@vercel/board 0.0.0 → 0.16.0

package/dist/backend-http-0roEmjl0.mjs

@@ -0,0 +1,613 @@
+import { t as BoardError } from "./client-DGDPaN7U.mjs";
+import { t as createHttp } from "./backend-http-BVRno-ca.mjs";
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { decodeJwt } from "jose";
+import { exchangeVercelOidcToken, getVercelOidcToken, getVercelToken } from "@vercel/oidc";
+//#region src/client/node.ts
+const configDir = () => join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "board");
+/** The board saved by `board use <url>`. */
+function savedUrl() {
+	try {
+		const { url } = JSON.parse(readFileSync(join(configDir(), "config.json"), "utf8"));
+		return url;
+	} catch {
+		return;
+	}
+}
+/**
+* A Git checkout's root: `.git` is a directory with a `HEAD`, or a worktree's
+* `gitdir:` file. A stray empty `.git` (say, in `~` or `/tmp`) isn't one.
+*/
+function isCheckout(directory) {
+	const git = join(directory, ".git");
+	try {
+		if (statSync(git).isDirectory()) return existsSync(join(git, "HEAD"));
+		return readFileSync(git, "utf8").startsWith("gitdir:");
+	} catch {
+		return false;
+	}
+}
+function projectDir(cwd = process.cwd()) {
+	let directory = resolve(cwd);
+	while (true) {
+		if (existsSync(join(directory, ".board", "config.json")) || isCheckout(directory)) return directory;
+		const parent = dirname(directory);
+		if (parent === directory) return resolve(cwd);
+		directory = parent;
+	}
+}
+function projectUrl() {
+	const path = join(projectDir(), ".board", "config.json");
+	let contents;
+	try {
+		contents = readFileSync(path, "utf8");
+	} catch (error) {
+		if (error.code === "ENOENT") return void 0;
+		throw error;
+	}
+	try {
+		const { url } = JSON.parse(contents);
+		if (typeof url === "string" && ["http:", "https:"].includes(new URL(url).protocol)) return url;
+	} catch {}
+	throw new BoardError("invalid_config", `invalid board link at ${path}: expected an http(s) url`, 0);
+}
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"localhost",
+	"[::1]"
+]);
+/** Where `vb serve` leaves the token for the board it runs at `url`: only this user can read it. */
+function localTokenFile(url) {
+	const normalized = url.replace(/\/+$/, "");
+	return join(configDir(), "local", `${createHash("sha256").update(normalized).digest("hex").slice(0, 32)}.json`);
+}
+/** The token a local board on this machine left for you, if `url` is one. */
+function localToken(url) {
+	try {
+		if (!LOOPBACK.has(new URL(url).hostname)) return null;
+		const saved = JSON.parse(readFileSync(localTokenFile(url), "utf8"));
+		if (saved.url !== url.replace(/\/+$/, "") || typeof saved.token !== "string") return null;
+		return {
+			token: saved.token,
+			handle: saved.handle ?? null
+		};
+	} catch {
+		return null;
+	}
+}
+/** Claude Code, Codex, and Grok sessions select their own profile, like Just Chat's CLI. */
+function detectAgent(env = process.env) {
+	const found = [];
+	if (env.CLAUDECODE === "1" || env.CLAUDE_CODE_SESSION_ID) found.push({
+		profile: "claude",
+		session: env.CLAUDE_CODE_SESSION_ID || null
+	});
+	if (env.CODEX_THREAD_ID || env.CODEX_SESSION_ID) found.push({
+		profile: "codex",
+		session: env.CODEX_THREAD_ID || env.CODEX_SESSION_ID || null
+	});
+	if (env.GROK_SESSION_ID) found.push({
+		profile: "grok",
+		session: env.GROK_SESSION_ID
+	});
+	if (env.CURSOR_AGENT === "1") found.push({
+		profile: "cursor",
+		session: null
+	});
+	if (env.PI_CODING_AGENT === "true" || env.AI_AGENT === "pi") found.push({
+		profile: "pi",
+		session: env.PI_SESSION_ID || null
+	});
+	const named = env.AI_AGENT?.trim().toLowerCase();
+	if (named && /^[a-z][a-z0-9-]{0,31}$/.test(named) && !found.some((agent) => agent.profile === named)) found.push({
+		profile: named,
+		session: null
+	});
+	if (found.length > 1) throw new BoardError("ambiguous_agent", `several agent environments detected (${found.map((a) => a.profile).join(", ")}): choose one with a profile, or none`, 0);
+	return found[0] ?? null;
+}
+const expiry = (token) => {
+	try {
+		const { exp } = decodeJwt(token);
+		return exp ? exp * 1e3 : Date.now() + 3e5;
+	} catch {
+		return Date.now() + 3e5;
+	}
+};
+const cacheFile = (audience) => join(configDir(), "tokens", `${createHash("sha256").update(audience).digest("hex").slice(0, 32)}.json`);
+async function readCache(audience) {
+	try {
+		const cached = JSON.parse(await readFile(cacheFile(audience), "utf8"));
+		return cached.expiresAt - 3e5 > Date.now() ? cached : null;
+	} catch {
+		return null;
+	}
+}
+async function writeCache(audience, cached) {
+	await mkdir(join(configDir(), "tokens"), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(cacheFile(audience), JSON.stringify(cached), { mode: 384 });
+}
+/**
+* A person's token: their Vercel CLI login mints a development token for the
+* project the board's host is a deployment of, exchanged so its audience is the
+* board's URL. Cached on disk for its 12-hour life.
+*/
+async function personToken(audience, discovery) {
+	const cached = await readCache(audience);
+	if (cached && cached.name === void 0) {
+		const user = await getVercelToken().then(vercelUser).catch(() => null);
+		const filled = {
+			...cached,
+			name: user?.name ?? null,
+			avatar: user?.avatar ?? null
+		};
+		await writeCache(audience, filled).catch(() => {});
+		return filled;
+	}
+	if (cached) return cached;
+	if (!discovery.project_id) throw new BoardError("no_project", `the board at ${discovery.url} doesn't know its Vercel project`, 0);
+	const authToken = await getVercelToken().catch(() => null);
+	const project = await boardProject(audience, discovery, authToken);
+	let development;
+	try {
+		if (!authToken) throw new Error("no Vercel CLI credentials file");
+		const response = await fetch(`https://api.vercel.com/v1/projects/${project.id}/token?source=board${project.team ? `&teamId=${project.team}` : ""}`, {
+			method: "POST",
+			headers: { authorization: `Bearer ${authToken}` }
+		});
+		if (response.status === 403 || response.status === 404) throw new BoardError("no_access", "your Vercel account can't access this board's project: ask for access to it", response.status);
+		if (!response.ok) throw new Error(`${response.status} ${response.statusText}`);
+		development = (await response.json()).token;
+	} catch (error) {
+		if (error instanceof BoardError) throw error;
+		development = await tokenFromVercelCli(project);
+	}
+	const token = await exchangeVercelOidcToken({
+		token: development,
+		audience
+	});
+	const user = authToken ? await vercelUser(authToken) : null;
+	const fresh = {
+		token,
+		expiresAt: expiry(token),
+		handle: user?.handle ?? null,
+		name: user?.name ?? null,
+		avatar: user?.avatar ?? null
+	};
+	await writeCache(audience, fresh).catch(() => {});
+	return fresh;
+}
+/**
+* The project to mint a person's token for: the one Vercel, asked with your own
+* login, says the board's host is a deployment of (its deployment URL, a branch
+* alias, or a domain), found as `vercel curl` finds it. Discovery names a project
+* too, but any board can name any project you can access, and a token for one it
+* isn't could be replayed where that project is trusted, so the two must agree.
+* Vercel knows no loopback host: a board there runs on your machine (`next dev`).
+*/
+async function boardProject(url, discovery, authToken) {
+	const { host, hostname } = new URL(url);
+	if (LOOPBACK.has(hostname)) return {
+		id: discovery.project_id,
+		team: discovery.team_id
+	};
+	const found = await findProject(authToken ? async (method, path) => {
+		const response = await fetch(`https://api.vercel.com${path}`, {
+			method,
+			headers: { authorization: `Bearer ${authToken}` }
+		});
+		return response.ok ? await response.json() : null;
+	} : vercelCliApi, host);
+	if (!found) throw new BoardError("no_access", `your Vercel login can't see the project ${host} belongs to: run \`vercel login\` or ask for access to it`, 0);
+	if (found.projectId !== discovery.project_id) throw new BoardError("wrong_project", `the board at ${url} says its project is ${discovery.project_id}, but it's a deployment of ${found.projectId}, so vb won't sign in to it`, 0);
+	return {
+		id: found.projectId,
+		team: found.ownerId.startsWith("team_") ? found.ownerId : null
+	};
+}
+/** When credentials live in the keychain, the Vercel CLI mints the token itself. */
+async function tokenFromVercelCli(project) {
+	const args = [
+		"project",
+		"token",
+		project.id,
+		"--format=json"
+	];
+	if (project.team) args.push("--scope", project.team);
+	try {
+		const { stdout } = await promisify(execFile)("vercel", args, { timeout: 3e4 });
+		return JSON.parse(stdout).token;
+	} catch {
+		throw new BoardError("not_logged_in", "not signed in to Vercel: run `vercel login`", 0);
+	}
+}
+/** Your Vercel username, display name, and avatar (Vercel serves avatars publicly). */
+async function vercelUser(authToken) {
+	try {
+		const response = await fetch("https://api.vercel.com/v2/user", { headers: { authorization: `Bearer ${authToken}` } });
+		if (!response.ok) return null;
+		const { user } = await response.json();
+		return {
+			handle: user?.username?.toLowerCase() ?? null,
+			name: user?.name?.trim() || null,
+			avatar: user?.avatar && /^[0-9a-f]+$/i.test(user.avatar) ? `https://vercel.com/api/www/avatar/${user.avatar}?s=128` : null
+		};
+	} catch {
+		return null;
+	}
+}
+async function githubActionsToken(audience) {
+	const url = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL);
+	url.searchParams.set("audience", audience);
+	const response = await fetch(url, { headers: { authorization: `bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}` } });
+	if (!response.ok) throw new BoardError("no_token", `GitHub Actions refused an OIDC token (${response.status}): does the job have \`permissions: id-token: write\`?`, 0);
+	return (await response.json()).value;
+}
+/** The board the environment points at: `BOARD_URL`, the project's link (`vb link`, `vb serve`), or `vb use`'s. */
+function boardUrl() {
+	const url = (process.env.BOARD_URL ?? projectUrl() ?? savedUrl())?.replace(/\/+$/, "");
+	if (!url) throw new BoardError("no_board", "no board URL: run `board link <url>`, set BOARD_URL, run `board use <url>`, or `board serve` for a local one", 0);
+	return url;
+}
+/**
+* How a client reaches the board at `url` from Node: through Deployment Protection, with a token
+* from `token`, `BOARD_TOKEN`, a local board's token file (`vb serve`), GitHub Actions, the Vercel
+* runtime, or your Vercel CLI login, in that order. `handle` is yours, in place of `BOARD_HANDLE`
+* or your Vercel username.
+*/
+function connect(url, options = {}) {
+	url = url.replace(/\/+$/, "");
+	const doFetch = guarded(url, options.fetch ?? ((input, init) => globalThis.fetch(input, init)), options.token);
+	let discovery;
+	const discover = () => discovery ??= doFetch(url).then(async (response) => {
+		if (!response.ok) throw new BoardError("no_board", `no board at ${url} (${response.status})`, response.status);
+		const found = await response.json();
+		if (found.audience !== url) throw new BoardError("wrong_audience", `the board at ${url} says its URL is ${found.audience}: use that URL`, 0);
+		return found;
+	});
+	let cached = null;
+	let source = null;
+	let person = null;
+	const mint = async () => {
+		if (options.token !== void 0) {
+			const token = typeof options.token === "function" ? await options.token() : options.token;
+			return {
+				token,
+				expiresAt: expiry(token)
+			};
+		}
+		if (process.env.BOARD_TOKEN) {
+			const token = process.env.BOARD_TOKEN;
+			source = "BOARD_TOKEN";
+			return {
+				token,
+				expiresAt: expiry(token)
+			};
+		}
+		const local = localToken(url);
+		if (local) {
+			source = "vb serve";
+			return {
+				token: local.token,
+				expiresAt: expiry(local.token),
+				handle: local.handle,
+				name: null,
+				avatar: null
+			};
+		}
+		const discovered = await discover();
+		if (process.env.ACTIONS_ID_TOKEN_REQUEST_URL && process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN) {
+			const token = await githubActionsToken(url);
+			source = "GitHub Actions OIDC";
+			return {
+				token,
+				expiresAt: expiry(token)
+			};
+		}
+		if (process.env.VERCEL === "1") {
+			const token = await hostedToken(url);
+			source = "Vercel OIDC";
+			return {
+				token,
+				expiresAt: expiry(token)
+			};
+		}
+		person ??= personToken(url, discovered).finally(() => {
+			person = null;
+		});
+		const minted = await person;
+		source = "vercel login";
+		return minted;
+	};
+	const token = async () => {
+		if (options.token !== void 0 || !cached || cached.expiresAt - 6e4 < Date.now()) cached = await mint();
+		return cached.token;
+	};
+	const send = (async (input, init = {}) => {
+		const href = input instanceof Request ? input.url : String(input);
+		const method = (init.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+		const path = (href.startsWith(url) ? href.slice(url.length) : new URL(href).pathname).split("?")[0] || "/";
+		const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0));
+		if (!(method === "GET" && path === "/")) {
+			if (!headers.has("authorization")) headers.set("authorization", `Bearer ${await token()}`);
+			const handle = options.handle ?? (process.env.BOARD_HANDLE || (options.token === void 0 ? cached?.handle : null));
+			if (handle && !headers.has("x-board-handle")) headers.set("x-board-handle", handle);
+			if (!headers.has("x-board-profile") && options.token === void 0) {
+				if (cached?.name && !headers.has("x-board-name")) headers.set("x-board-name", encodeURIComponent(cached.name));
+				if (cached?.avatar && !headers.has("x-board-avatar")) headers.set("x-board-avatar", cached.avatar);
+			}
+		}
+		return doFetch(input, {
+			...init,
+			headers
+		});
+	});
+	return {
+		fetch: send,
+		source: () => source
+	};
+}
+/** The profile the environment picks: `BOARD_AS`, or the coding agent it runs in, with its session. */
+function environmentProfile() {
+	const detected = detectAgent();
+	const name = process.env.BOARD_AS || detected?.profile;
+	const avatar = process.env.BOARD_AVATAR;
+	return {
+		profile: name ? avatar ? {
+			name,
+			avatar
+		} : name : null,
+		session: detected?.session ?? null
+	};
+}
+const WHERE = "Project → Settings → Deployment Protection → Protection Bypass for Automation";
+var Wall = class extends Error {
+	status;
+	constructor(status) {
+		super("protected");
+		this.status = status;
+	}
+};
+/**
+* This deployment's Vercel OIDC token, with `url` as its audience: what a hosted client sends a
+* board, for Deployment Protection's Trusted Sources. Its `cause` says why it couldn't.
+*/
+async function hostedToken(url) {
+	try {
+		return await getVercelOidcToken({ audience: url });
+	} catch (cause) {
+		throw Object.assign(new BoardError("no_token", `cannot obtain Vercel OIDC credentials for ${url}: enable OIDC on the calling project or supply token / BOARD_TOKEN; configure Deployment Protection Trusted Sources for its project and environment`, 0), { cause });
+	}
+}
+/** A host this deployment answers on, as Vercel's system variables name them (bare hosts). */
+const ownHost = (host) => [
+	process.env.VERCEL_URL,
+	process.env.VERCEL_BRANCH_URL,
+	process.env.VERCEL_PROJECT_PRODUCTION_URL
+].some((own) => !!own && own.toLowerCase() === host.toLowerCase());
+/** Explicit bypass wins; otherwise hosted calls use OIDC and local people use their saved bypass. */
+function guarded(url, doFetch, suppliedToken) {
+	const host = new URL(url).host;
+	let secret;
+	let looked;
+	let envRejected = false;
+	return async (input, init = {}) => {
+		const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0));
+		init = {
+			...init,
+			headers
+		};
+		const fromEnv = process.env.VERCEL_AUTOMATION_BYPASS_SECRET;
+		if (fromEnv && !envRejected && (process.env.VERCEL !== "1" || ownHost(host))) try {
+			return await through(doFetch, input, init, fromEnv);
+		} catch (error) {
+			if (!(error instanceof Wall)) throw error;
+			if (process.env.VERCEL !== "1") throw new BoardError("protected", `${url} is behind Vercel Deployment Protection and rejected VERCEL_AUTOMATION_BYPASS_SECRET; check it against ${WHERE}`, error.status);
+			envRejected = true;
+		}
+		if (process.env.VERCEL === "1") {
+			if (!headers.has("x-vercel-trusted-oidc-idp-token")) {
+				const token = headers.get("authorization")?.match(/^Bearer (.+)$/i)?.[1] ?? (typeof suppliedToken === "function" ? await suppliedToken() : suppliedToken) ?? (process.env.BOARD_TOKEN || await hostedToken(url));
+				headers.set("x-vercel-trusted-oidc-idp-token", token);
+			}
+			return through(doFetch, input, init, null).catch((error) => {
+				throw error instanceof Wall ? new BoardError("protected", `${url} rejected Vercel OIDC access: configure Deployment Protection Trusted Sources for the calling project and environment`, error.status) : error;
+			});
+		}
+		const used = await (secret ??= readBypass(host));
+		try {
+			return await through(doFetch, input, init, used);
+		} catch (error) {
+			if (!(error instanceof Wall)) throw error;
+		}
+		looked ??= projectBypass(url, host, doFetch).then(async (found) => {
+			await writeBypass(host, found.secret).catch(() => {});
+			return found;
+		});
+		const { secret: found, created } = await looked;
+		secret = Promise.resolve(found);
+		try {
+			return await through(doFetch, input, init, found).catch(async (error) => {
+				if (!(error instanceof Wall) || !created) throw error;
+				await new Promise((resolve) => setTimeout(resolve, 1e3));
+				return through(doFetch, input, init, found);
+			});
+		} catch (error) {
+			throw error instanceof Wall ? new BoardError("protected", `${url} is behind Vercel Deployment Protection and its project's automation bypass didn't get through; set VERCEL_AUTOMATION_BYPASS_SECRET (${WHERE})`, error.status) : error;
+		}
+	};
+}
+/**
+* One request that recognizes the wall: a redirect to `/sso-api`, or an HTML
+* page where the board answers JSON (on SAML teams, the redirects end at the
+* IdP's login page with a 200). Only a 2xx, 401, or 403 HTML page counts, so a
+* 404 page keeps its own error; attachments, which may be HTML, come with a
+* `content-disposition`. Other redirects of a GET or HEAD are followed as fetch
+* would, dropping the token and bypass secret on the way to another origin; a
+* redirected POST comes back as its 3xx.
+*/
+async function through(doFetch, input, init, bypass) {
+	let target = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+	const method = (init.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
+	let headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0));
+	if (bypass) headers.set("x-vercel-protection-bypass", bypass);
+	for (let hops = 0;; hops++) {
+		const response = await doFetch(hops === 0 ? input : target, {
+			...init,
+			headers,
+			redirect: "manual"
+		});
+		const location = response.status >= 300 && response.status < 400 ? response.headers.get("location") : null;
+		if (location) {
+			const next = new URL(location, target);
+			if (next.pathname.startsWith("/sso-api")) throw new Wall(response.status);
+			if (method === "GET" || method === "HEAD") {
+				if (hops >= 20) throw new BoardError("too_many_redirects", `too many redirects from ${target}`, response.status);
+				if (next.origin !== new URL(target).origin) {
+					headers = new Headers(headers);
+					headers.delete("authorization");
+					headers.delete("x-vercel-trusted-oidc-idp-token");
+					headers.delete("x-vercel-protection-bypass");
+				}
+				target = next.href;
+				continue;
+			}
+		}
+		const { status } = response;
+		if (/^text\/html\b/i.test(response.headers.get("content-type") ?? "") && !response.headers.has("content-disposition") && (status >= 200 && status < 300 || status === 401 || status === 403)) throw new Wall(status);
+		return response;
+	}
+}
+const bypassFile = (host) => join(configDir(), "bypass", `${createHash("sha256").update(host).digest("hex").slice(0, 32)}.json`);
+async function readBypass(host) {
+	try {
+		return JSON.parse(await readFile(bypassFile(host), "utf8")).secret || null;
+	} catch {
+		return null;
+	}
+}
+async function writeBypass(host, secret) {
+	await mkdir(join(configDir(), "bypass"), {
+		recursive: true,
+		mode: 448
+	});
+	await writeFile(bypassFile(host), JSON.stringify({
+		host,
+		secret
+	}), { mode: 384 });
+}
+const automationBypass = (bypasses) => Object.entries(bypasses ?? {}).find(([, value]) => value.scope === "automation-bypass")?.[0] ?? null;
+/**
+* The board's project's automation bypass secret, as `vercel curl` finds it:
+* the deployment (or alias) behind the host gives the project, whose
+* `protectionBypass` has it. When there's none, it's created.
+*/
+async function projectBypass(url, host, doFetch) {
+	const blocked = (why) => new BoardError("protected", `${url} is behind Vercel Deployment Protection, and your Vercel login ${why}, or set VERCEL_AUTOMATION_BYPASS_SECRET (${WHERE})`, 0);
+	let api;
+	try {
+		const token = await getVercelToken();
+		api = async (method, path) => {
+			const response = await doFetch(`https://api.vercel.com${path}`, {
+				method,
+				headers: {
+					authorization: `Bearer ${token}`,
+					...method === "PATCH" ? { "content-type": "application/json" } : {}
+				},
+				...method === "PATCH" ? { body: "{}" } : {}
+			});
+			return response.ok ? await response.json() : null;
+		};
+	} catch {
+		api = vercelCliApi;
+	}
+	const project = await findProject(api, host);
+	if (!project) throw blocked("can't see its project: run `vercel login` or ask for access");
+	const scope = project.ownerId.startsWith("team_") ? `?teamId=${project.ownerId}` : "";
+	const details = await api("GET", `/v9/projects/${project.projectId}${scope}`);
+	if (!details) throw blocked("can't read its project's settings: ask for access");
+	const existing = automationBypass(details.protectionBypass);
+	if (existing) return {
+		secret: existing,
+		created: false
+	};
+	if (!details.ssoProtection && !details.passwordProtection) throw new BoardError("no_board", `no board at ${url}: it answered with a web page, and its Vercel project isn't protected`, 0);
+	const created = await api("PATCH", `/v1/projects/${project.projectId}/protection-bypass${scope}`);
+	const secret = automationBypass(created?.protectionBypass);
+	if (!secret) throw blocked("can't read or create its project's automation bypass: ask a project admin");
+	process.stderr.write(`created a Protection Bypass for Automation on the Vercel project ${details?.name ?? project.projectId}\n`);
+	return {
+		secret,
+		created: true
+	};
+}
+/** The project behind a host, as `vercel curl` finds it: the deployment, then the alias, in your own scope and then each of your teams. */
+async function findProject(api, host) {
+	const lookup = async (kind, team) => {
+		const found = await api("GET", `${kind === "deployment" ? `/v13/deployments/${encodeURIComponent(host)}` : `/now/aliases/${encodeURIComponent(host)}`}${team ? `?teamId=${team}` : ""}`).catch(() => null);
+		const owner = found?.ownerId ?? found?.team?.id ?? team;
+		return found?.projectId && owner ? {
+			projectId: found.projectId,
+			ownerId: owner
+		} : null;
+	};
+	const own = await lookup("deployment", null) ?? await lookup("alias", null);
+	if (own) return own;
+	const { teams } = await api("GET", "/v2/teams?limit=100").catch(() => null) ?? {};
+	const ids = (teams ?? []).filter((team) => !team.limited).map((team) => team.id);
+	for (const kind of ["deployment", "alias"]) for (let i = 0; i < ids.length; i += 8) {
+		const found = (await Promise.all(ids.slice(i, i + 8).map((id) => lookup(kind, id)))).find(Boolean);
+		if (found) return found;
+	}
+	return null;
+}
+/** When credentials live in the keychain, the Vercel CLI makes the API call itself. */
+let vercelCli;
+const vercelCliApi = async (method, path) => {
+	vercelCli ??= promisify(execFile)("vercel", ["whoami", "--non-interactive"], { timeout: 1e4 }).then(() => true, () => false);
+	if (!await vercelCli) throw new BoardError("not_logged_in", "not signed in to Vercel: run `vercel login`", 0);
+	const args = [
+		"api",
+		path,
+		"-X",
+		method,
+		"--raw",
+		"--non-interactive"
+	];
+	if (method === "PATCH") args.push("--input", "-");
+	try {
+		const run = promisify(execFile)("vercel", args, { timeout: 3e4 });
+		run.child.stdin?.on("error", () => {});
+		run.child.stdin?.end(method === "PATCH" ? "{}" : "");
+		return JSON.parse((await run).stdout);
+	} catch (error) {
+		if (error.code === "ENOENT") throw new BoardError("not_logged_in", "not signed in to Vercel: run `vercel login`", 0);
+		return null;
+	}
+};
+//#endregion
+//#region src/backend-http/index.ts
+const environment = {
+	url: boardUrl,
+	fetch: (url) => connect(url).fetch,
+	profile: environmentProfile
+};
+/**
+* The board at `url`, which keeps the log: this board uses it as this deployment. Without a
+* `url`, the one the environment points at: `BOARD_URL`, the repo's link, or `vb use`'s.
+* Without a `fetch`, it sends the credentials `vb` would.
+*/
+function http(url, options = {}) {
+	return createHttp(url, options, environment);
+}
+//#endregion
+export { detectAgent as a, projectUrl as c, connect as i, boardUrl as n, localTokenFile as o, configDir as r, projectDir as s, http as t };