heyquilt 0.3.121 → 0.3.138

package/src/api/routes/seam-connect.js

@@ -0,0 +1,103 @@
+// "Connect Seam": a Quilt person links their own Seam account to Quilt, the way any app connects
+// to Seam (Seam's OAuth 2, authorization code with PKCE). Quilt never shares accounts with Seam:
+// it keeps the person's Seam token and calls Seam's HTTP API with it. Off unless Quilt is
+// registered as a Seam app (seamClientId, env QUILT_SEAM_CLIENT_ID).
+//
+// The PKCE verifier is never stored: `state` carries who asked and until when, signed with
+// Quilt's secret, and the verifier is an HMAC of the state, so any API machine can finish it.
+import crypto from 'node:crypto'
+import { HttpError, Raw } from '../http.js'
+
+export const CONNECT_MS = 10 * 60_000
+const REFRESH_EARLY_MS = 60_000
+
+const b64 = (b) => Buffer.from(b).toString('base64url')
+const mac = (secret, text) => crypto.createHmac('sha256', secret).update(text).digest('base64url')
+const same = (a, b) => a.length === b.length && crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b))
+const page = (status, title, text) => new Raw(status, `<!doctype html><meta charset="utf-8"><title>${title}</title><body style="font:16px system-ui;margin:4em auto;max-width:32em"><h1>${title}</h1><p>${text}</p></body>`, 'text/html; charset=utf-8')
+
+export function seamConnectRoutes ({ store, person, now = Date.now, apiUrl, seamUrl, seamSiteUrl = 'https://seam.heyquilt.com', clientId, secret, fetch = globalThis.fetch, log = () => {} }) {
+  if (!clientId || !secret || !seamUrl || !store.seamLink) return []
+  const seam = String(seamUrl).replace(/\/+$/, '')
+  const site = String(seamSiteUrl).replace(/\/+$/, '')
+  const redirectUri = `${String(apiUrl).replace(/\/+$/, '')}/v1/seam/connect/callback`
+  const verifierOf = (state) => mac(secret, `seam-pkce\0${state}`)
+  const userOf = (p) => p.userId || p.id
+
+  function makeState (userId) {
+    const body = b64(JSON.stringify({ u: userId, e: now() + CONNECT_MS, n: crypto.randomBytes(12).toString('base64url') }))
+    return `${body}.${mac(secret, `seam-state\0${body}`)}`
+  }
+  function readState (state) {
+    const [body, sig] = String(state || '').split('.')
+    if (!body || !sig || !same(sig, mac(secret, `seam-state\0${body}`))) return null
+    try {
+      const s = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'))
+      return s && s.e > now() ? s : null
+    } catch { return null }
+  }
+
+  async function tokenCall (form) {
+    let res
+    try { res = await fetch(`${seam}/oauth/token`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' }, body: new URLSearchParams({ client_id: clientId, ...form }).toString(), signal: AbortSignal.timeout(10_000) }) } catch { throw new HttpError(503, 'Seam could not be reached; try again') }
+    const data = await res.json().catch(() => null)
+    if (!res.ok || !data?.access_token) return { error: data?.error || `seam_${res.status}`, detail: data?.error_description || '' }
+    return { access: data.access_token, refresh: data.refresh_token, scope: data.scope || '', expiresAt: now() + Number(data.expires_in || 3600) * 1000 }
+  }
+
+  /** The person's Seam access token, refreshed when it is about to end; null when not connected. */
+  async function freshToken (userId) {
+    const link = await store.seamLink(userId)
+    if (!link) return null
+    if (link.expiresAt - REFRESH_EARLY_MS > now()) return link
+    const t = await tokenCall({ grant_type: 'refresh_token', refresh_token: link.refresh })
+    if (t.error) {
+      // Seam ended the grant (revoked on seam.heyquilt.com, or the token was reused): connect again.
+      if (t.error === 'invalid_grant' || t.error === 'invalid_client') { await store.deleteSeamLink(userId); return null }
+      throw new HttpError(503, 'Seam could not refresh your connection; try again')
+    }
+    return store.putSeamLink(userId, { ...t, connectedAt: link.connectedAt })
+  }
+
+  return [
+    // { scope? } → { url }: the page on Seam's site where the person allows Quilt.
+    ['POST', /^\/v1\/seam\/connect$/, async (req, body) => {
+      const p = await person(req)
+      const scope = String(body?.scope || 'quilts:write').trim()
+      const state = makeState(userOf(p))
+      const challenge = crypto.createHash('sha256').update(verifierOf(state)).digest('base64url')
+      const q = new URLSearchParams({ client_id: clientId, redirect_uri: redirectUri, response_type: 'code', scope, state, code_challenge: challenge, code_challenge_method: 'S256' })
+      return { url: `${site}/oauth/authorize?${q}` }
+    }],
+    // Seam sends the browser back here with a code (or error=access_denied).
+    ['GET', /^\/v1\/seam\/connect\/callback$/, async (req) => {
+      const q = new URL(req.url, 'http://x').searchParams
+      const s = readState(q.get('state'))
+      if (!s) return page(400, 'Seam was not connected', 'This link expired or was not made by Quilt. Start again from Quilt.')
+      if (q.get('error')) return page(200, 'Seam was not connected', 'You chose not to connect Seam. You can connect it from Quilt any time.')
+      const t = await tokenCall({ grant_type: 'authorization_code', code: q.get('code') || '', redirect_uri: redirectUri, code_verifier: verifierOf(q.get('state')) })
+      if (t.error) { log(`seam connect: ${t.error} ${t.detail}`); return page(400, 'Seam was not connected', 'Seam did not accept this sign-in. Start again from Quilt.') }
+      await store.putSeamLink(s.u, { ...t, connectedAt: now() })
+      return page(200, 'Seam is connected', 'Quilt can now use Seam as you. You can close this tab.')
+    }],
+    ['GET', /^\/v1\/seam\/connection$/, async (req) => {
+      const link = await store.seamLink(userOf(await person(req)))
+      return link ? { connected: true, scope: link.scope, connectedAt: link.connectedAt } : { connected: false }
+    }],
+    // The person's own Seam token, for their app to call Seam's API with.
+    ['GET', /^\/v1\/seam\/token$/, async (req) => {
+      const link = await freshToken(userOf(await person(req)))
+      if (!link) throw new HttpError(404, 'Seam is not connected: connect it first')
+      return { access_token: link.access, token_type: 'Bearer', expires_at: link.expiresAt, scope: link.scope, seam_url: seam }
+    }],
+    ['DELETE', /^\/v1\/seam\/connection$/, async (req) => {
+      const userId = userOf(await person(req))
+      const link = await store.seamLink(userId)
+      if (link) {
+        await fetch(`${seam}/oauth/revoke`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ token: link.refresh }).toString(), signal: AbortSignal.timeout(10_000) }).catch(() => {})
+        await store.deleteSeamLink(userId)
+      }
+      return { connected: false }
+    }]
+  ]
+}

package/src/api/routes/session-migrate.js

@@ -0,0 +1,39 @@
+// Making a session a quilt (Seam's plans/quilt-source-control/16, "How a session becomes a quilt"):
+// POST /v1/sessions/:room/migrate { dry_run, token, step }. The session's owner, signed in, asks here
+// (step 'make' is "Make this a quilt": made and moved into its squares in one go; 'switch' moves the session's files into its squares, layout 3; 'unswitch' goes back;
+// 'shadow' links a session with a git remote to the quilt its import fills, 16 step 1);
+// the relay machine holding the room does the work (POST /quilt/migrate, with the relay secret),
+// so this is the same operation as the MCP tool and `quilt session migrate`. Seam is called as the
+// owner: with `token` (their Seam sign-in) when given, else the sign-in they used here. The relay
+// refuses while Seam is off for it (QUILT_SOURCE_URL), so nothing changes until that flag is set.
+import { HttpError } from '../http.js'
+
+const ROOM = /^[A-Za-z0-9_-]{1,64}$/
+const NO_SESSION = 'no such session'
+const MIGRATE_TIMEOUT_MS = 5 * 60 * 1000 // a large session's patch 1 and squares take a while
+
+export function sessionMigrateRoutes ({ store, person, bearer, relaySecret, cluster }) {
+  return [
+    ['POST', /^\/v1\/sessions\/([^/]+)\/migrate$/, async (req, body, [room]) => {
+      const account = `person:${(await person(req)).userId}`
+      if (!ROOM.test(room)) throw new HttpError(404, NO_SESSION)
+      const session = await store.sessionByRoom(room).catch(() => null)
+      if (!session) throw new HttpError(404, NO_SESSION)
+      if (session.ownerAccount !== account) throw new HttpError(403, 'Only the session owner can make it a quilt.')
+      if (!relaySecret) throw new HttpError(503, 'the relay is not set up on this server')
+      const dry = body && body.dry_run === true
+      const token = body && typeof body.token === 'string' && body.token ? body.token : bearer(req)
+      const where = await store.relayRoom(room).catch(() => null)
+      const step = body && (body.step === 'make' || body.step === 'switch' || body.step === 'unswitch' || body.step === 'shadow') ? body.step : null
+      // step 'shadow' (16 step 1): `quilt` names the quilt an import of the session's git remote fills; null unlinks.
+      const quilt = step === 'shadow' && typeof body.quilt === 'string' && body.quilt ? body.quilt.slice(0, 200) : null
+      const ask = { room, account, ...(dry ? { dry_run: true } : { token }), ...(step && !dry ? { step } : {}), ...(step === 'shadow' && !dry ? { quilt } : {}), ...(step === 'unswitch' && !dry && Array.isArray(body.carried) ? { carried: body.carried.filter((x) => typeof x === 'string').slice(0, 200) } : {}) }
+      try {
+        return await cluster.callRelay((where && where.machineId) || '', 'POST', '/quilt/migrate', ask, { timeoutMs: MIGRATE_TIMEOUT_MS })
+      } catch (err) {
+        const said = String(err.message).replace(/^relay .*? answered \d+: /, '')
+        throw new HttpError(err.status && err.status < 500 ? err.status : 502, said)
+      }
+    }]
+  ]
+}

package/src/api/routes/sessions.js

@@ -3,7 +3,7 @@
 // who were there at the same time as you.
 import { HttpError, Raw } from '../http.js'
 import { auditTrail, auditCsv, MAX_ACTIONS } from '../audit.js'
-import { summarize, collaborators, myVisits, isTimeZone, weekStart, monthStart, MAX_SESSIONS } from '../activity.js'
+import { summarize, collaborators, myVisits, isTimeZone, weekStart, monthStart, MAX_SESSIONS, DAY_MS } from '../activity.js'
 import { cleanSessionName, BAD_SESSION_NAME } from '../../session-name.js'
 
 const ROOM = /^[A-Za-z0-9_-]{1,64}$/
@@ -90,3 +90,75 @@ export function sessionRoutes ({ store, now, person }) {
     ['GET', /^\/v1\/me\/collaborators$/, async (req) => ({ collaborators: await collaboratorsOf(store, await me(req), now()) })]
   ]
 }
+
+export const NOW_CACHE_MS = 10 * 1000
+export const NOW_TIMEOUT_MS = 5 * 1000
+const NOW_ROOMS = 40
+
+/**
+ * Asks the relay machines holding an account's recent sessions for its summary of now, and merges their
+ * answers: (account, t) → { sessions, at, live, partial? }. The dashboard's route and the email notices
+ * (notify.js) both use it.
+ */
+export function nowAsker ({ store, cluster, relayOn = false, log = () => {} }) {
+  return async (account, t) => {
+    if (!relayOn) return { sessions: [], at: t, live: false }
+    // The sessions that can be live: the latest ones, and every one active in the last day.
+    const sessions = await store.accountSessions(account, { since: t - DAY_MS, limit: 20 })
+    const rooms = sessions.map((s) => s.room).slice(0, NOW_ROOMS)
+    const byMachine = new Map()
+    await Promise.all(rooms.map(async (room) => {
+      const placed = await store.relayRoom(room).catch(() => null)
+      const id = (placed && placed.machineId) || ''
+      if (!byMachine.has(id)) byMachine.set(id, [])
+      byMachine.get(id).push(room)
+    }))
+    let partial = false
+    const answers = await Promise.all([...byMachine].map(([id, list]) =>
+      cluster.callRelay(id, 'POST', '/now', { account, rooms: list }, { timeoutMs: NOW_TIMEOUT_MS })
+        .catch((err) => { partial = true; log(`now from relay ${id || ''}: ${err.message}`); return null })))
+    return { sessions: answers.flatMap((a) => (a && Array.isArray(a.sessions) ? a.sessions : [])), at: t, live: true, ...(partial ? { partial: true } : {}) }
+  }
+}
+
+/**
+ * The website dashboard's summary of now (plans/dashboard ticket 9): for each of my sessions a relay
+ * holds, who is in it, what each AI is doing, the board in brief, held files and what needs me
+ * (src/now-summary.js on the relay). The relay machines holding my recent sessions are asked, at most
+ * once every NOW_CACHE_MS per person (the page asks every 15 to 30 seconds), and their answers merged.
+ * `relayOn` false (no relay or no relay secret): nothing to ask, so nothing is live.
+ */
+export function nowRoutes ({ store, now, person, cluster, relayOn = false, log = () => {} }) {
+  const cache = new Map() // account -> { at, out }
+  const ask = nowAsker({ store, cluster, relayOn, log })
+  return [
+    ['GET', /^\/v1\/me\/now$/, async (req) => {
+      const account = `person:${(await person(req)).userId}`
+      const t = now()
+      const hit = cache.get(account)
+      if (hit && t - hit.at < NOW_CACHE_MS) return hit.out
+      const out = await ask(account, t)
+      cache.set(account, { at: t, out })
+      if (cache.size > 5000) for (const [k, v] of cache) if (t - v.at >= NOW_CACHE_MS) cache.delete(k)
+      return out
+    }],
+
+    // One session I was in, in more detail (its page's Activity tab): { session } or { session: null } when
+    // nobody is in it now. 404 for a session I was never in, whether or not it exists.
+    ['GET', /^\/v1\/me\/now\/([^/]+)$/, async (req, body, [room]) => {
+      const account = `person:${(await person(req)).userId}`
+      if (!ROOM.test(room)) throw new HttpError(404, NO_SESSION)
+      const visits = await store.visitsInRooms([room])
+      if (!visits.some((v) => v.account === account)) throw new HttpError(404, NO_SESSION)
+      if (!relayOn) return { session: null, live: false }
+      const placed = await store.relayRoom(room).catch(() => null)
+      try {
+        const a = await cluster.callRelay((placed && placed.machineId) || '', 'POST', '/now', { account, rooms: [room], detail: true }, { timeoutMs: NOW_TIMEOUT_MS })
+        return { session: (a && Array.isArray(a.sessions) && a.sessions[0]) || null, live: true }
+      } catch (err) {
+        log(`now for ${room}: ${err.message}`)
+        return { session: null, live: true, partial: true }
+      }
+    }]
+  ]
+}

package/src/api/server.js

@@ -28,7 +28,10 @@ import crypto from 'node:crypto'
 import { githubRoutes } from './routes/github.js'
 import { githubApp, ensureWebhookSecret, redeliverFailed } from './github-app.js'
 import { releaseSource } from './releases.js'
-import { sessionRoutes } from './routes/sessions.js'
+import { sessionRoutes, nowRoutes, nowAsker, overviewOf } from './routes/sessions.js'
+import { notifier, NOTIFY_EVERY_MS } from './notify.js'
+import { browserRoutes } from './routes/browsers.js'
+import { sessionMigrateRoutes } from './routes/session-migrate.js'
 import { accessTypeRoutes } from './routes/access-types.js'
 import { grantRoutes } from './routes/grants.js'
 import { sessionInviteRoutes } from './routes/session-invites.js'
@@ -37,6 +40,7 @@ import { workspaceFileRoutes } from './routes/workspace-files.js'
 import { workspaceAgentRoutes } from './routes/workspace-agents.js'
 import { workspaceInviteRoutes } from './routes/workspace-invites.js'
 import { HOSTED_RELAY } from '../settings.js'
+import { seamConnectRoutes } from './routes/seam-connect.js'
 import { roomAccessFrom } from './access.js'
 import { joiningRoom, sessionArg } from '../mcp-room.js'
 import { issueRoutes } from './routes/issues.js'
@@ -47,7 +51,6 @@ import { secretRoutes } from './routes/secrets.js'
 import { voiceRoutes } from './routes/voice.js'
 import { mailRoutes } from './routes/mail.js'
 import { agentWakeRoutes } from './routes/agent-wake.js'
-import { quiltRoutes } from '../quilts/routes.js'
 import { workspaceReach } from './workspace-reach.js'
 import { leader, LEADER_ONLY } from './leader.js'
 import { autoscale } from './autoscale.js'
@@ -73,7 +76,7 @@ const MCP_TIMEOUT_MS = 30 * 1000
 // a change to its grant reaches it as soon as it reaches a connected app.
 const PASS_REUSE_MARGIN_MS = 5 * 60 * 1000
 
-export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, siteUrl, apiUrl = 'https://api.heyquilt.com', mailer = { send: async () => { throw new Error('no mailer configured') } }, now = Date.now, log = () => {}, startLimit = 10, inviteLimit = 10, inviteSendLimit = 20, tokenLimit = 30, joinLimit = 20, trustProxy = false, maxStartKeys = 10_000, passKey = '', passLimit = 60, relayUrl = HOSTED_RELAY, mcpLimit = 600, reportKey = '', reportLimit = 10, slowMs = 2000, pruneEveryMs = 60 * 60 * 1000, keepEventsMs = 30 * 24 * 60 * 60 * 1000, keepIssuesMs = 90 * 24 * 60 * 60 * 1000, pruneStartMs = 10_000, relaySecret = '', workspaces = false, fileStore = null, maxFileBytes = 500 * 1024 * 1024, workspaceQuotaBytes = 5 * 1024 * 1024 * 1024, maxWorkspaceFiles = 2000, webhookFetch = globalThis.fetch, webhookLookup, allowLocalWebhooks = false, github = null, githubFetch = globalThis.fetch, fly = null, aiVmWaitMs = AI_VM_WAIT_MS, aiVmSpareSuspendMs, relayFetch = null, relayFly = null, heavy = null, relayTargets = null, clusterTiming = {}, vaultSecret = '', vaultUrl = 'https://vault.heyquilt.com', allowLocalUpstreams = false, secretWaitMs, voice = {}, voiceFetch = globalThis.fetch, mail = {}, mailFetch = globalThis.fetch, machineId = '', leaderTiming = {}, autoscaleTiming = {}, exit = () => process.exit(0), apiFly = null, maxMachines, quilts = null }) {
+export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, siteUrl, apiUrl = 'https://api.heyquilt.com', mailer = { send: async () => { throw new Error('no mailer configured') } }, now = Date.now, log = () => {}, startLimit = 10, inviteLimit = 10, inviteSendLimit = 20, tokenLimit = 30, joinLimit = 20, trustProxy = false, maxStartKeys = 10_000, passKey = '', passLimit = 60, relayUrl = HOSTED_RELAY, mcpLimit = 600, reportKey = '', reportLimit = 10, slowMs = 2000, pruneEveryMs = 60 * 60 * 1000, keepEventsMs = 30 * 24 * 60 * 60 * 1000, keepIssuesMs = 90 * 24 * 60 * 60 * 1000, pruneStartMs = 10_000, relaySecret = '', workspaces = false, quiltSourceDefault = false, fileStore = null, maxFileBytes = 500 * 1024 * 1024, workspaceQuotaBytes = 5 * 1024 * 1024 * 1024, maxWorkspaceFiles = 2000, webhookFetch = globalThis.fetch, webhookLookup, allowLocalWebhooks = false, github = null, githubFetch = globalThis.fetch, fly = null, aiVmWaitMs = AI_VM_WAIT_MS, aiVmSpareSuspendMs, relayFetch = null, relayFly = null, heavy = null, relayTargets = null, clusterTiming = {}, vaultSecret = '', vaultUrl = 'https://vault.heyquilt.com', allowLocalUpstreams = false, secretWaitMs, voice = {}, voiceFetch = globalThis.fetch, mail = {}, mailFetch = globalThis.fetch, machineId = '', leaderTiming = {}, autoscaleTiming = {}, exit = () => process.exit(0), apiFly = null, maxMachines, seamUrl = 'https://api.seam.heyquilt.com', seamFetch = globalThis.fetch, seamClientId = '', seamSiteUrl = 'https://seam.heyquilt.com', seamConnectSecret = '', notifyEveryMs = NOTIFY_EVERY_MS }) {
   // PASS_SIGNING_KEY. A bad one should stop the API at start, not fail every pass later.
   if (passKey) passPublicKey(passKey)
   const site = String(siteUrl || '').replace(/\/+$/, '')
@@ -222,7 +225,8 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
     ['GET', /^\/healthz$/, async () => ({ ok: true })],
 
     // Which optional parts this API has on, for the app and the MCPs to decide what to show. Public.
-    ['GET', /^\/v1\/features$/, async () => ({ workspaces: !!workspaces, secrets: !!vaultSecret })],
+    // quilt_source_default (QUILT_SOURCE_DEFAULT, Seam's plans/quilt-source-control/16 flags order 8): apps make the sessions they start quilts from the start.
+    ['GET', /^\/v1\/features$/, async () => ({ workspaces: !!workspaces, secrets: !!vaultSecret, quilt_source_default: !!quiltSourceDefault })],
 
     ['POST', /^\/v1\/device\/start$/, async (req, body) => {
       limitStarts(req)
@@ -388,13 +392,16 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
   // A person's AI on its own cloud machine (routes/ai-vm.js): off (503) without Fly set up. Only the leader runs it.
   const aiVm = aiVmRoutes({ ...ctx, relayUrl, fly, waitMs: aiVmWaitMs, spareSuspendMs: aiVmSpareSuspendMs, leads: lead.leads })
   routes.push(...aiVm.routes)
+  // Email notices people turned on in the website's Settings › Notifications (notify.js): the leader sends them.
+  const notices = notifier({ store, mailer, ask: nowAsker({ store, cluster, relayOn: !!(relay && relaySecret), log }), overview: (account, t) => overviewOf(store, account, 'UTC', t), now, log, site, leads: lead.leads, everyMs: notifyEveryMs })
+  if (notifyEveryMs > 0) notices.start()
   // A team's git rule or who is on a team changed: the relay asks its sessions' rules again now (relay /github/policy).
   // With a room (a session put in or taken out of a workspace), only that session asks.
   const policyChanged = (room = '') => {
     if (!relay || !relaySecret) return
     cluster.tellRelays('/github/policy', room ? { room } : {}).catch((err) => log(`git rules to relay: ${err.message}`))
   }
-  routes.push(...orgRoutes(ctx), ...memberRoutes(ctx), ...teamRoutes({ ...ctx, policyChanged }), ...inviteRoutes(ctx), ...agentRoutes({ ...ctx, passKey }), ...agentInviteRoutes({ ...ctx, workspaces }), ...joinRoutes(ctx), ...relayRoutes(ctx), ...githubRoutes({ ...ctx, github, githubFetch, relayHttp: relay, relayFetch: githubFetch, tellRelays: (path, body) => cluster.tellRelays(path, body), hookSecret, workspaces }), ...relayClusterRoutes({ ...ctx, cluster }), ...sessionRoutes(ctx), ...accessTypeRoutes(ctx), ...grantRoutes({ ...ctx, workspaces }), ...sessionInviteRoutes({ ...ctx, workspaces }), ...issueRoutes(ctx))
+  routes.push(...orgRoutes(ctx), ...memberRoutes(ctx), ...teamRoutes({ ...ctx, policyChanged }), ...inviteRoutes(ctx), ...agentRoutes({ ...ctx, passKey }), ...agentInviteRoutes({ ...ctx, workspaces }), ...joinRoutes(ctx), ...relayRoutes(ctx), ...githubRoutes({ ...ctx, github, githubFetch, relayHttp: relay, relayFetch: githubFetch, tellRelays: (path, body) => cluster.tellRelays(path, body), hookSecret, workspaces }), ...relayClusterRoutes({ ...ctx, cluster }), ...sessionRoutes(ctx), ...nowRoutes({ ...ctx, cluster, relayOn: !!(relay && relaySecret) }), ...browserRoutes(ctx), ...sessionMigrateRoutes({ ...ctx, cluster }), ...accessTypeRoutes(ctx), ...grantRoutes({ ...ctx, workspaces }), ...sessionInviteRoutes({ ...ctx, workspaces }), ...issueRoutes(ctx))
   // Always routed: with the flag off each answers a plain 404 of its own, so the app's
   // check at every launch isn't filed as a missing route.
   // Only these take a hosted agent's pass (workspaceReach), so they alone get the pass key.
@@ -416,16 +423,19 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
   routes.push(...mailRoutes({ ...ctx, passKey, mail, mailFetch, makeLimiter, tellRoom }))
   // How Quilt wakes each agent (routes/agent-wake.js): step 2 of joining.
   routes.push(...agentWakeRoutes({ ...ctx, passKey, mail, mailFetch, makeLimiter }))
-  // Quilt source control (src/quilts/, plans/quilt-source-control/): off unless startApi gets `quilts`.
-  // Seam takes who is calling from us, as a quilt member: { member_id, kind, name, tool?, on_behalf_of? }.
-  const quiltCaller = quilts ? workspaceReach({ ...ctx, passKey }) : null
-  const identifyQuiltMember = async (req) => {
-    const c = await quiltCaller.caller(req)
+  // Seam (src/quilts/, Seam's plans/quilt-source-control/) is its own service at seamUrl. This API is its
+  // identity service for Quilt accounts: GET /v1/seam/me says who is calling, as a quilt member
+  // { member_id, kind, name, tool?, on_behalf_of? }, for a person's sign-in, an agent key or a pass.
+  const seamCaller = workspaceReach({ ...ctx, passKey })
+  const identifySeamMember = async (req) => {
+    const c = await seamCaller.caller(req)
     if (c.agent) return { member_id: c.account, kind: 'agent', name: c.agent.name || 'agent', ...(c.agent.provider ? { tool: String(c.agent.provider).toLowerCase() } : {}), ...(c.agent.ownerUserId ? { on_behalf_of: `person:${c.agent.ownerUserId}` } : {}) }
     const p = c.userId && store.profile ? await store.profile(c.userId).catch(() => null) : null
     return { member_id: c.account, kind: 'person', name: (p && p.name) || 'person' }
   }
-  routes.push(...quiltRoutes({ quilts, identify: identifyQuiltMember }))
+  routes.push(['GET', /^\/v1\/seam\/me$/, (req) => identifySeamMember(req)])
+  // "Connect Seam": a person links their own Seam account (Seam's OAuth); off without seamClientId.
+  routes.push(...seamConnectRoutes({ store, person, now, apiUrl: api, seamUrl, seamSiteUrl, clientId: seamClientId, secret: seamConnectSecret || passKey, fetch: seamFetch, log }))
 
   async function openLink (code) {
     const userCode = normalizeUserCode(code)
@@ -488,6 +498,7 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
     try {
       if (pathname.startsWith('/v1/file-data/') && files instanceof DiskStore) return await serveFileData(req, res, send, pathname.slice('/v1/file-data/'.length))
       if (pathname === '/mcp') return await proxyMcp(req, res, send)
+      if (SEAM_PATH.test(pathname)) return await forwardSeam(req, res)
       if (req.method === 'GET' && (pathname === '/v1/releases/latest' || pathname.startsWith('/v1/download/'))) return await serveRelease(req, res, send, pathname)
       const url = new URL(req.url, 'http://x')
       const route = routes.find(([m, re]) => m === req.method && re.test(url.pathname))
@@ -514,6 +525,25 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
     }
   })
 
+  // Seam's routes moved to Seam's own server (Seam's docs/seam-service.md): old seam commands and sites
+  // still call them here, so they go on to seamUrl as sent, and Seam's answer comes straight back.
+  async function forwardSeam (req, res) {
+    if (!seamUrl) throw new HttpError(404, 'not found')
+    const headers = {}
+    for (const h of ['authorization', 'content-type', 'accept']) if (req.headers[h]) headers[h] = req.headers[h]
+    const hasBody = !['GET', 'HEAD', 'DELETE'].includes(req.method)
+    let up
+    try {
+      up = await seamFetch(seamUrl.replace(/\/+$/, '') + req.url, { method: req.method, headers, ...(hasBody ? { body: await readRaw(req, SEAM_MAX_BODY), duplex: 'half' } : {}), redirect: 'manual' })
+    } catch (err) {
+      if (err instanceof HttpError) throw err
+      throw new HttpError(502, 'Seam did not answer; try again')
+    }
+    const body = Buffer.from(await up.arrayBuffer())
+    res.writeHead(up.status, { 'content-type': up.headers.get('content-type') || 'application/json', 'cache-control': 'no-store', ...cors(req) })
+    res.end(body)
+  }
+
   // Downloads and the update check (releases.js): public, from the private repository's latest
   // release, read as Quilt's GitHub App. A download is a redirect to GitHub's own short-lived link.
   const releases = releaseSource({ github, fetch: githubFetch, now, apiUrl: api })
@@ -674,13 +704,17 @@ export function startApi ({ port = 0, host = '127.0.0.1', store, verifyUser, sit
 
   return new Promise((resolve) => server.listen(port, host, () => {
     const p = server.address().port
-    resolve({ port: p, url: `http://${host}:${p}`, cluster, lead, scaler, grow, fillSpares: aiVm.fillSpares, close: () => { clearInterval(prune); clearTimeout(firstPrune); aiVm.close(); lead.close(); scaler.close(); grow.close(); return new Promise((r) => server.close(r)) }, startKeys: () => limitStarts.size(), sweepFiles: (at) => wsFiles.sweep(at), flushWebhooks, githubReady })
+    resolve({ port: p, url: `http://${host}:${p}`, cluster, lead, scaler, grow, fillSpares: aiVm.fillSpares, notices, close: () => { clearInterval(prune); clearTimeout(firstPrune); aiVm.close(); notices.stop(); lead.close(); scaler.close(); grow.close(); return new Promise((r) => server.close(r)) }, startKeys: () => limitStarts.size(), sweepFiles: (at) => wsFiles.sweep(at), flushWebhooks, githubReady })
   }))
 }
 
 // Which room a hosted agent's MCP request is about: shared with the relay (src/mcp-room.js).
 export { joiningRoom, sessionArg } from '../mcp-room.js'
 
+// Seam's routes, answered by Seam's own server now (forwardSeam). Its biggest body is a pack.
+const SEAM_PATH = /^\/v1\/(quilts|imports|search|signing-keys)(\/|$)/
+const SEAM_MAX_BODY = 96 * 1024 * 1024
+
 function decodePart (s) {
   try { return decodeURIComponent(s) } catch { throw new HttpError(400, 'bad path') }
 }

package/src/api/supabase-store.js

@@ -69,6 +69,14 @@ export const rowFrom = (row) => row && Object.fromEntries(Object.entries(toCamel
 export function createSupabaseStore ({ url, serviceKey, client }) {
   const db = client || createClient(url, serviceKey, { auth: { persistSession: false, autoRefreshToken: false } })
   const one = async (q) => { const { data, error } = await q; if (error) throw error; return data }
+  // A lease call (relay_leases), or the git_sync_leases one while the relay_leases migration is not applied (PGRST202: no such function).
+  const leaseRpc = async (what, key, args, oldArgs) => {
+    const { data, error } = await db.rpc(`${what}_relay_lease`, args)
+    if (!error) return data
+    const at = String(key).indexOf(' ')
+    if (error.code !== 'PGRST202' || at < 1) throw error
+    return one(db.rpc(`${what}_git_sync_lease`, oldArgs(key.slice(0, at), key.slice(at + 1))))
+  }
   const memberOf = async (orgId, userId) => rowFrom(await one(db.from('org_members').select(MEMBER).eq('org_id', orgId).eq('user_id', userId).maybeSingle()))
   // Every row of a query, a page at a time. `build` makes a fresh query (with a stable order) per page.
   const pages = async (build) => {
@@ -343,10 +351,11 @@ export function createSupabaseStore ({ url, serviceKey, client }) {
       await one(db.from('org_github').upsert(row, { onConflict: 'org_id' }))
     },
     // The API's own settings (app_settings): a value it keeps across starts, such as the webhook secret it set on GitHub.
-    // One live session per repository and branch (git_sync_leases, through its locking functions).
-    async takeLease ({ repo, branch, room, holder = '', ttlMs }) { return await one(db.rpc('take_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_holder: holder, p_ttl_ms: ttlMs })) },
-    async heartbeatLease ({ repo, branch, room, generation, ttlMs }) { return await one(db.rpc('heartbeat_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_generation: generation, p_ttl_ms: ttlMs })) },
-    async releaseLease ({ repo, branch, room, generation }) { return await one(db.rpc('release_git_sync_lease', { p_repo: repo, p_branch: branch, p_room: room, p_generation: generation })) },
+    // Relay leases (relay_leases, through its locking functions; 16 R2). `key`: the relay's name for what it holds.
+    // Before the migration that makes relay_leases is applied, a git branch's key ("<repo> <branch>") goes to the old functions.
+    async takeLease ({ key, room, holder = '', ttlMs }) { return await leaseRpc('take', key, { p_key: key, p_room: room, p_holder: holder, p_ttl_ms: ttlMs }, (repo, branch) => ({ p_repo: repo, p_branch: branch, p_room: room, p_holder: holder, p_ttl_ms: ttlMs })) },
+    async heartbeatLease ({ key, room, generation, ttlMs }) { return await leaseRpc('heartbeat', key, { p_key: key, p_room: room, p_generation: generation, p_ttl_ms: ttlMs }, (repo, branch) => ({ p_repo: repo, p_branch: branch, p_room: room, p_generation: generation, p_ttl_ms: ttlMs })) },
+    async releaseLease ({ key, room, generation }) { return await leaseRpc('release', key, { p_key: key, p_room: room, p_generation: generation }, (repo, branch) => ({ p_repo: repo, p_branch: branch, p_room: room, p_generation: generation })) },
     async getSetting (key) { const r = await one(db.from('app_settings').select('value').eq('key', key).maybeSingle()); return r ? r.value : null },
     async setSetting (key, value) { await one(db.from('app_settings').upsert({ key, value: String(value), updated_at: new Date().toISOString() }, { onConflict: 'key' })) },
     async setSettingIfAbsent (key, value) {
@@ -417,6 +426,36 @@ export function createSupabaseStore ({ url, serviceKey, client }) {
       return u ? { email: u.email || '', confirmed: !!u.email_confirmed_at } : null
     },
 
+    // Email notices (notify.js): kept on each account, so no table is needed. user_metadata.notify is what
+    // the person turned on (the website writes it); user_metadata.notify_sent what was sent already.
+    async notifyUsers () {
+      const out = []
+      for (let page = 1; page < 1000; page++) {
+        const { data, error } = await db.auth.admin.listUsers({ page, perPage: 1000 })
+        if (error) throw error
+        const list = data?.users || []
+        for (const u of list) {
+          const m = u.user_metadata || {}
+          if (u.email && u.email_confirmed_at && m.notify && typeof m.notify === 'object') out.push({ userId: u.id, email: u.email, notify: m.notify, sent: m.notify_sent || {} })
+        }
+        if (list.length < 1000) break
+      }
+      return out
+    },
+    async setNotifySent (userId, sent) {
+      const { data, error } = await db.auth.admin.getUserById(userId)
+      if (error) throw error
+      const meta = data?.user?.user_metadata || {}
+      const { error: e2 } = await db.auth.admin.updateUserById(userId, { user_metadata: { ...meta, notify_sent: sent } })
+      if (e2) throw e2
+    },
+
+    // A person's browser sign-ins (20261026235000_my_browser_sessions.sql), for signing out one at a time.
+    async authSessions (userId) {
+      return (await one(db.rpc('auth_sessions_of', { p_user: userId }))).map((r) => ({ id: r.id, createdAt: ms(r.created_at), lastActiveAt: ms(r.updated_at || r.created_at), userAgent: r.user_agent || '', ip: r.ip || '' }))
+    },
+    async endAuthSession (userId, id) { return !!(await one(db.rpc('end_auth_session', { p_user: userId, p_id: id }))) },
+
     // Session activity (see 20261002000000_session_activity.sql). Event times are epoch ms.
     async ingestPresence (events, receivedAt) {
       return await one(db.rpc('ingest_presence', { p_events: events, p_received_at: ts(receivedAt) }))
@@ -885,6 +924,16 @@ export function createSupabaseStore ({ url, serviceKey, client }) {
       await one(db.from('secret_data_keys').upsert({ scope_type: scopeType, scope_id: scopeId, version, sealed_key: sealedKey, provider }, { onConflict: 'scope_type,scope_id,version', ignoreDuplicates: true }))
       return rowFrom(await one(db.from('secret_data_keys').select(SECRET_DATA_KEY).eq('scope_type', scopeType).eq('scope_id', scopeId).eq('version', version).single()))
     },
+    // "Connect Seam" (routes/seam-connect.js): the person's Seam tokens, one row per Quilt user.
+    async seamLink (userId) {
+      const r = await one(db.from('seam_links').select('user_id,access_token,refresh_token,scope,expires_at,connected_at').eq('user_id', userId).maybeSingle())
+      return r ? { userId: r.user_id, access: r.access_token, refresh: r.refresh_token, scope: r.scope, expiresAt: Date.parse(r.expires_at), connectedAt: Date.parse(r.connected_at) } : null
+    },
+    async putSeamLink (userId, link) {
+      await one(db.from('seam_links').upsert({ user_id: userId, access_token: link.access, refresh_token: link.refresh, scope: link.scope || '', expires_at: ts(link.expiresAt), connected_at: ts(link.connectedAt ?? Date.now()), updated_at: new Date().toISOString() }, { onConflict: 'user_id' }))
+      return { userId, access: link.access, refresh: link.refresh, scope: link.scope || '', expiresAt: link.expiresAt, connectedAt: link.connectedAt ?? Date.now() }
+    },
+    async deleteSeamLink (userId) { await one(db.from('seam_links').delete().eq('user_id', userId)) },
     async secretSettings (scopeType, scopeId) {
       const r = rowFrom(await one(db.from('secret_scope_settings').select(SECRET_SETTINGS).eq('scope_type', scopeType).eq('scope_id', scopeId).maybeSingle()))
       return r || { scopeType, scopeId, inheritOff: false, inheritOffBy: null, inheritOffAt: null, agentsOn: false, agents: 'all', updatedAt: null }