@intentius/chant 0.99.0 → 0.101.0

package/dist/workspace/trust/attestor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attestor.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/attestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,8EAAsF,CAAC;AACrH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,4BAA4B,GAAG,YAAY,CAAC;IAChE,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC;CACvE;AAID,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAQ1H;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAGjE"}
+{"version":3,"file":"attestor.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/attestor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,8EAAsF,CAAC;AACrH,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,+CAA+C;AAC/C,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,UAAU,GAAG,4BAA4B,GAAG,YAAY,CAAC;IAChE,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,2CAA2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAAC;IACtE;;;;OAIG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAAC;CAClE;AAID,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAQ1H;AAED,8FAA8F;AAC9F,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,iBAAiB,CAM1H;AAED,0EAA0E;AAC1E,wBAAsB,eAAe,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAGjE"}

package/dist/workspace/trust/dsse.d.ts

@@ -0,0 +1,58 @@
+/**
+ * DSSE envelopes (https://github.com/secure-systems-lab/dsse, v1) signed with
+ * Ed25519 runner keys (#2553).
+ *
+ * The signature covers the pre-authentication encoding (PAE) of the payload
+ * type and the payload, never the payload alone, so an envelope cannot be
+ * replayed under another type. Everything here runs offline: verifying needs
+ * the envelope and the public key, nothing else.
+ *
+ * Public keys are written the way ssh writes them (`ssh-ed25519 AAAA...`), so
+ * the runner keys in `.chant/trust.json` read like the signers file beside
+ * them, and a key id is the key's ssh fingerprint (`SHA256:...`).
+ */
+import { type KeyObject } from "node:crypto";
+export declare const IN_TOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+export interface DsseSignature {
+    keyid: string;
+    sig: string;
+}
+export interface DsseEnvelope {
+    payloadType: string;
+    /** Base64 of the payload bytes. */
+    payload: string;
+    signatures: DsseSignature[];
+}
+/** DSSE v1 pre-authentication encoding. Lengths are byte lengths in ASCII decimal. */
+export declare function pae(payloadType: string, payload: Buffer): Buffer;
+/** The 32 raw bytes of an `ssh-ed25519 <base64>` public key. */
+export declare function ed25519FromSsh(line: string): Buffer;
+/** An `ssh-ed25519 <base64>` line for 32 raw public key bytes. */
+export declare function sshFromEd25519(raw: Buffer): string;
+/** The ssh fingerprint of a public key line: `SHA256:` and unpadded base64. */
+export declare function sshFingerprint(line: string): string;
+/** A private Ed25519 key from PEM (PKCS#8), and its public half as an ssh line. */
+export declare function loadRunnerKey(pem: string): {
+    key: KeyObject;
+    publicKey: string;
+};
+export declare function signEnvelope(payloadType: string, payload: Buffer, key: KeyObject, publicKey: string): DsseEnvelope;
+export interface TrustedKey {
+    principal: string;
+    /** `ssh-ed25519 <base64>`. */
+    key: string;
+}
+export type EnvelopeVerdict = {
+    ok: true;
+    principal: string;
+    keyid: string;
+    payloadType: string;
+    payload: Buffer;
+} | {
+    ok: false;
+    code: "envelope-invalid" | "envelope-untrusted";
+    reason: string;
+};
+/** Verify an envelope against `trusted`. One valid signature by a trusted key is enough. */
+export declare function verifyEnvelope(envelope: unknown, trusted: readonly TrustedKey[]): EnvelopeVerdict;
+//# sourceMappingURL=dsse.d.ts.map

package/dist/workspace/trust/dsse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsse.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/dsse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAA+D,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAE1G,eAAO,MAAM,oBAAoB,iCAAiC,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,sFAAsF;AACtF,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGhE;AAWD,gEAAgE;AAChE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAOlD;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAMD,mFAAmF;AACnF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAKhF;AAID,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAGlH;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpF;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,kBAAkB,GAAG,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnF,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,GAAG,eAAe,CAmBjG"}

package/dist/workspace/trust/evidence-cli.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `chant workspace evidence sign|verify` (#2553): runner evidence over the
+ * records a kind locates, in a DSSE envelope. See ./evidence.ts.
+ *
+ * `sign` runs in CI or in a service, with a runner key the policy at base
+ * lists. It refuses a key the signers file lists: evidence is a machine's
+ * statement, and a developer's key cannot make one. `verify` needs no
+ * network and no key, only the envelope and the repository.
+ *
+ * With `--json`, `verify` prints the `evidence.schema.json` document, and a
+ * refused `sign` prints its failure branch.
+ */
+import type { CommandContext } from "../../cli/registry.js";
+import { type DsseEnvelope } from "./dsse.js";
+import { type EvidenceErrorCode, type EvidenceStatement, type EvidenceVerdict } from "./evidence.js";
+export declare const EVIDENCE_CONTRACT_VERSION = 1;
+export declare const EVIDENCE_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/evidence/v1/evidence.schema.json";
+export interface EvidenceFailure {
+    code: EvidenceErrorCode;
+    message: string;
+}
+/** What `evidence verify --json` prints, and a refused `evidence sign --json`. */
+export type EvidenceDocument = ({
+    $schema: string;
+    contract: number;
+    chant: string;
+    at: string;
+} & Extract<EvidenceVerdict, {
+    ok: true;
+}>) | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    at: string | null;
+    error: EvidenceFailure;
+};
+export declare function runWorkspaceEvidence(ctx: CommandContext): Promise<number>;
+export interface SignRequest {
+    repo: string;
+    /** The kind file, resolved against `cwd`. */
+    kind: string;
+    cwd: string;
+    keyPem: string;
+    checkId: string;
+    at?: string;
+    base?: string;
+    claim?: Buffer;
+    environment?: Buffer;
+}
+/**
+ * Build and sign evidence, or say why not. Refuses a key the signers file
+ * lists, and a key the policy at base does not list as a runner.
+ */
+export declare function signRecordsEvidence(req: SignRequest): Promise<{
+    envelope: DsseEnvelope;
+    statement: EvidenceStatement;
+    runner: string;
+} | {
+    error: EvidenceFailure;
+}>;
+/** Verify an envelope file at `at` against the runner keys at base, as the document `--json` prints. */
+export declare function verifyEvidenceFile(repo: string, envelopePath: string, opts?: {
+    at?: string;
+    base?: string;
+}): EvidenceDocument;
+//# sourceMappingURL=evidence-cli.d.ts.map

package/dist/workspace/trust/evidence-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-cli.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/evidence-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIzD,OAAO,EAAiB,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,EAAsE,KAAK,iBAAiB,EAAE,KAAK,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAGtK,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C,eAAO,MAAM,yBAAyB,kFAAkF,CAAC;AAMzH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kFAAkF;AAClF,MAAM,MAAM,gBAAgB,GACxB,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,eAAe,EAAE;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAAC,GAC3G;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AAqBpG,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAO/E;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC,CA8ChH;AA2BD,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,gBAAgB,CAgBlI"}

package/dist/workspace/trust/evidence.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Runner evidence (#2553, #2524 D5 "Evidence").
+ *
+ * A runner, meaning a CI job or a service, states that a check ran over a
+ * set of records at one commit. The statement is an in-toto Statement v1:
+ * each record is a subject, named by its path and hashed, and the predicate
+ * binds the commit, its tree, the check, and the digests of the claim and of
+ * the environment when given. The runner signs it in a DSSE envelope with its
+ * own Ed25519 key.
+ *
+ * Verifying needs only the envelope, the repository's objects and the runner
+ * keys the policy at base lists, so it works offline. Evidence is never
+ * reused on trust: a verdict reports, subject by subject, whether the records
+ * still hash the same, and evidence for records that changed is `stale`.
+ */
+import { z } from "zod";
+import { type DsseEnvelope } from "./dsse.js";
+import type { KeyObject } from "node:crypto";
+import type { RunnerKey } from "./policy.js";
+export declare const STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+export declare const RUNNER_EVIDENCE_PREDICATE = "https://intentius.io/chant/runner-evidence/v1";
+/**
+ * Why evidence is refused, by `evidence sign` or `evidence verify` (#2553).
+ * Each is in `reason-codes.ts` and in `evidence.schema.json`. A sign or verify
+ * that can't read the record kind fails with the records read's own code.
+ */
+export declare const EVIDENCE_ERROR_CODES: readonly ["not-a-git-repository", "revision-unknown", "trust-policy-unreadable", "envelope-unreadable", "envelope-invalid", "envelope-untrusted", "evidence-payload-type", "evidence-statement-invalid", "evidence-runner-mismatch", "runner-key-invalid", "runner-key-is-signer", "runner-key-unlisted", "kind-unreadable", "kind-invalid", "schema-unreadable", "schema-id-mismatch", "schema-invalid", "location-missing"];
+export type EvidenceErrorCode = (typeof EVIDENCE_ERROR_CODES)[number];
+/** The statement a runner signs. Strict, so a verifier never acts on a field it does not know. */
+export declare const evidenceStatementSchema: z.ZodObject<{
+    _type: z.ZodLiteral<"https://in-toto.io/Statement/v1">;
+    subject: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        digest: z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+    predicateType: z.ZodLiteral<"https://intentius.io/chant/runner-evidence/v1">;
+    predicate: z.ZodObject<{
+        runner: z.ZodString;
+        commit: z.ZodString;
+        tree: z.ZodString;
+        check: z.ZodString;
+        claim: z.ZodOptional<z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+        environment: z.ZodOptional<z.ZodObject<{
+            sha256: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type EvidenceStatement = z.infer<typeof evidenceStatementSchema>;
+/** SHA-256 of a record's text, line endings normalised as seals do (#2524 D4). */
+export declare function recordHash(text: string): string;
+export interface EvidenceInput {
+    repo: string;
+    /** The full commit id the check ran at. Records are hashed as committed there. */
+    commit: string;
+    paths: string[];
+    runner: string;
+    check: string;
+    claim?: Buffer;
+    environment?: Buffer;
+}
+export declare function buildStatement(input: EvidenceInput): EvidenceStatement;
+export declare function signEvidence(statement: EvidenceStatement, key: KeyObject, publicKey: string): DsseEnvelope;
+export interface SubjectVerdict {
+    name: string;
+    signed: string;
+    /** The hash at the revision checked, or null when the record is not there. */
+    now: string | null;
+    matches: boolean;
+}
+export type EvidenceVerdict = {
+    ok: true;
+    /** `current` when every subject still hashes the same at the revision checked; otherwise `stale`. */
+    status: "current" | "stale";
+    runner: string;
+    class: RunnerKey["class"];
+    keyid: string;
+    statement: EvidenceStatement;
+    subjects: SubjectVerdict[];
+} | {
+    ok: false;
+    code: EvidenceErrorCode;
+    reason: string;
+};
+/**
+ * Verify an envelope against the runner keys at base, then compare each
+ * subject with the record as committed at `at`.
+ */
+export declare function verifyEvidence(envelope: unknown, runners: readonly RunnerKey[], repo: string, at: string): EvidenceVerdict;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/workspace/trust/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAsD,KAAK,YAAY,EAAE,MAAM,QAAQ,CAAC;AAC/F,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,eAAO,MAAM,cAAc,oCAAoC,CAAC;AAChE,eAAO,MAAM,yBAAyB,kDAAkD,CAAC;AAEzF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,+ZAmBS,CAAC;AAC3C,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAKtE,kGAAkG;AAClG,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;kBA2BzB,CAAC;AACZ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C;AAkBD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,iBAAiB,CAmBtE;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAE1G;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,MAAM,eAAe,GACvB;IACE,EAAE,EAAE,IAAI,CAAC;IACT,qGAAqG;IACrG,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,iBAAiB,CAAC;IAC7B,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B,GACD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,eAAe,CAmC1H"}

package/dist/workspace/trust/policy.d.ts

@@ -72,10 +72,33 @@ export declare const trustConfigSchema: z.ZodObject<{
         to: z.ZodString;
         note: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    runners: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        principal: z.ZodString;
+        class: z.ZodEnum<{
+            runner: "runner";
+            service: "service";
+        }>;
+        key: z.ZodString;
+    }, z.core.$strict>>>;
+    admitted: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        return: z.ZodString;
+        signers: z.ZodArray<z.ZodObject<{
+            principal: z.ZodString;
+            key: z.ZodString;
+        }, z.core.$strict>>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type TrustConfig = z.infer<typeof trustConfigSchema>;
 /** The role whose holders may change the policy. Without any grant of it, every signer may. */
 export declare const ADMIN_ROLE = "admin";
+/** A key that signs runner evidence: a service or CI identity. */
+export interface RunnerKey {
+    principal: string;
+    class: "runner" | "service";
+    /** `ssh-ed25519 <base64>`. */
+    key: string;
+}
 /** The policy a check applies, as read at base. */
 export interface TrustPolicy {
     /** The full commit id the policy was read at, or null when there is no base. */
@@ -91,10 +114,34 @@ export interface TrustPolicy {
         from?: string;
         to: string;
     }>;
+    /** Runner and service keys that may sign runner evidence (#2553). */
+    runners: RunnerKey[];
+    /** Runner entries that are not used, and why. */
+    excludedRunners: Array<{
+        principal: string;
+        reason: string;
+    }>;
+    /** Signers admitted per return (#2552), keyed by return id. They verify that return's commits and seals only. */
+    admitted: Record<string, Signer[]>;
+    /**
+     * Set on a copy of the policy used for one returned record (#2552): the
+     * return it came back in. A seal by a principal the policy does not list
+     * then reads as unverifiable rather than unlisted, until an admin admits
+     * the signer. Never set on the policy read at base.
+     */
+    returnedFrom?: string;
     /** Why the policy could not be read, when it could not. Nothing verifies then. */
     problems: string[];
+    /**
+     * The signer set in effect at a commit's position in the base's history
+     * (#2553). Absent, every commit is judged by `signers`.
+     */
+    signersAt?: (commit: string) => {
+        version: number;
+        signers: Signer[];
+    } | null;
 }
-/** Paths whose change is a protected write under `policy`. */
+/** Paths whose change is a protected write under `policy`: the config, the signers file and its rotation file (#2553). */
 export declare function protectedPaths(policy: TrustPolicy): string[];
 /** Principals allowed to change the policy: the admins when any are granted, otherwise every signer. */
 export declare function policyWriters(policy: TrustPolicy): Set<string>;
@@ -106,6 +153,12 @@ export declare function emptyPolicy(base: string | null, problems?: string[]): T
  * its problems listed, so nothing is attested (fail closed).
  */
 export declare function readTrustPolicy(source: RecordSource, base: string | null): TrustPolicy;
+/**
+ * The policy for work that came back in return `id` (#2552): the signers at
+ * base plus the ones admitted for that return, marked with the return so a
+ * seal by an unknown signer reads as unverifiable.
+ */
+export declare function returnedPolicy(policy: TrustPolicy, id: string): TrustPolicy;
 /** A file's text through `source`, or undefined when it is not there. */
 export declare function readOptional(source: RecordSource, path: string): string | undefined;
 //# sourceMappingURL=policy.d.ts.map

package/dist/workspace/trust/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AAcD,eAAO,MAAM,iBAAiB;;;;;;;;;kBAiBnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8DAA8D;AAC9D,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAE5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CA8BtF;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,0GAA0G;AAC1G,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAe7D,uEAAuE;AACvE,MAAM,WAAW,MAAM;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;CAC5B;AAmDD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAkD3D;AAED,8FAA8F;AAC9F,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAM9D;AAcD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;kBA4DnB,CAAC;AAEZ,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+FAA+F;AAC/F,eAAO,MAAM,UAAU,UAAU,CAAC;AAElC,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,8BAA8B;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAChC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9C,qEAAqE;IACrE,OAAO,EAAE,SAAS,EAAE,CAAC;IACrB,iDAAiD;IACjD,eAAe,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,iHAAiH;IACjH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC/E;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAG5D;AAED,wGAAwG;AACxG,wBAAgB,aAAa,CAAC,MAAM,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAI9D;AAED,oDAAoD;AACpD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,GAAE,MAAM,EAAO,GAAG,WAAW,CAErF;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAiDtF;AAWD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,GAAG,WAAW,CAE3E;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKnF"}

package/dist/workspace/trust/provenance.d.ts

@@ -21,6 +21,16 @@ export interface RecordProvenance {
     principal?: string;
     key?: string;
     reason: string;
+    /**
+     * Set when the content came back in a return (#2552): the return's id, the
+     * commit in the returned copy that the level judges, and the commit here
+     * that holds the content. `commit` above is that commit here.
+     */
+    returned?: {
+        id: string;
+        commit?: string;
+        importedIn: string | null;
+    };
 }
 /** Where the base revision came from. */
 export type BaseSource = "flag" | "origin/HEAD" | "main" | "master";
@@ -36,7 +46,11 @@ export interface ResolvedBase {
  * `HEAD`, which is the change under review.
  */
 export declare function resolveBase(repo: string, explicit?: string): ResolvedBase;
-/** The policy at `base`, or an inactive one when there is no base. */
+/**
+ * The policy at `base`, or an inactive one when there is no base. With a
+ * signers file, its history is verified too (#2553): every version must be
+ * signed by a threshold of the one before, or nothing verifies.
+ */
 export declare function policyAtBase(repo: string, base: ResolvedBase): TrustPolicy;
 /**
  * The last commit reachable from `rev` that changed each path. Merges are
@@ -58,6 +72,12 @@ export interface ProvenanceQuery {
     at: string | null;
     paths: string[];
     attestors: readonly CommitAttestor[];
+    /**
+     * A second look at each committed path, given the provenance of the commit
+     * that holds it here. Returned work (#2552) uses it to judge the commit the
+     * content was made in, which a return carries. Undefined keeps the answer.
+     */
+    revisit?: (path: string, host: RecordProvenance) => RecordProvenance | undefined;
 }
 /**
  * The provenance of each path. With attestation off (no signers file at

package/dist/workspace/trust/provenance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAE1E,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAczE;AAED,sEAAsE;AACtE,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAG1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3F;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYrE;AAWD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,gBAAgB,CAa1I;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAyBlF"}
+{"version":3,"file":"provenance.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/provenance.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG1E,6CAA6C;AAC7C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,eAAe,CAAC;IACvB,mFAAmF;IACnF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CACvE;AAED,yCAAyC;AACzC,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,aAAa,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEpE,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;IACxB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAcD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAczE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,WAAW,CAW1E;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3F;AAED,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAYrE;AAWD,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAEpF;AAED,kDAAkD;AAClD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,gBAAgB,CAwB1I;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,MAAM,EAAE,WAAW,CAAC;IACpB,qEAAqE;IACrE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,SAAS,cAAc,EAAE,CAAC;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAClF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CA0BlF"}

package/dist/workspace/trust/rotation.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Signer rotation, verified from history (#2553, #2524 D5, ws-001).
+ *
+ * A signer set is the signers file plus a threshold. A new set is valid only
+ * when a threshold of the previous set signed it, as in TUF's root rotation.
+ * The signatures live beside the signers file, in `<signers>.rotation.json`:
+ *
+ * ```json
+ * { "schema": 1, "version": 2, "previous": "sha256:…", "threshold": 1,
+ *   "signatures": [{ "principal": "alice@example.com", "signature": "-----BEGIN SSH SIGNATURE-----…" }] }
+ * ```
+ *
+ * Each signature is `ssh-keygen -Y sign -n chant-signers` over the statement
+ * {@link rotationStatement} returns: the new version, the digest of the
+ * previous signers file, the digest of the new one and the new threshold. The
+ * version number and the previous digest together stop an old, once-valid set
+ * from being replayed, and the namespace stops a commit signature from
+ * standing in for a rotation signature.
+ *
+ * ## Revocation by position
+ *
+ * Dates prove nothing: whoever makes a commit sets its date. So a commit is
+ * judged by where it sits in the base's history. Walking the base's
+ * first-parent line from the oldest commit, each commit that changes the
+ * signer set starts a version, and each version must be signed by a threshold
+ * of the one before. A commit already in the base's history is judged by the
+ * version in effect just before the first-parent commit that brought it in. A
+ * key removed at version N therefore still vouches for what was merged before
+ * N, and for nothing merged after, however the later commit is dated. A commit
+ * not yet in the base's history is judged by the latest version.
+ */
+import { z } from "zod";
+import { type ExcludedSigner, type Signer } from "./policy.js";
+/** Why a signer set is not a valid next version (#2553). Each is in `reason-codes.ts` and in `signers.schema.json`. */
+export declare const ROTATION_REFUSAL_CODES: readonly ["signers-removed", "rotation-unparseable", "rotation-invalid", "rotation-first-version", "rotation-missing", "rotation-version-skew", "rotation-previous-mismatch", "rotation-threshold-unsatisfiable", "rotation-threshold-not-met"];
+export type RotationRefusalCode = (typeof ROTATION_REFUSAL_CODES)[number];
+/** A refused version: the code and a sentence for people. */
+export interface RotationRefusal {
+    code: RotationRefusalCode;
+    reason: string;
+}
+/** The ssh-keygen namespace rotation signatures are made in. Never `git`. */
+export declare const ROTATION_NAMESPACE = "chant-signers";
+/** The rotation file for a signers file. */
+export declare function rotationPath(signersPath: string): string;
+/** `sha256:<hex>` of a signers file's bytes, line endings normalised. */
+export declare function signersDigest(text: string): string;
+export declare const rotationFileSchema: z.ZodObject<{
+    schema: z.ZodLiteral<1>;
+    version: z.ZodNumber;
+    previous: z.ZodNullable<z.ZodString>;
+    threshold: z.ZodNumber;
+    signatures: z.ZodArray<z.ZodObject<{
+        principal: z.ZodString;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type RotationFile = z.infer<typeof rotationFileSchema>;
+/** The bytes each rotation signature covers. */
+export declare function rotationStatement(r: {
+    version: number;
+    previous: string | null;
+    threshold: number;
+}, signers: string): Buffer;
+/** One version of the signer set, as history established it. */
+export interface SignerVersion {
+    /** 1 and up; 0 marks where the signers file was removed and nothing was in effect. */
+    version: number;
+    /** The first-parent commit that made this version, or null for a set not yet merged. */
+    commit: string | null;
+    digest: string;
+    threshold: number;
+    signers: Signer[];
+    excluded: ExcludedSigner[];
+    /** The principals whose signatures made this version valid; empty for the first version. */
+    signedBy: string[];
+}
+export interface SignerHistory {
+    versions: SignerVersion[];
+    /** Where the chain broke, when it did. Nothing verifies then. */
+    broken?: {
+        commit: string | null;
+    } & RotationRefusal;
+}
+/** The state of the signer files at one point, as text. */
+export interface SignerFiles {
+    signers?: string;
+    rotation?: string;
+}
+/**
+ * Check `next` against the version before it. Returns the new version, or
+ * the reason it is not valid. `prev` undefined means there was no signer set,
+ * so `next` is a first version and needs no signatures.
+ */
+export declare function nextVersion(prev: SignerVersion | undefined, next: SignerFiles, commit: string | null): SignerVersion | RotationRefusal;
+/**
+ * How many signers could each give a counted signature: principals and keys
+ * are both distinct, so this is the size of a largest matching between them.
+ */
+export declare function distinctHolders(signers: readonly Signer[]): number;
+/** A file's text at `commit`, or undefined when it is not there. */
+export declare function fileAt(repo: string, commit: string, path: string): string | undefined;
+/**
+ * Walk the signer set's history along the first-parent line of `base`,
+ * oldest first. A removal ends the chain; a later signers file starts a new
+ * one, which only the protected-write check in CI could have admitted.
+ */
+export declare function signerHistory(repo: string, base: string, signersPath: string): SignerHistory;
+/**
+ * Finds the signer set in effect for a commit, by its position in the base's
+ * history. Built once per base; the first-parent line is read once and
+ * each lookup is a binary search.
+ */
+export declare class SignerPositions {
+    private readonly repo;
+    private readonly base;
+    private readonly history;
+    private line;
+    private index;
+    private memo;
+    constructor(repo: string, base: string, history: SignerHistory);
+    private isAncestor;
+    /** The base's first-parent line, newest first. */
+    private firstParents;
+    /**
+     * The version that judges `commit`, or null when no signer set was in
+     * effect there (before the first one, or the chain is broken).
+     */
+    versionFor(commit: string): SignerVersion | null;
+    private lookup;
+}
+//# sourceMappingURL=rotation.d.ts.map

package/dist/workspace/trust/rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotation.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/rotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAuB,KAAK,cAAc,EAAE,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAGjF,uHAAuH;AACvH,eAAO,MAAM,sBAAsB,iPAUO,CAAC;AAC3C,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,6DAA6D;AAC7D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD,4CAA4C;AAC5C,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;kBAQpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,gDAAgD;AAChD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAK7H;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,iEAAiE;IACjE,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,eAAe,CAAC;CACtD;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,aAAa,GAAG,eAAe,CA6DtI;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAuBlE;AAMD,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMrF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAqB5F;AAED;;;;GAIG;AACH,qBAAa,eAAe;IAMxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,IAAI,CAAuB;IACnC,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,IAAI,CAA2C;gBAGpC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,aAAa;IAGzC,OAAO,CAAC,UAAU;IASlB,kDAAkD;IAClD,OAAO,CAAC,YAAY;IAQpB;;;OAGG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI;IAQhD,OAAO,CAAC,MAAM;CA+Bf"}

package/dist/workspace/trust/seal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAuDD,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI"}
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/seal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAMH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG5C,qDAAqD;AACrD,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,qEAAqE;AACrE,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,gHAAgH;IAChH,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yCAAyC;AACzC,MAAM,WAAW,SAAS;IACxB,kKAAkK;IAClK,QAAQ,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,sCAAsC;AACtC,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAEvH;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE9G;AAED,gDAAgD;AAChD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAoBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,GAAG,SAAS,CAYjF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,GAAG,SAAS,CAgB/E;AAkED,oCAAoC;AACpC,qBAAa,SAAU,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,IAAI,CAAA;CAAE,CAuBzG;AAMD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAE9I;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,WAAW,CAEpI"}

package/dist/workspace/trust/signers-cli.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `chant workspace signers [rotate [--threshold <n>] | sign --key <file>]`
+ * (#2553): show the signer history, and propose a new signer set.
+ *
+ * Rotating is three steps: edit the signers file, run `rotate` to write the
+ * rotation file for the next version, and have a threshold of the current
+ * signers each run `sign` with their own key. `chant workspace verify` then
+ * checks the result against the set at base.
+ */
+import type { CommandContext } from "../../cli/registry.js";
+import { type RotationRefusalCode, type SignerHistory } from "./rotation.js";
+export declare const SIGNERS_CONTRACT_VERSION = 1;
+export declare const SIGNERS_OUTPUT_SCHEMA_ID = "https://intentius.io/chant/schemas/workspace/signers/v1/signers.schema.json";
+/** Why `chant workspace signers` prints no history. Each is in `reason-codes.ts` and `signers.schema.json`. */
+export declare const SIGNERS_ERROR_CODES: readonly ["not-a-git-repository", "revision-unknown", "signers-file-missing"];
+export type SignersErrorCode = (typeof SIGNERS_ERROR_CODES)[number];
+/** What `chant workspace signers --json` prints. */
+export type SignersDocument = {
+    $schema: string;
+    contract: number;
+    chant: string;
+    base: string;
+    signersPath: string;
+    versions: Array<{
+        version: number;
+        commit: string | null;
+        digest: string | null;
+        threshold: number;
+        principals: string[];
+        signedBy: string[];
+    }>;
+    broken: {
+        commit: string | null;
+        code: RotationRefusalCode;
+        message: string;
+    } | null;
+} | {
+    $schema: string;
+    contract: number;
+    chant: string;
+    error: {
+        code: SignersErrorCode;
+        message: string;
+    };
+};
+/** The signer history at `base` as the `--json` document. */
+export declare function signersDocument(repo: string, base: string, signersPath: string, history: SignerHistory): SignersDocument;
+export declare function runWorkspaceSigners(ctx: CommandContext): Promise<number>;
+//# sourceMappingURL=signers-cli.d.ts.map

package/dist/workspace/trust/signers-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signers-cli.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/signers-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOzD,OAAO,EASL,KAAK,mBAAmB,EACxB,KAAK,aAAa,EACnB,MAAM,YAAY,CAAC;AAKpB,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,wBAAwB,gFAAgF,CAAC;AAEtH,+GAA+G;AAC/G,eAAO,MAAM,mBAAmB,+EAAgH,CAAC;AACjJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,oDAAoD;AACpD,MAAM,MAAM,eAAe,GACvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAChJ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,EAAE,mBAAmB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CACtF,GACD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE;QAAE,IAAI,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAM7G,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,eAAe,CAexH;AAOD,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA6F9E"}

package/dist/workspace/trust/ssh-commit.d.ts

@@ -47,4 +47,16 @@ export declare function verifySshSignature(signers: Signer[], payload: Buffer, s
     reason: string;
 };
 export declare const sshCommitAttestor: CommitAttestor;
+/**
+ * The public key inside an armored ssh signature (the SSHSIG format), as
+ * `<type> <base64>`, or undefined when the text is not one. The key is what
+ * made the signature; whether anyone trusts it is a separate question.
+ */
+export declare function sshSignatureKey(signature: string): string | undefined;
+/**
+ * Whether an ssh signature over `payload` in `namespace` is intact, whoever
+ * made it (`ssh-keygen -Y check-novalidate`). Returns the key's fingerprint,
+ * false when it does not check, or null when ssh-keygen is not installed.
+ */
+export declare function sshSignatureIntact(payload: Buffer, signature: string, namespace: string): string | false | null;
 //# sourceMappingURL=ssh-commit.d.ts.map

package/dist/workspace/trust/ssh-commit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAUD,6GAA6G;AAC7G,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAIrI;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAW/B,CAAC"}
+{"version":3,"file":"ssh-commit.d.ts","sourceRoot":"","sources":["../../../src/workspace/trust/ssh-commit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAsC,cAAc,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAwB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAI7D,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAW,GAAG,YAAY,CAsB9E;AAUD,6GAA6G;AAC7G,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAIrI;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuBjG;AAED,eAAO,MAAM,iBAAiB,EAAE,cAiB/B,CAAC;AAeF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAmBrE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAY/G"}