@heyquilt/seam 0.16.0 → 0.22.0

package/bin/seam.js

@@ -8,13 +8,13 @@ import { fileURLToPath } from 'node:url'
 import { readAccount, login, logout, resume } from '../lib/account.js'
 
 const here = path.dirname(fileURLToPath(import.meta.url))
-// The published package ships the client in lib/quilts (scripts/build.mjs); in the repo it is
-// read straight from the server's src/quilts.
-const QUILTS = fs.existsSync(path.join(here, '../lib/quilts/cli.js')) ? '../lib/quilts' : '../../src/quilts'
+// In the repo the client is read straight from the server's src/quilts (never a stale build);
+// the published package has no src/, and ships it in lib/quilts (scripts/build.mjs).
+const QUILTS = fs.existsSync(path.join(here, '../../src/quilts/cli.js')) ? '../../src/quilts' : '../lib/quilts'
 const quilts = (file) => import(`${QUILTS}/${file}`)
 const { version } = JSON.parse(fs.readFileSync(path.join(here, '../package.json'), 'utf8'))
 
-const HELP = `seam ${version}: Quilt Source, source control for people and their agents
+const HELP = `seam ${version}: Seam, source control for people and their agents
 Docs: https://seam.heyquilt.com/docs
 
   seam login [--no-browser]          Sign in with your heyquilt.com account
@@ -32,9 +32,19 @@ Docs: https://seam.heyquilt.com/docs
   seam key [add [--name n] | remove <key>]   seam commit --sign | sign [rev]   seam log --show-signature
   seam line [new <name> [--from rev] | freeze | unfreeze]  Lines: main, release/<name>
   seam tag [<name> [rev]]            seam release [<name> [rev] -m <notes>]  Read as tag:<name>
+  seam commit --amend [-m "<message>"]   change your square's last commit
+  seam square open "<title>" --on sq:<id>   a square stacked on another
+  seam claim <path|glob> [--note why] | unclaim <id>   files your square is working on
+  seam review approve|request-changes|comment|dismiss <sq>   seam line require <line> [--approvals n] [--checks a,b]
+  seam check <name> green|red [--square sq | --patch n]   report a check (a red one on a patch reverts it)
+  seam resolutions [forget <key>]    conflicts settled before, settled the same way again
+  seam bisect <bad> <good> --run "<check>"   seam grep <pattern> [rev] [--all]   seam describe [rev]   seam merge-base <a> <b>
+  seam log --follow <path> | log -S <text>
+  seam token [new <name> [--level read|write] | revoke <name>]   a key for one quilt, for CI
   seam events [--webhook <url>]      What happened to your squares
   seam export git <dir>              Back to git
   seam mcp                           The same commands as MCP tools, for your AI tool
+  seam serve                         Run a Seam server (SEAM_IDENTITY_URL says who is calling)
 
 Agents: set SEAM_TOKEN to the agent's key instead of signing in.`
 
@@ -55,6 +65,11 @@ async function main () {
   if (cmd === 'logout') { const a = await logout(); return console.log(a ? `Signed out of ${a.account.email}.` : 'Not signed in.') }
   if (cmd === 'whoami') { const a = readAccount(); if (!a) { process.exitCode = 1; return console.log('Not signed in.') } return console.log(`${a.account.name} (${a.account.email})`) }
   if (cmd === 'mcp') return mcp()
+  // The server is not in the package (it ships the client): it runs from Seam's source or its image.
+  if (cmd === 'serve') {
+    if (QUILTS === '../lib/quilts') fail('seam serve runs from Seam\'s source: node src/quilts/server.js in the repository, or the Dockerfile.seam image (docs/seam-service.md).')
+    return (await quilts('server.js')).serveFromEnv(process.env)
+  }
   const { SEAM_VERBS, runSeamCommand } = await quilts('cli.js')
   if (!SEAM_VERBS.has(cmd)) fail(`seam: '${cmd}' is not a seam command. See seam help.`)
   try {

package/lib/account.js

@@ -8,7 +8,8 @@ import path from 'node:path'
 import crypto from 'node:crypto'
 
 export const API_URL = 'https://api.heyquilt.com'
-export const apiUrl = () => String(process.env.SEAM_API_URL || API_URL).replace(/\/+$/, '')
+// Sign-in lives on the accounts API (Seam's identity service), not on Seam's own server.
+export const apiUrl = () => String(process.env.SEAM_ACCOUNTS_URL || API_URL).replace(/\/+$/, '')
 export const seamHome = () => process.env.SEAM_HOME || path.join(os.homedir(), '.seam')
 const accountFile = () => path.join(seamHome(), 'account.json')
 const identityFile = () => path.join(seamHome(), 'identity.json')

package/lib/quilts/cli.js

@@ -7,13 +7,13 @@ import fs from 'node:fs'
 import os from 'node:os'
 import { quiltClient } from './client.js'
 import { findBlock, checkout, status as blockStatus, commitFolder, amendFolder, syncTo, localDiff, saveBlock, restore, reset, clean, localChanges } from './block.js'
-import { describeLog, describeShow, describeDiff, describeBlame, describeStatus, describeMerge, describeWrite, describeSquare, describeSquareStatus, describeEvents, describeTag, describeRelease, describeImport, describeRestore, describeReset, describeClean, describeLive, describeClaims, describeResolutions, describeLiveSet, describeMergeBase, describeGrep, describeBisect, describeCheck, describeReviews, describeReviewed, describeSquareCheck, describePolicy, describeKeys } from './describe.js'
+import { describeLog, describeShow, describeDiff, describeBlame, describeStatus, describeMerge, describeWrite, describeSquare, describeSquareStatus, describeEvents, describeTag, describeRelease, describeImport, describeRestore, describeReset, describeClean, describeLive, describeClaims, describeResolutions, describeLiveSet, describeMergeBase, describeGrep, describeBisect, describeCheck, describeReviews, describeReviewed, describeSquareCheck, describePolicy, describeKeys, describeTokens, describeNewToken } from './describe.js'
 import { signWithLocalKey, localKey, makeLocalKey, signingKeyFile } from './signing.js'
 
-export const API_URL = 'https://api.heyquilt.com'
+export const API_URL = 'https://api.seam.heyquilt.com'
 
 /** The verbs `seam` answers. */
-export const SEAM_VERBS = new Set(['quilts', 'square', 'checkout', 'status', 'commit', 'log', 'show', 'diff', 'merge', 'rebase', 'revert', 'cherry-pick', 'blame', 'resolve', 'cat', 'ls', 'import', 'export', 'events', 'tag', 'release', 'line', 'restore', 'reset', 'clean', 'live', 'bisect', 'grep', 'describe', 'merge-base', 'claim', 'unclaim', 'check', 'resolutions', 'review', 'sign', 'key'])
+export const SEAM_VERBS = new Set(['quilts', 'square', 'checkout', 'status', 'commit', 'log', 'show', 'diff', 'merge', 'rebase', 'revert', 'cherry-pick', 'blame', 'resolve', 'cat', 'ls', 'import', 'export', 'events', 'tag', 'release', 'line', 'restore', 'reset', 'clean', 'live', 'bisect', 'grep', 'describe', 'merge-base', 'claim', 'unclaim', 'check', 'resolutions', 'review', 'sign', 'key', 'token'])
 
 const VALUE_FLAGS = new Set(['-m', '--quilts', '--message', '-n', '--max-count', '--into', '--onto', '--on-conflict', '--quilt', '--square', '--dir', '--line', '--task', '--level', '--title', '--slug', '--format', '--expect-tip', '--side', '--file', '--batch', '--to', '--note', '--after', '--kinds', '--webhook', '--secret', '--branch', '--from', '-S', '--run', '--marks', '--patch', '--on', '--path', '--checks', '--name', '--public-key'])
 
@@ -258,6 +258,22 @@ export async function runSeamCommand (cmd, argv, { cwd = process.cwd(), token, o
       const r = await signWithLocalKey(client, needQuilt(), pos[0] || (block?.square ? block.square_short : block?.line) || 'main')
       return print(r, `Signed ${r.short} with ${r.signature.key}.`)
     }
+    case 'token': {
+      // seam token [list] | new <name> [--level read|write] | revoke <id or name>
+      const sub = pos[0] || 'list'
+      if (sub === 'list') { const r = await client.tokens(needQuilt()); return print(r, describeTokens(r)) }
+      if (sub === 'new') {
+        if (!pos[1]) throw new Error('seam token new <name> [--level read|write]')
+        const r = await client.createToken(needQuilt(), { name: pos[1], level: flags['--level'] || 'read' })
+        return print(r, describeNewToken(r))
+      }
+      if (sub === 'revoke') {
+        if (!pos[1]) throw new Error('seam token revoke <id or name>')
+        const r = await client.revokeToken(needQuilt(), pos[1])
+        return print(r, `Revoked token ${r.name} (${r.id}): it no longer reaches the quilt.`)
+      }
+      throw new Error('seam token [list] | new <name> [--level read|write] | revoke <id or name>')
+    }
     case 'key': {
       // seam key [list [member]] | add [--name <n>] [--public-key <file>] | remove <key>
       const sub = pos[0] || 'list'

package/lib/quilts/client.js

@@ -73,6 +73,9 @@ export function quiltClient ({ api, token, fetch: fetchImpl = globalThis.fetch,
     exportPatches: (q, o = {}) => call('GET', `${Q(q)}/export/git${qs(o)}`),
     log: (q, o = {}) => call('GET', `${Q(q)}/log${qs(o)}`),
     sign: (q, rev, b) => call('POST', `${Q(q)}/commits/${enc(rev)}/signatures`, b),
+    tokens: (q) => call('GET', `${Q(q)}/tokens`),
+    createToken: (q, b) => call('POST', `${Q(q)}/tokens`, b),
+    revokeToken: (q, id) => call('DELETE', `${Q(q)}/tokens/${enc(id)}`),
     signingKeys: (o = {}) => call('GET', `/v1/signing-keys${qs(o)}`),
     addKey: (b) => call('POST', '/v1/signing-keys', b),
     removeKey: (key) => call('DELETE', `/v1/signing-keys/${enc(key)}`),

package/lib/quilts/describe.js

@@ -257,3 +257,10 @@ export function describeKeys (r) {
   if (!r.keys.length) return `${r.member} has no signing keys.`
   return r.keys.map((k) => `${k.key}${k.name ? `  ${k.name}` : ''}${k.removed_at ? `  (removed ${when(k.removed_at)})` : `  added ${when(k.added_at)}`}`).join('\n')
 }
+
+export function describeTokens (r) {
+  if (!r.tokens.length) return `${r.quilt} has no tokens. Make one with seam token new <name> [--level read|write].`
+  return r.tokens.map((t) => `${t.id}  ${t.name}  ${t.level}${t.revoked_at ? `  (revoked ${when(t.revoked_at)})` : `  made ${when(t.created_at)} by ${t.created_by}`}`).join('\n')
+}
+
+export const describeNewToken = (t) => `Made token ${t.name} (${t.level} on ${t.quilt}, id ${t.id}). Its secret, shown only this once:\n\n  ${t.token}\n\nSet it as SEAM_TOKEN (or send it as Authorization: Bearer <token>).`

package/lib/quilts/errors.js

@@ -1,5 +1,8 @@
-// The error every quilt operation refuses with, shared by the server and seam's client.
+// What both the server and the seam client need without loading the server (service.js).
 export class QuiltError extends Error {
   /** `code` is the wire name (04/07/12): head_moved, tip_moved, conflict, not_found, ... */
   constructor (status, code, message, extra = {}) { super(message); this.status = status; this.code = code; this.extra = extra }
 }
+
+/** A square's short handle: sq: + the last 8 hex of its uuid (02). */
+export const squareShort = (id) => `sq:${String(id).replace(/-/g, '').slice(-8)}`

package/lib/quilts/tools.js

@@ -8,11 +8,11 @@
 // quilt and square, and seam_commit takes the files' new contents.
 import path from 'node:path'
 import { z } from 'zod'
-import { describeLog, describeShow, describeDiff, describeBlame, describeStatus, describeMerge, describeWrite, describeSquare, describeSquareStatus, describeEvents, describeTag, describeRelease, describeImport, describeRestore, describeReset, describeClean, describeLive, describeClaims, describeResolutions, describeLiveSet, describeMergeBase, describeGrep, describeBisect, describeCheck, describeReviews, describeReviewed, describeSquareCheck, describePolicy, describeKeys } from './describe.js'
+import { describeLog, describeShow, describeDiff, describeBlame, describeStatus, describeMerge, describeWrite, describeSquare, describeSquareStatus, describeEvents, describeTag, describeRelease, describeImport, describeRestore, describeReset, describeClean, describeLive, describeClaims, describeResolutions, describeLiveSet, describeMergeBase, describeGrep, describeBisect, describeCheck, describeReviews, describeReviewed, describeSquareCheck, describePolicy, describeKeys, describeTokens, describeNewToken } from './describe.js'
 import { signWithLocalKey, localKey, makeLocalKey, signingKeyFile } from './signing.js'
 import { status as blockStatus, commitFolder, amendFolder, syncTo, restore, reset, clean, localChanges } from './block.js'
 
-export const SEAM_TOOLS = ['seam_quilts', 'seam_open_square', 'seam_squares', 'seam_log', 'seam_show', 'seam_diff', 'seam_blame', 'seam_cat', 'seam_ls', 'seam_commit', 'seam_merge', 'seam_rebase', 'seam_revert', 'seam_cherry_pick', 'seam_resolve', 'seam_square_status', 'seam_square_handoff', 'seam_abandon', 'seam_reopen', 'seam_fold', 'seam_split', 'seam_events', 'seam_events_webhook', 'seam_line_list', 'seam_line_new', 'seam_line_freeze', 'seam_line_unfreeze', 'seam_line_require', 'seam_reviews', 'seam_review', 'seam_tag_list', 'seam_tag', 'seam_release_list', 'seam_release', 'seam_import_git', 'seam_restore', 'seam_reset', 'seam_clean', 'seam_live', 'seam_live_set', 'seam_bisect', 'seam_grep', 'seam_search', 'seam_describe', 'seam_merge_base', 'seam_claims', 'seam_claim', 'seam_unclaim', 'seam_check', 'seam_resolutions', 'seam_forget_resolution', 'seam_sign', 'seam_keys', 'seam_key_add', 'seam_key_remove']
+export const SEAM_TOOLS = ['seam_quilts', 'seam_open_square', 'seam_squares', 'seam_log', 'seam_show', 'seam_diff', 'seam_blame', 'seam_cat', 'seam_ls', 'seam_commit', 'seam_merge', 'seam_rebase', 'seam_revert', 'seam_cherry_pick', 'seam_resolve', 'seam_square_status', 'seam_square_handoff', 'seam_abandon', 'seam_reopen', 'seam_fold', 'seam_split', 'seam_events', 'seam_events_webhook', 'seam_line_list', 'seam_line_new', 'seam_line_freeze', 'seam_line_unfreeze', 'seam_line_require', 'seam_reviews', 'seam_review', 'seam_tag_list', 'seam_tag', 'seam_release_list', 'seam_release', 'seam_import_git', 'seam_restore', 'seam_reset', 'seam_clean', 'seam_live', 'seam_live_set', 'seam_bisect', 'seam_grep', 'seam_search', 'seam_describe', 'seam_merge_base', 'seam_claims', 'seam_claim', 'seam_unclaim', 'seam_check', 'seam_resolutions', 'seam_forget_resolution', 'seam_sign', 'seam_keys', 'seam_key_add', 'seam_key_remove', 'seam_token_list', 'seam_token_new', 'seam_token_revoke']
 
 /** What every agent is told about source control, in each MCP's instructions. */
 export const SEAM_GUIDE = 'Quilt source control (quilts): a quilt is a repository on the Quilt server; you work in a square (your own branch and working copy), commit save points in it, and merge it into main, where it becomes a patch. ' +
@@ -48,6 +48,9 @@ export const SEAM_DESCRIPTIONS = {
   seam_sign: 'Signs a commit you made (rev, default your square\'s head) with your Ed25519 key, so seam_log with show_signature shows it as yours. With no signature, signs with this computer\'s key (seam_key_add makes one); a hosted agent signs the text "seam-commit <commit id>\\n" itself and passes key and signature (base64).',
   seam_keys: 'Your signing keys (or member\'s): their ids, names, and when each was added or removed.',
   seam_key_add: 'Adds an Ed25519 signing key to your account. With no public_key, makes one on this computer (kept in ~/.seam/signing-key.pem) or adds the one already there.',
+  seam_token_list: 'The quilt\'s tokens (keys for one quilt, for CI and scripts): id, name, read or write, and whether revoked. Admins only.',
+  seam_token_new: 'Makes a quilt token: a key that reaches only this quilt, at level read (default) or write, for a CI job or a script. The secret (sqt_…) is in this answer only; it is used as SEAM_TOKEN or Authorization: Bearer. Admins only.',
+  seam_token_revoke: 'Revokes a quilt token (by id, or by name): it stops working at once. Admins only.',
   seam_key_remove: 'Removes one of your signing keys (key: ed25519:…). Commits it signed then show "removed_key" instead of "good".',
   seam_tag: 'Tags a revision (rev: patch:12, a commit, a line, sq:…; default main) with a name that never moves. Read it back as the revision tag:<name>.',
   seam_release_list: 'The quilt\'s releases, newest first, each with its notes.',
@@ -106,6 +109,9 @@ export const SEAM_INPUTS = {
   seam_sign: { quilt: QUILT, rev: REV, key: z.string().max(40).optional().describe('Your key id (ed25519:…), with signature'), signature: z.string().max(200).optional().describe('Base64 Ed25519 signature of "seam-commit <commit id>\\n"') },
   seam_keys: { member: z.string().max(200).optional().describe('Whose keys (default yours)') },
   seam_key_add: { public_key: z.string().max(2000).optional().describe('Ed25519 public key (PEM, or base64 of its 32 bytes); none: this computer\'s'), name: z.string().max(100).optional() },
+  seam_token_list: { quilt: QUILT },
+  seam_token_new: { quilt: QUILT, name: z.string().max(100).describe('What it is for, e.g. ci'), level: z.enum(['read', 'write']).optional() },
+  seam_token_revoke: { quilt: QUILT, token: z.string().max(100).describe('The token\'s id or name') },
   seam_key_remove: { key: z.string().max(40).describe('The key id, ed25519:…') },
   seam_tag: { quilt: QUILT, name: z.string().max(100).describe('The tag, e.g. v1.0'), rev: z.string().max(200).optional().describe('What it names: patch:12, a commit, a line, sq:…; default main') },
   seam_release_list: { quilt: QUILT },
@@ -303,6 +309,9 @@ export async function runSeamTool (name, args, { client, found = null }) {
         const r = await client.addKey({ public_key: pub, name: args.name || '' })
         return `${made ? `Made a signing key at ${signingKeyFile()} and added` : 'Added'} ${r.key}. Sign with seam_commit { sign: true } or seam_sign.`
       }
+      case 'seam_token_list': return describeTokens(await client.tokens(needQuilt()))
+      case 'seam_token_new': return describeNewToken(await client.createToken(needQuilt(), { name: args.name, level: args.level || 'read' }))
+      case 'seam_token_revoke': { const r = await client.revokeToken(needQuilt(), args.token); return `Revoked token ${r.name} (${r.id}): it no longer reaches the quilt.` }
       case 'seam_key_remove': { const r = await client.removeKey(args.key); return `Removed ${r.key}: commits it signed now show removed_key.` }
       case 'seam_tag':
       case 'seam_release': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heyquilt/seam",
-  "version": "0.16.0",
+  "version": "0.22.0",
   "description": "seam: Quilt Source's command. Git's verbs for source control that runs on the server, built for many agents and people at once.",
   "license": "UNLICENSED",
   "type": "module",