New repository page with board and starting files; assetlinks.json; hung tests stopped; changelog on the WASM tier (closes #360, closes #365, closes #370) 40a43921ef42

-- A repository's boards (oxygenhub#360): a board made or chosen with a new

-- repository takes its issues and proposals as they open, each a card at

-- the bottom of the board's first column.

CREATE TABLE project_repos (

    project_id BIGINT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,

    repo_id    BIGINT NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,

    PRIMARY KEY (project_id, repo_id)

);

CREATE INDEX project_repos_by_repo ON project_repos (repo_id);

-- A repository's boards (oxygenhub#360): a board made or chosen with a new

-- repository takes its issues and proposals as they open, each a card at

-- the bottom of the board's first column.

CREATE TABLE project_repos (

    project_id INTEGER NOT NULL REFERENCES projects(id) ON DELETE CASCADE,

    repo_id    INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,

    PRIMARY KEY (project_id, repo_id)

);

CREATE INDEX project_repos_by_repo ON project_repos (repo_id);

//! What a new repository starts with (oxygenhub#360), shared by the New

//! repository page and the API: a name check before anything is made, the

//! files it starts with (a README, a licence, an `.oxyignore` for a

//! language), committed as its creator the way the starter's are (#347),

//! and a project board made or chosen with it, which then takes its issues

//! and proposals as they open.

use crate::auth::roles;

use crate::db::{self, projects as pdb};

use crate::repos::RepoName;

use crate::Shared;

use oxy_core::repo::FileEdit;

/// Whether `owner/name` may be made by `account`: `Ok` with its address,

/// or why not, said as the page and the API say it.

pub async fn check_name(app: &Shared, account: &db::accounts::Account, owner: &str, name: &str) -> Result<RepoName, String> {

    let Some(n) = RepoName::new(owner.trim(), name.trim()) else {

        return Err("A repository name is letters, digits, dots, dashes and underscores, up to 64.".into());

    };

    if n.name.ends_with(crate::wiki::SUFFIX) {

        return Err("A name cannot end in .wiki: that is the address of a repository's wiki.".into());

    }

    if !roles::may_create_under(&app.db, account, &n.owner).await.map_err(|e| e.to_string())? {

        return Err(format!("You cannot create repositories under {}.", n.owner));

    }

    if db::repos::get(&app.db, &n.owner, &n.name).await.map_err(|e| e.to_string())?.is_some() || app.repos.exists(&n) {

        return Err(format!("{n} exists."));

    }

    Ok(n)

}

/// A board for a new repository: none, a new one under its owner with this

/// title, or the owner's board of this number.

#[derive(Clone, Debug, PartialEq, Eq)]

pub enum Board {

    None,

    New(String),

    Existing(i64),

}

impl Board {

    /// The form's or the API's choice: `new` with a title (the

    /// repository's name when empty), a board number, or nothing.

    pub fn parse(choice: &str, title: &str, repo: &str) -> Result<Board, String> {

        match choice.trim() {

            "" | "none" => Ok(Board::None),

            "new" => {

                let t: String = title.trim().chars().take(100).collect();

                Ok(Board::New(if t.is_empty() { repo.to_string() } else { t }))

            }

            n => n.parse().map(Board::Existing).map_err(|_| format!("No board {n}.")),

        }

    }

}

/// Checked before the repository is made: a chosen board must be the

/// owner's, open, and one `account` may change.

pub async fn check_board(app: &Shared, account: &db::accounts::Account, owner: &str, board: &Board) -> Result<(), String> {

    match board {

        Board::None => Ok(()),

        Board::New(_) => match crate::web::projects::rights_of(app, Some(account), owner).await.map_err(|e| e.to_string())? {

            Some(r) if r.edit => Ok(()),

            _ => Err(format!("You cannot make boards under {owner}.")),

        },

        Board::Existing(n) => {

            let p = pdb::get(&app.db, owner, *n).await.map_err(|e| e.to_string())?.ok_or(format!("{owner} has no board {n}."))?;

            if p.closed {

                return Err(format!("Board {n} is closed."));

            }

            match crate::web::projects::rights_of(app, Some(account), owner).await.map_err(|e| e.to_string())? {

                Some(r) if r.edit => Ok(()),

                _ => Err(format!("You cannot change {owner}'s boards.")),

            }

        }

    }

}

/// Make or find the board and link it to the repository; its number.

pub async fn link_board(app: &Shared, row: &db::repos::RepoRow, board: &Board, public: bool) -> sqlx::Result<Option<i64>> {

    let p = match board {

        Board::None => return Ok(None),

        Board::New(title) => pdb::create(&app.db, &row.owner, title, &format!("Work on {}/{}", row.owner, row.name), public).await?,

        Board::Existing(n) => match pdb::get(&app.db, &row.owner, *n).await? {

            Some(p) => p,

            None => return Ok(None),

        },

    };

    pdb::link_repo(&app.db, p.id, row.id).await?;

    Ok(Some(p.number))

}

/// The licences offered, with what each allows, for the page.

pub const LICENCES: &[(&str, &str)] = &[

    ("MIT", "use, change and share it freely, keeping the notice"),

    ("BSD-2-Clause", "as MIT, in the BSD's words"),

    ("ISC", "as MIT, in fewer words"),

];

/// The languages an `.oxyignore` is offered for.

pub const IGNORES: &[&str] = &["Rust", "Node", "Python", "Go", "Java and Kotlin"];

/// What a new repository starts with: the files, by path.

#[derive(Clone, Debug, Default, PartialEq, Eq)]

pub struct Start {

    pub readme: bool,

    /// One of [`LICENCES`], or empty.

    pub licence: String,

    /// One of [`IGNORES`], or empty.

    pub ignore: String,

}

impl Start {

    pub fn is_empty(&self) -> bool {

        !self.readme && self.licence.is_empty() && self.ignore.is_empty()

    }

    /// The files, for a repository `name` described as `description`,

    /// whose copyright `holder` keeps in `year`.

    pub fn files(&self, name: &RepoName, description: &str, holder: &str, year: i32) -> Result<Vec<(String, String)>, String> {

        let mut out = Vec::new();

        if self.readme {

            let about = if description.trim().is_empty() { String::new() } else { format!("{}\n\n", description.trim()) };

            out.push(("README.md".to_string(), format!("# {}\n\n{about}", name.name)));

        }

        if !self.licence.is_empty() {

            let text = licence(&self.licence, holder, year).ok_or(format!("No licence {}.", self.licence))?;

            out.push(("LICENSE".to_string(), text));

        }

        if !self.ignore.is_empty() {

            let text = ignore(&self.ignore).ok_or(format!("No .oxyignore for {}.", self.ignore))?;

            out.push((".oxyignore".to_string(), text.to_string()));

        }

        Ok(out)

    }

}

fn licence(id: &str, holder: &str, year: i32) -> Option<String> {

    Some(match id {

        "MIT" => format!(

            "MIT License\n\nCopyright (c) {year} {holder}\n\n\

Permission is hereby granted, free of charge, to any person obtaining a copy\n\

of this software and associated documentation files (the \"Software\"), to deal\n\

in the Software without restriction, including without limitation the rights\n\

to use, copy, modify, merge, publish, distribute, sublicense, and/or sell\n\

copies of the Software, and to permit persons to whom the Software is\n\

furnished to do so, subject to the following conditions:\n\n\

The above copyright notice and this permission notice shall be included in all\n\

copies or substantial portions of the Software.\n\n\

THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\n\

IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\n\

FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\n\

AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\n\

LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\n\

OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\n\

SOFTWARE.\n"

        ),

        "BSD-2-Clause" => format!(

            "BSD 2-Clause License\n\nCopyright (c) {year}, {holder}\n\n\

Redistribution and use in source and binary forms, with or without\n\

modification, are permitted provided that the following conditions are met:\n\n\

1. Redistributions of source code must retain the above copyright notice, this\n   \

list of conditions and the following disclaimer.\n\n\

2. Redistributions in binary form must reproduce the above copyright notice,\n   \

this list of conditions and the following disclaimer in the documentation\n   \

and/or other materials provided with the distribution.\n\n\

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\"\n\

AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE\n\

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n\

DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE\n\

FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\n\

DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR\n\

SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\n\

CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\n\

OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE\n\

OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n"

        ),

        "ISC" => format!(

            "ISC License\n\nCopyright (c) {year} {holder}\n\n\

Permission to use, copy, modify, and/or distribute this software for any\n\

purpose with or without fee is hereby granted, provided that the above\n\

copyright notice and this permission notice appear in all copies.\n\n\

THE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES\n\

WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF\n\

MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR\n\

ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\n\

WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN\n\

ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF\n\

OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.\n"

        ),

        _ => return None,

    })

}

fn ignore(lang: &str) -> Option<&'static str> {

    Some(match lang {

        "Rust" => "# Build output\ntarget/\n",

        "Node" => "# Dependencies and build output\nnode_modules/\ndist/\n*.log\n",

        "Python" => "# Caches, environments and build output\n__pycache__/\n*.pyc\n.venv/\nbuild/\ndist/\n*.egg-info/\n",

        "Go" => "# Build output\nbin/\n*.test\n",

        "Java and Kotlin" => "# Build output and tool state\nbuild/\n.gradle/\nout/\n*.class\n",

        _ => return None,

    })

}

/// Commit `files` to the new repository's default bookmark as `by`, signed

/// as their delegate (as the starter's are); a repository with no files

/// yet only.

pub async fn commit_start(

    app: &Shared,

    row: &db::repos::RepoRow,

    by: &db::accounts::Account,

    files: Vec<(String, String)>,

) -> Result<(), String> {

    if files.is_empty() {

        return Ok(());

    }

    let name = RepoName::new(&row.owner, &row.name).ok_or("bad repository name")?;

    let signer = crate::web::edit::signer_for(app, by.id).await?;

    let paths: Vec<String> = files.iter().map(|(p, _)| p.clone()).collect();

    let edits: Vec<FileEdit> = files.into_iter().map(|(path, content)| FileEdit { path, content: Some(content.into_bytes()) }).collect();

    let b = row.default_bookmark.clone();

    crate::repos::edits::commit(&app.repos, &name, b.clone(), b, edits, format!("Start with {}", paths.join(", ")), signer)

        .await

        .map_err(|e| e.to_string())?;

    db::accounts::audit(&app.db, Some(by), "repo.started", &name.to_string(), &paths.join(", ")).await.ok();

    Ok(())

}

#[cfg(test)]

mod tests {

    use super::*;

    #[test]

    fn boards_and_starting_files() {

        assert_eq!(Board::parse("", "", "demo").unwrap(), Board::None);

        assert_eq!(Board::parse("new", " ", "demo").unwrap(), Board::New("demo".into()));

        assert_eq!(Board::parse("new", "Roadmap", "demo").unwrap(), Board::New("Roadmap".into()));

        assert_eq!(Board::parse("4", "", "demo").unwrap(), Board::Existing(4));

        assert!(Board::parse("four", "", "demo").is_err());

        let name = RepoName::new("andy", "demo").unwrap();

        let s = Start { readme: true, licence: "MIT".into(), ignore: "Rust".into() };

        let files = s.files(&name, "A demo.", "Andy McCall", 2026).unwrap();

        let paths: Vec<&str> = files.iter().map(|(p, _)| p.as_str()).collect();

        assert_eq!(paths, ["README.md", "LICENSE", ".oxyignore"]);

        assert_eq!(files[0].1, "# demo\n\nA demo.\n\n");

        assert!(files[1].1.starts_with("MIT License\n\nCopyright (c) 2026 Andy McCall\n"));

        assert_eq!(files[2].1, "# Build output\ntarget/\n");

        for (id, _) in LICENCES {

            assert!(licence(id, "X", 2026).unwrap().contains("2026"), "{id}");

        }

        for lang in IGNORES {

            assert!(ignore(lang).is_some(), "{lang}");

        }

        assert!(Start { licence: "GPL".into(), ..Default::default() }.files(&name, "", "X", 2026).is_err());

        assert!(Start::default().is_empty());

    }

}

# A test still running after ten minutes is stopped and fails (#365):

# a hang in run #537 held its runner for an hour.

slow-timeout = { period = "60s", terminate-after = 10 }

// Cheap checks on the WASM tier (oxygenflow#96): OxygenFlow's checks module,

// copied from oxygenflow/.flow/checks.wasm (built there from

// crates/flow-checks; copy it again when it changes). No image and no KVM,

// so any runner with the WASM tier takes it: a phone, plex, windows-1.

sandbox "wasm" {

    runtime "wasm"

    memory-limit "64MiB"

}

// The changelog's shape, and a section for the version Cargo.toml says, so a

// release never finds its notes missing.

job "changelog" {

    sandbox "wasm"

    scope "CHANGELOG.md" "Cargo.toml" ".flow/checks.wasm"

    exec ".flow/checks.wasm" "changelog" "CHANGELOG.md" "Cargo.toml"

}

# Under nextest, as the test job: a test that hangs is stopped at the CI

# profile's limit and reported, not left holding the runner (#365).

exec sh .flow/warm-target.sh cargo nextest run -p oxygenhub --features postgres --locked --profile ci

- **A fresh New repository page (#360):** owner and name side by side with a live check that the name is free and valid and the address it will have; visibility as three described choices; **Start with** a README, a licence (MIT, BSD 2-Clause or ISC, with what each allows) and an `.oxyignore` for a language, committed as you with the hub signing as your delegate (it says what to do first when you have not delegated, before anything is made); and a **project board** with it: a new one (Backlog, Doing, Done, on by default for an organisation) or one of the owner's, which takes the repository's issues and proposals as they open. Storage moves under its own heading. The API's create takes the same (`project: {"new": TITLE} | {"number": N}`, `readme`, `licence`, `ignore`), and `oh repo create OWNER/NAME [--project new:TITLE|N] [--readme] [--licence MIT] [--ignore Rust]`.

- **oxygenhub.io links open the Android app (#370):** `/.well-known/assetlinks.json` vouches for the app (its package and release key's fingerprint, `[push] android_apps` to change), so Android opens the hub's links in it once the app claims them (oxygenhub-android#36).

- **The changelog is checked on the WASM tier:** a `changelog` job in the pipeline runs OxygenFlow's checks module (no image, no KVM; a phone or plex takes it) and fails when the changelog's sections are out of shape or Cargo.toml's version has none.

// The New repository page (oxygenhub#360): the name checked as it is

// typed, the board choices shown as they apply, an owner's own boards.

(function () {

  var form = document.querySelector("[data-new-repo]");

  if (!form) return;

  var owner = form.querySelector("#owner");

  var name = form.querySelector("#name");

  var out = form.querySelector("#name-check");

  var timer = null;

  function check() {

    var n = name.value.trim();

    if (!n) { out.textContent = ""; out.className = "small name-check"; return; }

    fetch("/new/check?owner=" + encodeURIComponent(owner.value) + "&name=" + encodeURIComponent(n), { credentials: "same-origin" })

      .then(function (r) { return r.json(); })

      .then(function (v) {

        out.textContent = v.ok ? v.message + " Its address: " + v.address : v.message;

        out.className = "small name-check " + (v.ok ? "ok-text" : "err-text");

      })

      .catch(function () {});

  }

  function later() { clearTimeout(timer); timer = setTimeout(check, 250); }

  name.addEventListener("input", later);

  var orgs = (owner.getAttribute("data-orgs") || "").split(" ").filter(Boolean);

  var list = form.querySelector("[data-board-list]");

  var title = form.querySelector(".board-title");

  var existing = form.querySelector(".board-existing");

  function boards() {

    var chosen = form.querySelector("input[name=board]:checked");

    var v = chosen ? chosen.value : "";

    if (title) title.hidden = v !== "new";

    if (existing) existing.hidden = v !== "existing";

    if (list) {

      var first = null;

      Array.prototype.forEach.call(list.options, function (o) {

        var mine = o.getAttribute("data-owner") === owner.value;

        o.hidden = !mine; o.disabled = !mine;

        if (mine && !first) first = o;

      });

      if (list.selectedOptions.length && list.selectedOptions[0].disabled && first) first.selected = true;

      var exRadio = form.querySelector("[data-board-existing]");

      if (exRadio) exRadio.parentElement.hidden = !first;

    }

  }

  owner.addEventListener("change", function () {

    // An organisation's repository has a board by default.

    var neu = form.querySelector("[data-board-new]");

    if (neu && orgs.indexOf(owner.value) >= 0) neu.checked = true;

    boards();

    later();

  });

  form.querySelectorAll("input[name=board]").forEach(function (r) { r.addEventListener("change", boards); });

  if (orgs.indexOf(owner.value) >= 0) { var n0 = form.querySelector("[data-board-new]"); if (n0) n0.checked = true; }

  boards();

})();

    /// A project board with it (#360): `{"new": "Title"}` (an empty title

    /// is the repository's name) or `{"number": N}`, the owner's board; its

    /// issues and proposals then join that board as they open.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub project: Option<RepoProject>,

    /// Files it starts with, committed as the caller (#360): a README, a

    /// licence (`MIT`, `BSD-2-Clause`, `ISC`), an `.oxyignore` for a

    /// language (`Rust`, `Node`, `Python`, `Go`, `Java and Kotlin`).

    #[serde(default, skip_serializing_if = "std::ops::Not::not")]

    pub readme: bool,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub licence: Option<String>,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub ignore: Option<String>,

}

/// A new repository's board: a new one, or the owner's existing one.

#[derive(Clone, Debug, Default, PartialEq, Eq, Serialize, Deserialize, JsonSchema)]

pub struct RepoProject {

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub new: Option<String>,

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub number: Option<i64>,

        ("RepoProject", schemars::schema_for!(RepoProject)),

    // Its board and starting files, checked before anything is made (#360).

    use crate::repo_setup::{Board, Start};

    let board = match &body.project {

        None => Board::None,

        Some(p) => match (&p.new, p.number) {

            (Some(t), None) => Board::New(if t.trim().is_empty() { name.name.clone() } else { t.trim().chars().take(100).collect() }),

            (None, Some(n)) => Board::Existing(n),

            _ => return Err(ApiError(StatusCode::BAD_REQUEST, "project is {\"new\": TITLE} or {\"number\": N}".into())),

        },

    };

    crate::repo_setup::check_board(&app, me, &name.owner, &board).await.map_err(|m| ApiError(StatusCode::UNPROCESSABLE_ENTITY, m))?;

    let start =

        Start { readme: body.readme, licence: body.licence.clone().unwrap_or_default(), ignore: body.ignore.clone().unwrap_or_default() };

    let holder = if me.display_name.trim().is_empty() { me.username.clone() } else { me.display_name.clone() };

    let files = start

        .files(&name, &body.description, &holder, time::OffsetDateTime::now_utc().year())

        .map_err(|m| ApiError(StatusCode::BAD_REQUEST, m))?;

    if !files.is_empty() {

        crate::web::edit::signer_for(&app, me.id).await.map_err(|m| ApiError(StatusCode::CONFLICT, m))?;

    }

    crate::repo_setup::link_board(&app, &row, &board, body.visibility == Visibility::Public).await?;

    crate::repo_setup::commit_start(&app, &row, me, files).await.map_err(|m| ApiError(StatusCode::INTERNAL_SERVER_ERROR, m))?;

    /// The Android apps this hub's links open (App Links, #370), each

    /// `PACKAGE:SHA256` with the release key's certificate fingerprint as

    /// colon-separated hex; served at `/.well-known/assetlinks.json`. The

    /// official app by default; empty for none.

    pub android_apps: Vec<String>,

/// The OxygenHub Android app's package and its release key's SHA-256

/// certificate fingerprint (oxygenhub-android CHANGELOG, 0.1.0).

pub const OFFICIAL_ANDROID_APP: &str =

    "io.oxygenhub.android:B0:99:57:36:44:42:AF:B2:27:28:B7:EF:93:F8:23:2D:F1:41:17:DA:50:28:6D:45:93:04:0F:9C:9F:A2:2A:48";

            android_apps: vec![OFFICIAL_ANDROID_APP.into()],

    let row: IssueRow = sqlx::query_as("INSERT INTO issues (repo_id, number, title, body, author_id, author, created_ms, updated_ms) VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING *")

        .await?;

    // Onto the boards the repository is linked to (#360).

    super::projects::opened(pool, row.repo_id, "issue", row.number, &row.author).await?;

    Ok(row)

/// Link a board to a repository (#360): its issues and proposals join

/// the board as they open.

pub async fn link_repo(pool: &Pool, project_id: i64, repo_id: i64) -> sqlx::Result<()> {

    sqlx::query("INSERT INTO project_repos (project_id, repo_id) VALUES ($1, $2) ON CONFLICT DO NOTHING")

        .bind(project_id)

        .bind(repo_id)

        .execute(pool)

        .await?;

    Ok(())

}

/// The boards a repository is linked to.

pub async fn boards_of_repo(pool: &Pool, repo_id: i64) -> sqlx::Result<Vec<i64>> {

    sqlx::query_scalar("SELECT project_id FROM project_repos WHERE repo_id = $1 ORDER BY project_id").bind(repo_id).fetch_all(pool).await

}

/// Issue or proposal `number` of `repo_id` opened (#360): a card for it at

/// the bottom of the first column of each board the repository is linked

/// to; an open board only.

pub async fn opened(pool: &Pool, repo_id: i64, kind: &str, number: i64, by: &str) -> sqlx::Result<()> {

    for project_id in boards_of_repo(pool, repo_id).await? {

        let closed: Option<bool> =

            sqlx::query_scalar("SELECT closed FROM projects WHERE id = $1").bind(project_id).fetch_optional(pool).await?;

        if closed != Some(false) {

            continue;

        }

        if let Some(first) = columns(pool, project_id).await?.first() {

            add_card(

                pool,

                project_id,

                NewCard { column_id: first.id, kind, repo_id: Some(repo_id), number: Some(number), note: "", added_by: by },

            )

            .await?;

        }

    }

    Ok(())

}

    let row: ProposalRow = sqlx::query_as(

    .await?;

    // Onto the boards the repository is linked to (#360).

    super::projects::opened(pool, row.repo_id, "proposal", row.number, &row.author).await?;

    Ok(row)

pub mod repo_setup;

/// `/.well-known/assetlinks.json` (#370): the Android apps whose App Links

/// this hub vouches for, so its links open them rather than the browser.

pub async fn assetlinks(State(app): State<Shared>) -> Response {

    let apps: Vec<serde_json::Value> = app

        .config

        .push

        .android_apps

        .iter()

        .filter_map(|a| {

            let (package, fp) = a.split_once(':')?;

            Some(serde_json::json!({

                "relation": ["delegate_permission/common.handle_all_urls"],

                "target": { "namespace": "android_app", "package_name": package, "sha256_cert_fingerprints": [fp.to_ascii_uppercase()] }

            }))

        })

        .collect();

    ([(header::CONTENT_TYPE, "application/json")], serde_json::Value::Array(apps).to_string()).into_response()

}

        .route("/.well-known/assetlinks.json", get(home::assetlinks))

        .route("/new/check", get(repo_settings::check_name))

    /// The open boards of each owner the viewer may change, for "add it to

    /// an existing board" (#360): (owner, number, title).

    boards: Vec<(String, i64, String)>,

    /// Owners that are organisations: a board is on by default for them.

    orgs: Vec<String>,

    licences: &'static [(&'static str, &'static str)],

    ignores: &'static [&'static str],

    base_url: String,

/// The New repository page's choices for `me` (#360).

async fn new_page(app: &Shared, shell: Shell, me: &accounts::Account, error: Option<String>) -> NewRepoPage {

    let owners = owners_for(app, me).await;

    let mut boards = Vec::new();

    let mut orgs = Vec::new();

    for o in &owners {

        if accounts::org_by_name(&app.db, o).await.ok().flatten().is_some() {

            orgs.push(o.clone());

        }

        let may = crate::web::projects::rights_of(app, Some(me), o).await.ok().flatten().is_some_and(|r| r.edit);

        if may {

            for p in db::projects::of_owner(&app.db, o).await.unwrap_or_default().into_iter().filter(|p| !p.closed) {

                boards.push((o.clone(), p.number, p.title));

            }

        }

    }

    NewRepoPage {

        shell,

        owners,

        error,

        boards,

        orgs,

        licences: crate::repo_setup::LICENCES,

        ignores: crate::repo_setup::IGNORES,

        base_url: app.config.base_url().trim_end_matches('/').to_string(),

    }

}

    Ok(Page(new_page(&app, shell, &me.account, None).await))

}

#[derive(Deserialize)]

pub struct NameCheck {

    #[serde(default)]

    owner: String,

    #[serde(default)]

    name: String,

}

/// `GET /new/check?owner=&name=` (#360): the page's live check that a name

/// is free and valid, answering `{"ok", "message", "address"}`.

pub async fn check_name(State(app): State<Shared>, viewer: Viewer, Query(q): Query<NameCheck>) -> Response {

    let Some(me) = viewer.account() else {

        return (axum::http::StatusCode::UNAUTHORIZED, axum::Json(serde_json::json!({"ok": false, "message": "Sign in first."})))

            .into_response();

    };

    if q.name.trim().is_empty() {

        return axum::Json(serde_json::json!({"ok": false, "message": ""})).into_response();

    }

    match crate::repo_setup::check_name(&app, me, &q.owner, &q.name).await {

        Ok(n) => axum::Json(serde_json::json!({

            "ok": true,

            "message": format!("{n} is free."),

            "address": format!("{}{}", app.config.base_url().trim_end_matches('/'), n.url()),

        }))

        .into_response(),

        Err(m) => axum::Json(serde_json::json!({"ok": false, "message": m})).into_response(),

    }

    /// What it starts with (#360): a README, a licence, an `.oxyignore`.

    #[serde(default)]

    readme: Option<String>,

    #[serde(default)]

    licence: String,

    #[serde(default)]

    ignore: String,

    /// A board with it: `new` (titled `board_title`), a board number, or none.

    #[serde(default)]

    board: String,

    #[serde(default)]

    board_title: String,

    /// The existing board's number, with `board=existing`.

    #[serde(default)]

    board_n: String,

    let page = new_page(&app, shell.clone(), &me.account, None).await;

    let fail = |msg: &str| Page(NewRepoPage { error: Some(msg.into()), ..clone_page(&page) }).into_response();

    let name = match crate::repo_setup::check_name(&app, &me.account, &f.owner, &f.name).await {

        Ok(n) => n,

        Err(m) => return Ok(fail(&m)),

    };

    let Some(visibility) = Visibility::parse(&f.visibility) else { return Ok(fail("Visibility is public, internal or private.")) };

    // Its board and its starting files are checked before anything is made (#360).

    let choice = if f.board == "existing" { f.board_n.as_str() } else { f.board.as_str() };

    let board = match crate::repo_setup::Board::parse(choice, &f.board_title, &name.name) {

        Ok(b) => b,

        Err(m) => return Ok(fail(&m)),

    if let Err(m) = crate::repo_setup::check_board(&app, &me.account, &name.owner, &board).await {

        return Ok(fail(&m));

    let start =

        crate::repo_setup::Start { readme: f.readme.is_some(), licence: f.licence.trim().to_string(), ignore: f.ignore.trim().to_string() };

    let year = time::OffsetDateTime::now_utc().year();

    let holder = if me.account.display_name.trim().is_empty() { me.account.username.clone() } else { me.account.display_name.clone() };

    let files = match start.files(&name, &f.description, &holder, year) {

        Ok(files) => files,

        Err(m) => return Ok(fail(&m)),

    };

    if !files.is_empty() && f.storage == "bucket" {

        return Ok(fail("A repository kept in your own bucket starts empty: push its first files to it."));

    if !files.is_empty() {

        if let Err(m) = crate::web::edit::signer_for(&app, me.account.id).await {

            return Ok(fail(&format!("The hub cannot write the starting files for you yet. {m}")));

        }

        crate::repo_setup::link_board(&app, &row, &board, visibility == Visibility::Public)

            .await

            .map_err(|e| Error::from_db(shell.clone(), e))?;

    let row = db::repos::create(&app.db, &name.owner, &name.name, f.description.trim(), visibility)

    crate::repo_setup::link_board(&app, &row, &board, visibility == Visibility::Public)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    if let Err(e) = crate::repo_setup::commit_start(&app, &row, &me.account, files).await {

        tracing::warn!("starting files for {name}: {e}");

    }

}

fn clone_page(p: &NewRepoPage) -> NewRepoPage {

    NewRepoPage {

        shell: p.shell.clone(),

        owners: p.owners.clone(),

        error: p.error.clone(),

        boards: p.boards.clone(),

        orgs: p.orgs.clone(),

        licences: p.licences,

        ignores: p.ignores,

        base_url: p.base_url.clone(),

    }

    // A repository made with a board (#360): a new one, or an existing one;

    // its issues join the board as they open. Checked before anything is made.

    let boards = |v: &serde_json::Value| v.as_array().unwrap().len();

    let before = boards(&api(app, "GET", "/api/v1/projects/andy", Some(&a), None).await.1);

    let (st, v) = api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"demo","project":{"new":"Never"}}"#)).await;

    assert_eq!(st, StatusCode::CONFLICT, "a name taken: {v}");

    let (st, v) = api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"fresh","readme":true}"#)).await;

    assert_eq!(st, StatusCode::CONFLICT, "starting files need the hub as the caller's delegate: {v}");

    assert!(v["detail"].as_str().unwrap_or("").contains("delegated"), "{v}");

    assert_eq!(api(app, "GET", "/api/v1/repos/andy/fresh", Some(&a), None).await.0, StatusCode::NOT_FOUND, "nothing made");

    assert_eq!(boards(&api(app, "GET", "/api/v1/projects/andy", Some(&a), None).await.1), before, "no board made");

    let (st, v) =

        api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"boarded","project":{"new":"Boarded work"}}"#)).await;

    assert_eq!(st, StatusCode::CREATED, "{v}");

    let all = api(app, "GET", "/api/v1/projects/andy", Some(&a), None).await.1;

    let made = all.as_array().unwrap().iter().find(|p| p["title"] == "Boarded work").expect("the new board").clone();

    let n = made["number"].as_i64().unwrap();

    api(app, "POST", "/api/v1/repos/andy/boarded/issues", Some(&a), Some(r#"{"title":"First"}"#)).await;

    let (_, b) = api(app, "GET", &format!("/api/v1/projects/andy/{n}"), Some(&a), None).await;

    assert_eq!(b["columns"][0]["cards"][0]["reference"], "andy/boarded#1", "{b}");

    assert_eq!(b["columns"][2]["name"], "Done");

    let (st, v) =

        api(app, "POST", "/api/v1/repos", Some(&a), Some(&format!(r#"{{"owner":"andy","name":"joined","project":{{"number":{n}}}}}"#)))

            .await;

    assert_eq!(st, StatusCode::CREATED, "{v}");

    api(app, "POST", "/api/v1/repos/andy/joined/issues", Some(&a), Some(r#"{"title":"Second"}"#)).await;

    let (_, b) = api(app, "GET", &format!("/api/v1/projects/andy/{n}"), Some(&a), None).await;

    let refs: Vec<&str> = b["columns"][0]["cards"].as_array().unwrap().iter().map(|c| c["reference"].as_str().unwrap()).collect();

    assert_eq!(refs, ["andy/boarded#1", "andy/joined#1"]);

    let (st, _) = api(app, "POST", "/api/v1/repos", Some(&a), Some(r#"{"owner":"andy","name":"nowhere","project":{"number":99}}"#)).await;

    assert_eq!(st, StatusCode::UNPROCESSABLE_ENTITY, "no such board");

    assert_eq!(api(app, "GET", "/api/v1/repos/andy/nowhere", Some(&a), None).await.0, StatusCode::NOT_FOUND);

    // The New repository page (#360): its choices, and the live name check.

    assert!(page.body.contains("data-new-repo") && page.body.contains(">MIT: ") && page.body.contains("A new board"), "{}", page.body);

    let check = |q: &'static str| {

        let (app, andy) = (app.clone(), andy.clone());

        async move { serde_json::from_str::<serde_json::Value>(&call(&app, "GET", q, None, Some(&andy), None, None).await.body).unwrap() }

    };

    let v = check("/new/check?owner=andy&name=demo").await;

    assert_eq!((v["ok"].as_bool(), v["message"].as_str()), (Some(true), Some("andy/demo is free.")), "{v}");

    assert!(v["address"].as_str().unwrap().ends_with("/andy/demo"));

    assert_eq!(check("/new/check?owner=andy&name=bad%20name").await["ok"], false);

    let made = call(

        app,

        "POST",

        "/new",

        None,

        Some(&andy),

        None,

        Some(&format!("_csrf={}&owner=andy&name=demo&board=new&board_title=Demo+work", csrf_of(&page.body))),

    )

    .await;

    assert_eq!(made.location.as_deref(), Some("/andy/demo"), "{}", made.body);

    assert_eq!(check("/new/check?owner=andy&name=demo").await["message"], "andy/demo exists.");

    let board = oxygenhub::db::projects::of_owner(&app.db, "andy").await.unwrap();

    assert_eq!(board.iter().map(|p| p.title.as_str()).collect::<Vec<_>>(), ["Demo work"]);

    let again =

        call(app, "POST", "/new", None, Some(&andy), None, Some(&format!("_csrf={}&owner=andy&name=other&readme=1", csrf_of(&page.body))))

            .await;

    assert!(again.body.contains("cannot write the starting files for you yet"), "no delegate: refused, nothing made");

    assert!(oxygenhub::db::repos::get(&app.db, "andy", "other").await.unwrap().is_none());

}

/// oxygenhub#370: the hub vouches for the Android app's App Links, so its

/// links open the app; the official app by default.

#[tokio::test(flavor = "multi_thread")]

async fn assetlinks_name_the_android_app() {

    let h = hub().await;

    let r = call(&h.app, "GET", "/.well-known/assetlinks.json", None, None, None, None).await;

    assert_eq!(r.status, StatusCode::OK);

    let v: serde_json::Value = serde_json::from_str(&r.body).unwrap();

    assert_eq!(v[0]["relation"][0], "delegate_permission/common.handle_all_urls");

    assert_eq!(v[0]["target"]["package_name"], "io.oxygenhub.android");

    let fp = v[0]["target"]["sha256_cert_fingerprints"][0].as_str().unwrap();

    assert!(fp.starts_with("B0:99:57:") && fp.ends_with(":2A:48") && fp.len() == 95, "{fp}");

/// A test that fails after two minutes instead of holding a runner for an

/// hour (oxygenhub#365), where it hangs waiting on the hub; a hang inside

/// a blocking call is stopped by nextest's limit in CI instead. The tests

/// run on four worker threads: the client's pushes block the thread they

/// run on, and with the hub served from the same runtime, a small runner's

/// few threads could leave none to answer them.

async fn bounded(test: impl std::future::Future<Output = ()>) {

    if tokio::time::timeout(Duration::from_secs(120), test).await.is_err() {

        panic!("the test did not finish in two minutes");

    }

}

#[tokio::test(flavor = "multi_thread", worker_threads = 4)]

    bounded(a_secret_in_history_is_found_and_judged_body()).await

}

async fn a_secret_in_history_is_found_and_judged_body() {

#[tokio::test(flavor = "multi_thread", worker_threads = 4)]

    bounded(the_scan_resumes_where_its_budget_stopped_body()).await

}

async fn the_scan_resumes_where_its_budget_stopped_body() {

#[tokio::test(flavor = "multi_thread", worker_threads = 4)]

    bounded(the_worker_scans_on_start_and_after_a_push_body()).await

}

async fn the_worker_scans_on_start_and_after_a_push_body() {

    /// Create a repository on the hub (#360): OWNER/NAME, with a board and

    /// starting files if asked

    Create {

        /// OWNER/NAME

        slug: String,

        #[arg(long, short)]

        description: Option<String>,

        /// public (the default), internal or private

        #[arg(long, default_value = "public")]

        visibility: String,

        /// A project board with it: `new`, `new:TITLE`, or an existing board's number

        #[arg(long, short)]

        project: Option<String>,

        /// Start it with a README

        #[arg(long)]

        readme: bool,

        /// Start it with a licence: MIT, BSD-2-Clause or ISC

        #[arg(long)]

        licence: Option<String>,

        /// Start it with an .oxyignore for a language: Rust, Node, Python, Go, "Java and Kotlin"

        #[arg(long)]

        ignore: Option<String>,

    },

            Ok(0)

        }

        Cmd::Repo { cmd: RepoCmd::Create { slug, description, visibility, project, readme, licence, ignore } } => {

            let (owner, name) = slug.split_once('/').context("give the repository as OWNER/NAME")?;

            let project = match project.as_deref() {

                None => None,

                Some("new") => Some(serde_json::json!({ "new": "" })),

                Some(p) if p.starts_with("new:") => Some(serde_json::json!({ "new": &p[4..] })),

                Some(n) => {

                    Some(serde_json::json!({ "number": n.parse::<i64>().context("--project is new, new:TITLE or a board number")? }))

                }

            };

            let mut body = serde_json::json!({

                "owner": owner, "name": name, "description": description.unwrap_or_default(), "visibility": visibility, "readme": readme,

            });

            if let Some(p) = project {

                body["project"] = p;

            }

            if let Some(l) = licence {

                body["licence"] = serde_json::json!(l);

            }

            if let Some(i) = ignore {

                body["ignore"] = serde_json::json!(i);

            }

            let r: serde_json::Value = c.send("POST", "/repos", &body)?;

            if json {

                println!("{r}");

            } else {

                println!("{} created {owner}/{name} {}", ui::ok("✔"), ui::dim(r["url"].as_str().unwrap_or("")));

                println!("{}", ui::kv("clone", &format!("oxy clone {}/{owner}/{name}", t.hub)));

            }

The hub has one identity of its own, the **hub delegate key**, generated at `init` and published at `/.well-known/oxyhub-key`. `/.well-known/assetlinks.json` names the Android apps whose App Links the hub vouches for (`[push] android_apps`, `PACKAGE:SHA256`; the official app by default, #370), so the hub's links open them. It is used only to sign changes the hub itself creates on behalf of a signed-in user (web edits, §6.9; proposal landings, §7.6). Such a change carries the user's linked key as `author` and the hub key as signer, which the author-or-delegate rule (spec §14.4) accepts only when the user's identity object lists the hub key as a delegate with the `changes` and `refs` scopes (Oxygen spec §14.2; the hub signs the change and attests the reference), still in force: the user opts in once with `oxy identity delegate add <hub key> --scope changes,refs` and re-links the rotated identity (§5.3). Policy is then checked exactly as for the user's own signature, since a rule that names the author covers the author's delegates (spec §14.5). If the user has not delegated, or the policy does not authorise them for the reference, the hub refuses the action and shows the client recipe. Delegation is per user and revocable by the user alone (`oxy identity delegate remove`); the hub never needs a policy entry of its own.

JSON under `/api/v1`, bearer tokens, `application/json`, RFC 7807 problem responses (an unknown route, or a known one with the wrong method, too), cursor pagination (`?after=`), ETags on cacheable resources, and rate limits per token. Resources mirror the pages: `POST /repos` (repo:admin: `{"owner", "name", "description", "visibility"}`, and with #360 `project` (`{"new": TITLE}` or `{"number": N}`: a board made or chosen with it, which then takes its issues and proposals as they open, `project_repos`) and `readme`, `licence` (`MIT`, `BSD-2-Clause`, `ISC`) and `ignore` (an `.oxyignore` for `Rust`, `Node`, `Python`, `Go`, `Java and Kotlin`), committed as the caller with the hub signing as their delegate; the board and the delegate are checked before anything is made; `oh repo create OWNER/NAME --project new:TITLE --readme`), `/repos/{owner}/{name}`, `/bookmarks`, `/changes/{hash}`, `/tree/{ref}/{path}`, `/file/{ref}/{path}`, `/blame`, `/history/{ref}` (`?path=`, `?offset=&limit=`, or `?r=REVSET` for the changes a revset selects, evaluated under a two-second budget and answering 400 when it does not parse or goes past it; Oxygen's docs/revset_query_language.md), `/compare`, `/conflicts`, `/proposals` (`?state=open|draft|landed|closed|all`, open ones and drafts by default; a source bookmark may hold `/`, and `owner/name:bookmark` naming the repository itself is its own bookmark), `/proposals/{n}/comments|reviews|checks|files`, `PATCH /proposals/{n}` (the title and description, for its author or a maintainer, and `labels`, the whole set by name, for triage; what is not given stays), `POST /proposals/{n}/land` (repo:write: what the Land button does, `409` with the blockers when it cannot; a landed proposal keeps the changes it landed and reports `landed` with who, how (`web`, or `api (token NAME)`) and when, which its event, the audit log and the push record also say, adding when nobody approved), `/proposals/{n}/content/{base|head}/{path}` (a changed file's bytes in the target's state or the projected state, for editor diff views), `/issues` (creating an issue can set its labels, assignees and milestone; `PATCH /issues/{n}` edits the title and body for the author or triage, and replaces labels, assignees or the milestone for triage, recording each on the timeline; unknown names are refused before anything changes), `/labels` (`POST` creates or changes one, `DELETE /labels/{name}` removes it; triage), `/milestones` (`POST` creates one or changes the description and due date of the one with that title, `PATCH /milestones/{title}` changes title, description, due date or state; triage), `/releases` (`PATCH /releases/{tag}` changes the title, notes or prerelease flag, repo:write), `/tags` (`POST` creates one, repo:write; `DELETE /tags/{tag}` withdraws one, a maintainer, `409` while a release uses it; §9), `/trust`, `/pushes`, `/hooks`, `/checks`, `/user`, `/user/repos` (the caller's own, organisations' and collaborations, `?affiliation=&after=&limit=`, #302), `/user/orgs`, `/user/sky` (Your sky's data, the dashboard backdrop's: the caller's repositories and their events of the last 30 days as `[repo, kind, at_ms, n]`, for the Android app; oxygenhub-android#23; `/repos/{owner}/{name}/sky` gives one repository's, its pages' backdrop), `/user/issues` (the open issues assigned to the caller, in repositories it can see, newest-updated first, each with its repository and address; #359), `/user/flow/runs` (the newest Flow runs of the caller's repositories, each with its repository and jobs, `?before=MS&limit=`; oxygenhub-android#26), `/user/starter?owner=X` and `/repos/{owner}/{name}/starter` (#347: the assistants a new repository under X may ask, and, `POST {"description", "assistant"}` by its admin, an assistant's draft of an empty repository's starting files, committed in the background as the caller, the hub signing as their delegate; `GET` says `running`, `done` with the change and files, or `failed` with why), `/notifications` (the caller's inbox and unread count, each with its repository, reason, thread and label, #305; `/notifications/{id}/read` and `/notifications/read` mark read; scope `user:read`), `/users/{name}`, `/users/{name}/drops` and `/drops` (§4.5), `/orgs/{name}`, `/checks/{state}` (the checks on a state, named by its hash, by its heads joined with `+`, by the one head of a single-head state, or by a bookmark), `/checks/required` (`GET`, and `PUT` of the whole list by a repository admin: the checks a proposal needs, passed, to land), `/projects/{owner}` (list, create) and `/projects/{owner}/{n}` (the board as the caller may see it, with its saved `views` and each column's `wip_limit`; `?q=` applies a filter as the board's filter bar reads it (words, `repo:`, `assignee:`, `label:`, `milestone:`, `state:`, `is:open|closed`, `age:>Nd|<Nd`) and `?view=NAME` a saved view's, #361, `/charts` its cumulative flow, cycle time, weekly throughput, the open iteration's burn-down and Monte Carlo forecasts of when its open cards, each milestone's and `?q=`'s are done, at 50% and 85%, from its card moves, #357, `PATCH` for title, description, privacy and closing, and `owner` to transfer it to an owner the caller may make boards under (#125: it takes the next number there, and its old address redirects), `/cards` to list them by column or add a reference or note to a column named by id or name, `/cards/{id}` to move or remove one, `POST /columns` (`{"name"}`, at the right), `PATCH /columns/{column}` (by id or name: `{"name", "position"}`, 0 the leftmost) and `DELETE /columns/{column}` (its cards to the first remaining column; a board keeps one) for its columns, each answering the board (#366), `POST /cards/move` (#289: `{"from", "column", "except", "state", "dry_run"}`) to move a column's cards at once, but those `except` names (card ids or issue and proposal references) and, given `state`, only those whose issue or proposal is in one, all or none and audited once, answering what moved and what was kept; `POST /cards/archive` (#293: `{"from", "older_days", "except", "state", "dry_run"}`, the same selection and an age) to archive them, `GET /cards?archived=true` to list the archived ones (each with `archived_ms`) and `POST /cards/{id}/restore` to put one back; cards carry their `labels` and `assignees`; `repo:write` and the page's rights to change), `/coverage` and `/tests` (a bookmark's coverage and JUnit test reports from Flow jobs, newest first, `?bookmark=&limit=`), `POST /coverage` (repo:write, #136: `{"bookmark"}` or `{"change"}` and `content`, an LCOV, Cobertura or JaCoCo report measured off the hub, kept for that state as uploaded by the caller, shown "uploaded by NAME" wherever a run number would be, and setting no check; `oh coverage upload FILE`), `/coverage/{id}` (a report with its files) and `/tests/{id}` (a report with its cases, `?status=failed` for the failed and errored ones), `/flow/runs` (`GET`: runs newest first, `?before=N&limit=`; `POST {"bookmark"}` or `{"change"}`, repo:write: run a bookmark's current state, the default bookmark when none is named, or one change's state; with `"jobs": [NAME..]` only those jobs and what they depend on, each one a manual run starts, else `409` naming the ones it does (#130); `oh run start --job NAME`), `/flow/runs/{n}` (a run with its jobs, each with its timings: `queued_ms`, `ready_ms`, the `phases` its runner reported (image, prepare, run, finish, in milliseconds) and its peak disk and memory; #348, `oh run view N --timings`), `/flow/runs/{n}/jobs/{job}/log` (`?after=seq&limit=`), `/flow/runs/{n}/jobs/{job}/reports` and `/flow/runs/{n}/jobs/{job}/report` (`?name=`; with its files, and `…/report/{path}` one file as published, sandboxed) and `/reports` (`?bookmark=`: the newest run of each) and `/reports/{name}` (`?id=` or `?bookmark=`; `…/files/{path}`): the reports Flow jobs publish (#348, docs/reports.md §6; `oh run report N JOB`, `oh report`) and `/flow/runs/{n}/rerun` (repo:write: a finished run again), both answering `201 {"number", "url"}` or `409` with why nothing started, `/flow/runs/{n}/jobs/{job}/rerun` (repo:write, oxygenflow#31: that job of a finished run again, in the same run, with the jobs that depend on it; what it depends on keeps its result, so a flaky test reruns without its build; their logs, artifacts and reports go, their checks return to queued and the run is running again; `{"queued": N}`, or `409` while the run is live or for a job it lacks; RE-RUN THIS JOB on the run page, `oh run rerun N --job NAME`), `/flow/runs/{n}/cancel` (repo:write: a run still going ends as `cancelled`, its running jobs stopped when their runner next reports; `409` when it had already ended; a push to a bookmark cancels the push runs of it still going: the queued ones, and those running too unless the repository keeps them or they are the default bookmark's, which always finish (#369)), `/search`. A change's author carries the account its key is linked to, or `null` and a `note` saying the key is not linked and where its owner links it; `via` names the delegate (an agent) that signed for the author when one did, with the delegation's scope and expiry and whether it has since been revoked, and the pages show the same as an `agent` badge, a `via` row under the author on the change page, and a count under the author in Contributors (the change page shows a "key not linked" tag, with a link to Settings → Keys for signed-in viewers). Shapes reuse `oxy --json` shapes wherever one exists (change, status, blame, diff) so tools written against the CLI work against the hub. `crates/hub-api` holds the types with `serde` derives and is what the runner and the VS Code extension will link.

<div class="head"><h1>New repository</h1></div>

<form class="card new-repo" method="post" action="/new" data-new-repo>

  <div class="row name-row">

    <div><label for="owner">Owner</label><select id="owner" name="owner" data-orgs="{% for o in orgs %}{{ o }} {% endfor %}">{% for o in owners %}<option value="{{ o }}">{{ o }}</option>{% endfor %}</select></div>

    <div class="slash" aria-hidden="true">/</div>

    <div class="grow"><label for="name">Name</label><input type="text" id="name" name="name" required pattern="[A-Za-z0-9][A-Za-z0-9._-]{0,63}" autocomplete="off" aria-describedby="name-check" autofocus></div>

  <p id="name-check" class="small name-check" role="status" aria-live="polite" data-base="{{ base_url }}"></p>

  <label for="description">Description <span class="small mute">(optional)</span></label><input type="text" id="description" name="description">

  <fieldset class="choices">

    <legend>Visibility</legend>

    <label class="choice-card"><input type="radio" name="visibility" value="public" checked><span><strong>Public</strong><span class="small mute">Anyone can see and clone it. You choose who may push.</span></span></label>

    <label class="choice-card"><input type="radio" name="visibility" value="internal"><span><strong>Internal</strong><span class="small mute">Anyone signed in to this hub can see it.</span></span></label>

    <label class="choice-card"><input type="radio" name="visibility" value="private"><span><strong>Private</strong><span class="small mute">Only you{% if !orgs.is_empty() %}, the organisation's members{% endif %} and the people you add.</span></span></label>

  </fieldset>

  <fieldset class="choices">

    <legend>Start with <span class="small mute">(optional; left empty, it starts empty and takes its first push)</span></legend>

    <label class="check"><input type="checkbox" name="readme" value="1"> a README with its name and description</label>

    <div class="row">

      <div><label for="licence">Licence</label><select id="licence" name="licence"><option value="">none</option>{% for (id, what) in licences %}<option value="{{ id }}">{{ id }}: {{ what }}</option>{% endfor %}</select></div>

      <div><label for="ignore">.oxyignore</label><select id="ignore" name="ignore"><option value="">none</option>{% for l in ignores %}<option>{{ l }}</option>{% endfor %}</select></div>

    </div>

    <p class="small mute">The hub commits these as you, signed with its key as your delegate, as it does for edits on the site.</p>

  </fieldset>

  <fieldset class="choices">

    <legend>Project board</legend>

    <label class="choice-card"><input type="radio" name="board" value="" checked data-board-none><span><strong>No board</strong><span class="small mute">Add its issues to a board later.</span></span></label>

    <label class="choice-card"><input type="radio" name="board" value="new" data-board-new><span><strong>A new board</strong><span class="small mute">Backlog, Doing and Done, with finished work moving to Done. Its issues and proposals join the board as they open.</span></span></label>

    <div class="board-title"><label for="board_title">Board title</label><input type="text" id="board_title" name="board_title" maxlength="100" placeholder="the repository's name"></div>

    {% if !boards.is_empty() %}<label class="choice-card"><input type="radio" name="board" value="existing" data-board-existing><span><strong>An existing board</strong><span class="small mute">Its issues and proposals join it as they open.</span></span></label>

    <div class="board-existing"><label for="board_n">Board</label><select id="board_n" name="board_n" data-board-list>{% for (o, n, t) in boards %}<option value="{{ n }}" data-owner="{{ o }}">{{ o }} #{{ n }}: {{ t }}</option>{% endfor %}</select></div>{% endif %}

  </fieldset>

  <details class="storage"><summary>Storage <span class="small mute">(this server's disk, unless you keep it in your own bucket)</span></summary>

  </details>

  <button type="submit">CREATE REPOSITORY</button>

/* The New repository page (#360). */

.new-repo .name-row { display: flex; align-items: flex-end; gap: 8px; }

.new-repo .name-row .grow { flex: 1; min-width: 0; }

.new-repo .name-row .slash { font-size: 20px; color: var(--mute); padding-bottom: 6px; }

.new-repo .name-check { min-height: 1.4em; margin: 4px 0 8px; }

.ok-text { color: var(--ok); }

.err-text { color: var(--bad); }

.new-repo fieldset.choices { border: 1px solid var(--line); padding: 10px 12px; margin: 12px 0; display: grid; gap: 8px; }

.new-repo fieldset.choices legend { padding: 0 4px; font-weight: 600; }

.choice-card { display: flex; gap: 10px; align-items: flex-start; padding: 8px 10px; border: 1px solid var(--line); background: var(--soft); cursor: pointer; }

.choice-card > span { display: grid; gap: 2px; }

.choice-card:has(input:checked) { border-color: var(--acc); }

.new-repo .board-title, .new-repo .board-existing { margin-left: 28px; }

.new-repo details.storage { margin: 12px 0; }