codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/task-records/signing.js

@@ -0,0 +1,140 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var signing_exports = {};
+__export(signing_exports, {
+  KEY_KIND: () => KEY_KIND,
+  RECORD_NAMESPACE: () => RECORD_NAMESPACE,
+  canonicalJson: () => canonicalJson,
+  fingerprintOf: () => fingerprintOf,
+  keyFileName: () => keyFileName,
+  makeDeviceKey: () => makeDeviceKey,
+  parseKeyIntroduction: () => parseKeyIntroduction,
+  parseSignature: () => parseSignature,
+  serializeKeyIntroduction: () => serializeKeyIntroduction,
+  shortFingerprint: () => shortFingerprint,
+  signWithDevice: () => signWithDevice,
+  verifyWithDevice: () => verifyWithDevice
+});
+module.exports = __toCommonJS(signing_exports);
+var import_node_crypto = __toESM(require("node:crypto"));
+var import_yaml = require("yaml");
+const RECORD_NAMESPACE = "codetrellis-task-record";
+const KEY_KIND = "codetrellis-device-key";
+const MAX_KEY_BYTES = 4 * 1024;
+const WRITER = /^[a-f0-9]{8,32}$/;
+const FINGERPRINT = /^SHA256:[A-Za-z0-9+/]{43}$/;
+const EMAIL = /^[^\s<>@]{1,64}@[^\s<>@]{1,255}$/;
+const SSH_SIGNATURE = /^-----BEGIN SSH SIGNATURE-----\n[A-Za-z0-9+/=\n]+-----END SSH SIGNATURE-----$/;
+function canonicalJson(v) {
+  const sort = (x) => {
+    if (Array.isArray(x)) return x.map(sort);
+    if (x && typeof x === "object") {
+      return Object.fromEntries(Object.keys(x).sort().map((k) => [k, sort(x[k])]));
+    }
+    return x;
+  };
+  return JSON.stringify(sort(v));
+}
+function parseSignature(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const s = raw;
+  if (s.how === "device" && typeof s.key === "string" && FINGERPRINT.test(s.key) && typeof s.value === "string" && /^[A-Za-z0-9+/]{86}==$/.test(s.value)) {
+    return { how: "device", key: s.key, value: s.value };
+  }
+  if (s.how === "git" && typeof s.signer === "string" && EMAIL.test(s.signer) && typeof s.value === "string" && SSH_SIGNATURE.test(s.value.trim())) {
+    return { how: "git", signer: s.signer, value: s.value.trim() };
+  }
+  return null;
+}
+function fingerprintOf(publicKey) {
+  return `SHA256:${import_node_crypto.default.createHash("sha256").update(Buffer.from(publicKey, "base64")).digest("base64").replace(/=+$/, "")}`;
+}
+function makeDeviceKey() {
+  const { publicKey, privateKey } = import_node_crypto.default.generateKeyPairSync("ed25519");
+  const pub = publicKey.export({ type: "spki", format: "der" }).toString("base64");
+  return { publicKey: pub, privateKey: privateKey.export({ type: "pkcs8", format: "der" }).toString("base64"), fingerprint: fingerprintOf(pub) };
+}
+function signWithDevice(key, bytes) {
+  const priv = import_node_crypto.default.createPrivateKey({ key: Buffer.from(key.privateKey, "base64"), format: "der", type: "pkcs8" });
+  return { how: "device", key: key.fingerprint, value: import_node_crypto.default.sign(null, Buffer.from(bytes, "utf8"), priv).toString("base64") };
+}
+function verifyWithDevice(publicKey, bytes, value) {
+  try {
+    const pub = import_node_crypto.default.createPublicKey({ key: Buffer.from(publicKey, "base64"), format: "der", type: "spki" });
+    if (pub.asymmetricKeyType !== "ed25519") return false;
+    return import_node_crypto.default.verify(null, Buffer.from(bytes, "utf8"), pub, Buffer.from(value, "base64"));
+  } catch {
+    return false;
+  }
+}
+function keyFileName(writer) {
+  return `${writer}.yaml`;
+}
+function serializeKeyIntroduction(k) {
+  return '# CodeTrellis: this device signs its task-state records with this key.\n# Teammates trust it once, in Settings \u2192 Shared task state, after checking the\n# fingerprint with its owner. Until then its records read "unverified".\n' + (0, import_yaml.stringify)({ kind: KEY_KIND, version: 1, writer: k.writer, name: k.name, publicKey: k.publicKey, fingerprint: k.fingerprint }, { lineWidth: 0 });
+}
+function parseKeyIntroduction(source, fileWriter) {
+  if (Buffer.byteLength(source, "utf8") > MAX_KEY_BYTES) return { error: "larger than a key file can be" };
+  let raw;
+  try {
+    raw = (0, import_yaml.parse)(source, { maxAliasCount: 0 });
+  } catch {
+    return { error: "not YAML" };
+  }
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return { error: "not a key file" };
+  const r = raw;
+  if (r.kind !== KEY_KIND || r.version !== 1) return { error: "not a key file this version reads" };
+  if (typeof r.writer !== "string" || !WRITER.test(r.writer) || r.writer !== fileWriter) return { error: "names another device than its file" };
+  if (typeof r.publicKey !== "string" || r.publicKey.length > 200) return { error: "no public key" };
+  try {
+    const pub = import_node_crypto.default.createPublicKey({ key: Buffer.from(r.publicKey, "base64"), format: "der", type: "spki" });
+    if (pub.asymmetricKeyType !== "ed25519") return { error: "not an Ed25519 key" };
+  } catch {
+    return { error: "not a public key" };
+  }
+  const name = typeof r.name === "string" && r.name.trim() ? r.name.trim().slice(0, 120) : "someone";
+  return { key: { writer: r.writer, name, publicKey: r.publicKey, fingerprint: fingerprintOf(r.publicKey) } };
+}
+function shortFingerprint(fp) {
+  return fp.slice(0, 7 + 12);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  KEY_KIND,
+  RECORD_NAMESPACE,
+  canonicalJson,
+  fingerprintOf,
+  keyFileName,
+  makeDeviceKey,
+  parseKeyIntroduction,
+  parseSignature,
+  serializeKeyIntroduction,
+  shortFingerprint,
+  signWithDevice,
+  verifyWithDevice
+});

package/src/backend/services/task-records/split-signals.js

@@ -0,0 +1,52 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var split_signals_exports = {};
+__export(split_signals_exports, {
+  stateSplitDrafts: () => stateSplitDrafts
+});
+module.exports = __toCommonJS(split_signals_exports);
+var import_database = require("../database");
+var import_awareness_signals = require("../awareness-signals");
+var import_item_status = require("../../../shared/lib/item-status");
+var import_heads = require("./heads");
+function stateSplitDrafts(projectRoot) {
+  const out = [];
+  for (const [itemUid, claims] of (0, import_heads.allSplits)()) {
+    const row = (0, import_database.getDb)().exec(
+      "SELECT i.title, p.project_path FROM plan_items i JOIN plans p ON p.uid = i.plan_uid WHERE i.uid = ?",
+      [itemUid]
+    )[0]?.values[0];
+    if (!row || row[1] !== projectRoot || claims.length === 0) continue;
+    const item = { title: String(row[0]) };
+    const ws = `task:${itemUid}`;
+    const forged = claims.some((c) => c.forged);
+    out.push((0, import_awareness_signals.draft)(
+      "state-split",
+      forged ? "high" : "medium",
+      itemUid,
+      { items: [itemUid], labels: { [ws]: item.title }, said: claims.map((c) => ({ name: c.name, status: c.status, ...c.forged ? { forged: true } : {} })) },
+      [ws],
+      `\u201C${item.title}\u201D: ${(0, import_item_status.atOnceWords)(claims)}.`
+    ));
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  stateSplitDrafts
+});

package/src/backend/services/task-records/test-runs.js

@@ -0,0 +1,164 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var test_runs_exports = {};
+__export(test_runs_exports, {
+  RUNS_DIR: () => RUNS_DIR,
+  codeAt: () => codeAt,
+  myRunCount: () => myRunCount,
+  readTeammateRuns: () => readTeammateRuns,
+  writeRunRecord: () => writeRunRecord
+});
+module.exports = __toCommonJS(test_runs_exports);
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var import_node_child_process = require("node:child_process");
+var import_confined_fs = require("../confined-fs");
+var import_cloud_files = require("../cloud-files");
+var import_grounding = require("../tests/grounding");
+var import_teammate_runs = require("../tests/teammate-runs");
+var import_run_record = require("./run-record");
+var import_trust = require("./trust");
+const RUNS_DIR = import_node_path.default.join(".codetrellis", "runs");
+const FILE = /^([a-f0-9]{8,32})-(\d{1,9})\.yaml$/;
+const MAX_FILES = 2e3;
+const MAX_DIRTY = 500;
+const git = (root, args) => {
+  try {
+    return (0, import_node_child_process.execFileSync)("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 16 * 1024 * 1024 });
+  } catch {
+    return null;
+  }
+};
+function filesIn(dir) {
+  try {
+    return import_node_fs.default.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && FILE.test(e.name)).slice(0, MAX_FILES).map((e) => {
+      const m = FILE.exec(e.name);
+      return { name: e.name, writer: m[1], counter: Number(m[2]) };
+    });
+  } catch {
+    return [];
+  }
+}
+function codeAt(projectRoot) {
+  const commit = git(projectRoot, ["rev-parse", "HEAD"])?.trim() || null;
+  if (!commit) return { commit: null, dirty: [] };
+  const out = git(projectRoot, ["status", "--porcelain=v1", "-z", "--untracked-files=all"]) ?? "";
+  const dirty = [];
+  const parts = out.split("\0");
+  for (let i = 0; i < parts.length && dirty.length < MAX_DIRTY; i++) {
+    const entry = parts[i];
+    if (entry.length < 4) continue;
+    const file = entry.slice(3);
+    if (entry[0] === "R" || entry[0] === "C") i++;
+    if (!file.startsWith(".codetrellis/")) dirty.push(file);
+  }
+  return { commit, dirty };
+}
+function writeRunRecord(where, run) {
+  const dir = import_node_path.default.join(where.home, RUNS_DIR);
+  const mine = filesIn(dir).filter((f) => f.writer === where.me);
+  let counter = Math.max(0, ...mine.map((f) => f.counter)) + 1;
+  while (import_node_fs.default.existsSync(import_node_path.default.join(dir, `${where.me}-${counter}.yaml`))) counter++;
+  const { commit, dirty } = codeAt(where.projectRoot);
+  const record = {
+    writer: where.me,
+    name: where.name,
+    counter,
+    at: run.ranAt,
+    by: run.by,
+    commit,
+    dirty,
+    report: run.path,
+    totals: run.totals,
+    files: (0, import_run_record.runFilesOf)(run.cases.map((c) => ({ testFile: (0, import_grounding.testFileOf)(where.projectRoot, c), name: c.name, result: c.result, message: c.message })))
+  };
+  const signature = (0, import_trust.signRecord)(where.projectRoot, where.home, record, (0, import_run_record.runRecordBytes)(record));
+  const file = (0, import_confined_fs.writeFileWithin)(where.home, import_node_path.default.join(dir, `${where.me}-${counter}.yaml`), (0, import_run_record.serializeRunRecord)(record, signature), "test-run record");
+  for (const f of mine) {
+    try {
+      (0, import_confined_fs.removeWithin)(where.home, import_node_path.default.join(dir, f.name), {}, "test-run record");
+    } catch {
+    }
+  }
+  return file;
+}
+function readTeammateRuns(projectRoot, home, me) {
+  const dir = import_node_path.default.join(home, RUNS_DIR);
+  const known = (0, import_teammate_runs.knownRunCounters)(projectRoot);
+  const newest = /* @__PURE__ */ new Map();
+  for (const f of filesIn(dir)) {
+    if (f.writer === me) continue;
+    const at = newest.get(f.writer);
+    if (!at || f.counter > at.counter) newest.set(f.writer, f);
+  }
+  let added = 0;
+  let ctx = null;
+  for (const [writer, f] of newest) {
+    if ((known.get(writer) ?? 0) >= f.counter) continue;
+    const file = import_node_path.default.join(dir, f.name);
+    if ((0, import_cloud_files.isPlaceholder)(file)) continue;
+    let text;
+    try {
+      text = (0, import_confined_fs.readTextWithin)(home, file, "test-run record");
+    } catch {
+      continue;
+    }
+    const parsed = (0, import_run_record.parseRunRecord)(text);
+    if (!("record" in parsed)) continue;
+    const r = parsed.record;
+    if (r.writer !== writer || r.counter !== f.counter) continue;
+    ctx ??= (0, import_trust.checkContext)(projectRoot);
+    const v = (0, import_trust.verifyTaskRecord)(r, parsed.signed, ctx);
+    (0, import_teammate_runs.putTeammateRun)(projectRoot, {
+      writer,
+      counter: r.counter,
+      name: v.verified ? v.who : r.name,
+      by: r.by,
+      commit: r.commit,
+      dirty: r.dirty,
+      at: r.at,
+      report: r.report,
+      totals: r.totals,
+      files: r.files,
+      verdict: v.verified ? { verified: true, how: v.how, who: v.who } : { verified: false, why: v.why }
+    });
+    added++;
+  }
+  return added;
+}
+function myRunCount(home, me) {
+  return home ? filesIn(import_node_path.default.join(home, RUNS_DIR)).filter((f) => f.writer === me).length : 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RUNS_DIR,
+  codeAt,
+  myRunCount,
+  readTeammateRuns,
+  writeRunRecord
+});

package/src/backend/services/task-records/trust.js

@@ -0,0 +1,243 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var trust_exports = {};
+__export(trust_exports, {
+  KEYS_DIR: () => KEYS_DIR,
+  checkContext: () => checkContext,
+  decideKey: () => decideKey,
+  deviceKey: () => deviceKey,
+  forgetVerdicts: () => forgetVerdicts,
+  introduceDeviceKey: () => introduceDeviceKey,
+  listTeammateKeys: () => listTeammateKeys,
+  readKeyIntroductions: () => readKeyIntroductions,
+  signRecord: () => signRecord,
+  signingWay: () => signingWay,
+  verifyTaskRecord: () => verifyTaskRecord
+});
+module.exports = __toCommonJS(trust_exports);
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var import_node_crypto = __toESM(require("node:crypto"));
+var import_node_child_process = require("node:child_process");
+var import_database = require("../database");
+var import_persistence = require("../persistence");
+var import_confined_fs = require("../confined-fs");
+var import_signed_approvals = require("../signed-approvals");
+var import_signing = require("./signing");
+var import_cloud_files = require("../cloud-files");
+const KEYS_DIR = import_node_path.default.join(".codetrellis", "keys");
+const MAX_KEY_FILES = 500;
+function deviceKey() {
+  const v = (0, import_database.getDb)().exec("SELECT public_key, private_key, fingerprint FROM task_record_device_key WHERE id = 1")[0]?.values[0];
+  if (v) return { publicKey: String(v[0]), privateKey: String(v[1]), fingerprint: String(v[2]) };
+  const k = (0, import_signing.makeDeviceKey)();
+  (0, import_database.getDb)().run(
+    "INSERT OR IGNORE INTO task_record_device_key (id, public_key, private_key, fingerprint, created_at) VALUES (1, ?, ?, ?, ?)",
+    [k.publicKey, k.privateKey, k.fingerprint, Date.now()]
+  );
+  (0, import_persistence.markDirty)();
+  return deviceKey();
+}
+const gitSigningAllowed = () => process.env.CODETRELLIS_GIT_SIGN_RECORDS !== "0";
+function signingWay(projectRoot) {
+  const setup = gitSigningAllowed() ? (0, import_signed_approvals.signingSetup)(projectRoot) : null;
+  if (setup?.canSign) {
+    return { how: "git", as: setup.signer, says: `Records written here are signed with your git SSH key, as ${setup.signer}. Teammates check them against git's allowed signers, as they do signed commits.` };
+  }
+  const k = deviceKey();
+  return {
+    how: "device",
+    as: k.fingerprint,
+    says: `Records written here are signed with this device's own key (${(0, import_signing.shortFingerprint)(k.fingerprint)}\u2026). Teammates trust it once, in their Settings, after checking that fingerprint with you.`
+  };
+}
+function signRecord(projectRoot, home, record, bytes) {
+  const setup = gitSigningAllowed() ? (0, import_signed_approvals.signingSetup)(projectRoot) : null;
+  if (setup?.canSign) {
+    try {
+      const value = (0, import_node_child_process.execFileSync)("ssh-keygen", ["-Y", "sign", "-f", setup.keyFile, "-n", import_signing.RECORD_NAMESPACE], {
+        input: bytes,
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+        timeout: 15e3
+      });
+      return { how: "git", signer: setup.signer, value: value.trim() };
+    } catch (err) {
+      console.warn("[TaskRecords] git could not sign a record; the device key signs it:", err.message.split("\n")[0]);
+    }
+  }
+  const key = deviceKey();
+  introduceDeviceKey(home, record.writer, record.name, key);
+  return (0, import_signing.signWithDevice)(key, bytes);
+}
+function introduceDeviceKey(projectRoot, writer, name, key) {
+  const rel = import_node_path.default.join(KEYS_DIR, (0, import_signing.keyFileName)(writer));
+  const text = (0, import_signing.serializeKeyIntroduction)({ writer, name, publicKey: key.publicKey, fingerprint: key.fingerprint });
+  try {
+    if ((0, import_confined_fs.readTextWithin)(projectRoot, rel, "device key") === text) return;
+  } catch {
+  }
+  (0, import_confined_fs.writeFileWithin)(projectRoot, rel, text, "device key");
+}
+function readKeyIntroductions(projectRoot, me) {
+  const dir = import_node_path.default.join(projectRoot, KEYS_DIR);
+  let names;
+  try {
+    names = import_node_fs.default.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && /^[a-f0-9]{8,32}\.yaml$/.test(e.name)).map((e) => e.name).slice(0, MAX_KEY_FILES);
+  } catch {
+    return 0;
+  }
+  let added = 0;
+  for (const name of names) {
+    const writer = name.slice(0, -".yaml".length);
+    if (writer === me) continue;
+    if ((0, import_cloud_files.isPlaceholder)(import_node_path.default.join(dir, name))) continue;
+    let text;
+    try {
+      text = (0, import_confined_fs.readTextWithin)(projectRoot, import_node_path.default.join(KEYS_DIR, name), "device key");
+    } catch {
+      continue;
+    }
+    const parsed = (0, import_signing.parseKeyIntroduction)(text, writer);
+    if (!("key" in parsed)) continue;
+    const k = parsed.key;
+    if ((0, import_database.getDb)().exec("SELECT 1 FROM task_record_keys WHERE writer = ? AND fingerprint = ?", [k.writer, k.fingerprint])[0]?.values[0]) continue;
+    (0, import_database.getDb)().run(
+      `INSERT INTO task_record_keys (writer, fingerprint, public_key, name, project_root, state, first_seen) VALUES (?, ?, ?, ?, ?, 'new', ?)`,
+      [k.writer, k.fingerprint, k.publicKey, k.name, projectRoot, Date.now()]
+    );
+    added++;
+  }
+  if (added) (0, import_persistence.markDirty)();
+  return added;
+}
+function rowToKey(v, trustedWriters) {
+  const writer = String(v[0]);
+  const state = String(v[3]);
+  return {
+    writer,
+    name: String(v[1]),
+    fingerprint: String(v[2]),
+    short: (0, import_signing.shortFingerprint)(String(v[2])),
+    state,
+    firstSeen: Number(v[4]),
+    decidedAt: v[5] == null ? null : Number(v[5]),
+    decidedBy: v[6] == null ? null : String(v[6]),
+    replaces: state !== "trusted" && trustedWriters.has(writer)
+  };
+}
+function listTeammateKeys(roots) {
+  const marks = roots.map(() => "?").join(", ");
+  const rows = (0, import_database.getDb)().exec(
+    `SELECT writer, name, fingerprint, state, first_seen, decided_at, decided_by FROM task_record_keys
+     WHERE project_root IN (${marks}) OR writer IN (SELECT writer FROM task_record_keys WHERE project_root IN (${marks}))
+     ORDER BY CASE state WHEN 'new' THEN 0 WHEN 'trusted' THEN 1 ELSE 2 END, name, writer`,
+    [...roots, ...roots]
+  )[0]?.values ?? [];
+  const trusted = new Set(rows.filter((r) => r[3] === "trusted").map((r) => String(r[0])));
+  return rows.map((r) => rowToKey(r, trusted));
+}
+function decideKey(writer, fingerprint, trust, by) {
+  const known = (0, import_database.getDb)().exec("SELECT 1 FROM task_record_keys WHERE writer = ? AND fingerprint = ?", [writer, fingerprint])[0]?.values[0];
+  if (!known) return null;
+  (0, import_database.getDb)().run(
+    "UPDATE task_record_keys SET state = ?, decided_at = ?, decided_by = ? WHERE writer = ? AND fingerprint = ?",
+    [trust ? "trusted" : "refused", Date.now(), by, writer, fingerprint]
+  );
+  (0, import_persistence.markDirty)();
+  verdicts.clear();
+  const rows = (0, import_database.getDb)().exec(
+    "SELECT writer, name, fingerprint, state, first_seen, decided_at, decided_by FROM task_record_keys WHERE writer = ?",
+    [writer]
+  )[0]?.values ?? [];
+  const trusted = new Set(rows.filter((r) => r[3] === "trusted").map((r) => String(r[0])));
+  const row = rows.find((r) => r[2] === fingerprint);
+  return row ? rowToKey(row, trusted) : null;
+}
+function checkContext(projectRoot) {
+  const allowed = (0, import_signed_approvals.signingSetup)(projectRoot).allowedSigners;
+  let stamp = "none";
+  if (allowed) {
+    try {
+      const s = import_node_fs.default.statSync(allowed);
+      stamp = `${s.mtimeMs}:${s.size}`;
+    } catch {
+      stamp = "missing";
+    }
+  }
+  return { allowedSigners: allowed, allowedStamp: stamp };
+}
+const verdicts = /* @__PURE__ */ new Map();
+const MAX_VERDICTS = 2e4;
+function verifyTaskRecord(record, signed, ctx) {
+  const sig = signed.signature;
+  if (!sig) return { verified: false, why: "it is not signed" };
+  const key = import_node_crypto.default.createHash("sha256").update(`${record.writer}
+${signed.bytes}
+${JSON.stringify(sig)}
+${ctx.allowedStamp}`).digest("hex");
+  const cached = verdicts.get(key);
+  if (cached) return cached;
+  const verdict = check(record, signed.bytes, sig, ctx);
+  if (verdicts.size >= MAX_VERDICTS) verdicts.clear();
+  verdicts.set(key, verdict);
+  return verdict;
+}
+function check(record, bytes, sig, ctx) {
+  if (sig.how === "git") {
+    const out = (0, import_signed_approvals.verifyRecord)(bytes, sig.value, sig.signer, ctx.allowedSigners, import_signing.RECORD_NAMESPACE);
+    return out.ok ? { verified: true, how: "git", who: sig.signer } : { verified: false, why: out.reason };
+  }
+  const v = (0, import_database.getDb)().exec(
+    "SELECT public_key, name, state FROM task_record_keys WHERE writer = ? AND fingerprint = ?",
+    [record.writer, sig.key]
+  )[0]?.values[0];
+  if (!v) return { verified: false, why: `it is signed with a device key (${(0, import_signing.shortFingerprint)(sig.key)}\u2026) this project has not introduced` };
+  const [publicKey, name, state] = [String(v[0]), String(v[1]), String(v[2])];
+  if (state === "refused") return { verified: false, why: `it is signed with ${name}'s device key, which you refused` };
+  if (state !== "trusted") return { verified: false, why: `it is signed with ${name}'s device key, which you have not trusted yet` };
+  if (!(0, import_signing.verifyWithDevice)(publicKey, bytes, sig.value)) return { verified: false, why: `its signature does not match ${name}'s device key: it was changed after it was signed` };
+  return { verified: true, how: "device", who: name };
+}
+function forgetVerdicts() {
+  verdicts.clear();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  KEYS_DIR,
+  checkContext,
+  decideKey,
+  deviceKey,
+  forgetVerdicts,
+  introduceDeviceKey,
+  listTeammateKeys,
+  readKeyIntroductions,
+  signRecord,
+  signingWay,
+  verifyTaskRecord
+});