@intentius/chant 0.124.32 → 0.124.33

package/dist/workspace/ci-run.d.ts

@@ -1,5 +1,5 @@
 /**
- * `chant ci run plan|apply` (#4094, epic #4101): run one pull-request job as
+ * `chant ci run plan|record|apply` (#4094, epic #4101, record #4168): run one pull-request job as
  * a pipeline Op, the first slice of the chant runner.
  *
  * The job is the typed value `prLoopJobs` (../components/pr-pipeline.ts)
@@ -78,7 +78,7 @@ import type { OpRunFailureReason, OpRunRecord } from "../op/runtime.js";
 import type { OpConfig } from "../op/types.js";
 import { type Redact } from "../op/redact.js";
 import { type CiSecrets } from "./ci-secrets.js";
-/** The two jobs a pull-request pipeline has. */
+/** The jobs a pull-request pipeline has: plan, and on merge record (#4168) or, opted in, apply. */
 export type CiJobName = PrLoopJob["jobName"];
 export declare const CI_JOB_NAMES: readonly CiJobName[];
 /** The Op each job is recorded as, which `ci.green` phases match. */
@@ -193,7 +193,7 @@ export interface CiStatusConfig {
     urlTemplate?: string;
 }
 /**
- * A job's status context: `chant/pr-plan` for the plan, and for the apply
+ * A job's status context: `chant/pr-plan` for the plan, `chant/pr-record` for the record (#4168), and for the apply
  * `chant/<gate>`, which is `chant/pr-apply` unless `--gate` renamed the gate.
  * pr-plan's own status is `chant/plan` (../pr-loop.ts), a different context.
  */
@@ -304,6 +304,12 @@ export interface CiRunRequest {
      * `runOrigin: { forge: "local" }` and `runtime: "local"`.
      */
     local?: boolean;
+    /**
+     * `--require-runner-start` (#4147): refuse the job before its first step
+     * unless a runner-start statement, signed by a runner key
+     * `.chant/trust.json` at `base` lists, names this forge job.
+     */
+    requireRunnerStart?: boolean;
     /**
      * `--wave <k>` (#4003, #4156): the one wave a generated apply job runs, as
      * `pr-apply --wave <k>`. Needs `--wave-gate`.
@@ -361,12 +367,12 @@ export declare function formatCiRun(r: CiRunResult): string;
  * The generator's options from `ci run`'s and `ci serve`'s flags, as `chant
  * build --components --generate <lexicon> --pr-loop` takes them: `--gate`,
  * `--branch`, `--events-json`, `--report-url`, `--pr-build`,
- * `--pr-build-command`, `--wave-gate` (#4003) and `--no-require-review`
- * (#4156).
+ * `--pr-build-command`, `--wave-gate` (#4003) and `--require-review`
+ * (#4168; `--no-require-review`, the default, is still accepted).
  */
 export declare function ciLoopOptions(args: CommandContext["args"]): PrLoopPipelineOptions;
 /** The secrets file `--secrets` names, else the one `CHANT_CI_SECRETS` names, read; undefined when neither names one (#4096). */
 export declare function ciSecretsOf(flag: string | undefined, env?: Record<string, string | undefined>): CiSecrets | undefined;
-/** `chant ci run plan|apply` (#4094). */
+/** `chant ci run plan|record|apply` (#4094, #4168). */
 export declare function runCiRun(ctx: CommandContext): Promise<number>;
 //# sourceMappingURL=ci-run.d.ts.map

package/dist/workspace/ci-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-run.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAMH,OAAO,EAA+E,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpK,OAAO,EAAiE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK3E,OAAO,EAA8B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAMvD,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAOvG,gDAAgD;AAChD,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7C,eAAO,MAAM,YAAY,EAAE,SAAS,SAAS,EAAsB,CAAC;AAEpE,qEAAqE;AACrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAA0C,CAAC;AAE5F,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAA8B,CAAC;AAEjE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,EAAE,SAA8B,CAAC;AAEhE,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAEnI;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,CACP,CAAC;AAKX,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IACL,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAoBrD;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGlG;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,GAAG,SAAS,CAmCvJ;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,+IAA+I;IAC/I,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMjJ;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,aAAa,CAAC,CAKpK;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/L;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2HAA2H;IAC3H,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,IAAI,CAAC;CACd;AA4BD,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrF;AAiFD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqCnE;AA2LD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAc5D;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAUlD;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAWjF;AAuBD,iIAAiI;AACjI,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,SAAS,GAAG,SAAS,CAGlI;AAED,yCAAyC;AACzC,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyDnE"}
+{"version":3,"file":"ci-run.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAMH,OAAO,EAA+E,KAAK,SAAS,EAAE,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACpK,OAAO,EAAiE,KAAK,YAAY,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE/H,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAK3E,OAAO,EAA8B,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,KAAK,EAAgB,QAAQ,EAAmB,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC;AAMvD,OAAO,EAA2D,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AASvG,mGAAmG;AACnG,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7C,eAAO,MAAM,YAAY,EAAE,SAAS,SAAS,EAAgC,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAA+D,CAAC;AASjH,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,EAAE,SAA8B,CAAC;AAEjE,4FAA4F;AAC5F,eAAO,MAAM,kBAAkB,EAAE,SAA8B,CAAC;AAEhE,uEAAuE;AACvE,eAAO,MAAM,eAAe,YAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAU,CAAC;AAEnI;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,mBAAmB,EACnB,cAAc,EACd,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,eAAe,CACP,CAAC;AAKX,iGAAiG;AACjG,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,UAAW,SAAQ,KAAK;IACnC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,QAAQ,CACtB,GAAG,EAAE,SAAS,EACd,KAAK,EAAE;IACL,KAAK,EAAE,SAAS,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC,GACA,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6BxB;AAED,+CAA+C;AAC/C,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,SAAS,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iHAAiH;IACjH,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,sGAAsG;AACtG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,QAAQ,CAoBrD;AAWD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IAAE,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAGlG;AAKD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,kBAAkB,GAAG,SAAS,CAmCvJ;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,+IAA+I;IAC/I,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAOD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAErE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,GAAG,SAAS,CAMjJ;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,GAAG,aAAa,CAAC,CAKpK;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/L;AAED,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,SAAS,CAAC;IACf,oDAAoD;IACpD,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,SAAS,CAAC;IACjB,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,qBAAqB,CAAC;IAC7B,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,8DAA8D;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7C;;;;OAIG;IACH,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yGAAyG;IACzG,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,0CAA0C;IAC1C,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uEAAuE;IACvE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,2HAA2H;IAC3H,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,EAAE,WAAW,CAAC;IACpB,sDAAsD;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,qEAAqE;IACrE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,oDAAoD;IACpD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,yGAAyG;IACzG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,IAAI,CAAC;CACd;AA4BD,0GAA0G;AAC1G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAMrF;AAiFD;;;;GAIG;AACH,wBAAsB,KAAK,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA0CnE;AA2MD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAc5D;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAUlD;AAID;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,qBAAqB,CAWjF;AAuBD,iIAAiI;AACjI,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,SAAS,GAAG,SAAS,CAGlI;AA0BD,uDAAuD;AACvD,wBAAsB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2DnE"}

package/dist/workspace/ci-run.js

@@ -1,5 +1,5 @@
 /**
- * `chant ci run plan|apply` (#4094, epic #4101): run one pull-request job as
+ * `chant ci run plan|record|apply` (#4094, epic #4101, record #4168): run one pull-request job as
  * a pipeline Op, the first slice of the chant runner.
  *
  * The job is the typed value `prLoopJobs` (../components/pr-pipeline.ts)
@@ -94,9 +94,17 @@ import { resolveMemberContext } from "./member-pipeline.js";
 import { signOpRunRecord } from "./trust/op-run-statement.js";
 import { gitTop } from "./tree.js";
 import { hostRunnerKey } from "./ci-runner-key.js";
-export const CI_JOB_NAMES = ["plan", "apply"];
+import { requireRunnerStart } from "./ci-runner-start.js";
+import { securityGroupsAt } from "./security.js";
+export const CI_JOB_NAMES = ["plan", "apply", "record"];
 /** The Op each job is recorded as, which `ci.green` phases match. */
-export const CI_JOB_OPS = { plan: "pr-plan", apply: "pr-apply" };
+export const CI_JOB_OPS = { plan: "pr-plan", apply: "pr-apply", record: "pr-record" };
+/** What each job's Op says it does. */
+const CI_JOB_OVERVIEWS = {
+    plan: "Plan the members this pull request reaches",
+    apply: "Apply the plan a reviewer approved",
+    record: "Record the plan on the merged commit; nothing applies",
+};
 /** Where a job the chant runner ran says it ran (#4094). */
 export const CHANT_RUNNER_ORIGIN = { forge: "chant" };
 /** Where a job `chant ci run --local` ran says it ran (#4161): this machine, outside CI. */
@@ -207,7 +215,7 @@ export function ciJobOp(input) {
     const op = CI_JOB_OPS[input.job.jobName];
     return {
         name: op,
-        overview: input.job.jobName === "plan" ? "Plan the members this pull request reaches" : "Apply the plan a reviewer approved",
+        overview: CI_JOB_OVERVIEWS[input.job.jobName],
         labels: { Env: input.env, Pipeline: "pr", Job: input.job.jobName },
         phases,
     };
@@ -289,12 +297,12 @@ export function ciJobFailure(input) {
 const STATUS_DESCRIPTION = 140;
 const cut = (text, max = STATUS_DESCRIPTION) => (text.length > max ? `${text.slice(0, max - 3)}...` : text);
 /**
- * A job's status context: `chant/pr-plan` for the plan, and for the apply
+ * A job's status context: `chant/pr-plan` for the plan, `chant/pr-record` for the record (#4168), and for the apply
  * `chant/<gate>`, which is `chant/pr-apply` unless `--gate` renamed the gate.
  * pr-plan's own status is `chant/plan` (../pr-loop.ts), a different context.
  */
 export function ciStatusContext(job, gate) {
-    return job === "apply" ? `chant/${gate ?? PR_APPLY_GATE}` : `chant/${CI_JOB_OPS.plan}`;
+    return job === "apply" ? `chant/${gate ?? PR_APPLY_GATE}` : `chant/${CI_JOB_OPS[job]}`;
 }
 /**
  * The link a job's status carries: the `--status-url` template with `{key}`
@@ -466,6 +474,10 @@ export async function ciRun(req) {
         throw new CiRunError(`the pull-request pipeline has no ${req.job} job; it has ${jobs.map((j) => j.jobName).join(" and ")}`);
     if (req.wave !== undefined && (req.job !== "apply" || !req.loop?.waveGate))
         throw new CiRunError("--wave names the one wave an apply runs, and takes --wave-gate: ci run apply --wave-gate <gate> --wave <k>");
+    // #4147: before anything runs or any secret reaches a step, the provisioner's word that this runner was started for this job.
+    // #4168: under the isolated-runners security group an apply job requires the statement too, unless it runs on this machine.
+    const isolated = !req.requireRunnerStart && !req.local && req.job === "apply" && securityGroupsAt(cwd).has("isolated-runners");
+    const started = req.requireRunnerStart || isolated ? runnerStartFor(req, { top, commit, hostEnv }) : undefined;
     // A generated wave job's command, as prLoopWaveJobs writes it. #4161: a local job's command posts no status or note.
     const command = `${found.command}${req.wave !== undefined ? ` --wave ${req.wave}` : ""}${req.local ? " --no-status" : ""}`;
     const job = { ...found, command, ...(req.wave !== undefined ? { wave: req.wave } : {}) };
@@ -484,7 +496,8 @@ export async function ciRun(req) {
     // In place the forge's own variables come too; one whose value is short, such as a flag, is left out, so it can't blank common words.
     const redact = ciRedactor(req.inPlace ? { ...longValues(jobEnv), ...own } : jobEnv, req.secrets);
     try {
-        const result = await runCiJob(req, { cwd, top, commit, place, job, jobEnv, ...(redact ? { redact } : {}) });
+        const ran = await runCiJob(req, { cwd, top, commit, place, job, jobEnv, ...(redact ? { redact } : {}) });
+        const result = started ? { ...ran, notes: [started, ...ran.notes] } : ran;
         return redact ? { ...result, warnings: result.warnings.map(redact), notes: result.notes.map(redact), ...(result.pushWarning ? { pushWarning: redact(result.pushWarning) } : {}) } : result;
     }
     catch (err) {
@@ -493,6 +506,23 @@ export async function ciRun(req) {
         throw err;
     }
 }
+/**
+ * `--require-runner-start` (#4147): the runner-start statement for this
+ * forge job, checked against `.chant/trust.json` at `--base` (the commit
+ * before the change, as a push's `before` is), or at the job's commit
+ * without one. Throws {@link CiRunError} unless it verifies.
+ */
+function runnerStartFor(req, at) {
+    if (req.local)
+        throw new CiRunError("--require-runner-start checks a forge job's runner, and --local runs the job on this machine");
+    const base = req.base ? resolveJobCommit(at.top, req.base) : at.commit;
+    try {
+        return requireRunnerStart({ top: at.top, base, commit: at.commit, env: at.hostEnv }).reason;
+    }
+    catch (err) {
+        throw new CiRunError(message(err));
+    }
+}
 /** The generator's options for a `--local` job (#4161): the same, with no report URL. */
 function localLoop(loop) {
     const { reportUrl: _dropped, ...rest } = loop ?? {};
@@ -722,8 +752,8 @@ export function formatCiRun(r) {
  * The generator's options from `ci run`'s and `ci serve`'s flags, as `chant
  * build --components --generate <lexicon> --pr-loop` takes them: `--gate`,
  * `--branch`, `--events-json`, `--report-url`, `--pr-build`,
- * `--pr-build-command`, `--wave-gate` (#4003) and `--no-require-review`
- * (#4156).
+ * `--pr-build-command`, `--wave-gate` (#4003) and `--require-review`
+ * (#4168; `--no-require-review`, the default, is still accepted).
  */
 export function ciLoopOptions(args) {
     return {
@@ -734,13 +764,13 @@ export function ciLoopOptions(args) {
         ...(args.prBuild ? { build: true } : {}),
         ...(args.prBuildCommand ? { buildCommand: args.prBuildCommand } : {}),
         ...(args.waveGate ? { waveGate: args.waveGate } : {}),
-        ...(args.requireReview === false ? { requireReview: false } : {}),
+        ...(args.requireReview === true ? { requireReview: true } : {}),
     };
 }
-const USAGE = "chant ci run plan|apply --env <env> --base <sha> [--pr <n>] [--commit <sha>] [--forge github|gitlab|forgejo] " +
+const USAGE = "chant ci run plan|record|apply --env <env> --base <sha> [--pr <n>] [--commit <sha>] [--forge github|gitlab|forgejo] " +
     "[--gate <name>] [--wave-gate <name>] [--wave <k>] [--branch <name>] [--events-json] [--report-url <url>] [--run-index-limit <n>] [--image <image>] [--before-script <line>]... " +
-    "[--pr-build] [--pr-build-command <line>] [--no-require-review] [--no-status] [--status-url <url template>] " +
-    "[--chant <command>] [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>] [-o <dir>] [--in-place | --local] [--no-push] [--verbose] | chant ci run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]";
+    "[--pr-build] [--pr-build-command <line>] [--require-review] [--no-status] [--status-url <url template>] " +
+    "[--chant <command>] [--pass-env <NAME>]... [--secrets <file>] [--key <runner key.pem>] [-o <dir>] [--in-place | --local] [--no-push] [--verbose] | chant ci run --at <sha> | chant ci run --setup-key [--trust [--principal <name>]] [--state <dir>] [--branch <name>]";
 const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 /** The host's runner key in `--state`, or in ci serve's default state directory, when `--setup-key` made one there (#4099). */
 function hostRunnerKeyAt(cwd, statePath) {
@@ -760,15 +790,40 @@ export function ciSecretsOf(flag, env = process.env) {
     const file = flag ?? (env[CI_SECRETS_ENV] || undefined);
     return file === undefined ? undefined : readCiSecrets(resolve(file));
 }
-/** `chant ci run plan|apply` (#4094). */
+/**
+ * `chant ci run --at <sha>` (#4169): ask for every required phase to be built
+ * at a commit of the green branch. On GitHub, with a token in the
+ * environment, the workflows holding the phases start at once.
+ */
+async function requestBuildCommand(at) {
+    const { requestBuild } = await import("./ci-green.js");
+    const { ciForgeFromEnv } = await import("./ci-green-forge.js");
+    let forge;
+    try {
+        forge = process.env.GITHUB_REPOSITORY ? ciForgeFromEnv("github") : undefined;
+    }
+    catch {
+        forge = undefined;
+    }
+    const r = await requestBuild({ cwd: process.cwd(), at, ...(forge ? { forge } : {}) });
+    for (const w of r.warnings)
+        console.error(formatWarning({ message: w }));
+    const what = `${r.request.phases.join(", ")} at ${r.request.commit.slice(0, 12)}`;
+    console.log(`${r.existed ? `${r.request.tag} already asks for a build` : `Asked for ${what}: ${r.request.tag}`}. ` +
+        (r.dispatched.length > 0 ? `Started ${r.dispatched.join(", ")}.` : "The next ci tick starts it on GitHub, and ci serve --build-command serves it for chant runs."));
+    return 0;
+}
+/** `chant ci run plan|record|apply` (#4094, #4168). */
 export async function runCiRun(ctx) {
     const { args } = ctx;
     try {
         if (args.setupKey)
             return (await import("./ci-serve.js")).runnerKeySetupCommand(ctx);
+        if (args.at !== undefined && args.extraPositional === undefined)
+            return await requestBuildCommand(args.at);
         const job = args.extraPositional;
-        if (job !== "plan" && job !== "apply")
-            throw new CiRunError(`ci run takes the job to run, plan or apply${job ? `, not ${JSON.stringify(job)}` : ""}`);
+        if (job !== "plan" && job !== "apply" && job !== "record")
+            throw new CiRunError(`ci run takes the job to run, plan, record or apply${job ? `, not ${JSON.stringify(job)}` : ""}`);
         if (!args.env)
             throw new CiRunError("--env names the environment the pipeline is for, as chant build --components --generate <lexicon> --pr-loop took it: --env <env>");
         const forge = args.forge ?? detectForge(process.env);
@@ -806,6 +861,7 @@ export async function runCiRun(ctx) {
             ...(args.local ? { local: true } : {}),
             ...(args.noPush ? { push: false } : {}),
             ...(args.wave !== undefined ? { wave: args.wave } : {}),
+            ...(args.requireRunnerStart ? { requireRunnerStart: true } : {}),
             ...(args.runIndexLimit ? { runIndexLimit: args.runIndexLimit } : {}),
             ...(args.image ? { image: args.image } : {}),
             ...(args.beforeScript?.length ? { beforeScript: args.beforeScript } : {}),

package/dist/workspace/ci-runner-start.d.ts

@@ -0,0 +1,77 @@
+/**
+ * `chant ci runner-start sign|verify` and `chant ci run --require-runner-start`
+ * (#4147): the runner-start statement (../runner-start.ts) checked against
+ * `.chant/trust.json` at base.
+ *
+ * - `sign` is for the provisioner that starts a runner for one job: it signs
+ *   the job's ids with a runner key the job never holds and prints the
+ *   envelope, which the provisioner puts where the job looks for it.
+ * - `verify` is for the job: it names itself from the forge's variables,
+ *   reads the statement, and fails unless a runner key `.chant/trust.json`
+ *   at base lists, whose principal holds the `runner` role, signed it for
+ *   this job.
+ * - `ci run --require-runner-start` makes the same check before the job's
+ *   first step, so an apply refuses before it trades for any credentials.
+ *
+ * Requiring the statement is opt-in (#4156). With nothing asking for it,
+ * nothing reads it, and a runner with none never refuses, warns or hides
+ * anything.
+ *
+ * {@link runnerStartReadiness} says whether a repository could require it
+ * at base, and what is missing, for the isolated-runners security group
+ * (#4168, section 8), whose WSP165 check reports these gaps.
+ */
+import type { CommandContext } from "../cli/registry.js";
+import { type CiJobIdentity, type RunnerStartVerdict } from "../runner-start.js";
+import { type TrustPolicy } from "./trust/policy.js";
+/**
+ * Check this job's runner-start statement against `.chant/trust.json` at
+ * `base`. `commit` is the commit the job runs, in place of the forge's
+ * variable. Never throws.
+ */
+export declare function checkRunnerStart(input: {
+    top: string;
+    base: string;
+    env?: Record<string, string | undefined>;
+    commit?: string;
+    readFile?: (path: string) => string;
+}): RunnerStartVerdict;
+/** One thing a repository lacks before it can require runner-start statements. */
+export interface RunnerStartGap {
+    /** Not a read-contract reason code: the isolated-runners group (#4168) maps each to its own security code. */
+    gap: "no-runner-key" | "no-runner-role" | "trust-unreadable";
+    reason: string;
+}
+/**
+ * Whether `.chant/trust.json` in `policy` lets a job require a runner-start
+ * statement: a key under `runners` whose principal holds the `runner` role.
+ * `configured` is true when there are no gaps. For the isolated-runners
+ * security group (#4168); nothing here refuses or warns.
+ */
+export declare function runnerStartReadiness(policy: TrustPolicy): {
+    configured: boolean;
+    gaps: RunnerStartGap[];
+};
+/** {@link runnerStartReadiness} for the repository around `cwd` at `base` (default `HEAD`). */
+export declare function runnerStartReadinessAt(cwd: string, base?: string): {
+    configured: boolean;
+    gaps: RunnerStartGap[];
+};
+/** The job named by `--job`: JSON, or `@<file>` holding it. */
+export declare function parseJobSpec(spec: string): CiJobIdentity;
+/** `chant ci runner-start sign|verify`. */
+export declare function runCiRunnerStart(ctx: CommandContext): Promise<number>;
+/**
+ * The check `ci run --require-runner-start` makes before the job's first
+ * step: the statement for this job, verified against `.chant/trust.json` at
+ * `base`. Throws with the verdict's reason unless it verified.
+ */
+export declare function requireRunnerStart(input: {
+    top: string;
+    base: string;
+    commit: string;
+    env: Record<string, string | undefined>;
+}): Extract<RunnerStartVerdict, {
+    status: "verified";
+}>;
+//# sourceMappingURL=ci-runner-start.d.ts.map

package/dist/workspace/ci-runner-start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-runner-start.d.ts","sourceRoot":"","sources":["../../src/workspace/ci-runner-start.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAKL,KAAK,aAAa,EAElB,KAAK,kBAAkB,EACxB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAOhF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;CAAE,GAAG,kBAAkB,CAUzL;AAED,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,8GAA8G;IAC9G,GAAG,EAAE,eAAe,GAAG,gBAAgB,GAAG,kBAAkB,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,WAAW,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,EAAE,CAAA;CAAE,CAezG;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,SAAS,GAAG;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,cAAc,EAAE,CAAA;CAAE,CAKlH;AAkBD,+DAA+D;AAC/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAuBxD;AAID,2CAA2C;AAC3C,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B3E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAC,CAMrL"}

package/dist/workspace/ci-runner-start.js

@@ -0,0 +1,185 @@
+/**
+ * `chant ci runner-start sign|verify` and `chant ci run --require-runner-start`
+ * (#4147): the runner-start statement (../runner-start.ts) checked against
+ * `.chant/trust.json` at base.
+ *
+ * - `sign` is for the provisioner that starts a runner for one job: it signs
+ *   the job's ids with a runner key the job never holds and prints the
+ *   envelope, which the provisioner puts where the job looks for it.
+ * - `verify` is for the job: it names itself from the forge's variables,
+ *   reads the statement, and fails unless a runner key `.chant/trust.json`
+ *   at base lists, whose principal holds the `runner` role, signed it for
+ *   this job.
+ * - `ci run --require-runner-start` makes the same check before the job's
+ *   first step, so an apply refuses before it trades for any credentials.
+ *
+ * Requiring the statement is opt-in (#4156). With nothing asking for it,
+ * nothing reads it, and a runner with none never refuses, warns or hides
+ * anything.
+ *
+ * {@link runnerStartReadiness} says whether a repository could require it
+ * at base, and what is missing, for the isolated-runners security group
+ * (#4168, section 8), whose WSP165 check reports these gaps.
+ */
+import { execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { formatError } from "../cli/format.js";
+import { ciJobFromEnv, RUNNER_START_SIGNER_ROLE, signRunnerStart, verifyRunnerStartForJob, } from "../runner-start.js";
+import { gitRevisionSource } from "./record-source.js";
+import { gitTop } from "./tree.js";
+import { loadRunnerKey } from "./trust/dsse.js";
+import { emptyPolicy, readTrustPolicy } from "./trust/policy.js";
+/** The policy at `base` in the repository around `cwd`. */
+function policyAt(top, base) {
+    return readTrustPolicy(gitRevisionSource(top, base), base);
+}
+/**
+ * Check this job's runner-start statement against `.chant/trust.json` at
+ * `base`. `commit` is the commit the job runs, in place of the forge's
+ * variable. Never throws.
+ */
+export function checkRunnerStart(input) {
+    const policy = policyAt(input.top, input.base);
+    if (policy.problems.length > 0)
+        return { status: "untrusted", reason: `.chant/trust.json at ${input.base.slice(0, 12)} cannot be read: ${policy.problems.join("; ")}` };
+    return verifyRunnerStartForJob({
+        runners: policy.runners,
+        roles: policy.roles,
+        ...(input.env ? { env: input.env } : {}),
+        ...(input.commit ? { commit: input.commit } : {}),
+        ...(input.readFile ? { readFile: input.readFile } : {}),
+    });
+}
+/**
+ * Whether `.chant/trust.json` in `policy` lets a job require a runner-start
+ * statement: a key under `runners` whose principal holds the `runner` role.
+ * `configured` is true when there are no gaps. For the isolated-runners
+ * security group (#4168); nothing here refuses or warns.
+ */
+export function runnerStartReadiness(policy) {
+    const gaps = [];
+    if (policy.problems.length > 0) {
+        gaps.push({ gap: "trust-unreadable", reason: `.chant/trust.json cannot be read: ${policy.problems.join("; ")}` });
+        return { configured: false, gaps };
+    }
+    if (policy.runners.length === 0) {
+        gaps.push({ gap: "no-runner-key", reason: ".chant/trust.json lists no key under runners for a provisioner to sign with: chant workspace trust runner add <principal> --key <ssh-ed25519 line>" });
+    }
+    else {
+        const holders = new Set((policy.roles[RUNNER_START_SIGNER_ROLE] ?? []).map((p) => p.normalize("NFKC").trim().toLowerCase()));
+        if (!policy.runners.some((r) => holders.has(r.principal.normalize("NFKC").trim().toLowerCase()))) {
+            gaps.push({ gap: "no-runner-role", reason: `no principal under runners holds the ${RUNNER_START_SIGNER_ROLE} role in .chant/trust.json: "roles": { "${RUNNER_START_SIGNER_ROLE}": ["<principal>"] }` });
+        }
+    }
+    return { configured: gaps.length === 0, gaps };
+}
+/** {@link runnerStartReadiness} for the repository around `cwd` at `base` (default `HEAD`). */
+export function runnerStartReadinessAt(cwd, base = "HEAD") {
+    const top = gitTop(cwd);
+    if (!top)
+        return runnerStartReadiness(emptyPolicy(null, [`${cwd} is not in a git repository`]));
+    const commit = revParse(top, base);
+    return runnerStartReadiness(commit ? policyAt(top, commit) : emptyPolicy(null, [`${base} is not a commit`]));
+}
+function revParse(top, rev) {
+    try {
+        return execFileSync("git", ["rev-parse", "--verify", "-q", `${rev}^{commit}`], { cwd: top, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim() || undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The base `verify` reads trust at: `--base`, else the remote's default branch, else `HEAD`. */
+function verifyBase(top, base) {
+    const rev = base ?? (revParse(top, "refs/remotes/origin/HEAD") ? "refs/remotes/origin/HEAD" : "HEAD");
+    const commit = revParse(top, rev);
+    if (!commit)
+        throw new Error(`--base ${rev} is not a commit in this repository`);
+    return commit;
+}
+/** The job named by `--job`: JSON, or `@<file>` holding it. */
+export function parseJobSpec(spec) {
+    const text = spec.startsWith("@") ? readFileSync(resolve(spec.slice(1)), "utf8") : spec;
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new Error("--job takes the job as JSON, or @<file> holding it: {\"system\":\"github\",\"repo\":\"owner/name\",\"run\":\"<id>\",\"attempt\":\"1\",\"job\":\"apply\",\"commit\":\"<sha>\",\"runner\":\"<name>\"}");
+    }
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw))
+        throw new Error("--job takes a JSON object");
+    const o = raw;
+    const str = (k) => (o[k] === undefined ? undefined : String(o[k]));
+    const known = ["system", "repo", "run", "attempt", "job", "commit", "runner"];
+    const extra = Object.keys(o).filter((k) => !known.includes(k));
+    if (extra.length > 0)
+        throw new Error(`--job has fields chant does not know: ${extra.join(", ")}`);
+    return {
+        system: (str("system") ?? ""),
+        repo: str("repo") ?? "",
+        run: str("run") ?? "",
+        attempt: str("attempt") ?? "1",
+        job: str("job") ?? "",
+        commit: str("commit") ?? "",
+        ...(str("runner") ? { runner: str("runner") } : {}),
+    };
+}
+const USAGE = "chant ci runner-start sign --key <runner key.pem> --principal <name> --job <json|@file> [-o <file>]\n  chant ci runner-start verify [--base <rev>] [--commit <sha>] [--json]";
+/** `chant ci runner-start sign|verify`. */
+export async function runCiRunnerStart(ctx) {
+    const { args } = ctx;
+    const action = args.extraPositional;
+    try {
+        if (action === "sign") {
+            if (!args.key)
+                throw new Error("--key names the provisioner's runner key, an Ed25519 private key in PEM, which the job never holds");
+            if (!args.ciPrincipal)
+                throw new Error("--principal names the principal .chant/trust.json lists the key for under runners");
+            if (!args.ciJob)
+                throw new Error("--job names the job the runner was started for, as JSON or @<file>");
+            const job = parseJobSpec(args.ciJob);
+            const pem = readFileSync(resolve(args.key), "utf8");
+            const loaded = loadRunnerKey(pem);
+            const envelope = signRunnerStart(job, { principal: args.ciPrincipal, key: loaded.key, publicKey: loaded.publicKey });
+            const text = `${JSON.stringify(envelope)}\n`;
+            if (args.output)
+                writeFileSync(resolve(args.output), text, { mode: 0o644 });
+            else
+                process.stdout.write(text);
+            return 0;
+        }
+        if (action === "verify") {
+            const top = gitTop(process.cwd());
+            if (!top)
+                throw new Error("verify reads .chant/trust.json at a commit, and this directory is not in a git repository");
+            const base = verifyBase(top, args.base);
+            const verdict = checkRunnerStart({ top, base, ...(args.commit ? { commit: args.commit } : {}) });
+            if (args.json)
+                process.stdout.write(`${JSON.stringify({ ...verdict, base })}\n`);
+            else
+                console.error(`ci runner-start: ${verdict.status}: ${verdict.reason}`);
+            return verdict.status === "verified" ? 0 : 1;
+        }
+        throw new Error(`ci runner-start takes sign or verify${action ? `, not ${JSON.stringify(action)}` : ""}`);
+    }
+    catch (err) {
+        console.error(formatError({ message: `chant ci runner-start: ${err instanceof Error ? err.message : String(err)}`, hint: USAGE }));
+        return 1;
+    }
+}
+/**
+ * The check `ci run --require-runner-start` makes before the job's first
+ * step: the statement for this job, verified against `.chant/trust.json` at
+ * `base`. Throws with the verdict's reason unless it verified.
+ */
+export function requireRunnerStart(input) {
+    const named = ciJobFromEnv(input.env);
+    if (!named.ok)
+        throw new Error(`--require-runner-start needs a forge job to check: ${named.reason}`);
+    const verdict = checkRunnerStart({ top: input.top, base: input.base, env: input.env, commit: input.commit });
+    if (verdict.status !== "verified")
+        throw new Error(`--require-runner-start: ${verdict.status}: ${verdict.reason}`);
+    return verdict;
+}