pray-cli 1.6.0

package/dist/tree/index.js

@@ -0,0 +1,40 @@
+export function renderDependencyTree(project) {
+    const packageMap = new Map(project.packages.map((packageEntry) => [
+        packageEntry.declaration.name,
+        packageEntry,
+    ]));
+    const lines = ["Dependency tree"];
+    for (const packageEntry of project.packages) {
+        renderTreeNode(packageEntry, packageMap, 0, new Set(), lines);
+    }
+    return lines;
+}
+function renderTreeNode(packageEntry, packageMap, depth, ancestry, lines) {
+    const indent = "  ".repeat(depth);
+    lines.push(`${indent}${packageEntry.declaration.name} ${packageEntry.spec.version}`);
+    if (ancestry.has(packageEntry.declaration.name)) {
+        lines.push(`${indent}  (cycle)`);
+        return;
+    }
+    ancestry.add(packageEntry.declaration.name);
+    for (const dependency of packageEntry.spec.dependencies) {
+        const resolved = packageMap.get(dependency.name);
+        if (resolved) {
+            renderTreeNode(resolved, packageMap, depth + 1, ancestry, lines);
+        }
+        else {
+            lines.push(`${indent}  ${dependency.name} (unresolved)`);
+        }
+    }
+    ancestry.delete(packageEntry.declaration.name);
+}
+export function packageSourceSummary(packageEntry) {
+    if (packageEntry.declaration.path) {
+        return `path:${packageEntry.declaration.path}`;
+    }
+    if (packageEntry.declaration.source) {
+        return packageEntry.declaration.source;
+    }
+    return "default";
+}
+//# sourceMappingURL=index.js.map

package/dist/tree/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tree/index.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,oBAAoB,CAAC,OAAwB;IAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC;QACrC,YAAY,CAAC,WAAW,CAAC,IAAI;QAC7B,YAAY;KACb,CAAC,CACH,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAClC,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC5C,cAAc,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CACrB,YAA6B,EAC7B,UAAwC,EACxC,KAAa,EACb,QAAqB,EACrB,KAAe;IAEf,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,CACzE,CAAC;IACF,IAAI,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,WAAW,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,QAAQ,EAAE,CAAC;YACb,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,KAAK,UAAU,CAAC,IAAI,eAAe,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,YAA6B;IAChE,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAClC,OAAO,QAAQ,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,YAAY,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC;IACzC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/trust/import-registry.d.ts

@@ -0,0 +1,6 @@
+export interface ImportRegistryResult {
+    publishersAdded: number;
+    hostKeysAdded: number;
+}
+export declare function importRegistryTrust(sourceUrl: string, matchPrefix: string | undefined, includeHostKey: boolean): Promise<ImportRegistryResult>;
+//# sourceMappingURL=import-registry.d.ts.map

package/dist/trust/import-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-registry.d.ts","sourceRoot":"","sources":["../../src/trust/import-registry.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAMD,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,cAAc,EAAE,OAAO,GACtB,OAAO,CAAC,oBAAoB,CAAC,CAmC/B"}

package/dist/trust/import-registry.js

@@ -0,0 +1,65 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { PrayError } from "../errors.js";
+import { httpGet, joinUrl } from "../http/client.js";
+import { appendMissingKeys, mutableRuleForMatchPrefix, normalizeKey, } from "./policy-helpers.js";
+import { loadTrustPolicy, saveTrustPolicy } from "./store.js";
+export async function importRegistryTrust(sourceUrl, matchPrefix, includeHostKey) {
+    const prefix = matchPrefix ?? sourceUrl;
+    const config = await fetchSshPublishers(sourceUrl);
+    if (!config) {
+        throw PrayError.unsupported(`no v1/ssh_publishers.json found for ${sourceUrl}`);
+    }
+    const publisherFingerprints = (config.publishers ?? [])
+        .map((entry) => normalizeKey(entry.fingerprint ?? ""))
+        .filter((fingerprint) => fingerprint.length > 0);
+    if (publisherFingerprints.length === 0) {
+        throw PrayError.unsupported(`v1/ssh_publishers.json for ${sourceUrl} lists no publisher fingerprints`);
+    }
+    if (includeHostKey &&
+        (sourceUrl.startsWith("pray+ssh://") || sourceUrl.startsWith("ssh+pray://"))) {
+        throw PrayError.unsupported("host-key import for pray+ssh:// is not implemented yet in pray-cli typescript");
+    }
+    const policy = loadTrustPolicy();
+    const rule = mutableRuleForMatchPrefix(policy, prefix);
+    const publishers = appendMissingKeys(rule.allowed_publishers, publisherFingerprints);
+    rule.allowed_publishers = publishers.list;
+    saveTrustPolicy(policy);
+    return { publishersAdded: publishers.added, hostKeysAdded: 0 };
+}
+async function fetchSshPublishers(sourceUrl) {
+    const localRoot = localDistributionRoot(sourceUrl);
+    if (localRoot) {
+        const path = join(localRoot, "v1", "ssh_publishers.json");
+        if (!existsSync(path)) {
+            return undefined;
+        }
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    if (sourceUrl.startsWith("pray+ssh://") ||
+        sourceUrl.startsWith("ssh+pray://")) {
+        throw PrayError.unsupported("pray+ssh:// registry import is not implemented yet in pray-cli typescript");
+    }
+    if (sourceUrl.startsWith("http://") || sourceUrl.startsWith("https://")) {
+        try {
+            const bytes = await httpGet(joinUrl(sourceUrl, "v1/ssh_publishers.json"));
+            return JSON.parse(bytes.toString("utf8"));
+        }
+        catch (error) {
+            if (error instanceof PrayError &&
+                error.kind === "resolution" &&
+                error.message.includes("404")) {
+                return undefined;
+            }
+            throw error;
+        }
+    }
+    throw PrayError.unsupported(`unsupported registry source for import: ${sourceUrl}`);
+}
+function localDistributionRoot(sourceUrl) {
+    const path = sourceUrl.startsWith("file://")
+        ? sourceUrl.slice("file://".length)
+        : sourceUrl;
+    return existsSync(path) ? path : undefined;
+}
+//# sourceMappingURL=import-registry.js.map

package/dist/trust/import-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-registry.js","sourceRoot":"","sources":["../../src/trust/import-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAW9D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,SAAiB,EACjB,WAA+B,EAC/B,cAAuB;IAEvB,MAAM,MAAM,GAAG,WAAW,IAAI,SAAS,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,CAAC,WAAW,CACzB,uCAAuC,SAAS,EAAE,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;SACpD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnD,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,SAAS,CAAC,WAAW,CACzB,8BAA8B,SAAS,kCAAkC,CAC1E,CAAC;IACJ,CAAC;IAED,IACE,cAAc;QACd,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,EAC5E,CAAC;QACD,MAAM,SAAS,CAAC,WAAW,CACzB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,iBAAiB,CAClC,IAAI,CAAC,kBAAkB,EACvB,qBAAqB,CACtB,CAAC;IACF,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,IAAI,CAAC;IAC1C,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,EAAE,eAAe,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,SAAiB;IAEjB,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;IACvE,CAAC;IACD,IACE,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC;QACnC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EACnC,CAAC;QACD,MAAM,SAAS,CAAC,WAAW,CACzB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;QACnE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IACE,KAAK,YAAY,SAAS;gBAC1B,KAAK,CAAC,IAAI,KAAK,YAAY;gBAC3B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC7B,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC,WAAW,CACzB,2CAA2C,SAAS,EAAE,CACvD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;QAC1C,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;QACnC,CAAC,CAAC,SAAS,CAAC;IACd,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC"}

package/dist/trust/import-repo.d.ts

@@ -0,0 +1,2 @@
+export declare function importSigningKeysFromRepository(projectRoot: string, sourceUrl: string, matchPrefix: string | undefined): number;
+//# sourceMappingURL=import-repo.d.ts.map

package/dist/trust/import-repo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-repo.d.ts","sourceRoot":"","sources":["../../src/trust/import-repo.ts"],"names":[],"mappings":"AAYA,wBAAgB,+BAA+B,CAC7C,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,MAAM,CAoBR"}

package/dist/trust/import-repo.js

@@ -0,0 +1,50 @@
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { PrayError } from "../errors.js";
+import { gitSourceCacheDirectory } from "../git/sources.js";
+import { appendMissingKeys, mutableRuleForMatchPrefix, normalizeKey, } from "./policy-helpers.js";
+import { loadTrustPolicy, saveTrustPolicy } from "./store.js";
+export function importSigningKeysFromRepository(projectRoot, sourceUrl, matchPrefix) {
+    const cloneUrl = sourceUrl.replace(/^git\+/, "");
+    const repository = gitSourceCacheDirectory(projectRoot, cloneUrl);
+    if (!existsSync(join(repository, ".git"))) {
+        throw PrayError.resolution(`no cached git repository for ${cloneUrl} at ${repository}`);
+    }
+    const keys = repositorySigningKeys(repository);
+    if (keys.length === 0) {
+        throw PrayError.unsupported(`no commit signing key/fingerprint found for HEAD in ${repository}`);
+    }
+    const policy = loadTrustPolicy();
+    const rule = mutableRuleForMatchPrefix(policy, matchPrefix ?? cloneUrl);
+    const result = appendMissingKeys(rule.allowed_signing_keys, keys);
+    rule.allowed_signing_keys = result.list;
+    saveTrustPolicy(policy);
+    return result.added;
+}
+function repositorySigningKeys(repository) {
+    const keys = [];
+    for (const format of ["%GK", "%GF"]) {
+        const value = gitLogFormat(repository, format);
+        if (!value) {
+            continue;
+        }
+        const normalized = normalizeKey(value);
+        if (!keys.includes(normalized)) {
+            keys.push(normalized);
+        }
+    }
+    return keys;
+}
+function gitLogFormat(repository, format) {
+    const result = spawnSync("git", ["log", "-1", `--format=${format}`], {
+        cwd: repository,
+        encoding: "utf8",
+    });
+    if (result.status !== 0) {
+        return undefined;
+    }
+    const value = (result.stdout ?? "").trim();
+    return value.length > 0 ? value : undefined;
+}
+//# sourceMappingURL=import-repo.js.map

package/dist/trust/import-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-repo.js","sourceRoot":"","sources":["../../src/trust/import-repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,YAAY,GACb,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9D,MAAM,UAAU,+BAA+B,CAC7C,WAAmB,EACnB,SAAiB,EACjB,WAA+B;IAE/B,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,SAAS,CAAC,UAAU,CACxB,gCAAgC,QAAQ,OAAO,UAAU,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,SAAS,CAAC,WAAW,CACzB,uDAAuD,UAAU,EAAE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,yBAAyB,CAAC,MAAM,EAAE,WAAW,IAAI,QAAQ,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IAClE,IAAI,CAAC,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC;IACxC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,SAAS,qBAAqB,CAAC,UAAkB;IAC/C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAU,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,MAAc;IACtD,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,MAAM,EAAE,CAAC,EAAE;QACnE,GAAG,EAAE,UAAU;QACf,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC"}

package/dist/trust/index.d.ts

@@ -0,0 +1,11 @@
+import { defaultTrustPolicy, loadTrustPolicy, saveTrustPolicy, trustHome, trustPolicyPath } from "./store.js";
+export type { TrustPolicy, TrustRule } from "./types.js";
+export { defaultTrustPolicy, loadTrustPolicy, saveTrustPolicy, trustHome, trustPolicyPath, };
+export declare function listTrustPolicy(): string;
+export declare function addSigningKey(fingerprint: string): void;
+export declare function removeSigningKey(fingerprint: string): void;
+export declare function setRequireSignedCommit(required: boolean): void;
+export declare function setDefaultAllow(allow: boolean): void;
+export declare function checkTrustPolicy(): string;
+export declare function runTrustCommand(argumentsList: string[], projectRoot: string): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/trust/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,SAAS,EACT,eAAe,EAChB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,SAAS,EACT,eAAe,GAChB,CAAC;AAEF,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAMvD;AAED,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAY1D;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,CAI9D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAIpD;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EAAE,EACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAqEf"}

package/dist/trust/index.js

@@ -0,0 +1,148 @@
+import { stringify } from "smol-toml";
+import { PrayError } from "../errors.js";
+import { gitSourceCacheDirectory } from "../git/sources.js";
+import { importRegistryTrust } from "./import-registry.js";
+import { importSigningKeysFromRepository } from "./import-repo.js";
+import { defaultTrustPolicy, loadTrustPolicy, saveTrustPolicy, trustHome, trustPolicyPath, } from "./store.js";
+export { defaultTrustPolicy, loadTrustPolicy, saveTrustPolicy, trustHome, trustPolicyPath, };
+export function listTrustPolicy() {
+    return stringify(loadTrustPolicy());
+}
+export function addSigningKey(fingerprint) {
+    const policy = loadTrustPolicy();
+    const keys = new Set(policy.default.allowed_signing_keys ?? []);
+    keys.add(fingerprint);
+    policy.default.allowed_signing_keys = [...keys].sort();
+    saveTrustPolicy(policy);
+}
+export function removeSigningKey(fingerprint) {
+    const policy = loadTrustPolicy();
+    policy.default.allowed_signing_keys = (policy.default.allowed_signing_keys ?? []).filter((key) => key !== fingerprint);
+    policy.rules = policy.rules.map((rule) => ({
+        ...rule,
+        allowed_signing_keys: rule.allowed_signing_keys?.filter((key) => key !== fingerprint),
+    }));
+    saveTrustPolicy(policy);
+}
+export function setRequireSignedCommit(required) {
+    const policy = loadTrustPolicy();
+    policy.default.require_signed_commit = required;
+    saveTrustPolicy(policy);
+}
+export function setDefaultAllow(allow) {
+    const policy = loadTrustPolicy();
+    policy.default.allow = allow;
+    saveTrustPolicy(policy);
+}
+export function checkTrustPolicy() {
+    return "trust check: no compromised key feed configured";
+}
+export async function runTrustCommand(argumentsList, projectRoot) {
+    const [subcommand, ...rest] = argumentsList;
+    switch (subcommand) {
+        case "list":
+            process.stdout.write(`${listTrustPolicy()}\n`);
+            return;
+        case "show":
+            process.stdout.write(`${listTrustPolicy()}\n`);
+            return;
+        case "add-key": {
+            const fingerprint = rest[0];
+            if (!fingerprint) {
+                throw PrayError.unsupported("trust add-key requires a fingerprint");
+            }
+            addSigningKey(fingerprint);
+            return;
+        }
+        case "remove-key":
+        case "revoke": {
+            const fingerprint = rest[0];
+            if (!fingerprint) {
+                throw PrayError.unsupported("trust remove-key requires a fingerprint");
+            }
+            removeSigningKey(fingerprint);
+            return;
+        }
+        case "set-signed": {
+            const value = rest[0];
+            setRequireSignedCommit(value === "true" || value === "1");
+            return;
+        }
+        case "set-allow": {
+            const value = rest[0];
+            setDefaultAllow(value !== "false" && value !== "0");
+            return;
+        }
+        case "check":
+            process.stdout.write(`${checkTrustPolicy()}\n`);
+            return;
+        case "import-repo": {
+            const { sourceUrl, matchPrefix } = parseImportRepoArguments(rest);
+            const added = importSigningKeysFromRepository(projectRoot, sourceUrl, matchPrefix);
+            const cloneUrl = sourceUrl.replace(/^git\+/, "");
+            process.stdout.write(`imported ${added} key(s) from ${gitSourceCacheDirectory(projectRoot, cloneUrl)}\n`);
+            return;
+        }
+        case "import-registry": {
+            const options = parseImportRegistryArguments(rest);
+            const result = await importRegistryTrust(options.sourceUrl, options.matchPrefix, options.includeHostKey);
+            process.stdout.write(`imported ${result.publishersAdded} publisher fingerprint(s) and ${result.hostKeysAdded} host key(s) for ${options.matchPrefix ?? options.sourceUrl}\n`);
+            return;
+        }
+        default:
+            throw PrayError.unsupported(`unknown trust subcommand: ${subcommand ?? "(none)"}`);
+    }
+}
+function parseImportRepoArguments(argumentsList) {
+    const sourceUrl = argumentsList[0];
+    if (!sourceUrl) {
+        throw PrayError.unsupported("trust import-repo requires SOURCE_URL");
+    }
+    let matchPrefix;
+    for (let index = 1; index < argumentsList.length; index += 1) {
+        const argument = argumentsList[index];
+        if (argument === "--match-prefix") {
+            const value = argumentsList[index + 1];
+            if (!value) {
+                throw PrayError.unsupported("--match-prefix requires VALUE");
+            }
+            matchPrefix = value;
+            index += 1;
+            continue;
+        }
+        throw PrayError.unsupported(`unknown trust import-repo argument: ${argument}`);
+    }
+    return { sourceUrl, matchPrefix };
+}
+function parseImportRegistryArguments(argumentsList) {
+    const sourceUrl = argumentsList[0];
+    if (!sourceUrl) {
+        throw PrayError.unsupported("trust import-registry requires SOURCE_URL");
+    }
+    let matchPrefix;
+    let includeHostKey = sourceUrl.startsWith("pray+ssh://") || sourceUrl.startsWith("ssh+pray://");
+    for (let index = 1; index < argumentsList.length; index += 1) {
+        const argument = argumentsList[index];
+        switch (argument) {
+            case "--match-prefix": {
+                const value = argumentsList[index + 1];
+                if (!value) {
+                    throw PrayError.unsupported("--match-prefix requires VALUE");
+                }
+                matchPrefix = value;
+                index += 1;
+                break;
+            }
+            case "--host-key":
+                includeHostKey = true;
+                break;
+            case "--no-host-key":
+                includeHostKey = false;
+                break;
+            default:
+                throw PrayError.unsupported(`unknown trust import-registry argument: ${argument}`);
+        }
+    }
+    return { sourceUrl, matchPrefix, includeHostKey };
+}
+//# sourceMappingURL=index.js.map

package/dist/trust/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,+BAA+B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,SAAS,EACT,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,eAAe,EACf,SAAS,EACT,eAAe,GAChB,CAAC;AAEF,MAAM,UAAU,eAAe;IAC7B,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,WAAmB;IAC/C,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtB,MAAM,CAAC,OAAO,CAAC,oBAAoB,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,eAAe,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,CAAC,OAAO,CAAC,oBAAoB,GAAG,CACpC,MAAM,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAC1C,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACzC,GAAG,IAAI;QACP,oBAAoB,EAAE,IAAI,CAAC,oBAAoB,EAAE,MAAM,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,CAC7B;KACF,CAAC,CAAC,CAAC;IACJ,eAAe,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAiB;IACtD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,CAAC,OAAO,CAAC,qBAAqB,GAAG,QAAQ,CAAC;IAChD,eAAe,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,MAAM,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;IAC7B,eAAe,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,iDAAiD,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAuB,EACvB,WAAmB;IAEnB,MAAM,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC;IAC5C,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,EAAE,IAAI,CAAC,CAAC;YAC/C,OAAO;QACT,KAAK,MAAM;YACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,EAAE,IAAI,CAAC,CAAC;YAC/C,OAAO;QACT,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,CAAC,WAAW,CAAC,sCAAsC,CAAC,CAAC;YACtE,CAAC;YACD,aAAa,CAAC,WAAW,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,KAAK,YAAY,CAAC;QAClB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,SAAS,CAAC,WAAW,CAAC,yCAAyC,CAAC,CAAC;YACzE,CAAC;YACD,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC9B,OAAO;QACT,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,sBAAsB,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,eAAe,CAAC,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,KAAK,OAAO;YACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,gBAAgB,EAAE,IAAI,CAAC,CAAC;YAChD,OAAO;QACT,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,+BAA+B,CAC3C,WAAW,EACX,SAAS,EACT,WAAW,CACZ,CAAC;YACF,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,KAAK,gBAAgB,uBAAuB,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,CACpF,CAAC;YACF,OAAO;QACT,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACvB,MAAM,OAAO,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CACtC,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,cAAc,CACvB,CAAC;YACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,MAAM,CAAC,eAAe,iCAAiC,MAAM,CAAC,aAAa,oBAAoB,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,SAAS,IAAI,CACxJ,CAAC;YACF,OAAO;QACT,CAAC;QACD;YACE,MAAM,SAAS,CAAC,WAAW,CACzB,6BAA6B,UAAU,IAAI,QAAQ,EAAE,CACtD,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,aAAuB;IAIvD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,WAA+B,CAAC;IACpC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAE,CAAC;QACvC,IAAI,QAAQ,KAAK,gBAAgB,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;YAC/D,CAAC;YACD,WAAW,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,SAAS,CAAC,WAAW,CACzB,uCAAuC,QAAQ,EAAE,CAClD,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,4BAA4B,CAAC,aAAuB;IAK3D,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,SAAS,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,WAA+B,CAAC;IACpC,IAAI,cAAc,GAChB,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAE,CAAC;QACvC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,gBAAgB,CAAC,CAAC,CAAC;gBACtB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;gBACvC,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,SAAS,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;gBAC/D,CAAC;gBACD,WAAW,GAAG,KAAK,CAAC;gBACpB,KAAK,IAAI,CAAC,CAAC;gBACX,MAAM;YACR,CAAC;YACD,KAAK,YAAY;gBACf,cAAc,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,eAAe;gBAClB,cAAc,GAAG,KAAK,CAAC;gBACvB,MAAM;YACR;gBACE,MAAM,SAAS,CAAC,WAAW,CACzB,2CAA2C,QAAQ,EAAE,CACtD,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AACpD,CAAC"}

package/dist/trust/parse.d.ts

@@ -0,0 +1,3 @@
+import type { TrustPolicy } from "./types.js";
+export declare function parseTrustPolicyValue(value: unknown): TrustPolicy;
+//# sourceMappingURL=parse.d.ts.map

package/dist/trust/parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/trust/parse.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAa,MAAM,YAAY,CAAC;AAIzD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,CAMjE"}

package/dist/trust/parse.js

@@ -0,0 +1,43 @@
+import { PrayError } from "../errors.js";
+import { optionalString, requireBoolean, requireRecord, requireStringArray, } from "../validation.js";
+const CONTEXT = "trust policy";
+export function parseTrustPolicyValue(value) {
+    const record = requireRecord(value, CONTEXT);
+    return {
+        default: parseTrustRule(record.default ?? {}, "default"),
+        rules: parseTrustRules(record.rules),
+    };
+}
+function parseTrustRules(value) {
+    if (value === undefined) {
+        return [];
+    }
+    if (!Array.isArray(value)) {
+        throw PrayError.parse(CONTEXT, "rules must be an array");
+    }
+    return value.map((entry, index) => parseTrustRule(entry, `rules[${index}]`));
+}
+function parseTrustRule(value, context) {
+    const record = requireRecord(value, context);
+    const rule = {};
+    if (record.match_prefix !== undefined) {
+        rule.match_prefix = optionalString(record.match_prefix, "match_prefix", context);
+    }
+    if (record.allow !== undefined) {
+        rule.allow = requireBoolean(record.allow, "allow", context);
+    }
+    if (record.require_signed_commit !== undefined) {
+        rule.require_signed_commit = requireBoolean(record.require_signed_commit, "require_signed_commit", context);
+    }
+    if (record.allowed_signing_keys !== undefined) {
+        rule.allowed_signing_keys = requireStringArray(record.allowed_signing_keys, "allowed_signing_keys", context);
+    }
+    if (record.allowed_host_keys !== undefined) {
+        rule.allowed_host_keys = requireStringArray(record.allowed_host_keys, "allowed_host_keys", context);
+    }
+    if (record.allowed_publishers !== undefined) {
+        rule.allowed_publishers = requireStringArray(record.allowed_publishers, "allowed_publishers", context);
+    }
+    return rule;
+}
+//# sourceMappingURL=parse.js.map

package/dist/trust/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../src/trust/parse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EACL,cAAc,EACd,cAAc,EACd,aAAa,EACb,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,MAAM,OAAO,GAAG,cAAc,CAAC;AAE/B,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,OAAO;QACL,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,SAAS,CAAC;QACxD,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe;IACrD,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAc,EAAE,CAAC;IAC3B,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACtC,IAAI,CAAC,YAAY,GAAG,cAAc,CAChC,MAAM,CAAC,YAAY,EACnB,cAAc,EACd,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC/C,IAAI,CAAC,qBAAqB,GAAG,cAAc,CACzC,MAAM,CAAC,qBAAqB,EAC5B,uBAAuB,EACvB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,oBAAoB,GAAG,kBAAkB,CAC5C,MAAM,CAAC,oBAAoB,EAC3B,sBAAsB,EACtB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,kBAAkB,CACzC,MAAM,CAAC,iBAAiB,EACxB,mBAAmB,EACnB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC5C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAC1C,MAAM,CAAC,kBAAkB,EACzB,oBAAoB,EACpB,OAAO,CACR,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/trust/policy-helpers.d.ts

@@ -0,0 +1,8 @@
+import type { TrustPolicy, TrustRule } from "./types.js";
+export declare function normalizeKey(value: string): string;
+export declare function mutableRuleForMatchPrefix(policy: TrustPolicy, matchPrefix: string): TrustRule;
+export declare function appendMissingKeys(target: string[] | undefined, keys: string[]): {
+    list: string[];
+    added: number;
+};
+//# sourceMappingURL=policy-helpers.d.ts.map

package/dist/trust/policy-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-helpers.d.ts","sourceRoot":"","sources":["../../src/trust/policy-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEzD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,WAAW,EACnB,WAAW,EAAE,MAAM,GAClB,SAAS,CAiBX;AAED,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,EAAE,GACb;IAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAenC"}

package/dist/trust/policy-helpers.js

@@ -0,0 +1,36 @@
+export function normalizeKey(value) {
+    return value.trim().toUpperCase();
+}
+export function mutableRuleForMatchPrefix(policy, matchPrefix) {
+    const existing = policy.rules.find((rule) => rule.match_prefix === matchPrefix);
+    if (existing) {
+        return existing;
+    }
+    const rule = {
+        match_prefix: matchPrefix,
+        allow: true,
+        require_signed_commit: false,
+        allowed_signing_keys: [],
+        allowed_host_keys: [],
+        allowed_publishers: [],
+    };
+    policy.rules.push(rule);
+    return rule;
+}
+export function appendMissingKeys(target, keys) {
+    const list = [...(target ?? [])];
+    let added = 0;
+    for (const key of keys) {
+        const normalized = normalizeKey(key);
+        if (!normalized) {
+            continue;
+        }
+        if (list.some((existing) => normalizeKey(existing) === normalized)) {
+            continue;
+        }
+        list.push(normalized);
+        added += 1;
+    }
+    return { list, added };
+}
+//# sourceMappingURL=policy-helpers.js.map

package/dist/trust/policy-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-helpers.js","sourceRoot":"","sources":["../../src/trust/policy-helpers.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAmB,EACnB,WAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,WAAW,CAC5C,CAAC;IACF,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAc;QACtB,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,IAAI;QACX,qBAAqB,EAAE,KAAK;QAC5B,oBAAoB,EAAE,EAAE;QACxB,iBAAiB,EAAE,EAAE;QACrB,kBAAkB,EAAE,EAAE;KACvB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAA4B,EAC5B,IAAc;IAEd,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC;YACnE,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtB,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/trust/store.d.ts

@@ -0,0 +1,7 @@
+import type { TrustPolicy } from "./types.js";
+export declare function trustHome(): string;
+export declare function trustPolicyPath(): string;
+export declare function defaultTrustPolicy(): TrustPolicy;
+export declare function loadTrustPolicy(): TrustPolicy;
+export declare function saveTrustPolicy(policy: TrustPolicy): void;
+//# sourceMappingURL=store.d.ts.map

package/dist/trust/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/trust/store.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAKhD;AAED,wBAAgB,eAAe,IAAI,WAAW,CAc7C;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAIzD"}

package/dist/trust/store.js

@@ -0,0 +1,40 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parse, stringify } from "smol-toml";
+import { PrayError } from "../errors.js";
+import { parseTrustPolicyValue } from "./parse.js";
+export function trustHome() {
+    return process.env.PRAY_HOME ?? join(homedir(), ".pray");
+}
+export function trustPolicyPath() {
+    return join(trustHome(), "trust.toml");
+}
+export function defaultTrustPolicy() {
+    return {
+        default: { allow: true },
+        rules: [],
+    };
+}
+export function loadTrustPolicy() {
+    const path = trustPolicyPath();
+    if (!existsSync(path)) {
+        return defaultTrustPolicy();
+    }
+    try {
+        return parseTrustPolicyValue(parse(readFileSync(path, "utf8")));
+    }
+    catch (error) {
+        if (error instanceof PrayError) {
+            throw error;
+        }
+        const message = error instanceof Error ? error.message : String(error);
+        throw PrayError.parse("trust policy", message);
+    }
+}
+export function saveTrustPolicy(policy) {
+    const path = trustPolicyPath();
+    mkdirSync(join(path, ".."), { recursive: true });
+    writeFileSync(path, `${stringify(policy)}\n`, "utf8");
+}
+//# sourceMappingURL=store.js.map

package/dist/trust/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/trust/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAGnD,MAAM,UAAU,SAAS;IACvB,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;QACxB,KAAK,EAAE,EAAE;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,SAAS,CAAC,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,aAAa,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACxD,CAAC"}

package/dist/trust/types.d.ts

@@ -0,0 +1,13 @@
+export interface TrustPolicy {
+    default: TrustRule;
+    rules: TrustRule[];
+}
+export interface TrustRule {
+    match_prefix?: string;
+    allow?: boolean;
+    require_signed_commit?: boolean;
+    allowed_signing_keys?: string[];
+    allowed_host_keys?: string[];
+    allowed_publishers?: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/trust/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/trust/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,EAAE,SAAS,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B"}

package/dist/trust/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/trust/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/trust/types.ts"],"names":[],"mappings":""}

package/dist/validation.d.ts

@@ -0,0 +1,8 @@
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function requireRecord(value: unknown, context: string): Record<string, unknown>;
+export declare function requireString(value: unknown, field: string, context: string): string;
+export declare function requireBoolean(value: unknown, field: string, context: string): boolean;
+export declare function requireNumber(value: unknown, field: string, context: string): number;
+export declare function requireStringArray(value: unknown, field: string, context: string): string[];
+export declare function optionalString(value: unknown, field: string, context: string): string | undefined;
+//# sourceMappingURL=validation.d.ts.map

package/dist/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAEA,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,MAAM,GACd,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAKzB;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,MAAM,CAKR;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAKT;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,MAAM,CAKR;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,MAAM,EAAE,CAOV;AAED,wBAAgB,cAAc,CAC5B,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,SAAS,CAKpB"}

package/dist/validation.js

@@ -0,0 +1,41 @@
+import { PrayError } from "./errors.js";
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function requireRecord(value, context) {
+    if (!isRecord(value)) {
+        throw PrayError.parse(context, `expected object, got ${typeof value}`);
+    }
+    return value;
+}
+export function requireString(value, field, context) {
+    if (typeof value !== "string") {
+        throw PrayError.parse(context, `${field} must be a string`);
+    }
+    return value;
+}
+export function requireBoolean(value, field, context) {
+    if (typeof value !== "boolean") {
+        throw PrayError.parse(context, `${field} must be a boolean`);
+    }
+    return value;
+}
+export function requireNumber(value, field, context) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw PrayError.parse(context, `${field} must be a number`);
+    }
+    return value;
+}
+export function requireStringArray(value, field, context) {
+    if (!Array.isArray(value)) {
+        throw PrayError.parse(context, `${field} must be an array`);
+    }
+    return value.map((entry, index) => requireString(entry, `${field}[${index}]`, context));
+}
+export function optionalString(value, field, context) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return requireString(value, field, context);
+}
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,OAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,wBAAwB,OAAO,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,KAAa,EACb,OAAe;IAEf,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,KAAa,EACb,OAAe;IAEf,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,KAAa,EACb,OAAe;IAEf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,KAAc,EACd,KAAa,EACb,OAAe;IAEf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,KAAK,mBAAmB,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAChC,aAAa,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE,OAAO,CAAC,CACpD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAc,EACd,KAAa,EACb,OAAe;IAEf,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}