feat: support workspace-managed SSH repository access

web/workspace/test/repository-access/api.test.ts

@@ -2,6 +2,7 @@ import {
   parseRepositoryAccessProjection,
   parseRepositorySshCredentials,
   parseRepositorySshHostTrusts,
+  parseRepositorySshPublicKey,
   RepositoryAccessSchemaError,
 } from "../../src/lib/workspace/api/repository-access.ts";
 
@@ -59,6 +60,22 @@ const hostTrust = {
 
 Deno.test("Repository Access parsers accept generated response contracts", () => {
   assertEquals(parseRepositorySshCredentials([credential]), [credential]);
+  assertEquals(
+    parseRepositorySshPublicKey({
+      credential_id: "deploy-key",
+      current_revision: 2,
+      public_key_algorithm: "ssh-ed25519",
+      public_key_fingerprint: "SHA256:credential",
+      public_key: "ssh-ed25519 AAAA",
+    }),
+    {
+      credential_id: "deploy-key",
+      current_revision: 2,
+      public_key_algorithm: "ssh-ed25519",
+      public_key_fingerprint: "SHA256:credential",
+      public_key: "ssh-ed25519 AAAA",
+    },
+  );
   assertEquals(parseRepositorySshHostTrusts([hostTrust]), [hostTrust]);
   assertEquals(
     parseRepositoryAccessProjection({

web/workspace/test/repository-access/ui.test.ts

@@ -28,6 +28,7 @@ test("Repository Access Web code consumes workspace-api generated DTOs", () => {
   assert(
     loaderSource.includes("parseRepositorySshCredentials") &&
       loaderSource.includes("parseRepositorySshHostTrusts") &&
+      loaderSource.includes("parseRepositorySshPublicKey") &&
       loaderSource.includes("parseRepositoryAccessProjection"),
     "loader should validate unknown JSON before exposing generated DTOs to Svelte",
   );
@@ -66,6 +67,29 @@ test("Repository Access renders the shared access projection fields", () => {
   }
 });
 
+test("Repository Access generates and copies selectable public keys", () => {
+  for (
+    const token of [
+      "/credentials/generate",
+      "/public-key",
+      "Generate Repository SSH credential",
+      "navigator.clipboard.writeText",
+      "publicKeys[credential.credential_id]",
+      "workspace-default",
+      "always offered during SSH clone",
+    ]
+  ) {
+    assert(
+      source.includes(token),
+      `missing generated public key flow ${token}`,
+    );
+  }
+  assert(
+    source.includes("binding.credential_id"),
+    "Repository bindings should identify the selected credential",
+  );
+});
+
 test("Repository credential submissions clear write-only fields in finally blocks", () => {
   const createStart = source.indexOf("async function createCredential()");
   const rotateStart = source.indexOf("async function rotateCredential(");