heyquilt 0.3.121 → 0.3.122

package/src/quilts/runner.js

@@ -0,0 +1,95 @@
+// seam runner (plans/quilt-source-control/13 "Checks"): a ready-made check runner anyone starts on
+// their own machine. It polls the runs Seam asked its member to run (GET /checks?state=queued),
+// checks each run's commit out into a fresh block folder, runs the command there, and reports the
+// verdict (exit 0 green, anything else red) on the run's run_key with a link to the log. A run
+// Seam cancels (check.cancelled: a newer head superseded it) is stopped and not reported.
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { spawn } from 'node:child_process'
+import { checkout } from './block.js'
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+const safe = (key) => key.replace(/[^\w.-]+/g, '_').slice(0, 180)
+
+/** The log link a verdict carries: --log-url with {run_key} and {file}, else the log file's own address. */
+export function logLink (template, runKey, file) {
+  if (!template) return 'file://' + file
+  return template.replaceAll('{run_key}', encodeURIComponent(runKey)).replaceAll('{file}', encodeURIComponent(path.basename(file)))
+}
+
+/** The environment a run's command gets: what to run and, when Seam knows, which tests the change reaches. */
+export function runEnv (run, base = process.env) {
+  const a = run.affected || { confidence: 'all' }
+  return {
+    ...base,
+    SEAM_CHECK: run.name, SEAM_TIER: run.tier, SEAM_COMMIT: run.commit, SEAM_RUN_KEY: run.run_key,
+    SEAM_LINE: run.line || '', SEAM_SQUARE: run.square || '',
+    SEAM_AFFECTED_CONFIDENCE: a.confidence, SEAM_AFFECTED_TESTS: a.confidence === 'all' ? '' : (a.tests || []).join('\n')
+  }
+}
+
+/**
+ * Runs checks for one quilt. { client, quilt, checks: ['ci'], run: 'npm test', dir (where block
+ * folders and logs go), api, once (handle what is queued now, then return), intervalMs, logUrl,
+ * say(line) }. Returns the runs it finished: [{ run_key, status | 'cancelled', url }].
+ */
+export async function runChecks ({ client, quilt, checks, run: command, dir = path.join(os.tmpdir(), 'seam-runner'), api, once = false, intervalMs = 5000, logUrl, say = () => {}, keep = false }) {
+  if (!checks?.length) throw new Error('seam runner needs --check <name>[,<name>]')
+  if (!command) throw new Error('seam runner needs --run "<command>"')
+  const logs = path.join(dir, 'logs')
+  fs.mkdirSync(logs, { recursive: true })
+  const done = []
+  const seen = new Set()
+  for (;;) {
+    const queued = []
+    for (const name of checks) queued.push(...(await client.checkRuns(quilt, { state: 'queued', name })).runs)
+    const todo = queued.filter((r) => !seen.has(r.run_key)).sort((a, b) => a.at - b.at)
+    for (const r of todo) {
+      seen.add(r.run_key)
+      done.push(await runOne(r))
+    }
+    if (once) return done
+    await sleep(intervalMs)
+  }
+
+  async function runOne (r) {
+    const work = fs.mkdtempSync(path.join(dir, 'run-'))
+    const file = path.join(logs, safe(r.run_key) + '.log')
+    const url = logLink(logUrl, r.run_key, file)
+    say(`${r.name} (${r.tier}) on ${r.commit.slice(0, 12)}${r.square ? ` in ${r.square}` : ` at ${r.line}`}: running`)
+    const out = fs.openSync(file, 'w')
+    let status
+    try {
+      fs.writeSync(out, `seam runner: ${r.name} ${r.tier} ${r.commit} run_key ${r.run_key}\n$ ${command}\n`)
+      await checkout(client, { quilt, rev: r.commit, dir: work, api })
+      const child = spawn(command, { cwd: work, shell: true, env: runEnv(r), stdio: ['ignore', out, out], detached: process.platform !== 'win32' })
+      const exited = new Promise((resolve) => child.on('close', (code) => resolve(code)))
+      let cancelled = false
+      for (;;) {
+        const code = await Promise.race([exited, sleep(Math.min(intervalMs, 2000)).then(() => undefined)])
+        if (code !== undefined) { status = code === 0 ? 'green' : 'red'; break }
+        const gone = (await client.checkRuns(quilt, { state: 'cancelled', name: r.name, limit: 50 })).runs.some((x) => x.run_key === r.run_key)
+        if (gone && !cancelled) {
+          cancelled = true
+          try { process.kill(process.platform !== 'win32' ? -child.pid : child.pid, 'SIGTERM') } catch { child.kill('SIGTERM') }
+        }
+        if (cancelled) { await exited; status = 'cancelled'; break }
+      }
+    } catch (err) {
+      fs.writeSync(out, `\nseam runner: ${err.message}\n`)
+      status = 'red'
+    } finally {
+      fs.writeSync(out, `\nseam runner: ${status}\n`)
+      fs.closeSync(out)
+      if (!keep) fs.rmSync(work, { recursive: true, force: true })
+    }
+    if (status !== 'cancelled') {
+      const body = { check: r.name, status, run_key: r.run_key, url }
+      if (r.tier === 'pre_merge' && r.square) await client.reportSquareCheck(quilt, r.square, { ...body, head: r.commit })
+      else await client.reportCheck(quilt, r.line, body)
+    }
+    say(`${r.name} on ${r.commit.slice(0, 12)}: ${status} (log ${url})`)
+    return { run_key: r.run_key, status, url }
+  }
+}

package/src/quilts/server.js

@@ -0,0 +1,144 @@
+// Seam's own server: the routes in routes.js on an HTTP port, apart from any other product.
+// Who is calling comes from an identity service over HTTP (SEAM_IDENTITY_URL): Seam sends it the
+// caller's Authorization header and gets back the caller as a quilt member. Quilt's accounts API is
+// one such service (GET /v1/seam/me); any other host can be one by answering the same way.
+//
+//   seam serve            or   node src/quilts/server.js
+//   SEAM_AUTH_URL         Seam's own accounts: its Supabase project's address; Seam checks the
+//                         project's access tokens itself (SEAM_AUTH_JWT_SECRET for a shared secret)
+//   SEAM_IDENTITY_URL     an identity service, for every other token: GET with the caller's
+//                         Authorization → 200 { member_id, kind, name, tool?, on_behalf_of? }, or 401
+//                         (one of the two is required)
+//   SEAM_PORT / PORT      port (default 8080); SEAM_HOST (default 0.0.0.0)
+//   SEAM_STORE=supabase   rows and packs in Seam's own Supabase project: SEAM_SUPABASE_URL,
+//                         SEAM_SUPABASE_KEY (service role), SEAM_BUCKET (default quilt-packs);
+//                         otherwise a local store in SEAM_DATA (default ./seam-data)
+import http from 'node:http'
+import crypto from 'node:crypto'
+import { fileURLToPath } from 'node:url'
+import { quiltRoutes } from './routes.js'
+import { QuiltError } from './errors.js'
+import { quiltsFromEnv } from './setup.js'
+import { supabaseVerifier, seamIdentity } from './accounts.js'
+
+const MAX_BODY = 1024 * 1024
+const KINDS = new Set(['person', 'agent'])
+
+/**
+ * identify(req) from an identity service over HTTP. A caller it accepts is kept for `ttlMs`
+ * (keyed by a hash of the Authorization header, never the header itself); a refusal is not kept.
+ */
+export function remoteIdentity ({ url, fetch = globalThis.fetch, ttlMs = 30_000, now = Date.now, max = 10_000, timeoutMs = 5000 }) {
+  if (!url) throw new Error('remoteIdentity needs the identity service url (SEAM_IDENTITY_URL)')
+  const cache = new Map() // hash → { member, until }
+  return async function identify (req) {
+    const auth = String(req.headers?.authorization || '')
+    if (!auth) throw new QuiltError(401, 'not_signed_in', 'sign in: send "Authorization: Bearer <token>"')
+    const key = crypto.createHash('sha256').update(auth).digest('hex')
+    const hit = cache.get(key)
+    if (hit && hit.until > now()) return hit.member
+    let res
+    try {
+      res = await fetch(url, { headers: { authorization: auth, accept: 'application/json' }, signal: AbortSignal.timeout(timeoutMs) })
+    } catch {
+      throw new QuiltError(503, 'identity_unavailable', 'Seam could not reach its sign-in service; try again')
+    }
+    const data = await res.json().catch(() => null)
+    if (res.status === 401 || res.status === 403) throw new QuiltError(401, 'not_signed_in', (data && data.error) || 'this sign-in is unknown or expired')
+    const m = res.ok && data && typeof data === 'object' ? data : null
+    if (!m || typeof m.member_id !== 'string' || !m.member_id || !KINDS.has(m.kind)) throw new QuiltError(503, 'identity_unavailable', 'Seam\'s sign-in service gave an answer it cannot use; try again')
+    const member = { member_id: m.member_id, kind: m.kind, name: String(m.name || m.kind) }
+    if (m.tool) member.tool = String(m.tool)
+    if (m.on_behalf_of) member.on_behalf_of = String(m.on_behalf_of)
+    if (cache.size >= max) cache.delete(cache.keys().next().value)
+    cache.set(key, { member, until: now() + ttlMs })
+    return member
+  }
+}
+
+function readBody (req, max, raw) {
+  return new Promise((resolve, reject) => {
+    let size = 0; const chunks = []
+    req.on('data', (c) => { size += c.length; if (size > max) { req.destroy(); reject(new QuiltError(413, 'too_large', 'too large')) } else chunks.push(c) })
+    req.on('end', () => {
+      const buf = Buffer.concat(chunks)
+      if (raw) return resolve(buf)
+      if (!buf.length) return resolve({})
+      if (/^application\/x-www-form-urlencoded/i.test(String(req.headers['content-type'] || ''))) return resolve(Object.fromEntries(new URLSearchParams(buf.toString('utf8'))))
+      let body
+      try { body = JSON.parse(buf.toString('utf8')) } catch { return reject(new QuiltError(400, 'bad_request', 'bad json')) }
+      resolve(body && typeof body === 'object' && !Array.isArray(body) ? body : {})
+    })
+    req.on('error', reject)
+  })
+}
+
+const decode = (s) => { try { return decodeURIComponent(s) } catch { throw new QuiltError(400, 'bad_request', 'bad path') } }
+
+/** Seam on a port: { server, url, close }. */
+export async function startSeamServer ({ quilts, identify, port = 0, host = '127.0.0.1', log = () => {} }) {
+  if (!quilts) throw new Error('startSeamServer needs quilts (createQuilts)')
+  const routes = quiltRoutes({ quilts, identify })
+  const server = http.createServer(async (req, res) => {
+    const send = (status, data) => {
+      res.writeHead(status, { 'content-type': 'application/json', 'cache-control': 'no-store' })
+      res.end(JSON.stringify(data))
+    }
+    try {
+      const url = new URL(req.url, 'http://x')
+      if (req.method === 'GET' && (url.pathname === '/healthz' || url.pathname === '/')) return send(200, { ok: true, service: 'seam' })
+      const route = routes.find(([m, re]) => m === req.method && re.test(url.pathname))
+      if (!route) return send(404, { ok: false, error: 'not found', code: 'not_found' })
+      const opts = route[3] || {}
+      const body = opts.raw ? await readBody(req, opts.maxBody || MAX_BODY, true) : ['POST', 'PUT', 'PATCH'].includes(req.method) ? await readBody(req, opts.maxBody || MAX_BODY, false) : {}
+      const out = await route[2](req, body, url.pathname.match(route[1]).slice(1).map(decode))
+      if (Array.isArray(out)) send(out[0], out[1])
+      else send(200, out)
+    } catch (err) {
+      if (err instanceof QuiltError) return send(err.status, { ok: false, error: err.message, code: err.code, ...err.extra })
+      if (err && Number.isInteger(err.status) && err.status >= 400 && err.status < 500) return send(err.status, { ok: false, error: err.message })
+      log(`seam error: ${err?.stack || err?.message || err}`)
+      send(500, { ok: false, error: 'internal error', code: 'internal' })
+    }
+  })
+  await new Promise((resolve) => server.listen(port, host, resolve))
+  const at = server.address()
+  return { server, url: `http://${at.address.includes(':') ? `[${at.address}]` : at.address}:${at.port}`, close: () => new Promise((resolve) => server.close(resolve)) }
+}
+
+/** The SEAM_* settings as the store settings setup.js reads (its QUILT_SOURCE_* names still work). */
+export function storeEnv (env) {
+  const pick = (seam, old) => env[seam] ?? env[old]
+  const out = { QUILT_SOURCE: '1' }
+  const map = { QUILT_SOURCE_STORE: pick('SEAM_STORE', 'QUILT_SOURCE_STORE'), QUILT_SOURCE_SUPABASE_URL: pick('SEAM_SUPABASE_URL', 'QUILT_SOURCE_SUPABASE_URL'), QUILT_SOURCE_SUPABASE_KEY: pick('SEAM_SUPABASE_KEY', 'QUILT_SOURCE_SUPABASE_KEY'), QUILT_SOURCE_BUCKET: pick('SEAM_BUCKET', 'QUILT_SOURCE_BUCKET'), QUILT_SOURCE_DATA: env.SEAM_DATA ?? env.QUILT_SOURCE_DATA ?? './seam-data', SUPABASE_URL: env.SUPABASE_URL, SEAM_SITE_URL: env.SEAM_SITE_URL }
+  for (const [k, v] of Object.entries(map)) if (v !== undefined) out[k] = v
+  return out
+}
+
+/**
+ * Who is calling, from the settings: Seam's own sign-in (SEAM_AUTH_URL, Seam's Supabase project,
+ * with SEAM_AUTH_JWT_SECRET when it still signs with a shared secret) checked here, and/or an
+ * identity service over HTTP (SEAM_IDENTITY_URL) for every other token.
+ */
+export function identityFromEnv (env, quilts, { fetch = globalThis.fetch } = {}) {
+  const authUrl = env.SEAM_AUTH_URL || ''
+  const verify = authUrl ? supabaseVerifier({ authUrl, jwtSecret: env.SEAM_AUTH_JWT_SECRET || null, fetch }) : null
+  const fallback = env.SEAM_IDENTITY_URL ? remoteIdentity({ url: env.SEAM_IDENTITY_URL, fetch, ...(env.SEAM_IDENTITY_TTL_MS ? { ttlMs: Number(env.SEAM_IDENTITY_TTL_MS) } : {}) }) : null
+  if (!verify && !fallback) throw new Error('seam serve needs a sign-in: SEAM_AUTH_URL (Seam\'s own accounts, its Supabase project) and/or SEAM_IDENTITY_URL (an identity service, e.g. https://api.heyquilt.com/v1/seam/me)')
+  return seamIdentity({ quilts, verify, fallback })
+}
+
+/** `seam serve`: the settings from the environment, a port, and a log line. */
+export async function serveFromEnv (env = process.env, { log = console.log } = {}) {
+  if (!env.SEAM_AUTH_URL && !env.SEAM_IDENTITY_URL) identityFromEnv(env, null)
+  const quilts = await quiltsFromEnv(storeEnv(env), { log })
+  const identify = identityFromEnv(env, quilts)
+  const s = await startSeamServer({ quilts, identify, port: Number(env.SEAM_PORT || env.PORT || 8080), host: env.SEAM_HOST || '0.0.0.0', log })
+  const from = [env.SEAM_AUTH_URL && `Seam accounts (${new URL(env.SEAM_AUTH_URL).host})`, env.SEAM_IDENTITY_URL && new URL(env.SEAM_IDENTITY_URL).host].filter(Boolean).join(' and ')
+  log(`seam: listening on ${s.url}, sign-in from ${from}`)
+  return s
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  serveFromEnv().catch((err) => { console.error(err.message || err); process.exit(1) })
+}

package/src/quilts/service.js

@@ -31,7 +31,7 @@ export const shortId = (id, n = 12) => (id ? id.slice(0, n) : null)
 
 const statusOf = {
   not_found: 404, head_moved: 409, tip_moved: 409, square_merging: 409, square_closed: 409, holder_moved: 409, square_state: 409, exists: 409, slug_taken: 409,
-  conflict: 422, line_frozen: 423, line_exists: 409, tag_exists: 409, claim_refused: 412, claim_taken: 409, policy: 428, own_square: 403, parent_open: 409, bad_parent: 422, bad_request: 400, forbidden: 403, not_holder: 403, too_many_files: 422, pack_corrupt: 422, key_exists: 409
+  conflict: 422, line_frozen: 423, line_exists: 409, tag_exists: 409, claim_refused: 412, claim_taken: 409, policy: 428, own_square: 403, parent_open: 409, bad_parent: 422, bad_request: 400, forbidden: 403, not_holder: 403, too_many_files: 422, pack_corrupt: 422, key_exists: 409, moved: 409, too_many_agents: 409, not_claimable: 403
 }
 
 /** A store error as a QuiltError with its wire status. */
@@ -617,6 +617,7 @@ export function createQuiltService ({ store, objects, now = Date.now }) {
       const path = cleanPath(ch.path)
       if (path.split('/')[0] === '.seam') throw new QuiltError(400, 'bad_request', '.seam/ is the block\'s own folder and is never committed')
       if (ch.op === 'delete') { out.push({ path, op: 'delete' }); continue }
+      if (ch.op === 'conflict') { out.push(await importedTerm(q, path, ch, blobs)); continue }
       if (ch.op !== 'put') throw new QuiltError(400, 'bad_request', `${path}: op is put or delete`)
       let id = ch.blob
       let size = ch.size
@@ -650,6 +651,45 @@ export function createQuiltService ({ store, objects, now = Date.now }) {
     return { changes: out, blobs, resolved }
   }
 
+  /**
+   * A conflict brought in from another system (16: an open merge of a session that became a
+   * quilt): `{ path, op: 'conflict', reason: 'import', base, ours, theirs }`, each side
+   * `{ content (base64), from_square?, from_commit?, by? }` or null for a side without the file.
+   * Writes a `content` term (`edit_vs_delete` when a side is gone) whose origin says it was
+   * imported; from then on it is a term like a merge's (07): materialised, settled by hand.
+   */
+  async function importedTerm (q, path, ch, blobs) {
+    if (ch.reason !== 'import') throw new QuiltError(400, 'bad_request', `${path}: a commit writes a conflict only with reason 'import'; merges make the others`)
+    if (!ch.ours && !ch.theirs) throw new QuiltError(400, 'bad_request', `${path}: a conflict needs at least one side with the file`)
+    const side = async (s, which) => {
+      if (s == null) return {}
+      if (typeof s !== 'object') throw new QuiltError(400, 'bad_request', `${path}: ${which} is { content } or null`)
+      const out = {}
+      if (s.content != null) {
+        const bytes = Buffer.from(String(s.content), 'base64')
+        out.blob = blobId(bytes)
+        out.mode = 'file'
+        blobs.push({ kind: 'blob', id: out.blob, bytes })
+      }
+      if (s.from_commit != null) {
+        if (!isId(s.from_commit) || !(await store.getCommit(q, s.from_commit))) throw new QuiltError(422, 'bad_request', `${path}: ${which}.from_commit is not a commit of this quilt`)
+        out.from_commit = s.from_commit
+      }
+      if (s.from_square != null) {
+        const sq = await store.getSquare(String(s.from_square))
+        if (!sq || sq.quilt_id !== q) throw new QuiltError(422, 'bad_request', `${path}: ${which}.from_square is not a square of this quilt`)
+        out.from_square = sq.id
+      }
+      if (s.by != null) out.by = String(s.by).slice(0, 200)
+      return out
+    }
+    const [base, ours, theirs] = [await side(ch.base, 'base'), await side(ch.ours, 'ours'), await side(ch.theirs, 'theirs')]
+    const term = { kind: ours.blob && theirs.blob ? 'content' : 'edit_vs_delete', adds: [ours, theirs], removes: [base], origin: { reason: 'import' } }
+    const id = termId(term)
+    blobs.push({ kind: 'term', id, bytes: termBytes(term) })
+    return { path, op: 'conflict', term: id }
+  }
+
   // ---- uploads (04: have?, then one pack of what is missing) ----
 
   async function have (me, ref, ids) {

package/src/quilts/setup.js

@@ -6,7 +6,10 @@
 //                             QUILT_SOURCE_SUPABASE_KEY (its service role key); the rows from the
 //                             *_quilts.sql migration, the packs in its bucket QUILT_SOURCE_BUCKET
 //                             (default quilt-packs)
+//   SEAM_IMPORT_SCRATCH=<dir>   where imports from a git remote keep their mirrors (default the temp folder)
+//   SEAM_SECRET_<NAME>        a credential an import names (`--credential name`): user:token or a token
 import path from 'node:path'
+import os from 'node:os'
 import { createQuilts } from './index.js'
 import { createMemoryQuiltStore } from './store-memory.js'
 import { BlobstoreObjects, diskObjects } from './objects.js'
@@ -24,11 +27,15 @@ export async function quiltsFromEnv (env, { memory = false, log = () => {} } = {
     const store = createSupabaseQuiltStore({ url, serviceKey: key })
     const objects = new BlobstoreObjects(new SupabaseBucket({ url, key, bucket: env.QUILT_SOURCE_BUCKET || 'quilt-packs' }))
     log(`quilt source control: rows and packs in ${new URL(url).host}`)
-    return createQuilts({ store, objects, events: { log } })
+    const quilts = createQuilts({ store, objects, events: { log }, siteUrl: env.SEAM_SITE_URL || undefined, importFollow: { scratch: env.SEAM_IMPORT_SCRATCH || path.join(os.tmpdir(), 'seam-imports') } })
+    quilts.follower.start()
+    return quilts
   }
   const dir = path.resolve(env.QUILT_SOURCE_DATA || './quilt-source-data')
   const store = createMemoryQuiltStore({ file: path.join(dir, 'journal.jsonl') })
   log(`quilt source control: local store in ${dir}${memory ? '' : ' (QUILT_SOURCE_DATA)'}`)
   // The local prototype may POST events to webhooks on this machine; the hosted one may not.
-  return createQuilts({ store, objects: diskObjects(path.join(dir, 'packs')), events: { allowLocalWebhooks: true, log } })
+  const quilts = createQuilts({ store, objects: diskObjects(path.join(dir, 'packs')), events: { allowLocalWebhooks: true, log }, siteUrl: env.SEAM_SITE_URL || undefined, importFollow: { scratch: env.SEAM_IMPORT_SCRATCH || path.join(dir, 'imports'), allowLocal: true } })
+  quilts.follower.start()
+  return quilts
 }

package/src/quilts/store-memory.js

@@ -23,9 +23,17 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     reviews: new Map(), // quilt → review rows (13), oldest first
     signingKeys: new Map(), // key id → { id, member, public_key, name, added_at, removed_at }
     signatures: new Map(), // quilt + commit → signature rows
+    accounts: new Map(), // account id → { id, email, name, member_id, created_at, seen_at } (accounts.js)
+    memberClaims: new Map(), // member id → { member_id, email, name, claimed_by, claimed_at } (members made before Seam accounts)
+    agents: new Map(), // agent id → { id, account_id, name, created_at, revoked_at } (keys.js)
+    keys: new Map(), // key id → { id, hash, account_id, kind, agent_id, public_key, name, created_at, expires_at, revoked_at }
+    oauthClients: new Map(), // client id → { id, account_id, name, redirect_uris, created_at, revoked_at } (oauth.js)
+    oauthCodes: new Map(), // code hash → { id, code_hash, client_id, account_id, redirect_uri, challenge, scopes, created_at, expires_at, used_at }
+    deviceLinks: new Map(), // link id → { id, code_hash, user_code, public_key, name, platform, state, account_id, created_at, expires_at }
     tokens: new Map(), // token id → { id, quilt_id, name, level, hash, created_by, created_at, revoked_at } (tokens.js)
     lineRules: new Map(), // quilt → Map of line → { line, approvals, checks }
     squareChecks: new Map(), // square → Map of check name → its latest report
+    checkRuns: new Map(), // quilt → Map of run_key → a check run (13)
     claims: new Map(), // quilt → Map of claim id → claim (06: rows, not log entries)
     resolutions: new Map(), // quilt → Map of key → remembered resolution (07, D12)
     tags: new Map(), // quilt + name → tag (06: never moved or deleted)
@@ -240,7 +248,7 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
       if (expect && 'holder' in expect && s.holder !== expect.holder) throw Object.assign(new StoreError('holder_moved', `the square is now held by ${s.holder}`), { holder: s.holder })
       if (expect && 'state' in expect && s.state !== expect.state) throw Object.assign(new StoreError('square_state', `the square is ${s.state}`), { state: s.state })
       appendLog(s.quilt_id, { kind: 'square', square: s.id, actor, at, payload: { op, ...patch, ...log } })
-      Object.assign(s, patch, { updated_at: at })
+      Object.assign(s, patch, { updated_at: at }, patch.state === 'merged' ? { closed_at: at } : {})
       return { ...s }
     },
 
@@ -356,6 +364,95 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
       if (!row.removed_at) row.removed_at = at
       return clone(row)
     },
+    // A Seam account (accounts.js): made on its first verified call, its email kept current.
+    accountFor ({ id, email, name, at }) {
+      const row = t.accounts.get(id)
+      if (row) { row.email = email; row.seen_at = at; return clone(row) }
+      const taken = new Set([...t.accounts.values()].map((a) => a.member_id))
+      const c = [...t.memberClaims.values()].filter((x) => x.email === String(email).toLowerCase() && x.member_id.startsWith('person:') && !x.claimed_by && !taken.has(x.member_id)).sort((a, b) => a.member_id < b.member_id ? -1 : 1)[0]
+      t.accounts.set(id, { id, email, name, member_id: c ? c.member_id : `person:${id}`, created_at: at, seen_at: at })
+      if (c) { c.claimed_by = id; c.claimed_at = at }
+      return clone(t.accounts.get(id))
+    },
+    addMemberClaims ({ claims }) {
+      let added = 0
+      for (const c of claims) if (!t.memberClaims.has(c.member_id)) { t.memberClaims.set(c.member_id, { member_id: c.member_id, email: String(c.email).toLowerCase(), name: c.name ?? null, claimed_by: null, claimed_at: null }); added++ }
+      return { added }
+    },
+    // Seam's own keys (keys.js): a computer's or an agent's; `replace` revokes its earlier live keys.
+    addKey (r) {
+      if (r.agent_id) { const a = t.agents.get(r.agent_id); if (!a || a.account_id !== r.account_id || a.revoked_at) throw new StoreError('not_found', 'no such agent') }
+      if (r.replace) for (const x of t.keys.values()) if (x.account_id === r.account_id && !x.revoked_at && ((r.agent_id && x.agent_id === r.agent_id) || (r.public_key && x.public_key === r.public_key) || (r.grant_id && x.grant_id === r.grant_id))) x.revoked_at = r.created_at
+      const { replace, ...row } = r
+      t.keys.set(r.id, { agent_id: null, public_key: null, expires_at: null, client_id: null, grant_id: null, scopes: null, ...row, revoked_at: null })
+      return clone(t.keys.get(r.id))
+    },
+    revokeKey ({ id, at }) {
+      const x = t.keys.get(id)
+      if (!x) throw new StoreError('not_found', 'no such key')
+      if (!x.revoked_at) x.revoked_at = at
+      return clone(x)
+    },
+    createAgent ({ id, account_id, name, created_at, max = 100, claim }) {
+      const acct = t.accounts.get(account_id)
+      if (!acct) throw new StoreError('not_found', 'no such account')
+      if ([...t.agents.values()].filter((a) => a.account_id === account_id && !a.revoked_at).length >= max) throw new StoreError('too_many_agents', 'too many agents; revoke one first')
+      if (claim) {
+        const c = t.memberClaims.get(claim)
+        if (!c || c.email !== acct.email.toLowerCase() || c.claimed_by) throw new StoreError('not_claimable', 'that agent is not one of yours to re-link, or it was re-linked already')
+        id = claim.slice(6); c.claimed_by = account_id; c.claimed_at = created_at
+      }
+      t.agents.set(id, { id, account_id, name, created_at, revoked_at: null })
+      return clone(t.agents.get(id))
+    },
+    revokeAgent ({ id, account_id, at }) {
+      const a = t.agents.get(id)
+      if (!a || a.account_id !== account_id) throw new StoreError('not_found', 'no such agent')
+      if (!a.revoked_at) { a.revoked_at = at; for (const x of t.keys.values()) if (x.agent_id === id && !x.revoked_at) x.revoked_at = at }
+      return clone(a)
+    },
+    // OAuth (oauth.js): an app's client, its one-use codes, and ending a grant's tokens.
+    addOAuthClient (r) {
+      if (!t.accounts.has(r.account_id)) throw new StoreError('not_found', 'no such account')
+      t.oauthClients.set(r.id, { ...r, revoked_at: null })
+      return clone(t.oauthClients.get(r.id))
+    },
+    revokeOAuthClient ({ id, account_id, at }) {
+      const c = t.oauthClients.get(id)
+      if (!c || c.account_id !== account_id) throw new StoreError('not_found', 'no such app')
+      if (!c.revoked_at) { c.revoked_at = at; for (const x of t.keys.values()) if (x.client_id === id && !x.revoked_at) x.revoked_at = at }
+      return clone(c)
+    },
+    addOAuthCode (r) {
+      for (const [h, c] of t.oauthCodes) if (c.expires_at < r.created_at - 86400_000) t.oauthCodes.delete(h)
+      t.oauthCodes.set(r.code_hash, { ...r, used_at: null })
+      return clone(t.oauthCodes.get(r.code_hash))
+    },
+    takeOAuthCode ({ code_hash: h, at }) {
+      const c = t.oauthCodes.get(h)
+      if (!c) return null
+      const out = { ...clone(c), was_used: c.used_at != null }
+      if (!c.used_at) c.used_at = at
+      return out
+    },
+    revokeGrant ({ grant_id: g, at }) {
+      let n = 0
+      for (const x of t.keys.values()) if (x.grant_id === g && !x.revoked_at) { x.revoked_at = at; n++ }
+      return { revoked: n }
+    },
+    addDeviceLink (r) {
+      for (const [id, l] of t.deviceLinks) if (l.expires_at < r.created_at - 86400_000) t.deviceLinks.delete(id)
+      if ([...t.deviceLinks.values()].some((l) => l.user_code === r.user_code)) throw new StoreError('exists', 'this code is taken')
+      t.deviceLinks.set(r.id, { platform: null, ...r, state: 'pending', account_id: null })
+      return clone(t.deviceLinks.get(r.id))
+    },
+    setDeviceLink ({ id, from, state, account_id }) {
+      const l = t.deviceLinks.get(id)
+      if (!l || l.state !== from) throw new StoreError('moved', 'this sign-in link changed; start again')
+      l.state = state
+      if (account_id) l.account_id = account_id
+      return clone(l)
+    },
     // A quilt token (tokens.js): a row and its membership token:<id>, made and ended together.
     createToken (r) {
       quiltRow(r.quilt_id)
@@ -392,12 +489,31 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
       return clone(r)
     },
     // What a line needs to take a merge (13): a number of approvals.
-    setLineRule ({ quilt_id: q, line, approvals, checks = [] }) {
+    setLineRule ({ quilt_id: q, line, approvals, checks = [], runners = {}, targeting = {} }) {
       if (!t.lines.has(k(q, line))) throw new StoreError('not_found', `no line ${line}`)
       let m = t.lineRules.get(q); if (!m) { m = new Map(); t.lineRules.set(q, m) }
-      m.set(line, { line, approvals, checks: [...checks] })
+      m.set(line, { line, approvals, checks: [...checks], runners: clone(runners), targeting: clone(targeting), since_seq: quiltRow(q).head_seq })
       return clone(m.get(line))
     },
+    // Check runs (13): added once per run_key (a repeat is the same run); returns the stored rows.
+    addCheckRuns ({ quilt_id: q, runs }) {
+      quiltRow(q)
+      let m = t.checkRuns.get(q); if (!m) { m = new Map(); t.checkRuns.set(q, m) }
+      return runs.map((r) => { if (!m.has(r.run_key)) m.set(r.run_key, { ...clone(r), quilt_id: q, affected: r.affected ?? null, url: r.url ?? null, verdict: r.verdict ?? null, by: r.by ?? null, advisory: !!r.advisory, finished_at: r.finished_at ?? null }); return clone(m.get(r.run_key)) })
+    },
+    // Asks a check's runners again (13): a policy log row the events job turns into check.requested.
+    requestCheckRun ({ quilt_id: q, line, square_id: sq, actor, at, payload }) {
+      if (!t.lines.has(k(q, line))) throw new StoreError('not_found', `no line ${line}`)
+      return { seq: appendLog(q, { kind: 'policy', line, square: sq || null, actor, at, payload: clone(payload) }).seq }
+    },
+    // A run's state and verdict; `expect_state` refuses when it moved (square_state).
+    setCheckRun ({ quilt_id: q, run_key: key, state, verdict, by, url, at, expect_state: expect }) {
+      const r = t.checkRuns.get(q)?.get(key)
+      if (!r) throw new StoreError('not_found', `no check run ${key}`)
+      if (expect && r.state !== expect) throw Object.assign(new StoreError('square_state', `the run is ${r.state}`), { state: r.state })
+      Object.assign(r, { state, ...(verdict !== undefined ? { verdict } : {}), ...(by !== undefined ? { by } : {}), ...(url !== undefined ? { url } : {}), ...(state === 'done' || state === 'cancelled' ? { finished_at: at } : {}) })
+      return clone(r)
+    },
     // A check's latest result on a square (13): one row per (square, check), replaced by each report.
     setSquareCheck ({ quilt_id: q, square_id: sq, name, status, head, by, at }) {
       const row = t.squares.get(sq)
@@ -436,6 +552,36 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
       Object.assign(ln, { frozen: !!frozen, updated_at: at })
       return clone(ln)
     },
+    // The quilt's import record (14), in settings.import, with the lines it freezes (freeze: true,
+    // reason import_follow) or unfreezes (freeze: false) in the same transaction. Refuses with
+    // `conflict` when the record's state is not expect_state, or a line's tip is not expect_tips[line].
+    setImport ({ quilt_id: q, import: rec, freeze = null, lines = [], expect_state, expect_tips, actor, at }) {
+      const quilt = quiltRow(q)
+      const cur = quilt.settings?.import || null
+      if (expect_state !== undefined && (cur?.state || null) !== expect_state) throw new StoreError('conflict', `the import is ${cur?.state || 'not started'}`, { state: cur?.state || null })
+      for (const [name, tip] of Object.entries(expect_tips || {})) {
+        const ln = t.lines.get(k(q, name))
+        if ((ln?.tip || null) !== (tip || null)) throw new StoreError('conflict', `${name} moved`, { line: name, tip: ln?.tip || null })
+      }
+      if (freeze !== null) {
+        for (const name of lines) {
+          const ln = t.lines.get(k(q, name))
+          if (!ln || !!ln.frozen === !!freeze) continue
+          appendLog(q, { kind: 'policy', line: name, actor, at, payload: { op: freeze ? 'freeze' : 'unfreeze', reason: 'import_follow' } })
+          Object.assign(ln, { frozen: !!freeze, updated_at: at })
+        }
+      }
+      if (!cur || cur.state !== rec.state) appendLog(q, { kind: 'policy', actor, at, payload: { op: 'import', id: rec.id, state: rec.state } })
+      quilt.settings = { ...(quilt.settings || {}), import: clone(rec) }
+      return clone(rec)
+    },
+    // The quilt's export to a git remote (14), in settings.export; a policy row when `logged`.
+    setExport ({ quilt_id: q, export: rec, logged = false, actor, at }) {
+      const quilt = quiltRow(q)
+      if (logged) appendLog(q, { kind: 'policy', actor, at, payload: { op: 'export', target: rec.target, enabled: !!rec.enabled, state: rec.status?.state || null } })
+      quilt.settings = { ...(quilt.settings || {}), export: clone(rec) }
+      return clone(rec)
+    },
     // The merge window's state on a line (07): current window, maximum, red checks.
     setLineWindow ({ quilt_id: q, line, merge_window: w, merge_window_max: m, red_checks: red }) {
       const ln = t.lines.get(k(q, line))
@@ -566,11 +712,24 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     async resolutions (q) { return [...(t.resolutions.get(q)?.values() || [])].map(clone) },
     async signingKey (id) { const r = t.signingKeys.get(id); return r ? clone(r) : null },
     async tokens (q) { return [...t.tokens.values()].filter((r) => r.quilt_id === q).sort((a, b) => a.created_at - b.created_at).map(clone) },
+    async keyByHash (hash) { const r = [...t.keys.values()].find((x) => x.hash === hash); return r ? clone(r) : null },
+    async deviceKey (publicKey) { const r = [...t.keys.values()].filter((x) => x.public_key === publicKey && !x.revoked_at).sort((a, b) => b.created_at - a.created_at)[0]; return r ? clone(r) : null },
+    async agentClaims (email) { return { claims: [...t.memberClaims.values()].filter((c) => c.email === String(email).toLowerCase() && c.member_id.startsWith('agent:') && !c.claimed_by).sort((a, b) => a.member_id < b.member_id ? -1 : 1).map((c) => ({ member_id: c.member_id, name: c.name })) } },
+    async getAgent (id) { const r = t.agents.get(id); return r ? clone(r) : null },
+    async agentsOf (accountId) { return [...t.agents.values()].filter((a) => a.account_id === accountId).sort((a, b) => a.created_at - b.created_at).map(clone) },
+    async deviceLink (by) { const r = [...t.deviceLinks.values()].find((l) => (by.code_hash && l.code_hash === by.code_hash) || (by.user_code && l.user_code === by.user_code)); return r ? clone(r) : null },
+    async oauthClient (id) { const r = t.oauthClients.get(id); return r ? clone(r) : null },
+    async oauthClientsOf (accountId) { return [...t.oauthClients.values()].filter((c) => c.account_id === accountId).sort((a, b) => a.created_at - b.created_at).map(clone) },
+    async getAccount (id) { const r = t.accounts.get(id); return r ? clone(r) : null },
     async tokenByHash (hash) { const r = [...t.tokens.values()].find((x) => x.hash === hash); return r ? clone(r) : null },
     async signingKeys (member) { return [...t.signingKeys.values()].filter((r) => r.member === member).sort((a, b) => a.added_at - b.added_at).map(clone) },
     async signaturesOf (q, commits) { return commits.flatMap((c) => t.signatures.get(k(q, c)) || []).map(clone) },
     async reviews (q, sq) { return (t.reviews.get(q) || []).filter((r) => r.square_id === sq).map(clone) },
     async squareChecks (q, sq) { return t.squares.get(sq)?.quilt_id === q ? [...(t.squareChecks.get(sq)?.values() || [])].map(clone) : [] },
+    async checkRuns (q, { state, name, tier, line, square_id: sq, limit = 100 } = {}) {
+      const all = [...(t.checkRuns.get(q)?.values() || [])].filter((r) => (!state || r.state === state) && (!name || r.name === name) && (!tier || r.tier === tier) && (!line || r.line === line) && (!sq || r.square_id === sq))
+      return all.reverse().slice(0, limit).map(clone)
+    },
     async lineRules (q) { return [...(t.lineRules.get(q)?.values() || [])].map(clone) },
     async claims (q) { return [...(t.claims.get(q)?.values() || [])].map(clone) },
     async getTag (q, name) { return clone(t.tags.get(k(q, name))) },
@@ -677,6 +836,8 @@ export function createMemoryQuiltStore ({ file = null } = {}) {
     async gitShas (q, shas) { const out = {}; for (const sha of shas) { const id = t.gitShas.get(k(q, sha)); if (id) out[sha] = id } return out },
     async gitShaOf (q, id) { return t.gitOf.get(k(q, id)) || null },
     async getBlock (id) { return clone(t.blocks.get(id)) },
+    /** Every import still following git: [{ quilt_id, import }]. */
+    async importsFollowing () { const out = []; for (const row of t.quilts.values()) if (row.settings?.import?.state === 'following') out.push({ quilt_id: row.id, import: clone(row.settings.import) }); return out },
     close () { if (journal) { fs.closeSync(journal); journal = null } }
   })
   return store

package/src/quilts/store-rpc.js

@@ -22,7 +22,7 @@ export function createRpcQuiltStore (rpc) {
     createQuilt: 'quilt_create_quilt', setMember: 'quilt_set_member', sealPack: 'quilt_seal_pack', stageFiles: 'quilt_stage_files',
     openSquare: 'quilt_open_square', commit: 'quilt_commit', beginMerge: 'quilt_begin_merge', endMerge: 'quilt_end_merge', merge: 'quilt_merge',
     importCommit: 'quilt_import_commit', setSnapshot: 'quilt_set_snapshot', setSquare: 'quilt_set_square', setGitSha: 'quilt_set_git_sha', remember: 'quilt_remember',
-    addEvents: 'quilt_add_events', setWebhook: 'quilt_set_webhook', takeLease: 'quilt_take_lease', openAndCommit: 'quilt_open_and_commit', giveLease: 'quilt_give_lease', addStubs: 'quilt_add_stubs', fillLinePaths: 'quilt_fill_line_paths', setConflicted: 'quilt_set_conflicted', setArchive: 'quilt_set_archive', setLineWindow: 'quilt_set_line_window', createLine: 'quilt_create_line', setLineFrozen: 'quilt_set_line_frozen', createTag: 'quilt_create_tag', setLive: 'quilt_set_live', createClaim: 'quilt_create_claim', deleteClaim: 'quilt_delete_claim', setResolution: 'quilt_set_resolution', deleteResolution: 'quilt_delete_resolution', addReview: 'quilt_add_review', setLineRule: 'quilt_set_line_rule', setSquareCheck: 'quilt_set_square_check', addSigningKey: 'quilt_add_signing_key', removeSigningKey: 'quilt_remove_signing_key', addSignature: 'quilt_add_signature', createToken: 'quilt_create_token', revokeToken: 'quilt_revoke_token'
+    addEvents: 'quilt_add_events', setWebhook: 'quilt_set_webhook', takeLease: 'quilt_take_lease', openAndCommit: 'quilt_open_and_commit', giveLease: 'quilt_give_lease', addStubs: 'quilt_add_stubs', fillLinePaths: 'quilt_fill_line_paths', setConflicted: 'quilt_set_conflicted', setArchive: 'quilt_set_archive', setLineWindow: 'quilt_set_line_window', createLine: 'quilt_create_line', setLineFrozen: 'quilt_set_line_frozen', createTag: 'quilt_create_tag', setLive: 'quilt_set_live', createClaim: 'quilt_create_claim', deleteClaim: 'quilt_delete_claim', setResolution: 'quilt_set_resolution', deleteResolution: 'quilt_delete_resolution', addReview: 'quilt_add_review', setLineRule: 'quilt_set_line_rule', setSquareCheck: 'quilt_set_square_check', addSigningKey: 'quilt_add_signing_key', removeSigningKey: 'quilt_remove_signing_key', addSignature: 'quilt_add_signature', createToken: 'quilt_create_token', revokeToken: 'quilt_revoke_token', setImport: 'quilt_set_import', setExport: 'quilt_set_export', addCheckRuns: 'quilt_add_check_runs', setCheckRun: 'quilt_set_check_run', requestCheckRun: 'quilt_request_check_run', accountFor: 'quilt_account_for', addKey: 'quilt_add_key', revokeKey: 'quilt_revoke_key', createAgent: 'quilt_create_agent', revokeAgent: 'quilt_revoke_agent', addDeviceLink: 'quilt_add_device_link', setDeviceLink: 'quilt_set_device_link', addMemberClaims: 'quilt_add_member_claims', addOAuthClient: 'quilt_add_oauth_client', revokeOAuthClient: 'quilt_revoke_oauth_client', addOAuthCode: 'quilt_add_oauth_code', takeOAuthCode: 'quilt_take_oauth_code', revokeGrant: 'quilt_revoke_grant'
   }
   const store = {}
   for (const [name, fn] of Object.entries(writes)) store[name] = (args) => call(fn, args)
@@ -40,12 +40,22 @@ export function createRpcQuiltStore (rpc) {
     claims: (q) => call('quilt_claims_of', { quilt_id: q }),
     tokens: (q) => call('quilt_tokens_of', { quilt_id: q }),
     tokenByHash: (hash) => call('quilt_token_by_hash', { hash }),
+    oauthClient: (id) => call('quilt_oauth_client', { id }),
+    oauthClientsOf: (accountId) => call('quilt_oauth_clients_of', { account_id: accountId }),
+    getAccount: (id) => call('quilt_get_account', { id }),
+    keyByHash: (hash) => call('quilt_key_by_hash', { hash }),
+    deviceKey: (publicKey) => call('quilt_device_key', { public_key: publicKey }),
+    getAgent: (id) => call('quilt_get_agent', { id }),
+    agentClaims: (email) => call('quilt_agent_claims', { email }),
+    agentsOf: (accountId) => call('quilt_agents_of', { account_id: accountId }),
+    deviceLink: (by) => call('quilt_device_link', by),
     signingKey: (id) => call('quilt_signing_key', { id }),
     signingKeys: (member) => call('quilt_signing_keys_of', { member }),
     signaturesOf: (q, commits) => call('quilt_signatures_of', { quilt_id: q, commits }),
     reviews: (q, sq) => call('quilt_reviews_of', { quilt_id: q, square_id: sq }),
     squareChecks: (q, sq) => call('quilt_square_checks_of', { quilt_id: q, square_id: sq }),
     lineRules: (q) => call('quilt_line_rules_of', { quilt_id: q }),
+    checkRuns: (q, { state, name, tier, line, square_id: sq, limit = 100 } = {}) => call('quilt_check_runs_of', { quilt_id: q, state, name, tier, line, square_id: sq, limit }),
     resolution: (q, key) => call('quilt_resolution', { quilt_id: q, key }),
     resolutions: (q) => call('quilt_resolutions_of', { quilt_id: q }),
     getSquare: (id) => call('quilt_get_square', { id }),
@@ -74,6 +84,7 @@ export function createRpcQuiltStore (rpc) {
     gitShas: async (q, shas) => (await call('quilt_git_shas', { quilt_id: q, shas })) || {},
     gitShaPrefix: (q, prefix) => call('quilt_git_sha_prefix', { quilt_id: q, prefix }),
     gitShaOf: (q, id) => call('quilt_git_sha_of', { quilt_id: q, commit_id: id }),
+    importsFollowing: () => call('quilt_imports_following', {}),
     close () {}
   })
 }