@intentius/chant 0.80.0 → 0.81.0

package/dist/workspace/status.d.ts

@@ -0,0 +1,150 @@
+/**
+ * `chant workspace status <env> [--compare-to <env>] [--json]` (#2544): a
+ * read-only view of each member's latest release in an environment, and
+ * optionally a second environment beside it (#2524 D19, ws-043).
+ *
+ * Releases stay per member: a release is an artifact digest plus a git SHA in
+ * the member's own ledger on the `chant/lifecycle` branch. Member ledgers
+ * live under `_members/<member>/<env>/releases.jsonl` (#2524 D7, #2538), and
+ * the root member `.` keeps the flat `<env>/releases.jsonl`. A member whose
+ * `_members/<member>/` directory doesn't exist yet is read from the flat
+ * ledger, which is where a chant from before #2538, or below the floor,
+ * still writes it. Several members read that way share one ledger, and the
+ * output says so.
+ *
+ * The command reads the local `chant/lifecycle` branch and never fetches it.
+ * The output names the branch tip it read, so a stale copy is visible.
+ *
+ * A member whose ledger can't be read is still listed, with a reason code,
+ * and the command still exits 0 (#2524 D15, ws-020), as `ls` does. Only a
+ * declaration that can't be read, or an environment name that can't be one,
+ * exits 1. The `--json` output is part of the read contract and is described
+ * by `status.schema.json` beside this file.
+ */
+import type { CommandContext } from "../cli/registry.js";
+import { type ReleaseRecord } from "../lifecycle/release-ledger.js";
+import { type ErrorLocation } from "./declaration.js";
+/** The version of the `status` output this chant writes. */
+export declare const STATUS_CONTRACT_VERSION = 1;
+/** `$id` of the JSON Schema for the `--json` output, shipped beside this file. */
+export declare const STATUS_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/status/v1/status.schema.json";
+/** The branch every ledger lives on. */
+export declare const LIFECYCLE_REF = "chant/lifecycle";
+/** The directory on {@link LIFECYCLE_REF} that holds member ledgers (#2538). */
+export declare const MEMBERS_DIR = "_members";
+/**
+ * Why a member's ledger for one environment can't be fully read. Closed: a
+ * new code is a contract change.
+ */
+export declare const STATUS_REASON_CODES: readonly ["ledger-unreadable", "ledger-malformed"];
+export type StatusReasonCode = (typeof STATUS_REASON_CODES)[number];
+/**
+ * Why the status couldn't be read at all. The declaration's own codes, except
+ * the two that only `--at` returns, and one for the environment name.
+ */
+export declare const STATUS_ERROR_CODES: readonly ["declaration-missing", "declaration-ambiguous", "declaration-unparseable", "declaration-invalid", "placement-invalid", "reader-too-old", "root-chant-required", "not-a-git-repository", "environment-invalid"];
+export type StatusErrorCode = (typeof STATUS_ERROR_CODES)[number];
+export interface StatusRelease {
+    component: string;
+    digest: string;
+    gitSha: string;
+    /** The input-side digest, when `digest` is a rendered one (a pinned helm deploy). Compare joins on it. */
+    inputDigest: string | null;
+    runId: string;
+    timestamp: string;
+    actor: string;
+    /** Read flags, such as `legacy-digest` (#2514). */
+    flags: string[];
+}
+export interface StatusLedger {
+    /** `members` for `_members/<member>/<env>/releases.jsonl`, `flat` for `<env>/releases.jsonl`. */
+    layout: "members" | "flat";
+    /** The ledger's path on the branch. */
+    path: string;
+    /** True when more than one member in this output reads this same flat ledger. */
+    shared: boolean;
+}
+export interface StatusEnvironment {
+    env: string;
+    ledger: StatusLedger;
+    /** The latest release of each component in the ledger, sorted by component. */
+    releases: StatusRelease[];
+    reason: {
+        code: StatusReasonCode;
+        message: string;
+    } | null;
+}
+export type CompareState = "same" | "differs" | "only-env" | "only-compare";
+export interface StatusCompare {
+    /** True when any component is not `same`. */
+    differs: boolean;
+    components: {
+        component: string;
+        state: CompareState;
+        digest: string | null;
+        compareDigest: string | null;
+    }[];
+}
+export interface StatusMember {
+    name: string;
+    dir: string;
+    kind: string;
+    /** The environment asked for first, then the one compared to, if any. */
+    environments: StatusEnvironment[];
+    /** Null without `--compare-to`. */
+    compare: StatusCompare | null;
+    readable: boolean;
+}
+export type StatusDocument = {
+    $schema: string;
+    contract: number;
+    chant: string;
+    env: string;
+    compareTo: string | null;
+    lifecycle: {
+        ref: string;
+        commit: string | null;
+    };
+    workspace: {
+        name: string;
+        root: string;
+        file: string;
+    };
+    members: StatusMember[];
+    summary: {
+        members: number;
+        released: number;
+        unreadable: number;
+        differing: number | null;
+    };
+} | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    error: {
+        code: StatusErrorCode;
+        message: string;
+        location: ErrorLocation | null;
+    };
+};
+type LedgerReader = (path: string, cwd: string) => Promise<{
+    records: ReleaseRecord[];
+    malformed: number;
+}>;
+export interface StatusQuery {
+    /** Where the walk up to the declaration starts. */
+    cwd: string;
+    env: string;
+    compareTo?: string;
+    /** Reads one ledger; the lifecycle reader unless a test swaps it. */
+    readLedger?: LedgerReader;
+}
+export declare function compareEnvironments(a: StatusEnvironment, b: StatusEnvironment): StatusCompare;
+/** Find the workspace, read every member's ledger and build the document `--json` prints. */
+export declare function workspaceStatus(query: StatusQuery): Promise<StatusDocument>;
+export declare function runWorkspaceStatus(ctx: CommandContext): Promise<number>;
+export declare function formatStatus(doc: Extract<StatusDocument, {
+    members: unknown;
+}>): string;
+export {};
+//# sourceMappingURL=status.d.ts.map

package/dist/workspace/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/workspace/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAExG,OAAO,EAAsD,KAAK,aAAa,EAAe,MAAM,eAAe,CAAC;AAKpH,4DAA4D;AAC5D,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,8EAA8E,CAAC;AAEnH,wCAAwC;AACxC,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAE/C,gFAAgF;AAChF,eAAO,MAAM,WAAW,aAAa,CAAC;AAItC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,oDAKU,CAAC;AAC3C,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,0NAYW,CAAC;AAC3C,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKlE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,iGAAiG;IACjG,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;IAC3B,uCAAuC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,YAAY,CAAC;IACrB,+EAA+E;IAC/E,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAE5E,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC;CAC/G;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,mCAAmC;IACnC,OAAO,EAAE,aAAa,GAAG,IAAI,CAAC;IAC9B,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,cAAc,GACtB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAC9F,GACD;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QAAE,IAAI,EAAE,eAAe,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAA;KAAE,CAAC;CACnF,CAAC;AAEN,KAAK,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE5G,MAAM,WAAW,WAAW;IAC1B,mDAAmD;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,CAAC,EAAE,YAAY,CAAC;CAC3B;AAkFD,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,iBAAiB,GAAG,aAAa,CAW7F;AAED,6FAA6F;AAC7F,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,cAAc,CAAC,CA4DjF;AAED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAuC7E;AAeD,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,EAAE;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,GAAG,MAAM,CAqCvF"}

package/dist/workspace/template-manifest.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Template parameters (#2627, #2524 D9): `chant.template.json` at a
+ * template's root declares the parameters `chant init --from` takes and the
+ * files they are substituted into.
+ *
+ * ```json
+ * {
+ *   "parameters": {
+ *     "name": { "type": "string", "default": "Reference app", "pattern": "^[A-Za-z0-9][A-Za-z0-9 ._-]*$" }
+ *   },
+ *   "files": ["app/src/server.mjs"]
+ * }
+ * ```
+ *
+ * A listed file carries `{{chant:<name>}}` where the value goes. The `chant:`
+ * prefix keeps the placeholder apart from TypeScript template literals
+ * (`${x}`), GitHub and Forgejo expressions (`${{ x }}`) and Handlebars or
+ * Mustache (`{{x}}`), so a template can hold any of those in a listed file.
+ * Only listed files are substituted, the value is inserted as written, and a
+ * placeholder naming an undeclared parameter is an error in the template.
+ *
+ * The manifest is JSON and read as data: no template code runs at init or
+ * upgrade. It is template metadata, like `.chant/migrations/`, so it is not
+ * copied into the project. The values used are recorded in the lineage's
+ * `parameters`, and `chant workspace upgrade` substitutes them again into both
+ * the merge base and the target version, so an unedited file carrying a value
+ * still has its recorded hash.
+ *
+ * `hostBound` is declared and validated but not acted on yet: recording a
+ * value per host belongs to export and import (#2552). A host-bound value is
+ * recorded in `parameters` like any other until then.
+ */
+import { z } from "zod";
+import { LockError } from "./lineage-lock.js";
+/** The manifest's path, relative to the template's root (the `#<member>` directory, when one is given). */
+export declare const TEMPLATE_MANIFEST = "chant.template.json";
+export declare function placeholder(name: string): string;
+declare const ParameterSchema: z.ZodObject<{
+    type: z.ZodLiteral<"string">;
+    default: z.ZodOptional<z.ZodString>;
+    pattern: z.ZodOptional<z.ZodString>;
+    hostBound: z.ZodOptional<z.ZodBoolean>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type TemplateParameter = z.infer<typeof ParameterSchema>;
+declare const ManifestSchema: z.ZodObject<{
+    $comment: z.ZodOptional<z.ZodString>;
+    parameters: z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodLiteral<"string">;
+        default: z.ZodOptional<z.ZodString>;
+        pattern: z.ZodOptional<z.ZodString>;
+        hostBound: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    files: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type TemplateManifest = z.infer<typeof ManifestSchema>;
+export declare class TemplateParameterError extends LockError {
+    name: string;
+}
+/**
+ * Read the manifest from a template's files, or null when it has none.
+ * Throws on a manifest that is not valid JSON or does not match the schema.
+ */
+export declare function readManifest(files: Map<string, Buffer>): TemplateManifest | null;
+/**
+ * Parse `--param name=value` arguments (split at the first `=`). A name given
+ * twice is refused rather than silently taking the last value.
+ */
+export declare function parseParamArgs(args: readonly string[]): Record<string, string>;
+/**
+ * The value of every declared parameter: the given value, or the default.
+ * Refuses an undeclared name (listing the declared ones), a parameter with no
+ * value and no default, and a value that does not match its pattern.
+ */
+export declare function resolveParameters(manifest: TemplateManifest | null, given: Record<string, string>): Record<string, string>;
+/**
+ * The template's files as the project gets them: the manifest removed, and
+ * each listed file with its placeholders replaced. A listed file that is
+ * missing, or a placeholder naming no declared parameter, is refused.
+ */
+export declare function substituteParameters(files: Map<string, Buffer>, manifest: TemplateManifest | null, values: Record<string, string>): Map<string, Buffer>;
+/**
+ * The values an upgrade substitutes into a version of the template: the
+ * recorded value of every parameter that version declares, and the default of
+ * one it adds. A recorded parameter the version no longer declares is dropped.
+ */
+export declare function carryParameters(manifest: TemplateManifest | null, recorded: Record<string, unknown>): Record<string, string>;
+export {};
+//# sourceMappingURL=template-manifest.d.ts.map

package/dist/workspace/template-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-manifest.d.ts","sourceRoot":"","sources":["../../src/workspace/template-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,2GAA2G;AAC3G,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAOvD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,QAAA,MAAM,eAAe;;;;;;kBAUV,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAEhE,QAAA,MAAM,cAAc;;;;;;;;;;kBAMT,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAM9D,qBAAa,sBAAuB,SAAQ,SAAS;IAC1C,IAAI,SAA4B;CAC1C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,GAAG,IAAI,CAoChF;AAQD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU9E;AAOD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB1H;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC1B,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBrB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5H"}

package/dist/workspace/tree.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The files a workspace read looks at: the working tree, or one commit's git
+ * objects (`--at <rev>`, #2524 D15). Reading a revision needs no checkout and
+ * no network; the whole tree is listed once from the local object store.
+ *
+ * Paths are relative to the tree's root, `/`-separated, and `""` is the root.
+ */
+export interface WorkspaceTree {
+    /** Appended to messages, such as " at 91c7547e". Empty for the working tree. */
+    label: string;
+    /** Whether `path` is a file, a directory, or missing. */
+    stat(path: string): "file" | "dir" | undefined;
+    /** The names of the entries directly inside directory `path`, or undefined when it is missing. */
+    list(path: string): {
+        name: string;
+        type: "file" | "dir";
+    }[] | undefined;
+    /** The text of the file at `path`. Throws when it can't be read. */
+    read(path: string): string;
+}
+/** Join tree-relative path parts, leaving out `""` and `"."`. */
+export declare function joinPath(...parts: string[]): string;
+/** The working tree under `root`. */
+export declare function workingTree(root: string): WorkspaceTree;
+/** The top of the git repository holding `cwd`, or undefined outside one. */
+export declare function gitTop(cwd: string): string | undefined;
+/** The full commit id `rev` names in the repository at `top`, or undefined. */
+export declare function resolveCommit(top: string, rev: string): string | undefined;
+/**
+ * The tree of `commit` in the repository at `top`, rooted at `prefix` (a
+ * directory relative to `top`, `""` for the top itself).
+ */
+export declare function gitTree(top: string, commit: string, prefix?: string): WorkspaceTree;
+/** Directory names a workspace walk never enters. */
+export declare function skippedDir(name: string): boolean;
+//# sourceMappingURL=tree.d.ts.map

package/dist/workspace/tree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree.d.ts","sourceRoot":"","sources":["../../src/workspace/tree.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IAC/C,kGAAkG;IAClG,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,EAAE,GAAG,SAAS,CAAC;IACzE,oEAAoE;IACpE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CAC5B;AAED,iEAAiE;AACjE,wBAAgB,QAAQ,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAEnD;AAED,qCAAqC;AACrC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAqCvD;AAMD,6EAA6E;AAC7E,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMtD;AAED,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAO1E;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,aAAa,CA+B/E;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD"}

package/dist/workspace/trust/attestor.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Attestors and provenance levels (#2524 D5).
+ *
+ * An attestor answers one question about a commit: does it carry an
+ * attestation that the policy read at base accepts? Concrete attestors are
+ * plugins. Core ships the contract and the first one, ssh-signed commits
+ * (./ssh-commit.ts). Plugin attestors will arrive the way kinds do, through
+ * `workspaceKinds` (#2525 rule 5), once the declaration can name them (#2534,
+ * #2535); until then {@link registerAttestor} is the entry point.
+ *
+ * What counts as proof: a signature the attestor checked against a key the
+ * base policy lists. Never a trailer, a typed-in name, an author field or an
+ * environment variable.
+ */
+import type { TrustPolicy } from "./policy.js";
+/**
+ * How far a record's authorship is established. The list is closed and
+ * ordered from strongest to weakest; a gate may require `attested`.
+ *
+ * - `attested`: an attestor verified a signature by a signer the base policy lists.
+ * - `attested-unverifiable-here`: there is a signature, but nothing here can
+ *   check it (a signature format no attestor handles, or a missing tool).
+ * - `adopted`: not attested, but inside a commit range the base policy admits.
+ * - `unattested`: none of the above. The same word, with the same meaning, as
+ *   the approver a gate resolution records when its channel cannot attest to a
+ *   name (#2384, {@link UNATTESTED_APPROVER}); D5 keeps that meaning.
+ */
+export declare const PROVENANCE_LEVELS: readonly ["attested", "attested-unverifiable-here", "adopted", "unattested"];
+export type ProvenanceLevel = (typeof PROVENANCE_LEVELS)[number];
+/** What one attestor says about one commit. */
+export interface CommitAttestation {
+    level: "attested" | "attested-unverifiable-here" | "unattested";
+    /** The attestor that gave this answer. */
+    attestor: string;
+    /** The principal whose key verified, when `attested`. */
+    principal?: string;
+    /** The key's fingerprint, when known. */
+    key?: string;
+    /** Why the level is what it is, in a sentence. */
+    reason: string;
+}
+/** Read access to the repository an attestor checks. */
+export interface AttestorContext {
+    /** The repository's top directory. */
+    repo: string;
+    /** The policy read at base. */
+    policy: TrustPolicy;
+}
+/** A commit attestor. Plugins implement this. */
+export interface CommitAttestor {
+    /** A stable name, such as `ssh-commit`. */
+    readonly name: string;
+    attestCommit(ctx: AttestorContext, commit: string): CommitAttestation;
+}
+/** Add an attestor. Later registrations are asked after earlier ones. */
+export declare function registerAttestor(attestor: CommitAttestor): void;
+/** Remove every attestor registered by {@link registerAttestor}. For tests. */
+export declare function resetAttestors(): void;
+/**
+ * Ask each attestor in turn. The first `attested` answer wins; otherwise
+ * `attested-unverifiable-here` beats `unattested`, so a signature nobody here
+ * can check is still reported as there.
+ */
+export declare function attestCommit(ctx: AttestorContext, commit: string, attestors: readonly CommitAttestor[]): CommitAttestation;
+/** The attestors in use: the built-in ones first, then any registered. */
+export declare function activeAttestors(): Promise<CommitAttestor[]>;
+//# sourceMappingURL=attestor.d.ts.map

package/dist/workspace/trust/attestor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attestor.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/attestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,8EAAsF,CAAC;AACrH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,4BAA4B,GAAG,YAAY,CAAC;IAChE,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC;CACvE;AAID,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAQ1H;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAGjE"}

package/dist/workspace/trust/policy.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Trust policy, always read from the base revision (#2524 D5, Threat model;
+ * ws-001, ws-002).
+ *
+ * A check reads who may sign, and who holds which role, from the target
+ * branch tip or `--base <rev>`, never from the change under review. A change
+ * can edit its own copy of these files, and those edits have no effect until
+ * they are merged: the change is still judged by the policy at base. Editing
+ * the policy is itself a protected write (see ./verify.ts).
+ *
+ * Two files, both optional:
+ *
+ * - `.chant/allowed_signers` holds the signers, in ssh-keygen's
+ *   allowed_signers format, so `git log --show-signature` can use the same
+ *   file. `trust.json` may name another path.
+ * - `.chant/trust.json` holds the override for the signers path, the role
+ *   grants and the adopted commit ranges. Role grants move into
+ *   `chant.workspace.json` once the declaration exists (#2534).
+ *
+ * Attestation is opt-in (#2525 rule 6). Without a signers file at base,
+ * nothing is verified and every record is `unattested`.
+ */
+import { z } from "zod";
+import type { RecordSource } from "../record-source.js";
+/** The trust config, relative to the repository root. Fixed: it is how the signers path is overridden. */
+export declare const TRUST_CONFIG_PATH = ".chant/trust.json";
+/** Where the signers are when `trust.json` names no other path. */
+export declare const DEFAULT_SIGNERS_PATH = ".chant/allowed_signers";
+/** One usable signer: a principal and the public key it signs with. */
+export interface Signer {
+    principal: string;
+    /** `<type> <base64>`, with no comment. */
+    key: string;
+    /** The `namespaces="..."` option as written, or undefined when the key may sign any namespace. */
+    namespaces?: string;
+    /** 1-based line in the signers file. */
+    line: number;
+}
+/** A line of the signers file that is not used, and why. */
+export interface ExcludedSigner {
+    line: number;
+    reason: string;
+}
+export interface SignerSet {
+    signers: Signer[];
+    excluded: ExcludedSigner[];
+}
+/**
+ * Parse an allowed_signers file, keeping only lines whose meaning does not
+ * depend on anything the signer controls.
+ *
+ * Refused, each with a reason, rather than passed to ssh-keygen:
+ *
+ * - `valid-after` and `valid-before`. git checks them against the commit's own
+ *   date, which whoever makes the commit sets. A backdated commit would pass a
+ *   window its key has left. Revocation is by position in history (#2553),
+ *   never by date.
+ * - `cert-authority`. A certificate's validity is also a date, and a CA key
+ *   vouches for keys this file never names.
+ * - Principal patterns (`*`, `?`, `!`). A signer is named by one exact
+ *   principal, so role grants can name it.
+ */
+export declare function parseAllowedSigners(text: string): SignerSet;
+/** The signers as an allowed_signers file ssh-keygen reads, holding only the usable lines. */
+export declare function renderAllowedSigners(signers: Signer[]): string;
+export declare const trustConfigSchema: z.ZodObject<{
+    schema: z.ZodLiteral<1>;
+    signers: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    adopted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodString;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type TrustConfig = z.infer<typeof trustConfigSchema>;
+/** The role whose holders may change the policy. Without any grant of it, every signer may. */
+export declare const ADMIN_ROLE = "admin";
+/** The policy a check applies, as read at base. */
+export interface TrustPolicy {
+    /** The full commit id the policy was read at, or null when there is no base. */
+    base: string | null;
+    /** The signers path used. */
+    signersPath: string;
+    /** Whether a signers file exists at base. False means attestation is off. */
+    active: boolean;
+    signers: Signer[];
+    excluded: ExcludedSigner[];
+    roles: Record<string, string[]>;
+    adopted: Array<{
+        from?: string;
+        to: string;
+    }>;
+    /** Why the policy could not be read, when it could not. Nothing verifies then. */
+    problems: string[];
+}
+/** Paths whose change is a protected write under `policy`. */
+export declare function protectedPaths(policy: TrustPolicy): string[];
+/** Principals allowed to change the policy: the admins when any are granted, otherwise every signer. */
+export declare function policyWriters(policy: TrustPolicy): Set<string>;
+/** A policy with nothing in it: attestation off. */
+export declare function emptyPolicy(base: string | null, problems?: string[]): TrustPolicy;
+/**
+ * Read the policy through `source`, which must read the base revision.
+ * Never throws: a policy that cannot be read yields an inactive policy with
+ * its problems listed, so nothing is attested (fail closed).
+ */
+export declare function readTrustPolicy(source: RecordSource, base: string | null): TrustPolicy;
+/** A file's text through `source`, or undefined when it is not there. */
+export declare function readOptional(source: RecordSource, path: string): string | undefined;
+//# sourceMappingURL=policy.d.ts.map

package/dist/workspace/trust/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AAcD,eAAO,MAAM,iBAAiB;;;;;;;;;kBAiBnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAE5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CA8BtF;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}

package/dist/workspace/trust/provenance.d.ts

@@ -0,0 +1,67 @@
+/**
+ * The provenance level of each record (#2524 D5, Threat model).
+ *
+ * A record's content comes from the last commit that changed its file. That
+ * commit is asked of each attestor, with the policy read at base. A file with
+ * uncommitted changes is `unattested`: its bytes are in no commit, so nothing
+ * vouches for them.
+ *
+ * On a developer machine this detects; it does not enforce (ws-002). An agent
+ * running as the developer can use an unlocked signing agent or skip the check.
+ * Enforcement is CI running the same check against base.
+ */
+import { type CommitAttestor, type ProvenanceLevel } from "./attestor.js";
+import { type TrustPolicy } from "./policy.js";
+/** What `records` reports for one record. */
+export interface RecordProvenance {
+    level: ProvenanceLevel;
+    /** The commit the record's content comes from, or null for uncommitted content. */
+    commit: string | null;
+    attestor?: string;
+    principal?: string;
+    key?: string;
+    reason: string;
+}
+/** Where the base revision came from. */
+export type BaseSource = "flag" | "origin/HEAD" | "main" | "master";
+export interface ResolvedBase {
+    commit: string | null;
+    from: BaseSource | null;
+    /** Why there is no base, when there is none. */
+    problem?: string;
+}
+/**
+ * The base revision: `--base <rev>` when given, otherwise the target branch
+ * tip, taken as `origin/HEAD`, then a local `main`, then `master`. Never
+ * `HEAD`, which is the change under review.
+ */
+export declare function resolveBase(repo: string, explicit?: string): ResolvedBase;
+/** The policy at `base`, or an inactive one when there is no base. */
+export declare function policyAtBase(repo: string, base: ResolvedBase): TrustPolicy;
+/**
+ * The last commit reachable from `rev` that changed each path. Merges are
+ * diffed against all their parents (`-c`), so a merge that changes a file
+ * beyond what either side brought is the commit that file comes from, and a
+ * merge that only takes one side's version is passed through to that side.
+ */
+export declare function lastCommits(repo: string, rev: string, paths: string[]): Map<string, string>;
+/** Paths with staged, unstaged or untracked changes in the working tree. */
+export declare function dirtyPaths(repo: string, paths: string[]): Set<string>;
+/** Whether `commit` lies in a range the policy adopts (`from..to`, exact). */
+export declare function isAdopted(repo: string, policy: TrustPolicy, commit: string): boolean;
+/** A commit's provenance level under `policy`. */
+export declare function commitProvenance(repo: string, policy: TrustPolicy, commit: string, attestors: readonly CommitAttestor[]): RecordProvenance;
+export interface ProvenanceQuery {
+    repo: string | undefined;
+    policy: TrustPolicy;
+    /** The commit records were read at, or null for the working tree. */
+    at: string | null;
+    paths: string[];
+    attestors: readonly CommitAttestor[];
+}
+/**
+ * The provenance of each path. With attestation off (no signers file at
+ * base) nothing is checked and every path is `unattested`.
+ */
+export declare function recordProvenance(q: ProvenanceQuery): Map<string, RecordProvenance>;
+//# sourceMappingURL=provenance.d.ts.map

package/dist/workspace/trust/provenance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAE1E,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAczE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAG1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3F;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYrE;AAWD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,gBAAgB,CAa1I;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAyBlF"}

package/dist/workspace/trust/ssh-commit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The first attestor: ssh-signed commits, checked against the signers the
+ * base policy lists (#2524 D5, ws-001).
+ *
+ * It does not ask `git verify-commit`. That would read `gpg.ssh.program`,
+ * `gpg.ssh.allowedSignersFile` and the rest from git config, which whoever
+ * controls the machine can set, and it passes the commit's own date to
+ * ssh-keygen as the verification time. Instead it takes the signature and the
+ * signed payload out of the commit object itself and hands them to
+ * `ssh-keygen -Y verify` with a signers file built from the base policy, in
+ * the `git` namespace.
+ */
+import type { CommitAttestor } from "./attestor.js";
+import { type Signer } from "./policy.js";
+/** A commit object split into its signed payload and its signature. */
+export interface SignedCommit {
+    /** The bytes the signature covers: the commit object without its signature header. */
+    payload: Buffer;
+    /** The armored signature, or undefined when the commit is unsigned. */
+    signature?: string;
+}
+/**
+ * Split a raw commit object. `header` is `gpgsig` in a SHA-1 repository and
+ * `gpgsig-sha256` in a SHA-256 one; git removes exactly that header, with its
+ * continuation lines, to get the bytes it signed.
+ */
+export declare function splitSignedCommit(raw: Buffer, header?: string): SignedCommit;
+/**
+ * Check a detached ssh signature over `payload` in `namespace` against
+ * `signers`. Shared with the rotation check (#2553), which signs signer sets
+ * in their own namespace so a commit signature can never stand in for one.
+ */
+export declare function verifySshSignature(signers: Signer[], payload: Buffer, signature: string, namespace: string): {
+    ok: true;
+    principal: string;
+    key?: string;
+} | {
+    ok: false;
+    missing: boolean;
+    reason: string;
+};
+export declare const sshCommitAttestor: CommitAttestor;
+//# sourceMappingURL=ssh-commit.d.ts.map

package/dist/workspace/trust/ssh-commit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAmBD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAW/B,CAAC"}

package/dist/workspace/trust/test-repo.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Test support for the trust modules: throwaway git repositories whose commits
+ * are signed with throwaway ssh keys. Isolated from the user's git config, so a
+ * developer's own signing setup never leaks into a test.
+ */
+export declare const hasSshKeygen: boolean;
+export interface Key {
+    name: string;
+    /** Private key file. */
+    file: string;
+    /** `ssh-ed25519 AAAA...`, no comment. */
+    pub: string;
+}
+export declare class TestRepo {
+    readonly dir: string;
+    private readonly home;
+    private readonly scratch;
+    constructor(label: string);
+    env(extra?: Record<string, string>): NodeJS.ProcessEnv;
+    git(args: string[], opts?: {
+        env?: Record<string, string>;
+        input?: string | Buffer;
+    }): string;
+    key(name: string): Key;
+    write(path: string, text: string): void;
+    /** Stage everything and commit, signed with `key` when given. Returns the commit id. */
+    commit(message: string, key?: Key, env?: Record<string, string>): string;
+    head(): string;
+    /**
+     * Write a commit object by hand: the current index's tree, `HEAD` as parent,
+     * and `signature` spliced in as the gpgsig header. Returns the new commit,
+     * which HEAD then points at.
+     */
+    forgeCommit(message: string, sign: (payload: Buffer) => string): string;
+    /** An ssh signature over `payload` in `namespace`, by `key`. */
+    sshSign(key: Key, payload: Buffer, namespace: string): string;
+    cleanup(): void;
+}
+/** A record kind reading `records/*.md`, and its schema, written into `repo`. */
+export declare function writeRecordKind(repo: TestRepo): string;
+export declare function note(id: string, body?: string): string;
+//# sourceMappingURL=test-repo.d.ts.map

package/dist/workspace/trust/test-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-repo.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/test-repo.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,eAAO,MAAM,YAAY,SAA2E,CAAC;AAErG,MAAM,WAAW,GAAG;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,QAAQ;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,KAAK,EAAE,MAAM;IASzB,GAAG,CAAC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM,CAAC,UAAU;IAc1D,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;KAAO,GAAG,MAAM;IAIjG,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG;IAOtB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKvC,wFAAwF;IACxF,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GAAG,MAAM;IAO5E,IAAI,IAAI,MAAM;IAId;;;;OAIG;IACH,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,MAAM;IAgBvE,gEAAgE;IAChE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAO7D,OAAO,IAAI,IAAI;CAGhB;AAED,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM,CAqBtD;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAElD"}