heyquilt 0.3.121 → 0.3.122

package/src/quilts/keys.js

@@ -0,0 +1,186 @@
+// Seam's own keys for its own accounts (accounts.js):
+//  - a computer linked through Seam's device flow (`seam login`): it shows a code, the person
+//    approves it on seam.heyquilt.com/device, and the computer gets a key (ssk_…) that lasts
+//    30 days and is renewed with the computer's own Ed25519 key, no browser (`resume`);
+//  - agents an account makes (`seam agent new <name>`), each with its own key (sak_…), which the
+//    owner refreshes (a new key, the old one revoked) or revokes with the agent.
+// Only a key's sha256 is kept. An agent is the member agent:<id>, on behalf of its owner.
+import crypto from 'node:crypto'
+import { QuiltError } from './errors.js'
+import { uuidv7 } from './ids.js'
+
+export const DEVICE_KEY_PREFIX = 'ssk_'
+export const AGENT_KEY_PREFIX = 'sak_'
+export const DEVICE_LINK_CONTEXT = 'seam-device-link-v1'
+export const DEVICE_RESUME_CONTEXT = 'seam-device-resume-v1'
+export const DEVICE_KEY_DAYS = 30
+export const LINK_SECONDS = 600
+export const MAX_AGENTS = 100
+const KEY = /^s[sa]k_[A-Za-z0-9_-]{43}$/
+const USER_CODE_ABC = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789'
+
+export const isSeamKey = (s) => KEY.test(String(s || ''))
+const sha = (s) => crypto.createHash('sha256').update(String(s)).digest('hex')
+const newSecret = (prefix) => prefix + crypto.randomBytes(32).toString('base64url')
+const userCode = () => { const b = crypto.randomBytes(8); let s = ''; for (let i = 0; i < 8; i++) s += USER_CODE_ABC[b[i] % USER_CODE_ABC.length]; return `${s.slice(0, 4)}-${s.slice(4)}` }
+
+function publicKeyOf (publicKey) {
+  try {
+    const k = crypto.createPublicKey({ key: Buffer.from(String(publicKey), 'base64url'), format: 'der', type: 'spki' })
+    if (k.asymmetricKeyType !== 'ed25519') throw new Error('not ed25519')
+    return k
+  } catch { throw new QuiltError(400, 'bad_request', 'publicKey: this computer\'s Ed25519 public key (SPKI DER, base64url)') }
+}
+const signedBy = (publicKey, text, signature) => {
+  try { return crypto.verify(null, Buffer.from(text), publicKeyOf(publicKey), Buffer.from(String(signature || ''), 'base64url')) } catch { return false }
+}
+
+export function keyOps (svc, { siteUrl = 'https://seam.heyquilt.com' } = {}) {
+  const { store, now, fromStore } = svc.internals
+  const site = String(siteUrl).replace(/\/+$/, '')
+  const profile = (a) => ({ id: a.id, name: a.name, email: a.email })
+  const agentView = (a) => ({ id: a.id, name: a.name, member_id: `agent:${a.id}`, created_at: a.created_at, ...(a.revoked_at ? { revoked_at: a.revoked_at } : {}) })
+  const accountOf = (me) => {
+    if (!me.account || me.kind !== 'person') throw new QuiltError(403, 'needs_account', 'sign in with your Seam account for this')
+    return me.account
+  }
+  const wrap = async (fn) => { try { return await fn() } catch (err) { throw fromStore(err) } }
+
+  async function deviceKeyFor (account, publicKey, name) {
+    const secret = newSecret(DEVICE_KEY_PREFIX)
+    const at = now()
+    await wrap(() => store.addKey({ id: uuidv7(at), hash: sha(secret), account_id: account.id, kind: 'device', public_key: publicKey, name, created_at: at, expires_at: at + DEVICE_KEY_DAYS * 86400_000, replace: true }))
+    return { token: secret, expiresIn: DEVICE_KEY_DAYS * 86400, profile: profile(account) }
+  }
+
+  /** POST /v1/device/start { publicKey, deviceName, platform? }: a code to approve on the site. */
+  async function deviceStart ({ publicKey, deviceName, platform } = {}) {
+    publicKeyOf(publicKey)
+    const name = String(deviceName || 'a computer').trim().slice(0, 200) || 'a computer'
+    const code = crypto.randomBytes(32).toString('base64url')
+    const at = now()
+    let link
+    for (let i = 0; !link; i++) {
+      try { link = await store.addDeviceLink({ id: uuidv7(at), code_hash: sha(code), user_code: userCode(), public_key: String(publicKey), name, platform: platform ? String(platform).slice(0, 40) : null, created_at: at, expires_at: at + LINK_SECONDS * 1000 }) } catch (err) { if (err.code !== 'exists' || i > 3) throw fromStore(err) }
+    }
+    return { deviceCode: code, userCode: link.user_code, verificationUrl: `${site}/device?code=${link.user_code}`, expiresIn: LINK_SECONDS, interval: 3 }
+  }
+
+  async function liveLink (userCodeIn) {
+    const l = await store.deviceLink({ user_code: String(userCodeIn || '').trim().toUpperCase() })
+    if (!l || l.expires_at < now()) throw new QuiltError(404, 'not_found', 'no such sign-in code, or it expired: run seam login again')
+    return l
+  }
+
+  /** GET /v1/device/:code: what the approval page shows (the signed-in person's own account only). */
+  async function deviceLinkInfo (me, code) {
+    accountOf(me)
+    const l = await liveLink(code)
+    return { user_code: l.user_code, name: l.name, platform: l.platform, state: l.state, expires_at: l.expires_at }
+  }
+
+  /** POST /v1/device/approve { user_code, approve? }: the signed-in person approves (or declines) a computer. */
+  async function deviceApprove (me, { user_code: code, approve = true } = {}) {
+    const account = accountOf(me)
+    const l = await liveLink(code)
+    if (l.state !== 'pending') throw new QuiltError(409, 'moved', 'this code was already used')
+    const out = await wrap(() => store.setDeviceLink({ id: l.id, from: 'pending', state: approve === false ? 'declined' : 'approved', account_id: account }))
+    return { user_code: out.user_code, name: out.name, state: out.state }
+  }
+
+  /** POST /v1/device/poll { deviceCode, signature }: pending, or the computer's key once approved. */
+  async function devicePoll ({ deviceCode, signature } = {}) {
+    const l = await store.deviceLink({ code_hash: sha(deviceCode) })
+    if (!l || !signedBy(l.public_key, `${DEVICE_LINK_CONTEXT}\0${deviceCode}`, signature)) throw new QuiltError(404, 'not_found', 'no such sign-in link')
+    if (l.state === 'taken' || l.expires_at < now()) throw new QuiltError(410, 'expired', 'this sign-in link expired: run seam login again')
+    if (l.state === 'declined') throw new QuiltError(403, 'declined', 'sign-in was declined in the browser')
+    if (l.state === 'pending') return { status: 'pending' }
+    await wrap(() => store.setDeviceLink({ id: l.id, from: 'approved', state: 'taken' }))
+    const account = await store.getAccount(l.account_id)
+    return { status: 'approved', ...(await deviceKeyFor(account, l.public_key, l.name)) }
+  }
+
+  /** POST /v1/device/resume { publicKey, at, signature }: a linked computer signs back in with its key. */
+  async function deviceResume ({ publicKey, at, signature } = {}) {
+    publicKeyOf(publicKey)
+    if (!Number.isFinite(Number(at)) || Math.abs(now() - Number(at)) > 5 * 60_000) throw new QuiltError(400, 'bad_request', 'at: the time now, in ms (check this computer\'s clock)')
+    const k = await store.deviceKey(String(publicKey))
+    if (!k || !signedBy(publicKey, `${DEVICE_RESUME_CONTEXT}\0${at}`, signature)) throw new QuiltError(401, 'not_linked', 'this computer is not signed in: run seam login')
+    const account = await store.getAccount(k.account_id)
+    return deviceKeyFor(account, k.public_key, k.name)
+  }
+
+  /** POST /v1/me/signout: ends the key the caller signed in with. */
+  async function signout (me) {
+    if (me.key) await wrap(() => store.revokeKey({ id: me.key, at: now() }))
+    return { ok: true }
+  }
+
+  /** The caller a Seam key stands for, or null when it is unknown, revoked or expired. */
+  async function keyCaller (secret) {
+    if (!isSeamKey(secret)) return null
+    const k = await store.keyByHash(sha(secret))
+    if (!k || k.revoked_at || (k.expires_at && k.expires_at <= now())) return null
+    const account = await store.getAccount(k.account_id)
+    if (!account) return null
+    if (k.kind === 'device') return { member_id: account.member_id, kind: 'person', name: account.name, account: account.id, key: k.id }
+    const a = await store.getAgent(k.agent_id)
+    if (!a || a.revoked_at) return null
+    return { member_id: `agent:${a.id}`, kind: 'agent', name: a.name, tool: 'seam', on_behalf_of: account.member_id, key: k.id }
+  }
+
+  async function agentKeyFor (account, agent) {
+    const secret = newSecret(AGENT_KEY_PREFIX)
+    const at = now()
+    await wrap(() => store.addKey({ id: uuidv7(at), hash: sha(secret), account_id: account, kind: 'agent', agent_id: agent.id, name: agent.name, created_at: at, expires_at: null, replace: true }))
+    return { ...agentView(agent), key: secret }
+  }
+
+  async function ownAgent (account, which) {
+    const w = String(which || '')
+    const all = await store.agentsOf(account)
+    const a = all.find((x) => x.id === w) || (() => {
+      const named = all.filter((x) => x.name === w && !x.revoked_at)
+      if (named.length > 1) throw new QuiltError(400, 'bad_request', `${named.length} agents are named ${w}; use its id`)
+      return named[0]
+    })()
+    if (!a) throw new QuiltError(404, 'not_found', `no agent ${w}`)
+    return a
+  }
+
+  /** POST /v1/agents { name, claim? }: a new agent and its key (shown in this answer only); `claim` re-links an old agent (agent:<id>) listed for this account's email, keeping its member id and its patches. */
+  async function createAgent (me, { name, claim } = {}) {
+    const account = accountOf(me)
+    if (claim != null && !/^agent:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(String(claim))) throw new QuiltError(400, 'bad_request', 'claim: the old agent\'s member id, agent:<id>')
+    let n = String(name || '').trim()
+    if (!n && claim) n = (await store.agentClaims((await store.getAccount(account)).email)).claims.find((c) => c.member_id === claim)?.name || 'agent'
+    if (!n || n.length > 100) throw new QuiltError(400, 'bad_request', 'name: the agent\'s name, up to 100 characters')
+    const at = now()
+    const a = await wrap(() => store.createAgent({ id: uuidv7(at), account_id: account, name: n, created_at: at, max: MAX_AGENTS, ...(claim ? { claim: String(claim).toLowerCase() } : {}) }))
+    return agentKeyFor(account, a)
+  }
+
+  /** GET /v1/agents: the account's agents, revoked ones too, and `relink`: old agents it may re-link. */
+  async function agents (me) {
+    const account = accountOf(me)
+    const a = await store.getAccount(account)
+    return { agents: (await store.agentsOf(account)).map(agentView), relink: (await store.agentClaims(a.email)).claims }
+  }
+
+  /** POST /v1/agents/:id/key: a new key for the agent; its old key stops working. */
+  async function refreshAgentKey (me, which) {
+    const account = accountOf(me)
+    const a = await ownAgent(account, which)
+    if (a.revoked_at) throw new QuiltError(409, 'revoked', `${a.name} was revoked; make a new agent`)
+    return agentKeyFor(account, a)
+  }
+
+  /** DELETE /v1/agents/:id: revokes the agent and its key. Its patches stay its own. */
+  async function revokeAgent (me, which) {
+    const account = accountOf(me)
+    const a = await ownAgent(account, which)
+    return agentView(await wrap(() => store.revokeAgent({ id: a.id, account_id: account, at: now() })))
+  }
+
+  return { deviceStart, deviceLinkInfo, deviceApprove, devicePoll, deviceResume, signout, keyCaller, createAgent, agents, refreshAgentKey, revokeAgent }
+}

package/src/quilts/merge.js

@@ -23,9 +23,17 @@ const MAX_SIDES = 8
 // across machines. A non-holder peeks at the table lease with ttl 0 (takes it only if free, and
 // then it is already expired). A crashed holder's lease lapses after LEASE_TTL_MS.
 const LEASE_TTL_MS = 10_000
+const RENEW_MS = LEASE_TTL_MS / 4
 const leases = new Map() // quilt + line → { held: boolean, queue: [resolve] }
 
 function leaseOf (key) { let l = leases.get(key); if (!l) { l = { held: false, queue: [], idle: [] }; leases.set(key, l) } return l }
+/** Why a line is frozen: an import that follows git names itself (14), else the plain refusal. */
+export function frozenWhy (q, line) {
+  const imp = q.settings?.import
+  if (imp && imp.follow && imp.state !== 'done' && (line === 'main' || line.startsWith('release/'))) return `${line} is frozen while import ${imp.id} follows git: merges happen in git until cut-over (seam import cutover ${imp.id})`
+  return `${line} is frozen`
+}
+
 function takeLease (key) {
   const l = leaseOf(key)
   if (!l.held) { l.held = true; return Promise.resolve() }
@@ -203,7 +211,7 @@ export function mergeOps (svc) {
     const run = async () => {
       const ln = await store.getLine(q.id, line)
       if (!ln) throw new QuiltError(404, 'not_found', `no line ${line}`)
-      if (ln.frozen) throw new QuiltError(423, 'line_frozen', `${line} is frozen`)
+      if (ln.frozen) throw new QuiltError(423, 'line_frozen', frozenWhy(q, line))
       const parent = await openParent(sq)
       if (parent) throw new QuiltError(409, 'parent_open', `this square is stacked on ${squareShort(parent.id)}, which has not merged: merge it first, or fold this square into it`, { parent: squareShort(parent.id) })
       if (sq.state !== 'open') throw new QuiltError(409, sq.state === 'merging' ? 'square_merging' : 'square_closed', `the square is ${sq.state}`)
@@ -226,6 +234,12 @@ export function mergeOps (svc) {
 
       if (svc.internals.mergeWindow) await svc.internals.mergeWindow(q, line) // 429 merge_window above the line's window (07)
       try { await store.beginMerge({ square_id: sq.id, expect_head: sq.head, actor: me.member_id, at: now() }) } catch (err) { throw fromStore(err) }
+      // A merge queued behind others on a busy line can run past LEASE_TTL_MS: it renews its
+      // square while it runs, so the sweeper ends only merges whose server is gone.
+      const renew = setInterval(() => {
+        store.setSquare({ square_id: sq.id, op: 'merge_renew', expect: { state: 'merging' }, patch: {}, actor: me.member_id, at: now() }).catch(() => {})
+      }, RENEW_MS)
+      renew.unref?.()
       let retries = 0
       const leaseKey = `${q.id}\u0000${line}`
       const holder = `merge:${sq.id}:${uuidv7()}`
@@ -278,6 +292,7 @@ export function mergeOps (svc) {
         await store.endMerge({ square_id: sq.id, why: err.code || 'error', actor: me.member_id, at: now() }).catch(() => {})
         throw fromStore(err)
       } finally {
+        clearInterval(renew)
         if (release) await release()
       }
     }

package/src/quilts/oauth.js

@@ -0,0 +1,202 @@
+// Seam as an OAuth 2 provider (D4): any app (Quilt is one) asks a person for access to their
+// quilts with the authorization code flow and PKCE (S256 only; RFC 6749, RFC 7636). Clients are
+// public (no secret): an account registers one with its redirect addresses (`seam oauth client
+// new`). The person approves on seam.heyquilt.com/oauth/authorize; the app trades the code at
+// POST /oauth/token for an access token (sok_…, an hour) and a refresh token (sor_…, 90 days,
+// a new one on each use; a used one presented again ends the whole grant).
+//
+// Scopes: `quilts:read` / `quilts:write` (every quilt the person is in), `quilt:<quilt>:read` /
+// `quilt:<quilt>:write` (one quilt; given by id or slug, kept as its id). Write includes read.
+// A token reaches only /v1/me, the quilts list and the quilts its scopes name, never more than
+// the person themself may do.
+import crypto from 'node:crypto'
+import { QuiltError } from './errors.js'
+import { uuidv7 } from './ids.js'
+
+export const ACCESS_PREFIX = 'sok_'
+export const REFRESH_PREFIX = 'sor_'
+export const ACCESS_SECONDS = 3600
+export const REFRESH_DAYS = 90
+export const CODE_SECONDS = 60
+const ACCESS = /^sok_[A-Za-z0-9_-]{43}$/
+const REFRESH = /^sor_[A-Za-z0-9_-]{43}$/
+const CLIENT = /^sc_[A-Za-z0-9_-]{22}$/
+const SCOPE = /^(quilts:(read|write)|quilt:([^:\s]{1,200}):(read|write))$/
+
+export const isOAuthToken = (s) => ACCESS.test(String(s || ''))
+const sha = (s) => crypto.createHash('sha256').update(String(s)).digest('hex')
+const secret = (prefix) => prefix + crypto.randomBytes(32).toString('base64url')
+const s256 = (verifier) => crypto.createHash('sha256').update(String(verifier)).digest('base64url')
+
+/** An OAuth refusal: `error` is RFC 6749's code, as the token endpoint answers it. */
+const oauthError = (status, error, description) => new QuiltError(status, error, description, { error, error_description: description })
+
+/** A redirect address a client may register: https, or http on this computer (an app's loopback). */
+export function goodRedirect (uri) {
+  let u
+  try { u = new URL(String(uri)) } catch { return false }
+  if (u.hash || u.username || u.password) return false
+  if (u.protocol === 'https:') return true
+  return u.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(u.hostname)
+}
+
+/** Whether a token's scopes let it do `need` ('read' or 'write') on the quilt with this id. */
+export function scopeAllows (scopes, quiltId, need) {
+  for (const s of scopes || []) {
+    const m = SCOPE.exec(s)
+    if (!m) continue
+    const level = m[2] || m[4]
+    if (need === 'write' && level !== 'write') continue
+    if (m[1].startsWith('quilts:') || m[3] === quiltId) return true
+  }
+  return false
+}
+
+export function oauthOps (svc) {
+  const { store, now, fromStore, quiltFor } = svc.internals
+  const wrap = async (fn) => { try { return await fn() } catch (err) { throw fromStore(err) } }
+  const accountOf = (me) => {
+    if (!me.account || me.kind !== 'person' || me.scopes) throw new QuiltError(403, 'needs_account', 'sign in with your Seam account for this')
+    return me.account
+  }
+  const clientView = (c) => ({ client_id: c.id, name: c.name, redirect_uris: c.redirect_uris, created_at: c.created_at, ...(c.revoked_at ? { revoked_at: c.revoked_at } : {}) })
+
+  /** POST /v1/oauth/clients { name, redirect_uris }: a public client (PKCE, no secret) the account owns. */
+  async function createClient (me, { name, redirect_uris: uris } = {}) {
+    const account = accountOf(me)
+    const n = String(name || '').trim()
+    if (!n || n.length > 100) throw new QuiltError(400, 'bad_request', 'name: the app\'s name, as people see it when they approve it (up to 100 characters)')
+    const list = (Array.isArray(uris) ? uris : [uris]).filter(Boolean).map(String)
+    if (!list.length || list.length > 10 || !list.every(goodRedirect)) throw new QuiltError(400, 'bad_request', 'redirect_uris: 1 to 10 addresses, https (or http on 127.0.0.1 / localhost), without a #fragment')
+    const at = now()
+    const c = await wrap(() => store.addOAuthClient({ id: 'sc_' + crypto.randomBytes(16).toString('base64url'), account_id: account, name: n, redirect_uris: [...new Set(list)], created_at: at }))
+    return clientView(c)
+  }
+
+  /** GET /v1/oauth/clients: the account's clients. */
+  async function clients (me) {
+    return { clients: (await store.oauthClientsOf(accountOf(me))).map(clientView) }
+  }
+
+  /** DELETE /v1/oauth/clients/:id: the client stops working, with every token it was given. */
+  async function revokeClient (me, id) {
+    return clientView(await wrap(() => store.revokeOAuthClient({ id: String(id), account_id: accountOf(me), at: now() })))
+  }
+
+  async function liveClient (id) {
+    const c = CLIENT.test(String(id || '')) ? await store.oauthClient(String(id)) : null
+    if (!c || c.revoked_at) throw oauthError(400, 'invalid_client', 'no such app (client_id), or it was revoked')
+    return c
+  }
+
+  /** The scopes asked for, each checked against what the person may do, quilts kept by id. */
+  async function grantable (me, scope) {
+    const asked = [...new Set(String(scope || '').split(/\s+/).filter(Boolean))]
+    if (!asked.length || asked.length > 20) throw oauthError(400, 'invalid_scope', 'scope: up to 20 of quilts:read, quilts:write, quilt:<quilt>:read, quilt:<quilt>:write')
+    const out = []
+    const quilts = []
+    for (const s of asked) {
+      const m = SCOPE.exec(s)
+      if (!m) throw oauthError(400, 'invalid_scope', `${s} is not a Seam scope (quilts:read, quilts:write, quilt:<quilt>:read, quilt:<quilt>:write)`)
+      if (m[1].startsWith('quilts:')) { out.push(s); continue }
+      let q
+      try { q = await quiltFor(me, m[3], m[4]) } catch { throw oauthError(400, 'invalid_scope', `you don't have ${m[4]} on ${m[3]}`) }
+      out.push(`quilt:${q.id}:${m[4]}`)
+      quilts.push({ id: q.id, slug: q.slug, name: q.name || q.slug, level: m[4] })
+    }
+    return { scopes: [...new Set(out)], quilts }
+  }
+
+  function checkRequest (c, { redirect_uri: redirectUri, response_type: type = 'code', code_challenge: challenge, code_challenge_method: method } = {}) {
+    if (!c.redirect_uris.includes(String(redirectUri || ''))) throw oauthError(400, 'invalid_request', 'redirect_uri is not one this app registered')
+    if (type !== 'code') throw oauthError(400, 'unsupported_response_type', 'response_type must be code')
+    if (method !== 'S256' || !/^[A-Za-z0-9_-]{43}$/.test(String(challenge || ''))) throw oauthError(400, 'invalid_request', 'PKCE is required: code_challenge (base64url SHA-256 of the verifier) and code_challenge_method=S256')
+  }
+
+  /** GET /v1/oauth/authorize?…: what the approval page shows (the app, the scopes), once the request checks out. */
+  async function authorizeInfo (me, params = {}) {
+    accountOf(me)
+    const c = await liveClient(params.client_id)
+    checkRequest(c, params)
+    const { scopes, quilts } = await grantable(me, params.scope)
+    return { client: { client_id: c.id, name: c.name }, redirect_uri: params.redirect_uri, scopes, quilts }
+  }
+
+  /** POST /v1/oauth/authorize { client_id, redirect_uri, scope, state, code_challenge, code_challenge_method, approve }: where to send the browser. */
+  async function authorize (me, params = {}) {
+    const account = accountOf(me)
+    const c = await liveClient(params.client_id)
+    checkRequest(c, params)
+    const back = new URL(params.redirect_uri)
+    if (params.state != null) back.searchParams.set('state', String(params.state))
+    if (params.approve === false || params.approve === '0') {
+      back.searchParams.set('error', 'access_denied')
+      return { redirect: back.toString() }
+    }
+    const { scopes } = await grantable(me, params.scope)
+    const code = crypto.randomBytes(32).toString('base64url')
+    const at = now()
+    await wrap(() => store.addOAuthCode({ id: uuidv7(at), code_hash: sha(code), client_id: c.id, account_id: account, redirect_uri: String(params.redirect_uri), challenge: params.code_challenge, scopes, created_at: at, expires_at: at + CODE_SECONDS * 1000 }))
+    back.searchParams.set('code', code)
+    return { redirect: back.toString() }
+  }
+
+  async function issue ({ account_id: account, client_id: client, scopes, grant_id: grant }, at) {
+    const access = secret(ACCESS_PREFIX)
+    const refresh = secret(REFRESH_PREFIX)
+    const c = await store.oauthClient(client)
+    const base = { account_id: account, client_id: client, grant_id: grant, scopes, name: c?.name || 'an app', created_at: at }
+    await wrap(() => store.addKey({ ...base, id: uuidv7(at), hash: sha(refresh), kind: 'oauth_refresh', expires_at: at + REFRESH_DAYS * 86400_000, replace: true }))
+    await wrap(() => store.addKey({ ...base, id: uuidv7(at), hash: sha(access), kind: 'oauth', expires_at: at + ACCESS_SECONDS * 1000 }))
+    return { access_token: access, token_type: 'Bearer', expires_in: ACCESS_SECONDS, refresh_token: refresh, scope: scopes.join(' ') }
+  }
+
+  /** POST /oauth/token (form or JSON): grant_type authorization_code (with code_verifier) or refresh_token. */
+  async function token (body = {}) {
+    const at = now()
+    const c = await liveClient(body.client_id)
+    if (body.grant_type === 'authorization_code') {
+      const row = await wrap(() => store.takeOAuthCode({ code_hash: sha(body.code || ''), at }))
+      if (!row || row.client_id !== c.id) throw oauthError(400, 'invalid_grant', 'this code is unknown')
+      if (row.was_used) {
+        await wrap(() => store.revokeGrant({ grant_id: row.id, at }))
+        throw oauthError(400, 'invalid_grant', 'this code was used already; the tokens it gave are revoked')
+      }
+      if (row.expires_at <= at) throw oauthError(400, 'invalid_grant', 'this code expired; sign in again')
+      if (row.redirect_uri !== String(body.redirect_uri || '')) throw oauthError(400, 'invalid_grant', 'redirect_uri differs from the one the code was given for')
+      if (!body.code_verifier || s256(body.code_verifier) !== row.challenge) throw oauthError(400, 'invalid_grant', 'code_verifier does not match the code_challenge')
+      return issue({ account_id: row.account_id, client_id: c.id, scopes: row.scopes, grant_id: row.id }, at)
+    }
+    if (body.grant_type === 'refresh_token') {
+      const k = REFRESH.test(String(body.refresh_token || '')) ? await store.keyByHash(sha(body.refresh_token)) : null
+      if (!k || k.kind !== 'oauth_refresh' || k.client_id !== c.id) throw oauthError(400, 'invalid_grant', 'this refresh token is unknown')
+      if (k.revoked_at) {
+        // A used refresh token again: someone else may hold it, so the grant ends for both.
+        await wrap(() => store.revokeGrant({ grant_id: k.grant_id, at }))
+        throw oauthError(400, 'invalid_grant', 'this refresh token was used already; sign in again')
+      }
+      if (k.expires_at <= at) throw oauthError(400, 'invalid_grant', 'this refresh token expired; sign in again')
+      return issue(k, at)
+    }
+    throw oauthError(400, 'unsupported_grant_type', 'grant_type: authorization_code or refresh_token')
+  }
+
+  /** POST /oauth/revoke { token }: ends the grant the token belongs to (RFC 7009: always 200). */
+  async function revokeToken ({ token: t } = {}) {
+    const k = ACCESS.test(String(t || '')) || REFRESH.test(String(t || '')) ? await store.keyByHash(sha(t)) : null
+    if (k && k.grant_id) await wrap(() => store.revokeGrant({ grant_id: k.grant_id, at: now() }))
+    return {}
+  }
+
+  /** The person an access token stands for, with its scopes; null when unknown, revoked or expired. */
+  async function oauthCaller (t) {
+    if (!isOAuthToken(t)) return null
+    const k = await store.keyByHash(sha(t))
+    if (!k || k.kind !== 'oauth' || k.revoked_at || k.expires_at <= now()) return null
+    const [account, c] = await Promise.all([store.getAccount(k.account_id), store.oauthClient(k.client_id)])
+    if (!account || !c || c.revoked_at) return null
+    return { member_id: account.member_id, kind: 'person', name: account.name, tool: c.name, account: account.id, key: k.id, scopes: k.scopes, client: c.id }
+  }
+
+  return { createOAuthClient: createClient, oauthClients: clients, revokeOAuthClient: revokeClient, oauthAuthorizeInfo: authorizeInfo, oauthAuthorize: authorize, oauthToken: token, oauthRevoke: revokeToken, oauthCaller }
+}

package/src/quilts/reviews.js

@@ -14,6 +14,7 @@
 // green there). Seam does not run the checks; whoever runs them reports with a key.
 import { QuiltError, squareShort } from './service.js'
 import { uuidv7 } from './ids.js'
+import { cleanRunners, cleanTiers, cleanGlobs } from './checks.js'
 
 export const KINDS = ['comment', 'approve', 'request_changes', 'dismiss']
 export const MAX_BODY = 20000
@@ -65,7 +66,8 @@ export function reviewOps (svc) {
 
   async function ruleOf (q, line) {
     const r = (await store.lineRules(q)).find((x) => x.line === line)
-    return { approvals: r ? r.approvals : 0, checks: r?.checks || [] }
+    const tg = r?.targeting || {}
+    return { approvals: r ? r.approvals : 0, checks: r?.checks || [], runners: r?.runners || {}, ...(tg.tiers && Object.keys(tg.tiers).length ? { tiers: tg.tiers } : {}), ...(tg.tests?.length ? { tests: tg.tests } : {}), ...(tg.ci_config?.length ? { ci_config: tg.ci_config } : {}), since_seq: r?.since_seq ?? null }
   }
   const need = async (q, line) => (await ruleOf(q, line)).approvals
 
@@ -103,8 +105,10 @@ export function reviewOps (svc) {
     if (!sq.head) throw new QuiltError(400, 'bad_request', 'the square has no commits to check yet')
     const head = body.head || sq.head
     if (head !== sq.head) throw new QuiltError(409, 'head_moved', 'the square moved on since that commit: check its latest commit', { head: sq.head })
-    try { await store.setSquareCheck({ quilt_id: q.id, square_id: sq.id, name, status: body.status, head, by: me.member_id, at: now() }) } catch (err) { throw fromStore(err) }
     const rule = await ruleOf(q.id, sq.line)
+    const noted = svc.internals.noteVerdict ? await svc.internals.noteVerdict(me, q, { name, tier: 'pre_merge', commit: head, square: sq.id, line: sq.line, verdict: body.status, run_key: body.run_key, url: body.url }) : {}
+    if (noted.advisory) return { square: squareShort(sq.id), check: name, status: body.status, head, advisory: true, runners: rule.runners[name], checks: await checksOf(q.id, sq, rule.checks) }
+    try { await store.setSquareCheck({ quilt_id: q.id, square_id: sq.id, name, status: body.status, head, by: me.member_id, at: now() }) } catch (err) { throw fromStore(err) }
     return { square: squareShort(sq.id), check: name, status: body.status, head, checks: await checksOf(q.id, sq, rule.checks) }
   }
 
@@ -158,8 +162,13 @@ export function reviewOps (svc) {
       const bad = checks.find((c) => !CHECK_NAME.test(c))
       if (bad !== undefined) throw new QuiltError(400, 'bad_request', `${bad || '(empty)'} is not a check name: letters, digits, dots, dashes, underscores, slashes or colons`)
     }
-    try { await store.setLineRule({ quilt_id: q.id, line, approvals: n, checks, actor: me.member_id, at: now() }) } catch (err) { throw fromStore(err) }
-    return { line, approvals: n, checks }
+    const runners = body.runners === undefined ? was.runners : cleanRunners(body.runners, (c) => CHECK_NAME.test(c))
+    const tiers = body.tiers === undefined ? (was.tiers || {}) : cleanTiers(body.tiers, (c) => CHECK_NAME.test(c))
+    const tests = body.tests === undefined ? (was.tests || []) : cleanGlobs(body.tests, 'tests')
+    const ciConfig = body.ci_config === undefined ? (was.ci_config || []) : cleanGlobs(body.ci_config, 'ci_config')
+    const targeting = { ...(Object.keys(tiers).length ? { tiers } : {}), ...(tests.length ? { tests } : {}), ...(ciConfig.length ? { ci_config: ciConfig } : {}) }
+    try { await store.setLineRule({ quilt_id: q.id, line, approvals: n, checks, runners, targeting, actor: me.member_id, at: now() }) } catch (err) { throw fromStore(err) }
+    return { line, approvals: n, checks, runners, ...targeting }
   }
 
   /** GET /lines/:name/policy */
@@ -167,7 +176,9 @@ export function reviewOps (svc) {
     const q = await quiltFor(me, ref, 'read')
     const line = String(lineName)
     if (!await store.getLine(q.id, line)) throw new QuiltError(404, 'not_found', `no line ${line}`)
-    return { line, ...await ruleOf(q.id, line) }
+    const { since_seq: seq, ...rule } = await ruleOf(q.id, line)
+    void seq
+    return { line, ...rule }
   }
 
   /** Refuses a merge of `sq` into `line` that the line's rule does not allow yet (428 policy). */
@@ -178,6 +189,8 @@ export function reviewOps (svc) {
     const s = n ? standing(sq, await store.reviews(q, sq.id), n, await notAllowed(q, sq)) : { ready: true, have: 0, changes_requested_by: [] }
     const notGreen = rule.checks.length ? (await checksOf(q, sq, rule.checks)).filter((c) => c.required && c.status !== 'green') : []
     if (notGreen.length) {
+      // Asking to merge asks the runners of a required check that has nothing on the head yet.
+      if (svc.internals.askForChecks) await svc.internals.askForChecks(q, sq, notGreen.filter((x) => x.status !== 'red').map((x) => x.name), sq.holder)
       const c = notGreen[0]
       const why = { missing: 'has not reported', stale: 'has not reported on the latest commit', red: 'is red' }[c.status]
       throw new QuiltError(428, 'policy', `${line} needs check ${c.name} green on ${squareShort(sq.id)}'s latest commit and it ${why}: run it and report with seam check ${c.name} green --square ${squareShort(sq.id)}`,

package/src/quilts/routes.js

@@ -4,6 +4,7 @@
 // reaches the same operations as the seam CLI and seam_* tools.
 import { QuiltError } from './service.js'
 import { classify, tokenKey } from './limits.js'
+import { scopeAllows } from './oauth.js'
 
 const Q = '/v1/quilts/([^/]+)'
 const MAX_JSON = 96 * 1024 * 1024
@@ -27,12 +28,31 @@ export function quiltRoutes ({ quilts, identify }) {
     return identify(req)
   }
 
+  // An app's OAuth token (oauth.js) reaches /v1/me, the quilts list and the quilts its scopes name.
+  const READ_POSTS = /\/(have|blobs)$/
+  async function withinScope (m, req) {
+    if (!m.scopes) return
+    const p = new URL(req.url, 'http://x').pathname
+    if (req.method === 'GET' && (p === '/v1/me' || p === '/v1/quilts')) return
+    const q = new RegExp(`^${Q}(?:/|$)`).exec(p)
+    const need = req.method === 'GET' || READ_POSTS.test(p) ? 'read' : 'write'
+    if (q) {
+      let ref
+      try { ref = decodeURIComponent(q[1]) } catch { ref = q[1] }
+      const quilt = await quilts.internals.quiltFor(m, ref, 'read')
+      if (scopeAllows(m.scopes, quilt.id, need)) return
+    }
+    throw new QuiltError(403, 'insufficient_scope', `this app's access does not include ${need} here; ask for a wider scope`)
+  }
+  const inScope = (m, list) => m.scopes && !m.scopes.some((s) => s.startsWith('quilts:')) ? list.filter((q) => scopeAllows(m.scopes, q.id, 'read')) : list
+
   // Every answer is the server's record; a refusal carries its wire code (12's WriteResult).
   // Per-token rate limits (04, limits.js), when the quilts were made with them.
   const limiter = quilts.rateLimiter || null
   const run = (fn) => async (req, body, params) => {
     try {
       const m = await me(req)
+      await withinScope(m, req)
       if (limiter) limiter.take(tokenKey(req, m), classify(req.method, req.url, body), m.kind === 'person')
       return await fn(m, body, params, req)
     } catch (err) {
@@ -42,9 +62,43 @@ export function quiltRoutes ({ quilts, identify }) {
     }
   }
   const big = { maxBody: MAX_JSON }
+  // Seam's device flow, before a computer has a sign-in: no caller, a refusal as an answer.
+  const open = (fn) => async (req, body) => {
+    try { return await fn(body) } catch (err) {
+      if (err instanceof QuiltError) return [err.status, { ok: false, error: err.message, code: err.code, ...err.extra }]
+      throw err
+    }
+  }
 
   return [
-    ['GET', /^\/v1\/quilts$/, run(async (m) => ({ quilts: await quilts.quilts(m) }))],
+    ['POST', /^\/v1\/imports$/, run(async (m, b) => [202, await quilts.startImport(m, b)])],
+    ['GET', /^\/v1\/imports\/([^/]+)$/, run((m, b, [id]) => quilts.importStatus(m, decodeURIComponent(id)))],
+    ['POST', /^\/v1\/imports\/([^/]+)\/cutover$/, run((m, b, [id]) => quilts.cutover(m, decodeURIComponent(id), b || {}))],
+    // A poke carries the import's secret (Bearer sip_…) or a member's key.
+    ['POST', /^\/v1\/imports\/([^/]+)\/poke$/, async (req, body, [id]) => {
+      const h = String(req.headers?.authorization || '')
+      if (!h.startsWith('Bearer sip_')) return run(async (m) => [202, await quilts.pokeImport(m, decodeURIComponent(id))])(req, body, [id])
+      try { return [202, await quilts.pokeImport(null, decodeURIComponent(id), { secret: h.slice(7).trim() })] } catch (err) { if (err instanceof QuiltError) return [err.status, { ok: false, error: err.message, code: err.code }]; throw err }
+    }],
+    ['GET', /^\/v1\/me$/, run((m) => quilts.whoami(m))],
+    ['POST', /^\/v1\/me\/signout$/, run((m) => quilts.signout(m))],
+    ['POST', /^\/v1\/device\/start$/, open((b) => quilts.deviceStart(b))],
+    ['POST', /^\/v1\/device\/poll$/, open((b) => quilts.devicePoll(b))],
+    ['POST', /^\/v1\/device\/resume$/, open((b) => quilts.deviceResume(b))],
+    ['POST', /^\/v1\/device\/approve$/, run((m, b) => quilts.deviceApprove(m, b))],
+    ['GET', /^\/v1\/device\/([A-Za-z0-9-]+)$/, run((m, b, [code]) => quilts.deviceLinkInfo(m, code))],
+    ['GET', /^\/v1\/agents$/, run((m) => quilts.agents(m))],
+    ['POST', /^\/v1\/agents$/, run(async (m, b) => [201, await quilts.createAgent(m, b)])],
+    ['POST', /^\/v1\/agents\/([^/]+)\/key$/, run((m, b, [id]) => quilts.refreshAgentKey(m, decodeURIComponent(id)))],
+    ['DELETE', /^\/v1\/agents\/([^/]+)$/, run((m, b, [id]) => quilts.revokeAgent(m, decodeURIComponent(id)))],
+    ['GET', /^\/v1\/oauth\/clients$/, run((m) => quilts.oauthClients(m))],
+    ['POST', /^\/v1\/oauth\/clients$/, run(async (m, b) => [201, await quilts.createOAuthClient(m, b)])],
+    ['DELETE', /^\/v1\/oauth\/clients\/([^/]+)$/, run((m, b, [id]) => quilts.revokeOAuthClient(m, decodeURIComponent(id)))],
+    ['GET', /^\/v1\/oauth\/authorize$/, run((m, b, p, req) => quilts.oauthAuthorizeInfo(m, Object.fromEntries(query(req))))],
+    ['POST', /^\/v1\/oauth\/authorize$/, run((m, b) => quilts.oauthAuthorize(m, b))],
+    ['POST', /^\/oauth\/token$/, open((b) => quilts.oauthToken(b))],
+    ['POST', /^\/oauth\/revoke$/, open((b) => quilts.oauthRevoke(b))],
+    ['GET', /^\/v1\/quilts$/, run(async (m) => ({ quilts: inScope(m, await quilts.quilts(m)) }))],
     ['POST', /^\/v1\/quilts$/, run(async (m, b) => [201, await quilts.createQuilt(m, b)])],
     ['GET', new RegExp(`^${Q}$`), run((m, b, [q]) => quilts.quiltInfo(m, q))],
     ['POST', new RegExp(`^${Q}/members$`), run((m, b, [q]) => quilts.addMember(m, q, b))],
@@ -65,12 +119,15 @@ export function quiltRoutes ({ quilts, identify }) {
     ['GET', new RegExp(`^${Q}/squares/([^/]+)/reviews$`), run((m, b, [q, s]) => quilts.reviews(m, q, s))],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/reviews$`), run(async (m, b, [q, s]) => [201, await quilts.review(m, q, s, b)])],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/checks$`), run((m, b, [q, s]) => quilts.reportSquareCheck(m, q, s, b))],
+    ['POST', new RegExp(`^${Q}/squares/([^/]+)/checks/([^/]+)/rerun$`), run(async (m, b, [q, s, c]) => [201, await quilts.rerunCheck(m, q, { ...b, check: decodeURIComponent(c), square: s })])],
+    ['POST', new RegExp(`^${Q}/lines/([^/]+)/checks/([^/]+)/rerun$`), run(async (m, b, [q, line, c]) => [201, await quilts.rerunCheck(m, q, { ...b, check: decodeURIComponent(c), line: decodeURIComponent(line) })])],
     ['GET', new RegExp(`^${Q}/lines/([^/]+)/policy$`), run((m, b, [q, line]) => quilts.linePolicy(m, q, decodeURIComponent(line)))],
     ['PUT', new RegExp(`^${Q}/lines/([^/]+)/policy$`), run((m, b, [q, line]) => quilts.setLinePolicy(m, q, decodeURIComponent(line), b))],
     ['GET', new RegExp(`^${Q}/squares/([^/]+)/live$`), run((m, b, [q, s]) => quilts.live(m, q, s))],
     ['PUT', new RegExp(`^${Q}/squares/([^/]+)/live$`), run((m, b, [q, s]) => quilts.setLive(m, q, s, b)), big],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/handoff$`), run((m, b, [q, s]) => quilts.handoff(m, q, s, b))],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/abandon$`), run((m, b, [q, s]) => quilts.abandon(m, q, s, b))],
+    ['POST', new RegExp(`^${Q}/squares/([^/]+)/merged$`), run((m, b, [q, s]) => quilts.squareMerged(m, q, s, b))],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/reopen$`), run((m, b, [q, s]) => quilts.reopen(m, q, s, b))],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/merge$`), run(async (m, b, [q, s]) => { const r = await quilts.mergeSquare(m, q, s, b); return r.noop ? r : [201, r] })],
     ['POST', new RegExp(`^${Q}/squares/([^/]+)/fold$`), run((m, b, [q, s]) => quilts.fold(m, q, s, b))],
@@ -82,6 +139,8 @@ export function quiltRoutes ({ quilts, identify }) {
     ['POST', new RegExp(`^${Q}/lines$`), run(async (m, b, [q]) => [201, await quilts.newLine(m, q, b)])],
     ['POST', new RegExp(`^${Q}/lines/([^/]+)/freeze$`), run((m, b, [q, line]) => quilts.freezeLine(m, q, line))],
     ['POST', new RegExp(`^${Q}/lines/([^/]+)/unfreeze$`), run((m, b, [q, line]) => quilts.unfreezeLine(m, q, line))],
+    ['PUT', new RegExp(`^${Q}/export$`), run((m, b, [q]) => quilts.setExport(m, q, b))],
+    ['GET', new RegExp(`^${Q}/export$`), run((m, b, [q]) => quilts.exportStatus(m, q))],
     ['GET', new RegExp(`^${Q}/tags$`), run((m, b, [q]) => quilts.tags(m, q))],
     ['POST', new RegExp(`^${Q}/tags$`), run(async (m, b, [q]) => [201, await quilts.createTag(m, q, b)])],
     ['GET', new RegExp(`^${Q}/tags/(.+)$`), run((m, b, [q, name]) => quilts.getTag(m, q, decodeURIComponent(name)))],
@@ -98,6 +157,7 @@ export function quiltRoutes ({ quilts, identify }) {
     ['POST', new RegExp(`^${Q}/patches/(\\d+)/revert$`), run(async (m, b, [q, n]) => [201, await quilts.revert(m, q, { ...b, rev: `${b.line || 'main'}:${n}` })])],
     ['POST', new RegExp(`^${Q}/revert$`), run(async (m, b, [q]) => [201, await quilts.revert(m, q, b)])],
 
+    ['GET', new RegExp(`^${Q}/checks$`), run((m, b, [q], req) => { const s = query(req); return quilts.checkRuns(m, q, { state: s.get('state') || undefined, name: s.get('name') || undefined, tier: s.get('tier') || undefined, line: s.get('line') || undefined, square: s.get('square') || undefined, limit: s.get('limit') || 100 }) })],
     ['GET', new RegExp(`^${Q}/events$`), run((m, b, [q], req) => { const s = query(req); return quilts.events(m, q, { after: s.get('after') || 0, kinds: list(s.get('kinds')), limit: s.get('limit') || 100 }) })],
     ['POST', new RegExp(`^${Q}/webhook$`), run((m, b, [q]) => quilts.subscribe(m, q, b))],
     ['GET', new RegExp(`^${Q}/show/([^/]+)$`), run((m, b, [q, rev], req) => { const s = query(req); return quilts.show(m, q, rev, { format: s.get('format') || 'unified', paths: list(s.get('paths')) }) })],