@vercel/board 0.0.0-stage → 0.15.0

package/dist/a2-DYGYankn.mjs

@@ -0,0 +1,3045 @@
+import { n as DIRECT_UPLOAD_BYTES_MAX, r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import { _ as RemoteWatcherId, b as actorKind, i as Attachment, x as platformAvatar } from "./schemas-Be08nyfW.mjs";
+import { _ as schedulesContract, d as SCHEDULES_SESSION, f as boardContract, g as registryContract, h as inboxSession, m as inboxContract, o as IDENTITY_SESSION, p as identityContract, s as INBOXES_SESSION, t as BOARD_SESSION, u as REGISTRY_SESSION, v as watchContract, y as watchSession } from "./contract-CuJmlrhw.mjs";
+import { s as isKeyIdOf, t as compileWatcher } from "./watch-spec-W0c7ypHJ.mjs";
+import { r as duration, t as BoardError } from "./client-DGDPaN7U.mjs";
+import { c as VERSION, l as SYNC, n as METHODS, t as canonicalWatchers } from "./watchers-hash-D9hbHLKB.mjs";
+import { a as forbidden, c as toErrorResponse, r as badRequest, s as notFound, t as HttpError } from "./errors-DX3hpwWt.mjs";
+import { a as resolveMentions, n as actorSeen, s as replaceMentions } from "./actors-rdN4dDTU.mjs";
+import { n as authorize, t as FULL_ACCESS } from "./access-CJU2-vaa.mjs";
+import { i as authenticates } from "./auth-COzc09sn.mjs";
+import { a as MIDDLEWARE_ACTOR, i as DroppedError } from "./targets-ojFEXEyN.mjs";
+import { n as channelsReducer, s as identityCodesReducer, t as actorsReducer, u as linkedTo } from "./reducers-mUPFuFJV.mjs";
+import { A as view, C as linkedIds, D as readableFilter, E as pollFeed, M as viewedBy, O as ref, S as indexOf, T as personView, _ as waitUntil, a as blindText, b as eventView, c as landedFor, d as writeDelete, f as writeEdit, g as writeReaction, h as writePost, i as authorizePost, j as viewLinkedIds, k as toMessageFilter, l as trusted, m as writeLinks, n as authorizeMessage, p as writeLabels, r as authorizeOwn, s as deploymentIdentity, t as afterRetry, u as writeAttach, v as OWN_CODE, w as loadBefore, x as foldEvent, y as compileFilter } from "./attempts-BQUp9MKO.mjs";
+import { t as TABLES_CONSUMER } from "./sql-DbiEnqM0.mjs";
+import { A2Error, idempotentId, reducer } from "experimental-a2";
+import { createHash, randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { consumer, createServer } from "experimental-a2/server";
+import { lookup } from "node:dns";
+import { request } from "node:https";
+import { BlockList, isIP } from "node:net";
+//#region src/server/blob.ts
+/** Files in memory, for tests: forgets everything when the process ends. */
+function memoryBlob() {
+	const files = /* @__PURE__ */ new Map();
+	return {
+		put: async (key, data, contentType) => void files.set(key, {
+			data: data.slice(),
+			contentType
+		}),
+		get: async (key) => files.get(key) ?? null
+	};
+}
+/** Files on disk, for development and `vb serve`: under `dir`, `.a2/attachments` by default. */
+function fsBlob(dir = ".a2/attachments") {
+	const path = (key) => join(dir, ...key.split("/"));
+	return {
+		async put(key, data, contentType) {
+			await mkdir(dirname(path(key)), { recursive: true });
+			await writeFile(path(key), data);
+			await writeFile(`${path(key)}.type`, contentType);
+		},
+		async get(key) {
+			try {
+				const [data, contentType] = await Promise.all([readFile(path(key)), readFile(`${path(key)}.type`, "utf8")]);
+				return {
+					data: new Uint8Array(data),
+					contentType
+				};
+			} catch {
+				return null;
+			}
+		}
+	};
+}
+const dataKey = (id) => `board/attachments/${id}`;
+/** A direct upload the board signed, until it's finished: what it's called, and who may finish it. */
+const ticketKey = (id) => `board/uploads/${id}.json`;
+const metaKey = (id) => `board/attachments/${id}.json`;
+/** `shot.png`, as the board stores a name: no paths, no control characters. */
+function fileName(name) {
+	return (name ?? "").split(/[\\/]/).pop().replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, 255) || "file";
+}
+/** `image/png`, or `application/octet-stream` when the type isn't one. */
+function mediaType(type) {
+	const value = (type ?? "").split(";")[0].trim().toLowerCase();
+	return /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/.test(value) && value.length <= 255 ? value : "application/octet-stream";
+}
+/** A board without a blob store keeps no files: every file route says so. */
+const noBlob = () => new HttpError(501, "no_files", "this board keeps no files: pass `blob` to `a2()`");
+/** 128 random bits, base64url, drawn again when they'd start with `-`, which a command line reads as a flag. */
+function attachmentId() {
+	for (;;) {
+		const id = randomBytes(16).toString("base64url");
+		if (!id.startsWith("-")) return id;
+	}
+}
+/**
+* Stores an upload under a fresh ID, with its metadata beside it. `uploadedBy`
+* is the principal that sent it, who can read it before any message carries it.
+* `max` is the most it can be: `ATTACHMENT_BYTES_MAX` unless the board's own sync imports it.
+*/
+async function writeUpload(blob, input, max = ATTACHMENT_BYTES_MAX) {
+	if (!blob) throw noBlob();
+	if (input.data.byteLength === 0) throw badRequest("the file is empty");
+	if (input.data.byteLength > max) throw new HttpError(413, "too_large", `attachments are at most ${max / 1024 / 1024} MB`);
+	const attachment = {
+		id: attachmentId(),
+		name: fileName(input.name),
+		type: mediaType(input.type),
+		size: input.data.byteLength
+	};
+	await blob.put(dataKey(attachment.id), input.data, attachment.type);
+	const meta = input.uploadedBy === void 0 ? attachment : {
+		...attachment,
+		uploadedBy: input.uploadedBy
+	};
+	await blob.put(metaKey(attachment.id), new TextEncoder().encode(JSON.stringify(meta)), "application/json");
+	return attachment;
+}
+async function bytes(data) {
+	return data instanceof Uint8Array ? data : new Uint8Array(await new Response(data).arrayBuffer());
+}
+const attachmentNotFound = (id) => notFound(`no attachment: ${id}`, "attachment_not_found");
+/**
+* An upload's metadata, as the board recorded it, never what a request says,
+* and who uploaded it: null for files the board imported itself, or stored
+* before it recorded that.
+*/
+async function readUpload(blob, id) {
+	if (!blob) throw noBlob();
+	const found = Attachment.shape.id.safeParse(id).success ? await blob.get(metaKey(id)) : null;
+	if (!found) throw attachmentNotFound(id);
+	const meta = JSON.parse(new TextDecoder().decode(await bytes(found.data)));
+	return {
+		attachment: Attachment.parse(meta),
+		uploadedBy: typeof meta.uploadedBy === "string" ? meta.uploadedBy : null
+	};
+}
+/** An attachment's bytes as the store keeps them, a stream or the bytes, for board() to serve. */
+async function attachmentBody(blob, id) {
+	if (!blob) throw noBlob();
+	const found = await blob.get(dataKey(id));
+	if (!found) throw attachmentNotFound(id);
+	return found.data;
+}
+/** How long a direct upload's URL takes bytes: long enough for 100 MB on a slow link. */
+const DIRECT_UPLOAD_TTL_MS = 18e5;
+const noDirectUploads = () => new HttpError(501, "no_direct_uploads", `this board's blob store can't take direct uploads, so files are at most ${ATTACHMENT_BYTES_MAX / 1024 / 1024} MB`);
+/**
+* Starts a direct upload: a fresh ID, and a URL in the store to `PUT` its bytes to. The board
+* keeps what the request said the file is until `finishUpload` checks the store has it.
+*/
+async function startUpload(blob, input) {
+	if (!blob) throw noBlob();
+	if (!blob.uploadUrl || !blob.head) throw noDirectUploads();
+	if (input.size > 104857600) throw new HttpError(413, "too_large", `direct uploads are at most ${DIRECT_UPLOAD_BYTES_MAX / 1024 / 1024} MB`);
+	const expires = new Date(Date.now() + DIRECT_UPLOAD_TTL_MS);
+	const ticket = {
+		id: attachmentId(),
+		name: fileName(input.name),
+		type: mediaType(input.type),
+		size: input.size,
+		uploadedBy: input.uploadedBy,
+		expiresAt: expires.toISOString()
+	};
+	await blob.put(ticketKey(ticket.id), new TextEncoder().encode(JSON.stringify(ticket)), "application/json");
+	const { url, headers } = await blob.uploadUrl(dataKey(ticket.id), {
+		contentType: ticket.type,
+		maxBytes: ticket.size,
+		expiresAt: expires
+	});
+	return {
+		id: ticket.id,
+		url,
+		headers: {
+			...headers,
+			"content-type": ticket.type
+		},
+		expiresAt: ticket.expiresAt
+	};
+}
+/**
+* Finishes a direct upload: once the store has exactly the bytes its start said, the board records
+* the attachment, as `writeUpload` does. Only its uploader may finish it; a second finish answers
+* the same attachment. It never reads the record before writing it: a store with a cache (Vercel
+* Blob's CDN) would keep that miss, and the post that names the file would find nothing.
+*/
+async function finishUpload(blob, id, principal) {
+	if (!blob) throw noBlob();
+	const found = Attachment.shape.id.safeParse(id).success ? await blob.get(ticketKey(id)) : null;
+	const ticket = found ? JSON.parse(new TextDecoder().decode(await bytes(found.data))) : null;
+	if (!ticket || ticket.uploadedBy !== principal) throw notFound(`no upload: ${id}`, "upload_not_found");
+	if (!blob.head) throw noDirectUploads();
+	const stored = await blob.head(dataKey(id));
+	if (!stored) throw new HttpError(409, "not_uploaded", `nothing's been uploaded for ${id} yet: PUT the file to its URL first`);
+	if (stored.size !== ticket.size) throw badRequest(`the store has ${stored.size} bytes for ${id}, but its upload said ${ticket.size}`, "size_mismatch");
+	const attachment = {
+		id,
+		name: ticket.name,
+		type: ticket.type,
+		size: stored.size
+	};
+	try {
+		await blob.put(metaKey(id), new TextEncoder().encode(JSON.stringify({
+			...attachment,
+			uploadedBy: principal
+		})), "application/json");
+	} catch (error) {
+		const done = await blob.get(metaKey(id)).catch(() => null);
+		if (!done) throw error;
+		return Attachment.parse(JSON.parse(new TextDecoder().decode(await bytes(done.data))));
+	}
+	return attachment;
+}
+//#endregion
+//#region src/server/reads.ts
+/** Keeps the tables from the board's log, one event at a time, from the first. */
+function tablesConsumer(tables) {
+	return consumer({
+		contract: boardContract,
+		name: TABLES_CONSUMER,
+		lane: "tables",
+		backfill: true
+	}).run(async (ctx) => {
+		if (ctx.session.id !== "board") return;
+		await tables.apply(ctx.event);
+	});
+}
+/**
+* The board's reads from its tables. A read that names a log index (a message
+* ID is one) waits until the tables have applied it; list reads don't wait, and
+* say which index they reflect.
+*/
+function createReads(tables, session, projection) {
+	/**
+	* The first list read on an instance starts the tables catching up, and doesn't wait: after a deploy
+	* that adds them, or on a quiet board, nothing else may have yet.
+	*/
+	let catching = null;
+	/**
+	* The reader of views whose links point to the board messages `linked`, looked up only for a
+	* reader that can't read every channel. A linked message is older than the one linking it, so
+	* the tables have it.
+	*/
+	async function readerOf(access, linked) {
+		if (access.readsAll) return {
+			access,
+			channelOf: () => void 0
+		};
+		const ids = [...new Set(linked)].filter((id) => id > 0);
+		const found = ids.length === 0 ? /* @__PURE__ */ new Map() : await tables.messagesAt(ids, await tables.position());
+		return {
+			access,
+			channelOf: (id) => found.get(id)?.channel
+		};
+	}
+	function catchUp() {
+		if (catching) return;
+		catching = session.consume(projection).catch(() => {
+			catching = null;
+		});
+		waitUntil(catching);
+	}
+	/** Waits until the tables have applied `index`, or the whole log when it's omitted. */
+	async function ensure(index, signal) {
+		if (index !== void 0 && await tables.position() >= index) return;
+		await session.consume(projection, {
+			...index !== void 0 ? { through: index } : {},
+			...signal ? { signal } : {}
+		});
+	}
+	return {
+		tables,
+		ensure,
+		position: () => tables.position(),
+		async message(id, signal) {
+			await ensure(id, signal);
+			return tables.message(id);
+		},
+		/** A thread's root and replies; `cursor` is the index the tables had applied before reading it. */
+		async thread(root, signal) {
+			await ensure(root, signal);
+			const cursor = await tables.position();
+			return {
+				messages: await tables.thread(root),
+				cursor
+			};
+		},
+		async messagesAt(ids, index, signal) {
+			await ensure(index, signal);
+			return tables.messagesAt(ids, index);
+		},
+		/** By event ID, as of the whole log: an ID doesn't say how far to wait. */
+		async byEventId(eventId, signal) {
+			await ensure(void 0, signal);
+			return tables.byEventId(eventId);
+		},
+		/** The reader of views of `messages`: what a link shows depends on where the message it points to lives. */
+		reader: (access, messages) => readerOf(access, [...messages].flatMap((message) => linkedIds(message.links))),
+		readerOf,
+		async messages(filter, page) {
+			catchUp();
+			if (filter.channels?.length === 0) return {
+				messages: [],
+				position: await tables.position()
+			};
+			return tables.messages(filter, page);
+		},
+		async threads(filter, page) {
+			catchUp();
+			if (filter.channels?.length === 0) return {
+				threads: [],
+				position: await tables.position()
+			};
+			return tables.threads(filter, page);
+		}
+	};
+}
+//#endregion
+//#region src/server/schedules.ts
+/** Vercel Queues delays at most 6 days: a send further out than this goes in hops. */
+const MAX_HOP_MS = 432e6;
+/** A timer that fires this early just waits again; any closer counts as on time. */
+const EARLY_MS = 1e3;
+const identityOf = (as) => {
+	const { author, principal, actor } = as.payload.as;
+	return {
+		author,
+		principal: {
+			...principal,
+			expiresAt: null
+		},
+		actor: {
+			...actor,
+			kind: actorKind(actor.kind)
+		}
+	};
+};
+function foldSchedules(state, event) {
+	switch (event.type) {
+		case "schedule.created": {
+			const { payload } = event;
+			state.byId[event.index] = {
+				id: event.index,
+				channel: payload.channel,
+				re: payload.re,
+				text: payload.text,
+				labels: { ...payload.labels },
+				noSync: payload.noSync,
+				attachments: payload.attachments ?? [],
+				first: payload.first,
+				every: payload.every,
+				until: payload.until,
+				times: payload.times,
+				as: identityOf(event),
+				createdAt: new Date(event.createdAt).toISOString(),
+				blind: payload.blind ?? false,
+				sent: 0,
+				next: payload.first,
+				last: null,
+				canceled: null
+			};
+			return state;
+		}
+		case "schedule.canceled": {
+			const schedule = state.byId[event.payload.id];
+			if (!schedule || schedule.next === null) return state;
+			schedule.next = null;
+			schedule.canceled = {
+				by: event.payload.by,
+				reason: event.payload.reason
+			};
+			return state;
+		}
+		case "schedule.fired": {
+			const schedule = state.byId[event.payload.id];
+			if (!schedule || schedule.next === null || schedule.sent !== event.payload.n) return state;
+			schedule.sent++;
+			schedule.last = event.payload.message;
+			schedule.next = event.payload.next;
+			return state;
+		}
+		default: return state;
+	}
+}
+const schedulesReducer = reducer({
+	contract: schedulesContract,
+	name: "board.schedules.v1",
+	initialState: { byId: {} }
+}).fold(foldSchedules);
+/** The send after one due at `at`: the next slot after now, so downtime skips missed slots instead of replaying them. */
+function nextSend(schedule, n, at, now) {
+	if (schedule.every === null) return null;
+	if (schedule.times !== null && n + 1 >= schedule.times) return null;
+	const next = at + schedule.every * Math.max(1, Math.floor((now - at) / schedule.every) + 1);
+	return schedule.until !== null && next > schedule.until ? null : next;
+}
+/**
+* Whether `principal` is the schedule's creator, as far as seeing and canceling
+* it goes. A principal ID is coarser than access (a repo's workflows share one,
+* and so do the proxies narrowing one token with `x-board-scope`), so it also
+* needs `post` there now, as it would to create it. Where it can't read, the
+* schedule is its own only if it was created without reading too, so a
+* principal ID shared with a caller that reads doesn't reach that caller's.
+*/
+const createdBy = (schedule, principal) => schedule.as.principal.id === principal.id && principal.access.can("post", schedule.channel) && (schedule.blind || principal.access.readable(schedule.channel));
+const scheduleView = (schedule, actors) => {
+	const author = actors.byId[schedule.as.actor.id] ?? schedule.as.actor;
+	return {
+		id: ref(schedule.id),
+		channel: schedule.channel,
+		re: schedule.re === null ? null : ref(schedule.re),
+		text: schedule.text,
+		labels: { ...schedule.labels },
+		noSync: schedule.noSync,
+		attachments: schedule.attachments,
+		first: new Date(schedule.first).toISOString(),
+		every: schedule.every,
+		until: schedule.until === null ? null : new Date(schedule.until).toISOString(),
+		times: schedule.times,
+		sent: schedule.sent,
+		next: schedule.next === null ? null : new Date(schedule.next).toISOString(),
+		last: schedule.last === null ? null : ref(schedule.last),
+		state: schedule.canceled ? "canceled" : schedule.next === null ? "done" : "pending",
+		canceled: schedule.canceled,
+		by: schedule.as.author,
+		author: {
+			kind: author.kind,
+			handle: author.handle,
+			name: author.name,
+			avatar: author.avatar
+		},
+		createdAt: schedule.createdAt
+	};
+};
+const SYSTEM = deploymentIdentity("board:schedule", "schedule");
+/** A refusal (a 403, or a 404 for a thread the creator can no longer read) as null; anything else still throws. */
+const refused = (error) => {
+	if (error instanceof HttpError && (error.status === 403 || error.status === 404)) return null;
+	throw error;
+};
+/**
+* Scheduled messages: `schedule.created` arms the first send as an A2 timer, and
+* each `schedule.due` posts as the schedule's creator, then arms the next.
+*/
+function createSchedules(options) {
+	let writes = null;
+	let accessNow = null;
+	/** Posts as `identity`, through what every post does: the middleware too. */
+	let send = null;
+	/** Arms send `n`, due at `at`: the whole way, or one hop toward it. */
+	async function arm(ctx, name, id, n, at) {
+		const hop = Math.min(at, Date.now() + MAX_HOP_MS);
+		await ctx.session.schedule(name, { at: new Date(Math.max(hop, Date.now())) }, {
+			type: "schedule.due",
+			payload: {
+				id,
+				n,
+				at
+			}
+		});
+	}
+	async function due(ctx) {
+		if (!writes || !accessNow || !send) throw new Error("schedules used before the board bound them");
+		const { id, n, at } = ctx.event.payload;
+		const { state } = await ctx.session.state(schedulesReducer);
+		const schedule = state.byId[id];
+		if (!schedule || schedule.next !== at || schedule.sent !== n) return;
+		if (Date.now() < at - EARLY_MS) return arm(ctx, "hop", id, n, at);
+		if (schedule.re !== null) {
+			const root = await writes.reads.message(schedule.re, ctx.signal);
+			if (!root || root.deleted) {
+				await ctx.session.append("ended", {
+					type: "schedule.canceled",
+					payload: {
+						id,
+						by: SYSTEM.author,
+						reason: "thread_deleted"
+					}
+				});
+				return;
+			}
+		}
+		const access = await accessNow(schedule.as.principal);
+		const target = schedule.re === null ? { channel: schedule.channel } : { re: schedule.re };
+		const proofs = access && await authorizePost(writes, access, {
+			...target,
+			labels: schedule.labels
+		}).catch(refused);
+		if (!access || !proofs) {
+			console.info(`[board] schedule s${id}'s creator can no longer post it in ${schedule.channel}`);
+			await ctx.session.append("ended", {
+				type: "schedule.canceled",
+				payload: {
+					id,
+					by: SYSTEM.author,
+					reason: "revoked"
+				}
+			});
+			return;
+		}
+		const input = {
+			...schedule.re === null ? { channel: schedule.channel } : { re: ref(schedule.re) },
+			id: await idempotentId("board-schedule", String(id), String(n)),
+			text: schedule.text,
+			labels: schedule.labels,
+			noSync: schedule.noSync,
+			...schedule.attachments.length ? { attachments: schedule.attachments.map((file) => file.id) } : {}
+		};
+		let posted;
+		try {
+			const sent = await send({
+				...schedule.as,
+				principal: {
+					...schedule.as.principal,
+					access
+				}
+			}, {
+				via: {
+					kind: "schedule",
+					id
+				},
+				schedule: {
+					id,
+					n
+				}
+			}, input);
+			posted = indexOf(sent.id);
+		} catch (error) {
+			if (!(error instanceof DroppedError)) throw error;
+			console.info(`[board] the middleware dropped schedule s${id}: ${error.message}`);
+			await ctx.session.append("ended", {
+				type: "schedule.canceled",
+				payload: {
+					id,
+					by: SYSTEM.author,
+					reason: "dropped"
+				}
+			});
+			return;
+		}
+		const next = nextSend(schedule, n, at, Date.now());
+		await ctx.session.append("fired", {
+			type: "schedule.fired",
+			payload: {
+				id,
+				n,
+				message: posted,
+				next
+			}
+		});
+		if (next !== null) await arm(ctx, "next", id, n + 1, next);
+	}
+	/**
+	* Arms each schedule's next send, as the schedule stands now, from the first schedule on: a queue
+	* delivers a timer to the deployment that armed it, so one an earlier deployment armed may never
+	* reach this one. The deployment that gets there first sends, and `due` makes the other's a no-op.
+	*/
+	const arming = consumer({
+		contract: schedulesContract,
+		name: "board-schedules",
+		types: ["schedule.created"],
+		lane: "schedules",
+		backfill: true
+	}).run(async (ctx) => {
+		if (!options.scheduler) return;
+		const { state } = await ctx.session.state(schedulesReducer, { through: "latest" });
+		const schedule = state.byId[ctx.event.index];
+		if (!schedule || schedule.next === null) return;
+		await arm(ctx, "first", schedule.id, schedule.sent, schedule.next);
+	});
+	/** Makes each due send, one schedule at a time. */
+	const sending = consumer({
+		contract: schedulesContract,
+		name: "board-schedule-sends",
+		types: ["schedule.due"],
+		lane: ({ event }) => `schedule:${event.payload.id}`
+	}).run(due);
+	const server = createServer({
+		contract: schedulesContract,
+		...options.store ? { store: options.store } : {},
+		...options.scheduler ? { scheduler: options.scheduler } : {},
+		consumers: [arming, sending]
+	});
+	const session = server.session(SCHEDULES_SESSION);
+	/**
+	* The first request on an instance starts the arming catching up, and doesn't wait: on the
+	* first deploy with it, every schedule from before gets its next send armed here.
+	*/
+	let catching = null;
+	function catchUp() {
+		if (catching || !options.scheduler) return;
+		catching = session.consume(arming).catch((error) => {
+			console.warn("[board] schedules are not caught up:", error.message);
+			catching = null;
+		});
+		waitUntil(catching);
+	}
+	/** `visible`: which schedules the caller may see. */
+	async function list(query, visible = () => true) {
+		if (!writes) throw new Error("schedules used before the board bound them");
+		const [{ state }, { state: actors }] = await Promise.all([session.state(schedulesReducer), writes.session.state(actorsReducer)]);
+		return Object.values(state.byId).filter(visible).filter((s) => query.all ? true : s.next !== null).filter((s) => query.root === void 0 ? true : s.re === query.root).filter((s) => query.channel === void 0 ? true : s.channel === query.channel).filter((s) => query.by === void 0 ? true : s.as.actor.id === query.by || s.as.actor.handle.toLowerCase() === query.by.toLowerCase()).sort((a, b) => a.id - b.id).map((s) => scheduleView(s, actors));
+	}
+	return {
+		server,
+		session,
+		catchUp,
+		bind: (binding) => {
+			writes = binding.writes;
+			accessNow = binding.accessNow;
+			send = binding.send;
+		},
+		list,
+		/** The pending schedules that reply in the thread rooted at `root`. */
+		forThread: (root) => list({ root }),
+		async create(identity, body, attachments) {
+			if (!writes) throw new Error("schedules used before the board bound them");
+			if (!options.scheduler) throw new HttpError(501, "no_scheduler", "this board has no scheduler: pass `scheduler` to `a2()` to send later");
+			const now = Date.now();
+			const every = body.every === void 0 ? null : duration(body.every);
+			if (every !== null && every < 6e4) throw badRequest("`every` is at least 1m");
+			if (every !== null && every > 316224e5) throw badRequest("`every` is at most a year");
+			const first = body.at !== void 0 ? Date.parse(body.at) : now + duration(body.in ?? body.every);
+			if (first < now - 6e4) throw badRequest("`at` is in the past");
+			const until = body.until !== void 0 ? Date.parse(body.until) : body.for !== void 0 ? first + duration(body.for) : null;
+			if (until !== null && until < first) throw badRequest("the schedule stops before its first send");
+			if (first > now + 316224e5 || until !== null && until > now + 316224e5) throw badRequest("a schedule reaches at most a year out: its first send and its stop");
+			const { state: known } = await writes.session.state(actorsReducer);
+			const withoutEmails = replaceMentions(body.text, (t) => t.kind === "actor" && t.actor.includes("@") ? t.actor : null);
+			const { unknown } = resolveMentions(withoutEmails, known, identity.actor, false, identity.principal.access.readsAll);
+			let channel = body.channel;
+			let re = null;
+			if (body.re !== void 0) {
+				const target = await writes.reads.message(body.re);
+				if (!target || target.deleted) throw notFound(`message not found: #${body.re}`, "message_not_found");
+				re = target.re ?? target.id;
+				channel = target.channel;
+			}
+			const [row] = await session.append({
+				type: "schedule.created",
+				payload: {
+					channel,
+					re,
+					text: body.text,
+					labels: body.labels ?? {},
+					noSync: body.noSync ?? false,
+					...attachments.length ? { attachments } : {},
+					first,
+					every,
+					until,
+					times: body.times ?? null,
+					as: {
+						author: identity.author,
+						principal: {
+							id: identity.principal.id,
+							kind: identity.principal.kind,
+							handle: identity.principal.handle,
+							...identity.principal.facts ? { facts: identity.principal.facts } : {},
+							...identity.principal.scope !== void 0 ? { scope: identity.principal.scope } : {}
+						},
+						actor: identity.actor
+					},
+					...identity.principal.access.readable(channel) ? {} : { blind: true }
+				}
+			});
+			const { state } = await session.state(schedulesReducer);
+			const { state: actors } = await writes.session.state(actorsReducer);
+			const schedule = scheduleView(state.byId[row.index], actors);
+			return unknown.length && identity.principal.access.readable(channel) ? {
+				schedule,
+				unknownMentions: unknown
+			} : { schedule };
+		},
+		/**
+		* Its creator may cancel it while they can post there, and so may `manage`
+		* in its channel. Anyone else gets 403 where they can read it, and 404
+		* where they can't. Canceling twice is a no-op.
+		*/
+		async cancel(identity, id) {
+			if (!writes) throw new Error("schedules used before the board bound them");
+			const { state } = await session.state(schedulesReducer);
+			const schedule = state.byId[id];
+			const missing = () => notFound(`schedule not found: s${id}`, "schedule_not_found");
+			if (!schedule) throw missing();
+			if (!createdBy(schedule, identity.principal)) authorize(identity.principal.access, "manage", schedule.channel, missing);
+			const canceled = schedule.next !== null;
+			if (canceled) await session.append({
+				type: "schedule.canceled",
+				payload: {
+					id,
+					by: identity.author,
+					reason: "canceled"
+				}
+			});
+			const { state: after } = await session.state(schedulesReducer);
+			const { state: actors } = await writes.session.state(actorsReducer);
+			return {
+				schedule: scheduleView(after.byId[id], actors),
+				canceled
+			};
+		}
+	};
+}
+/** How long a pulled match is its puller's before someone may pull it again. */
+const LEASE_MS = 3e5;
+/** After an error, a match waits 1 second, doubling to 30. */
+const retryDelay = (attempts) => Math.min(3e4, 1e3 * 2 ** (attempts - 1));
+/**
+* Sweeps fall on the minute: a registrant has at most one timer a minute, however many matches it
+* pulls. A sweep wakes it for leases that ran out, and for a wake-up that didn't arrive.
+*/
+const SWEEP_MS = 6e4;
+/** The sweep that covers `at`: the next minute at least a second after it, since a timer may land up to a second early. */
+const sweepFor = (at) => Math.ceil((at + 1e3) / SWEEP_MS) * SWEEP_MS;
+/** The longest a registrant whose wake-ups don't get there waits for the next one. */
+const WAKE_BACKOFF_MAX_MS = 36e5;
+/**
+* After `failures` wake-ups in a row that didn't get there, how long until the next: a minute,
+* doubling to an hour. Until then a match only queues.
+*/
+const wakeBackoff = (failures) => Math.min(WAKE_BACKOFF_MAX_MS, SWEEP_MS * 2 ** (failures - 1));
+/** The queue of platform events a registrant pushed for sync key `key`. */
+const inboxQueue = (key) => `@inbox:${key}`;
+const queueKey = (queue, thread) => `${queue}\u001f${thread}`;
+function remove(state, id) {
+	const found = state.pending[id];
+	if (!found) return;
+	delete state.pending[id];
+	const key = queueKey(found.queue, found.thread);
+	const rest = (state.queues[key] ?? []).filter((queued) => queued !== id);
+	if (rest.length > 0) state.queues[key] = rest;
+	else delete state.queues[key];
+}
+function foldQueue(state, event) {
+	switch (event.type) {
+		case "watch.matched": {
+			const { watcher, sync, inbox, thread } = event.payload;
+			const queue = watcher ?? (sync ? "@sync" : inbox !== void 0 ? inboxQueue(inbox) : void 0);
+			if (queue === void 0 || state.pending[event.id]) return state;
+			state.pending[event.id] = {
+				id: event.id,
+				queue,
+				thread,
+				event: event.payload.event,
+				attempts: 0,
+				lease: null,
+				retryAt: null
+			};
+			(state.queues[queueKey(queue, thread)] ??= []).push(event.id);
+			return state;
+		}
+		case "watch.leased": {
+			const found = state.pending[event.payload.matched];
+			if (found && !found.lease) found.lease = {
+				id: event.payload.lease,
+				until: event.payload.until
+			};
+			return state;
+		}
+		case "watch.acked": {
+			const found = state.pending[event.payload.matched];
+			if (!found || found.lease?.id !== event.payload.lease) return state;
+			if (event.payload.error === void 0) {
+				remove(state, found.id);
+				return state;
+			}
+			found.attempts += 1;
+			found.lease = null;
+			found.retryAt = event.payload.retryAt ?? null;
+			return state;
+		}
+		case "watch.expired": {
+			const found = state.pending[event.payload.matched];
+			if (!found || found.lease?.id !== event.payload.lease) return state;
+			found.attempts += 1;
+			found.lease = null;
+			return state;
+		}
+		case "watch.retry": {
+			const found = state.pending[event.payload.matched];
+			if (found) found.retryAt = null;
+			return state;
+		}
+		case "watch.armed":
+			if (!state.sweeps.includes(event.payload.at)) state.sweeps.push(event.payload.at);
+			return state;
+		case "watch.due": {
+			const { sweep } = event.payload;
+			if (sweep !== void 0) state.sweeps = state.sweeps.filter((at) => at !== sweep);
+			return state;
+		}
+		case "watch.failed":
+		case "watch.skipped":
+			remove(state, event.payload.matched);
+			return state;
+		case "watch.unreachable":
+			state.unreachable = {
+				failures: event.payload.failures,
+				until: event.payload.until
+			};
+			return state;
+		case "watch.reachable":
+			state.unreachable = null;
+			return state;
+		default: return state;
+	}
+}
+const queueReducer = reducer({
+	contract: watchContract,
+	name: "board.watch-queue.v4",
+	initialState: {
+		queues: {},
+		pending: {},
+		sweeps: [],
+		unreachable: null
+	}
+}).fold(foldQueue);
+const describe$1 = (error) => ((error instanceof Error ? error.message : String(error)) || "unknown error").slice(0, 500);
+/**
+* Whether `access` may see `event` now, as it was matched: a message's channel, or every channel for
+* none. Sync's queue gets what its registrant may sync, since it speaks for platform users there.
+*/
+function readable(access, event, queue) {
+	const channel = event.message?.channel;
+	if (queue === "@sync") return channel === void 0 ? access.everywhere("sync") : access.can("sync", channel);
+	return channel === void 0 ? access.readsAll : access.readable(channel);
+}
+/** An append that holds an event ID already in the log: another pull's lease. */
+const taken = (error) => error instanceof A2Error && error.code === "PARTIAL_DUPLICATE_BATCH";
+/** Whether a match is free to pull now: no one holds it, and its wait after an error is over. A lease or wait whose time has passed counts as over. */
+const free = (found, now) => !(found.lease && found.lease.until > now) && !(found.retryAt !== null && found.retryAt > now);
+/** Whether the registrant has anything to pull now. */
+const hasWork = (state, now) => Object.values(state.queues).some((ids) => free(state.pending[ids[0]], now));
+/**
+* Hands out what the registrant's watchers and sync may run now: each queue's oldest match, if it's
+* free, leased to this pull. The inbox's queues are `pullInbox`'s.
+*/
+async function pull(session, options) {
+	return (await lease(session, {
+		...options,
+		queues: (queue) => !queue.startsWith("@inbox:"),
+		visible: (event, queue) => readable(options.access, event, queue)
+	})).map(({ id, queue, thread, lease, attempt, event }) => ({
+		id,
+		watcher: queue,
+		thread,
+		lease,
+		attempt,
+		event
+	}));
+}
+/**
+* Hands out the platform events the registrant pushed for sync key `key`: each platform thread's
+* oldest, if it's free, while the registrant may still sync somewhere.
+*/
+function pullInbox(session, key, options) {
+	const queue = inboxQueue(key);
+	return lease(session, {
+		...options,
+		queues: (name) => name === queue,
+		visible: () => options.access.anywhere("sync")
+	});
+}
+/**
+* Leases what's free in the queues `queues` picks: each one's oldest item, which `visible` says
+* its registrant may still have. What the pull changes goes in one append, and one read after
+* tells which leases are this pull's: two pulls at once derive the same lease ID for a try, and
+* only one lands.
+*/
+async function lease(session, options) {
+	const { state } = await session.state(queueReducer);
+	const events = state.unreachable ? [{
+		type: "watch.reachable",
+		payload: { by: "pull" }
+	}] : [];
+	const offered = [];
+	for (const ids of Object.values(state.queues)) {
+		if (offered.length >= options.limit) break;
+		const head = state.pending[ids[0]];
+		if (!options.queues(head.queue) || !free(head, options.now)) continue;
+		let attempts = head.attempts;
+		if (head.lease) {
+			events.push({
+				type: "watch.expired",
+				payload: {
+					matched: head.id,
+					lease: head.lease.id
+				}
+			});
+			attempts += 1;
+			if (attempts >= 5) {
+				events.push(failure(head, `its lease ran out ${attempts} times`));
+				continue;
+			}
+		}
+		if (!options.visible(head.event, head.queue)) {
+			events.push({
+				type: "watch.skipped",
+				payload: {
+					matched: head.id,
+					reason: "its registrant can't have it anymore"
+				}
+			});
+			continue;
+		}
+		const lease = randomBytes(16).toString("hex");
+		events.push({
+			type: "watch.leased",
+			id: await idempotentId("board-lease", head.id, String(attempts)),
+			payload: {
+				matched: head.id,
+				lease,
+				until: options.now + LEASE_MS
+			}
+		});
+		offered.push({
+			head,
+			lease,
+			attempt: attempts
+		});
+	}
+	if (events.length === 0) return [];
+	await session.append(...events).catch(async (error) => {
+		if (!taken(error)) throw error;
+		for (const event of events) await session.append(event).catch((one) => {
+			if (!taken(one)) throw one;
+		});
+	});
+	if (offered.length === 0) return [];
+	const { state: after } = await session.state(queueReducer);
+	const handed = offered.filter(({ head, lease }) => after.pending[head.id]?.lease?.id === lease);
+	if (handed.length > 0 && options.timers) await arm(session, after, options.now + LEASE_MS);
+	return handed.map(({ head, lease, attempt }) => ({
+		id: head.id,
+		queue: head.queue,
+		thread: head.thread,
+		lease,
+		attempt,
+		event: head.event
+	}));
+}
+/** Records how a pulled match went: done, skipped, or an error that waits, then tries again. */
+async function ack(session, id, body, options) {
+	const { state } = await session.state(queueReducer);
+	const found = state.pending[id];
+	if (!found) return "gone";
+	if (found.lease?.id !== body.lease) return "stale";
+	if (body.skip) {
+		await session.append({
+			type: "watch.skipped",
+			payload: {
+				matched: id,
+				reason: "its board skipped it"
+			}
+		});
+		return "acked";
+	}
+	if (body.error === void 0) {
+		await session.append({
+			type: "watch.acked",
+			payload: {
+				matched: id,
+				lease: body.lease
+			}
+		});
+		return "acked";
+	}
+	const attempts = found.attempts + 1;
+	if (attempts >= 5) {
+		await session.append({
+			type: "watch.acked",
+			payload: {
+				matched: id,
+				lease: body.lease,
+				error: body.error
+			}
+		}, failure(found, body.error));
+		return "acked";
+	}
+	const retryAt = options.now + retryDelay(attempts);
+	await session.append({
+		type: "watch.acked",
+		payload: {
+			matched: id,
+			lease: body.lease,
+			error: body.error,
+			retryAt
+		}
+	});
+	if (options.timers) await session.schedule(`retry:${id}:${attempts}`, { at: new Date(retryAt) }, {
+		type: "watch.due",
+		payload: {
+			matched: id,
+			retry: true
+		}
+	});
+	return "acked";
+}
+/**
+* Sets a sweep for `at`, unless one is set already. The sweep runs on the minute after it, so the
+* leases of a minute share one timer. Its timer goes first: a sweep recorded without one would
+* never run, and a timer set twice under one name lands once.
+*/
+async function arm(session, state, at) {
+	const sweep = sweepFor(at);
+	if (state.sweeps.includes(sweep)) return;
+	await session.schedule(`sweep:${sweep}`, { at: new Date(sweep) }, {
+		type: "watch.due",
+		payload: { sweep }
+	});
+	await session.append({
+		type: "watch.armed",
+		id: await idempotentId("board-sweep", String(sweep)),
+		payload: { at: sweep }
+	});
+}
+/**
+* A timer came due: an error's wait is over, or a sweep. Returns the queue after it, for its
+* consumer to tell whether the registrant has something to pull.
+*/
+async function due(session, payload) {
+	const { state } = await session.state(queueReducer);
+	const found = payload.matched === void 0 ? void 0 : state.pending[payload.matched];
+	if (!payload.retry || !found || found.retryAt === null) return state;
+	await session.append({
+		type: "watch.retry",
+		payload: { matched: found.id }
+	});
+	return (await session.state(queueReducer)).state;
+}
+/** Gives up on a match: `watch.failed`, said in the logs too. */
+function failure(found, error) {
+	console.error(`[board] a registrant's ${found.queue} gave up on an item after 5 tries:`, error);
+	return {
+		type: "watch.failed",
+		payload: {
+			matched: found.id,
+			thread: found.thread,
+			error: describe$1(error)
+		}
+	};
+}
+//#endregion
+//#region src/server/watch.ts
+const ID = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+/** The events a tail shows, receipts included for `--all`: each concerns a message, and carries its thread for the lane. */
+const WATCHED = [
+	"message.posted",
+	"message.edited",
+	"message.deleted",
+	"reaction.added",
+	"reaction.removed",
+	"labels.changed",
+	"message.sync_failed",
+	"message.synced",
+	"message.files_synced",
+	"thread.synced"
+];
+/** Receipts: only a `--all` tail shows them. */
+const RECEIPTS = /* @__PURE__ */ new Set(["message.synced", "message.files_synced"]);
+/**
+* What a registrant's sync gets, in every channel where it may sync: what it delivers to platforms,
+* and a thread's new targets. A tail never shows `thread.synced`, so no watcher gets it.
+*/
+const SYNCED = /* @__PURE__ */ new Set([
+	"message.posted",
+	"message.edited",
+	"message.deleted",
+	"reaction.added",
+	"reaction.removed",
+	"labels.changed",
+	"thread.synced"
+]);
+/** Whether a match waits in a registrant's queue for it to pull, as opposed to a config watcher's, which runs here. */
+const queued = (payload) => payload.watcher !== void 0 || payload.sync === true || payload.inbox !== void 0;
+/**
+* A2 dead-letters an event after 10 failures, and a dead letter stops its
+* lane, which is the thread's: the watcher would never run on that thread
+* again. So `run` gets a few tries, then the failure is recorded and the
+* thread moves on.
+*/
+const RUN_ATTEMPTS = 5;
+/**
+* A run that's killed (a timeout, out of memory) never throws. A2 counts it
+* toward the 10 failures when the next attempt takes over, and dead-letters
+* the event at that takeover instead of running it: the 10th attempt is the
+* last one a watcher sees. Throws give up at RUN_ATTEMPTS, so getting this far
+* means runs keep dying, and the 10th records the failure without running.
+*/
+const KILLED_ATTEMPTS = 10;
+/** Tries at a wake-up before it's left to the next match or sweep, well short of A2's dead letter. */
+const WAKE_TRIES = 3;
+const describe = (error) => ((error instanceof Error ? error.message : String(error)) || "unknown error").slice(0, 500);
+/**
+* One match, on its thread's lane: `run`, retried by A2 while it fails, then
+* given up on (recorded as `watch.failed`) so the thread's next event runs.
+*/
+async function runMatch(input) {
+	const { watcher, match, attempt } = input;
+	const event = match.payload.event;
+	const giveUp = async (error) => {
+		console.error(`[board] watcher ${watcher.id} gave up on event #${event.cursor} after ${attempt} tries:`, error);
+		await input.record({
+			matched: match.id,
+			thread: match.payload.thread,
+			error
+		});
+	};
+	const early = !afterRetry(attempt);
+	if (early && attempt >= KILLED_ATTEMPTS) return giveUp(`its run was cut short ${attempt - 1} times (a timeout, or out of memory)`);
+	try {
+		await watcher.run(event);
+	} catch (error) {
+		if (!early || attempt < RUN_ATTEMPTS) throw error;
+		await giveUp(describe(error));
+	}
+}
+/** A watcher writes as `board:watch:<id>`, and its own writes never wake it. */
+const actorOf = (id) => `board:watch:${id}`;
+/** `watch:@<principal>`: everything one registrant's watchers matched, queued for it to pull. */
+const registrantSession = (owner) => watchSession(`@${owner}`);
+/**
+* Watchers: a board-contract consumer matches each event against every
+* watcher's filters, the way a tail does, and appends what matched to that
+* watcher's session, where `run` happens on the thread's lane.
+*/
+function createWatchers(options) {
+	const watchers = Object.entries(options.watch).map(([id, watcher]) => {
+		if (!ID.test(id)) throw new Error(`watch: ids use lowercase letters, numbers, - and _, got: ${id}`);
+		return {
+			id,
+			...compileWatcher(id, watcher)
+		};
+	});
+	const byId = new Map(watchers.map((watcher) => [watcher.id, watcher]));
+	let reads = null;
+	/** Runs a watcher on a board event it matched, one thread at a time. */
+	const runner = consumer({
+		contract: watchContract,
+		name: "board-watch",
+		types: ["watch.matched"],
+		lane: ({ event }) => `thread:${event.payload.thread}`
+	}).run(async (ctx) => {
+		const watcher = byId.get(ctx.session.id.slice(6));
+		if (!watcher) return;
+		await runMatch({
+			watcher: {
+				id: watcher.id,
+				run: (event) => options.run(watcher.id, event, ctx.event.id, ctx.attempt)
+			},
+			match: ctx.event,
+			attempt: ctx.attempt,
+			record: (payload) => ctx.session.append(`failed:${ctx.event.id}`, {
+				type: "watch.failed",
+				payload
+			})
+		});
+	});
+	/**
+	* Wakes a registrant's board when it has something to pull: a new match, a wait after an error
+	* that's over, or a sweep that finds a lease ran out. A registrant's wake-ups go one at a time,
+	* and only when there's something to pull: its board pulls until nothing's left, so a burst of
+	* matches wakes it once. One that doesn't get there waits a minute for the next, doubling to an
+	* hour while they keep failing, until its board answers one, pulls, or registers.
+	*/
+	const waker = consumer({
+		contract: watchContract,
+		name: "board-wake",
+		types: ["watch.matched", "watch.due"],
+		lane: ({ event }) => "thread" in event.payload && (!queued(event.payload) || event.payload.inbox !== void 0) ? null : "wake"
+	}).run(async (ctx) => {
+		const key = ctx.session.id.slice(6);
+		const registered = options.registered;
+		if (!key.startsWith("@") || !registered) return;
+		if (ctx.event.type === "watch.matched" && (!queued(ctx.event.payload) || ctx.event.payload.inbox !== void 0)) return;
+		const queue = server.session(ctx.session.id);
+		try {
+			const state = ctx.event.type === "watch.due" ? await due(queue, ctx.event.payload) : (await queue.state(queueReducer)).state;
+			if (!hasWork(state, Date.now())) return;
+			const registration = (await registered.state()).byOwner[key.slice(1)];
+			if (!registration || registration.url === null) return;
+			const { url } = registration;
+			const now = Date.now();
+			if (state.unreachable && state.unreachable.until > now) return;
+			const woken = await registered.wake({
+				...registration,
+				url
+			});
+			if (woken.reached) {
+				if (state.unreachable) await queue.append({
+					type: "watch.reachable",
+					payload: { by: "wake" }
+				});
+				return;
+			}
+			const failures = (state.unreachable?.failures ?? 0) + 1;
+			const until = now + wakeBackoff(failures);
+			if (failures === 1) console.error(`[board] couldn't wake ${url}: ${woken.why}`);
+			if (failures === 2) console.error(`[board] couldn't wake ${url} again (${woken.why}): trying less often, up to once an hour, until it answers, pulls, or registers`);
+			if (options.scheduler) await arm(queue, state, until);
+			await queue.append({
+				type: "watch.unreachable",
+				payload: {
+					failures,
+					until,
+					why: woken.why.slice(0, 200) || "unknown error"
+				}
+			});
+		} catch (error) {
+			if (ctx.attempt < WAKE_TRIES) throw error;
+			console.error(`[board] couldn't wake the board of ${key.slice(1)}:`, error.message);
+		}
+	});
+	const server = createServer({
+		contract: watchContract,
+		...options.store ? { store: options.store } : {},
+		...options.scheduler ? { scheduler: options.scheduler } : {},
+		consumers: [runner, waker]
+	});
+	const configured = watchers.map((watcher) => ({
+		...watcher,
+		actor: actorOf(watcher.id)
+	}));
+	const compiled = /* @__PURE__ */ new Map();
+	function compiledFor(registration) {
+		const version = `${registration.hash}\u001f${JSON.stringify(registration.principal)}`;
+		const hit = compiled.get(registration.owner);
+		if (hit?.version === version) return hit.candidates;
+		const candidates = [];
+		for (const [id, spec] of Object.entries(registration.watch)) try {
+			candidates.push({
+				...compileWatcher(id, spec),
+				id,
+				actor: `${registration.owner}+${id.toLowerCase()}`,
+				registration
+			});
+		} catch (error) {
+			console.error(`[board] skipping a watcher ${registration.owner} registered:`, error.message);
+		}
+		compiled.set(registration.owner, {
+			version,
+			candidates
+		});
+		return candidates;
+	}
+	async function registrations() {
+		return options.registered ? Object.values((await options.registered.state()).byOwner) : [];
+	}
+	/** Matches one board event; the message before or after it must match, as in a tail. */
+	async function dispatch(ctx) {
+		const event = ctx.event;
+		const through = event.index - 1;
+		const [messages, { state: actors }] = await Promise.all([messagesBefore(event, ctx.signal), ctx.session.state(actorsReducer, { through })]);
+		const { id, before, after } = foldEvent(messages, actors, event);
+		const by = event.payload.by?.actor;
+		const message = after ?? before;
+		const thread = event.payload.thread;
+		let view$1;
+		/** Each session's matches, appended together: one append per watcher in config, one per registrant. */
+		const appends = /* @__PURE__ */ new Map();
+		const add = (session, matched) => (appends.get(session) ?? appends.set(session, []).get(session)).push(matched);
+		const registered = await registrations();
+		const targets = [...configured, ...registered.flatMap(compiledFor)];
+		const registrants = /* @__PURE__ */ new Map();
+		const accessOf = (registration) => {
+			let found = registrants.get(registration.owner);
+			if (!found) registrants.set(registration.owner, found = options.registered.accessNow(registration.principal));
+			return found;
+		};
+		for (const watcher of targets) {
+			if (event.type === "thread.synced") break;
+			if (by === watcher.actor) continue;
+			if (RECEIPTS.has(event.type) && !watcher.all) continue;
+			const { registration } = watcher;
+			let access = FULL_ACCESS;
+			if (registration) {
+				const now = await accessOf(registration);
+				if (!now || (id === null ? !now.readsAll : !message || !now.readable(message.channel))) continue;
+				access = now;
+			}
+			const match = compileFilter(watcher.filters, {
+				me: null,
+				actors,
+				messages,
+				access
+			});
+			if (watcher.enters ? !entered(match, before, after, messages) : !(watcher.criteria ? match(before) || match(after) : id !== null)) continue;
+			const key = registration ? `@${registration.owner}/${watcher.id}` : watcher.id;
+			const shown = registration ? eventView(event, after, actors, await reads.reader(access, after ? [after] : [])) : view$1 ??= eventView(event, after, actors, OWN_CODE);
+			add(registration ? registrantSession(registration.owner) : watchSession(watcher.id), {
+				type: "watch.matched",
+				id: await idempotentId("board-watch", key, event.id),
+				payload: {
+					thread,
+					event: shown,
+					...registration ? { watcher: watcher.id } : {}
+				}
+			});
+		}
+		const syncing = SYNCED.has(event.type) ? registered.filter((registration) => registration.sync.length > 0) : [];
+		if (syncing.length > 0) {
+			const about = event.type === "thread.synced" ? await rootOf(event.payload.thread, event.index, ctx.signal) : message;
+			for (const registration of syncing) {
+				const now = await accessOf(registration);
+				if (!now || !about || !now.can("sync", about.channel)) continue;
+				const reader = await reads.reader(now, [about, ...before ? [before] : []]);
+				const shown = {
+					...eventView(event, about, actors, reader),
+					...event.type === "labels.changed" && before ? { before: view(before, actors, reader) } : {}
+				};
+				add(registrantSession(registration.owner), {
+					type: "watch.matched",
+					id: await idempotentId("board-watch", `@${registration.owner}/@sync`, event.id),
+					payload: {
+						thread,
+						event: shown,
+						sync: true
+					}
+				});
+			}
+		}
+		await Promise.all([...appends].map(async ([session, events]) => {
+			try {
+				await server.session(session).append(...events);
+			} catch (error) {
+				if (!(error instanceof A2Error && error.code === "PARTIAL_DUPLICATE_BATCH")) throw error;
+				for (const matched of events) await server.session(session).append(matched);
+			}
+		}));
+	}
+	/** A thread's root, as the board has it once the tables reach `index`: the event that synced it comes after it. */
+	async function rootOf(thread, index, signal) {
+		if (!reads) throw new Error("watchers used before the board bound them");
+		await reads.ensure(index - 1, signal);
+		return await reads.tables.byEventId(thread) ?? void 0;
+	}
+	/** The message `event` concerns, and its thread's root, as they were just before it. */
+	async function messagesBefore(event, signal) {
+		if (!reads) throw new Error("watchers used before the board bound them");
+		return loadBefore(reads, event, signal);
+	}
+	/** Didn't match before and does now; a new reply only counts if its thread wasn't already in view. */
+	function entered(match, before, after, messages) {
+		if (match(before) || !match(after)) return false;
+		return !match(before === void 0 && after.re !== null ? messages.byId[after.re] : void 0);
+	}
+	return {
+		server,
+		boardConsumer: consumer({
+			contract: boardContract,
+			name: "board-watchers",
+			types: WATCHED,
+			lane: ({ event }) => `thread:${event.payload.thread}`
+		}).run(dispatch),
+		bind: (binding) => {
+			reads = binding.reads;
+		}
+	};
+}
+//#endregion
+//#region src/server/registry.ts
+/** A principal as a registration keeps it: enough to work out its access again at each match. */
+const storedPrincipal = (principal) => ({
+	id: principal.id,
+	kind: principal.kind,
+	handle: principal.handle,
+	...principal.facts ? { facts: principal.facts } : {},
+	...principal.scope !== void 0 ? { scope: principal.scope } : {}
+});
+/** What a registration shows: the principal's token facts stay on the board. */
+const viewOf = ({ principal: _principal, ...view }) => view;
+/**
+* The same on both ends: a board on `http()` hashes its watchers, and whether its sync subscribes,
+* and the board it uses hashes what it holds.
+*/
+function watchersHash(watch, sync = []) {
+	return createHash("sha256").update(canonicalWatchers(watch, sync)).digest("hex").slice(0, 32);
+}
+function foldRegistry(state, event) {
+	if (event.type === "watchers.registered") {
+		const { owner, principal, url, watch, sync, hash } = event.payload;
+		const copied = Object.fromEntries(Object.entries(watch).map(([id, spec]) => [id, {
+			tail: spec.tail,
+			when: spec.when
+		}]));
+		state.byOwner[owner] = {
+			owner,
+			principal: structuredClone(principal),
+			url,
+			watch: copied,
+			sync: (sync ?? []).map((entry) => ({ ...entry })),
+			hash
+		};
+	}
+	return state;
+}
+const registryReducer = reducer({
+	contract: registryContract,
+	name: "board.registry.v1",
+	initialState: { byOwner: {} }
+}).fold(foldRegistry);
+/** Watchers registered with this board by boards on `http()`. */
+function createRegistry(options) {
+	const server = createServer({
+		contract: registryContract,
+		...options.store ? { store: options.store } : {},
+		...options.scheduler ? { scheduler: options.scheduler } : {}
+	});
+	const session = server.session(REGISTRY_SESSION);
+	const state = async () => (await session.state(registryReducer)).state;
+	return {
+		server,
+		state,
+		/**
+		* Replaces `principal`'s registration. One that changes nothing writes nothing, so asking
+		* again is free, unless the principal's token facts changed: those decide what it may read.
+		*/
+		async register(principal, input) {
+			const owner = principal.id;
+			const hash = watchersHash(input.watch, input.sync);
+			const current = (await state()).byOwner[owner];
+			if (current && current.url === input.url && current.hash === hash && JSON.stringify(current.principal) === JSON.stringify(principal)) return viewOf(current);
+			await session.append({
+				type: "watchers.registered",
+				payload: {
+					owner,
+					principal,
+					url: input.url,
+					watch: input.watch,
+					...input.sync.length > 0 ? { sync: input.sync } : {},
+					hash
+				}
+			});
+			return {
+				owner,
+				url: input.url,
+				watch: input.watch,
+				sync: input.sync,
+				hash
+			};
+		},
+		async list() {
+			return Object.values((await state()).byOwner).sort((a, b) => a.owner.localeCompare(b.owner)).map(viewOf);
+		}
+	};
+}
+//#endregion
+//#region src/server/transport.ts
+/** Addresses a wake-up never reaches: this machine, private networks, link-local, and the rest that aren't the internet. */
+const NOT_PUBLIC = new BlockList();
+for (const [network, prefix] of [
+	["0.0.0.0", 8],
+	["10.0.0.0", 8],
+	["100.64.0.0", 10],
+	["127.0.0.0", 8],
+	["169.254.0.0", 16],
+	["172.16.0.0", 12],
+	["192.0.0.0", 24],
+	["192.168.0.0", 16],
+	["198.18.0.0", 15],
+	["224.0.0.0", 4],
+	["240.0.0.0", 4]
+]) NOT_PUBLIC.addSubnet(network, prefix, "ipv4");
+for (const [network, prefix] of [
+	["::", 127],
+	["64:ff9b::", 96],
+	["64:ff9b:1::", 48],
+	["100::", 64],
+	["2001::", 32],
+	["2002::", 16],
+	["fc00::", 7],
+	["fe80::", 10],
+	["fec0::", 10],
+	["ff00::", 8]
+]) NOT_PUBLIC.addSubnet(network, prefix, "ipv6");
+/** Whether `address` is one a wake-up may connect to. */
+const isPublicAddress = (address) => {
+	const family = isIP(address);
+	return family !== 0 && !NOT_PUBLIC.check(address, family === 4 ? "ipv4" : "ipv6");
+};
+/** Resolves as the system does, and refuses a name that resolves to any address that isn't public. */
+const publicLookup = (hostname, options, callback) => {
+	lookup(hostname, {
+		...options,
+		all: true
+	}, (error, found) => {
+		if (error) return callback(error, "", 0);
+		const addresses = found;
+		const bad = addresses.find((entry) => !isPublicAddress(entry.address));
+		if (bad || addresses.length === 0) return callback(Object.assign(/* @__PURE__ */ new Error(`${hostname} resolves to ${bad?.address ?? "nothing"}, which isn't a public address`), { code: "ENOTPUBLIC" }), "", 0);
+		if (options.all) return callback(null, addresses);
+		callback(null, addresses[0].address, addresses[0].family);
+	});
+};
+/** A response body is read only as far as an error message needs. */
+const ERROR_BYTES = 4096;
+/** Statuses a `Response` has no body with. */
+const NULL_BODY = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+/**
+* A wake-up's answer as a `Response`, whatever status the other end chose: one with no body has
+* none, and one a `Response` can't have (outside 200 to 599) is a 502.
+*/
+function responseOf(status, body) {
+	if (status === void 0 || !Number.isInteger(status) || status < 200 || status > 599) return new Response(null, { status: 502 });
+	return new Response(NULL_BODY.has(status) ? null : body, { status });
+}
+/** POSTs to a public `https` URL: the default `Post`. */
+async function publicPost(url, init) {
+	const target = new URL(url);
+	if (target.protocol !== "https:") throw new Error(`wake-ups go over https, not to ${url}`);
+	const host = target.hostname.replace(/^\[|\]$/g, "");
+	if (isIP(host) && !isPublicAddress(host)) throw new Error(`${host} isn't a public address`);
+	return new Promise((resolve, reject) => {
+		const sent = request(target, {
+			method: "POST",
+			headers: {
+				...init.headers,
+				"content-length": String(Buffer.byteLength(init.body))
+			},
+			lookup: publicLookup,
+			signal: init.signal
+		}, (response) => {
+			const chunks = [];
+			let size = 0;
+			response.on("data", (chunk) => {
+				if (size < ERROR_BYTES) chunks.push(chunk);
+				size += chunk.length;
+			});
+			response.on("end", () => {
+				try {
+					resolve(responseOf(response.statusCode, Buffer.concat(chunks).subarray(0, ERROR_BYTES)));
+				} catch (error) {
+					reject(error);
+				}
+			});
+			response.on("error", reject);
+		});
+		sent.on("error", reject);
+		sent.end(init.body);
+	});
+}
+//#endregion
+//#region src/server/a2.ts
+/** Sync's own lookups and receipts, from board() in this deployment. */
+const SYNC_ACTOR = "board:sync";
+/** The board's own code, through its handle: `team.post(…)`. With `as(profile)`, `board:client:<profile>`. */
+const CLIENT_ACTOR = "board:client";
+/** A cursor or message ref in a request, as this board's log index: decimals, from 0. */
+function cursorAt(value) {
+	const index = indexOf(value);
+	if (index === null) throw badRequest(`${value} isn't a cursor or a message ID on this board`, "invalid_cursor");
+	return index;
+}
+/** The message a ref in a request names, as its log index, or a 404 for one that names nothing here. */
+function messageAt(value) {
+	const index = indexOf(value);
+	if (index === null || index === 0) throw notFound(`message not found: #${value}`, "message_not_found");
+	return index;
+}
+/** A schedule's ID, `12` or as the CLI shows it, `s12`, as its index in session `schedules`. */
+function scheduleAt(value) {
+	const bare = value.replace(/^s/, "");
+	const index = indexOf(bare);
+	if (index === null || index === 0) throw notFound(`schedule not found: s${bare}`, "schedule_not_found");
+	return index;
+}
+new AbortController().signal;
+/** A wake-up only has to arrive: the board it wakes runs what it pulls before it answers. */
+const WAKE_TIMEOUT_MS = 5e3;
+/**
+* `idempotentId`'s shape, a UUIDv8: the IDs the board derives for its own writes (schedule
+* sends, watchers, sync). They're guessable, so an API caller can't post with one and take it first.
+*/
+const DERIVED_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-8[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+/** A request to the board, as board() verified it, as opposed to a write the board's own code makes in-process. */
+const fromRequest = (caller) => "identity" in caller && (caller.origin.via?.kind ?? "api") === "api";
+/** Sync in board() in this deployment, as opposed to a sync elsewhere that uses this board. */
+const ownSync = (caller) => "self" in caller && caller.origin.via?.kind === "engine";
+/** board()'s own code, as the backend's discovery is asked for it. */
+const OWN = {
+	self: null,
+	origin: { via: {
+		kind: "client",
+		name: null
+	} }
+};
+/**
+* Who a caller writes as. This deployment's own code writes as `board:client` from a handle,
+* `board:client:<profile>` from `as(profile)`, as `board:watch:<id>` from a watcher, which its
+* own writes never wake, and as `board:middleware` and `board:sync` from board()'s middleware
+* and sync.
+*/
+function selfIdentity(caller) {
+	const { self, origin } = caller;
+	if (origin.via?.kind === "watcher") return deploymentIdentity(`board:watch:${self}`, self ?? "watch");
+	if (origin.via?.kind === "middleware") return deploymentIdentity(MIDDLEWARE_ACTOR, "middleware");
+	if (origin.via?.kind === "engine") return deploymentIdentity(SYNC_ACTOR, "sync");
+	if (self === null) return deploymentIdentity(CLIENT_ACTOR, "client");
+	if (!ID.test(self)) throw badRequest(`as: profiles use lowercase letters, numbers, - and _, got: ${self}`);
+	return deploymentIdentity(`${CLIENT_ACTOR}:${self}`, self);
+}
+/** A schedule as its creator sees it where it can't read: its text as a blind writer's message's is. */
+const blindSchedule = (schedule, access, own) => access.readable(schedule.channel) ? schedule : {
+	...schedule,
+	text: blindText(schedule.text, own)
+};
+/**
+* A platform user, writing through sync: full access, and each write still proved against the
+* channel it lands in. Their avatar is an https URL or none. `records`: the write keeps the
+* board's record of who they are, which only a sync that may sync everywhere does.
+*/
+function externalIdentity(author, records) {
+	return {
+		principal: {
+			id: author.id,
+			kind: "external",
+			handle: author.handle,
+			access: FULL_ACCESS,
+			expiresAt: null
+		},
+		author: {
+			actor: author.id,
+			principal: author.id,
+			profile: null,
+			session: null
+		},
+		actor: {
+			id: author.id,
+			kind: "external",
+			handle: author.handle,
+			name: author.name,
+			avatar: platformAvatar(author.avatar)
+		},
+		...records ? {} : { records: false }
+	};
+}
+/**
+* A one-time code for linking an account: `vb-` and eight letters and digits that
+* can't be misread. Only its hash is kept.
+*/
+const CODE_LETTERS = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
+const CODE_TTL_MS = 6e5;
+const newCode = () => {
+	const letters = [...randomBytes(8)].map((byte) => CODE_LETTERS[byte % 31]).join("");
+	return `vb-${letters.slice(0, 4)}-${letters.slice(4)}`;
+};
+const hashCode = (code) => createHash("sha256").update(code.toUpperCase()).digest("base64url");
+/** The board events sync delivers: what a platform shows, and a thread's new targets. */
+const DELIVERED = [
+	"thread.synced",
+	"message.posted",
+	"message.edited",
+	"message.deleted",
+	"reaction.added",
+	"reaction.removed",
+	"labels.changed"
+];
+/** The inboxes that have had an event, so a sync key's inbox lists every channel's. */
+const inboxesReducer = reducer({
+	contract: inboxContract,
+	name: "board.inboxes.v1",
+	initialState: {}
+}).fold((state, event) => {
+	if (event.type === "inbox.opened") state[event.payload.channel] = true;
+	return state;
+});
+/** An append that holds an event ID already in the log. */
+const duplicate = (error) => error instanceof A2Error && error.code === "PARTIAL_DUPLICATE_BATCH";
+/** Where a board given no store keeps it, in the working directory, in every environment. */
+const DEFAULT_STORE_PATH = ".a2/dev.db";
+/** Why a file couldn't be opened, in a few words: a read-only filesystem, a serverless function's say. */
+function unwritable(error) {
+	const { code, message } = error;
+	if (code === "EROFS" || code === "EACCES" || code === "EPERM" || /unable to open database|readonly database/i.test(String(message))) return "this filesystem isn't writable here";
+	return String(message ?? error).split("\n")[0];
+}
+/**
+* The store of a board given none: SQLite at `.a2/dev.db`, opened on its first use (so nothing loads
+* SQLite for a board that's given a store). Where it can't open, each request says why and what to
+* pass: never a store in memory, which would lose the board without a word.
+*/
+async function defaultStore() {
+	const { sqlite } = await import("./backend-a2/store-sqlite.mjs");
+	try {
+		return sqlite({ path: DEFAULT_STORE_PATH });
+	} catch (error) {
+		throw new HttpError(500, "no_store", `can't open SQLite at ${DEFAULT_STORE_PATH}: ${unwritable(error)}, so pass a store to a2()`);
+	}
+}
+/** Everything behind a board on `a2()`, built once board() binds it. Nothing in it connects until it's used. */
+function build(options, binding) {
+	const blob = options.blob ?? null;
+	const { store } = options;
+	const log = store.log;
+	const registry = createRegistry({
+		store: log,
+		scheduler: options.scheduler
+	});
+	/**
+	* Who a caller is, and what it may do now: one board() verified, as it said, its access
+	* included; this deployment's own code everything.
+	*/
+	const identityOf = async (caller) => "identity" in caller ? caller.identity : selfIdentity(caller);
+	/** Its own code's handle, which reaches it in process. */
+	let ownHandle = null;
+	const post = options.transport?.post ?? publicPost;
+	const watchers = createWatchers({
+		watch: Object.fromEntries(Object.entries(binding.subscriptions).flatMap(([id, subscription]) => subscription.kind === "tail" ? [[id, {
+			tail: subscription.tail,
+			when: subscription.when
+		}]] : [])),
+		run: (id, event, trigger, attempt) => binding.run(id, event, {
+			trigger,
+			attempt
+		}),
+		store: log,
+		scheduler: options.scheduler,
+		registered: {
+			state: registry.state,
+			accessNow: (principal) => binding.accessNow(principal),
+			wake
+		}
+	});
+	const schedules = createSchedules({
+		store: log,
+		scheduler: options.scheduler
+	});
+	const projection = tablesConsumer(store.tables);
+	/** Sync's delivery in progress here: its receipts are its consumer's appends, fenced by its attempt. */
+	const delivering = new AsyncLocalStorage();
+	/**
+	* Sync's outbound, when board() syncs: each event it delivers, on its thread's lane, with its own
+	* place in the log, so no watcher holds it up. A2 retries what throws, and dead-letters it after 10.
+	*/
+	const outbound = binding.subscriptions["@sync"] ? consumer({
+		contract: boardContract,
+		name: "board-sync",
+		types: DELIVERED,
+		lane: ({ event }) => `thread:${event.payload.thread}`
+	}).run(async (ctx) => {
+		const event = ctx.event;
+		const [messages, { state: actors }] = await Promise.all([loadBefore(reads, event, ctx.signal), ctx.session.state(actorsReducer, { through: event.index - 1 })]);
+		const { before, after } = foldEvent(messages, actors, event);
+		const about = event.type === "thread.synced" ? (await reads.ensure(event.index - 1, ctx.signal), await store.tables.byEventId(event.payload.thread)) ?? void 0 : after;
+		const shown = {
+			...eventView(event, about, actors, OWN_CODE),
+			...event.type === "labels.changed" && before ? { before: view(before, actors, OWN_CODE) } : {}
+		};
+		await delivering.run(ctx, () => binding.run(SYNC, shown, {
+			trigger: ctx.event.id,
+			attempt: ctx.attempt
+		}));
+	}) : void 0;
+	const consumers = [
+		projection,
+		watchers.boardConsumer,
+		outbound
+	].filter((consumer) => consumer !== void 0);
+	const server = createServer({
+		contract: boardContract,
+		store: log,
+		...options.scheduler ? { scheduler: options.scheduler } : {},
+		consumers
+	});
+	const session = server.session(BOARD_SESSION);
+	const reads = createReads(store.tables, session, projection);
+	const writes = {
+		session,
+		reads
+	};
+	/** Sync's inbound: each platform event board()'s sync pushed here, one platform thread at a time. */
+	const inbound = consumer({
+		contract: inboxContract,
+		name: "board-inbox",
+		types: ["external.received"],
+		lane: ({ event }) => `thread:${event.payload.event.thread}`
+	}).run(async (ctx) => {
+		const { payload } = ctx.event;
+		await binding.receive(payload.sync, {
+			event: payload.event,
+			raw: payload.raw
+		}, {
+			id: ctx.event.id,
+			attempt: ctx.attempt,
+			signal: ctx.signal
+		});
+	});
+	const inboxServer = createServer({
+		contract: inboxContract,
+		store: log,
+		...options.scheduler ? { scheduler: options.scheduler } : {},
+		consumers: [inbound]
+	});
+	const codes = createServer({
+		contract: identityContract,
+		store: log
+	}).session(IDENTITY_SESSION);
+	const inboxes = inboxServer.session(INBOXES_SESSION);
+	/** The inboxes this instance knows have an `inbox.opened`, so most pushes write nothing more. */
+	const opened = /* @__PURE__ */ new Set();
+	schedules.bind({
+		writes,
+		accessNow: binding.accessNow,
+		send: async (identity, origin, input) => sendAs(identity, origin, input)
+	});
+	watchers.bind({ reads });
+	/**
+	* Whether `principal` may have a file: one it uploaded, or one a message it
+	* can read carries. A deleted message drops its files, so it no longer counts.
+	*/
+	async function attachmentReadable(principal, id, uploadedBy) {
+		if (principal.access.readsAll || uploadedBy === principal.id) return true;
+		await reads.ensure();
+		return (await reads.tables.withAttachment(id)).some((message) => principal.access.readable(message.channel));
+	}
+	/**
+	* `filter`, narrowed to the channels `access` reads among those the log has,
+	* and the index that list reflects: a read's cursor goes no further, or the
+	* first post in a channel newer than the list would be in neither the page
+	* nor the feed after it.
+	*/
+	async function readable(filter, access) {
+		if (access.readsAll) return {
+			filter,
+			through: Number.POSITIVE_INFINITY
+		};
+		const { state, index } = await session.state(channelsReducer);
+		return {
+			filter: readableFilter(filter, Object.keys(state), access),
+			through: index
+		};
+	}
+	/** Who wrote, was mentioned, or reacted in the channels `access` reads, a page at a time. */
+	async function actorsIn(access) {
+		const ids = /* @__PURE__ */ new Set();
+		const { filter } = await readable({}, access);
+		for (let before;;) {
+			const { messages } = await reads.messages(filter, {
+				limit: 500,
+				...before !== void 0 ? { before } : {}
+			});
+			for (const message of messages) {
+				ids.add(message.by.actor);
+				for (const id of message.mentions) ids.add(id);
+				for (const reactors of Object.values(message.reactions)) for (const id of reactors) ids.add(id);
+			}
+			if (messages.length < 500) return ids;
+			before = messages[0].id;
+		}
+	}
+	/** Files a write carries, as the board stored them: each one the caller may have, or 404 as if it didn't exist. */
+	const attachmentsFor = (principal, ids) => Promise.all([...new Set(ids ?? [])].map(async (id) => {
+		const { attachment, uploadedBy } = await readUpload(blob, id);
+		if (!await attachmentReadable(principal, id, uploadedBy)) throw attachmentNotFound(id);
+		return attachment;
+	}));
+	/**
+	* Tells a registrant's board it has matches to pull, with no event and no credential in it: its
+	* board pulls them with its own credentials, and lets this POST through its own protection. The hash says whether its registration is stale. Says whether the
+	* wake-up got there: an answer, or still pulling when the wait ran out.
+	*/
+	async function wake(registration) {
+		try {
+			const response = await post(`${registration.url}/wake`, {
+				headers: {
+					"content-type": "application/json",
+					"x-board-watchers": registration.hash
+				},
+				body: "{}",
+				signal: AbortSignal.timeout(WAKE_TIMEOUT_MS)
+			});
+			return response.ok ? { reached: true } : {
+				reached: false,
+				why: String(response.status)
+			};
+		} catch (error) {
+			if (error.name === "TimeoutError") return { reached: true };
+			return {
+				reached: false,
+				why: error.message
+			};
+		}
+	}
+	/** A registrant's queue, in the watch contract: its watchers' and sync's matches, and its inbox. */
+	const queueOf = (owner) => watchers.server.session(registrantSession(owner));
+	/**
+	* A schedule's send, as its creator, through board(): its middleware sees it as any post. One the
+	* middleware drops is a `DroppedError`, as the schedule takes it.
+	*/
+	async function sendAs(identity, origin, input) {
+		const { channel, re, ...rest } = input;
+		const handle = binding.handle({
+			identity,
+			origin
+		});
+		try {
+			return channel !== void 0 ? await handle.post(channel, rest) : await handle.reply(re, rest);
+		} catch (error) {
+			if (error instanceof BoardError && error.code === "dropped") throw new DroppedError(error.message === "the board dropped this message" ? [] : error.message.split("\n"));
+			throw error;
+		}
+	}
+	/** A post as it lands: what the caller may post, with the files it may have. */
+	async function postNow(caller, identity, parsed) {
+		const { principal } = identity;
+		const body = {
+			...parsed,
+			re: parsed.re === void 0 ? void 0 : messageAt(parsed.re)
+		};
+		const proofs = await authorizePost(writes, principal.access, body);
+		if (fromRequest(caller) && body.id !== void 0 && DERIVED_ID.test(body.id)) throw badRequest("id: UUIDv8s are the board's own, for the writes it makes itself");
+		if (fromRequest(caller) && body.id?.startsWith("key:") && !isKeyIdOf(body.id, principal.id)) throw badRequest(`id: key:… IDs derive from a client's key, and this token's are key:${principal.id}:…`);
+		if (fromRequest(caller) && body.id?.startsWith("sync:")) throw badRequest("id: sync:… IDs are what sync imports, under the principal that imports them");
+		const attachments = await attachmentsFor(principal, body.attachments);
+		const { schedule, config } = caller.origin;
+		const { unknownMentions, ...message } = await writePost(writes, {
+			attachments,
+			identity,
+			proofs,
+			channel: body.channel,
+			re: body.re,
+			text: body.text,
+			labels: body.labels,
+			noSync: body.noSync,
+			id: body.id,
+			sync: body.sync,
+			config,
+			...schedule && !fromRequest(caller) ? {
+				schedule,
+				lenientMentions: true
+			} : {}
+		});
+		return {
+			message,
+			...unknownMentions ? { unknownMentions } : {}
+		};
+	}
+	/**
+	* The sync entry an import says it came through, when it names one: one its caller syncs, or a
+	* 403. This board's own sync's, or what a sync elsewhere registered.
+	*/
+	async function checkSource(caller, principal, source) {
+		if (source && !(await entriesOf(caller, principal)).some((entry) => entry.key === source.key)) throw forbidden(`this token doesn't sync ${source.key} here: its board registers its sync entries`);
+	}
+	const methods = {
+		async discovery() {
+			const url = binding.url() ?? (ownHandle ??= binding.handle(OWN)).url;
+			const { id, teamId } = await binding.project();
+			return {
+				version: VERSION,
+				url,
+				audience: url,
+				team_id: teamId,
+				project_id: id,
+				sync: (await linkable()).map(({ key, platform }) => ({
+					key,
+					platform
+				}))
+			};
+		},
+		async me(caller) {
+			const { principal, author, actor } = await identityOf(caller);
+			return {
+				actor: actor.id,
+				principal: principal.id,
+				kind: actor.kind,
+				handle: actor.handle,
+				name: actor.name,
+				avatar: actor.avatar,
+				profile: author.profile,
+				session: author.session,
+				expiresAt: principal.expiresAt?.toISOString() ?? null,
+				can: principal.access.summary()
+			};
+		},
+		async channels(caller) {
+			const { principal } = await identityOf(caller);
+			const { state, index } = await session.state(channelsReducer);
+			return {
+				channels: Object.values(state).filter((channel) => principal.access.readable(channel.path)).sort((a, b) => a.path.localeCompare(b.path)),
+				cursor: ref(index)
+			};
+		},
+		async actors(caller) {
+			const { principal, actor } = await identityOf(caller);
+			const { state, index } = await session.state(actorsReducer);
+			let seen = null;
+			if (!principal.access.readsAll) {
+				const ids = await actorsIn(principal.access);
+				ids.add(actor.id);
+				seen = (id) => ids.has(id);
+			}
+			return {
+				actors: Object.values(state.byId).filter((a) => seen === null || seen(a.id)).sort((a, b) => a.handle.localeCompare(b.handle)).map(({ host: _host, ...a }) => {
+					const person = personView(state, a.id);
+					return person ? {
+						...a,
+						person
+					} : a;
+				}),
+				cursor: ref(index)
+			};
+		},
+		async identity(caller) {
+			const { principal } = await identityOf(caller);
+			const { state, index } = await session.state(actorsReducer);
+			const links = linkedTo(state, principal.id).map((id) => ({
+				actor: id,
+				handle: state.byId[id]?.handle ?? null,
+				name: state.byId[id]?.name ?? null,
+				method: state.links[id].method,
+				at: state.links[id].at
+			}));
+			const unlinked = (await linkable()).filter((entry) => !links.some((link) => link.actor.startsWith(`${entry.platform}:user:`))).map((entry) => entry.key);
+			return {
+				principal: principal.id,
+				links,
+				unlinked,
+				cursor: ref(index)
+			};
+		},
+		async messages(caller, query) {
+			const { principal, actor } = await identityOf(caller);
+			const { state: actors } = await session.state(actorsReducer);
+			const { filter, through } = await readable(toMessageFilter(query, {
+				me: actor.id,
+				actors
+			}), principal.access);
+			const { messages, position } = await reads.messages(filter, {
+				...query.before !== void 0 ? { before: cursorAt(query.before) } : {},
+				...query.after !== void 0 ? { after: cursorAt(query.after) } : {},
+				limit: query.limit ?? 50
+			});
+			const reader = await reads.reader(principal.access, messages);
+			return {
+				messages: messages.map((m) => view(m, actors, reader)),
+				cursor: ref(Math.min(position, through))
+			};
+		},
+		async threads(caller, query) {
+			const { principal, actor } = await identityOf(caller);
+			const { state: actors } = await session.state(actorsReducer);
+			const { filter, through } = await readable(toMessageFilter(query, {
+				me: actor.id,
+				actors
+			}), principal.access);
+			const { threads, position } = await reads.threads(filter, {
+				...query.after !== void 0 ? { after: cursorAt(query.after) } : {},
+				limit: query.limit ?? 50
+			});
+			const reader = await reads.reader(principal.access, threads.flatMap((t) => t.last ? [t.root, t.last] : [t.root]));
+			return {
+				threads: threads.map((t) => ({
+					message: view(t.root, actors, reader),
+					replies: t.replies,
+					last: t.last && view(t.last, actors, reader)
+				})),
+				cursor: ref(Math.min(position, through))
+			};
+		},
+		async message(caller, { id }, signal) {
+			const { principal } = await identityOf(caller);
+			const at = messageAt(id);
+			const message = await reads.message(at, signal);
+			if (!message || !principal.access.readable(message.channel)) throw notFound(`message not found: #${at}`, "message_not_found");
+			const [{ messages, cursor }, { state: actors }] = await Promise.all([reads.thread(message.re ?? message.id, signal), session.state(actorsReducer)]);
+			const [root, ...replies] = messages;
+			const reader = await reads.reader(principal.access, messages);
+			return {
+				message: view(root, actors, reader),
+				replies: replies.map((reply) => view(reply, actors, reader)),
+				cursor: ref(cursor),
+				schedules: await schedules.forThread(root.id)
+			};
+		},
+		async posted(caller, { id }, signal) {
+			const identity = await identityOf(caller);
+			const landed = await reads.byEventId(id, signal);
+			const shown = landed ? await landedFor(writes, identity, landed) : null;
+			if (!shown) throw notFound(`no post of yours has id ${id}`, "post_not_found");
+			return { message: shown };
+		},
+		async post(caller, parsed) {
+			return postNow(caller, await identityOf(caller), parsed);
+		},
+		async edit(caller, { id, text }) {
+			const identity = await identityOf(caller);
+			const authorized = await authorizeOwn(writes, identity.principal, messageAt(id), "edit");
+			const { unknownMentions } = await writeEdit(writes, {
+				identity,
+				authorized,
+				text
+			});
+			return {
+				ok: true,
+				...unknownMentions ? { unknownMentions } : {}
+			};
+		},
+		async delete(caller, { id }) {
+			const identity = await identityOf(caller);
+			const authorized = await authorizeOwn(writes, identity.principal, messageAt(id), "delete");
+			await writeDelete(writes, {
+				identity,
+				authorized
+			});
+			return { ok: true };
+		},
+		async react(caller, { id, emoji, remove }) {
+			const identity = await identityOf(caller);
+			const authorized = await authorizeMessage(writes, identity.principal.access, "react", messageAt(id));
+			await writeReaction(writes, {
+				identity,
+				authorized,
+				emoji,
+				remove
+			});
+			return { ok: true };
+		},
+		async label(caller, { id, set, unset }) {
+			const identity = await identityOf(caller);
+			const authorized = await authorizeMessage(writes, identity.principal.access, "label", messageAt(id));
+			await writeLabels(writes, {
+				identity,
+				authorized,
+				set,
+				unset
+			});
+			return { ok: true };
+		},
+		async schedule(caller, parsed) {
+			const identity = await identityOf(caller);
+			const body = {
+				...parsed,
+				re: parsed.re === void 0 ? void 0 : messageAt(parsed.re)
+			};
+			await authorizePost(writes, identity.principal.access, body);
+			const attachments = await attachmentsFor(identity.principal, body.attachments);
+			return schedules.create(identity, body, attachments);
+		},
+		async schedules(caller, query) {
+			const { principal, actor } = await identityOf(caller);
+			let root;
+			if (query.re !== void 0) {
+				const at = messageAt(query.re);
+				root = (await authorizeMessage(writes, principal.access, "read", at)).message.re ?? at;
+			}
+			const visible = (schedule) => principal.access.readable(schedule.channel) || createdBy(schedule, principal);
+			return { schedules: (await schedules.list({
+				...query,
+				...root !== void 0 ? { root } : {}
+			}, visible)).map((schedule) => blindSchedule(schedule, principal.access, actor.id)) };
+		},
+		async cancelSchedule(caller, { id }) {
+			const identity = await identityOf(caller);
+			const answer = await schedules.cancel(identity, scheduleAt(id));
+			return {
+				...answer,
+				schedule: blindSchedule(answer.schedule, identity.principal.access, identity.actor.id)
+			};
+		},
+		async upload(caller, { data, name, type }) {
+			const { principal } = await identityOf(caller);
+			if (!principal.access.anywhere("post") && !principal.access.anywhere("sync")) throw forbidden("this token can't post anywhere, so it can't upload");
+			const max = ownSync(caller) ? IMPORT_BYTES_MAX : ATTACHMENT_BYTES_MAX;
+			return { attachment: await writeUpload(blob, {
+				data,
+				name,
+				type,
+				uploadedBy: principal.id
+			}, max) };
+		},
+		async uploadStart(caller, { name, type, size }) {
+			const { principal } = await identityOf(caller);
+			if (!principal.access.anywhere("post") && !principal.access.anywhere("sync")) throw forbidden("this token can't post anywhere, so it can't upload");
+			return startUpload(blob, {
+				name: name ?? null,
+				type: type ?? null,
+				size,
+				uploadedBy: principal.id
+			});
+		},
+		async uploadFinish(caller, { id }) {
+			const { principal } = await identityOf(caller);
+			return { attachment: await finishUpload(blob, id, principal.id) };
+		},
+		async attachment(caller, { id }) {
+			const { principal } = await identityOf(caller);
+			const { attachment, uploadedBy } = await readUpload(blob, id);
+			if (!await attachmentReadable(principal, attachment.id, uploadedBy)) throw attachmentNotFound(attachment.id);
+			return {
+				attachment,
+				data: await attachmentBody(blob, attachment.id)
+			};
+		},
+		async watchers(caller) {
+			const { principal } = await identityOf(caller);
+			const all = await registry.list();
+			return { watchers: principal.access.everywhere("manage") ? all : all.filter((found) => found.owner === principal.id) };
+		},
+		async register(caller, body) {
+			const { principal } = await identityOf(caller);
+			ownWatchers(principal);
+			if (!principal.access.anywhere("read")) throw forbidden("this token can't read anywhere, so a watcher it registers would see nothing");
+			if ((body.sync?.length ?? 0) > 0 && !principal.access.anywhere("sync")) throw forbidden("this token can't register a sync: it needs sync somewhere");
+			const taken = body.sync?.find((entry) => binding.sync.some((own) => own.key === entry.key));
+			if (taken) throw new HttpError(409, "sync_key_taken", `this board's own sync has sync entry ${taken.key}: give yours another key`);
+			for (const [id, spec] of Object.entries(body.watch)) {
+				const name = RemoteWatcherId.safeParse(id);
+				if (!name.success) throw badRequest(`watch ${id}: ${name.error.issues[0].message}`, "bad_watcher");
+				try {
+					compileWatcher(id, spec);
+				} catch (error) {
+					throw badRequest(error.message, "bad_watcher");
+				}
+			}
+			const registered = await registry.register(storedPrincipal(principal), {
+				url: body.url ?? null,
+				watch: body.watch,
+				sync: body.sync ?? []
+			});
+			const queue = queueOf(principal.id);
+			if ((await queue.state(queueReducer)).state.unreachable) await queue.append({
+				type: "watch.reachable",
+				payload: { by: "registration" }
+			});
+			return registered;
+		},
+		async matches(caller, query, signal) {
+			const { principal } = await identityOf(caller);
+			ownWatchers(principal);
+			if (!(await registry.state()).byOwner[principal.id]) throw notFound("this token has no watchers registered here", "no_registration");
+			const queue = queueOf(principal.id);
+			const pulling = {
+				access: principal.access,
+				limit: query.limit ?? 10,
+				timers: options.scheduler !== void 0
+			};
+			const deadline = Date.now() + (query.wait ?? 0) * 1e3;
+			for (let pause = 100;; pause = Math.min(pause * 2, 1e3)) {
+				const matches = await pull(queue, {
+					...pulling,
+					now: Date.now()
+				});
+				if (matches.length > 0) {
+					const reader = await reads.readerOf(principal.access, matches.flatMap((match) => viewLinkedIds(match.event)));
+					return { matches: matches.map((match) => ({
+						...match,
+						event: viewedBy(match.event, reader)
+					})) };
+				}
+				if (Date.now() >= deadline || signal.aborted) return { matches };
+				await new Promise((resolve) => setTimeout(resolve, Math.min(pause, Math.max(0, deadline - Date.now()))));
+			}
+		},
+		async ack(caller, { id, ...body }) {
+			const { principal } = await identityOf(caller);
+			ownWatchers(principal);
+			const result = await ack(queueOf(principal.id), id, body, {
+				now: Date.now(),
+				timers: options.scheduler !== void 0
+			});
+			if (result === "gone") throw notFound(`no match ${id} is waiting for this token`, "no_match");
+			if (result === "stale") throw new HttpError(409, "stale_lease", "that lease ran out, and the match was pulled again");
+			return { ok: true };
+		},
+		async events(caller, query, signal) {
+			const { principal, actor } = await identityOf(caller);
+			const after = query.after !== void 0 ? cursorAt(query.after) : void 0;
+			const { state: actors } = await session.state(actorsReducer);
+			const feed = {
+				session,
+				reads,
+				after,
+				filters: query,
+				all: query.all ?? false,
+				me: actor.id,
+				actors,
+				access: principal.access
+			};
+			const { events, cursor } = await pollFeed(feed, (query.wait ?? 0) * 1e3, signal);
+			return {
+				events,
+				cursor: ref(cursor)
+			};
+		},
+		async typing(caller, { id, status }, signal) {
+			const { principal } = await identityOf(caller);
+			const found = await reads.message(messageAt(id), signal);
+			if (!found || found.deleted || !principal.access.readable(found.channel)) throw notFound(`message not found: #${id}`, "message_not_found");
+			if (!principal.access.can("post", found.channel)) throw forbidden(`this token can't post in ${found.channel}`);
+			const { message, replies } = await methods.message(caller, { id }, signal);
+			return { targets: await binding.typing([message, ...replies], status) };
+		},
+		async readSource(caller, { key, target, limit }) {
+			if (!binding.sync.some((entry) => entry.key === key)) throw notFound(`this board doesn't run sync entry ${key}: read it where its sync runs`, "not_synced_here");
+			const { principal } = await identityOf(caller);
+			if (!principal.access.everywhere("manage")) throw forbidden("this token can't read a source: it needs manage in every channel");
+			return binding.readSource(key, target, limit ?? 50);
+		},
+		async syncImport(caller, body, signal) {
+			const { principal } = await needSync(caller, "import", true);
+			await speaksFor(caller, principal.id, body.author, body.op === "seen" ? null : body.from);
+			const author = externalIdentity(body.author, recordsActors(caller, principal));
+			if (body.op === "seen") {
+				const { state: actors } = await session.state(actorsReducer);
+				const seen = author.records === false ? null : actorSeen(author.actor, actors);
+				if (seen) await session.append(seen);
+				return { message: null };
+			}
+			const may = (channel) => principal.access.can("sync", channel);
+			if (body.op === "post") {
+				if (body.channel === void 0 === (body.re === void 0)) throw badRequest("an import needs `channel`; a reply needs `re`");
+				let re;
+				let root = null;
+				let channel = body.channel;
+				if (body.re !== void 0) {
+					re = messageAt(body.re);
+					root = await reads.message(re);
+					if (!root || !principal.access.readable(root.channel)) throw notFound(`message not found: #${body.re}`, "message_not_found");
+					channel = root.channel;
+				}
+				if (!may(channel)) throw forbidden(`this token can't sync in ${channel}, so it can't import there`);
+				const id = body.id === void 0 ? void 0 : importId(caller, principal.id, body.id);
+				const attachments = await attachmentsFor(principal, body.attachments);
+				const commit = async ({ text, labels }) => {
+					const proofs = await trusted.post(writes, {
+						channel: body.channel,
+						re,
+						labels
+					});
+					return (await writePost(writes, {
+						identity: author,
+						proofs,
+						channel: body.channel,
+						re,
+						text,
+						labels,
+						noSync: body.noSync,
+						id,
+						origin: body.origin,
+						from: body.from,
+						...body.origin && !ownSync(caller) ? { importedBy: principal.id } : {},
+						lenientMentions: true,
+						attachments,
+						links: await linksOf(principal, body.links),
+						config: caller.origin.config
+					})).id;
+				};
+				const write = {
+					text: body.text,
+					labels: body.labels ?? {}
+				};
+				if (id !== void 0 && await reads.byEventId(id, signal)) return { message: await commit(write) };
+				if (body.origin) await claimable(body.origin, body.from, root?.thread ?? null);
+				await checkSource(caller, principal.id, body.source);
+				return { message: await commit(write) };
+			}
+			if (body.origin === void 0 === (body.message === void 0)) throw badRequest("a change names its message by `origin` or by `message`, one or the other");
+			const id = body.origin !== void 0 ? await locate(body.origin) : indexOf(body.message);
+			const found = id === null || id === 0 ? null : await reads.message(id);
+			if (!found || !may(found.channel)) return { message: null };
+			const authorized = (permission) => trusted.message(writes, permission, found.id);
+			const asAuthor = body.origin === void 0;
+			if (body.op === "edit") {
+				const proof = await authorized("post");
+				const commit = async ({ text }) => {
+					await writeEdit(writes, {
+						identity: author,
+						authorized: proof,
+						text,
+						from: body.from,
+						asAuthor
+					});
+					return ref(found.id);
+				};
+				const write = {
+					kind: "edit",
+					id: ref(found.id),
+					channel: found.channel,
+					re: found.re === null ? null : ref(found.re),
+					text: body.text
+				};
+				if (!found.deleted && !(asAuthor && found.by.principal !== body.author.id)) await checkSource(caller, principal.id, body.source);
+				return { message: await commit(write) };
+			}
+			if (body.op === "delete") await writeDelete(writes, {
+				identity: author,
+				authorized: await authorized("post"),
+				from: body.from,
+				asAuthor
+			});
+			else if (body.op === "react") await writeReaction(writes, {
+				identity: author,
+				authorized: await authorized("react"),
+				emoji: body.emoji,
+				remove: body.remove ?? false,
+				from: body.from
+			});
+			else if (body.op === "labels") await writeLabels(writes, {
+				identity: author,
+				authorized: await authorized("label"),
+				set: body.set,
+				unset: body.unset
+			});
+			else await writeLinks(writes, {
+				identity: author,
+				authorized: await authorized("post"),
+				links: await linksOf(principal, body.links) ?? [],
+				from: body.from
+			});
+			return { message: ref(found.id) };
+		},
+		async syncReceipt(caller, body) {
+			const identity = await identityOf(caller);
+			unnarrowed(identity.principal, "record what it synced");
+			const authorized = await authorizeMessage(writes, identity.principal.access, "sync", messageAt(body.message));
+			const { message } = authorized;
+			if (body.kind === "thread") return {
+				ok: true,
+				...await writeAttach(writes, {
+					identity,
+					authorized,
+					target: {
+						target: body.target,
+						kind: body.targetKind
+					},
+					cause: body.cause
+				})
+			};
+			await deliverable(caller, identity.principal.id, message, body.target, body.kind === "message" ? body.external : void 0);
+			const about = {
+				id: message.id,
+				thread: message.thread,
+				target: body.target
+			};
+			const by = ownSync(caller) ? {} : { syncedBy: identity.principal.id };
+			if (body.kind === "message") await receipt(caller, `receipt:${message.id}:${body.target}`, [{
+				type: "message.synced",
+				payload: {
+					...about,
+					external: body.external,
+					...by
+				}
+			}, ...body.files !== void 0 ? [{
+				type: "message.files_synced",
+				payload: {
+					...about,
+					files: body.files,
+					...by
+				}
+			}] : []]);
+			else if (body.kind === "files") await receipt(caller, `files:${message.id}:${body.target}`, [{
+				type: "message.files_synced",
+				payload: {
+					...about,
+					files: body.files,
+					...by
+				}
+			}]);
+			else await receipt(caller, `failed:${message.id}:${body.target}`, [{
+				type: "message.sync_failed",
+				payload: {
+					...about,
+					error: body.error
+				}
+			}]);
+			return { ok: true };
+		},
+		async syncThread(caller, { thread }) {
+			const { principal } = await needSync(caller, "look up a sync");
+			await reads.ensure();
+			const synced = await store.tables.syncOf(thread);
+			if (!synced || !principal.access.can("sync", synced.channel)) throw notFound(`no thread ${thread} on this board`, "thread_not_found");
+			return {
+				thread,
+				root: ref(synced.root),
+				channel: synced.channel,
+				targets: [...synced.targets],
+				external: { ...synced.external }
+			};
+		},
+		async syncFind(caller, query, signal) {
+			const { principal } = await needSync(caller, "look up a sync");
+			const { tables } = store;
+			let thread = null;
+			let message = null;
+			let holder = null;
+			if (query.code !== void 0) {
+				const issued = (await codes.state(identityCodesReducer)).state[hashCode(query.code)];
+				const keys = new Set((await entriesOf(caller, principal.id)).map((entry) => entry.key));
+				if (issued && issued.usedBy === null && Date.parse(issued.expiresAt) >= Date.now() && keys.has(issued.sync)) holder = issued.principal;
+			}
+			if (query.post !== void 0) {
+				const landed = await reads.byEventId(importId(caller, principal.id, query.post), signal);
+				if (landed && principal.access.can("sync", landed.channel)) message = ref(landed.id);
+			}
+			if (query.thread !== void 0) {
+				let key = query.message === void 0 ? await tables.threadOf(query.thread) : null;
+				if (key === null) {
+					await reads.ensure(void 0, signal);
+					key = await tables.threadOf(query.thread);
+				}
+				const synced = key === null ? null : await tables.syncOf(key);
+				if (synced && principal.access.can("sync", synced.channel)) thread = key;
+				if (query.message !== void 0) {
+					const id = await tables.messageOf(query.thread, query.message);
+					const found = id === null ? null : await tables.message(id);
+					if (found && principal.access.can("sync", found.channel)) message = ref(found.id);
+				}
+			}
+			const { state: actors } = query.account !== void 0 || query.person !== void 0 ? await session.state(actorsReducer) : { state: null };
+			const platforms = actors ? (await entriesOf(caller, principal.id)).map((entry) => `${entry.platform}:`) : [];
+			const ours = (account) => platforms.some((platform) => account.startsWith(platform));
+			const link = query.account !== void 0 && ours(query.account) ? actors?.links[query.account] : void 0;
+			return {
+				thread,
+				message,
+				person: link ? {
+					id: link.to,
+					method: link.method
+				} : null,
+				accounts: query.person === void 0 || !actors ? [] : linkedTo(actors, query.person).filter(ours).map((id) => ({
+					id,
+					method: actors.links[id].method
+				})),
+				holder
+			};
+		},
+		async syncCopies(caller, query) {
+			const { principal } = await needSync(caller, "look up a sync");
+			await reads.ensure();
+			const ids = [...new Set(query.message.map(indexOf).filter((id) => id !== null && id > 0))];
+			const everywhere = principal.access.everywhere("sync");
+			const [copies, messages] = await Promise.all([store.tables.copiesOf(ids), everywhere ? null : store.tables.messagesAt(ids, await store.tables.position())]);
+			const own = ownSync(caller);
+			const mine = (copy) => own ? copy.by === void 0 : copy.by === principal.id;
+			const out = {};
+			for (const id of ids) {
+				const found = messages?.get(id);
+				if (everywhere || found && principal.access.can("sync", found.channel)) out[ref(id)] = Object.fromEntries(Object.entries(copies.get(id) ?? {}).filter(([, copy]) => mine(copy)).map(([target, { by: _by, ...copy }]) => [target, copy]));
+			}
+			return { copies: out };
+		},
+		async syncRoots(caller, { by, since }) {
+			const { principal } = await needSync(caller, "look up a sync");
+			await reads.ensure();
+			const roots = (await store.tables.recentRoots(by, since)).filter((root) => principal.access.can("sync", root.channel));
+			const { state: actors } = await session.state(actorsReducer);
+			const reader = await reads.reader(principal.access, roots);
+			return { roots: roots.map((root) => view(root, actors, reader)) };
+		},
+		async inboxPush(caller, { key, events }) {
+			const { principal } = await needSync(caller, "push to an inbox", true);
+			for (const { event } of events) for (const location of [
+				event.channel,
+				event.thread,
+				"subthread" in event ? event.subthread : null
+			]) if (location !== null && !location.startsWith(`${key}:`)) throw badRequest(`an inbox's platform locations belong to its sync key: ${location} isn't ${key}'s`);
+			if (ownSync(caller)) {
+				for (const { id, event, raw } of events) {
+					await openInbox(event.channel);
+					await inboxServer.session(inboxSession(event.channel)).append({
+						type: "external.received",
+						id: await idempotentId("board-inbox", key, id),
+						payload: {
+							sync: key,
+							event,
+							raw
+						}
+					});
+				}
+				return { ok: true };
+			}
+			const queue = queueOf(principal.id);
+			const matched = await Promise.all(events.map(async ({ id, event, raw }) => ({
+				type: "watch.matched",
+				id: await idempotentId("board-inbox", key, id),
+				payload: {
+					thread: event.thread,
+					inbox: key,
+					event: {
+						sync: key,
+						event,
+						raw
+					}
+				}
+			})));
+			await queue.append(...matched).catch(async (error) => {
+				if (!duplicate(error)) throw error;
+				for (const one of matched) await queue.append(one);
+			});
+			return { ok: true };
+		},
+		async inboxNext(caller, { key, limit }) {
+			if (ownSync(caller)) return { items: [] };
+			const { principal } = await needSync(caller, "pull from an inbox", true);
+			return { items: (await pullInbox(queueOf(principal.id), key, {
+				access: principal.access,
+				limit: limit ?? 10,
+				now: Date.now(),
+				timers: options.scheduler !== void 0
+			})).map(({ id, thread, lease, attempt, event }) => {
+				const item = event;
+				return {
+					id,
+					key,
+					thread,
+					lease,
+					attempt,
+					event: item.event,
+					raw: item.raw
+				};
+			}) };
+		},
+		async inboxAck(caller, { id, lease, error }) {
+			const { principal } = await needSync(caller, "ack an inbox event", true);
+			const result = await ack(queueOf(principal.id), id, {
+				lease,
+				error
+			}, {
+				now: Date.now(),
+				timers: options.scheduler !== void 0
+			});
+			if (result === "gone") throw notFound(`no inbox event ${id} is waiting for this token`, "no_item");
+			if (result === "stale") throw new HttpError(409, "stale_lease", "that lease ran out, and the event was pulled again");
+			return { ok: true };
+		},
+		async inbox(caller, { key, channel, limit }) {
+			const { principal } = await needSync(caller, "read an inbox");
+			const everywhere = principal.access.everywhere("sync");
+			const entries = [];
+			if (everywhere) {
+				const channels = channel !== void 0 ? [channel] : Object.keys((await inboxes.state(inboxesReducer)).state).filter((found) => found.startsWith(`${key}:`));
+				for (const found of channels) for (const event of await inboxServer.session(inboxSession(found)).history()) if (event.type === "external.received" && event.payload.sync === key) entries.push({
+					id: event.id,
+					channel: found,
+					createdAt: new Date(event.createdAt).toISOString(),
+					...event.payload
+				});
+			}
+			const pushers = /* @__PURE__ */ new Set([principal.id, ...everywhere ? Object.keys((await registry.state()).byOwner) : []]);
+			for (const pusher of pushers) for (const event of await queueOf(pusher).history()) {
+				const pushed = event.payload;
+				if (event.type !== "watch.matched" || pushed.inbox !== key || !pushed.event) continue;
+				if (channel !== void 0 && pushed.event.event.channel !== channel) continue;
+				entries.push({
+					id: event.id,
+					channel: pushed.event.event.channel,
+					createdAt: new Date(event.createdAt).toISOString(),
+					...pushed.event
+				});
+			}
+			return { events: entries.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)).slice(0, limit ?? 50) };
+		},
+		async syncCode(caller, { sync }) {
+			const identity = await identityOf(caller);
+			if (identity.principal.kind !== "person") throw forbidden("only people link platform accounts");
+			const entry = (await linkable()).find((candidate) => candidate.key === sync);
+			if (!entry) throw notFound(`no sync entry named ${sync}`);
+			const principal = identity.principal.id;
+			const code = newCode();
+			const expiresAt = new Date(Date.now() + CODE_TTL_MS).toISOString();
+			await codes.append({
+				type: "identity.code_issued",
+				payload: {
+					hash: hashCode(code),
+					principal,
+					sync,
+					expiresAt
+				}
+			});
+			const signIn = entry.signIn && entry.url !== null ? `${entry.url}/identity/sign-in?${new URLSearchParams({
+				sync,
+				code
+			})}` : null;
+			return {
+				code,
+				expiresAt,
+				...signIn ? { signIn } : {}
+			};
+		},
+		async syncAccount(caller, body) {
+			const { principal } = await needSync(caller, "link accounts", true);
+			const { account } = body;
+			await speaksFor(caller, principal.id, account, body.sync);
+			const hash = hashCode(body.code);
+			const issued = (await codes.state(identityCodesReducer)).state[hash];
+			const bad = () => notFound("that code isn't live: it expired, was used, or was issued for another sync entry", "bad_code");
+			if (!issued || issued.sync !== body.sync) throw bad();
+			const usedHere = (used) => used?.usedBy === account.id && used.usedIn === (body.message ?? null);
+			if (issued.usedBy === null ? Date.parse(issued.expiresAt) < Date.now() : !usedHere(issued)) throw bad();
+			await codes.append({
+				type: "identity.code_used",
+				id: `used:${hash}`,
+				payload: {
+					hash,
+					actor: account.id,
+					...body.message !== void 0 ? { message: body.message } : {}
+				}
+			});
+			if (!usedHere((await codes.state(identityCodesReducer)).state[hash])) throw bad();
+			const linked = externalIdentity(account, recordsActors(caller, principal));
+			return {
+				person: issued.principal,
+				link: await link(linked, issued.principal, body.method ?? "code", `link:${hash}`)
+			};
+		},
+		async syncUnlink(caller, { account }) {
+			const { principal, author } = await identityOf(caller);
+			const { state } = await session.state(actorsReducer);
+			const found = state.links[account];
+			if (!found || found.to !== principal.id && !principal.access.everywhere("sync")) throw notFound(`${account} isn't linked`, "not_linked");
+			await session.append({
+				type: "actor.unlinked",
+				payload: {
+					actor: account,
+					by: author
+				}
+			});
+			return { ok: true };
+		}
+	};
+	/**
+	* An import's client ID as the board keeps it. A sync elsewhere names its posts under its own
+	* principal, so it can't take an ID anyone else would use.
+	*/
+	function importId(caller, principal, id) {
+		return ownSync(caller) ? id : `sync:${principal}:${createHash("sha256").update(`board-sync\u001f${id}`).digest("hex").slice(0, 32)}`;
+	}
+	/**
+	* The sync entries a caller imports through: this board's own sync's, or what a sync elsewhere
+	* registered, but for a key this board's own sync has since taken: its platform locations are
+	* that sync's alone.
+	*/
+	async function entriesOf(caller, principal) {
+		if (ownSync(caller)) return binding.sync;
+		return ((await registry.state()).byOwner[principal]?.sync ?? []).filter((entry) => !binding.sync.some((own) => own.key === entry.key));
+	}
+	/**
+	* The sync entries this board links accounts on, by key, each with the URL where its sync runs,
+	* once that's known: its own sync's, then those of the syncs registered here that may still sync.
+	* A key its own sync has is its own. A key two registered syncs claim is neither's to sign people
+	* in for: a person links it by posting the code where either syncs.
+	*/
+	async function linkable() {
+		const found = /* @__PURE__ */ new Map();
+		for (const entry of binding.sync) found.set(entry.key, {
+			...entry,
+			url: binding.url()
+		});
+		const claimed = /* @__PURE__ */ new Map();
+		for (const registration of Object.values((await registry.state()).byOwner)) {
+			if (registration.sync.length === 0) continue;
+			if (!(await binding.accessNow(registration.principal))?.anywhere("sync")) continue;
+			for (const entry of registration.sync) if (!found.has(entry.key)) (claimed.get(entry.key) ?? claimed.set(entry.key, []).get(entry.key)).push({
+				...entry,
+				url: registration.url
+			});
+		}
+		for (const [key, claims] of claimed) found.set(key, claims.length === 1 ? claims[0] : {
+			...claims[0],
+			signIn: false,
+			url: null
+		});
+		return [...found.values()];
+	}
+	/**
+	* Whether a caller may write as, or link, `author`: a platform user, never anyone this board
+	* signs in, on a platform it syncs: the one of entry `from`, when it names one.
+	*/
+	async function speaksFor(caller, principal, author, from) {
+		if (authenticates(author.id) || await signedIn(author.id)) throw forbidden(`${author.id} is someone this board signs in, not a platform user: sync can't write as them`);
+		const entries = await entriesOf(caller, principal);
+		const platforms = (from === null ? entries : entries.filter((entry) => entry.key === from)).map((entry) => entry.platform);
+		if (from !== null && platforms.length === 0) throw forbidden(`this token doesn't sync ${from} here: its board registers its sync entries`);
+		if (!platforms.some((platform) => author.id.startsWith(`${platform}:`))) throw forbidden(`${author.id} isn't a user of ${platforms.length ? platforms.join(" or ") : "a platform this token syncs"}`);
+	}
+	/**
+	* Whether `id` is someone this board signs in that `authenticates` can't tell by its shape: a
+	* host's principal, which may take any ID and kind, and their agents (`<principal>+<profile>`).
+	* It is once it has registered (its watchers write as `<principal>+<id>`, which never wakes
+	* them), or written: the board records a host's principals and their profiles as the host's,
+	* whatever their kind, and anything else that writes as other than a platform user.
+	*/
+	async function signedIn(id) {
+		const plus = id.indexOf("+");
+		const owners = (await registry.state()).byOwner;
+		if (owners[id] || plus > 0 && owners[id.slice(0, plus)]) return true;
+		const { state: actors } = await session.state(actorsReducer);
+		return [id, plus > 0 ? id.slice(0, plus) : null].some((known) => {
+			const actor = known === null ? void 0 : actors.byId[known];
+			return actor !== void 0 && (actor.kind !== "external" || actor.host === true);
+		});
+	}
+	/**
+	* Refuses a caller narrowed with `x-board-scope` (a sandboxed agent, say): its principal's
+	* watchers are one registration, which its project registers and runs with the token it
+	* narrowed. A narrowed pull would take matches from it, and a narrowed register replace it.
+	*/
+	function ownWatchers(principal) {
+		if (principal.scope !== void 0) throw forbidden("this token is narrowed with x-board-scope: registering and running watchers is its project's job");
+	}
+	/**
+	* Whether a sync's writes keep the board's record of the platform users they're by (name and
+	* avatar), which every channel shows: this board's own sync's, and those of one that may sync in every
+	* channel. Anyone else's still carry their author, and leave the record as it is.
+	*/
+	function recordsActors(caller, principal) {
+		return ownSync(caller) || principal.access.everywhere("sync");
+	}
+	/**
+	* The caller, when it may sync somewhere: what every sync route needs. `records`: what it does
+	* keeps sync's records (imports, receipts, its inbox, links), which only an integration does,
+	* never a caller narrowed with `x-board-scope`.
+	*/
+	async function needSync(caller, what, records = false) {
+		const identity = await identityOf(caller);
+		if (!identity.principal.access.anywhere("sync")) throw forbidden(`this token can't ${what}: it needs sync`);
+		if (records) unnarrowed(identity.principal, what);
+		return identity;
+	}
+	/**
+	* Refuses a caller narrowed with `x-board-scope` what its principal's sync does: a platform
+	* thread or message it claimed for a channel in its scope would bring that sync's later events
+	* there, from wherever on the platform they are.
+	*/
+	function unnarrowed(principal, what) {
+		if (principal.scope !== void 0) throw forbidden(`this token is narrowed with x-board-scope, so it can't ${what}: that's its project's sync's job`);
+	}
+	/**
+	* Refuses a platform origin an import can't have. Sync's records map each platform thread and
+	* message to one board thread and message, board-wide, so taking one over would send what the
+	* platform says there to another channel: a new root's platform thread must be no board
+	* thread's yet, a reply's must be its own thread's, and its platform message no board message's.
+	* Its platform locations are under the sync key it came through.
+	*/
+	async function claimable(origin, from, thread) {
+		if (from === null) throw badRequest("an import with an origin names the sync key it came through: pass `from`");
+		for (const location of [
+			origin.channel,
+			origin.thread,
+			origin.subthread
+		]) if (location !== void 0 && location !== null && !location.startsWith(`${from}:`)) throw badRequest(`an import's platform locations belong to its sync key: ${location} isn't ${from}'s`);
+		if (origin.subthread != null && !origin.subthread.startsWith(`${origin.thread}:`)) throw badRequest(`an import's subthread is in its thread: ${origin.subthread} isn't in ${origin.thread}`);
+		await reads.ensure();
+		const owner = await store.tables.threadOf(origin.thread);
+		if (owner !== null && owner !== thread) throw new HttpError(409, "already_synced", `${origin.thread} is already synced with another thread`);
+		if (owner === null && thread !== null) throw new HttpError(409, "not_synced", `${origin.thread} isn't synced with this thread`);
+		const exact = origin.subthread ?? origin.thread;
+		if (await store.tables.messageOf(exact, origin.message) !== null) throw new HttpError(409, "already_synced", `${origin.message} in ${exact} is already on the board`);
+	}
+	/**
+	* Refuses a delivery receipt a caller's sync can't have made: one for a target of another sync's,
+	* or of none of its message's thread's, or one that says its message landed as a platform thread
+	* or message another board thread or message syncs with. Receipts map those board-wide.
+	*/
+	async function deliverable(caller, principal, message, target, external) {
+		const key = target.slice(0, target.indexOf(":"));
+		if (!(await entriesOf(caller, principal)).some((entry) => entry.key === key)) throw forbidden(`this token doesn't sync ${key} here: its board registers its sync entries`);
+		await reads.ensure();
+		if (!(await store.tables.syncOf(message.thread))?.targets.includes(target)) throw badRequest(`#${message.id}'s thread doesn't sync with ${target}`, "not_a_target");
+		if (!external) return;
+		if (!external.thread.startsWith(`${key}:`)) throw badRequest(`a delivery to ${target} lands under ${key}, not in ${external.thread}`);
+		const owner = await store.tables.threadOf(external.thread);
+		if (owner !== null && owner !== message.thread) throw new HttpError(409, "already_synced", `${external.thread} is already synced with another thread`);
+		const copy = await store.tables.messageOf(external.thread, external.message);
+		if (copy !== null && copy !== message.id) throw new HttpError(409, "already_synced", `${external.message} in ${external.thread} is another board message's`);
+	}
+	/** The board message an import changes: a platform message, or the root of the thread a platform thread belongs to. */
+	async function locate(origin) {
+		await reads.ensure();
+		if (origin.message !== void 0) return store.tables.messageOf(origin.thread, origin.message);
+		const thread = await store.tables.threadOf(origin.thread);
+		return thread === null ? null : (await store.tables.syncOf(thread))?.root ?? null;
+	}
+	/**
+	* An import's links, as the board keeps them. One names a board message only if the importer
+	* may read it, and then says what the board's own copy says, never what the import does: its
+	* readers see that snapshot as the message's. Any other keeps its URL, and the platform's
+	* snapshot if it came with one.
+	*/
+	async function linksOf(principal, links) {
+		if (!links) return void 0;
+		const { state: actors } = await session.state(actorsReducer);
+		return Promise.all(links.map(async ({ message: ref, ...link }) => {
+			const id = ref === null ? null : indexOf(ref);
+			const found = id === null || id === 0 ? null : await reads.message(id);
+			if (!found || found.deleted || !principal.access.readable(found.channel)) return {
+				...link,
+				message: null
+			};
+			const snapshot = {
+				author: actors.byId[found.by.actor]?.name ?? found.by.actor,
+				text: found.text,
+				createdAt: found.createdAt,
+				files: found.attachments.map((file) => ({
+					name: file.name,
+					url: null
+				}))
+			};
+			return {
+				url: link.url,
+				message: found.id,
+				snapshot,
+				unavailable: null
+			};
+		}));
+	}
+	/**
+	* A receipt. This board's own sync, while it delivers here, appends it as its consumer, keyed by
+	* `key`: a retry after a crash lands it once, and an attempt that was taken over can't. Anyone
+	* else's lands once by `key`.
+	*/
+	async function receipt(caller, key, events) {
+		const ctx = delivering.getStore();
+		if (ctx && ownSync(caller)) {
+			await ctx.session.append(key, ...events);
+			return;
+		}
+		for (const [i, event] of events.entries()) await session.append({
+			...event,
+			id: await idempotentId("board-receipt", key, String(i))
+		}).catch((error) => {
+			if (!duplicate(error)) throw error;
+		});
+	}
+	/** Records that the inbox for `channel` exists, the first time anything lands in it. */
+	async function openInbox(channel) {
+		if (opened.has(channel)) return;
+		if (!(await inboxes.state(inboxesReducer)).state[channel]) await inboxes.append({
+			type: "inbox.opened",
+			id: await idempotentId("board-inbox", "opened", channel),
+			payload: { channel }
+		});
+		opened.add(channel);
+	}
+	/** Records that platform user `identity` is `to`, unless it already is. `id` makes a retry a no-op. */
+	async function link(identity, to, method, id) {
+		const { actor: account, author: by } = identity;
+		const { state: actors } = await session.state(actorsReducer);
+		const seen = identity.records === false ? null : actorSeen(account, actors);
+		const existing = actors.links[account.id];
+		if (existing?.to === to && !id) {
+			if (seen) await session.append(seen);
+			return {
+				actor: account.id,
+				handle: account.handle,
+				name: account.name,
+				method: existing.method,
+				at: existing.at
+			};
+		}
+		await session.append(...seen ? [{
+			...seen,
+			...id ? { id: `${id}:seen` } : {}
+		}] : [], {
+			type: "actor.linked",
+			...id ? { id } : {},
+			payload: {
+				actor: account.id,
+				to,
+				method,
+				by
+			}
+		});
+		return {
+			actor: account.id,
+			handle: account.handle,
+			name: account.name,
+			method,
+			at: (/* @__PURE__ */ new Date()).toISOString()
+		};
+	}
+	const servers = [
+		server,
+		inboxServer,
+		schedules.server,
+		registry.server,
+		watchers.server
+	];
+	return {
+		methods,
+		schedules,
+		/** The scheduler's callback, for every A2 server behind the board. */
+		scheduler: options.scheduler ? options.scheduler.handler(...servers) : async (_request) => toErrorResponse(notFound("this board has no scheduler")),
+		servers,
+		session,
+		store
+	};
+}
+/**
+* The board in this deployment, on A2's log: its store (SQLite at `.a2/dev.db` by default), and
+* optionally a scheduler and somewhere for files. It's the backend itself: pass it to
+* `board({ backend })`, and mount its `scheduler` in a route of its own. It trusts the callers
+* board() verified; what it does outside requests, it asks board()'s policy about and writes
+* through board(). Nothing is built or connected until board() binds it, and the default store
+* opens on the first call.
+*/
+function a2(options = {}) {
+	let binding = null;
+	let built = null;
+	let opening = null;
+	/** What's built, for what can't wait for the default store to open. */
+	const now = () => {
+		if (built) return built;
+		if (!binding) throw new Error("a2: this backend isn't serving a board yet: pass it to board({ backend })");
+		throw new Error("a2: its default store opens on the board's first request: pass a store to reach it before that");
+	};
+	const ready = async () => {
+		if (!built) {
+			if (!binding) throw new Error("a2: this backend isn't serving a board yet: pass it to board({ backend })");
+			const bound = binding;
+			opening ??= defaultStore().then((store) => built ??= build({
+				...options,
+				store
+			}, bound));
+			opening.catch(() => opening = null);
+			await opening;
+		}
+		built.schedules.catchUp();
+		return built;
+	};
+	const backend = {
+		...Object.fromEntries(METHODS.map((name) => [name, async (caller, input, signal) => (await ready()).methods[name](caller, input, signal)])),
+		routes: [],
+		keeps: true,
+		bind(given) {
+			if (binding) throw new Error("a2: this backend already serves a board: create one a2() per board()");
+			binding = given;
+			if (options.store) built = build({
+				...options,
+				store: options.store
+			}, given);
+		},
+		/** The scheduler's callback: `export { scheduler as POST }` from a route of its own. A board without a scheduler answers 404. */
+		scheduler: async (request) => (await ready()).scheduler(request),
+		/** The A2 servers behind this board, to share one scheduler with other A2 servers. */
+		get servers() {
+			return now().servers;
+		},
+		/** For tests and tools. */
+		get session() {
+			return now().session;
+		},
+		get store() {
+			return now().store;
+		}
+	};
+	for (const key of [
+		"servers",
+		"session",
+		"store"
+	]) Object.defineProperty(backend, key, { enumerable: false });
+	return backend;
+}
+//#endregion
+export { fsBlob as n, memoryBlob as r, a2 as t };