE,iFAAiF;aACpG,sBAAsB,EAAE,gFAAgF;aACxG,yBAAyB,EAAE,gEAAgE;aAE3F,qBAAqB,EAAE,iFAAiF;aACxG,mBAAmB,EAAE,iFAAiF;aACtG,yBAAyB,EAAE,8GAA8G;aAEzI,oBAAoB,EAAE,sJAAsJ;aAC5K,uBAAuB,EAAE,kFAAkF;aAC3G,qBAAqB,EAAE,uDAAuD;aAC9E,2BAA2B,EAAE,8CAA8C;aAC3E,4BAA4B,EAAE,4EAA4E;aAC1G,2BAA2B,EAAE,8CAA8C;aAC3E,8BAA8B,EAAE,6FAA6F;aAC7H,sBAAsB,EAAE,wGAAwG;aAEhI,uBAAuB,EAAE,kJAAkJ;aAC3K,gCAAgC,EAAE,yFAAyF;aAE3H,aAAa,EAAE,4FAA4F;aAC3G,eAAe,EAAE,iEAAiE;aAClF,aAAa,EAAE,sIAAsI;aACrJ,2BAA2B,EAAE,gHAAgH;aAC7I,oBAAoB,EAAE,qHAAqH;aAC3I,mBAAmB,EAAE,+GAA+G;aACpI,yBAAyB,EAAE,2KAA2K;aAEtM,oBAAoB,EAAE,sFAAsF;aAC5G,yBAAyB,EAAE,sEAAsE;aACjG,kBAAkB,EAAE,+EAA+E;aACnG,2BAA2B,EAAE,oFAAoF;aACjH,oBAAoB,EAAE,wFAAwF;aAC9G,0BAA0B,EAAE,2DAA2D;aACvF,oBAAoB,EAAE,mJAAmJ;aACzK,uBAAuB,EAAE,+IAA+I;aACxK,+BAA+B,EAAE,uJAAuJ;aACxL,uBAAuB,EAAE,gFAAgF;aACzG,yBAAyB,EAAE,8EAA8E;aACzG,mBAAmB,EAAE,mFAAmF;aAExG,mBAAmB,EAAE,6EAA6E;aAClG,YAAY,EAAE,uHAAuH;aAErI,0BAA0B,EAAE,uEAAuE;aACnG,sBAAsB,EAAE,8EAA8E;aACtG,sBAAsB,EAAE,qHAAqH;aAE7I,gBAAgB,EAAE,yFAAyF;aAC3G,cAAc,EAAE,gEAAgE;aAChF,kBAAkB,EAAE,oHAAoH;aACxI,qBAAqB,EAAE,oGAAoG;aAC3H,mBAAmB,EAAE,0GAA0G;aAE/H,cAAc,EAAE,8CAA8C;aAC9D,sBAAsB,EAAE,wGAAwG;aAChI,wBAAwB,EAAE,uIAAuI;aACjK,mBAAmB,EAAE,sLAAsL;aAE3M,mBAAmB,EAAE,sKAAsK;aAC3L,8BAA8B,EAAE,6MAA6M;aAE7O,iBAAiB,EAAE,2DAA2D;aAC9E,cAAc,EAAE,oEAAoE;aACpF,mBAAmB,EAAE,kEAAkE;aACvF,oBAAoB,EAAE,6DAA6D;aACnF,gBAAgB,EAAE,4CAA4C;aAC9D,kBAAkB,EAAE,uEAAuE;aAE3F,qBAAqB,EAAE,gFAAgF;aACvG,qBAAqB,EAAE,8FAA8F;aACrH,kBAAkB,EAAE,yCAAyC;aAC7D,iBAAiB,EAAE,4EAA4E;aAC/F,yBAAyB,EAAE,wGAAwG;aACnI,uBAAuB,EAAE,uFAAuF;aAChH,eAAe,EAAE,gGAAgG;aACjH,oBAAoB,EAAE,qEAAqE;aAC3F,yBAAyB,EAAE,+IAA+I;aAC1K,oBAAoB,EAAE,wEAAwE;aAC9F,sBAAsB,EAAE,6DAA6D;aACrF,oBAAoB,EAAE,0IAA0I;aAChK,0BAA0B,EAAE,4IAA4I;aACxK,6BAA6B,EAAE,uIAAuI;aACtK,uBAAuB,EAAE,+IAA+I;aACxK,oBAAoB,EAAE,6KAA6K;aAEnM,iBAAiB,EAAE,mLAAmL;aACtM,oBAAoB,EAAE,iKAAiK;aACvL,qBAAqB,EAAE,kKAAkK;aAEzL,oBAAoB,EAAE,qMAAqM;aAC3N,kBAAkB,EAAE,yIAAyI;aAC7J,uBAAuB,EAAE,qLAAqL;aAC9M,2BAA2B,EAAE,8PAA8P;aAC3R,eAAe,EAAE,kHAAkH;aACnI,wBAAwB,EAAE,0VAA0V;aAEpX,iBAAiB,EAAE,oFAAoF;aACvG,kBAAkB,EAAE,4EAA4E;aAEhG,mBAAmB,EAAE,4GAA4G;aACjI,gBAAgB,EAAE,kIAAkI;aACpJ,eAAe,EAAE,sEAAsE;aACvF,sBAAsB,EAAE,kFAAkF;aAC1G,sBAAsB,EAAE,mGAAmG;aAC3H,sBAAsB,EAAE,8DAA8D;aACtF,gBAAgB,EAAE,oOAAoO;aACtP,wBAAwB,EAAE,wKAAwK;aAClM,uBAAuB,EAAE,oNAAoN;aAC7O,qBAAqB,EAAE,mIAAmI;aAC1J,0BAA0B,EAAE,kOAAkO;aAC9P,0BAA0B,EAAE,6KAA6K;aAEzM,mBAAmB,EAAE,6FAA6F;aAClH,uBAAuB,EAAE,0HAA0H;aACnJ,oBAAoB,EAAE,yFAAyF;aAE/G,uBAAuB,EAAE,wEAAwE;aACjG,uBAAuB,EAAE,iFAAiF;aAC1G,2BAA2B,EAAE,uGAAuG;aACpI,uBAAuB,EAAE,uEAAuE;aAChG,yBAAyB,EAAE,6GAA6G;aAExI,wBAAwB,EAAE,2FAA2F;aACrH,sBAAsB,EAAE,uGAAuG;aAC/H,mBAAmB,EAAE,qMAAqM;aAE1N,yBAAyB,EAAE,kFAAkF;aAC7G,oBAAoB,EAAE,qKAAqK;aAC3L,oBAAoB,EAAE,2DAA2D;aACjF,oBAAoB,EAAE,+DAA+D;aACrF,kBAAkB,EAAE,wKAAwK;aAC5L,0BAA0B,EAAE,4EAA4E;aACxG,iCAAiC,EAAE,uDAAuD;aAC1F,6BAA6B,EAAE,6GAA6G;aAC5I,2BAA2B,EAAE,4GAA4G;aACzI,0BAA0B,EAAE,iEAAiE;aAC7F,wBAAwB,EAAE,iFAAiF;aAC3G,0BAA0B,EAAE,qEAAqE;aACjG,2BAA2B,EAAE,6FAA6F;aAC1H,6BAA6B,EAAE,uDAAuD;aACtF,+BAA+B,EAAE,8HAA8H;aAC/J,qBAAqB,EAAE,uGAAuG;aAC9H,+BAA+B,EAAE,+GAA+G;aAChJ,6BAA6B,EAAE,6KAA6K;aAE5M,wBAAwB,EAAE,wIAAwI;aAClK,mBAAmB,EAAE,oFAAoF;aACzG,wBAAwB,EAAE,mDAAmD;aAC7E,0BAA0B,EAAE,0GAA0G;aAEtI,kBAAkB,EAAE,kHAAkH;aACtI,qBAAqB,EAAE,yJAAyJ;aAEhL,iBAAiB,EAAE,2HAA2H;aAC9I,uBAAuB,EAAE,sPAAsP;aAE/Q,oBAAoB,EAAE,oFAAoF;aAE1G,4BAA4B,EAAE,4FAA4F;aAC1H,0BAA0B,EAAE,iDAAiD;aAC7E,yBAAyB,EAAE,0EAA0E;aAErG,4BAA4B,EAAE,mIAAmI;aACjK,6BAA6B,EAAE,4FAA4F;aAE3H,4BAA4B,EAAE,qHAAqH;aACnJ,gCAAgC,EAAE,oJAAoJ;aACtL,gCAAgC,EAAE,6FAA6F;aAC/H,mCAAmC,EAAE,6JAA6J;aAElM,wBAAwB,EAAE,mEAAmE;aAC7F,wBAAwB,EAAE,mEAAmE;aAC7F,sBAAsB,EAAE,iIAAiI;aAEzJ,yBAAyB,EAAE,6KAA6K;aACxM,2BAA2B,EAAE,6FAA6F;aAE1H,kCAAkC,EAAE,uOAAuO;aAE3Q,oBAAoB,EAAE,2FAA2F;aACjH,0BAA0B,EAAE,8LAA8L;aAE1N,UAAU,EAAE,2FAA2F;aACvG,aAAa,EAAE,2FAA2F;aAE1G,mBAAmB,EAAE,kHAAkH;aACvI,qBAAqB,EAAE,qFAAqF;aAC5G,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,oGAAoG;aAExH,wBAAwB,EAAE,uHAAuH;aAEjJ,YAAY,EAAE,6FAA6F;aAC3G,gBAAgB,EAAE,4FAA4F;aAC9G,sBAAsB,EAAE,mFAAmF;aAC3G,YAAY,EAAE,6EAA6E;aAC3F,qBAAqB,EAAE,8GAA8G;aAErI,YAAY,EAAE,sEAAsE;aACpF,aAAa,EAAE,mDAAmD;aAClE,WAAW,EAAE,qDAAqD;aAClE,gBAAgB,EAAE,iFAAiF;aACnG,uBAAuB,EAAE,0EAA0E;aAEnG,eAAe,EAAE,kHAAkH;aACnI,uBAAuB,EAAE,uIAAuI;aAChK,+BAA+B,EAAE,yEAAyE;aAC1G,wBAAwB,EAAE,0LAA0L;aAEpN,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAChH,uBAAuB,EAAE,2KAA2K;aAEpM,eAAe,EAAE,gGAAgG;aACjH,gBAAgB,EAAE,gEAAgE;aAElF,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAEhH,wBAAwB,EAAE,8DAA8D;aACxF,cAAc,EAAE,gGAAgG;aAChH,iBAAiB,EAAE,6FAA6F;aAChH,gBAAgB,EAAE,mIAAmI;aACrJ,wBAAwB,EAAE,yGAAyG;aACnI,oBAAoB,EAAE,6OAA6O;aAEnQ,eAAe,EAAE,6GAA6G;aAC9H,UAAU,EAAE,2FAA2F;aACvG,sBAAsB,EAAE,iFAAiF;aACzG,kBAAkB,EAAE,gFAAgF;aACpG,UAAU,EAAE,yFAAyF;aACrG,iBAAiB,EAAE,4FAA4F;aAC/G,oBAAoB,EAAE,iIAAiI;aAEvJ,qBAAqB,EAAE,qGAAqG;aAC5H,mBAAmB,EAAE,4GAA4G;aAEjI,yBAAyB,EAAE,qHAAqH;aAChJ,uBAAuB,EAAE,8IAA8I;aAEvK,sBAAsB,EAAE,uFAAuF;aAC/G,iBAAiB,EAAE,8HAA8H;aACjJ,sBAAsB,EAAE,wDAAwD;aAChF,kBAAkB,EAAE,yHAAyH;aAC7I,wBAAwB,EAAE,0FAA0F;aACpH,kBAAkB,EAAE,gHAAgH;aACpI,uBAAuB,EAAE,oHAAoH;aAC7I,4BAA4B,EAAE,0GAA0G;aACxI,kCAAkC,EAAE,mHAAmH;aACvJ,4BAA4B,EAAE,0HAA0H;aAExJ,yBAAyB,EAAE,uGAAuG;aAClI,qBAAqB,EAAE,oDAAoD;aAC3E,kBAAkB,EAAE,+GAA+G;aACnI,oBAAoB,EAAE,sFAAsF;aAC5G,uBAAuB,EAAE,kEAAkE;aAC3F,4BAA4B,EAAE,kIAAkI;aAChK,0BAA0B,EAAE,sEAAsE;aAClG,oBAAoB,EAAE,mFAAmF;aACzG,sBAAsB,EAAE,wJAAwJ;aAChL,qBAAqB,EAAE,sFAAsF;aAE7G,cAAc,EAAE,iCAAiC;aACjD,kBAAkB,EAAE,sDAAsD;CAClE,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,CAAC;AAE9C,mDAAmD;AACnD,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,IAAI,MAAM,EAAE,CAAC;AAEtD,eAAO,MAAM,WAAW,QAAkD,CAAC;AAE3E,2HAA2H;AAC3H,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAI/E"}
+{"version":3,"file":"reason-codes.d.ts","sourceRoot":"","sources":["../../src/workspace/reason-codes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,sHAAsH;AACtH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,uHAAuH;AACvH,eAAO,MAAM,mBAAmB,WAAW,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,OAAO;aAElB,qBAAqB,EAAE,2EAA2E;aAClG,uBAAuB,EAAE,4DAA4D;aACrF,yBAAyB,EAAE,mEAAmE;aAC9F,qBAAqB,EAAE,wFAAwF;aAC/G,mBAAmB,EAAE,kDAAkD;aACvE,gBAAgB,EAAE,iEAAiE;aACnF,qBAAqB,EAAE,sHAAsH;aAE7I,sBAAsB,EAAE,mEAAmE;aAC3F,kBAAkB,EAAE,uBAAuB;aAC3C,kBAAkB,EAAE,wFAAwF;aAE5G,qBAAqB,EAAE,yDAAyD;aAEhF,aAAa,EAAE,wCAAwC;aACvD,cAAc,EAAE,gEAAgE;aAChF,mBAAmB,EAAE,oDAAoD;aACzE,YAAY,EAAE,gEAAgE;aAE9E,cAAc,EAAE,4EAA4E;aAC5F,gBAAgB,EAAE,2KAA2K;aAC7L,mBAAmB,EAAE,2EAA2E;aAChG,wBAAwB,EAAE,sDAAsD;aAEhF,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,uEAAuE;aAE3F,iBAAiB,EAAE,iFAAiF;aACpG,sBAAsB,EAAE,gFAAgF;aACxG,yBAAyB,EAAE,gEAAgE;aAE3F,qBAAqB,EAAE,iFAAiF;aACxG,mBAAmB,EAAE,iFAAiF;aACtG,yBAAyB,EAAE,8GAA8G;aAEzI,oBAAoB,EAAE,sJAAsJ;aAC5K,uBAAuB,EAAE,kFAAkF;aAC3G,qBAAqB,EAAE,uDAAuD;aAC9E,2BAA2B,EAAE,8CAA8C;aAC3E,4BAA4B,EAAE,4EAA4E;aAC1G,2BAA2B,EAAE,8CAA8C;aAC3E,8BAA8B,EAAE,6FAA6F;aAC7H,sBAAsB,EAAE,wGAAwG;aAEhI,uBAAuB,EAAE,kJAAkJ;aAC3K,gCAAgC,EAAE,yFAAyF;aAE3H,aAAa,EAAE,4FAA4F;aAC3G,eAAe,EAAE,iEAAiE;aAClF,aAAa,EAAE,sIAAsI;aACrJ,2BAA2B,EAAE,gHAAgH;aAC7I,oBAAoB,EAAE,qHAAqH;aAC3I,mBAAmB,EAAE,+GAA+G;aACpI,yBAAyB,EAAE,2KAA2K;aAEtM,oBAAoB,EAAE,sFAAsF;aAC5G,yBAAyB,EAAE,sEAAsE;aACjG,kBAAkB,EAAE,+EAA+E;aACnG,2BAA2B,EAAE,oFAAoF;aACjH,oBAAoB,EAAE,wFAAwF;aAC9G,0BAA0B,EAAE,2DAA2D;aACvF,oBAAoB,EAAE,mJAAmJ;aACzK,uBAAuB,EAAE,+IAA+I;aACxK,+BAA+B,EAAE,uJAAuJ;aACxL,uBAAuB,EAAE,gFAAgF;aACzG,yBAAyB,EAAE,8EAA8E;aACzG,mBAAmB,EAAE,mFAAmF;aAExG,mBAAmB,EAAE,6EAA6E;aAClG,YAAY,EAAE,uHAAuH;aAErI,0BAA0B,EAAE,uEAAuE;aACnG,sBAAsB,EAAE,8EAA8E;aACtG,sBAAsB,EAAE,qHAAqH;aAE7I,gBAAgB,EAAE,yFAAyF;aAC3G,cAAc,EAAE,gEAAgE;aAChF,kBAAkB,EAAE,oHAAoH;aACxI,qBAAqB,EAAE,oGAAoG;aAC3H,mBAAmB,EAAE,0GAA0G;aAE/H,cAAc,EAAE,8CAA8C;aAC9D,sBAAsB,EAAE,wGAAwG;aAChI,wBAAwB,EAAE,uIAAuI;aACjK,mBAAmB,EAAE,sLAAsL;aAE3M,mBAAmB,EAAE,sKAAsK;aAC3L,8BAA8B,EAAE,6MAA6M;aAE7O,iBAAiB,EAAE,2DAA2D;aAC9E,cAAc,EAAE,oEAAoE;aACpF,mBAAmB,EAAE,kEAAkE;aACvF,oBAAoB,EAAE,6DAA6D;aACnF,gBAAgB,EAAE,4CAA4C;aAC9D,kBAAkB,EAAE,uEAAuE;aAE3F,qBAAqB,EAAE,gFAAgF;aACvG,qBAAqB,EAAE,8FAA8F;aACrH,kBAAkB,EAAE,yCAAyC;aAC7D,iBAAiB,EAAE,4EAA4E;aAC/F,yBAAyB,EAAE,wGAAwG;aACnI,uBAAuB,EAAE,uFAAuF;aAChH,eAAe,EAAE,gGAAgG;aACjH,oBAAoB,EAAE,qEAAqE;aAC3F,yBAAyB,EAAE,+IAA+I;aAC1K,oBAAoB,EAAE,wEAAwE;aAC9F,sBAAsB,EAAE,6DAA6D;aACrF,oBAAoB,EAAE,0IAA0I;aAChK,0BAA0B,EAAE,4IAA4I;aACxK,6BAA6B,EAAE,uIAAuI;aACtK,uBAAuB,EAAE,+IAA+I;aACxK,oBAAoB,EAAE,6KAA6K;aAEnM,iBAAiB,EAAE,mLAAmL;aACtM,oBAAoB,EAAE,iKAAiK;aACvL,qBAAqB,EAAE,kKAAkK;aAEzL,oBAAoB,EAAE,qMAAqM;aAC3N,kBAAkB,EAAE,yIAAyI;aAC7J,uBAAuB,EAAE,qLAAqL;aAC9M,2BAA2B,EAAE,8PAA8P;aAC3R,eAAe,EAAE,kHAAkH;aACnI,wBAAwB,EAAE,0VAA0V;aAEpX,iBAAiB,EAAE,oFAAoF;aACvG,kBAAkB,EAAE,4EAA4E;aAEhG,mBAAmB,EAAE,4GAA4G;aACjI,gBAAgB,EAAE,kIAAkI;aACpJ,eAAe,EAAE,sEAAsE;aACvF,sBAAsB,EAAE,kFAAkF;aAC1G,sBAAsB,EAAE,mGAAmG;aAC3H,sBAAsB,EAAE,8DAA8D;aACtF,gBAAgB,EAAE,oOAAoO;aACtP,wBAAwB,EAAE,wKAAwK;aAClM,uBAAuB,EAAE,oNAAoN;aAC7O,qBAAqB,EAAE,mIAAmI;aAC1J,0BAA0B,EAAE,kOAAkO;aAC9P,0BAA0B,EAAE,6KAA6K;aAEzM,mBAAmB,EAAE,6FAA6F;aAClH,uBAAuB,EAAE,0HAA0H;aACnJ,oBAAoB,EAAE,yFAAyF;aAE/G,uBAAuB,EAAE,wEAAwE;aACjG,uBAAuB,EAAE,iFAAiF;aAC1G,2BAA2B,EAAE,uGAAuG;aACpI,uBAAuB,EAAE,uEAAuE;aAChG,yBAAyB,EAAE,6GAA6G;aAExI,wBAAwB,EAAE,2FAA2F;aACrH,sBAAsB,EAAE,uGAAuG;aAC/H,mBAAmB,EAAE,qMAAqM;aAE1N,yBAAyB,EAAE,kFAAkF;aAC7G,oBAAoB,EAAE,qKAAqK;aAC3L,oBAAoB,EAAE,2DAA2D;aACjF,oBAAoB,EAAE,+DAA+D;aACrF,kBAAkB,EAAE,wKAAwK;aAC5L,0BAA0B,EAAE,4EAA4E;aACxG,iCAAiC,EAAE,uDAAuD;aAC1F,6BAA6B,EAAE,6GAA6G;aAC5I,2BAA2B,EAAE,4GAA4G;aACzI,0BAA0B,EAAE,iEAAiE;aAC7F,wBAAwB,EAAE,iFAAiF;aAC3G,0BAA0B,EAAE,qEAAqE;aACjG,2BAA2B,EAAE,6FAA6F;aAC1H,6BAA6B,EAAE,uDAAuD;aACtF,+BAA+B,EAAE,8HAA8H;aAC/J,qBAAqB,EAAE,uGAAuG;aAC9H,+BAA+B,EAAE,+GAA+G;aAChJ,6BAA6B,EAAE,6KAA6K;aAE5M,wBAAwB,EAAE,wIAAwI;aAClK,mBAAmB,EAAE,oFAAoF;aACzG,wBAAwB,EAAE,mDAAmD;aAC7E,0BAA0B,EAAE,0GAA0G;aAEtI,kBAAkB,EAAE,kHAAkH;aACtI,qBAAqB,EAAE,yJAAyJ;aAEhL,iBAAiB,EAAE,2HAA2H;aAC9I,uBAAuB,EAAE,sPAAsP;aAE/Q,oBAAoB,EAAE,oFAAoF;aAE1G,4BAA4B,EAAE,4FAA4F;aAC1H,0BAA0B,EAAE,iDAAiD;aAC7E,yBAAyB,EAAE,0EAA0E;aAErG,4BAA4B,EAAE,mIAAmI;aACjK,6BAA6B,EAAE,4FAA4F;aAE3H,4BAA4B,EAAE,qHAAqH;aACnJ,gCAAgC,EAAE,oJAAoJ;aACtL,gCAAgC,EAAE,6FAA6F;aAC/H,mCAAmC,EAAE,6JAA6J;aAElM,wBAAwB,EAAE,mEAAmE;aAC7F,wBAAwB,EAAE,mEAAmE;aAC7F,sBAAsB,EAAE,iIAAiI;aAEzJ,yBAAyB,EAAE,6KAA6K;aACxM,2BAA2B,EAAE,6FAA6F;aAE1H,kCAAkC,EAAE,uOAAuO;aAE3Q,oBAAoB,EAAE,2FAA2F;aACjH,0BAA0B,EAAE,8LAA8L;aAE1N,UAAU,EAAE,2FAA2F;aACvG,aAAa,EAAE,2FAA2F;aAE1G,mBAAmB,EAAE,kHAAkH;aACvI,qBAAqB,EAAE,qFAAqF;aAC5G,mBAAmB,EAAE,0DAA0D;aAC/E,kBAAkB,EAAE,oGAAoG;aAExH,wBAAwB,EAAE,uHAAuH;aAEjJ,YAAY,EAAE,6FAA6F;aAC3G,gBAAgB,EAAE,4FAA4F;aAC9G,sBAAsB,EAAE,mFAAmF;aAC3G,YAAY,EAAE,6EAA6E;aAC3F,qBAAqB,EAAE,8GAA8G;aAErI,YAAY,EAAE,sEAAsE;aACpF,aAAa,EAAE,mDAAmD;aAClE,WAAW,EAAE,qDAAqD;aAClE,gBAAgB,EAAE,iFAAiF;aACnG,uBAAuB,EAAE,0EAA0E;aAEnG,eAAe,EAAE,kHAAkH;aACnI,uBAAuB,EAAE,uIAAuI;aAChK,+BAA+B,EAAE,yEAAyE;aAC1G,wBAAwB,EAAE,0LAA0L;aAEpN,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAChH,uBAAuB,EAAE,2KAA2K;aAEpM,eAAe,EAAE,gGAAgG;aACjH,gBAAgB,EAAE,gEAAgE;aAElF,sBAAsB,EAAE,gHAAgH;aACxI,gBAAgB,EAAE,sJAAsJ;aACxK,eAAe,EAAE,8IAA8I;aAC/J,gBAAgB,EAAE,8EAA8E;aAEhG,wBAAwB,EAAE,kEAAkE;aAC5F,qBAAqB,EAAE,yFAAyF;aAEhH,wBAAwB,EAAE,8DAA8D;aACxF,cAAc,EAAE,gGAAgG;aAChH,iBAAiB,EAAE,6FAA6F;aAChH,gBAAgB,EAAE,mIAAmI;aACrJ,wBAAwB,EAAE,yGAAyG;aACnI,oBAAoB,EAAE,6OAA6O;aAEnQ,eAAe,EAAE,6GAA6G;aAC9H,UAAU,EAAE,2FAA2F;aACvG,sBAAsB,EAAE,iFAAiF;aACzG,kBAAkB,EAAE,gFAAgF;aACpG,UAAU,EAAE,yFAAyF;aACrG,iBAAiB,EAAE,4FAA4F;aAC/G,oBAAoB,EAAE,iIAAiI;aAEvJ,qBAAqB,EAAE,qGAAqG;aAC5H,mBAAmB,EAAE,4GAA4G;aAEjI,yBAAyB,EAAE,qHAAqH;aAChJ,uBAAuB,EAAE,8IAA8I;aAEvK,sBAAsB,EAAE,uFAAuF;aAC/G,iBAAiB,EAAE,8HAA8H;aACjJ,sBAAsB,EAAE,wDAAwD;aAChF,kBAAkB,EAAE,yHAAyH;aAC7I,wBAAwB,EAAE,0FAA0F;aACpH,kBAAkB,EAAE,gHAAgH;aACpI,uBAAuB,EAAE,oHAAoH;aAC7I,4BAA4B,EAAE,0GAA0G;aACxI,kCAAkC,EAAE,mHAAmH;aACvJ,4BAA4B,EAAE,0HAA0H;aAExJ,yBAAyB,EAAE,uGAAuG;aAClI,qBAAqB,EAAE,oDAAoD;aAC3E,kBAAkB,EAAE,+GAA+G;aACnI,oBAAoB,EAAE,sFAAsF;aAC5G,uBAAuB,EAAE,kEAAkE;aAC3F,4BAA4B,EAAE,kIAAkI;aAChK,0BAA0B,EAAE,sEAAsE;aAClG,oBAAoB,EAAE,mLAAmL;aACzM,sBAAsB,EAAE,8MAA8M;aACtO,qBAAqB,EAAE,sFAAsF;aAE7G,cAAc,EAAE,iCAAiC;aACjD,kBAAkB,EAAE,sDAAsD;CAClE,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,OAAO,CAAC;AAE9C,mDAAmD;AACnD,eAAO,MAAM,YAAY,EAA2B,UAAU,EAAE,CAAC;AAEjE,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,UAAU,CAEhE;AAED;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,UAAU,MAAM,IAAI,MAAM,EAAE,CAAC;AAEtD,eAAO,MAAM,WAAW,QAAkD,CAAC;AAE3E,2HAA2H;AAC3H,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,IAAI,UAAU,CAI/E"}

package/dist/workspace/reason-codes.js

@@ -268,6 +268,11 @@ export const REASONS = {
     // A declaration's members and hosts written through chant (member add|remove, host set, #3596): why the write was refused. Nothing is written.
     "member-exists": "member add names a member the declaration already has, with an entry other than the one given.",
     "member-unknown": "member remove names a member the declaration does not declare.",
+    // A runner entry of .chant/trust.json written through chant (trust runner add|remove, #3510): why the write was refused. Nothing is written.
+    "trust-config-invalid": ".chant/trust.json in the working tree is not JSON or does not match its schema, or the write would make it so.",
+    "trust-conflict": "--expect named a digest .chant/trust.json no longer has: another write changed it after the caller read it. The refusal names the digest it has now.",
+    "runner-exists": "trust runner add names a principal .chant/trust.json already lists with another key or class, or gives a key it lists for another principal.",
+    "runner-unknown": "trust runner remove names a principal .chant/trust.json lists no runner for.",
     // A box's factory written through chant (box factory set, #3600): why the write was refused. Nothing is written.
     "factory-member-unknown": "box factory set names a member the declaration does not declare.",
     "factory-box-missing": "box factory set names a member whose entry declares no box block, so it has no factory.",
@@ -311,8 +316,8 @@ export const REASONS = {
     "evidence-payload-type": "The envelope's payload type is not application/vnd.in-toto+json.",
     "evidence-statement-invalid": "The payload is not an in-toto Statement v1 with chant's runner-evidence predicate, or has a field the predicate does not define.",
     "evidence-runner-mismatch": "The statement names a runner other than the one whose key signed it.",
-    "runner-key-invalid": "The key given to evidence sign or runs sign is not an Ed25519 private key in PEM.",
-    "runner-key-is-signer": "The key given to evidence sign or runs sign is a person's key in the signers file. Evidence and run statements are signed by a service or CI identity.",
+    "runner-key-invalid": "The key given to evidence sign or runs sign is not an Ed25519 private key in PEM, or the key given to trust runner add is not an ssh-ed25519 public key or an Ed25519 key in PEM.",
+    "runner-key-is-signer": "The key given to evidence sign, runs sign or trust runner add is a person's key in the signers file, or trust runner add names a signer. Evidence and run statements are signed by a service or CI identity.",
     "runner-key-unlisted": "The policy at base lists no runner with the key given to evidence sign or runs sign.",
     // The lineage lock (check).
     "lock-invalid": "The lineage lock can't be read.",

package/dist/workspace/trust/trust-write.d.ts

@@ -0,0 +1,109 @@
+/**
+ * `chant workspace trust runner add <principal> --key <key>` and `chant
+ * workspace trust runner remove <principal>` (#3510): a runner entry of
+ * `.chant/trust.json`, written through chant.
+ *
+ * ws-074 lets a tool write the repo only through chant. A lobby that signs
+ * agent-run statements, a CI job that signs Op runs and ci tags, and a host
+ * running `chant ci serve` each need their key under `runners`, and before
+ * this write a box repo added that entry by hand. `add` lists the key for the
+ * principal and, for class `runner`, grants the principal the `runner` role
+ * that `ci tick`, `ci run` and `chant run --key` require. `remove` takes both
+ * away. The file is edited in place, so its formatting and key order stay as
+ * they were.
+ *
+ * The write is a working-tree write like `member add`: it holds the write
+ * lock (#3173, ws-089), is judged by the write scope at base, notes who wrote
+ * the file in the write journal, and never commits. Changing the trust
+ * config is a protected write, so the commit that carries it is checked by
+ * `chant workspace verify` against the policy at base. `--expect <digest>`
+ * refuses the write when the file has changed since the caller read it: the
+ * digest is the SHA-256 of the file's bytes, and of empty text when there is
+ * no file. Each write prints one JSON document (`trust-write.schema.json`)
+ * with the digest after the write, to pass as `--expect` to the next one.
+ */
+import type { CommandContext } from "../../cli/registry.js";
+import { type LastWrite } from "../write-lock.js";
+import { type RunnerKey } from "./policy.js";
+/** The version of the document these writes print. */
+export declare const TRUST_WRITE_CONTRACT_VERSION = 1;
+/** `$id` of the JSON Schema for what the trust writes print, shipped in `workspace/`. */
+export declare const TRUST_WRITE_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/trust-write/v1/trust-write.schema.json";
+export declare const TRUST_WRITE_ACTIONS: readonly ["runner add", "runner remove"];
+export type TrustWriteAction = (typeof TRUST_WRITE_ACTIONS)[number];
+/** Why a trust write wrote nothing. Closed. */
+export declare const TRUST_WRITE_ERROR_CODES: readonly ["not-a-git-repository", "write-usage-invalid", "trust-config-invalid", "trust-conflict", "runner-key-invalid", "runner-key-is-signer", "runner-exists", "runner-unknown", "write-scope-member", "write-scope-protected", "write-scope-class-unknown", "agent-unknown", "principal-unidentified", "write-lock-timeout", "write-lock-not-held"];
+export type TrustWriteErrorCode = (typeof TRUST_WRITE_ERROR_CODES)[number];
+type Head = {
+    $schema: string;
+    contract: number;
+    chant: string;
+    action: TrustWriteAction;
+    name: string | null;
+};
+/** What `--expect` disagreed with: the digest the file has now, and its last chant write when the journal knows it. */
+export interface TrustConflict {
+    path: string;
+    expected: string;
+    digest: string;
+    lastWrite: LastWrite | null;
+}
+/** What `trust runner add` and `trust runner remove` print. */
+export type TrustWriteDocument = (Head & {
+    name: string;
+    /** `.chant/trust.json`, from the repository root. */
+    path: string;
+    /** The SHA-256 of the file's bytes after the write (or as they would be, with dryRun): the next write's `--expect`. */
+    digest: string;
+    /** The SHA-256 of the file's bytes before the write; of empty text when there was no file. */
+    previousDigest: string;
+    /** The file, when the write changed it; else empty. */
+    paths: string[];
+    changed: boolean;
+    dryRun: boolean;
+    /** The runner entry before the write, or null when there was none. */
+    previous: RunnerKey | null;
+    /** The runner entry after the write, or null after a remove. */
+    entry: RunnerKey | null;
+    /** Whether the principal holds the `runner` role after the write. */
+    runnerRole: boolean;
+}) | (Head & {
+    error: {
+        code: TrustWriteErrorCode;
+        message: string;
+    };
+    conflict?: TrustConflict;
+});
+export interface TrustWriteRequest {
+    cwd: string;
+    action: TrustWriteAction;
+    /** The runner's principal. */
+    name: string;
+    /** For `runner add`: the public key, as an `ssh-ed25519` line or a file holding one or an Ed25519 PEM. */
+    key?: string;
+    /** For `runner add`: `runner` (the default) or `service`. */
+    runnerClass?: string;
+    /** Who is writing (`--by`). */
+    by?: string;
+    /** The agent session (`CHANT_AGENT`). */
+    agent?: string;
+    /** The file's digest the caller last read (`--expect`). */
+    expect?: string;
+    dryRun?: boolean;
+}
+/** The digest `--expect` compares: the SHA-256 of the file's text, of empty text when there is none. */
+export declare function trustDigest(text: string | null): string;
+/**
+ * The `ssh-ed25519 <base64>` line, with no comment, for what `--key` gives:
+ * the line itself (a comment after it is dropped), or a file holding such a
+ * line or an Ed25519 key in PEM, public or private, whose public half is
+ * used. Throws `runner-key-invalid` for anything else, so only a key the
+ * readers can verify is ever listed.
+ */
+export declare function runnerPublicKey(given: string, cwd: string): string;
+/** Run the write and build the document it prints. Never throws for a refusal. */
+export declare function trustWrite(req: TrustWriteRequest): TrustWriteDocument;
+/** `chant workspace trust runner add|remove <principal>`. */
+export declare function runWorkspaceTrust(ctx: CommandContext): number;
+export {};
+//# sourceMappingURL=trust-write.d.ts.map

package/dist/workspace/trust/trust-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-write.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/trust-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD,OAAO,EAAiH,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAG9J,OAAO,EAAmF,KAAK,SAAS,EAAoB,MAAM,UAAU,CAAC;AAE7I,sDAAsD;AACtD,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,wFAAwF,CAAC;AAE3H,eAAO,MAAM,mBAAmB,YAAI,YAAY,EAAE,eAAe,CAAU,CAAC;AAC5E,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,uBAAuB,yVAeM,CAAC;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3E,KAAK,IAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEhH,uHAAuH;AACvH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAC1B,CAAC,IAAI,GAAG;IACN,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,uHAAuH;IACvH,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,cAAc,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,sEAAsE;IACtE,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAC;IAC3B,gEAAgE;IAChE,KAAK,EAAE,SAAS,GAAG,IAAI,CAAC;IACxB,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAC;CACrB,CAAC,GACF,CAAC,IAAI,GAAG;IAAE,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,aAAa,CAAA;CAAE,CAAC,CAAC;AAEjG,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,gBAAgB,CAAC;IACzB,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+BAA+B;IAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAgBD,wGAAwG;AACxG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAEvD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAmClE;AAED,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,GAAG,EAAE,iBAAiB,GAAG,kBAAkB,CAYrE;AAwJD,6DAA6D;AAC7D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CA0B7D"}