@vercel/board 0.0.0-stage → 0.15.0

package/dist/exports-CyY3_FjZ.mjs

@@ -0,0 +1,1285 @@
+import { t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import "./schemas-Be08nyfW.mjs";
+import { A as SyncBody, B as UploadStartBody, C as Ref, D as SignInQuery, E as SchedulesQuery, F as SyncReceiptBody, I as SyncRootsQuery, L as SyncUnlinkBody, M as SyncCopiesQuery, N as SyncFindQuery, O as SourceReadQuery, P as SyncImportBody, R as ThreadsQuery, S as ReactBody, T as ScheduleBody, _ as InboxQuery, b as MessagesQuery, d as EditBody, f as EventsQuery, g as InboxPushBody, h as InboxNextQuery, j as SyncCodeBody, k as SyncAccountBody, m as InboxAckBody, o as derivedId, p as IdentityUnlinkBody, u as AckBody, v as LabelBody, w as RegisterBody, x as PostBody, y as MatchesQuery, z as TypingBody } from "./watch-spec-W0c7ypHJ.mjs";
+import { n as createBoardClient, t as BoardError } from "./client-DGDPaN7U.mjs";
+import { a as queryObject, c as VERSION, i as openapi, l as SYNC, n as METHODS, o as readCapped, r as createRouter, s as readJson } from "./watchers-hash-D9hbHLKB.mjs";
+import { a as forbidden, c as toErrorResponse, l as unauthorized, n as RejectedError, o as json, r as badRequest, s as notFound, t as HttpError } from "./errors-DX3hpwWt.mjs";
+import { i as resolveActor, r as claimsOf, t as KNOWN_AGENTS } from "./actors-rdN4dDTU.mjs";
+import { d as issuersOf, g as verifiesTokens, l as hostPrincipal, o as createAuthority, s as fromTokens } from "./auth-COzc09sn.mjs";
+import { i as DroppedError, n as syncTarget, o as runMiddleware, r as withEmailMentions, t as mentionsEmails } from "./targets-ojFEXEyN.mjs";
+//#region src/server/policy.ts
+/**
+* The policy a board's options say: verifying requests, and `access` over them and over the
+* principals its backend stores. `keeps`: the backend keeps the board, so the defaults let its
+* people and own deployments in when `access` is left out.
+*/
+function createPolicy(options, keeps, serving) {
+	/** Whether requests are served at all: a board on `http()` serves none without an `access` of its own. */
+	const open = keeps || options.access !== void 0;
+	const access = options.access ?? [];
+	/** The board's own Vercel project and team, from `project` or the environment, asked once. */
+	let own = null;
+	const project = () => (own ??= (async () => {
+		if (!serving) return {
+			id: options.project?.id ?? null,
+			teamId: options.project?.teamId ?? null
+		};
+		const found = await serving();
+		const [id, teamId] = await Promise.all([found.ownProjectId(options.project), found.ownTeamId(options.project)]);
+		return {
+			id,
+			teamId
+		};
+	})()).catch((error) => {
+		own = null;
+		throw error;
+	});
+	/** What discovery says the board's project is, as a request shows it: clients mint tokens with it. */
+	async function discoveryIdentity(headers) {
+		if (!serving) return {
+			projectId: options.project?.id ?? null,
+			teamId: options.project?.teamId ?? null
+		};
+		return (await serving()).discoveryIdentity(headers, options.project);
+	}
+	let tokens = null;
+	/** The verifier: `authenticate`, or `oidcTokens()` where this build has it. */
+	const verifier = () => options.authenticate ? Promise.resolve(options.authenticate) : tokens ??= serving ? serving().then((found) => found.oidcTokens()) : Promise.reject(new HttpError(501, "no_verifier", "this build of board verifies no tokens: pass board({ authenticate })"));
+	const authority = createAuthority({
+		access,
+		project,
+		hosts: options.authenticate !== void 0 && !verifiesTokens(options.authenticate)
+	});
+	const context = {
+		project,
+		issuers: typeof access === "function" ? [] : issuersOf(access)
+	};
+	/** Verified principals by credential, until they expire, so a stream's polls don't verify from scratch. */
+	const verified = /* @__PURE__ */ new Map();
+	/** And by request, for one with no credential (a session cookie), for as long as it's served. */
+	const perRequest = /* @__PURE__ */ new WeakMap();
+	/** Who a request's credential is: a 401 or the host's own rejection when it's no one. */
+	async function principalOf(request) {
+		const live = (principal) => principal.expiresAt === null || principal.expiresAt.getTime() > Date.now();
+		const known = perRequest.get(request);
+		if (known) {
+			const principal = await known;
+			if (live(principal)) return principal;
+		}
+		const key = request.credential === null ? null : [
+			request.audience,
+			request.credential,
+			request.headers.get("x-vercel-oidc-token") ?? ""
+		].join("");
+		const cached = key === null ? void 0 : verified.get(key);
+		if (cached && cached.until > Date.now()) {
+			perRequest.set(request, cached.principal);
+			return cached.principal;
+		}
+		const principal = verify(request);
+		perRequest.set(request, principal);
+		if (key !== null) principal.then((found) => {
+			if (found.facts?.issuer === "host" || found.expiresAt === null) return;
+			if (verified.size >= 1e3) verified.delete(verified.keys().next().value);
+			verified.set(key, {
+				principal,
+				until: found.expiresAt.getTime()
+			});
+		}, () => perRequest.delete(request));
+		return principal;
+	}
+	async function verify(request) {
+		const authenticate = await verifier();
+		let result;
+		try {
+			result = await authenticate({
+				...request,
+				board: context
+			});
+		} catch (error) {
+			if (error instanceof Response) throw new RejectedError(error);
+			throw error;
+		}
+		if (result instanceof Response) throw new RejectedError(result);
+		if (result === null || result === void 0) throw unauthorized("missing bearer token");
+		return fromTokens(result) ? result : hostPrincipal(result);
+	}
+	return {
+		open,
+		project,
+		discoveryIdentity,
+		/**
+		* Who a request is, and what it may do now: verified, under the rules, with the profile it
+		* claims. Each call works its access out again; its principal is verified once per credential
+		* until it expires.
+		*/
+		async identify(request) {
+			const found = await principalOf(request);
+			const principal = request.claims.scope === null ? found : {
+				...found,
+				scope: request.claims.scope
+			};
+			const { author, actor } = resolveActor(principal, request.claims, request.audience);
+			return {
+				principal: {
+					...principal,
+					access: await authority.grant(principal)
+				},
+				author,
+				actor
+			};
+		},
+		/** What a stored principal (a schedule's creator, a watcher's registrant) may do now: null once nothing. */
+		accessNow: (principal) => authority.accessNow(principal)
+	};
+}
+//#endregion
+//#region src/contract/logos.ts
+const LOGOS = {
+	claude: "m4.7144 15.9555 4.7174-2.6471.079-.2307-.079-.1275h-.2307l-.7893-.0486-2.6956-.0729-2.3375-.0971-2.2646-.1214-.5707-.1215-.5343-.7042.0546-.3522.4797-.3218.686.0608 1.5179.1032 2.2767.1578 1.6514.0972 2.4468.255h.3886l.0546-.1579-.1336-.0971-.1032-.0972L6.973 9.8356l-2.55-1.6879-1.3356-.9714-.7225-.4918-.3643-.4614-.1578-1.0078.6557-.7225.8803.0607.2246.0607.8925.686 1.9064 1.4754 2.4893 1.8336.3643.3035.1457-.1032.0182-.0728-.164-.2733-1.3539-2.4467-1.445-2.4893-.6435-1.032-.17-.6194c-.0607-.255-.1032-.4674-.1032-.7285L6.287.1335 6.6997 0l.9957.1336.419.3642.6192 1.4147 1.0018 2.2282 1.5543 3.0296.4553.8985.2429.8318.091.255h.1579v-.1457l.1275-1.706.2368-2.0947.2307-2.6957.0789-.7589.3764-.9107.7468-.4918.5828.2793.4797.686-.0668.4433-.2853 1.8517-.5586 2.9021-.3643 1.9429h.2125l.2429-.2429.9835-1.3053 1.6514-2.0643.7286-.8196.85-.9046.5464-.4311h1.0321l.759 1.1293-.34 1.1657-1.0625 1.3478-.8804 1.1414-1.2628 1.7-.7893 1.36.0729.1093.1882-.0183 2.8535-.607 1.5421-.2794 1.8396-.3157.8318.3886.091.3946-.3278.8075-1.967.4857-2.3072.4614-3.4364.8136-.0425.0304.0486.0607 1.5482.1457.6618.0364h1.621l3.0175.2247.7892.522.4736.6376-.079.4857-1.2142.6193-1.6393-.3886-3.825-.9107-1.3113-.3279h-.1822v.1093l1.0929 1.0686 2.0035 1.8092 2.5075 2.3314.1275.5768-.3218.4554-.34-.0486-2.2039-1.6575-.85-.7468-1.9246-1.621h-.1275v.17l.4432.6496 2.3436 3.5214.1214 1.0807-.17.3521-.6071.2125-.6679-.1214-1.3721-1.9246L14.38 17.959l-1.1414-1.9428-.1397.079-.674 7.2552-.3156.3703-.7286.2793-.6071-.4614-.3218-.7468.3218-1.4753.3886-1.9246.3157-1.53.2853-1.9004.17-.6314-.0121-.0425-.1397.0182-1.4328 1.9672-2.1796 2.9446-1.7243 1.8456-.4128.164-.7164-.3704.0667-.6618.4008-.5889 2.386-3.0357 1.4389-1.882.929-1.0868-.0062-.1579h-.0546l-6.3385 4.1164-1.1293.1457-.4857-.4554.0608-.7467.2307-.2429 1.9064-1.3114Z",
+	openai: "M22.2819 9.8211a5.9847 5.9847 0 0 0-.5157-4.9108 6.0462 6.0462 0 0 0-6.5098-2.9A6.0651 6.0651 0 0 0 4.9807 4.1818a5.9847 5.9847 0 0 0-3.9977 2.9 6.0462 6.0462 0 0 0 .7427 7.0966 5.98 5.98 0 0 0 .511 4.9107 6.051 6.051 0 0 0 6.5146 2.9001A5.9847 5.9847 0 0 0 13.2599 24a6.0557 6.0557 0 0 0 5.7718-4.2058 5.9894 5.9894 0 0 0 3.9977-2.9001 6.0557 6.0557 0 0 0-.7475-7.0729zm-9.022 12.6081a4.4755 4.4755 0 0 1-2.8764-1.0408l.1419-.0804 4.7783-2.7582a.7948.7948 0 0 0 .3927-.6813v-6.7369l2.02 1.1686a.071.071 0 0 1 .038.052v5.5826a4.504 4.504 0 0 1-4.4945 4.4944zm-9.6607-4.1254a4.4708 4.4708 0 0 1-.5346-3.0137l.142.0852 4.783 2.7582a.7712.7712 0 0 0 .7806 0l5.8428-3.3685v2.3324a.0804.0804 0 0 1-.0332.0615L9.74 19.9502a4.4992 4.4992 0 0 1-6.1408-1.6464zM2.3408 7.8956a4.485 4.485 0 0 1 2.3655-1.9728V11.6a.7664.7664 0 0 0 .3879.6765l5.8144 3.3543-2.0201 1.1685a.0757.0757 0 0 1-.071 0l-4.8303-2.7865A4.504 4.504 0 0 1 2.3408 7.872zm16.5963 3.8558L13.1038 8.364 15.1192 7.2a.0757.0757 0 0 1 .071 0l4.8303 2.7913a4.4944 4.4944 0 0 1-.6765 8.1042v-5.6772a.79.79 0 0 0-.407-.667zm2.0107-3.0231l-.142-.0852-4.7735-2.7818a.7759.7759 0 0 0-.7854 0L9.409 9.2297V6.8974a.0662.0662 0 0 1 .0284-.0615l4.8303-2.7866a4.4992 4.4992 0 0 1 6.6802 4.66zM8.3065 12.863l-2.02-1.1638a.0804.0804 0 0 1-.038-.0567V6.0742a4.4992 4.4992 0 0 1 7.3757-3.4537l-.142.0805L8.704 5.459a.7948.7948 0 0 0-.3927.6813zm1.0976-2.3654l2.602-1.4998 2.6069 1.4998v2.9994l-2.5974 1.4997-2.6067-1.4997Z",
+	x: "M14.234 10.162 22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299-.929-1.329L3.076 1.56h3.182l5.965 8.532.929 1.329 7.754 11.09h-3.182z",
+	slack: "M5.042 15.165a2.528 2.528 0 0 1-2.52 2.523A2.528 2.528 0 0 1 0 15.165a2.527 2.527 0 0 1 2.522-2.52h2.52v2.52zM6.313 15.165a2.527 2.527 0 0 1 2.521-2.52 2.527 2.527 0 0 1 2.521 2.52v6.313A2.528 2.528 0 0 1 8.834 24a2.528 2.528 0 0 1-2.521-2.522v-6.313zM8.834 5.042a2.528 2.528 0 0 1-2.521-2.52A2.528 2.528 0 0 1 8.834 0a2.528 2.528 0 0 1 2.521 2.522v2.52H8.834zM8.834 6.313a2.528 2.528 0 0 1 2.521 2.521 2.528 2.528 0 0 1-2.521 2.521H2.522A2.528 2.528 0 0 1 0 8.834a2.528 2.528 0 0 1 2.522-2.521h6.312zM18.956 8.834a2.528 2.528 0 0 1 2.522-2.521A2.528 2.528 0 0 1 24 8.834a2.528 2.528 0 0 1-2.522 2.521h-2.522V8.834zM17.688 8.834a2.528 2.528 0 0 1-2.523 2.521 2.527 2.527 0 0 1-2.52-2.521V2.522A2.527 2.527 0 0 1 15.165 0a2.528 2.528 0 0 1 2.523 2.522v6.312zM15.165 18.956a2.528 2.528 0 0 1 2.523 2.522A2.528 2.528 0 0 1 15.165 24a2.527 2.527 0 0 1-2.52-2.522v-2.522h2.52zM15.165 17.688a2.527 2.527 0 0 1-2.52-2.523 2.526 2.526 0 0 1 2.52-2.52h6.313A2.527 2.527 0 0 1 24 15.165a2.528 2.528 0 0 1-2.522 2.523h-6.313z",
+	github: "M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12",
+	whatsapp: "M17.472 14.382c-.297-.149-1.758-.867-2.03-.967-.273-.099-.471-.148-.67.15-.197.297-.767.966-.94 1.164-.173.199-.347.223-.644.075-.297-.15-1.255-.463-2.39-1.475-.883-.788-1.48-1.761-1.653-2.059-.173-.297-.018-.458.13-.606.134-.133.298-.347.446-.52.149-.174.198-.298.298-.497.099-.198.05-.371-.025-.52-.075-.149-.669-1.612-.916-2.207-.242-.579-.487-.5-.669-.51-.173-.008-.371-.01-.57-.01-.198 0-.52.074-.792.372-.272.297-1.04 1.016-1.04 2.479 0 1.462 1.065 2.875 1.213 3.074.149.198 2.096 3.2 5.077 4.487.709.306 1.262.489 1.694.625.712.227 1.36.195 1.871.118.571-.085 1.758-.719 2.006-1.413.248-.694.248-1.289.173-1.413-.074-.124-.272-.198-.57-.347m-5.421 7.403h-.004a9.87 9.87 0 01-5.031-1.378l-.361-.214-3.741.982.998-3.648-.235-.374a9.86 9.86 0 01-1.51-5.26c.001-5.45 4.436-9.884 9.888-9.884 2.64 0 5.122 1.03 6.988 2.898a9.825 9.825 0 012.893 6.994c-.003 5.45-4.437 9.884-9.885 9.884m8.413-18.297A11.815 11.815 0 0012.05 0C5.495 0 .16 5.335.157 11.892c0 2.096.547 4.142 1.588 5.945L.057 24l6.305-1.654a11.882 11.882 0 005.683 1.448h.005c6.554 0 11.89-5.335 11.893-11.893a11.821 11.821 0 00-3.48-8.413Z"
+};
+//#endregion
+//#region src/server/avatars.ts
+/** Each known agent's mark on its color. */
+const STYLES = {
+	claude: {
+		background: "#D97757",
+		mark: { path: LOGOS.claude }
+	},
+	codex: {
+		background: "#000000",
+		mark: { path: LOGOS.openai }
+	},
+	grok: {
+		background: "#000000",
+		mark: { path: LOGOS.x }
+	},
+	pi: {
+		background: "#1f1f1f",
+		mark: { glyph: "π" }
+	}
+};
+/** A built-in avatar for a detected agent; other names get their initial. */
+function avatarSvg(name) {
+	const style = STYLES[name] ?? {
+		background: "#666666",
+		mark: { glyph: name.slice(0, 1).toUpperCase() }
+	};
+	const mark = "path" in style.mark ? `<path transform="translate(30 30) scale(2.8333)" fill="#ffffff" d="${style.mark.path}"/>` : `<text x="64" y="86" font-family="ui-sans-serif,system-ui,sans-serif" font-size="66" font-weight="600" text-anchor="middle" fill="#ffffff">${style.mark.glyph}</text>`;
+	return `<svg xmlns="http://www.w3.org/2000/svg" width="128" height="128" viewBox="0 0 128 128"><rect width="128" height="128" rx="28" fill="${style.background}"/>${mark}</svg>`;
+}
+//#endregion
+//#region src/server/serve.ts
+/** The methods whose answer is something new. */
+const CREATED = /* @__PURE__ */ new Set([
+	"post",
+	"schedule",
+	"upload",
+	"uploadFinish"
+]);
+/** Shown inline only when a browser can't run it: everything else downloads. */
+const INLINE = /^(image\/(png|jpeg|gif|webp|avif)|video\/(mp4|webm)|text\/plain)$/;
+/**
+* The file, sandboxed: it can't run as a page on the board's origin, and only
+* types a browser can't execute display inline.
+*/
+function attachmentResponse({ attachment, data }) {
+	const disposition = INLINE.test(attachment.type) ? "inline" : "attachment";
+	const body = data instanceof Uint8Array ? new Blob([data]) : data;
+	return new Response(body, { headers: {
+		"content-type": attachment.type,
+		"content-length": String(attachment.size),
+		"content-disposition": `${disposition}; filename*=UTF-8''${encodeURIComponent(attachment.name)}`,
+		"content-security-policy": "sandbox; default-src 'none'",
+		"x-content-type-options": "nosniff",
+		"cache-control": "private, max-age=31536000, immutable"
+	} });
+}
+/** A method's input, from the request: its path's `:id` or `:key`, its query, or its body, validated. */
+async function inputOf(name, request, url, params) {
+	const id = params.id ?? "";
+	const key = params.key ?? "";
+	const body = () => readJson(request);
+	switch (name) {
+		case "discovery":
+		case "me":
+		case "channels":
+		case "actors":
+		case "identity":
+		case "watchers": return {};
+		case "message":
+		case "posted":
+		case "delete":
+		case "cancelSchedule":
+		case "attachment":
+		case "uploadFinish": return { id };
+		case "messages": return MessagesQuery.parse(queryObject(url));
+		case "threads": return ThreadsQuery.parse(queryObject(url));
+		case "schedules": return SchedulesQuery.parse(queryObject(url));
+		case "matches": return MatchesQuery.parse(queryObject(url));
+		case "events": {
+			const query = EventsQuery.parse(queryObject(url));
+			const last = request.headers.get("last-event-id");
+			if (query.after === void 0 && last && Ref.safeParse(last).success) query.after = last;
+			return query;
+		}
+		case "post": return PostBody.parse(await body());
+		case "schedule": return ScheduleBody.parse(await body());
+		case "register": return RegisterBody.parse(await body());
+		case "edit": return {
+			id,
+			...EditBody.parse(await body())
+		};
+		case "react": return {
+			id,
+			...ReactBody.parse(await body())
+		};
+		case "label": return {
+			id,
+			...LabelBody.parse(await body())
+		};
+		case "ack": return {
+			id,
+			...AckBody.parse(await body())
+		};
+		case "upload": {
+			const header = request.headers.get("x-board-filename");
+			let name = null;
+			try {
+				name = header === null ? null : decodeURIComponent(header);
+			} catch {
+				throw badRequest("`x-board-filename` is not URI-encoded");
+			}
+			return {
+				data: await readCapped(request, ATTACHMENT_BYTES_MAX),
+				name,
+				type: request.headers.get("content-type")
+			};
+		}
+		case "uploadStart": return UploadStartBody.parse(await body());
+		case "syncImport": return SyncImportBody.parse(await body());
+		case "syncReceipt": return SyncReceiptBody.parse(await body());
+		case "syncThread": return { thread: params.thread ?? "" };
+		case "syncFind": return SyncFindQuery.parse(queryObject(url));
+		case "syncCopies": return SyncCopiesQuery.parse(queryObject(url));
+		case "syncRoots": return SyncRootsQuery.parse(queryObject(url));
+		case "inboxPush": return {
+			key,
+			...InboxPushBody.parse(await body())
+		};
+		case "inboxNext": return {
+			key,
+			...InboxNextQuery.parse(queryObject(url))
+		};
+		case "inboxAck": return {
+			key,
+			id,
+			...InboxAckBody.parse(await body())
+		};
+		case "inbox": return {
+			key,
+			...InboxQuery.parse(queryObject(url))
+		};
+		case "syncCode": return SyncCodeBody.parse(await body());
+		case "syncAccount": return SyncAccountBody.parse(await body());
+		case "syncUnlink": return SyncUnlinkBody.parse(await body());
+		case "typing": return {
+			id,
+			...TypingBody.parse(await body()) ?? {}
+		};
+		case "readSource": return {
+			key,
+			...SourceReadQuery.parse(queryObject(url))
+		};
+	}
+}
+/** A platform user, as the middleware is told who's writing. */
+const externalActor = (author) => ({
+	id: author.id,
+	kind: "external",
+	handle: author.handle,
+	name: author.name,
+	avatar: author.avatar
+});
+/** A write's caller, as the middleware is told: where it came from. The middleware's own handle and sync's lookups skip it. */
+function sourceOf(caller) {
+	const via = caller.origin.via;
+	if (via?.kind === "middleware" || via?.kind === "engine") return null;
+	return via ?? { kind: "api" };
+}
+/** The middleware's own handle: its writes skip the middleware. */
+const MIDDLEWARE = {
+	self: "middleware",
+	origin: { via: { kind: "middleware" } }
+};
+/** board()'s own code, for what it looks up itself. */
+const OWN = {
+	self: null,
+	origin: { via: {
+		kind: "client",
+		name: null
+	} }
+};
+/**
+* The board, serving the protocol over HTTP on its backend: it routes and validates each request,
+* verifies its caller, applies `access`, runs the middleware, and calls the backend's method of the
+* same name with the caller it verified. Sync runs here too, for requests and for its own code.
+*/
+async function createServe(context) {
+	const { options, backend, runtime, policy } = context;
+	const entries = options.sync ?? {};
+	const engine = Object.keys(entries).length > 0 ? (await runtime.sync()).createSyncEngine(entries) : null;
+	const streamMaxMs = options.streamMaxMs ?? 28e4;
+	const route = createRouter(backend.routes, options.basePath);
+	const { state, ownUrl, clientAs, handleOf } = context;
+	const watch = options.watch ?? {};
+	const middleware = options.middleware ?? [];
+	/** What a request says about who it is, none of it verified yet: its bearer token, its claims, and the board's URL. */
+	function requestOf(request, audience) {
+		return {
+			credential: (request.headers.get("authorization") ?? "").match(/^Bearer\s+(.+)$/i)?.[1] ?? null,
+			claims: claimsOf(request.headers),
+			audience,
+			headers: request.headers
+		};
+	}
+	/** A request's caller, verified: who it is, and what `access` lets it do now. */
+	async function callerOf(request) {
+		return {
+			identity: await policy.identify(request),
+			origin: { via: { kind: "api" } }
+		};
+	}
+	/** What a board that serves no requests answers them: a board on `http()` with no `access` of its own. */
+	const servesOnly = () => new HttpError(404, "not_found", `${ownUrl() ?? "this board"} answers only wake-ups and webhooks`);
+	/**
+	* `@[ada@vercel.com]`: an email a synced platform knows becomes that user's mention, and the
+	* board learns who they are; the rest stay plain text.
+	*/
+	async function withEmails(text) {
+		return (await withEmailMentions(text, engine ? async (email) => {
+			const actor = await engine.findByEmail(email);
+			if (actor) await backend.syncImport(engine.caller, {
+				op: "seen",
+				author: {
+					...actor,
+					isBot: false
+				}
+			}, new AbortController().signal);
+			return actor;
+		} : void 0)).text;
+	}
+	/**
+	* A sync target as the board that syncs it resolves it. One for an entry this board doesn't
+	* have goes on as it is, for the sync that does, unless this board syncs: then it's a mistake.
+	*/
+	async function resolveTarget(target) {
+		if (typeof target !== "string") return target;
+		const at = target.indexOf(":");
+		if (at <= 0) throw badRequest(`sync targets look like <key>:<channel or thread>, got: ${target}`);
+		const key = target.slice(0, at);
+		if (engine && entries[key]) return engine.normalizeTarget(target);
+		if (engine) throw badRequest(`no sync entry named ${key}`);
+		return syncTarget(target);
+	}
+	/**
+	* What a verified caller may do, as board()'s `access` said when it verified them: board() checks
+	* it before it does anything for them past calling the backend (a platform call, an email lookup,
+	* sync's own write, reading an upload, the middleware), so a caller it won't let in starts none of
+	* it. Null for this deployment's own code, which may do everything.
+	*/
+	const accessOf = (caller) => "identity" in caller ? caller.identity.principal.access : null;
+	/**
+	* Whether board() may work for a write of `caller`'s that lands in `channel`, or in the thread of
+	* message `re`, which it must read: `post` there. One it may not goes to the backend as it came,
+	* for the backend to say why.
+	*/
+	async function mayPost(caller, where, signal) {
+		const access = accessOf(caller);
+		if (access === null) return {
+			access: null,
+			channel: where.channel ?? ""
+		};
+		const channel = where.channel ?? (where.re === void 0 ? void 0 : (await lookup(caller, where.re, signal))?.channel);
+		if (channel === void 0) return null;
+		return access.can("post", channel) ? {
+			access,
+			channel
+		} : null;
+	}
+	/** Who this deployment's own code is on its backend, asked once each: the middleware is told who's writing. */
+	const selves = /* @__PURE__ */ new Map();
+	async function whoIs(caller, signal) {
+		if ("identity" in caller) return {
+			principal: caller.identity.principal.id,
+			actor: caller.identity.actor
+		};
+		const key = JSON.stringify([
+			caller.origin.via?.kind ?? "",
+			caller.self,
+			caller.profile ?? null
+		]);
+		let found = selves.get(key);
+		if (!found) {
+			selves.set(key, found = backend.me(caller, {}, signal).then((me) => ({
+				principal: me.principal,
+				actor: {
+					id: me.actor,
+					kind: me.kind,
+					handle: me.handle,
+					name: me.name,
+					avatar: me.avatar
+				}
+			})));
+			found.catch(() => selves.delete(key));
+		}
+		return found;
+	}
+	let middlewareBoard = null;
+	/** Runs the middleware on a write, then `commit`s what it passed on: a `DroppedError` when it drops it. */
+	const screen = (write, author, source, commit) => runMiddleware(middleware, {
+		write,
+		author,
+		source,
+		board: () => middlewareBoard ??= handleOf(MIDDLEWARE, null)
+	}, commit);
+	/** Whether a lookup found what it looked for: a 404 says it didn't. */
+	async function found(lookup) {
+		try {
+			await lookup();
+			return true;
+		} catch (error) {
+			if (error instanceof HttpError && error.status === 404) return false;
+			throw error;
+		}
+	}
+	/** Files a write carries, as the board stored them: each one `caller` may have, or the backend's 404. */
+	async function attachmentsOf(caller, ids, signal) {
+		const attachments = [];
+		for (const id of new Set(ids ?? [])) {
+			const { attachment, data } = await backend.attachment(caller, { id }, signal);
+			if (data instanceof ReadableStream) await data.cancel().catch(() => {});
+			attachments.push(attachment);
+		}
+		return attachments;
+	}
+	/**
+	* A post through the middleware, then `send`: once board() knows it would land (a reply's root is
+	* there, and the caller may post, label, and sync where it does), with the files it may have. A
+	* retry of one that landed stands, whatever the middleware would say now; one that wouldn't land
+	* goes as it came, for the backend to say why.
+	*/
+	async function screenPost(caller, input, signal, send) {
+		const source = sourceOf(caller);
+		if (middleware.length === 0 || source === null) return send(input);
+		if (input.id !== void 0 && await found(() => backend.posted(caller, { id: input.id }, signal))) return send(input);
+		let channel = input.channel;
+		let re = null;
+		if (input.re !== void 0) {
+			const root = await lookup(caller, input.re, signal);
+			if (!root) return send(input);
+			channel = root.channel;
+			re = root.re ?? root.id;
+		}
+		const access = accessOf(caller);
+		const labels = Object.keys(input.labels ?? {}).length > 0;
+		const syncs = input.re === void 0 && (input.sync?.length ?? 0) > 0;
+		if (channel === void 0 || access && (!access.can("post", channel) || labels && !access.can("label", channel) || syncs && !access.can("sync", channel))) return send(input);
+		const attachments = await attachmentsOf(caller, input.attachments, signal);
+		const { actor } = await whoIs(caller, signal);
+		return screen({
+			kind: "post",
+			channel,
+			re,
+			text: input.text,
+			labels: input.labels ?? {},
+			attachments
+		}, actor, source, (write) => send({
+			...input,
+			text: write.text,
+			labels: write.labels
+		}));
+	}
+	/**
+	* The caller's own message, still there, where it may post: what an edit of it changes. One it
+	* can't read may still be its own, as board()'s own code finds it, only if it was written there
+	* without reading too: one its principal wrote where it reads (a repo's workflows share one) is
+	* as missing to it as one that isn't there.
+	*/
+	async function ownMessage(caller, id, signal) {
+		const access = accessOf(caller);
+		const readable = await lookup(caller, id, signal);
+		const message = readable ?? (access !== null ? await lookup(OWN, id, signal) : null);
+		if (!message || message.deleted || access && !access.can("post", message.channel)) return null;
+		if (!readable && !message.blind) return null;
+		return message.by.principal === (await whoIs(caller, signal)).principal ? message : null;
+	}
+	/** An edit through the middleware, then `send`: only the author's own, of a message that's still there, reaches it. */
+	async function screenEdit(caller, input, signal, send) {
+		const source = sourceOf(caller);
+		if (middleware.length === 0 || source === null) return send(input);
+		const message = await ownMessage(caller, input.id, signal);
+		if (!message) return send(input);
+		const { actor } = await whoIs(caller, signal);
+		return screen({
+			kind: "edit",
+			id: message.id,
+			channel: message.channel,
+			re: message.re,
+			text: input.text
+		}, actor, source, (write) => send({
+			...input,
+			text: write.text
+		}));
+	}
+	/**
+	* Where an import came from, as the middleware is told: the platform event sync says it's from,
+	* or what its entry and origin say. Null when it names an entry its caller doesn't sync, which
+	* the backend refuses.
+	*/
+	async function importSource(caller, body, found, signal) {
+		const key = body.source?.key ?? body.from;
+		if (body.source) {
+			if (!("identity" in caller ? (await backend.watchers(caller, {}, signal)).watchers.some((registration) => registration.owner === caller.identity.principal.id && registration.sync.some((entry) => entry.key === key)) : entries[body.source.key] !== void 0)) return null;
+		}
+		const origin = (body.op === "post" ? body.origin : null) ?? found?.origin ?? null;
+		return {
+			kind: "sync",
+			key: key ?? "",
+			platform: body.author.id.slice(0, Math.max(0, body.author.id.indexOf(":"))),
+			channel: body.source?.channel ?? found?.origin?.channel ?? origin?.channel ?? "",
+			thread: body.source?.thread ?? (origin ? origin.subthread ?? origin.thread : "")
+		};
+	}
+	/** The board message an import changes: the one it names, or the one its platform IDs are on the board as. */
+	async function importTarget(caller, body, signal) {
+		let id = body.message ?? null;
+		if (body.origin !== void 0) {
+			const { thread, message } = await backend.syncFind(caller, {
+				thread: body.origin.thread,
+				...body.origin.message !== void 0 ? { message: body.origin.message } : {}
+			}, signal);
+			id = body.origin.message !== void 0 ? message : thread === null ? null : (await backend.syncThread(caller, { thread }, signal)).root;
+		}
+		return id === null ? null : lookup(caller, id, signal);
+	}
+	/**
+	* An import, through the middleware when it's a post or an edit that would land: what the
+	* middleware passed on, or what it responded when it dropped it, for sync to tell the author on
+	* the platform. A retry of one that landed stands.
+	*/
+	async function syncImport(caller, body, signal) {
+		const send = (patched) => backend.syncImport(caller, patched, signal);
+		if (middleware.length === 0 || caller.origin.via?.kind === "middleware" || body.op !== "post" && body.op !== "edit") return send(body);
+		const access = accessOf(caller);
+		if (access && (!access.anywhere("sync") || "identity" in caller && caller.identity.principal.scope !== void 0)) return send(body);
+		const dropped = async (commit) => {
+			try {
+				return await commit();
+			} catch (error) {
+				if (!(error instanceof DroppedError)) throw error;
+				return {
+					message: null,
+					dropped: [...error.responses]
+				};
+			}
+		};
+		if (body.op === "post") {
+			if (body.id !== void 0 && (await backend.syncFind(caller, { post: body.id }, signal)).message !== null) return send(body);
+			let channel = body.channel;
+			let re = null;
+			if (body.re !== void 0) {
+				const root = await lookup(caller, body.re, signal);
+				if (!root) return send(body);
+				channel = root.channel;
+				re = root.re ?? root.id;
+			}
+			if (channel === void 0 || access && !access.can("sync", channel)) return send(body);
+			const source = await importSource(caller, body, null, signal);
+			if (!source) return send(body);
+			const attachments = await attachmentsOf(caller, body.attachments, signal);
+			return dropped(async () => screen({
+				kind: "post",
+				channel,
+				re,
+				text: body.text,
+				labels: body.labels ?? {},
+				attachments
+			}, externalActor(body.author), source, async (write) => send({
+				...body,
+				text: write.text,
+				labels: write.labels
+			})));
+		}
+		if (body.origin === void 0 === (body.message === void 0)) return send(body);
+		const found = await importTarget(caller, body, signal);
+		if (!found || found.deleted || access && !access.can("sync", found.channel) || body.message !== void 0 && found.by.principal !== body.author.id) return send(body);
+		const source = await importSource(caller, body, found, signal);
+		if (!source) return send(body);
+		return dropped(async () => screen({
+			kind: "edit",
+			id: found.id,
+			channel: found.channel,
+			re: found.re,
+			text: body.text
+		}, externalActor(body.author), source, async (write) => send({
+			...body,
+			text: write.text
+		})));
+	}
+	/** A message as `caller` may read it, or null. */
+	async function lookup(caller, id, signal) {
+		try {
+			const { message, replies } = await backend.message(caller, { id }, signal);
+			return [message, ...replies].find((candidate) => candidate.id === id) ?? null;
+		} catch (error) {
+			if (error instanceof HttpError && error.status === 404) return null;
+			throw error;
+		}
+	}
+	/**
+	* A post, with the emails it mentions resolved and the targets its channel syncs with landing
+	* beside it, once the caller may post there (and sync, for targets it names), through the
+	* middleware.
+	*/
+	async function post(caller, input, signal) {
+		const send = (poster, body) => screenPost(poster, body, signal, (patched) => backend.post(poster, patched, signal));
+		if (!engine) return send(caller, input.sync?.length ? {
+			...input,
+			sync: await Promise.all(input.sync.map(resolveTarget))
+		} : input);
+		const allowed = (input.sync?.length ?? 0) > 0 || mentionsEmails(input.text) || input.channel !== void 0 && !input.noSync ? await mayPost(caller, input, signal) : null;
+		if (!allowed) return send(caller, input);
+		const { access, channel } = allowed;
+		const body = input.re === void 0 && (input.sync?.length ?? 0) > 0 && (access === null || access.can("sync", channel)) ? {
+			...input,
+			sync: await Promise.all(input.sync.map(resolveTarget))
+		} : input;
+		let poster = caller;
+		if (body.channel !== void 0 && !body.noSync) {
+			const config = await engine.configTargets(body.channel);
+			if (config.length > 0) poster = {
+				...caller,
+				origin: {
+					...caller.origin,
+					config
+				}
+			};
+		}
+		const text = await withEmails(body.text);
+		const answer = await send(poster, {
+			...body,
+			text
+		});
+		return text !== input.text && access !== null && !access.readable(answer.message.channel) ? {
+			...answer,
+			message: {
+				...answer.message,
+				text: input.text
+			}
+		} : answer;
+	}
+	/**
+	* An import's answer, as a sync callback's client gets it: the message it wrote or changed, or the
+	* middleware's responses in the event's platform thread and a `DroppedError` when it dropped it.
+	*/
+	async function landed(caller, answer) {
+		if (!answer.dropped) return answer.message;
+		for (const text of answer.dropped) await caller.platform.respond(text);
+		throw new DroppedError(answer.dropped);
+	}
+	/**
+	* What a sync callback's client does, on any backend. Its own writes are imports, as the platform
+	* user the event came from, which the middleware sees as any import; everything else, its reads
+	* included, it does as sync. A change it names by ID is an import that names it so.
+	*/
+	async function asPlatform(name, caller, input, signal) {
+		const me = engine.caller;
+		const { author, key } = caller.platform;
+		const { via } = caller.origin;
+		const source = {
+			key,
+			channel: via.channel,
+			thread: via.thread
+		};
+		const change = async (body) => {
+			if (await landed(caller, await syncImport(me, body, signal)) === null) throw notFound(`message not found: #${body.message}`, "message_not_found");
+			return { ok: true };
+		};
+		switch (name) {
+			case "post": return importPost(caller, input, signal);
+			case "edit": {
+				const { id, text } = input;
+				return change({
+					op: "edit",
+					author,
+					from: null,
+					message: id,
+					text: await withEmails(text),
+					source
+				});
+			}
+			case "delete": return change({
+				op: "delete",
+				author,
+				from: null,
+				message: input.id
+			});
+			case "react": {
+				const { id, emoji, remove } = input;
+				return change({
+					op: "react",
+					author,
+					from: null,
+					message: id,
+					emoji,
+					...remove !== void 0 ? { remove } : {}
+				});
+			}
+			case "label": {
+				const { id, set, unset } = input;
+				return change({
+					op: "labels",
+					author,
+					from: null,
+					message: id,
+					...set ? { set } : {},
+					...unset ? { unset } : {}
+				});
+			}
+			default: return invoke(name, me, input, signal);
+		}
+	}
+	/** A sync callback's post, as an import by its platform user: once per client ID, which the backend sees to. */
+	async function importPost(caller, input, signal) {
+		const sync = engine;
+		const me = sync.caller;
+		const { author, key } = caller.platform;
+		const { via } = caller.origin;
+		const read = async (id) => {
+			const message = await lookup(me, id, signal);
+			if (!message) throw notFound(`message not found: #${id}`, "message_not_found");
+			return message;
+		};
+		if (input.id !== void 0) {
+			const found = (await backend.syncFind(me, { post: input.id }, signal)).message;
+			if (found !== null) return { message: await read(found) };
+		}
+		const targets = await Promise.all((input.sync ?? []).map(resolveTarget));
+		const config = input.channel !== void 0 && !input.noSync ? await sync.configTargets(input.channel) : [];
+		const message = await landed(caller, await syncImport(config.length > 0 ? {
+			...me,
+			origin: {
+				...me.origin,
+				config
+			}
+		} : me, {
+			op: "post",
+			author,
+			from: null,
+			origin: null,
+			source: {
+				key,
+				channel: via.channel,
+				thread: via.thread
+			},
+			...input.channel !== void 0 ? { channel: input.channel } : { re: input.re },
+			text: await withEmails(input.text),
+			...input.labels ? { labels: input.labels } : {},
+			...input.noSync ? { noSync: true } : {},
+			...input.attachments?.length ? { attachments: input.attachments } : {},
+			...input.id !== void 0 ? { id: input.id } : {}
+		}, signal));
+		for (const target of targets) await backend.syncReceipt(me, {
+			kind: "thread",
+			message,
+			target: target.target,
+			targetKind: target.kind,
+			cause: "request"
+		}, signal);
+		return { message: await read(message) };
+	}
+	/** The protocol method `name`, as board() serves it: what it posts and edits with the emails they mention resolved. */
+	async function invoke(name, caller, input, signal) {
+		switch (name) {
+			case "post": return post(caller, input, signal);
+			case "edit": {
+				const { id, text } = input;
+				const send = (body) => screenEdit(caller, body, signal, (patched) => backend.edit(caller, patched, signal));
+				if (!engine || !mentionsEmails(text) || !await mayPost(caller, { re: id }, signal)) return send({
+					id,
+					text
+				});
+				return send({
+					id,
+					text: await withEmails(text)
+				});
+			}
+			case "syncImport": return syncImport(caller, input, signal);
+			case "schedule": {
+				const body = input;
+				const allowed = engine && mentionsEmails(body.text) ? await mayPost(caller, body, signal) : null;
+				if (!allowed) return backend.schedule(caller, body, signal);
+				const text = await withEmails(body.text);
+				const answer = await backend.schedule(caller, {
+					...body,
+					text
+				}, signal);
+				const { access } = allowed;
+				return text !== body.text && access !== null && !access.readable(answer.schedule.channel) ? {
+					...answer,
+					schedule: {
+						...answer.schedule,
+						text: body.text
+					}
+				} : answer;
+			}
+			case "inbox": {
+				const query = input;
+				if (engine && entries[query.key] && query.channel !== void 0) {
+					const access = accessOf(caller);
+					if (access === null || access.anywhere("sync")) return backend.inbox(caller, {
+						...query,
+						channel: await engine.inboxChannel(query.key, query.channel)
+					}, signal);
+				}
+				return backend.inbox(caller, query, signal);
+			}
+			default: {
+				const method = backend[name];
+				if (typeof method !== "function") throw notFound(`no route: ${name}`);
+				return method.call(backend, caller, input, signal);
+			}
+		}
+	}
+	/**
+	* A sign-in that carries a code, where the entry's sync runs: a browser opens it with no token,
+	* so the code is all it has. `signIn` sends the person to the platform as whoever the code was
+	* issued to; `signedIn`, where the platform sends them back, links the account they approved.
+	*/
+	async function signingIn(name, url, signal) {
+		const { sync: key, code } = SignInQuery.parse(queryObject(url));
+		if (!engine || !entries[key]) throw notFound(`no sync entry named ${key}`);
+		const page = (status, text) => new Response(`${text}\n`, {
+			status,
+			headers: { "content-type": "text/plain; charset=utf-8" }
+		});
+		const { holder } = await backend.syncFind(engine.caller, { code }, signal);
+		if (holder === null) return page(404, "That link has expired or been used. Run `vb identity link` again for a new one.");
+		if (name === "signIn") {
+			const back = ownUrl();
+			const at = await engine.signIn(key, holder, back ? `${back}/identity/signed-in?${new URLSearchParams({
+				sync: key,
+				code
+			})}` : void 0);
+			return new Response(null, {
+				status: 302,
+				headers: { location: at }
+			});
+		}
+		const linked = await engine.redeemSignIn(key, holder, code);
+		if (!linked) return page(409, `${entries[key].platform} hasn't said you approved yet: finish signing in, then open this page again.`);
+		return page(200, `Linked ${linked.handle ? `@${linked.handle}` : linked.actor}. You can close this tab.`);
+	}
+	/** board()'s own routes for a caller: sync's, which run where board() does. */
+	async function serve(name, caller, request, url, params) {
+		const signal = request.signal;
+		switch (name) {
+			case "sync": {
+				const body = SyncBody.parse(await readJson(request));
+				const id = params.id ?? "";
+				const access = accessOf(caller);
+				if (access && engine) {
+					const message = await lookup(caller, id, signal);
+					if (!message) throw notFound(`message not found: #${id}`, "message_not_found");
+					if (!access.can("sync", message.channel)) throw forbidden(`this token can't sync in ${message.channel}`);
+				}
+				const target = await resolveTarget(body.target);
+				const { attached } = await backend.syncReceipt(caller, {
+					kind: "thread",
+					message: id,
+					target: target.target,
+					targetKind: target.kind,
+					cause: "request"
+				}, signal);
+				return json({
+					target: target.target,
+					attached: attached ?? true
+				});
+			}
+			case "identityUnlink": {
+				const body = IdentityUnlinkBody.parse(await readJson(request));
+				const { links } = await backend.identity(caller, {}, signal);
+				const wanted = body.actor.replace(/^@/, "").toLowerCase();
+				const found = links.filter((link) => link.actor === body.actor || link.handle?.toLowerCase() === wanted).map((link) => link.actor);
+				if (found.length === 0) throw notFound(`${body.actor} isn't linked to you`, "not_linked");
+				if (found.length > 1) throw badRequest(`${body.actor} names several of your accounts: use ${found.join(" or ")}`, "ambiguous_actor");
+				await backend.syncUnlink(caller, { account: found[0] }, signal);
+				return json({
+					ok: true,
+					actor: found[0]
+				});
+			}
+			default: throw notFound(`no route: ${request.method} ${url.pathname}`);
+		}
+	}
+	const synced = Object.fromEntries(METHODS.map((name) => [name, name === "syncImport" ? syncImport : (caller, input, signal) => backend[name].call(backend, caller, input, signal)]));
+	engine?.bind({
+		backend: synced,
+		client: (platform, trigger) => clientAs({
+			platform: {
+				author: platform.author,
+				key: platform.key,
+				respond: platform.respond
+			},
+			origin: { via: platform.via }
+		}, trigger)
+	});
+	/**
+	* Server-sent events, from the backend's long-poll: each event's `id` is its cursor, so
+	* `Last-Event-ID` resumes exactly. A request's caller is worked out again for each page, so what
+	* `access` says now holds, and a token that runs out ends it.
+	*/
+	async function sse(caller, query, request, identify) {
+		const first = await backend.events(caller, {
+			...query,
+			wait: 0
+		}, request.signal);
+		const encoder = new TextEncoder();
+		const controller = new AbortController();
+		const deadline = Date.now() + streamMaxMs;
+		const signal = AbortSignal.any([
+			request.signal,
+			controller.signal,
+			AbortSignal.timeout(streamMaxMs)
+		]);
+		const body = new ReadableStream({
+			async start(stream) {
+				const send = (text) => {
+					try {
+						stream.enqueue(encoder.encode(text));
+					} catch {}
+				};
+				const ping = setInterval(() => send(": ping\n\n"), 15e3);
+				try {
+					send(": connected\n\n");
+					let page = first;
+					let after;
+					for (;;) {
+						for (const event of page.events) send(`id: ${event.cursor}\nevent: board\ndata: ${JSON.stringify(event)}\n\n`);
+						if (page.cursor !== (page.events.at(-1)?.cursor ?? after)) send(`id: ${page.cursor}\n\n`);
+						after = page.cursor;
+						const left = deadline - Date.now();
+						if (signal.aborted || left <= 0) break;
+						page = await backend.events(identify ? await identify() : caller, {
+							...query,
+							after,
+							wait: Math.min(300, left / 1e3)
+						}, signal);
+					}
+				} catch (error) {
+					if (!signal.aborted) console.error("[board] feed failed", error);
+				} finally {
+					clearInterval(ping);
+					try {
+						stream.close();
+					} catch {}
+				}
+			},
+			cancel() {
+				controller.abort();
+			}
+		});
+		return new Response(body, { headers: {
+			"content-type": "text/event-stream",
+			"cache-control": "no-cache, no-transform",
+			connection: "keep-alive"
+		} });
+	}
+	/**
+	* Discovery, as a request reaches the board: who the board is to it (the URL a token must be minted
+	* for, and the project people mint them with), which is board()'s to say, and the sync entries
+	* accounts link on. Those are the backend's, where it keeps the board; a board on `http()` lists its own.
+	*/
+	async function discovery(request, url, signal) {
+		const { projectId, teamId } = await policy.discoveryIdentity(request.headers);
+		const sync = backend.keeps ? (await backend.discovery(OWN, {}, signal)).sync : Object.entries(entries).map(([key, entry]) => ({
+			key,
+			platform: entry.platform
+		}));
+		return {
+			version: VERSION,
+			url,
+			audience: url,
+			team_id: teamId,
+			project_id: projectId,
+			sync
+		};
+	}
+	async function dispatch(request, injected) {
+		try {
+			const url = new URL(request.url);
+			const match = route(request.method, url.pathname);
+			if (!match) throw notFound(`no route: ${request.method} ${url.pathname}`);
+			const { target } = match;
+			if (!injected && !match.root && (state.learned === null || state.learned.startsWith(`${match.base}/`))) state.learned = match.base;
+			const boardUrl = (options.url ?? `${url.origin}${match.base}`).replace(/\/+$/, "");
+			if (target.kind === "board" && target.name === "webhook") {
+				if (!engine || !entries[match.params.key ?? ""]) throw notFound(`no sync entry named ${match.params.key}`);
+				return await engine.handleWebhook(match.params.key, request);
+			}
+			if (target.kind === "board" && (target.name === "signIn" || target.name === "signedIn")) return await signingIn(target.name, url, request.signal);
+			if (target.kind === "board" && target.name === "avatar") {
+				const name = match.param ?? "";
+				if (!KNOWN_AGENTS.includes(name)) throw notFound(`no avatar: ${name}`);
+				return new Response(avatarSvg(name), { headers: {
+					"content-type": "image/svg+xml",
+					"cache-control": "public, max-age=86400"
+				} });
+			}
+			if (target.kind === "board" && target.name === "openapi") return json(openapi());
+			if (target.kind === "backend") return await target.route.handle(request, {
+				caller: injected && "platform" in injected ? engine.caller : injected,
+				param: match.param
+			});
+			if (!injected && !policy.open) throw servesOnly();
+			if (!injected && target.kind === "protocol" && target.name === "discovery") return json(await discovery(request, boardUrl, request.signal));
+			if (target.kind === "protocol" && typeof backend[target.name] !== "function") throw notFound(`no route: ${request.method} ${url.pathname}`);
+			const own = injected && "platform" in injected ? engine.caller : injected;
+			const asked = own ? null : requestOf(request, boardUrl);
+			const caller = own ?? await callerOf(asked);
+			if (target.kind === "board") return await serve(target.name, caller, request, url, match.params);
+			const input = await inputOf(target.name, request, url, match.params);
+			if (target.name === "events" && (request.headers.get("accept") ?? "").includes("text/event-stream")) return await sse(caller, input, request, asked ? () => callerOf(asked) : null);
+			const output = injected && "platform" in injected ? await asPlatform(target.name, injected, input, request.signal) : await invoke(target.name, caller, input, request.signal);
+			if (target.name === "attachment") return attachmentResponse(output);
+			return json(output, CREATED.has(target.name) ? 201 : 200);
+		} catch (error) {
+			return toErrorResponse(error);
+		}
+	}
+	return {
+		dispatch,
+		async inject(request, caller, trigger, writes) {
+			if (trigger !== null && request.method === "POST" && new URL(request.url).pathname.endsWith("/messages")) {
+				const body = await request.json() ?? {};
+				body.id ??= await derivedId("board-inbound", trigger, "client", String(writes.made++));
+				request = new Request(request.url, {
+					method: "POST",
+					headers: request.headers,
+					body: JSON.stringify(body)
+				});
+			}
+			return dispatch(request, caller);
+		},
+		async run(id, event, { trigger, attempt }) {
+			if (id === "@sync" && engine) return engine.deliver(event, { attempt });
+			const watcher = watch[id];
+			if (!watcher) throw new Error(`this board has no watcher ${id}`);
+			await watcher.run({
+				event,
+				board: handleOf({
+					self: id,
+					origin: { via: {
+						kind: "watcher",
+						id
+					} }
+				}, trigger)
+			});
+		},
+		async receive(key, item, { id, attempt }) {
+			if (!engine) throw new Error(`this board has no sync, so nothing reads ${key}'s inbox`);
+			await engine.receive(key, item, {
+				id,
+				attempt
+			});
+		},
+		pull: () => engine ? engine.pull() : Promise.resolve(0),
+		async readSource(key, target, limit) {
+			if (!engine || !entries[key]) throw notFound(`this board doesn't run sync entry ${key}: read it where its sync runs`, "not_synced_here");
+			return engine.readSource(key, target, limit);
+		},
+		typing: async (messages, status) => engine ? engine.typing(messages, status) : []
+	};
+}
+//#endregion
+//#region src/server/board.ts
+/** How long a handle's live events wait for the next, in seconds, before asking again. */
+const EVENTS_WAIT_S = 25;
+/**
+* A board for this project, on `backend`: `a2({ store, … })` keeps it in this deployment, and
+* `http(url)` uses another board that speaks the protocol. What it returns is the handle: its
+* methods act as the board's caller, and `fetch` serves the protocol over HTTP. Create it once,
+* at module scope, or one per tenant for a host.
+*/
+function createBoard(options, runtime) {
+	const backend = options.backend ?? runtime.http();
+	const policy = createPolicy(options, backend.keeps, runtime.serving);
+	const watch = options.watch ?? {};
+	const entries = options.sync ?? {};
+	const state = { learned: null };
+	/** Under the configured mount, so the router accepts the paths an in-process client builds. */
+	const inProcess = `http://in-process.board${(options.basePath ?? "").replace(/\/+$/, "")}`;
+	/**
+	* This board's own URL, where a board elsewhere wakes it: `url`, or on Vercel its production
+	* domain (a preview's own URL there), and never a request's Host, which its sender chooses.
+	*/
+	function ownUrl() {
+		if (options.url) return options.url.replace(/\/+$/, "");
+		const env = typeof process === "undefined" ? void 0 : process.env;
+		const domain = env?.VERCEL_ENV === "production" ? env.VERCEL_PROJECT_PRODUCTION_URL : env?.VERCEL_URL;
+		const base = options.basePath ?? state.learned;
+		return domain && base !== null ? `https://${domain}${base}`.replace(/\/+$/, "") : null;
+	}
+	let loading = null;
+	/** The board's pipeline, made once, when the board first serves, watches, syncs, or a handle calls it. */
+	function server() {
+		loading ??= createServe(context);
+		loading.catch(() => loading = null);
+		return loading;
+	}
+	function clientAs(caller, trigger) {
+		const writes = { made: 0 };
+		return createBoardClient({
+			url: inProcess,
+			token: "in-process",
+			fetch: (async (input, init) => (await server()).inject(new Request(input, init), caller, trigger, writes))
+		});
+	}
+	const serve = async (request) => (await server()).dispatch(request, null);
+	/** A handle on `client`, which `as` gives other profiles of. */
+	function handle(client, url) {
+		const made = {
+			...client,
+			fetch: serve,
+			as
+		};
+		if (url) Object.defineProperty(made, "url", {
+			get: url,
+			enumerable: true
+		});
+		return made;
+	}
+	/**
+	* A handle through board(), as `caller`: a post's `id` is its own, derived under who it writes as,
+	* so a retry posts once and no request can take it first. A verified caller's are a backend's,
+	* derived already (a schedule's send's), so they go as they are.
+	*/
+	function handleOf(caller, trigger) {
+		const client = clientAs(caller, trigger);
+		if ("identity" in caller) return handle({
+			...client,
+			events: (query, opts) => events(client, query, opts)
+		}, () => ownUrl() ?? inProcess);
+		const via = caller.origin.via?.kind ?? "client";
+		const id = (given) => derivedId(`board-${via === "watcher" ? "watch" : via}`, caller.self ?? "", given);
+		const owned = async (input) => typeof input === "string" || input.id === void 0 ? input : {
+			...input,
+			id: await id(input.id)
+		};
+		return handle({
+			...client,
+			post: async (channel, input) => client.post(channel, await owned(input)),
+			reply: async (re, input) => client.reply(re, await owned(input)),
+			posted: async (given) => client.posted(await id(given)),
+			request: (path, init = {}) => {
+				const { as: profile, ...rest } = init;
+				return profile !== void 0 ? as(profile).request(path, rest) : client.request(path, rest);
+			},
+			events: (query, opts) => events(client, query, opts)
+		}, () => ownUrl() ?? inProcess);
+	}
+	const profileCaller = (profile) => {
+		const name = profile === null ? null : typeof profile === "string" ? profile : profile.name;
+		return {
+			self: name,
+			profile,
+			origin: { via: {
+				kind: "client",
+				name
+			} }
+		};
+	};
+	function as(profile) {
+		return handleOf(profileCaller(profile), null);
+	}
+	const context = {
+		options,
+		backend,
+		runtime,
+		policy,
+		state,
+		ownUrl,
+		clientAs,
+		handleOf
+	};
+	const subscriptions = Object.fromEntries(Object.entries(watch).map(([id, watcher]) => [id, {
+		kind: "tail",
+		tail: watcher.tail,
+		when: watcher.when ?? "matches"
+	}]));
+	if (Object.keys(entries).length > 0) subscriptions[SYNC] = { kind: "sync" };
+	/** This board's sync entries, as its sync and discovery see them. */
+	const ownEntries = Object.entries(entries).map(([key, entry]) => ({
+		key,
+		platform: entry.platform,
+		signIn: entry.users !== null
+	}));
+	const binding = {
+		subscriptions,
+		run: async (id, event, meta) => (await server()).run(id, event, meta),
+		receive: async (key, item, meta) => (await server()).receive(key, item, meta),
+		pull: async () => ownEntries.length > 0 ? (await server()).pull() : 0,
+		sync: ownEntries,
+		readSource: async (key, target, limit) => (await server()).readSource(key, target, limit),
+		typing: async (messages, status) => (await server()).typing(messages, status),
+		accessNow: (principal) => policy.accessNow(principal),
+		project: () => policy.project(),
+		handle: (caller) => handleOf(caller, null),
+		url: ownUrl
+	};
+	backend.bind(binding);
+	return handleOf({
+		self: null,
+		origin: { via: {
+			kind: "client",
+			name: null
+		} }
+	}, null);
+}
+/**
+* Live events for a handle, from the backend's long-poll: each page from the last cursor it saw,
+* waiting for the next. It backs off after a failure, up to 30 seconds; a 4xx throws.
+*/
+async function* events(client, query = {}, opts = {}) {
+	let after = query.after;
+	let failures = 0;
+	while (!opts.signal?.aborted) {
+		let page;
+		try {
+			page = await client.poll({
+				...query,
+				...after !== void 0 ? { after } : {},
+				wait: EVENTS_WAIT_S
+			}, opts.signal);
+		} catch (error) {
+			if (opts.signal?.aborted) return;
+			if (error instanceof BoardError && error.status >= 400 && error.status < 500) throw error;
+			await new Promise((resolve) => setTimeout(resolve, Math.min(3e4, 500 * 2 ** failures++)));
+			continue;
+		}
+		failures = 0;
+		for (const event of page.events) {
+			yield event;
+			if (opts.signal?.aborted) return;
+		}
+		after = page.cursor;
+	}
+}
+//#endregion
+export { createBoard as t };