@loompad/cli 0.1.0 → 1.1.1

package/dist/core/team-hub.js

@@ -0,0 +1,964 @@
+/**
+ * Loom Teams — the hub protocol, and an in-memory hub that is its reference.
+ *
+ * The Team Hub is the thin coordination plane between members' daemons
+ * (docs/teams-architecture.md). Three implementations speak `HubClient`:
+ *
+ *   - MemoryHub (here): in-process, authoritative for the rules. Tests and the
+ *     local hub server both run it, so the rules are written once.
+ *   - HttpHubClient (src/hub/client.ts): talks to `loom hub` — a self-hosted
+ *     hub with no Supabase (D1), and the way two daemons meet in tests.
+ *   - Supabase (supabase/migrations/0002_teams.sql): the hosted hub, the same
+ *     rules as row-level security and SQL functions.
+ *
+ * Phase 1 ("see each other"): teams, members, devices, invites, key envelopes,
+ * shared repos, presence heartbeats and a durable feed. What the hub stores is
+ * plain metadata plus sealed content it cannot read (D2).
+ */
+import crypto from "node:crypto";
+import { githubWebhookFeed } from "./github-events.js";
+import { overlap, zoneOf } from "./team-leases.js";
+/** A claimed job whose runner went quiet this long is claimable again (D12, D71). */
+export const JOB_TTL_MS = 10 * 60_000;
+export class HubError extends Error {
+    status;
+    constructor(message, status = 400) {
+        super(message);
+        this.status = status;
+        this.name = "HubError";
+    }
+}
+// ---------------------------------------------------------------------------
+// Rules shared by every hub
+// ---------------------------------------------------------------------------
+/** A heartbeat older than this is a session that stopped (laptop closed, crash). */
+export const PRESENCE_TTL_MS = 45_000;
+export const INVITE_TTL_MS = 24 * 60 * 60_000;
+/** A short, one-way tag for an invite token: names it in the feed without revealing it. */
+export function inviteTag(invite) {
+    return crypto.createHash("sha256").update(invite).digest("hex").slice(0, 16);
+}
+export const FREE_SEATS = 3; // D21 — enforced by billing, surfaced by the hub
+/** A lease not renewed for this long is stale: its owner's machine is asleep or gone (D12). */
+export const LEASE_TTL_MS = 10 * 60_000;
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+export function normalizeRepo(repo) {
+    const r = repo
+        .trim()
+        .replace(/^(git@github\.com:|https?:\/\/github\.com\/)/, "")
+        .replace(/\.git$/, "")
+        .replace(/\/$/, "");
+    if (!REPO_RE.test(r))
+        throw new HubError(`"${repo}" is not a GitHub repo (owner/name)`);
+    return r.toLowerCase();
+}
+export class MemoryHub {
+    now;
+    users = new Map();
+    tokens = new Map(); // session token → user id
+    teamsById = new Map();
+    memberships = new Map(); // team → user → membership
+    devices = new Map();
+    invites = new Map();
+    envelopes = new Map(); // `${team}/${device}`
+    reposByTeam = new Map();
+    presenceByTeam = new Map();
+    feedByTeam = new Map();
+    dedupe = new Set();
+    feedSeq = 0;
+    leasesByTeam = new Map();
+    memoriesByTeam = new Map();
+    runnersByDevice = new Map();
+    jobsByTeam = new Map();
+    webhookSecrets = new Map(); // team → GitHub webhook secret (D83)
+    listeners = new Map();
+    constructor(now = Date.now) {
+        this.now = now;
+    }
+    /**
+     * Dev/self-host sign-in: a claimed GitHub login gets a session token.
+     * The hosted hub (Supabase) replaces this with real GitHub OAuth; the local
+     * hub server gates it behind its own admin secret.
+     */
+    signIn(github, name) {
+        const login = github.trim().toLowerCase();
+        if (!/^[a-z0-9](?:[a-z0-9-]{0,38})$/.test(login))
+            throw new HubError(`"${github}" is not a GitHub login`);
+        let user = [...this.users.values()].find((u) => u.github === login);
+        if (!user) {
+            user = { id: id("u"), github: login, name: name?.trim() || login };
+            this.users.set(user.id, user);
+        }
+        const token = crypto.randomBytes(24).toString("hex");
+        this.tokens.set(token, user.id);
+        return { token, user };
+    }
+    /** A client bound to one session — the only way to act on the hub. */
+    client(token) {
+        const userId = this.tokens.get(token);
+        if (!userId)
+            throw new HubError("not signed in to this hub", 401);
+        return new MemoryHubClient(this, userId);
+    }
+    // ── internals used by MemoryHubClient ──
+    user(id) {
+        const u = this.users.get(id);
+        if (!u)
+            throw new HubError("no such user", 404);
+        return u;
+    }
+    role(teamId, userId) {
+        return this.memberships.get(teamId)?.get(userId)?.role ?? null;
+    }
+    requireRole(teamId, userId, atLeast) {
+        const r = this.role(teamId, userId);
+        const rank = { viewer: 0, member: 1, owner: 2 };
+        if (!r)
+            throw new HubError("not a member of this team", 403);
+        if (rank[r] < rank[atLeast])
+            throw new HubError(`needs ${atLeast} rights`, 403);
+        return r;
+    }
+    team(teamId) {
+        const t = this.teamsById.get(teamId);
+        if (!t)
+            throw new HubError("no such team", 404);
+        return t;
+    }
+    createTeam(userId, name) {
+        const clean = name.trim().slice(0, 80);
+        if (!clean)
+            throw new HubError("a team needs a name");
+        const team = { id: id("t"), name: clean, createdAt: this.now(), keyVersion: 1 };
+        this.teamsById.set(team.id, team);
+        this.memberships.set(team.id, new Map([[userId, { role: "owner", joinedAt: this.now() }]]));
+        return team;
+    }
+    teamsOf(userId) {
+        const out = [];
+        for (const [teamId, m] of this.memberships) {
+            const mine = m.get(userId);
+            if (mine)
+                out.push({ ...this.team(teamId), role: mine.role });
+        }
+        return out;
+    }
+    registerDevice(userId, input) {
+        if (!input.sealPub || !input.signPub)
+            throw new HubError("a device needs both public keys");
+        const existing = [...this.devices.values()].find((d) => d.userId === userId && d.signPub === input.signPub);
+        if (existing)
+            return existing;
+        const d = {
+            id: id("d"),
+            userId,
+            label: input.label.slice(0, 60) || "device",
+            sealPub: input.sealPub,
+            signPub: input.signPub,
+            createdAt: this.now(),
+        };
+        this.devices.set(d.id, d);
+        return d;
+    }
+    device(deviceId, userId) {
+        const d = this.devices.get(deviceId);
+        if (!d || d.userId !== userId)
+            throw new HubError("that device isn't yours", 403);
+        return d;
+    }
+    createInvite(userId, teamId, ttlMs) {
+        this.requireRole(teamId, userId, "member");
+        // null / NaN arrive from JSON callers; either means "the default", never the floor.
+        if (typeof ttlMs !== "number" || !Number.isFinite(ttlMs))
+            ttlMs = INVITE_TTL_MS;
+        const invite = crypto.randomBytes(18).toString("base64url");
+        const expiresAt = this.now() + Math.min(Math.max(ttlMs, 60_000), 7 * INVITE_TTL_MS);
+        this.invites.set(invite, { teamId, createdBy: userId, expiresAt });
+        return { invite, expiresAt };
+    }
+    redeemInvite(userId, invite) {
+        const inv = this.invites.get(invite);
+        if (!inv || inv.usedBy || inv.expiresAt < this.now())
+            throw new HubError("this invite is invalid, used or expired", 403);
+        inv.usedBy = userId;
+        const m = this.memberships.get(inv.teamId);
+        if (!m.has(userId)) {
+            m.set(userId, { role: "member", joinedAt: this.now() });
+            // `invite` names which invite was used (a hash, never the token), so the
+            // inviter's Loom gives repo access to the person *that* link went to
+            this.appendFeedRaw(inv.teamId, null, { type: "member_joined", meta: { github: this.user(userId).github, invite: inviteTag(invite) } });
+        }
+        return { team: this.team(inv.teamId), role: m.get(userId).role };
+    }
+    members(userId, teamId) {
+        this.requireRole(teamId, userId, "viewer");
+        return [...this.memberships.get(teamId).entries()].map(([uid, m]) => ({
+            user: this.user(uid),
+            role: m.role,
+            joinedAt: m.joinedAt,
+            devices: [...this.devices.values()].filter((d) => d.userId === uid),
+        }));
+    }
+    removeMember(userId, teamId, target) {
+        const self = target === userId;
+        if (!self)
+            this.requireRole(teamId, userId, "owner");
+        const m = this.memberships.get(teamId);
+        if (!m?.has(target))
+            throw new HubError("not a member", 404);
+        const owners = [...m.values()].filter((x) => x.role === "owner").length;
+        if (m.get(target).role === "owner" && owners === 1)
+            throw new HubError("the last owner can't leave — hand ownership over first");
+        // Announce first, while the leaver can still hear it — otherwise their
+        // daemon never learns it was removed and keeps showing a team it's not in.
+        this.appendFeedRaw(teamId, null, { type: "member_left", meta: { github: this.user(target).github, rotateKey: true } });
+        m.delete(target);
+        // Their devices lose every envelope in this team; rotation (D6) is the
+        // owner's next step, and the feed says so.
+        for (const d of this.devices.values())
+            if (d.userId === target)
+                this.envelopes.delete(`${teamId}/${d.id}`);
+        for (const [k, p] of this.presenceByTeam.get(teamId) ?? [])
+            if (p.userId === target)
+                this.presenceByTeam.get(teamId).delete(k);
+        for (const [k, l] of this.leasesByTeam.get(teamId) ?? [])
+            if (l.userId === target)
+                this.leasesByTeam.get(teamId).delete(k);
+    }
+    // ── leases (Phase 2) ──
+    withStale(l) {
+        return { ...l, stale: this.now() - l.ts > LEASE_TTL_MS };
+    }
+    /**
+     * Everyone's live (non-stale) leases in a repo, except this user's own run.
+     * Matching on the run alone let anyone dodge a rival's lease by reusing its
+     * run id.
+     */
+    rivals(teamId, repo, exceptRun, userId) {
+        return [...(this.leasesByTeam.get(teamId)?.values() ?? [])]
+            .map((l) => this.withStale(l))
+            .filter((l) => l.repo === repo && !(l.runId === exceptRun && l.userId === userId) && !l.stale);
+    }
+    judge(teamId, repo, runId, scope, hardZones, userId) {
+        const rivals = this.rivals(teamId, repo, runId, userId);
+        const overlaps = rivals
+            .map((l) => ({ lease: l, paths: overlap(scope, l) }))
+            .filter((o) => o.paths.length > 0);
+        // D31: in a hard zone, any rival lease inside the same zone refuses the claim.
+        const zone = zoneOf(scope, hardZones);
+        if (zone) {
+            const holder = rivals.find((l) => zoneOf(l, [zone]) === zone);
+            if (holder)
+                return { overlaps, blockedBy: { lease: holder, zone } };
+        }
+        return { overlaps };
+    }
+    claimLease(userId, teamId, c) {
+        this.requireRole(teamId, userId, "member");
+        this.device(c.deviceId, userId);
+        const repo = normalizeRepo(c.repo);
+        if (!this.reposByTeam.get(teamId)?.has(repo))
+            throw new HubError(`${repo} isn't shared with this team`, 403);
+        const scope = { globs: c.globs.slice(0, 50), files: c.files.slice(0, 500), prefixes: c.prefixes.slice(0, 50) };
+        const verdict = this.judge(teamId, repo, c.runId, scope, c.hardZones, userId);
+        if (verdict.blockedBy)
+            return { lease: null, ...verdict };
+        const map = this.leasesByTeam.get(teamId) ?? new Map();
+        // one lease per (run, task): a re-claim replaces the old one
+        const existing = [...map.values()].find((l) => l.userId === userId && l.runId === c.runId && l.taskId === c.taskId);
+        const lease = {
+            ...scope,
+            id: existing?.id ?? id("l"),
+            teamId,
+            userId,
+            github: this.user(userId).github,
+            deviceId: c.deviceId,
+            repo,
+            runId: c.runId,
+            taskId: c.taskId,
+            state: "active",
+            ...(c.sealed ? { sealed: c.sealed } : {}),
+            since: existing?.since ?? this.now(),
+            ts: this.now(),
+        };
+        map.set(lease.id, lease);
+        this.leasesByTeam.set(teamId, map);
+        this.emit(teamId, { type: "lease", teamId, lease: this.withStale(lease) });
+        return { lease: this.withStale(lease), ...verdict };
+    }
+    ownLease(userId, teamId, leaseId) {
+        this.requireRole(teamId, userId, "member");
+        const l = this.leasesByTeam.get(teamId)?.get(leaseId);
+        if (!l || l.userId !== userId)
+            throw new HubError("that lease isn't yours", 403);
+        return l;
+    }
+    extendLease(userId, teamId, leaseId, scope, hardZones) {
+        const l = this.ownLease(userId, teamId, leaseId);
+        const wider = {
+            globs: [...new Set([...l.globs, ...scope.globs])].slice(0, 50),
+            files: [...new Set([...l.files, ...scope.files])].slice(0, 500),
+            prefixes: [...new Set([...l.prefixes, ...scope.prefixes])].slice(0, 50),
+        };
+        // only the NEW part is judged — what was already held stays held
+        const verdict = this.judge(teamId, l.repo, l.runId, scope, hardZones, userId);
+        if (verdict.blockedBy)
+            return { lease: null, ...verdict };
+        Object.assign(l, wider, { ts: this.now() });
+        this.emit(teamId, { type: "lease", teamId, lease: this.withStale(l) });
+        return { lease: this.withStale(l), ...verdict };
+    }
+    renewLeases(userId, teamId, deviceId) {
+        this.requireRole(teamId, userId, "member");
+        this.device(deviceId, userId);
+        let n = 0;
+        for (const l of this.leasesByTeam.get(teamId)?.values() ?? []) {
+            if (l.userId === userId && l.deviceId === deviceId) {
+                l.ts = this.now();
+                n++;
+            }
+        }
+        return n;
+    }
+    setRunLeaseState(userId, teamId, runId, state) {
+        this.requireRole(teamId, userId, "member");
+        let n = 0;
+        for (const l of this.leasesByTeam.get(teamId)?.values() ?? []) {
+            if (l.userId === userId && l.runId === runId && l.state !== state) {
+                l.state = state;
+                l.ts = this.now();
+                this.emit(teamId, { type: "lease", teamId, lease: this.withStale(l) });
+                n++;
+            }
+        }
+        return n;
+    }
+    releaseLeases(userId, teamId, runId, reason) {
+        this.requireRole(teamId, userId, "member");
+        const map = this.leasesByTeam.get(teamId);
+        const gone = [...(map?.values() ?? [])].filter((l) => l.userId === userId && l.runId === runId);
+        if (!gone.length)
+            return 0;
+        for (const l of gone)
+            map.delete(l.id);
+        this.emit(teamId, { type: "lease_gone", teamId, leaseIds: gone.map((l) => l.id), runId });
+        this.appendFeedRaw(teamId, userId, {
+            type: "lease_released",
+            repo: gone[0].repo,
+            meta: { runId, leases: gone.length, reason: reason.slice(0, 120) },
+        });
+        return gone.length;
+    }
+    // ── team memories (Phase 3) ──
+    mem(teamId) {
+        let m = this.memoriesByTeam.get(teamId);
+        if (!m)
+            this.memoriesByTeam.set(teamId, (m = new Map()));
+        return m;
+    }
+    publishMemory(userId, teamId, m) {
+        this.requireRole(teamId, userId, "member");
+        this.device(m.deviceId, userId);
+        const repo = normalizeRepo(m.repo);
+        if (!this.reposByTeam.get(teamId)?.has(repo))
+            throw new HubError(`${repo} isn't shared with this team`, 403);
+        if (!/^[A-Za-z0-9_-]{4,64}$/.test(m.id))
+            throw new HubError("bad memory id");
+        if (!m.hmac || !m.sealed?.c)
+            throw new HubError("a team memory needs its hmac and sealed content");
+        const github = this.user(userId).github;
+        const map = this.mem(teamId);
+        const own = map.get(m.id);
+        if (own && own.authorId !== userId)
+            throw new HubError("that memory id belongs to someone else", 403);
+        const twin = [...map.values()].find((x) => x.repo === repo && x.hmac === m.hmac && x.state === "live" && x.id !== m.id);
+        if (twin && !own) {
+            if (!twin.confirmedBy.includes(github))
+                twin.confirmedBy.push(github);
+            twin.updatedAt = this.now();
+            this.emit(teamId, { type: "memory", teamId, memory: { ...twin } });
+            return { memory: { ...twin }, merged: true };
+        }
+        if (m.supersedes && !map.has(m.supersedes))
+            throw new HubError(`no team memory "${m.supersedes}" to supersede`, 404);
+        const tm = {
+            id: m.id,
+            teamId,
+            repo,
+            authorId: userId,
+            author: github,
+            hmac: m.hmac,
+            sealed: m.sealed,
+            state: "live",
+            ...(m.supersedes ? { supersedes: m.supersedes } : {}),
+            confirmedBy: own?.confirmedBy ?? [github],
+            createdAt: own?.createdAt ?? this.now(),
+            updatedAt: this.now(),
+        };
+        map.set(tm.id, tm);
+        this.emit(teamId, { type: "memory", teamId, memory: { ...tm } });
+        return { memory: { ...tm }, merged: false };
+    }
+    ownMemory(userId, teamId, id) {
+        this.requireRole(teamId, userId, "member");
+        const m = this.mem(teamId).get(id);
+        if (!m)
+            throw new HubError(`no team memory "${id}"`, 404);
+        if (m.authorId !== userId)
+            throw new HubError("only its author can change a memory — record a correction instead", 403);
+        return m;
+    }
+    updateTeamMemory(userId, teamId, id, patch) {
+        const m = this.ownMemory(userId, teamId, id);
+        m.hmac = patch.hmac;
+        m.sealed = patch.sealed;
+        m.updatedAt = this.now();
+        this.emit(teamId, { type: "memory", teamId, memory: { ...m } });
+        return { ...m };
+    }
+    forgetTeamMemory(userId, teamId, id, reason) {
+        const m = this.ownMemory(userId, teamId, id);
+        m.state = "forgotten";
+        m.resolvedReason = reason.slice(0, 200);
+        m.updatedAt = this.now();
+        this.emit(teamId, { type: "memory", teamId, memory: { ...m } });
+    }
+    resolveMemories(userId, teamId, winnerId, loserId, reason) {
+        this.requireRole(teamId, userId, "member");
+        const map = this.mem(teamId);
+        const winner = map.get(winnerId);
+        const loser = map.get(loserId);
+        if (!winner || !loser)
+            throw new HubError("both memories must exist", 404);
+        if (winnerId === loserId)
+            throw new HubError("a memory can't supersede itself");
+        loser.state = "superseded";
+        loser.supersededBy = winnerId;
+        loser.resolvedBy = this.user(userId).github;
+        loser.resolvedReason = reason.slice(0, 200);
+        loser.updatedAt = this.now();
+        // the winner inherits the loser's confirmations: they agreed on the topic
+        for (const g of loser.confirmedBy)
+            if (!winner.confirmedBy.includes(g))
+                winner.confirmedBy.push(g);
+        winner.updatedAt = this.now();
+        this.emit(teamId, { type: "memory", teamId, memory: { ...loser } });
+        this.emit(teamId, { type: "memory", teamId, memory: { ...winner } });
+        this.appendFeedRaw(teamId, userId, {
+            type: "memory_resolved",
+            repo: loser.repo,
+            meta: { winner: winnerId, loser: loserId, reason: reason.slice(0, 200) },
+        });
+        return { ...loser };
+    }
+    teamMemories(userId, teamId, repo, opts = {}) {
+        this.requireRole(teamId, userId, "viewer");
+        const r = normalizeRepo(repo);
+        return [...this.mem(teamId).values()]
+            .filter((m) => m.repo === r && (opts.history || m.state === "live"))
+            .map((m) => ({ ...m, confirmedBy: [...m.confirmedBy] }));
+    }
+    // ── runners and jobs (Phase 5) ──
+    registerRunner(userId, input) {
+        const d = this.device(input.deviceId, userId);
+        const r = {
+            deviceId: d.id,
+            userId,
+            github: this.user(userId).github,
+            label: d.label,
+            kinds: [...new Set(input.kinds.map(String))].slice(0, 20),
+            shared: Boolean(input.shared),
+            capacity: Math.max(1, Math.min(8, Math.floor(input.capacity ?? 1))),
+            lastSeen: this.now(),
+        };
+        this.runnersByDevice.set(d.id, r);
+        return { ...r };
+    }
+    runners(userId, teamId) {
+        this.requireRole(teamId, userId, "viewer");
+        const members = this.memberships.get(teamId) ?? new Map();
+        return [...this.runnersByDevice.values()].filter((r) => members.has(r.userId)).map((r) => ({ ...r }));
+    }
+    revokeDevice(userId, deviceId) {
+        this.device(deviceId, userId);
+        this.devices.delete(deviceId);
+        this.runnersByDevice.delete(deviceId);
+        for (const k of [...this.envelopes.keys()])
+            if (k.endsWith(`/${deviceId}`))
+                this.envelopes.delete(k);
+    }
+    jobMap(teamId) {
+        let m = this.jobsByTeam.get(teamId);
+        if (!m)
+            this.jobsByTeam.set(teamId, (m = new Map()));
+        return m;
+    }
+    /** May this runner take this job? Its owner's jobs, or anyone's when shared (D68). */
+    eligible(r, j) {
+        if (j.target)
+            return j.target === r.deviceId;
+        return j.userId === r.userId || r.shared;
+    }
+    createJob(userId, teamId, j) {
+        this.requireRole(teamId, userId, "member");
+        this.device(j.deviceId, userId);
+        const repo = normalizeRepo(j.repo);
+        if (!this.reposByTeam.get(teamId)?.has(repo))
+            throw new HubError(`${repo} isn't shared with this team`, 403);
+        if (!["start", "continue", "fix", "return", "land"].includes(j.kind))
+            throw new HubError("bad job kind");
+        if (!j.sealed?.c)
+            throw new HubError("a job needs its sealed payload");
+        if (j.target) {
+            const r = this.runnersByDevice.get(j.target);
+            const members = this.memberships.get(teamId);
+            if (!r || !members?.has(r.userId))
+                throw new HubError("no such runner on this team", 404);
+            if (r.userId !== userId && !r.shared)
+                throw new HubError("that runner isn't shared", 403);
+        }
+        const job = {
+            id: id("j"),
+            teamId,
+            repo,
+            kind: j.kind,
+            userId,
+            github: this.user(userId).github,
+            ...(j.target ? { target: j.target } : {}),
+            state: "queued",
+            sealed: j.sealed,
+            createdAt: this.now(),
+            updatedAt: this.now(),
+        };
+        this.jobMap(teamId).set(job.id, job);
+        this.emit(teamId, { type: "job", teamId, job: { ...job } });
+        return { ...job };
+    }
+    claimJob(userId, teamId, runnerDeviceId, instantOnly = false) {
+        this.requireRole(teamId, userId, "member");
+        this.device(runnerDeviceId, userId);
+        const r = this.runnersByDevice.get(runnerDeviceId);
+        if (!r)
+            throw new HubError("that device isn't a runner — register it first", 403);
+        r.lastSeen = this.now();
+        const now = this.now();
+        const open = [...this.jobMap(teamId).values()]
+            .filter((j) => j.state === "queued" || (j.state === "claimed" && now - (j.heartbeatAt ?? 0) > JOB_TTL_MS))
+            .filter((j) => this.eligible(r, j))
+            .filter((j) => !instantOnly || j.kind === "return" || j.kind === "land")
+            .sort((a, b) => a.createdAt - b.createdAt);
+        const j = open[0];
+        if (!j)
+            return null;
+        Object.assign(j, { state: "claimed", runnerId: r.deviceId, runnerGithub: r.github, claimedAt: now, heartbeatAt: now, updatedAt: now });
+        this.emit(teamId, { type: "job", teamId, job: { ...j } });
+        return { ...j };
+    }
+    heldJob(userId, teamId, jobId, runnerDeviceId) {
+        this.requireRole(teamId, userId, "member");
+        this.device(runnerDeviceId, userId);
+        const j = this.jobMap(teamId).get(jobId);
+        if (!j)
+            throw new HubError(`no job "${jobId}"`, 404);
+        if (j.runnerId !== runnerDeviceId || j.state !== "claimed")
+            throw new HubError("that runner doesn't hold this job", 409);
+        return j;
+    }
+    heartbeatJob(userId, teamId, jobId, runnerDeviceId, progress) {
+        const j = this.heldJob(userId, teamId, jobId, runnerDeviceId);
+        j.heartbeatAt = this.now();
+        j.updatedAt = this.now();
+        if (progress)
+            j.progress = progress;
+        const r = this.runnersByDevice.get(runnerDeviceId);
+        if (r)
+            r.lastSeen = this.now();
+        this.emit(teamId, { type: "job", teamId, job: { ...j } });
+        return { ...j };
+    }
+    finishJob(userId, teamId, jobId, runnerDeviceId, outcome) {
+        const j = this.heldJob(userId, teamId, jobId, runnerDeviceId);
+        if (outcome.state !== "done" && outcome.state !== "failed")
+            throw new HubError("a job finishes done or failed");
+        j.state = outcome.state;
+        if (outcome.result)
+            j.result = outcome.result;
+        if (outcome.error)
+            j.error = outcome.error.slice(0, 500);
+        j.updatedAt = this.now();
+        this.emit(teamId, { type: "job", teamId, job: { ...j } });
+        return { ...j };
+    }
+    cancelJob(userId, teamId, jobId) {
+        this.requireRole(teamId, userId, "member");
+        const j = this.jobMap(teamId).get(jobId);
+        if (!j)
+            throw new HubError(`no job "${jobId}"`, 404);
+        if (j.userId !== userId)
+            throw new HubError("only whoever asked can cancel a job", 403);
+        if (j.state === "done" || j.state === "failed")
+            return { ...j };
+        j.state = "cancelled";
+        j.updatedAt = this.now();
+        this.emit(teamId, { type: "job", teamId, job: { ...j } });
+        return { ...j };
+    }
+    jobs(userId, teamId, opts = {}) {
+        this.requireRole(teamId, userId, "viewer");
+        return [...this.jobMap(teamId).values()]
+            .filter((j) => !opts.active || j.state === "queued" || j.state === "claimed")
+            .sort((a, b) => a.createdAt - b.createdAt)
+            .map((j) => ({ ...j }));
+    }
+    // ── GitHub webhooks (Phase 6, D83) ──
+    webhookSecret(userId, teamId, rotate = false) {
+        this.team(teamId);
+        this.requireRole(teamId, userId, "owner");
+        let secret = this.webhookSecrets.get(teamId);
+        if (!secret || rotate) {
+            secret = crypto.randomBytes(32).toString("hex");
+            this.webhookSecrets.set(teamId, secret);
+        }
+        return { secret };
+    }
+    /** The receiver's side (no session): the secret to verify a delivery against; null for no such team, or none set. */
+    webhookSecretOf(teamId) {
+        return this.teamsById.has(teamId) ? (this.webhookSecrets.get(teamId) ?? null) : null;
+    }
+    /**
+     * A verified delivery: its events, for repos this team shares only, appended
+     * as system events (no member). Returns how many were new — the rest were
+     * already in the feed (polled first, or a redelivery).
+     */
+    receiveGithubWebhook(teamId, event, payload) {
+        this.team(teamId);
+        const repos = [...(this.reposByTeam.get(teamId) ?? [])];
+        let n = 0;
+        for (const e of githubWebhookFeed(event, payload, repos))
+            if (this.appendFeedRaw(teamId, null, e))
+                n++;
+        return n;
+    }
+    leases(userId, teamId, repo) {
+        this.requireRole(teamId, userId, "viewer");
+        const r = repo ? normalizeRepo(repo) : null;
+        return [...(this.leasesByTeam.get(teamId)?.values() ?? [])]
+            .filter((l) => !r || l.repo === r)
+            .map((l) => this.withStale(l));
+    }
+    putKeyEnvelopes(userId, teamId, version, envs) {
+        const team = this.team(teamId);
+        this.requireRole(teamId, userId, "member");
+        if (version !== team.keyVersion && version !== team.keyVersion + 1) {
+            throw new HubError(`key version ${version} is stale (current ${team.keyVersion})`, 409);
+        }
+        // Rotation is an owner act; re-sealing the current key for a new device
+        // (a teammate's second laptop) is any member's.
+        if (version === team.keyVersion + 1)
+            this.requireRole(teamId, userId, "owner");
+        const members = this.memberships.get(teamId);
+        for (const e of envs) {
+            const d = this.devices.get(e.deviceId);
+            if (!d || !members.has(d.userId))
+                throw new HubError(`device ${e.deviceId} isn't on this team`, 400);
+            const k = `${teamId}/${e.deviceId}`;
+            const list = (this.envelopes.get(k) ?? []).filter((x) => x.version !== version);
+            list.push({ version, box: e.box });
+            this.envelopes.set(k, list);
+        }
+        if (version === team.keyVersion + 1) {
+            team.keyVersion = version;
+            this.appendFeedRaw(teamId, userId, { type: "key_rotated", meta: { version } });
+        }
+    }
+    keyEnvelopes(userId, teamId, deviceId) {
+        this.requireRole(teamId, userId, "viewer");
+        this.device(deviceId, userId);
+        return this.envelopes.get(`${teamId}/${deviceId}`) ?? [];
+    }
+    shareRepo(userId, teamId, repo) {
+        this.requireRole(teamId, userId, "member");
+        const r = normalizeRepo(repo);
+        const set = this.reposByTeam.get(teamId) ?? new Set();
+        if (set.has(r))
+            return;
+        set.add(r);
+        this.reposByTeam.set(teamId, set);
+        this.appendFeedRaw(teamId, userId, { type: "repo_shared", repo: r, meta: { repo: r } });
+    }
+    repos(userId, teamId) {
+        this.requireRole(teamId, userId, "viewer");
+        return [...(this.reposByTeam.get(teamId) ?? [])].sort();
+    }
+    presenceKey(p) {
+        return `${p.userId}/${p.deviceId}/${p.repo}/${p.agent}`;
+    }
+    heartbeat(userId, teamId, p) {
+        this.requireRole(teamId, userId, "member");
+        this.device(p.deviceId, userId);
+        const repo = normalizeRepo(p.repo);
+        if (!this.reposByTeam.get(teamId)?.has(repo))
+            throw new HubError(`${repo} isn't shared with this team`, 403);
+        const u = this.user(userId);
+        const full = {
+            ...p,
+            repo,
+            touches: (p.touches ?? []).slice(0, 50).map((t) => String(t).slice(0, 200)),
+            teamId,
+            userId,
+            github: u.github,
+            ts: this.now(),
+        };
+        const map = this.presenceByTeam.get(teamId) ?? new Map();
+        map.set(this.presenceKey(full), full);
+        this.presenceByTeam.set(teamId, map);
+        this.emit(teamId, { type: "presence", teamId, presence: full });
+    }
+    clearPresence(userId, teamId, key) {
+        this.requireRole(teamId, userId, "member");
+        const repo = normalizeRepo(key.repo);
+        const k = this.presenceKey({ userId, deviceId: key.deviceId, agent: key.agent, repo });
+        if (this.presenceByTeam.get(teamId)?.delete(k)) {
+            this.emit(teamId, { type: "presence_gone", teamId, userId, deviceId: key.deviceId, agent: key.agent, repo });
+        }
+    }
+    presence(userId, teamId) {
+        this.requireRole(teamId, userId, "viewer");
+        const cutoff = this.now() - PRESENCE_TTL_MS;
+        return [...(this.presenceByTeam.get(teamId)?.values() ?? [])].filter((p) => p.ts >= cutoff);
+    }
+    appendFeed(userId, teamId, e) {
+        this.requireRole(teamId, userId, "member");
+        if (e.deviceId)
+            this.device(e.deviceId, userId);
+        if (e.type === "crew_request" || e.type === "crew_request_answered") {
+            const id = e.meta.requestId;
+            if (typeof id !== "string" || !/^[a-zA-Z0-9-]{1,80}$/.test(id))
+                throw new HubError("invalid crew request id", 400);
+            const request = (this.feedByTeam.get(teamId) ?? []).find(f => f.type === "crew_request" && f.meta.requestId === id);
+            if (e.type === "crew_request") {
+                if (e.dedupeKey !== `crew-request:${id}`)
+                    throw new HubError("invalid crew request dedupe key", 400);
+                if (!e.repo || !this.reposByTeam.get(teamId)?.has(normalizeRepo(e.repo)))
+                    throw new HubError("request repo is not shared with this team", 403);
+                const owner = this.members(userId, teamId).find(m => m.user.github.toLowerCase() === String(e.meta.owner).toLowerCase());
+                if (!owner || owner.role === "viewer")
+                    throw new HubError("the requested owner is not an active team member", 403);
+                for (const field of ["crew", "teammate"])
+                    if (typeof e.meta[field] !== "string" || !/^[a-z0-9][a-z0-9-]{0,40}$/.test(String(e.meta[field])))
+                        throw new HubError(`invalid ${field}`, 400);
+                const expiry = Number(e.meta.expiresAt);
+                if (!Number.isFinite(expiry) || expiry <= this.now() || expiry > this.now() + 7 * 86400000)
+                    throw new HubError("crew request expiry must be within seven days", 400);
+                if (!e.sealed || JSON.stringify(e.sealed).length > 16000)
+                    throw new HubError("crew request text must be sealed and bounded", 400);
+                if (request && (request.userId !== userId || JSON.stringify(request.meta) !== JSON.stringify(e.meta) || JSON.stringify(request.sealed) !== JSON.stringify(e.sealed)))
+                    throw new HubError("crew request id already belongs to another request", 409);
+            }
+            else {
+                if (!request || request.repo !== e.repo)
+                    throw new HubError("crew request not found", 404);
+                if (String(request.meta.owner).toLowerCase() !== this.user(userId).github.toLowerCase())
+                    throw new HubError("only the requested crew's owner may answer", 403);
+                if (e.meta.state !== "accepted" && e.meta.state !== "declined")
+                    throw new HubError("answer must accept or decline", 400);
+                if (e.dedupeKey !== `crew-answer:${id}`)
+                    throw new HubError("invalid crew answer dedupe key", 400);
+                const previous = (this.feedByTeam.get(teamId) ?? []).find(f => f.type === "crew_request_answered" && f.meta.requestId === id);
+                if (previous && previous.meta.state !== e.meta.state)
+                    throw new HubError("this request has already been answered", 409);
+                if (!previous && Number(request.meta.expiresAt) <= this.now())
+                    throw new HubError("crew request expired", 409);
+            }
+        }
+        return this.appendFeedRaw(teamId, userId, e);
+    }
+    appendFeedRaw(teamId, userId, e) {
+        if (e.dedupeKey) {
+            const k = `${teamId}/${e.dedupeKey}`;
+            if (this.dedupe.has(k))
+                return null;
+            this.dedupe.add(k);
+        }
+        const ev = {
+            ...e,
+            ...(e.repo ? { repo: normalizeRepo(e.repo) } : {}),
+            id: ++this.feedSeq,
+            teamId,
+            userId,
+            github: userId ? this.user(userId).github : null,
+            ts: this.now(),
+        };
+        const list = this.feedByTeam.get(teamId) ?? [];
+        list.push(ev);
+        if (list.length > 5000)
+            list.splice(0, list.length - 5000);
+        this.feedByTeam.set(teamId, list);
+        this.emit(teamId, { type: "feed", teamId, event: ev });
+        return ev;
+    }
+    feed(userId, teamId, opts = {}) {
+        this.requireRole(teamId, userId, "viewer");
+        const list = (this.feedByTeam.get(teamId) ?? []).filter((e) => e.id > (opts.since ?? 0));
+        return list.slice(-Math.min(opts.limit ?? 200, 1000));
+    }
+    subscribe(userId, teamId, cb) {
+        this.requireRole(teamId, userId, "viewer");
+        const set = this.listeners.get(teamId) ?? new Set();
+        // A removed member stops hearing the team the moment they're removed.
+        const guarded = (e) => {
+            if (this.role(teamId, userId))
+                cb(e);
+        };
+        set.add(guarded);
+        this.listeners.set(teamId, set);
+        return () => set.delete(guarded);
+    }
+    emit(teamId, e) {
+        for (const l of this.listeners.get(teamId) ?? []) {
+            try {
+                l(e);
+            }
+            catch {
+                /* one bad listener never breaks the hub */
+            }
+        }
+    }
+}
+class MemoryHubClient {
+    hub;
+    userId;
+    constructor(hub, userId) {
+        this.hub = hub;
+        this.userId = userId;
+    }
+    run(fn) {
+        try {
+            return Promise.resolve(fn());
+        }
+        catch (err) {
+            return Promise.reject(err);
+        }
+    }
+    me() {
+        return this.run(() => this.hub.user(this.userId));
+    }
+    createTeam(name) {
+        return this.run(() => this.hub.createTeam(this.userId, name));
+    }
+    teams() {
+        return this.run(() => this.hub.teamsOf(this.userId));
+    }
+    registerDevice(input) {
+        return this.run(() => this.hub.registerDevice(this.userId, input));
+    }
+    createInvite(teamId, ttlMs) {
+        return this.run(() => this.hub.createInvite(this.userId, teamId, ttlMs));
+    }
+    redeemInvite(invite) {
+        return this.run(() => this.hub.redeemInvite(this.userId, invite));
+    }
+    members(teamId) {
+        return this.run(() => this.hub.members(this.userId, teamId));
+    }
+    removeMember(teamId, userId) {
+        return this.run(() => this.hub.removeMember(this.userId, teamId, userId));
+    }
+    putKeyEnvelopes(teamId, version, envelopes) {
+        return this.run(() => this.hub.putKeyEnvelopes(this.userId, teamId, version, envelopes));
+    }
+    keyEnvelopes(teamId, deviceId) {
+        return this.run(() => this.hub.keyEnvelopes(this.userId, teamId, deviceId));
+    }
+    shareRepo(teamId, repo) {
+        return this.run(() => this.hub.shareRepo(this.userId, teamId, repo));
+    }
+    repos(teamId) {
+        return this.run(() => this.hub.repos(this.userId, teamId));
+    }
+    heartbeat(teamId, p) {
+        return this.run(() => this.hub.heartbeat(this.userId, teamId, p));
+    }
+    clearPresence(teamId, key) {
+        return this.run(() => this.hub.clearPresence(this.userId, teamId, key));
+    }
+    presence(teamId) {
+        return this.run(() => this.hub.presence(this.userId, teamId));
+    }
+    appendFeed(teamId, e) {
+        return this.run(() => this.hub.appendFeed(this.userId, teamId, e));
+    }
+    feed(teamId, opts) {
+        return this.run(() => this.hub.feed(this.userId, teamId, opts));
+    }
+    subscribe(teamId, cb) {
+        return this.run(() => this.hub.subscribe(this.userId, teamId, cb));
+    }
+    claimLease(teamId, c) {
+        return this.run(() => this.hub.claimLease(this.userId, teamId, c));
+    }
+    extendLease(teamId, leaseId, scope, hardZones) {
+        return this.run(() => this.hub.extendLease(this.userId, teamId, leaseId, scope, hardZones));
+    }
+    renewLeases(teamId, deviceId) {
+        return this.run(() => this.hub.renewLeases(this.userId, teamId, deviceId));
+    }
+    setRunLeaseState(teamId, runId, state) {
+        return this.run(() => this.hub.setRunLeaseState(this.userId, teamId, runId, state));
+    }
+    releaseLeases(teamId, runId, reason) {
+        return this.run(() => this.hub.releaseLeases(this.userId, teamId, runId, reason));
+    }
+    leases(teamId, repo) {
+        return this.run(() => this.hub.leases(this.userId, teamId, repo));
+    }
+    publishMemory(teamId, m) {
+        return this.run(() => this.hub.publishMemory(this.userId, teamId, m));
+    }
+    updateTeamMemory(teamId, id, patch) {
+        return this.run(() => this.hub.updateTeamMemory(this.userId, teamId, id, patch));
+    }
+    forgetTeamMemory(teamId, id, reason) {
+        return this.run(() => this.hub.forgetTeamMemory(this.userId, teamId, id, reason));
+    }
+    resolveMemories(teamId, winnerId, loserId, reason) {
+        return this.run(() => this.hub.resolveMemories(this.userId, teamId, winnerId, loserId, reason));
+    }
+    teamMemories(teamId, repo, opts) {
+        return this.run(() => this.hub.teamMemories(this.userId, teamId, repo, opts));
+    }
+    registerRunner(input) {
+        return this.run(() => this.hub.registerRunner(this.userId, input));
+    }
+    runners(teamId) {
+        return this.run(() => this.hub.runners(this.userId, teamId));
+    }
+    revokeDevice(deviceId) {
+        return this.run(() => this.hub.revokeDevice(this.userId, deviceId));
+    }
+    createJob(teamId, j) {
+        return this.run(() => this.hub.createJob(this.userId, teamId, j));
+    }
+    claimJob(teamId, runnerDeviceId, instantOnly = false) {
+        return this.run(() => this.hub.claimJob(this.userId, teamId, runnerDeviceId, instantOnly));
+    }
+    heartbeatJob(teamId, jobId, runnerDeviceId, progress) {
+        return this.run(() => this.hub.heartbeatJob(this.userId, teamId, jobId, runnerDeviceId, progress));
+    }
+    finishJob(teamId, jobId, runnerDeviceId, outcome) {
+        return this.run(() => this.hub.finishJob(this.userId, teamId, jobId, runnerDeviceId, outcome));
+    }
+    cancelJob(teamId, jobId) {
+        return this.run(() => this.hub.cancelJob(this.userId, teamId, jobId));
+    }
+    jobs(teamId, opts) {
+        return this.run(() => this.hub.jobs(this.userId, teamId, opts));
+    }
+    webhookSecret(teamId, rotate) {
+        return this.run(() => this.hub.webhookSecret(this.userId, teamId, rotate));
+    }
+}
+function id(prefix) {
+    return `${prefix}_${crypto.randomBytes(8).toString("hex")}`;
+}
+//# sourceMappingURL=team-hub.js.map