heyquilt 0.3.122 → 0.3.138

package/src/quilts/tree.js

@@ -1,351 +0,0 @@
-// Snapshots as prolly trees (plans/quilt-source-control/03, "Prolly-tree snapshots"): the full
-// tree of a commit, over the quilt's sorted path list. Node boundaries come from a hash of the
-// key bytes only, so the shape depends on the paths and nothing else: two commits with the same
-// files have the same root, and one changed file rewrites a handful of nodes.
-//
-// Leaf node:     { l: 0, e: [[path, mode, blob, size] | [path, 'conflict', term, 0]] }
-// Internal node: { l: level, e: [[first_key, child_id]] }
-// Node id: blake3("quilt tree v1", canonical CBOR of the node).
-import { encode, decode } from './cbor.js'
-import { idOf } from './hash.js'
-import { cmpPath, under } from './records.js'
-
-// Boundaries: after at least MIN entries, a node ends after an entry whose key hash has its low
-// six bits set (a mean near 64 entries, about 4 KiB of leaf); never more than MAX entries.
-const MIN = 8
-const MAX = 256
-const MASK = 63
-
-const hex = (b) => Buffer.from(b).toString('hex')
-
-/** FNV-1a over the key's bytes and the level, the boundary hash ("quilt tree v1"). */
-function keyHash (key, level) {
-  let h = 0x811c9dc5 ^ level
-  const b = Buffer.from(key)
-  for (let i = 0; i < b.length; i++) { h ^= b[i]; h = Math.imul(h, 0x01000193) >>> 0 }
-  return h >>> 0
-}
-
-const leafRow = (e) => e.mode === 'conflict'
-  ? [e.path, 'conflict', Buffer.from(e.term, 'hex'), 0]
-  : [e.path, e.mode, Buffer.from(e.blob, 'hex'), e.size]
-const unleaf = ([path, mode, id, size]) => mode === 'conflict'
-  ? { path, mode: 'conflict', term: hex(id) }
-  : { path, mode, blob: hex(id), size }
-
-/** A node's canonical bytes and id. */
-function nodeOf (level, rows) {
-  const bytes = encode({ l: level, e: rows })
-  return { id: idOf('tree', bytes), bytes }
-}
-
-/** Decodes a tree node: { level, entries } (leaf entries, or [{ key, child }]). */
-export function decodeNode (bytes) {
-  const n = decode(bytes)
-  if (n.l === 0) return { level: 0, entries: n.e.map(unleaf) }
-  return { level: n.l, entries: n.e.map(([key, child]) => ({ key, child: hex(child) })) }
-}
-
-function chunk (items, keyOf, level) {
-  const groups = []
-  let cur = []
-  for (const it of items) {
-    cur.push(it)
-    const k = keyOf(it)
-    if (cur.length >= MAX || (cur.length >= MIN && (keyHash(k, level) & MASK) === MASK)) { groups.push(cur); cur = [] }
-  }
-  if (cur.length || !groups.length) groups.push(cur)
-  return groups
-}
-
-/**
- * Builds the tree of `entries` (sorted by path, unique). Returns { root, nodes } where nodes is a
- * Map of id → bytes for every node of the tree (callers store the ones they don't have).
- */
-export function buildTree (entries) {
-  const nodes = new Map()
-  let level = 0
-  let items = chunk(entries, (e) => e.path, 0).map((g) => {
-    const n = nodeOf(0, g.map(leafRow))
-    nodes.set(n.id, n.bytes)
-    return { key: g.length ? g[0].path : '', child: n.id }
-  })
-  while (items.length > 1) {
-    level++
-    items = chunk(items, (it) => it.key, level).map((g) => {
-      const n = nodeOf(level, g.map((it) => [it.key, Buffer.from(it.child, 'hex')]))
-      nodes.set(n.id, n.bytes)
-      return { key: g[0].key, child: n.id }
-    })
-  }
-  return { root: items[0].child, nodes }
-}
-
-/** The empty tree: never stored, known to every reader. */
-const empty = buildTree([])
-export const EMPTY_TREE = empty.root
-export const EMPTY_TREE_BYTES = empty.nodes.get(empty.root)
-
-/** Applies changes ({ path, op, blob, mode, size, term }) to sorted entries; returns new sorted entries. */
-export function applyChanges (entries, changes) {
-  const map = new Map(entries.map((e) => [e.path, e]))
-  for (const c of changes) {
-    if (c.op === 'delete') map.delete(c.path)
-    else if (c.op === 'conflict') map.set(c.path, { path: c.path, mode: 'conflict', term: c.term })
-    else map.set(c.path, { path: c.path, mode: c.mode, blob: c.blob, size: c.size })
-  }
-  return [...map.values()].sort((a, b) => cmpPath(a.path, b.path))
-}
-
-/**
- * Reads trees through `getNode(id) → bytes` (async; callers cache). Every read is a walk from a
- * root, skipping the subtrees it does not need.
- */
-export class TreeReader {
-  constructor (getNode) {
-    this.getNode = getNode
-    this.cache = new Map()
-  }
-
-  async node (id) {
-    let n = this.cache.get(id)
-    if (!n) {
-      n = decodeNode(id === EMPTY_TREE ? EMPTY_TREE_BYTES : await this.getNode(id))
-      this.cache.set(id, n)
-      if (this.cache.size > 20000) this.cache.delete(this.cache.keys().next().value)
-    }
-    return n
-  }
-
-  /** Every entry of the tree, in order. */
-  async entries (root) { return this.list(root, ['']) }
-
-  /** The entry at `path`, or null. */
-  async lookup (root, path) {
-    const found = await this.list(root, [path], { exact: true })
-    return found.find((e) => e.path === path) || null
-  }
-
-  /**
-   * The entries under any of `prefixes` (directories; '' is the root), in order. Only the nodes
-   * whose key range meets a prefix are read.
-   */
-  async list (root, prefixes, { exact = false } = {}) {
-    const ranges = prefixes.map((p) => p ? (exact ? [[p, p + '\0']] : [[p, p + '\0'], [p + '/', p + '0']]) : [['', null]]).flat()
-    const meets = (lo, hi) => ranges.some(([a, b]) => (b === null || cmpPath(lo, b) < 0) && (hi === null || cmpPath(hi, a) > 0))
-    const out = []
-    const walk = async (id, lo, hi) => {
-      const n = await this.node(id)
-      if (n.level === 0) {
-        for (const e of n.entries) if (prefixes.some((p) => exact ? e.path === p : under(e.path, p))) out.push(e)
-        return
-      }
-      for (let i = 0; i < n.entries.length; i++) {
-        const clo = i === 0 ? lo : n.entries[i].key
-        const chi = i + 1 < n.entries.length ? n.entries[i + 1].key : hi
-        if (meets(clo, chi)) await walk(n.entries[i].child, clo, chi)
-      }
-    }
-    await walk(root, '', null)
-    return out
-  }
-
-  /**
-   * What changed from tree `a` to tree `b`: [{ path, before?, after? }] in path order. Subtrees
-   * with the same id on both sides are never read, so the cost follows the change, not the tree.
-   */
-  async diff (a, b) {
-    if (a === b) return []
-    let fa = new Set([a])
-    let fb = new Set([b])
-    for (;;) {
-      for (const id of [...fa]) if (fb.has(id)) { fa.delete(id); fb.delete(id) }
-      const expand = async (front) => {
-        const next = new Set()
-        let grew = false
-        for (const id of front) {
-          const n = await this.node(id)
-          if (n.level === 0) next.add(id)
-          else { grew = true; for (const e of n.entries) next.add(e.child) }
-        }
-        return { next, grew }
-      }
-      const [ea, eb] = [await expand(fa), await expand(fb)]
-      fa = ea.next; fb = eb.next
-      if (!ea.grew && !eb.grew) break
-    }
-    for (const id of [...fa]) if (fb.has(id)) { fa.delete(id); fb.delete(id) }
-    const leaves = async (front) => {
-      const m = new Map()
-      for (const id of front) for (const e of (await this.node(id)).entries) m.set(e.path, e)
-      return m
-    }
-    const [ma, mb] = [await leaves(fa), await leaves(fb)]
-    const paths = [...new Set([...ma.keys(), ...mb.keys()])].sort(cmpPath)
-    const out = []
-    for (const p of paths) {
-      const x = ma.get(p)
-      const y = mb.get(p)
-      if (x && y && sameEntry(x, y)) continue
-      out.push({ path: p, ...(x ? { before: x } : {}), ...(y ? { after: y } : {}) })
-    }
-    return out
-  }
-}
-
-export const sameEntry = (x, y) => x.mode === y.mode && x.blob === y.blob && x.term === y.term
-
-const itemKey = (level) => level === 0 ? (e) => e.path : (it) => it.key
-const nodeRows = (level, items) => level === 0 ? items.map(leafRow) : items.map((it) => [it.key, Buffer.from(it.child, 'hex')])
-
-/**
- * A cursor over the node references of one level of the tree at `root` (top level `top`),
- * placed on the node whose subtree holds `key`. It reads only the nodes on its way down and
- * the neighbours it is moved onto: never a whole level.
- */
-async function cursorAt (reader, root, top, level, key) {
-  const stack = []
-  let id = root
-  for (let l = top; l > level; l--) {
-    const es = (await reader.node(id)).entries
-    let lo = 0; let hi = es.length - 1
-    while (lo < hi) { const mid = (lo + hi + 1) >> 1; if (cmpPath(es[mid].key, key) <= 0) lo = mid; else hi = mid - 1 }
-    stack.push({ es, i: lo })
-    id = es[lo].child
-  }
-  let end = false
-  return {
-    get end () { return end },
-    ref: () => end ? null : stack.length ? stack[stack.length - 1].es[stack[stack.length - 1].i] : { key: '', child: root },
-    first: () => stack.every((x) => x.i === 0),
-    async next () {
-      let d = stack.length - 1
-      while (d >= 0 && stack[d].i + 1 >= stack[d].es.length) d--
-      if (d < 0) { end = true; return }
-      stack[d].i++
-      for (let j = d + 1; j < stack.length; j++) stack[j] = { es: (await reader.node(stack[j - 1].es[stack[j - 1].i].child)).entries, i: 0 }
-    }
-  }
-}
-
-/**
- * Re-chunks one level where it was edited. `edits` ([{ from, to, items }], in order) replace the
- * items of the old nodes from..to. Chunking restarts at an edit's first node (its start is a
- * boundary in the old tree, so the chunker's state is the same) and stops once a new boundary
- * falls on an old node's end with no edit next: from there the old nodes are the new ones.
- * Returns splices [{ from, to, refs }]: old nodes from..to became `refs`.
- */
-async function rechunkLevel (reader, root, top, level, edits, nodes) {
-  const keyOf = itemKey(level)
-  const splices = []
-  let e = 0
-  while (e < edits.length) {
-    const cur = await cursorAt(reader, root, top, level, edits[e].from.key)
-    const atFirst = cur.first()
-    const sp = { from: cur.ref(), to: null, refs: [] }
-    let buf = []
-    const emit = () => {
-      const n = nodeOf(level, nodeRows(level, buf))
-      nodes.set(n.id, n.bytes)
-      sp.refs.push({ key: buf.length ? keyOf(buf[0]) : '', child: n.id })
-      buf = []
-    }
-    let synced = false
-    for (;;) {
-      let items
-      if (e < edits.length && cur.ref().child === edits[e].from.child) {
-        items = edits[e].items
-        while (cur.ref().child !== edits[e].to.child) await cur.next()
-        e++
-      } else items = (await reader.node(cur.ref().child)).entries
-      sp.to = cur.ref()
-      let atEnd = false
-      for (let k = 0; k < items.length; k++) {
-        buf.push(items[k])
-        if (buf.length >= MAX || (buf.length >= MIN && (keyHash(keyOf(items[k]), level) & MASK) === MASK)) { emit(); atEnd = k === items.length - 1 }
-      }
-      await cur.next()
-      if (cur.end) break
-      if (atEnd && !(e < edits.length && cur.ref().child === edits[e].from.child)) { synced = true; break }
-    }
-    if (!synced && (buf.length || (atFirst && !sp.refs.length))) emit()
-    splices.push(sp)
-  }
-  return splices
-}
-
-/** The level above's edits for `splices`: each parent holding a splice gets its new child list. */
-async function parentEdits (reader, root, top, level, splices) {
-  const out = []
-  for (const sp of splices) {
-    const pF = (await cursorAt(reader, root, top, level, sp.from.key)).ref()
-    const pL = (await cursorAt(reader, root, top, level, sp.to.key)).ref()
-    const last = out[out.length - 1]
-    if (last && last.to.child === pF.child) { last.to = pL; last.splices.push(sp) } else out.push({ from: pF, to: pL, splices: [sp] })
-  }
-  for (const ed of out) {
-    const c = await cursorAt(reader, root, top, level, ed.from.key)
-    const items = []
-    let s = 0
-    let skipTo = null
-    for (;;) {
-      for (const ch of (await reader.node(c.ref().child)).entries) {
-        if (skipTo) { if (ch.child === skipTo) skipTo = null; continue }
-        const sp = ed.splices[s]
-        if (sp && ch.child === sp.from.child) { items.push(...sp.refs); if (ch.child !== sp.to.child) skipTo = sp.to.child; s++; continue }
-        items.push(ch)
-      }
-      if (c.ref().child === ed.to.child) break
-      await c.next()
-    }
-    ed.items = items
-  }
-  return out
-}
-
-/**
- * The tree `root` with `changes` applied ({ path, op: put|delete|conflict, ... }), equal to
- * `buildTree` of the changed entries but reading and writing only the nodes on the changed
- * paths and the neighbours the chunker reads until it is back in step: O(changes × depth).
- * Returns { root, nodes } (the new nodes).
- */
-export async function updateTree (reader, root, changes) {
-  const nodes = new Map()
-  if (!changes.length) return { root, nodes }
-  const top = (await reader.node(root)).level
-  // Level 0: the changes, grouped by the leaf they fall in.
-  let edits = []
-  for (const c of [...changes].sort((a, b) => cmpPath(a.path, b.path))) {
-    const ref = (await cursorAt(reader, root, top, 0, c.path)).ref()
-    const last = edits[edits.length - 1]
-    if (last && last.from.child === ref.child) last.changes.push(c)
-    else edits.push({ from: ref, to: ref, changes: [c] })
-  }
-  for (const ed of edits) ed.items = applyChanges((await reader.node(ed.from.child)).entries, ed.changes)
-  let refs
-  for (let l = 0; ; l++) {
-    const splices = await rechunkLevel(reader, root, top, l, edits, nodes)
-    if (l === top) { refs = splices[0].refs; break }
-    edits = await parentEdits(reader, root, top, l + 1, splices)
-  }
-  // The tree grew: chunk the levels above from memory, as buildTree does.
-  let level = top
-  while (refs.length > 1) {
-    level++
-    refs = chunk(refs, (it) => it.key, level).map((g) => {
-      const n = nodeOf(level, nodeRows(level, g))
-      nodes.set(n.id, n.bytes)
-      return { key: g[0].key, child: n.id }
-    })
-  }
-  // The tree shrank: a root with one child is that child (buildTree stops at a one-node level).
-  let r = refs[0].child
-  for (;;) {
-    const n = nodes.has(r) ? decodeNode(nodes.get(r)) : await reader.node(r)
-    if (n.level === 0 || n.entries.length !== 1) break
-    nodes.delete(r)
-    r = n.entries[0].child
-  }
-  if (r === EMPTY_TREE) nodes.delete(r)
-  return { root: r, nodes }
-}

package/src/quilts/webhook.js

@@ -1,116 +0,0 @@
-// Seam's own webhooks: a member's subscription and its signed POSTs. Each POST carries
-// x-quilt-event, x-quilt-delivery, x-quilt-timestamp and
-// x-quilt-signature: sha256=HMAC-SHA256(secret, "<timestamp>.<body>"), and is retried after
-// each of RETRY_DELAYS_MS when the receiver is down, slow, or answers 408, 429 or 5xx.
-import crypto from 'node:crypto'
-import net from 'node:net'
-
-export const RETRY_DELAYS_MS = [1000, 5000, 25_000]
-export const DELIVERY_TIMEOUT_MS = 10_000
-export const MAX_URL = 2000
-export const MIN_SECRET = 16
-export const MAX_SECRET = 200
-export const MAX_BEARER = 500
-
-const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]', '0.0.0.0'])
-const PRIVATE_V4 = new net.BlockList()
-for (const [a, p] of [['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8], ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['224.0.0.0', 3]]) PRIVATE_V4.addSubnet(a, p, 'ipv4')
-const PRIVATE_V6 = new net.BlockList()
-for (const [a, p] of [['::', 96], ['64:ff9b::', 96], ['fc00::', 7], ['fe80::', 10], ['fec0::', 10], ['ff00::', 8]]) PRIVATE_V6.addSubnet(a, p, 'ipv6')
-
-/** Whether a host as written in a URL is this computer or a private network address. */
-function isLocalHost (host) {
-  const h = host.toLowerCase().replace(/^\[|\]$/g, '')
-  if (LOCAL_HOSTS.has(h) || h.endsWith('.localhost')) return true
-  const mapped = h.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i)
-  const a = mapped ? mapped[1] : h
-  const kind = net.isIP(a)
-  if (kind === 4) return PRIVATE_V4.check(a, 'ipv4')
-  if (kind === 6) return PRIVATE_V6.check(a, 'ipv6')
-  return false
-}
-
-/** The URL a subscription may POST to: https, no credentials, public (allowLocal also takes http to this computer). */
-export function parseWebhookUrl (raw, { allowLocal = false } = {}) {
-  const s = String(raw || '').trim()
-  if (!s) throw new Error('give the URL seam should POST to')
-  if (s.length > MAX_URL) throw new Error('that URL is too long')
-  let u
-  try { u = new URL(s) } catch { throw new Error('that is not a valid URL') }
-  if (u.username || u.password) throw new Error('the URL may not carry a user name or password')
-  const local = isLocalHost(u.hostname)
-  if (u.protocol === 'http:') {
-    if (!allowLocal || !local) throw new Error('the URL must use https')
-  } else if (u.protocol !== 'https:') {
-    throw new Error('the URL must start with https://')
-  } else if (local && !allowLocal) {
-    throw new Error('the URL must be reachable from the internet, not a local or private address')
-  }
-  return u.toString()
-}
-
-/** { url, secret?, bearer? } → { url, secret, since, made, bearer? }: a secret left out is made (and shown once). */
-export function makeSubscription ({ url, secret, bearer } = {}, { allowLocal = false, now = Date.now } = {}) {
-  const u = parseWebhookUrl(url, { allowLocal })
-  let s = secret == null ? '' : String(secret)
-  if (s && (s.length < MIN_SECRET || s.length > MAX_SECRET)) throw new Error(`the secret must be ${MIN_SECRET} to ${MAX_SECRET} characters (or leave it out and seam makes one)`)
-  const made = !s
-  if (made) s = crypto.randomBytes(24).toString('hex')
-  const b = bearer == null ? '' : String(bearer).trim()
-  if (b.length > MAX_BEARER || /[\r\n]/.test(b)) throw new Error(`the bearer key must be one line of at most ${MAX_BEARER} characters`)
-  return { url: u, secret: s, since: now(), made, ...(b ? { bearer: b } : {}) }
-}
-
-/** `sha256=<hex>`: HMAC-SHA256 with `secret` over `<ts>.<body>`. */
-export function signWebhook (secret, ts, body) {
-  return 'sha256=' + crypto.createHmac('sha256', String(secret)).update(`${ts}.${body}`).digest('hex')
-}
-
-/** For receivers: whether `signature` is right for this body and timestamp. */
-export function verifyWebhook (secret, ts, body, signature) {
-  const want = Buffer.from(signWebhook(secret, ts, body))
-  const got = Buffer.from(String(signature || ''))
-  return want.length === got.length && crypto.timingSafeEqual(want, got)
-}
-
-const retryable = (status) => status === 408 || status === 429 || status >= 500
-
-/** POSTs `payload` to `sub.url`, signed, with retries. Resolves { ok, status, attempts, delivery, error? }; never throws. */
-export async function deliverWebhook (sub, payload, { fetch = globalThis.fetch, delays = RETRY_DELAYS_MS, sleep = (ms) => new Promise((r) => setTimeout(r, ms)), timeoutMs = DELIVERY_TIMEOUT_MS, now = Date.now, log = () => {} } = {}) {
-  const body = JSON.stringify(payload)
-  const delivery = crypto.randomUUID()
-  let status = 0
-  let error = ''
-  let attempt = 0
-  while (attempt < delays.length + 1) {
-    attempt++
-    const ts = String(now())
-    try {
-      const res = await fetch(sub.url, {
-        method: 'POST',
-        headers: {
-          'content-type': 'application/json',
-          'user-agent': 'seam-webhook',
-          'x-quilt-event': String(payload.event || ''),
-          'x-quilt-delivery': delivery,
-          'x-quilt-timestamp': ts,
-          'x-quilt-signature': signWebhook(sub.secret, ts, body),
-          ...(sub.bearer ? { authorization: `Bearer ${sub.bearer}` } : {})
-        },
-        body,
-        redirect: 'manual',
-        signal: AbortSignal.timeout(timeoutMs)
-      })
-      status = res.status
-      error = ''
-      if (res.ok) return { ok: true, status, attempts: attempt, delivery }
-      if (!retryable(status)) break
-    } catch (err) {
-      status = 0
-      error = err && err.message ? err.message : String(err)
-    }
-    if (attempt <= delays.length) await sleep(delays[attempt - 1])
-  }
-  log(`webhook to ${sub.url} failed (${payload.event}): ${error || `HTTP ${status}`}`)
-  return { ok: false, status, attempts: attempt, error: error || `HTTP ${status}`, delivery }
-}

package/src/quilts/window.js

@@ -1,121 +0,0 @@
-// The merge window (plans/quilt-source-control/07 "AIMD on merges when main is red", 04 "Rate
-// limiting", decision 40): each line takes at most `window` merges an hour, 200 by default, and a
-// quilt at most 200 an hour across its lines. Merges are counted from the log itself (a line's
-// patches carry their time), so every API machine sees the same count with no counter to keep.
-// A red post-merge check halves the line's window (once per check, floor 5); that check going
-// green restores the window it halved; any other green batch adds 10, up to the line's maximum.
-// Above the window a merge is refused with 429 merge_window and `retry_after` seconds. A dry run
-// is never limited.
-import { QuiltError } from './service.js'
-
-export const HOUR = 3600 * 1000
-export const DEFAULT_WINDOW = 200
-export const FLOOR = 5
-export const GREEN_STEP = 10
-
-export function windowOps (svc, { max = DEFAULT_WINDOW, quiltMax = DEFAULT_WINDOW } = {}) {
-  const { store, now, quiltFor, fromStore } = svc.internals
-
-  const windowOf = (ln) => ({
-    max: ln.merge_window_max ?? max,
-    window: Math.min(ln.merge_window ?? ln.merge_window_max ?? max, ln.merge_window_max ?? max),
-    red: ln.red_checks || {}
-  })
-
-  // The patches of a line merged in the last hour, at most `cap` of them, and the time the
-  // oldest of those counted leaves the hour. Binary search over patch numbers: a line's patch
-  // times only grow, so this is O(log cap) reads of the patch row, never a scan. A git import's
-  // patches are not merges and don't count: they come before every merge on the line, so a
-  // just-imported quilt takes its first merges at once instead of an hour later.
-  async function lastHour (q, ln, cap, t) {
-    const n = ln.patch_count
-    if (!n || !cap) return { count: 0, oldest: null }
-    let lo = Math.max(1, n - cap + 1); let hi = n + 1 // first patch inside the hour is in [lo, hi]
-    const imported = new Map()
-    const isImport = async (sq) => { if (!imported.has(sq)) imported.set(sq, !!(sq && (await store.getSquare(sq))?.import)); return imported.get(sq) }
-    const inHour = async (p) => { const row = await store.patch(q, ln.name, p); return row && Number(row.at) > t - HOUR && !(await isImport(row.square)) ? Number(row.at) : null }
-    if (await inHour(n) == null) return { count: 0, oldest: null }
-    while (lo < hi) {
-      const mid = (lo + hi) >> 1
-      if (await inHour(mid) != null) hi = mid; else lo = mid + 1
-    }
-    return { count: n - lo + 1, oldest: await inHour(lo) }
-  }
-
-  /** Refuses a merge into `line` above its window or the quilt's (429 merge_window). */
-  async function checkWindow (q, line) {
-    const t = now()
-    const ln = await store.getLine(q.id, line)
-    if (!ln) return
-    const w = windowOf(ln)
-    const mine = await lastHour(q.id, ln, w.window, t)
-    if (mine.count >= w.window) {
-      throw new QuiltError(429, 'merge_window', `${line} has taken its ${w.window} merges for this hour${w.window < w.max ? ' (halved while a check is red)' : ''}; try again in ${Math.ceil((mine.oldest + HOUR - t) / 1000)} s`, { retry_after: Math.max(1, Math.ceil((mine.oldest + HOUR - t) / 1000)), window: w.window, window_max: w.max })
-    }
-    const lines = await store.lines(q.id)
-    if (lines.length < 2) return
-    let total = 0; let oldest = Infinity
-    for (const other of lines) {
-      const r = await lastHour(q.id, other, quiltMax, t)
-      total += r.count
-      if (r.oldest != null) oldest = Math.min(oldest, r.oldest)
-    }
-    if (total >= quiltMax) throw new QuiltError(429, 'merge_window', `this quilt has taken its ${quiltMax} merges for this hour across its lines`, { retry_after: Math.max(1, Math.ceil((oldest + HOUR - t) / 1000)), window: quiltMax })
-  }
-
-  async function setWindow (q, ln, next) {
-    try {
-      await store.setLineWindow({ quilt_id: q.id, line: ln.name, merge_window: next.window, merge_window_max: next.max, red_checks: next.red, at: now() })
-    } catch (err) { throw fromStore(err) }
-    return { line: ln.name, window: next.window, window_max: next.max, red: Object.keys(next.red).sort() }
-  }
-
-  /**
-   * A post-merge check's result on a line (13 sends these; a CI hook or a person can too):
-   * { check, status: 'red'|'green'|'flaky' }. Returns the line's window after it.
-   */
-  async function reportCheck (me, ref, line, body = {}) {
-    const q = await quiltFor(me, ref, 'write')
-    const ln = await store.getLine(q.id, line)
-    if (!ln) throw new QuiltError(404, 'not_found', `no line ${line}`)
-    const check = String(body.check || '').trim()
-    if (!check || check.length > 200) throw new QuiltError(400, 'bad_request', 'check: the name of the check, up to 200 characters')
-    if (!['red', 'green', 'flaky'].includes(body.status)) throw new QuiltError(400, 'bad_request', "status: 'red', 'green' or 'flaky'")
-    const noted = svc.internals.noteVerdict ? await svc.internals.noteVerdict(me, q, { name: check, tier: 'post_merge', commit: ln.tip, line, verdict: body.status, run_key: body.run_key, url: body.url }) : {}
-    if (noted.advisory) { const w0 = windowOf(ln); return { line, window: w0.window, window_max: w0.max, red: Object.keys(w0.red).sort(), advisory: true } }
-    const w = windowOf(ln)
-    const red = { ...w.red }
-    let window = w.window
-    if (body.status === 'red') {
-      if (red[check] == null) { red[check] = window; window = Math.max(FLOOR, Math.floor(window / 2)) } // once per check, not per red batch
-    } else if (red[check] != null) {
-      window = Math.max(window, red[check]) // green (or flaky) again: back to the window before that halving
-      delete red[check]
-    } else if (body.status === 'green') {
-      window = Math.min(w.max, window + GREEN_STEP)
-    }
-    return setWindow(q, ln, { window, max: w.max, red })
-  }
-
-  /** An admin sets a line's maximum window (04's PATCH /lines/:name { merge_window_max }). */
-  async function setLineLimits (me, ref, line, body = {}) {
-    const q = await quiltFor(me, ref, 'admin')
-    const ln = await store.getLine(q.id, line)
-    if (!ln) throw new QuiltError(404, 'not_found', `no line ${line}`)
-    const m = Number(body.merge_window_max)
-    if (!Number.isInteger(m) || m < FLOOR || m > 100000) throw new QuiltError(400, 'bad_request', `merge_window_max: a whole number from ${FLOOR}`)
-    const w = windowOf(ln)
-    return setWindow(q, ln, { window: Math.min(m, w.window === w.max ? m : w.window), max: m, red: w.red })
-  }
-
-  async function lineWindow (me, ref, line) {
-    const q = await quiltFor(me, ref, 'read')
-    const ln = await store.getLine(q.id, line)
-    if (!ln) throw new QuiltError(404, 'not_found', `no line ${line}`)
-    const w = windowOf(ln)
-    const used = await lastHour(q.id, ln, w.window, now())
-    return { line, window: w.window, window_max: w.max, used: used.count, red: Object.keys(w.red).sort() }
-  }
-
-  return { checkWindow, reportCheck, setLineLimits, lineWindow }
-}