@vercel/board 0.0.0 → 0.16.0

package/dist/sync.chat.d.mts

@@ -0,0 +1,2 @@
+import { i as externalAuthor, n as ChatSyncProvider, r as ChatTransport, t as ChatInput } from "./chat-provider-XCnQlxq6.mjs";
+export { ChatInput, ChatSyncProvider, ChatTransport, externalAuthor };

package/dist/sync.chat.mjs

@@ -0,0 +1,2 @@
+import { n as externalAuthor, t as ChatSyncProvider } from "./chat-provider-jFSeyNmB.mjs";
+export { ChatSyncProvider, externalAuthor };

package/dist/sync.d.mts

@@ -0,0 +1,3 @@
+import { _ as ExternalFile, g as ExternalEvent, h as ExternalAuthor } from "./reducers-B_vUGQRp.mjs";
+import { C as SyncResult, E as eventSchema, S as SyncOverrides, T as envelope, _ as connectUserTokens, a as ProviderFile, b as ProviderEvent, c as Receive, d as ResolvedTarget, f as SyncClient, g as UserTokens, h as SyncProvider, i as ProviderDelivery, l as ReceivedEvent, m as SyncHandler, o as ProviderOptions, p as SyncContext, r as FileDelivery, s as ProviderPost, t as EventMapping, u as RenderInput, v as withUserTokens, w as SyncRoot, x as RootOverride, y as EventBase } from "./provider-BGjz-mDa.mjs";
+export { EventBase, type EventMapping, type ExternalAuthor, ExternalEvent, type ExternalFile, type FileDelivery, type ProviderDelivery, type ProviderEvent, type ProviderFile, type ProviderOptions, type ProviderPost, type Receive, ReceivedEvent, type RenderInput, ResolvedTarget, type RootOverride, type SyncClient, type SyncContext, type SyncHandler, SyncOverrides, SyncProvider, type SyncResult, type SyncRoot, type UserTokens, connectUserTokens, envelope, eventSchema, withUserTokens };

package/dist/sync.mjs

@@ -0,0 +1,4 @@
+import { r as ExternalEvent } from "./contract-CuJmlrhw.mjs";
+import { a as EventBase, c as eventSchema, n as ResolvedTarget, o as SyncOverrides, r as SyncProvider, s as envelope, t as ReceivedEvent } from "./provider-CuewcDNZ.mjs";
+import { r as withUserTokens, t as connectUserTokens } from "./users-Dls7_ANV.mjs";
+export { EventBase, ExternalEvent, ReceivedEvent, ResolvedTarget, SyncOverrides, SyncProvider, connectUserTokens, envelope, eventSchema, withUserTokens };

package/dist/targets-yM5JBUgr.mjs

@@ -0,0 +1,94 @@
+import { m as MESSAGE_TEXT_MAX, p as Labels } from "./schemas-Be08nyfW.mjs";
+import { t as HttpError } from "./errors-DX3hpwWt.mjs";
+import { o as extractMentions, s as replaceMentions } from "./actors-DjMeZpnU.mjs";
+import { c as isThreadTarget } from "./reducers-mUPFuFJV.mjs";
+import { z } from "zod";
+//#region src/server/middleware.ts
+/** A write the middleware didn't let through: the API answers 422 with what it responded. */
+var DroppedError = class extends HttpError {
+	/** What the middleware responded, in order: none when it dropped the write without a word. */
+	responses;
+	constructor(responses) {
+		super(422, "dropped", responses.join("\n") || "the board dropped this message");
+		this.responses = responses;
+	}
+};
+const Patch = z.object({
+	text: z.string().max(MESSAGE_TEXT_MAX).optional(),
+	labels: Labels.optional()
+}).strict();
+const MIDDLEWARE_ACTOR = "board:middleware";
+/**
+* Runs `write` through `middleware` in order, then `commit`s what the last one
+* passed on. Throws `DroppedError` when one doesn't call `next`.
+*/
+async function runMiddleware(middleware, input, commit) {
+	const responses = [];
+	let committed = null;
+	const step = async (i, write) => {
+		if (i === middleware.length) {
+			if (write.text.trim() === "" && (write.kind === "edit" || write.attachments.length === 0)) return;
+			committed = { value: await commit(write) };
+			return;
+		}
+		let next = null;
+		await middleware[i]({
+			write: Object.freeze({ ...write }),
+			author: Object.freeze({ ...input.author }),
+			source: Object.freeze({ ...input.source }),
+			board: input.board(),
+			respond: async (text) => {
+				responses.push(text);
+			},
+			next: (patch = {}) => {
+				if (next) throw new Error("next() was already called");
+				const { text, labels } = Patch.parse(patch);
+				next = step(i + 1, {
+					...write,
+					...text !== void 0 ? { text } : {},
+					...write.kind === "post" && labels ? { labels: {
+						...write.labels,
+						...labels
+					} } : {}
+				});
+				return next;
+			}
+		});
+		if (next) await next;
+	};
+	await step(0, input.write);
+	if (!committed) throw new DroppedError(responses);
+	return committed.value;
+}
+//#endregion
+//#region src/server/targets.ts
+/** A target as a post or a receipt names it, resolved: a plain one's kind goes by its shape. */
+const syncTarget = (target) => typeof target === "string" ? {
+	target,
+	kind: isThreadTarget(target) ? "thread" : "channel"
+} : target;
+/** Whether `text` mentions anyone by email, `@[ada@vercel.com]`, which sync looks up. */
+const mentionsEmails = (text) => extractMentions(text).some((token) => token.kind === "actor" && token.actor.includes("@"));
+/**
+* `@[ada@vercel.com]`: each email `find` knows (a synced platform's user) becomes that user's
+* exact mention, `@[slack:user:U0456]`, so it reads natively there; the rest stay plain text.
+*/
+async function withEmailMentions(text, find) {
+	const emails = extractMentions(text).flatMap((token) => token.kind === "actor" && token.actor.includes("@") ? [token.actor] : []);
+	if (emails.length === 0) return {
+		text,
+		found: []
+	};
+	const byEmail = /* @__PURE__ */ new Map();
+	for (const email of emails) byEmail.set(email, await find?.(email).catch(() => null) ?? null);
+	return {
+		text: replaceMentions(text, (token) => {
+			if (token.kind !== "actor" || !byEmail.has(token.actor)) return null;
+			const actor = byEmail.get(token.actor);
+			return actor ? `@[${actor.id}]` : token.actor;
+		}),
+		found: [...byEmail.values()].filter((actor) => actor !== null)
+	};
+}
+//#endregion
+export { MIDDLEWARE_ACTOR as a, DroppedError as i, syncTarget as n, runMiddleware as o, withEmailMentions as r, mentionsEmails as t };

package/dist/tokens-DKLn5P9B.mjs

@@ -0,0 +1,256 @@
+import { l as unauthorized } from "./errors-DX3hpwWt.mjs";
+import { f as markVerified, m as trustedIssuers, n as TOKENS, r as VERCEL_ISSUER, u as issuerName } from "./auth-COzc09sn.mjs";
+import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
+//#region src/server/identity.ts
+let fromDisk;
+/** `vercel link` writes `.vercel/project.json`; local development reads it. */
+function readLinkedProject() {
+	fromDisk ??= (async () => {
+		try {
+			const { readFile } = await import("node:fs/promises");
+			const { join } = await import("node:path");
+			const raw = await readFile(join(process.cwd(), ".vercel", "project.json"), "utf8");
+			const { projectId, orgId } = JSON.parse(raw);
+			return {
+				projectId: projectId ?? null,
+				teamId: orgId ?? null
+			};
+		} catch {
+			return {
+				projectId: null,
+				teamId: null
+			};
+		}
+	})();
+	return fromDisk;
+}
+/**
+* The board's own Vercel project. Verification only trusts the project ID,
+* from config, the platform's `VERCEL_PROJECT_ID`, or the linked project.
+*/
+async function ownProjectId(configured) {
+	if (configured) return configured.id;
+	if (process.env.VERCEL_PROJECT_ID) return process.env.VERCEL_PROJECT_ID;
+	return (await readLinkedProject()).projectId;
+}
+/**
+* The board's own team, from config, `VERCEL_ORG_ID`, or the linked project.
+* On Vercel there's usually none of these, so verification falls back to the
+* platform's token for the board's project.
+*/
+async function ownTeamId(configured) {
+	if (configured?.teamId) return configured.teamId;
+	if (process.env.VERCEL_ORG_ID) return process.env.VERCEL_ORG_ID;
+	return (await readLinkedProject()).teamId;
+}
+/**
+* The team, for discovery only: clients need it to mint tokens. The platform's
+* request token is decoded without trust, since a spoofed header can only
+* mislead the response it's attached to.
+*/
+async function discoveryIdentity(headers, configured) {
+	const projectId = await ownProjectId(configured);
+	if (configured?.teamId) return {
+		projectId,
+		teamId: configured.teamId
+	};
+	const header = headers?.get("x-vercel-oidc-token");
+	if (header) try {
+		const claims = decodeJwt(header);
+		if (typeof claims.owner_id === "string") return {
+			projectId,
+			teamId: claims.owner_id
+		};
+	} catch {}
+	if (process.env.VERCEL_ORG_ID) return {
+		projectId,
+		teamId: process.env.VERCEL_ORG_ID
+	};
+	return {
+		projectId,
+		teamId: (await readLinkedProject()).teamId
+	};
+}
+//#endregion
+//#region src/server/tokens.ts
+const REGISTERED = /* @__PURE__ */ new Set([
+	"aud",
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+]);
+/** The claims rules can match on: plain values, bounded, as a schedule stores them. */
+function factsOf(issuer, iss, claims) {
+	const kept = {};
+	for (const [name, value] of Object.entries(claims)) {
+		if (REGISTERED.has(name) || Object.keys(kept).length >= 64) continue;
+		if (typeof value === "number" || typeof value === "boolean" || typeof value === "string" && value.length <= 1e3) kept[name] = value;
+	}
+	return {
+		issuer,
+		iss,
+		claims: kept
+	};
+}
+const issuerMatches = (iss, accepted) => typeof accepted === "string" ? iss === accepted : accepted.test(iss);
+const remoteKeys = /* @__PURE__ */ new Map();
+async function keysFor(iss) {
+	const cached = remoteKeys.get(iss);
+	if (cached) return cached;
+	const response = await fetch(`${iss.replace(/\/+$/, "")}/.well-known/openid-configuration`);
+	if (!response.ok) throw unauthorized(`cannot load keys for issuer ${iss}`);
+	const { jwks_uri } = await response.json();
+	const keys = createRemoteJWKSet(new URL(jwks_uri));
+	remoteKeys.set(iss, keys);
+	return keys;
+}
+/** What tokens are verified with: the platform's issuers, OIDC issuers the board's rules name, and test issuers. */
+function createVerifier(options) {
+	const vercelIssuer = options.auth?.vercel ?? { issuer: VERCEL_ISSUER };
+	const githubIssuer = options.auth?.github ?? { issuer: "https://token.actions.githubusercontent.com" };
+	const oidcIssuers = trustedIssuers(options.issuers);
+	let platformTeam = null;
+	/**
+	* The team on a Vercel-signed token for the board's own project. Project IDs
+	* are unique, so its `owner_id` is the board's team, whoever sent the token.
+	*/
+	async function teamFrom(platformToken, ownProject) {
+		if (platformTeam !== null || !platformToken || ownProject === null) return platformTeam;
+		try {
+			const iss = String(decodeJwt(platformToken).iss ?? "");
+			if (!issuerMatches(iss, vercelIssuer.issuer)) return null;
+			const keys = vercelIssuer.jwks ?? await keysFor(iss);
+			const { payload } = await jwtVerify(platformToken, keys, { issuer: iss });
+			if (payload.project_id === ownProject && typeof payload.owner_id === "string") platformTeam = payload.owner_id;
+		} catch {}
+		return platformTeam;
+	}
+	/** `platformToken`: the board's own OIDC token, which Vercel sends with each request. */
+	async function verify(token, audience, platformToken) {
+		let iss;
+		try {
+			iss = String(decodeJwt(token).iss ?? "");
+		} catch {
+			throw unauthorized("malformed token");
+		}
+		const local = options.auth?.local;
+		if (local && iss === local.issuer) return localPerson(token, local, audience);
+		const isVercel = issuerMatches(iss, vercelIssuer.issuer);
+		const isGitHub = !isVercel && issuerMatches(iss, githubIssuer.issuer);
+		const isOidc = !isVercel && !isGitHub && oidcIssuers.has(iss);
+		if (!isVercel && !isGitHub && !isOidc) throw unauthorized(`untrusted issuer: ${iss || "(none)"}`);
+		let claims;
+		try {
+			const keys = isOidc ? options.auth?.oidc?.[iss] ?? await keysFor(iss) : (isVercel ? vercelIssuer : githubIssuer).jwks ?? await keysFor(iss);
+			({payload: claims} = await jwtVerify(token, keys, {
+				issuer: iss,
+				audience
+			}));
+		} catch (error) {
+			if (error.status === 401) throw error;
+			throw unauthorized(`invalid token: ${error.message}`);
+		}
+		const facts = factsOf(isOidc ? "oidc" : isGitHub ? "github" : "vercel", iss, claims);
+		const expiresAt = claims.exp ? /* @__PURE__ */ new Date(claims.exp * 1e3) : null;
+		if (isOidc) {
+			if (typeof claims.sub !== "string" || claims.sub === "") throw unauthorized(`token from ${iss} without sub`);
+			return {
+				id: `oidc:${issuerName(iss)}:${claims.sub}`,
+				kind: "workflow",
+				handle: claims.sub.slice(0, 128),
+				expiresAt,
+				facts
+			};
+		}
+		if (isGitHub) return {
+			id: `github:repo:${String(claims.repository_id)}`,
+			kind: "workflow",
+			handle: String(claims.repository),
+			expiresAt,
+			facts
+		};
+		const environment = String(claims.environment ?? "");
+		const project = String(claims.project ?? "");
+		const ownProject = await options.projectId() ?? null;
+		if (ownProject !== null && claims.project_id === ownProject && environment === "development") {
+			if (typeof claims.user_id !== "string") throw unauthorized("development token without user_id");
+			return {
+				id: `vercel:user:${claims.user_id}`,
+				kind: "person",
+				handle: `user-${claims.user_id.slice(0, 6).toLowerCase()}`,
+				expiresAt
+			};
+		}
+		const teamId = await options.teamId() ?? await teamFrom(platformToken ?? process.env.VERCEL_OIDC_TOKEN, ownProject) ?? null;
+		return deployment(teamId === null ? facts : {
+			...facts,
+			team: teamId
+		}, project, environment, expiresAt);
+	}
+	return { verify };
+}
+const LOCAL_SUB = /^[a-z0-9](?:[a-z0-9._-]{0,62}[a-z0-9])?$/;
+async function localPerson(token, local, audience) {
+	let claims;
+	try {
+		({payload: claims} = await jwtVerify(token, local.jwks, {
+			issuer: local.issuer,
+			audience
+		}));
+	} catch (error) {
+		throw unauthorized(`invalid token: ${error.message}`);
+	}
+	const sub = String(claims.sub ?? "");
+	if (!LOCAL_SUB.test(sub)) throw unauthorized("local token without a valid sub");
+	return {
+		id: `local:user:${sub}`,
+		kind: "person",
+		handle: sub,
+		expiresAt: claims.exp ? /* @__PURE__ */ new Date(claims.exp * 1e3) : null
+	};
+}
+const deployment = (facts, project, environment, expiresAt) => ({
+	id: `vercel:project:${String(facts.claims.project_id)}:${environment}`,
+	kind: "deployment",
+	handle: environment === "production" ? project : `${project}@${environment}`,
+	expiresAt,
+	facts
+});
+/** The board's own project, for a verifier asked outside a board that knows it: from the environment. */
+const environmentBoard = {
+	project: async () => ({
+		id: await ownProjectId(),
+		teamId: await ownTeamId()
+	}),
+	issuers: []
+};
+/**
+* The OIDC tokens made out to this board: a request's bearer token, from Vercel (people and
+* deployments), GitHub Actions, an `oidc()` rule's issuer, or `local`'s (`vb serve`'s), verified
+* for the board's URL. Null for a request with no token, and a 401 for one whose token fails.
+* Without `request.board`, the board's project is the environment's, and it trusts no issuer past
+* Vercel's and GitHub's.
+*/
+function oidcTokens(options = {}) {
+	let made = null;
+	const authenticate = async (request) => {
+		if (request.credential === null) return null;
+		const board = request.board ?? environmentBoard;
+		const issuers = board.issuers.join("\n");
+		if (made?.board !== board || made.issuers !== issuers) made = {
+			board,
+			issuers,
+			verify: createVerifier({
+				projectId: async () => (await board.project()).id,
+				teamId: async () => (await board.project()).teamId,
+				issuers: board.issuers,
+				auth: options
+			}).verify
+		};
+		return markVerified(await made.verify(request.credential, request.audience, request.headers.get("x-vercel-oidc-token") ?? void 0));
+	};
+	return Object.assign(authenticate, { [TOKENS]: true });
+}
+//#endregion
+export { ownTeamId as i, discoveryIdentity as n, ownProjectId as r, oidcTokens as t };

package/dist/types-BHCjTZdB.d.mts

@@ -0,0 +1,104 @@
+import { a as ExternalCopy, c as SyncedThread, o as Message, p as BoardEvent } from "./reducers-B_vUGQRp.mjs";
+import { A2Store } from "experimental-a2/server";
+//#region src/store/types.d.ts
+/**
+ * What a query matches, resolved by the board: handles are already actor and
+ * principal sets, so a backend never needs the actors.
+ */
+type MessageFilter = {
+  /** One channel, or with `subtree` it and every channel under it. */
+  channel?: {
+    path: string;
+    subtree: boolean;
+  };
+  /** In one of these channels: those a reader may read. None matches nothing. */
+  channels?: readonly string[];
+  /** A thread: its root and its replies. */
+  re?: number;
+  /** Written by one of these actors, or by an agent of one of these people. */
+  by?: {
+    actors: readonly string[];
+    principals: readonly string[];
+  };
+  /** Mentions one of these actors. */
+  mentions?: readonly string[];
+  /** The sync key it came from, or `board`. */
+  from?: string;
+  /** Lowercased: a substring of the lowercased text. */
+  text?: string;
+  /** Each on the message or its thread's root; `values: null` is any value. */
+  labels?: readonly {
+    key: string;
+    values: readonly string[] | null;
+  }[];
+};
+/** By message ID: `after` takes the first `limit` after it; otherwise the last `limit`. */
+type Page = {
+  before?: number;
+  after?: number;
+  limit: number;
+};
+/** A thread as `/threads` lists it: its root, how many replies aren't deleted, and the latest. */
+type ThreadSummary = {
+  root: Message;
+  replies: number;
+  last: Message | null;
+};
+/**
+ * The board's messages, kept from its log. Each read says which log index it
+ * reflects (`position`), so a reader knows what it has seen.
+ */
+interface MessageTables {
+  /** The last log index applied. */
+  position(): Promise<number>;
+  /** Applies one board event, exactly once: an event at or below the position changes nothing. */
+  apply(event: BoardEvent): Promise<void>;
+  /**
+   * Applies `event` only if it's the very next one, and says whether it did: a
+   * writer catching the tables up on its own write, without waiting on the consumer.
+   */
+  applyNext(event: BoardEvent): Promise<boolean>;
+  message(id: number): Promise<Message | null>;
+  /** The message a post with this event ID created. A root's thread key is one. */
+  byEventId(eventId: string): Promise<Message | null>;
+  /** Each of `ids` as it was right after event `index`; one not posted by then is absent. */
+  messagesAt(ids: readonly number[], index: number): Promise<Map<number, Message>>;
+  /** A thread's root and every reply, deleted ones included, by ID. */
+  thread(root: number): Promise<Message[]>;
+  messages(filter: MessageFilter, page: Page): Promise<{
+    messages: Message[];
+    position: number;
+  }>;
+  /** Threads with a message that matches, by their latest reply. */
+  threads(filter: MessageFilter, page: Page): Promise<{
+    threads: ThreadSummary[];
+    position: number;
+  }>;
+  /** A thread's sync: its targets, and the platform thread it lives in on each. */
+  syncOf(thread: string): Promise<SyncedThread | null>;
+  /** The board thread a platform thread belongs to. */
+  threadOf(externalThread: string): Promise<string | null>;
+  /** Each message's copies, by target: where it went, or came from, on each platform. */
+  copiesOf(ids: readonly number[]): Promise<Map<number, Record<string, ExternalCopy>>>;
+  /** The board message a platform message is a copy of, or came in as. */
+  messageOf(externalThread: string, platformMessage: string): Promise<number | null>;
+  /** Every platform thread a board thread lives in. */
+  externalThreads(): Promise<string[]>;
+  /** A person's own roots posted at or after `since` (epoch ms). */
+  recentRoots(principal: string, since: number): Promise<Message[]>;
+  /** The messages that carry an attachment, by ID. A deleted message carries none. */
+  withAttachment(attachment: string): Promise<Message[]>;
+  close(): Promise<void>;
+}
+/**
+ * Where a board keeps everything: its A2 log, and the tables it reads from. Create one with
+ * `postgres()`, `redis()`, `redisHttp()`, `sqlite()`, or `memory()` from `@vercel/board/backend-a2/store-*`.
+ */
+type BoardStore = {
+  /** The board's A2 store. */
+  readonly log: A2Store;
+  readonly tables: MessageTables;
+  close(): Promise<void>;
+};
+//#endregion
+export { BoardStore as t };

package/dist/users-Dls7_ANV.mjs

@@ -0,0 +1,42 @@
+//#region src/sync/users.ts
+const USER_TOKENS = Symbol.for("board.userTokens");
+/**
+* Gives an adapter people's tokens, for your own OAuth: `slack({ adapter:
+* withUserTokens(createSlackAdapter(...), { authorize, token }) })`. A Connect
+* connector name (`adapter: 'slack/acme'`) does this for you.
+*/
+function withUserTokens(adapter, tokens) {
+	Object.defineProperty(adapter, USER_TOKENS, {
+		value: tokens,
+		enumerable: false,
+		configurable: true
+	});
+	return adapter;
+}
+const userTokensOf = (adapter) => adapter[USER_TOKENS] ?? null;
+/** Vercel Connect's user tokens for `connector`: the subject is the board's principal, so Connect binds the account to it. */
+function connectUserTokens(connector) {
+	const subject = (principal) => ({ subject: {
+		type: "user",
+		id: principal
+	} });
+	return {
+		async authorize(principal, options = {}) {
+			const { startAuthorization } = await import("@vercel/connect");
+			return (options.callback ? await startAuthorization(connector, subject(principal), { callbackUrl: options.callback }) : await startAuthorization(connector, subject(principal))).url;
+		},
+		async token(principal) {
+			const { getToken, NoValidTokenError, UserAuthorizationRequiredError } = await import("@vercel/connect");
+			try {
+				return await getToken(connector, subject(principal));
+			} catch (error) {
+				if (error instanceof UserAuthorizationRequiredError || error instanceof NoValidTokenError) return null;
+				const code = error.code;
+				if (code === "user_authorization_required" || code === "no_token") return null;
+				throw error;
+			}
+		}
+	};
+}
+//#endregion
+export { userTokensOf as n, withUserTokens as r, connectUserTokens as t };