heyquilt 0.3.119 → 0.3.120

package/src/quilts/store-memory.js

@@ -19,6 +19,16 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     slugs: new Map(), // owner + slug → quilt id
     members: new Map(), // quilt + member → { level }
     lines: new Map(), // quilt + name → line
+    live: new Map(), // square id → its shared uncommitted work { head, changes, actor, at }
+    reviews: new Map(), // quilt → review rows (13), oldest first
+    signingKeys: new Map(), // key id → { id, member, public_key, name, added_at, removed_at }
+    signatures: new Map(), // quilt + commit → signature rows
+    tokens: new Map(), // token id → { id, quilt_id, name, level, hash, created_by, created_at, revoked_at } (tokens.js)
+    lineRules: new Map(), // quilt → Map of line → { line, approvals, checks }
+    squareChecks: new Map(), // square → Map of check name → its latest report
+    claims: new Map(), // quilt → Map of claim id → claim (06: rows, not log entries)
+    resolutions: new Map(), // quilt → Map of key → remembered resolution (07, D12)
+    tags: new Map(), // quilt + name → tag (06: never moved or deleted)
     squares: new Map(), // id → square
     commits: new Map(), // quilt + id → commit row
     bySeq: new Map(), // quilt + seq → commit id
@@ -44,6 +54,7 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     byMember: new Map(), // member → Set of quilt ids
     quiltMembers: new Map(), // quilt → Set of member ids
     quiltLines: new Map(), // quilt → Set of line names
+    quiltTags: new Map(), // quilt → Set of tag names
     quiltSquares: new Map(), // quilt → Set of square ids
     squareCommitIds: new Map(), // square → [commit ids] in seq order
     squareTail: new Map(), // quilt + last 4 hex digits of the id → Set of square ids
@@ -311,6 +322,120 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
       if (sub) t.webhooks.set(k(q, m), { ...sub }); else t.webhooks.delete(k(q, m))
       return sub ? { ...sub } : null
     },
+    // A new line (release/<name>) starting at a commit: its next merge is patch 1.
+    createLine ({ quilt_id: q, name, tip, actor, at }) {
+      quiltRow(q)
+      if (t.lines.has(k(q, name))) throw new StoreError('line_exists', `there is already a line ${name}`)
+      if (tip && !t.commits.has(k(q, tip))) throw new StoreError('not_found', 'no such commit')
+      const row = appendLog(q, { kind: 'policy', line: name, actor, at, payload: { op: 'line', tip: tip || null } })
+      t.lines.set(k(q, name), { quilt_id: q, name, tip: tip || null, tip_seq: row.seq, patch_count: 0, frozen: false, updated_at: at })
+      addTo(t.quiltLines, q, name)
+      return clone(t.lines.get(k(q, name)))
+    },
+    // A tag (or a release: a tag with notes) on a commit; a name is taken once, for good.
+    createTag ({ quilt_id: q, name, commit, release = false, notes = null, actor, at }) {
+      quiltRow(q)
+      if (t.tags.has(k(q, name))) throw new StoreError('tag_exists', `there is already a tag ${name}`)
+      if (!t.commits.has(k(q, commit))) throw new StoreError('not_found', 'no such commit')
+      const row = appendLog(q, { kind: 'release', commit, actor, at, payload: { op: release ? 'release' : 'tag', name, ...(release ? { notes } : {}) } })
+      t.tags.set(k(q, name), { quilt_id: q, name, commit, release: !!release, notes: release ? notes : null, actor, at, seq: row.seq })
+      addTo(t.quiltTags, q, name)
+      return clone(t.tags.get(k(q, name)))
+    },
+    // A member's Ed25519 public key (signing.js): removed, never deleted.
+    addSigningKey (r) {
+      const had = t.signingKeys.get(r.id)
+      if (had && !had.removed_at) throw new StoreError('key_exists', had.member === r.member ? 'you already added this key' : 'this key is someone else\'s')
+      if (had && had.member !== r.member) throw new StoreError('key_exists', 'this key is someone else\'s')
+      t.signingKeys.set(r.id, { ...r, removed_at: null })
+      return clone(t.signingKeys.get(r.id))
+    },
+    removeSigningKey ({ id, member, at }) {
+      const row = t.signingKeys.get(id)
+      if (!row || row.member !== member) throw new StoreError('not_found', 'no such key')
+      if (!row.removed_at) row.removed_at = at
+      return clone(row)
+    },
+    // A quilt token (tokens.js): a row and its membership token:<id>, made and ended together.
+    createToken (r) {
+      quiltRow(r.quilt_id)
+      if ([...t.tokens.values()].some((x) => x.hash === r.hash)) throw new StoreError('exists', 'this token exists')
+      t.tokens.set(r.id, { ...r, revoked_at: null })
+      const m = `token:${r.id}`
+      t.members.set(k(r.quilt_id, m), { quilt_id: r.quilt_id, member_id: m, level: r.level }); addTo(t.byMember, m, r.quilt_id); addTo(t.quiltMembers, r.quilt_id, m)
+      appendLog(r.quilt_id, { kind: 'policy', actor: r.created_by, at: r.created_at, payload: { op: 'token', token: r.id, name: r.name, level: r.level } })
+      return clone(t.tokens.get(r.id))
+    },
+    revokeToken ({ quilt_id: q, id, actor, at }) {
+      const row = t.tokens.get(id)
+      if (!row || row.quilt_id !== q) throw new StoreError('not_found', 'no such token')
+      if (!row.revoked_at) {
+        row.revoked_at = at
+        t.members.delete(k(q, `token:${id}`))
+        appendLog(q, { kind: 'policy', actor, at, payload: { op: 'revoke_token', token: id } })
+      }
+      return clone(row)
+    },
+    // A signature on a commit: one per (commit, key), kept for good.
+    addSignature (r) {
+      if (!t.commits.has(k(r.quilt_id, r.commit))) throw new StoreError('not_found', 'no such commit')
+      let a = t.signatures.get(k(r.quilt_id, r.commit)); if (!a) { a = []; t.signatures.set(k(r.quilt_id, r.commit), a) }
+      if (!a.some((x) => x.key === r.key)) a.push({ ...r })
+      return clone(r)
+    },
+    // A review row on a square (13): kept for good, never changed.
+    addReview (r) {
+      const row = t.squares.get(r.square_id)
+      if (!row || row.quilt_id !== r.quilt_id) throw new StoreError('not_found', 'no such square')
+      let a = t.reviews.get(r.quilt_id); if (!a) { a = []; t.reviews.set(r.quilt_id, a) }
+      a.push({ ...r })
+      return clone(r)
+    },
+    // What a line needs to take a merge (13): a number of approvals.
+    setLineRule ({ quilt_id: q, line, approvals, checks = [] }) {
+      if (!t.lines.has(k(q, line))) throw new StoreError('not_found', `no line ${line}`)
+      let m = t.lineRules.get(q); if (!m) { m = new Map(); t.lineRules.set(q, m) }
+      m.set(line, { line, approvals, checks: [...checks] })
+      return clone(m.get(line))
+    },
+    // A check's latest result on a square (13): one row per (square, check), replaced by each report.
+    setSquareCheck ({ quilt_id: q, square_id: sq, name, status, head, by, at }) {
+      const row = t.squares.get(sq)
+      if (!row || row.quilt_id !== q) throw new StoreError('not_found', 'no such square')
+      let m = t.squareChecks.get(sq); if (!m) { m = new Map(); t.squareChecks.set(sq, m) }
+      m.set(name, { name, status, head, by, at })
+      return clone(m.get(name))
+    },
+    // A claim on a square's files (06): a mutable row, not a log entry.
+    createClaim ({ quilt_id: q, id, square_id: sq, pattern, holder, note = '', at }) {
+      const row = t.squares.get(sq)
+      if (!row || row.quilt_id !== q) throw new StoreError('not_found', 'no such square')
+      let m = t.claims.get(q); if (!m) { m = new Map(); t.claims.set(q, m) }
+      m.set(id, { quilt_id: q, id, square_id: sq, pattern, holder, note, at })
+      return clone(m.get(id))
+    },
+    deleteClaim ({ quilt_id: q, id }) {
+      const m = t.claims.get(q)
+      if (!m || !m.has(id)) throw new StoreError('not_found', 'no such claim')
+      m.delete(id)
+      return { ok: true }
+    },
+    // A square's shared uncommitted work, replaced whole; no changes clears it. Not history: no log row.
+    setLive ({ quilt_id: q, square_id: sq, head = null, changes = [], actor, at }) {
+      const row = t.squares.get(sq)
+      if (!row || row.quilt_id !== q) throw new StoreError('not_found', 'no such square')
+      if (!changes.length) { t.live.delete(sq); return null }
+      t.live.set(sq, { quilt_id: q, square_id: sq, head, changes: clone(changes), actor, at })
+      return clone(t.live.get(sq))
+    },
+    // Freezes or unfreezes a line: a frozen line refuses merges (line_frozen).
+    setLineFrozen ({ quilt_id: q, name, frozen, actor, at }) {
+      const ln = t.lines.get(k(q, name))
+      if (!ln) throw new StoreError('not_found', `no line ${name}`)
+      appendLog(q, { kind: 'policy', line: name, actor, at, payload: { op: frozen ? 'freeze' : 'unfreeze' } })
+      Object.assign(ln, { frozen: !!frozen, updated_at: at })
+      return clone(ln)
+    },
     // The merge window's state on a line (07): current window, maximum, red checks.
     setLineWindow ({ quilt_id: q, line, merge_window: w, merge_window_max: m, red_checks: red }) {
       const ln = t.lines.get(k(q, line))
@@ -424,6 +549,32 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     async members (q) { return [...(t.quiltMembers.get(q) || [])].map((m) => t.members.get(k(q, m))).filter(Boolean).map(clone) },
     async getLine (q, name) { return clone(t.lines.get(k(q, name))) },
     async lines (q) { return [...(t.quiltLines.get(q) || [])].map((n) => t.lines.get(k(q, n))).filter(Boolean).map(clone) },
+    async getLive (q, sq) { const r = t.live.get(sq); return r && r.quilt_id === q ? clone(r) : null },
+    // A remembered resolution (07, D12): one row per conflict key, the latest answer wins.
+    setResolution (r) {
+      let m = t.resolutions.get(r.quilt_id); if (!m) { m = new Map(); t.resolutions.set(r.quilt_id, m) }
+      m.set(r.key, { ...r })
+      return clone(m.get(r.key))
+    },
+    deleteResolution ({ quilt_id: q, key }) {
+      const m = t.resolutions.get(q)
+      if (!m || !m.has(key)) throw new StoreError('not_found', 'no such resolution')
+      m.delete(key)
+      return { ok: true }
+    },
+    async resolution (q, key) { return clone(t.resolutions.get(q)?.get(key) || null) },
+    async resolutions (q) { return [...(t.resolutions.get(q)?.values() || [])].map(clone) },
+    async signingKey (id) { const r = t.signingKeys.get(id); return r ? clone(r) : null },
+    async tokens (q) { return [...t.tokens.values()].filter((r) => r.quilt_id === q).sort((a, b) => a.created_at - b.created_at).map(clone) },
+    async tokenByHash (hash) { const r = [...t.tokens.values()].find((x) => x.hash === hash); return r ? clone(r) : null },
+    async signingKeys (member) { return [...t.signingKeys.values()].filter((r) => r.member === member).sort((a, b) => a.added_at - b.added_at).map(clone) },
+    async signaturesOf (q, commits) { return commits.flatMap((c) => t.signatures.get(k(q, c)) || []).map(clone) },
+    async reviews (q, sq) { return (t.reviews.get(q) || []).filter((r) => r.square_id === sq).map(clone) },
+    async squareChecks (q, sq) { return t.squares.get(sq)?.quilt_id === q ? [...(t.squareChecks.get(sq)?.values() || [])].map(clone) : [] },
+    async lineRules (q) { return [...(t.lineRules.get(q)?.values() || [])].map(clone) },
+    async claims (q) { return [...(t.claims.get(q)?.values() || [])].map(clone) },
+    async getTag (q, name) { return clone(t.tags.get(k(q, name))) },
+    async tags (q) { return [...(t.quiltTags.get(q) || [])].map((n) => t.tags.get(k(q, n))).filter(Boolean).map(clone) },
     async getSquare (id) { return clone(t.squares.get(id)) },
     async squares (q, { state, holder, task } = {}) {
       return [...(t.quiltSquares.get(q) || [])].map((id) => t.squares.get(id)).filter((s) => s.quilt_id === q && (!state || s.state === state) && (!holder || s.holder === holder) && (!task || s.task_id === task)).map(clone)
@@ -523,6 +674,7 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     async recall (key, maxAgeMs, now) { const r = t.idem.get(key); return r && now - r.at < maxAgeMs ? clone(r.result) : null },
     async stubMembers (q) { const out = []; for (const [key, v] of t.stubs) if (v.quilt_id === q) out.push(clone(v)); return out.sort((a, b) => a.member_id.localeCompare(b.member_id)) },
     async gitSha (q, sha) { return t.gitShas.get(k(q, sha)) || null },
+    async gitShas (q, shas) { const out = {}; for (const sha of shas) { const id = t.gitShas.get(k(q, sha)); if (id) out[sha] = id } return out },
     async gitShaOf (q, id) { return t.gitOf.get(k(q, id)) || null },
     async getBlock (id) { return clone(t.blocks.get(id)) },
     close () { if (journal) { fs.closeSync(journal); journal = null } }

package/src/quilts/store-rpc.js

@@ -22,7 +22,7 @@ export function createRpcQuiltStore (rpc) {
     createQuilt: 'quilt_create_quilt', setMember: 'quilt_set_member', sealPack: 'quilt_seal_pack', stageFiles: 'quilt_stage_files',
     openSquare: 'quilt_open_square', commit: 'quilt_commit', beginMerge: 'quilt_begin_merge', endMerge: 'quilt_end_merge', merge: 'quilt_merge',
     importCommit: 'quilt_import_commit', setSnapshot: 'quilt_set_snapshot', setSquare: 'quilt_set_square', setGitSha: 'quilt_set_git_sha', remember: 'quilt_remember',
-    addEvents: 'quilt_add_events', setWebhook: 'quilt_set_webhook', takeLease: 'quilt_take_lease', openAndCommit: 'quilt_open_and_commit', giveLease: 'quilt_give_lease', addStubs: 'quilt_add_stubs', fillLinePaths: 'quilt_fill_line_paths', setConflicted: 'quilt_set_conflicted', setArchive: 'quilt_set_archive', setLineWindow: 'quilt_set_line_window'
+    addEvents: 'quilt_add_events', setWebhook: 'quilt_set_webhook', takeLease: 'quilt_take_lease', openAndCommit: 'quilt_open_and_commit', giveLease: 'quilt_give_lease', addStubs: 'quilt_add_stubs', fillLinePaths: 'quilt_fill_line_paths', setConflicted: 'quilt_set_conflicted', setArchive: 'quilt_set_archive', setLineWindow: 'quilt_set_line_window', createLine: 'quilt_create_line', setLineFrozen: 'quilt_set_line_frozen', createTag: 'quilt_create_tag', setLive: 'quilt_set_live', createClaim: 'quilt_create_claim', deleteClaim: 'quilt_delete_claim', setResolution: 'quilt_set_resolution', deleteResolution: 'quilt_delete_resolution', addReview: 'quilt_add_review', setLineRule: 'quilt_set_line_rule', setSquareCheck: 'quilt_set_square_check', addSigningKey: 'quilt_add_signing_key', removeSigningKey: 'quilt_remove_signing_key', addSignature: 'quilt_add_signature', createToken: 'quilt_create_token', revokeToken: 'quilt_revoke_token'
   }
   const store = {}
   for (const [name, fn] of Object.entries(writes)) store[name] = (args) => call(fn, args)
@@ -34,6 +34,20 @@ export function createRpcQuiltStore (rpc) {
     members: (q) => call('quilt_members_of', { quilt_id: q }),
     getLine: (q, name) => call('quilt_get_line', { quilt_id: q, name }),
     lines: (q) => call('quilt_lines_of', { quilt_id: q }),
+    getTag: (q, name) => call('quilt_get_tag', { quilt_id: q, name }),
+    getLive: (q, sq) => call('quilt_get_live', { quilt_id: q, square_id: sq }),
+    tags: (q) => call('quilt_tags_of', { quilt_id: q }),
+    claims: (q) => call('quilt_claims_of', { quilt_id: q }),
+    tokens: (q) => call('quilt_tokens_of', { quilt_id: q }),
+    tokenByHash: (hash) => call('quilt_token_by_hash', { hash }),
+    signingKey: (id) => call('quilt_signing_key', { id }),
+    signingKeys: (member) => call('quilt_signing_keys_of', { member }),
+    signaturesOf: (q, commits) => call('quilt_signatures_of', { quilt_id: q, commits }),
+    reviews: (q, sq) => call('quilt_reviews_of', { quilt_id: q, square_id: sq }),
+    squareChecks: (q, sq) => call('quilt_square_checks_of', { quilt_id: q, square_id: sq }),
+    lineRules: (q) => call('quilt_line_rules_of', { quilt_id: q }),
+    resolution: (q, key) => call('quilt_resolution', { quilt_id: q, key }),
+    resolutions: (q) => call('quilt_resolutions_of', { quilt_id: q }),
     getSquare: (id) => call('quilt_get_square', { id }),
     squares: (q, { state, holder, task } = {}) => call('quilt_squares_of', { quilt_id: q, state, holder, task }),
     getCommit: (q, id) => call('quilt_get_commit', { quilt_id: q, id }),
@@ -57,6 +71,7 @@ export function createRpcQuiltStore (rpc) {
     recall: (key, maxAgeMs, now) => call('quilt_recall', { key, max_age_ms: maxAgeMs, now }),
     stubMembers: (q) => call('quilt_stub_members', { quilt_id: q }),
     gitSha: (q, sha) => call('quilt_git_sha', { quilt_id: q, sha }),
+    gitShas: async (q, shas) => (await call('quilt_git_shas', { quilt_id: q, shas })) || {},
     gitShaPrefix: (q, prefix) => call('quilt_git_sha_prefix', { quilt_id: q, prefix }),
     gitShaOf: (q, id) => call('quilt_git_sha_of', { quilt_id: q, commit_id: id }),
     close () {}

package/src/quilts/tags.js

@@ -0,0 +1,64 @@
+// Tags and releases (plans/quilt-source-control/06): a tag is a name on one commit (a patch or any
+// revision) that never moves and is never deleted; a release is a tag with notes. tag:<name> is a
+// revision everywhere. Anyone who can write tags; the tag records who and when.
+import { QuiltError } from './service.js'
+
+const NAME = /^[A-Za-z0-9._-][A-Za-z0-9._/-]{0,99}$/
+
+/** A tag name: letters, digits, dots, dashes, underscores and slashes, no `..`, no trailing slash. */
+export function tagName (raw) {
+  const s = String(raw || '').trim()
+  if (!NAME.test(s) || s.includes('..') || s.includes('//') || s.endsWith('/')) throw new QuiltError(400, 'bad_request', 'a tag name is letters, digits, dots, dashes, underscores and slashes (up to 100)')
+  return s
+}
+
+export function tagOps (svc) {
+  const { store, now, quiltFor, resolve, fromStore, getCommit } = svc.internals
+
+  async function view (q, row) {
+    const c = row.commit ? await store.getCommit(q, row.commit) : null
+    return { name: row.name, commit: row.commit, short: row.commit ? row.commit.slice(0, 12) : null, patch: c?.patch || null, release: !!row.release, notes: row.notes ?? null, by: row.actor, at: row.at }
+  }
+
+  async function make (me, ref, { name, rev, notes } = {}, release) {
+    const q = await quiltFor(me, ref, 'write')
+    const n = tagName(name)
+    if (notes != null && String(notes).length > 20000) throw new QuiltError(400, 'bad_request', 'release notes are up to 20000 characters')
+    const commit = await resolve(q.id, rev || 'main')
+    if (!commit) throw new QuiltError(400, 'bad_request', `${rev || 'main'} has no commits to tag`)
+    await getCommit(q.id, commit)
+    try {
+      const row = await store.createTag({ quilt_id: q.id, name: n, commit, release, notes: release ? String(notes ?? '') : null, actor: me.member_id, at: now() })
+      return view(q.id, row)
+    } catch (err) { throw fromStore(err) }
+  }
+
+  /** GET /tags: every tag, by name. */
+  async function tags (me, ref) {
+    const q = await quiltFor(me, ref, 'read')
+    const rows = (await store.tags(q.id)).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))
+    return { tags: await Promise.all(rows.map((r) => view(q.id, r))) }
+  }
+
+  /** GET /releases: the tags that are releases, newest first. */
+  async function releases (me, ref) {
+    const q = await quiltFor(me, ref, 'read')
+    const rows = (await store.tags(q.id)).filter((r) => r.release).sort((a, b) => (b.seq || 0) - (a.seq || 0))
+    return { releases: await Promise.all(rows.map((r) => view(q.id, r))) }
+  }
+
+  async function getTag (me, ref, name) {
+    const q = await quiltFor(me, ref, 'read')
+    const row = await store.getTag(q.id, String(name))
+    if (!row) throw new QuiltError(404, 'not_found', `no tag ${name}`)
+    return view(q.id, row)
+  }
+
+  return {
+    tags,
+    releases,
+    getTag,
+    createTag: (me, ref, body) => make(me, ref, body, false),
+    createRelease: (me, ref, body) => make(me, ref, body, true)
+  }
+}

package/src/quilts/tokens.js

@@ -0,0 +1,66 @@
+// Quilt tokens: a key for one quilt, read or write, for a CI job or a script. An admin makes one
+// (seam token new ci --level write), the secret (sqt_…) is shown once, and only its sha256 is kept.
+// A token is a member of its one quilt as token:<id> (so every read and write checks it like any
+// other member) and calls as an agent named after the token. Revoking it ends its membership.
+import crypto from 'node:crypto'
+import { QuiltError } from './errors.js'
+import { uuidv7 } from './ids.js'
+
+export const TOKEN_PREFIX = 'sqt_'
+export const MAX_TOKENS = 50
+const SECRET = /^sqt_[A-Za-z0-9_-]{43}$/
+
+export const hashToken = (secret) => crypto.createHash('sha256').update(String(secret)).digest('hex')
+export const isQuiltToken = (s) => SECRET.test(String(s || ''))
+
+export function tokenOps (svc) {
+  const { store, now, quiltFor, fromStore } = svc.internals
+  const view = (r) => ({ id: r.id, name: r.name, level: r.level, created_by: r.created_by, created_at: r.created_at, ...(r.revoked_at ? { revoked_at: r.revoked_at } : {}) })
+
+  /** POST /tokens { name, level? }: makes a token (admin). The secret is in this answer only. */
+  async function createToken (me, ref, { name, level = 'read' } = {}) {
+    const q = await quiltFor(me, ref, 'admin')
+    const n = String(name || '').trim()
+    if (!n || n.length > 100) throw new QuiltError(400, 'bad_request', 'name: what the token is for, up to 100 characters (e.g. ci)')
+    if (!['read', 'write'].includes(level)) throw new QuiltError(400, 'bad_request', 'level is read or write')
+    const live = (await store.tokens(q.id)).filter((r) => !r.revoked_at)
+    if (live.length >= MAX_TOKENS) throw new QuiltError(409, 'too_many_tokens', `up to ${MAX_TOKENS} tokens per quilt; revoke one first`)
+    const secret = TOKEN_PREFIX + crypto.randomBytes(32).toString('base64url')
+    try {
+      const row = await store.createToken({ id: uuidv7(now()), quilt_id: q.id, name: n, level, hash: hashToken(secret), created_by: me.member_id, created_at: now() })
+      return { ...view(row), quilt: q.slug, member_id: `token:${row.id}`, token: secret }
+    } catch (err) { throw fromStore(err) }
+  }
+
+  /** GET /tokens: the quilt's tokens, revoked ones too (admin). Never their secrets. */
+  async function tokens (me, ref) {
+    const q = await quiltFor(me, ref, 'admin')
+    return { quilt: q.slug, tokens: (await store.tokens(q.id)).map(view) }
+  }
+
+  /** DELETE /tokens/:id: revokes a token (by id, or by name when one live token has it). */
+  async function revokeToken (me, ref, which) {
+    const q = await quiltFor(me, ref, 'admin')
+    const all = await store.tokens(q.id)
+    const w = String(which || '')
+    let row = all.find((r) => r.id === w)
+    if (!row) {
+      const named = all.filter((r) => r.name === w && !r.revoked_at)
+      if (named.length > 1) throw new QuiltError(400, 'bad_request', `${named.length} tokens are named ${w}; revoke one by its id`)
+      row = named[0]
+    }
+    if (!row) throw new QuiltError(404, 'not_found', `no token ${w}`)
+    if (row.revoked_at) return view(row)
+    try { return view(await store.revokeToken({ quilt_id: q.id, id: row.id, actor: me.member_id, at: now() })) } catch (err) { throw fromStore(err) }
+  }
+
+  /** The caller a token secret stands for, or null when it is unknown or revoked. */
+  async function tokenCaller (secret) {
+    if (!isQuiltToken(secret)) return null
+    const row = await store.tokenByHash(hashToken(secret))
+    if (!row || row.revoked_at) return null
+    return { member_id: `token:${row.id}`, kind: 'agent', name: row.name, tool: 'token', token: { id: row.id, quilt_id: row.quilt_id, level: row.level } }
+  }
+
+  return { createToken, tokens, revokeToken, tokenCaller }
+}