@vercel/board 0.0.0 → 0.15.0

package/dist/watch-spec-W0c7ypHJ.mjs

@@ -0,0 +1,787 @@
+import { n as DIRECT_UPLOAD_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import { S as storable, a as AttachmentId, c as ChannelPath, d as LabelKey, g as MessageText, l as Emoji, m as MESSAGE_TEXT_MAX, n as ActorId, p as Labels, x as platformAvatar } from "./schemas-Be08nyfW.mjs";
+import { a as ExternalTarget, c as Link, l as Origin, n as ExternalAuthor, r as ExternalEvent } from "./contract-CuJmlrhw.mjs";
+import { z } from "zod";
+//#region src/api/routes.ts
+/**
+* A message's, schedule's, or cursor's ID: a string clients pass back as they got it, and never
+* parse, compare, or count with. Each backend picks its own; a board on `a2()` writes decimals.
+*/
+const Ref = z.string().min(1).max(128);
+const id = Ref;
+const repeated = z.union([z.string(), z.array(z.string())]).transform((value) => Array.isArray(value) ? value : [value]);
+/**
+* `pr` → `['pr', null]` (has the label), `status=open` → `['status', ['open']]`,
+* `state=open|draft` → either value.
+*/
+const LabelFilter = z.string().regex(/^[a-z0-9][a-z0-9_.-]*(=.*)?$/, "label filters look like key, key=value, or key=a|b").transform((value) => {
+	const at = value.indexOf("=");
+	return at === -1 ? [value, null] : [value.slice(0, at), value.slice(at + 1).split("|")];
+});
+/** A sync target as the board that syncs it resolved it: a platform channel to start a thread in, or a thread to join. */
+const ResolvedSyncTarget = z.object({
+	target: ExternalTarget,
+	kind: z.enum(["channel", "thread"])
+});
+/** Shared by `/messages` and `/events`. */
+const Filters = z.object({
+	channel: z.string().optional(),
+	re: id.optional(),
+	by: z.string().optional(),
+	mentions: z.string().optional(),
+	label: repeated.pipe(z.array(LabelFilter)).optional(),
+	/** Where messages came from: a sync key such as `slack`, or `board` for the board itself. */
+	from: z.string().min(1).max(64).optional(),
+	/** Case-insensitive words the text contains. */
+	text: z.string().min(1).max(200).optional()
+});
+const MessagesQuery = Filters.extend({
+	after: Ref.optional(),
+	before: id.optional(),
+	limit: z.coerce.number().int().min(1).max(500).optional()
+});
+/** `limit` counts threads: each thread with a matching message, by its latest reply. */
+const ThreadsQuery = Filters.extend({
+	after: Ref.optional(),
+	limit: z.coerce.number().int().min(1).max(500).optional()
+});
+const EventsQuery = Filters.extend({
+	after: Ref.optional(),
+	wait: z.coerce.number().min(0).max(300).optional(),
+	all: z.coerce.boolean().optional()
+});
+const PostBody = z.object({
+	channel: ChannelPath.optional(),
+	re: Ref.optional(),
+	/** May be empty when the message has attachments. */
+	text: z.string().max(MESSAGE_TEXT_MAX).default(""),
+	labels: Labels.optional(),
+	noSync: z.boolean().optional(),
+	/**
+	* External targets a new thread starts with: `slack:#incidents`, `github:owner/repo:12`. The
+	* board that syncs a target resolves it to `{ target, kind }`, which a board elsewhere takes as is.
+	*/
+	sync: z.array(z.union([z.string().min(3).max(300), ResolvedSyncTarget])).max(10).optional(),
+	id: z.string().min(1).max(200).refine(storable, "id has a NUL character or a lone surrogate").optional(),
+	/** IDs from `POST /attachments`. */
+	attachments: z.array(AttachmentId).max(10).optional()
+}).refine((body) => body.text.trim().length > 0 || (body.attachments?.length ?? 0) > 0, {
+	message: "message text is empty",
+	path: ["text"]
+}).refine((body) => body.channel === void 0 !== (body.re === void 0), { message: "a post needs `channel`; a reply needs `re`" }).refine((body) => !(body.noSync && body.sync?.length), { message: "`noSync` and `sync` contradict each other" });
+/** `30m`, `1d`: a number and a unit, `s`, `m`, `h`, or `d`. */
+const Duration = z.string().regex(/^\d+(\.\d+)?(s|m|h|d)$/, "durations look like 30s, 30m, 12h, or 1d");
+const Instant = z.string().datetime({ offset: true });
+/**
+* A message to post later, as the caller: once (`in` or `at`), or repeating
+* (`every`, starting `at` or `in` from now, or one `every` from now), until
+* `until`, `for` after the first send, or `times` sends. A repeat with no stop
+* runs until it's canceled.
+*/
+const ScheduleBody = z.object({
+	channel: ChannelPath.optional(),
+	re: Ref.optional(),
+	text: z.string().max(MESSAGE_TEXT_MAX).default(""),
+	labels: Labels.optional(),
+	noSync: z.boolean().optional(),
+	attachments: z.array(AttachmentId).max(10).optional(),
+	in: Duration.optional(),
+	at: Instant.optional(),
+	every: Duration.optional(),
+	until: Instant.optional(),
+	for: Duration.optional(),
+	times: z.number().int().positive().optional()
+}).refine((body) => body.text.trim().length > 0 || (body.attachments?.length ?? 0) > 0, {
+	message: "message text is empty",
+	path: ["text"]
+}).refine((body) => body.channel === void 0 !== (body.re === void 0), { message: "a schedule needs `channel` for a new thread, or `re` for a reply" }).refine((body) => body.in !== void 0 || body.at !== void 0 || body.every !== void 0, { message: "say when: `in`, `at`, or `every`" }).refine((body) => !(body.in !== void 0 && body.at !== void 0), { message: "`in` and `at` contradict each other" }).refine((body) => [
+	body.until,
+	body.for,
+	body.times
+].filter((v) => v !== void 0).length <= 1, { message: "pick one stop: `until`, `for`, or `times`" }).refine((body) => body.every !== void 0 || body.until === void 0 && body.for === void 0 && body.times === void 0, { message: "`until`, `for`, and `times` stop a repeat: add `every`" });
+const SchedulesQuery = z.object({
+	/** Any message in a thread: the schedules that reply in it. */
+	re: id.optional(),
+	channel: z.string().optional(),
+	/** An actor ID or handle: the schedules it created. */
+	by: z.string().optional(),
+	/** Include done and canceled schedules. */
+	all: z.coerce.boolean().optional()
+});
+const SyncBody = z.object({ target: z.string().min(3).max(300) });
+const InboxQuery = z.object({
+	channel: z.string().optional(),
+	limit: z.coerce.number().int().min(1).max(500).optional()
+});
+/** What a board on `http()` registers with the board it uses: its watchers' tails, and where to wake it. */
+const RegisterBody = z.object({
+	/** Without one, the board pulls on its own instead of being woken. */
+	url: z.string().url().max(500).refine((url) => /^https:\/\//.test(url), "wake-ups go over https").transform((url) => url.replace(/\/+$/, "")).nullable().optional(),
+	watch: z.record(z.string().max(100), z.object({
+		tail: z.string().max(1e3),
+		when: z.enum(["matches", "enters"]).default("matches")
+	})).refine((watch) => Object.keys(watch).length <= 32, `a board registers at most 32 watchers`),
+	/**
+	* Its sync entries: its sync subscribes too, to every post, change, and thread sync in the channels
+	* where it may sync, and the board lists the entries and links accounts on them.
+	*/
+	sync: z.array(z.object({
+		key: z.string().min(1).max(64),
+		platform: z.string().min(1).max(64),
+		signIn: z.boolean().default(false)
+	})).max(32).optional()
+});
+/** A pull of the caller's matches: at most `limit`, waiting up to `wait` seconds for one. */
+const MatchesQuery = z.object({
+	limit: z.coerce.number().int().min(1).max(50).optional(),
+	wait: z.coerce.number().min(0).max(25).optional()
+});
+/** How a pulled match went: its lease, and an error to try again, or `skip` to drop it. */
+const AckBody = z.object({
+	lease: z.string().min(1).max(64),
+	error: z.string().min(1).max(500).optional(),
+	skip: z.boolean().optional()
+});
+/**
+* What to read from a platform without syncing it: a channel (`#name` or an ID),
+* a thread (`C0123:1727000000.123456`), or a message permalink (its thread).
+*/
+const SourceReadQuery = z.object({
+	target: z.string().min(1).max(4e3),
+	limit: z.coerce.number().int().min(1).max(200).optional()
+});
+const IdentityUnlinkBody = z.object({ actor: z.string().min(1).max(256) });
+/** A sync entry's key: `slack`, `github`. */
+const SyncKey = z.string().min(1).max(64);
+/** A platform message an import changes, by its platform thread and ID; without a message, the root of the board thread the platform thread belongs to. */
+const ImportOrigin = z.object({
+	thread: ExternalTarget,
+	message: z.string().min(1).max(300).optional()
+});
+/** A link as an import carries it: a board message it names is a ref. */
+const ImportLink = Link.extend({ message: Ref.nullable() });
+/**
+* A platform user, as sync names them to the board. Their avatar shows wherever they do, so one
+* that isn't an https URL is dropped, never refused: the write lands without it.
+*/
+const PlatformUser = ExternalAuthor.extend({ avatar: z.string().nullable().transform(platformAvatar) });
+/**
+* Who wrote it on the platform, and the sync key it came through: null for a write a sync callback
+* makes as that user, which syncs out to every platform like one written on the board.
+*/
+const Imported = {
+	author: PlatformUser,
+	from: SyncKey.nullable()
+};
+/**
+* Where the platform event an import comes from is: its sync entry, platform channel, and thread.
+* The middleware is told, and answers there when it drops the write.
+*/
+const ImportSource = z.object({
+	key: SyncKey,
+	channel: ExternalTarget,
+	thread: ExternalTarget
+});
+/** The message a change is about: by its platform IDs (`origin`), or by its board ID (`message`), one or the other. */
+const Changed = {
+	origin: ImportOrigin.optional(),
+	message: Ref.optional()
+};
+/**
+* A platform's write, as its platform author, with where it came from: only a caller with `sync` in
+* the channel it lands in may make one. Posts are idempotent by `id`, derived from the platform
+* event; every other op finds the message it changes from its `origin`.
+*/
+const SyncImportBody = z.discriminatedUnion("op", [
+	z.object({
+		op: z.literal("post"),
+		...Imported,
+		/** Where it is on the platform. Null for a write a sync callback makes itself. */
+		origin: Origin.nullable().default(null),
+		source: ImportSource.optional(),
+		channel: ChannelPath.optional(),
+		re: Ref.optional(),
+		text: z.string().max(MESSAGE_TEXT_MAX).default(""),
+		labels: Labels.optional(),
+		noSync: z.boolean().optional(),
+		attachments: z.array(AttachmentId).max(10).optional(),
+		links: z.array(ImportLink).max(10).optional(),
+		id: z.string().min(1).max(200).refine(storable, "id has a NUL character or a lone surrogate").optional()
+	}),
+	z.object({
+		op: z.literal("edit"),
+		...Imported,
+		...Changed,
+		text: MessageText,
+		source: ImportSource.optional()
+	}),
+	z.object({
+		op: z.literal("delete"),
+		...Imported,
+		...Changed
+	}),
+	z.object({
+		op: z.literal("react"),
+		...Imported,
+		...Changed,
+		emoji: Emoji,
+		remove: z.boolean().optional()
+	}),
+	z.object({
+		op: z.literal("labels"),
+		...Imported,
+		...Changed,
+		set: Labels.optional(),
+		unset: z.array(LabelKey).optional()
+	}),
+	z.object({
+		op: z.literal("links"),
+		...Imported,
+		...Changed,
+		links: z.array(ImportLink).max(10)
+	}),
+	z.object({
+		op: z.literal("seen"),
+		author: PlatformUser
+	})
+]);
+const PlatformFiles = z.array(z.string().min(1).max(300)).max(10).nullable();
+/** What sync did on a platform, about a board message: it landed, its files did, it gave up, or its thread syncs with a target. */
+const SyncReceiptBody = z.discriminatedUnion("kind", [
+	z.object({
+		kind: z.literal("message"),
+		message: Ref,
+		target: ExternalTarget,
+		external: z.object({
+			thread: ExternalTarget,
+			message: z.string().min(1).max(300),
+			asUser: z.literal(true).optional()
+		}),
+		/** Its files, when they went with it: the platform's IDs, or null when it refused them. */
+		files: PlatformFiles.optional()
+	}),
+	z.object({
+		kind: z.literal("files"),
+		message: Ref,
+		target: ExternalTarget,
+		files: PlatformFiles
+	}),
+	z.object({
+		kind: z.literal("failed"),
+		message: Ref,
+		target: ExternalTarget,
+		error: z.string().min(1).max(500)
+	}),
+	z.object({
+		kind: z.literal("thread"),
+		/** Any message in the thread. */
+		message: Ref,
+		target: ExternalTarget,
+		/** A channel to start a thread in, or a thread to join. */
+		targetKind: z.enum(["channel", "thread"]),
+		cause: z.enum(["config", "request"])
+	})
+]);
+/** What sync looks up by platform ID: a thread or message, who an account is, and a person's accounts. */
+const SyncFindQuery = z.object({
+	/** A live one-time code: who it was issued to, for a sign-in that carries it. */
+	code: z.string().min(1).max(64).optional(),
+	/** The post the caller's sync imported with this client ID. */
+	post: z.string().min(1).max(200).optional(),
+	thread: ExternalTarget.optional(),
+	/** With `thread`: the platform message in it. */
+	message: z.string().min(1).max(300).optional(),
+	account: ActorId.optional(),
+	person: ActorId.optional()
+});
+const SyncCopiesQuery = z.object({ message: repeated.pipe(z.array(Ref).min(1).max(100)) });
+/** A person's own roots since `since`, in epoch milliseconds. */
+const SyncRootsQuery = z.object({
+	by: ActorId,
+	since: z.coerce.number().int().nonnegative()
+});
+/** Platform events for a sync key's inbox, each with the platform's own ID for it, which dedupes it. */
+const InboxPushBody = z.object({ events: z.array(z.object({
+	id: z.string().min(1).max(300),
+	event: ExternalEvent,
+	raw: z.unknown()
+})).min(1).max(50) });
+const InboxNextQuery = z.object({ limit: z.coerce.number().int().min(1).max(50).optional() });
+const InboxAckBody = z.object({
+	lease: z.string().min(1).max(64),
+	error: z.string().min(1).max(500).optional()
+});
+/** A one-time code for linking an account on sync entry `sync`: a person's own, for themselves. */
+const SyncCodeBody = z.object({ sync: SyncKey });
+/**
+* A platform account, linked to whoever a code was issued to: one posted from the account, or
+* carried through its sign-in. `message` is the platform message that posted it.
+*/
+const SyncAccountBody = z.object({
+	sync: SyncKey,
+	account: PlatformUser,
+	code: z.string().min(1).max(64),
+	message: z.string().max(1024).optional(),
+	/** `consent` when the code came through the account's own sign-in, so the board posts as them. */
+	method: z.enum(["code", "consent"]).optional()
+});
+/** A sign-in that carries a code, on the board whose sync runs the entry. */
+const SignInQuery = z.object({
+	sync: SyncKey,
+	code: z.string().min(1).max(64)
+});
+const SyncUnlinkBody = z.object({ account: ActorId });
+/** A direct upload, before its bytes: what the file will be called, its type, and its exact size. */
+const UploadStartBody = z.object({
+	name: z.string().max(1024).nullable().optional(),
+	type: z.string().max(1024).nullable().optional(),
+	size: z.number().int().positive().max(DIRECT_UPLOAD_BYTES_MAX, `direct uploads are at most ${DIRECT_UPLOAD_BYTES_MAX / 1024 / 1024} MB`)
+});
+const EditBody = z.object({ text: MessageText });
+const DeleteBody = z.object({}).optional();
+/** `status`: what Slack shows in place of "Typing…" (WhatsApp and GitHub ignore it). */
+const TypingBody = z.object({ status: z.string().trim().min(1).max(100).optional() }).optional();
+const ReactBody = z.object({
+	emoji: Emoji,
+	remove: z.boolean().optional()
+});
+const LabelBody = z.object({
+	set: Labels.optional(),
+	unset: z.array(LabelKey).optional()
+}).refine((body) => body.set !== void 0 || body.unset !== void 0, { message: "nothing to change: pass `set` or `unset`" });
+/** The route table: method, path, and the schemas that validate input. */
+const routes = {
+	/** Where the board is, its project, and the sync entries it links accounts on. No token. */
+	discovery: {
+		method: "GET",
+		path: "/"
+	},
+	me: {
+		method: "GET",
+		path: "/me"
+	},
+	channels: {
+		method: "GET",
+		path: "/channels"
+	},
+	actors: {
+		method: "GET",
+		path: "/actors"
+	},
+	messages: {
+		method: "GET",
+		path: "/messages",
+		query: MessagesQuery
+	},
+	message: {
+		method: "GET",
+		path: "/messages/:id"
+	},
+	/** Threads with a matching message, one summary each, by latest activity. */
+	threads: {
+		method: "GET",
+		path: "/threads",
+		query: ThreadsQuery
+	},
+	post: {
+		method: "POST",
+		path: "/messages",
+		body: PostBody
+	},
+	edit: {
+		method: "POST",
+		path: "/messages/:id/edit",
+		body: EditBody
+	},
+	delete: {
+		method: "POST",
+		path: "/messages/:id/delete",
+		body: DeleteBody
+	},
+	react: {
+		method: "POST",
+		path: "/messages/:id/reactions",
+		body: ReactBody
+	},
+	label: {
+		method: "POST",
+		path: "/messages/:id/labels",
+		body: LabelBody
+	},
+	/** Attaches the thread to a sync target, recording a `thread` receipt: needs `sync` where the thread is. */
+	sync: {
+		method: "POST",
+		path: "/messages/:id/sync",
+		body: SyncBody
+	},
+	/** Ephemeral: shows typing in the thread's synced platform threads, and writes nothing to the log. Needs `post` where the thread is. */
+	typing: {
+		method: "POST",
+		path: "/messages/:id/typing",
+		body: TypingBody
+	},
+	/** Posts a message later, as the caller: needs a scheduler. */
+	schedule: {
+		method: "POST",
+		path: "/schedules",
+		body: ScheduleBody
+	},
+	schedules: {
+		method: "GET",
+		path: "/schedules",
+		query: SchedulesQuery
+	},
+	/** Its creator, or manage in its channel, may cancel a schedule. Canceling one that's done is a no-op. */
+	cancelSchedule: {
+		method: "POST",
+		path: "/schedules/:id/cancel"
+	},
+	/** The caller's own post with the client ID it gave: what `POST /messages` answered, for telling a retry before posting. */
+	posted: {
+		method: "GET",
+		path: "/posts/:id"
+	},
+	/** Raw platform events in a sync key's inbox, newest first: the caller's own, and the board's with `sync` everywhere. */
+	inbox: {
+		method: "GET",
+		path: "/inbox/:key",
+		query: InboxQuery
+	},
+	/** Pushes platform events into the caller's inbox for a sync key, deduplicated by their platform IDs. */
+	inboxPush: {
+		method: "POST",
+		path: "/inbox/:key",
+		body: InboxPushBody
+	},
+	/** The caller's next inbox events, leased to it, one platform thread at a time and in order. */
+	inboxNext: {
+		method: "GET",
+		path: "/inbox/:key/next",
+		query: InboxNextQuery
+	},
+	/** How one went: done, or an error to try it again. */
+	inboxAck: {
+		method: "POST",
+		path: "/inbox/:key/:id/ack",
+		body: InboxAckBody
+	},
+	/** A platform's write, as its platform author: `sync` where it lands. */
+	syncImport: {
+		method: "POST",
+		path: "/sync/imports",
+		body: SyncImportBody
+	},
+	/** What sync did on a platform: a delivery, its files, a failure, or a thread's new target. */
+	syncReceipt: {
+		method: "POST",
+		path: "/sync/receipts",
+		body: SyncReceiptBody
+	},
+	/** A board thread's sync, by its key. */
+	syncThread: {
+		method: "GET",
+		path: "/sync/threads/:thread"
+	},
+	/** What platform IDs are on the board. */
+	syncFind: {
+		method: "GET",
+		path: "/sync/find",
+		query: SyncFindQuery
+	},
+	/** Messages' copies on platforms. */
+	syncCopies: {
+		method: "GET",
+		path: "/sync/copies",
+		query: SyncCopiesQuery
+	},
+	/** A person's recent roots, for telling their own platform copies from new messages. */
+	syncRoots: {
+		method: "GET",
+		path: "/sync/roots",
+		query: SyncRootsQuery
+	},
+	/** A one-time code for linking a platform account. */
+	syncCode: {
+		method: "POST",
+		path: "/sync/codes",
+		body: SyncCodeBody
+	},
+	/** Links a platform account, by a code or for a person. */
+	syncAccount: {
+		method: "POST",
+		path: "/sync/accounts",
+		body: SyncAccountBody
+	},
+	/** Unlinks a platform account. */
+	syncUnlink: {
+		method: "POST",
+		path: "/sync/accounts/unlink",
+		body: SyncUnlinkBody
+	},
+	/** Reads a platform channel or thread on demand, where that sync runs, without syncing or storing it. Full access only. */
+	readSource: {
+		method: "GET",
+		path: "/sources/:key/read",
+		query: SourceReadQuery
+	},
+	webhook: {
+		method: "POST",
+		path: "/webhooks/:key"
+	},
+	events: {
+		method: "GET",
+		path: "/events",
+		query: EventsQuery
+	},
+	avatar: {
+		method: "GET",
+		path: "/avatars/:name"
+	},
+	/** The file is the body; `content-type` is its type and `x-board-filename` its name, URI-encoded. */
+	upload: {
+		method: "POST",
+		path: "/attachments"
+	},
+	attachment: {
+		method: "GET",
+		path: "/attachments/:id"
+	},
+	/** A file too big for one request: the board answers where to `PUT` it in its blob store. Needs a store with `uploadUrl`. */
+	uploadStart: {
+		method: "POST",
+		path: "/attachments/uploads",
+		body: UploadStartBody
+	},
+	/** After the `PUT`: the board checks what landed in the store and records the attachment. */
+	uploadFinish: {
+		method: "POST",
+		path: "/attachments/uploads/:id"
+	},
+	openapi: {
+		method: "GET",
+		path: "/openapi.json"
+	},
+	/** Your linked platform accounts. */
+	identity: {
+		method: "GET",
+		path: "/identity"
+	},
+	/** Starts a sign-in that carries a code (no token), on the board that runs the entry's sync. */
+	signIn: {
+		method: "GET",
+		path: "/identity/sign-in",
+		query: SignInQuery
+	},
+	/** Where a sign-in comes back (no token): links the account it authorized to the code's person. */
+	signedIn: {
+		method: "GET",
+		path: "/identity/signed-in",
+		query: SignInQuery
+	},
+	identityUnlink: {
+		method: "POST",
+		path: "/identity/unlink",
+		body: IdentityUnlinkBody
+	},
+	/** Watchers registered by boards on `http()`: every one to `manage` everywhere, the caller's own to anyone else. */
+	watchers: {
+		method: "GET",
+		path: "/watchers"
+	},
+	/** Registers the caller's watchers, replacing its last registration. On a board on `http()`, registers its own, with no body or token. */
+	register: {
+		method: "POST",
+		path: "/watchers",
+		body: RegisterBody
+	},
+	/** The caller's matches it can run now, each leased to it until it acks. */
+	matches: {
+		method: "GET",
+		path: "/watchers/matches",
+		query: MatchesQuery
+	},
+	ack: {
+		method: "POST",
+		path: "/watchers/matches/:id/ack",
+		body: AckBody
+	},
+	/** On a board on `http()`: something matched. No body, no token: the board pulls what. */
+	wake: {
+		method: "POST",
+		path: "/wake"
+	}
+};
+//#endregion
+//#region src/client/ids.ts
+const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+/** SHA-256 of `text`, in hex. */
+async function sha256(text) {
+	return hex(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text))));
+}
+/**
+* A UUIDv8 from `parts`, exactly as A2's `idempotentId` makes one: the IDs a board derives for the
+* writes its own code makes, which no request may post with.
+*/
+async function derivedId(...parts) {
+	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(parts)))).slice(0, 16);
+	bytes[6] = bytes[6] & 15 | 128;
+	bytes[8] = bytes[8] & 63 | 128;
+	const text = hex(bytes);
+	return `${text.slice(0, 8)}-${text.slice(8, 12)}-${text.slice(12, 16)}-${text.slice(16, 20)}-${text.slice(20, 32)}`;
+}
+/** A derived ID's shape. */
+const DERIVED_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-8[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+/**
+* A post's ID, from one derived for it, under `principal`: a board takes a `key:<principal>:` ID
+* only from that principal, so no one else can post with it first.
+*/
+const keyId = async (principal, derived) => `key:${principal}:${(await sha256(`board-key\u001f${derived}`)).slice(0, 32)}`;
+/**
+* Whether `id` is exactly the shape `keyId` makes for `principal`. A prefix check isn't enough:
+* a principal's ID can be the start of another's (`oidc:gitlab.com:acme` and `oidc:gitlab.com:acme:ci`).
+*/
+const isKeyIdOf = (id, principal) => id.startsWith(`key:${principal}:`) && /^[0-9a-f]{32}$/.test(id.slice(`key:${principal}:`.length));
+//#endregion
+//#region src/api/tail.ts
+/** The filter flags `read`, `tail`, and `wait` share, and that a watcher's `tail` accepts. */
+const FILTER_FLAGS = {
+	re: { type: "string" },
+	by: { type: "string" },
+	mentions: { type: "string" },
+	label: {
+		type: "string",
+		multiple: true
+	},
+	from: { type: "string" },
+	text: { type: "string" }
+};
+/** `--mentions` alone means mentions of me; `--mentions @ada`, mentions of ada. */
+function withMentions(args) {
+	const out = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg !== "--mentions") out.push(arg);
+		else if (args[i + 1]?.startsWith("@")) out.push(`--mentions=${args[++i]}`);
+		else out.push("--mentions=me");
+	}
+	return out;
+}
+/** Splits an expression the way a shell would: whitespace separates, quotes group, `\` escapes. */
+function words(expression) {
+	const out = [];
+	let word = null;
+	let quote = null;
+	for (let i = 0; i < expression.length; i++) {
+		const char = expression[i];
+		if (quote) {
+			if (char === quote) quote = null;
+			else if (char === "\\" && quote === "\"" && i + 1 < expression.length) word += expression[++i];
+			else word += char;
+		} else if (/\s/.test(char)) {
+			if (word !== null) out.push(word);
+			word = null;
+		} else if (char === "\"" || char === "'") {
+			quote = char;
+			word ??= "";
+		} else if (char === "\\" && i + 1 < expression.length) word = (word ?? "") + expression[++i];
+		else word = (word ?? "") + char;
+	}
+	if (quote) throw new Error(`unterminated ${quote}`);
+	if (word !== null) out.push(word);
+	return out;
+}
+/** A watcher's tail takes the filters and `--all`, which shows receipts as it does in `vb tail`. */
+const TAIL_FLAGS = {
+	...FILTER_FLAGS,
+	all: { type: "boolean" }
+};
+/**
+* Parses filter flags as the CLI's parser does (Node's `parseArgs`, strict), written out so a tail
+* parses wherever board() runs, a browser included.
+*/
+function parseFilterFlags(args) {
+	const values = {};
+	const positionals = [];
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i];
+		if (arg === "--") {
+			positionals.push(...args.slice(i + 1));
+			break;
+		}
+		if (!arg.startsWith("-") || arg === "-") {
+			positionals.push(arg);
+			continue;
+		}
+		const eq = arg.indexOf("=");
+		const name = arg.startsWith("--") ? arg.slice(2, eq === -1 ? void 0 : eq) : null;
+		const spec = name !== null && Object.hasOwn(TAIL_FLAGS, name) ? TAIL_FLAGS[name] : null;
+		if (!spec) throw new Error(`${name !== null ? `--${name}` : arg.slice(0, 2)} isn't a filter`);
+		if (spec.type === "boolean") {
+			if (eq !== -1) throw new Error(`--${name} takes no value`);
+			values[name] = true;
+			continue;
+		}
+		let value;
+		if (eq !== -1) value = arg.slice(eq + 1);
+		else {
+			const next = args[i + 1];
+			if (next === void 0 || next.length > 1 && next.startsWith("-")) throw new Error(`--${name} needs a value`);
+			value = next;
+			i++;
+		}
+		if ("multiple" in spec) values[name] = [...values[name] ?? [], value];
+		else values[name] = value;
+	}
+	return {
+		values,
+		positionals
+	};
+}
+/** A watcher's `tail`: its filters, and whether `--all` shows it receipts too. */
+function parseWatchTail(expression) {
+	const { values, positionals } = parseFilterFlags(withMentions(words(expression)));
+	if (positionals.length > 1) throw new Error(`expected one channel, got: ${positionals.join(" ")}`);
+	const channel = positionals[0];
+	const parsed = Filters.safeParse({
+		...channel ? { channel } : {},
+		...values.re ? { re: values.re.replace(/^#/, "") } : {},
+		...values.by ? { by: values.by.replace(/^@/, "") } : {},
+		...values.mentions ? { mentions: values.mentions.replace(/^@/, "") } : {},
+		...values.label?.length ? { label: values.label } : {},
+		...values.from ? { from: values.from } : {},
+		...values.text ? { text: values.text } : {}
+	});
+	if (!parsed.success) {
+		const issue = parsed.error.issues[0];
+		throw new Error(`${issue?.path.length ? `--${String(issue.path[0])}: ` : ""}${issue?.message ?? "invalid filters"}`);
+	}
+	return {
+		filters: parsed.data,
+		all: values.all === true
+	};
+}
+//#endregion
+//#region src/server/watch-spec.ts
+/** Whether filters narrow anything: a view a message can enter. */
+const hasCriteria = (filters) => filters.channel !== void 0 || filters.re !== void 0 || filters.by !== void 0 || filters.mentions !== void 0 || filters.from !== void 0 || filters.text !== void 0 || (filters.label?.length ?? 0) > 0;
+/** A watcher's tail, checked the way a boot checks it: errors name the watcher. */
+function compileWatcher(id, spec) {
+	let filters;
+	let all;
+	try {
+		({filters, all} = parseWatchTail(spec.tail));
+	} catch (error) {
+		throw new Error(`watch ${id}: ${error.message}`);
+	}
+	if (filters.mentions === "me") throw new Error(`watch ${id}: a watcher has no "me": use --mentions @handle`);
+	const criteria = hasCriteria(filters);
+	if (spec.when === "enters" && !criteria) throw new Error(`watch ${id}: \`when: enters\` needs a filter to enter`);
+	return {
+		filters,
+		criteria,
+		enters: spec.when === "enters",
+		all
+	};
+}
+//#endregion
+export { SyncBody as A, UploadStartBody as B, Ref as C, SignInQuery as D, SchedulesQuery as E, SyncReceiptBody as F, SyncRootsQuery as I, SyncUnlinkBody as L, SyncCopiesQuery as M, SyncFindQuery as N, SourceReadQuery as O, SyncImportBody as P, ThreadsQuery as R, ReactBody as S, ScheduleBody as T, routes as V, InboxQuery as _, DERIVED_ID as a, MessagesQuery as b, keyId as c, EditBody as d, EventsQuery as f, InboxPushBody as g, InboxNextQuery as h, withMentions as i, SyncCodeBody as j, SyncAccountBody as k, sha256 as l, InboxAckBody as m, hasCriteria as n, derivedId as o, IdentityUnlinkBody as p, FILTER_FLAGS as r, isKeyIdOf as s, compileWatcher as t, AckBody as u, LabelBody as v, RegisterBody as w, PostBody as x, MatchesQuery as y, TypingBody as z };