@vercel/board 0.16.0 → 0.18.0

package/dist/{a2-C41hD8SF.mjs → a2-ChRLRupa.mjs}

@@ -1,26 +1,41 @@
 import { n as DIRECT_UPLOAD_BYTES_MAX, r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
 import { _ as RemoteWatcherId, b as actorKind, i as Attachment, x as platformAvatar } from "./schemas-Be08nyfW.mjs";
-import { _ as schedulesContract, d as SCHEDULES_SESSION, f as boardContract, g as registryContract, h as inboxSession, m as inboxContract, o as IDENTITY_SESSION, p as identityContract, s as INBOXES_SESSION, t as BOARD_SESSION, u as REGISTRY_SESSION, v as watchContract, y as watchSession } from "./contract-CuJmlrhw.mjs";
-import { s as isKeyIdOf, t as compileWatcher } from "./watch-spec-W0c7ypHJ.mjs";
-import { r as duration, t as BoardError } from "./client-DGDPaN7U.mjs";
-import { c as VERSION, l as SYNC, n as METHODS, t as canonicalWatchers } from "./watchers-hash-CLjsa6od.mjs";
-import { a as forbidden, c as toErrorResponse, r as badRequest, s as notFound, t as HttpError } from "./errors-DX3hpwWt.mjs";
-import { a as resolveMentions, n as actorSeen, s as replaceMentions } from "./actors-DjMeZpnU.mjs";
-import { n as authorize, t as FULL_ACCESS } from "./access-CJU2-vaa.mjs";
-import { i as authenticates } from "./auth-COzc09sn.mjs";
-import { a as MIDDLEWARE_ACTOR, i as DroppedError } from "./targets-yM5JBUgr.mjs";
-import { n as channelsReducer, s as identityCodesReducer, t as actorsReducer, u as linkedTo } from "./reducers-mUPFuFJV.mjs";
-import { A as view, C as linkedIds, D as readableFilter, E as pollFeed, M as viewedBy, O as ref, S as indexOf, T as personView, _ as waitUntil, a as blindText, b as eventView, c as landedFor, d as writeDelete, f as writeEdit, g as writeReaction, h as writePost, i as authorizePost, j as viewLinkedIds, k as toMessageFilter, l as trusted, m as writeLinks, n as authorizeMessage, p as writeLabels, r as authorizeOwn, s as deploymentIdentity, t as afterRetry, u as writeAttach, v as OWN_CODE, w as loadBefore, x as foldEvent, y as compileFilter } from "./attempts-Bxp9KgPf.mjs";
-import { t as TABLES_CONSUMER } from "./sql-DbiEnqM0.mjs";
-import { A2Error, idempotentId, reducer } from "experimental-a2";
+import "./external-BV_cUncs.mjs";
+import { f as VERSION, n as compileWatcher, o as METHODS, p as SYNC, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-RLtnSF-t.mjs";
+import { r as duration, t as BoardError } from "./client-BA-J7usH.mjs";
+import { n as derivedId, r as isKeyIdOf } from "./ids-C6AYo1bu.mjs";
+import { a as forbidden, c as toErrorResponse, i as duplicateId, r as badRequest, s as notFound, t as HttpError } from "./errors-DX3hpwWt.mjs";
+import { t as own } from "./own-OwgPWdmh.mjs";
+import { n as replaceMentions } from "./mentions-CB6ShY4R.mjs";
+import { _ as FULL_ACCESS, i as authenticates, v as authorize } from "./auth-Drg9FiC2.mjs";
+import { a as resolveMentions, n as actorSeen } from "./actors-BOamkEuz.mjs";
+import { n as MIDDLEWARE_ACTOR, t as DroppedError } from "./middleware-CqaCwucP.mjs";
+import { n as syncTarget, r as withEmailMentions } from "./targets-C-wdR5wP.mjs";
+import { t as A2Error } from "./session-clear-wHd5GCpZ-BnKSxReK.mjs";
+import { a as reducer } from "./reducer-CjmvZSAb-D_OSISmj.mjs";
+import { _ as BOARD_SESSION, a as IDENTITY_SESSION, c as SCHEDULES_SESSION, d as inboxContract, f as inboxSession, g as watchSession, h as watchContract, l as boardContract, m as schedulesContract, n as channelsReducer, o as INBOXES_SESSION, p as registryContract, r as identityCodesReducer, s as REGISTRY_SESSION, t as actorsReducer, u as identityContract } from "./reducers-BFmIXilu.mjs";
+import { n as createServer, t as consumer } from "./server-DtFrWxi3-Boa6gdWO.mjs";
+import { a as linkedTo, i as iso, n as foldMessages, o as personOf, t as foldActors } from "./folds-Dyjput8M.mjs";
+import { t as concernedMessageId } from "./project-DMDST9kl.mjs";
+import { t as TABLES_CONSUMER } from "./sql-U9WTxrwJ.mjs";
+import { n as waitUntil, t as afterRetry } from "./attempts-CLG840Oj.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { consumer, createServer } from "experimental-a2/server";
 import { lookup } from "node:dns";
 import { request } from "node:https";
 import { BlockList, isIP } from "node:net";
+//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/idempotent-id-BRJVeylj.js
+async function idempotentId(...parts) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(parts)));
+	const bytes = new Uint8Array(digest).slice(0, 16);
+	bytes[6] = bytes[6] & 15 | 128;
+	bytes[8] = bytes[8] & 63 | 128;
+	const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+//#endregion
 //#region src/server/blob.ts
 /** Files in memory, for tests: forgets everything when the process ends. */
 function memoryBlob() {
@@ -196,6 +211,461 @@ async function finishUpload(blob, id, principal) {
 	return attachment;
 }
 //#endregion
+//#region src/server/feed.ts
+/** Bookkeeping events, shown only with `all`: who's who, and delivery receipts. */
+const HIDDEN = /* @__PURE__ */ new Set([
+	"actor.seen",
+	"message.synced",
+	"message.files_synced"
+]);
+/** The person a linked platform actor is, as views show it. */
+function personView(actors, actor) {
+	const link = own(actors.links, actor);
+	const person = link ? own(actors.byId, link.to) : void 0;
+	return link ? {
+		id: link.to,
+		handle: person?.handle ?? link.to,
+		name: person?.name ?? link.to,
+		avatar: person?.avatar ?? null
+	} : void 0;
+}
+function actorView(actors, id) {
+	const author = own(actors.byId, id);
+	if (!author) return null;
+	const person = personView(actors, id);
+	return {
+		kind: author.kind,
+		handle: author.handle,
+		name: author.name,
+		avatar: author.avatar,
+		...person ? { person } : {}
+	};
+}
+/** The board's own code, which reads every channel: it needs no messages to say so. */
+const OWN_CODE = {
+	access: FULL_ACCESS,
+	channelOf: () => void 0
+};
+/** The board messages `links` point to, for `Reader.channelOf`. */
+const linkedIds = (links) => links.flatMap((link) => link.message === null ? [] : [link.message]);
+/**
+* Links as `reader` may see them. The log keeps each snapshot; it's hidden when
+* it's read. A linked message the reader's lookup doesn't have hides too: its
+* snapshot shows only where it's known to be readable.
+*/
+function readableLinks(links, reader) {
+	return links.map((link) => {
+		if (link.message === null) return {
+			...link,
+			message: null
+		};
+		const channel = reader.access.readsAll ? void 0 : reader.channelOf(link.message);
+		return reader.access.readsAll || channel !== void 0 && reader.access.readable(channel) ? {
+			...link,
+			message: ref(link.message)
+		} : {
+			url: link.url,
+			message: null,
+			snapshot: null,
+			unavailable: "not_readable"
+		};
+	});
+}
+/** The links in an event view: its payload's, its message's, and the message before a label change. */
+const viewLinks = (view) => {
+	const { payload, message, before } = view;
+	return [
+		payload?.links,
+		message?.links,
+		before?.links
+	].filter((links) => links !== void 0);
+};
+/** The board messages an event view's links point to, for a reader of them. */
+const viewLinkedIds = (view) => viewLinks(view).flatMap((links) => links.flatMap((link) => link.message === null ? [] : [indexOf(link.message) ?? 0]));
+/**
+* An event view made for one reader, as `reader` sees it: a link to a message it can't read shows
+* nothing of it. A watcher's match is made when its event lands and pulled later, by whatever its
+* registrant may read then.
+*/
+function viewedBy(view, reader) {
+	if (reader.access.readsAll) return view;
+	const shown = structuredClone(view);
+	const reread = (links) => readableLinks(links.map((link) => ({
+		...link,
+		message: link.message === null ? null : indexOf(link.message) ?? 0
+	})), reader);
+	if (shown.payload?.links) shown.payload.links = reread(shown.payload.links);
+	if (shown.message) shown.message.links = reread(shown.message.links);
+	if (shown.before) shown.before.links = reread(shown.before.links);
+	return shown;
+}
+/** A message's or a cursor's ID as clients see it. On this board it's the log index, in decimal. */
+const ref = (index) => String(index);
+/** The log index a ref names on this board, or null for a string that names nothing here. */
+const indexOf = (value) => /^(0|[1-9]\d{0,15})$/.test(value) ? Number(value) : null;
+/** A message as `reader` sees it. Every view names its reader, so none shows a link's snapshot by default. */
+function view(message, actors, reader) {
+	const { blind, version, schedule, ...shown } = message;
+	return {
+		...shown,
+		...blind ? { blind } : {},
+		id: ref(message.id),
+		re: message.re === null ? null : ref(message.re),
+		replyTo: message.replyTo === null ? null : ref(message.replyTo),
+		version: version ?? message.id,
+		...schedule ? { schedule: {
+			id: ref(schedule.id),
+			n: schedule.n
+		} } : {},
+		links: readableLinks(message.links, reader),
+		labels: { ...message.labels },
+		reactions: Object.fromEntries(Object.entries(message.reactions).map(([emoji, ids]) => [emoji, [...ids]])),
+		author: actorView(actors, message.by.actor)
+	};
+}
+/** Whether accounts are linked to `id`: then it's a person, even one who never wrote on the board. */
+const hasLinks = (actors, id) => Object.values(actors.links).some((link) => link.to === id);
+const actorSet = (value, actors) => own(actors.byId, value) || own(actors.links, value) || hasLinks(actors, value) ? /* @__PURE__ */ new Set([value]) : new Set(own(actors.byHandle, value.toLowerCase()) ?? []);
+/**
+* Who a `--by` or `--mentions` value covers. A person (`julian`, or one of their
+* linked accounts, `@julian` on Slack) is everyone they are: their own actor,
+* their agents (`julian/claude`), and every account linked to them. An agent
+* or an unlinked platform actor is just itself.
+*/
+function whoIs(value, actors) {
+	const ids = actorSet(value, actors);
+	const out = new Set(ids);
+	const principals = /* @__PURE__ */ new Set();
+	for (const id of ids) {
+		const kind = own(actors.byId, id)?.kind;
+		const person = own(actors.links, id) ? personOf(actors, id) : kind === "person" || hasLinks(actors, id) ? id : null;
+		if (person === null) continue;
+		principals.add(person);
+		out.add(person);
+		for (const linked of linkedTo(actors, person)) out.add(linked);
+	}
+	return {
+		actors: out,
+		principals
+	};
+}
+/** Whether `author` is one of `who`: its actor, or an agent of one of its people. */
+const covers = (who, actor, principal) => who.actors.has(actor) || principal !== void 0 && who.principals.has(principal);
+const hasLabel = (labels, [key, values]) => Object.hasOwn(labels, key) && (values === null || values.includes(labels[key]));
+/**
+* Compiles filters once; handles resolve against the actors known at that
+* moment. A label matches on the message or its thread's root, where sync puts
+* labels, so `pr=…` means the PR's whole conversation. `messages` is the live
+* state for that lookup. A message in a channel `access` can't read never
+* matches, whatever the filters say.
+*/
+function compileFilter(filters, context) {
+	const { access } = context;
+	const text = filters.text?.toLowerCase();
+	const labels = filters.label ?? [];
+	const channel = filters.channel;
+	const subtree = channel?.endsWith("/") ? channel.slice(0, -1) : null;
+	const by = filters.by === void 0 ? null : whoIs(filters.by, context.actors);
+	const re = filters.re === void 0 ? void 0 : indexOf(filters.re) ?? -1;
+	const mentions = filters.mentions === void 0 ? null : filters.mentions === "me" ? new Set(context.me === null ? [] : [context.me, ...linkedTo(context.actors, context.me)]) : whoIs(filters.mentions, context.actors).actors;
+	return (message) => {
+		if (!message || !access.readable(message.channel)) return false;
+		if (channel !== void 0) {
+			if (subtree !== null) {
+				if (message.channel !== subtree && !message.channel.startsWith(`${subtree}/`)) return false;
+			} else if (message.channel !== channel) return false;
+		}
+		if (re !== void 0 && message.id !== re && message.re !== re) return false;
+		if (by !== null && !covers(by, message.by.actor, message.by.principal)) return false;
+		if (mentions !== null && !message.mentions.some((id) => mentions.has(id))) return false;
+		if (filters.from !== void 0 && (message.from ?? "board") !== filters.from) return false;
+		if (text !== void 0 && !message.text.toLowerCase().includes(text)) return false;
+		if (labels.length > 0) {
+			const root = message.re === null ? void 0 : context.messages?.byId[message.re];
+			for (const label of labels) if (!hasLabel(message.labels, label) && !(root && hasLabel(root.labels, label))) return false;
+		}
+		return true;
+	};
+}
+/**
+* `filter`, narrowed to the channels `access` reads among `known`, as the tables
+* take it: a reader of every channel needs nothing more. A channel the caller
+* didn't know of is left out, never let in.
+*/
+function readableFilter(filter, known, access) {
+	if (access.readsAll) return filter;
+	const { channel, ...rest } = filter;
+	const within = (path) => !channel || path === channel.path || channel.subtree && path.startsWith(`${channel.path}/`);
+	return {
+		...rest,
+		channels: [...known].filter((path) => within(path) && access.readable(path))
+	};
+}
+/** The filters as the tables take them: handles resolved to who they cover, `me` to the caller. */
+function toMessageFilter(filters, context) {
+	const out = {};
+	const channel = filters.channel;
+	if (channel !== void 0) out.channel = channel.endsWith("/") ? {
+		path: channel.slice(0, -1),
+		subtree: true
+	} : {
+		path: channel,
+		subtree: false
+	};
+	if (filters.re !== void 0) out.re = indexOf(filters.re) ?? -1;
+	if (filters.by !== void 0) {
+		const who = whoIs(filters.by, context.actors);
+		out.by = {
+			actors: [...who.actors],
+			principals: [...who.principals]
+		};
+	}
+	if (filters.mentions !== void 0) out.mentions = filters.mentions === "me" ? context.me === null ? [] : [context.me, ...linkedTo(context.actors, context.me)] : [...whoIs(filters.mentions, context.actors).actors];
+	if (filters.from !== void 0) out.from = filters.from;
+	if (filters.text !== void 0) out.text = filters.text.toLowerCase();
+	if (filters.label?.length) out.labels = filters.label.map(([key, values]) => ({
+		key,
+		values
+	}));
+	return out;
+}
+/**
+* Loads into `messages`, as they were just before `event`, the message it
+* concerns and that message's root: what folding it and matching filters need.
+* `loaded` remembers what was asked for already, found or not.
+*/
+async function loadInto(reads, messages, loaded, event, signal) {
+	const id = concernedMessageId(event);
+	if (id === null) return;
+	const through = event.index - 1;
+	const load = async (ids) => {
+		const wanted = ids.filter((want) => !loaded.has(want));
+		if (wanted.length === 0) return;
+		const found = await reads.messagesAt(wanted, through, signal);
+		for (const want of wanted) {
+			loaded.add(want);
+			const message = found.get(want);
+			if (message) messages.byId[want] = message;
+		}
+	};
+	if (event.type === "message.posted") loaded.add(id);
+	else await load([id]);
+	const re = event.type === "message.posted" ? event.payload.re : messages.byId[id]?.re ?? null;
+	if (re !== null) await load([re]);
+}
+/** The message `event` concerns and its root, as they were just before it. */
+async function loadBefore(reads, event, signal) {
+	const messages = {
+		byId: {},
+		replies: {}
+	};
+	await loadInto(reads, messages, /* @__PURE__ */ new Set(), event, signal);
+	return messages;
+}
+/** Folds one event into `messages` and `actors`, and returns the message it concerns before and after. */
+function foldEvent(messages, actors, event) {
+	const id = concernedMessageId(event);
+	const before = id === null ? void 0 : structuredClone(messages.byId[id]);
+	foldMessages(messages, event);
+	foldActors(actors, event);
+	return {
+		id,
+		before,
+		after: id === null ? void 0 : messages.byId[id]
+	};
+}
+/** An event as subscribers receive it, with its message as it is afterwards. */
+function eventView(event, after, actors, reader) {
+	const by = event.payload.by?.actor;
+	const actor = by ? own(actors.byId, by) : void 0;
+	const { links } = event.payload;
+	return {
+		cursor: ref(event.index),
+		type: event.type,
+		createdAt: iso(event.createdAt),
+		payload: payloadView(event.payload, links ? readableLinks(links, reader) : void 0),
+		...after ? { message: view(after, actors, reader) } : {},
+		...actor ? { actor: {
+			id: actor.id,
+			...actorView(actors, actor.id)
+		} } : {}
+	};
+}
+/** An event's payload as clients see it: the message IDs in it are refs. */
+function payloadView(payload, links) {
+	const shown = { ...payload };
+	for (const key of [
+		"id",
+		"re",
+		"replyTo"
+	]) if (typeof shown[key] === "number") shown[key] = ref(shown[key]);
+	const schedule = shown.schedule;
+	if (schedule) shown.schedule = {
+		id: ref(schedule.id),
+		n: schedule.n
+	};
+	if (links) shown.links = links;
+	return shown;
+}
+/**
+* Folds events one at a time and decides what a subscriber sees. It holds only
+* the messages events have touched, each loaded from the tables as it was just
+* before the first event that touched it. A label or reaction change is
+* delivered when its message matched the filter before *or* after it, so
+* subscribers see messages leave a view too.
+*
+* It's the one choke point for `/events` (tail, wait, and poll): an event about
+* a message shows only where `access` reads its channel, and one about no
+* message (who's who, a thread's sync) only to a reader of every channel.
+*/
+var FeedProjection = class {
+	messages = {
+		byId: {},
+		replies: {}
+	};
+	loaded = /* @__PURE__ */ new Set();
+	reads;
+	actors;
+	match;
+	criteria;
+	all;
+	access;
+	/** Where each board message a view links to lives, for a reader that can't read every channel. */
+	linked = /* @__PURE__ */ new Map();
+	constructor(options) {
+		this.reads = options.reads;
+		this.actors = options.actors;
+		this.access = options.access;
+		this.match = compileFilter(options.filters, {
+			me: options.me,
+			actors: options.actors,
+			messages: this.messages,
+			access: options.access
+		});
+		this.criteria = hasCriteria(options.filters);
+		this.all = options.all;
+	}
+	/** Loads what `events` touch, all as of `index`, in two queries rather than two per event. */
+	async preload(events, index) {
+		const ids = /* @__PURE__ */ new Set();
+		for (const event of events) {
+			const id = concernedMessageId(event);
+			if (id === null) continue;
+			if (event.type !== "message.posted") ids.add(id);
+			else if (event.payload.re !== null) ids.add(event.payload.re);
+		}
+		const load = async (wanted) => {
+			if (wanted.length === 0) return;
+			const found = await this.reads.messagesAt(wanted, index);
+			for (const id of wanted) {
+				this.loaded.add(id);
+				const message = found.get(id);
+				if (message) this.messages.byId[id] = message;
+			}
+		};
+		await load([...ids].filter((id) => !this.loaded.has(id) && id <= index));
+		const roots = Object.values(this.messages.byId).flatMap((message) => message.re === null ? [] : [message.re]);
+		await load([...new Set(roots)].filter((id) => !this.loaded.has(id)));
+	}
+	async step(event, signal) {
+		await loadInto(this.reads, this.messages, this.loaded, event, signal);
+		const { id, before, after } = foldEvent(this.messages, this.actors, event);
+		const message = after ?? before;
+		const readable = id === null ? this.access.readsAll : message !== void 0 && this.access.readable(message.channel);
+		const hidden = HIDDEN.has(event.type) && !this.all;
+		if (!(readable && !hidden && (this.criteria ? this.match(before) || this.match(after) : id !== null || this.all))) return {
+			index: event.index,
+			view: null
+		};
+		await this.loadLinked([...after?.links ?? [], ...event.payload.links ?? []], event.index, signal);
+		const reader = {
+			access: this.access,
+			channelOf: (message) => this.messages.byId[message]?.channel ?? this.linked.get(message)
+		};
+		return {
+			index: event.index,
+			view: eventView(event, after, this.actors, reader)
+		};
+	}
+	/** Where the messages `links` point to live; a message never moves, so any version says. */
+	async loadLinked(links, index, signal) {
+		if (this.access.readsAll) return;
+		const wanted = [...new Set(linkedIds(links))].filter((id) => !this.messages.byId[id] && !this.linked.has(id));
+		if (wanted.length === 0) return;
+		const found = await this.reads.messagesAt(wanted, index, signal);
+		for (const id of wanted) this.linked.set(id, found.get(id)?.channel);
+	}
+};
+/** Resolves when the iterator yields, or with null once the signal aborts. */
+function nextOrAbort(iterator, signal) {
+	if (signal.aborted) return Promise.resolve(null);
+	return new Promise((resolve, reject) => {
+		const onAbort = () => resolve(null);
+		signal.addEventListener("abort", onAbort, { once: true });
+		iterator.next().then((result) => {
+			signal.removeEventListener("abort", onAbort);
+			resolve(result);
+		}, (error) => {
+			signal.removeEventListener("abort", onAbort);
+			reject(error);
+		});
+	});
+}
+/** Where a feed starts: `after`, or the head when it's omitted or past it. */
+async function start(options) {
+	const { index: head } = await options.session.state(channelsReducer);
+	return options.after === void 0 || options.after >= head ? head : options.after;
+}
+const PAGE = 200;
+/**
+* One long-poll: matching events already in the log return at once; otherwise
+* it waits up to `waitMs` for the first new match. The cursor is the last
+* event examined, matched or not, so the next poll never rescans.
+*/
+async function pollFeed(options, waitMs, signal) {
+	const index = await start(options);
+	const feed = new FeedProjection(options);
+	const events = [];
+	let cursor = index;
+	const backlog = await options.session.history({
+		gte: index + 1,
+		lte: index + PAGE
+	});
+	await feed.preload(backlog, index);
+	for (const event of backlog) {
+		const item = await feed.step(event, signal);
+		cursor = item.index;
+		if (item.view) events.push(item.view);
+	}
+	if (events.length > 0 || backlog.length === PAGE || waitMs <= 0) return {
+		events,
+		cursor
+	};
+	const timeout = AbortSignal.timeout(waitMs);
+	const until = AbortSignal.any([signal, timeout]);
+	const iterator = options.session.stream({ startAfter: cursor })[Symbol.asyncIterator]();
+	try {
+		while (true) {
+			const next = await nextOrAbort(iterator, until);
+			if (next === null || next.done) return {
+				events,
+				cursor
+			};
+			const item = await feed.step(next.value, until);
+			cursor = item.index;
+			if (item.view) {
+				events.push(item.view);
+				return {
+					events,
+					cursor
+				};
+			}
+		}
+	} finally {
+		iterator.return?.();
+	}
+}
+//#endregion
 //#region src/server/reads.ts
 /** Keeps the tables from the board's log, one event at a time, from the first. */
 function tablesConsumer(tables) {
@@ -300,6 +770,426 @@ function createReads(tables, session, projection) {
 	};
 }
 //#endregion
+//#region src/server/writes.ts
+/** A piece of the board's own deployment, writing as `actor` with full access. */
+function deploymentIdentity(actor, handle) {
+	return {
+		principal: {
+			id: actor,
+			kind: "deployment",
+			handle,
+			access: FULL_ACCESS,
+			expiresAt: null
+		},
+		author: {
+			actor,
+			principal: actor,
+			profile: null,
+			session: null
+		},
+		actor: {
+			id: actor,
+			kind: "deployment",
+			handle,
+			name: handle,
+			avatar: null
+		}
+	};
+}
+/**
+* The `actor.seen` a write carries, or null: who its author is, as the board's record of them
+* says, unless the board knows that already. A platform user's record is board-wide, so a write
+* whose identity doesn't keep it (`records: false`) leaves it as it is. A host's principal and its
+* profiles are recorded as the host's, which sync never writes as.
+*/
+function seenFor(identity, actors) {
+	if (identity.records === false) return null;
+	return actorSeen(identity.actor, actors, identity.principal.facts?.issuer === "host");
+}
+/** The actors a write can mention: the ones the board knows, plus the ones an email named. */
+const knownWith = (actors, found) => found.length === 0 ? actors : {
+	...actors,
+	byId: {
+		...actors.byId,
+		...Object.fromEntries(found.map((a) => [a.id, a]))
+	}
+};
+const messageNotFound = (id) => () => notFound(`message not found: #${id}`, "message_not_found");
+/**
+* A message the board looked up and the caller may act on with `permission`,
+* proved against its own channel. A message they can't read answers 404, as if
+* it didn't exist: IDs are sequential, so a 403 would confirm it does.
+*/
+async function authorizeMessage(ctx, access, permission, id) {
+	const message = await ctx.reads.message(id);
+	if (!message) throw messageNotFound(id)();
+	return {
+		message,
+		proof: authorize(access, permission, message.channel, messageNotFound(id))
+	};
+}
+/**
+* Your own message, to edit or delete: `post` in its channel. Where you can't
+* read, it's yours only if it was posted without reading too: a write-only
+* source fixes what it wrote, but a principal ID it shares with a caller that
+* reads (a repo's workflows share one) doesn't reach that caller's messages.
+* Someone else's answers 404 where you can't read it, and 403 where you can.
+*/
+async function authorizeOwn(ctx, principal, id, verb) {
+	const message = await ctx.reads.message(id);
+	if (!message) throw messageNotFound(id)();
+	const readable = principal.access.readable(message.channel);
+	if (message.by.principal !== principal.id || !readable && !message.blind) {
+		if (!readable) throw messageNotFound(id)();
+		throw forbidden(`only the author can ${verb} a message`);
+	}
+	return {
+		message,
+		proof: authorize(principal.access, "post", message.channel)
+	};
+}
+const hasLabels = (labels) => Object.keys(labels ?? {}).length > 0;
+/**
+* Proofs for a post. A root lands in the channel it names, which the caller
+* needn't read: write-only is `['post']`. A reply lands in its root's channel,
+* looked up here and never taken from the request, and needs `read` there too,
+* since addressing a thread you can't see would confirm it exists.
+*/
+async function authorizePost(ctx, access, input) {
+	let channel;
+	let re;
+	if (input.re !== void 0) {
+		re = (await authorizeMessage(ctx, access, "read", input.re)).message;
+		channel = re.channel;
+	} else {
+		if (!input.channel) throw badRequest("a post needs a channel");
+		channel = input.channel;
+	}
+	return {
+		post: authorize(access, "post", channel),
+		...re ? { re } : {},
+		...hasLabels(input.labels) ? { label: authorize(access, "label", channel) } : {},
+		...input.sync?.length ? { sync: authorize(access, "sync", channel) } : {}
+	};
+}
+/**
+* Spends a proof on its target: a write checked against one channel can't land
+* in another. A mismatch is the board's own bug, never the caller's.
+*/
+function spend(proof, permission, target) {
+	if (!proof || proof.permission !== permission || proof.channel !== target.channel) throw new Error(`a ${permission} write in ${target.channel} needs a proof for that channel`);
+}
+/** Full-access proofs for the board's own code (sync), still checked against the channel each write lands in. */
+const trusted = {
+	message: (ctx, permission, id) => authorizeMessage(ctx, FULL_ACCESS, permission, id),
+	post: (ctx, input) => authorizePost(ctx, FULL_ACCESS, input)
+};
+async function writePost(ctx, input) {
+	const { identity } = input;
+	const sent = input.text;
+	let channel = input.channel;
+	let re = null;
+	let replyTo = null;
+	let thread;
+	const id = input.id ?? (input.re === void 0 ? crypto.randomUUID() : void 0);
+	if (input.re !== void 0) {
+		const target = input.proofs.re;
+		if (target?.id !== input.re) throw new Error(`a reply to #${input.re} needs proofs for that message`);
+		re = target.re ?? target.id;
+		replyTo = target.id === re ? null : target.id;
+		channel = target.channel;
+		thread = target.thread;
+		if (input.sync?.length) throw badRequest("sync attaches whole threads: use `board sync <id> <target>`");
+	} else {
+		if (!channel) throw badRequest("a post needs a channel");
+		thread = id;
+	}
+	spend(input.proofs.post, "post", { channel });
+	if (hasLabels(input.labels)) spend(input.proofs.label, "label", { channel });
+	if (input.sync?.length) spend(input.proofs.sync, "sync", { channel });
+	if (input.id !== void 0) {
+		const landed = await ctx.reads.byEventId(input.id);
+		if (landed) {
+			if (landed.channel !== channel || landed.re !== re || landed.replyTo !== replyTo) throw duplicateId();
+			const shown = await landedFor(ctx, identity, landed);
+			if (!shown) throw duplicateId();
+			return shownTo(shown, identity.principal.access, sent);
+		}
+	}
+	return commitPost(ctx, input, {
+		channel,
+		re,
+		replyTo,
+		thread,
+		id,
+		sent
+	});
+}
+/**
+* A post that landed, as its author may have it back: only the same author's, and one in a
+* channel it can't read only if it posted without reading too. A caller that can't read gets back
+* what it sent, as it landed: never what others have added since. Null for anyone else.
+*/
+async function landedFor(ctx, identity, landed) {
+	if (!sameAuthor(landed.by, identity.author)) return null;
+	const { access } = identity.principal;
+	const { state: actors } = await ctx.session.state(actorsReducer);
+	if (access.readable(landed.channel)) return view(landed, actors, await readerFor(ctx, access, landed));
+	if (!landed.blind) return null;
+	const [event] = await ctx.session.history({
+		gte: landed.id,
+		lte: landed.id
+	});
+	const posted = foldMessages({
+		byId: {},
+		replies: {}
+	}, event).byId[landed.id];
+	return {
+		...view(posted, actors, await readerFor(ctx, access, posted)),
+		text: blindText(posted.text, identity.actor.id),
+		mentions: []
+	};
+}
+/**
+* A message's text for its writer where it can't read: each exact mention but of itself shows as
+* `@…`. The board may have turned an email it wrote into an actor ID, and who that is, `/actors`
+* doesn't show it either.
+*/
+const blindText = (text, own) => replaceMentions(text, (token) => token.kind === "actor" && token.actor !== own ? "@…" : null);
+const sameAuthor = (a, b) => a.actor === b.actor && a.principal === b.principal && a.profile === b.profile && a.session === b.session;
+async function commitPost(ctx, input, placed) {
+	const { identity } = input;
+	const { channel, re, replyTo, thread, id, sent } = placed;
+	const { state: actors } = await ctx.session.state(actorsReducer);
+	const targets = [];
+	if (re === null) for (const requested of input.sync ?? []) {
+		const target = syncTarget(requested);
+		await unclaimed(ctx, target, thread, identity.principal.access);
+		if (!targets.some((t) => t.target === target.target)) targets.push({
+			...target,
+			cause: "request"
+		});
+	}
+	const seen = seenFor(identity, actors);
+	const { text, found } = await withEmailMentions(input.text);
+	const named = found.map((actor) => actorSeen(actor, actors)).filter((event) => event !== null);
+	const { mentions, unknown } = resolveMentions(text, knownWith(actors, found), seen ? identity.actor : void 0, input.lenientMentions ?? false, identity.principal.access.readsAll);
+	const synced = await Promise.all(targets.map(async ({ target, kind, cause }) => ({
+		type: "thread.synced",
+		id: await derivedId("board", thread, "sync", target),
+		payload: {
+			thread,
+			target,
+			kind,
+			cause,
+			by: identity.author
+		}
+	})));
+	const rows = await ctx.session.append(...seen ? [seen] : [], ...named, {
+		type: "message.posted",
+		...id ? { id } : {},
+		payload: {
+			channel,
+			text,
+			re,
+			replyTo,
+			thread,
+			labels: input.labels ?? {},
+			noSync: input.noSync ?? false,
+			mentions,
+			by: identity.author,
+			origin: input.origin ?? null,
+			from: input.from ?? null,
+			...input.attachments?.length ? { attachments: input.attachments } : {},
+			...input.links?.length ? { links: input.links } : {},
+			...input.schedule ? { schedule: input.schedule } : {},
+			...identity.principal.access.readable(channel) ? {} : { blind: true },
+			...input.importedBy !== void 0 ? { importedBy: input.importedBy } : {}
+		}
+	}, ...synced);
+	const posted = rows.find((row) => row.type === "message.posted");
+	await untilApplied(ctx, rows);
+	const message = foldMessages({
+		byId: {},
+		replies: {}
+	}, posted).byId[posted.index];
+	const known = seen ? {
+		...actors,
+		byId: {
+			...actors.byId,
+			[identity.actor.id]: identity.actor
+		}
+	} : actors;
+	return shownTo(view(message, known, await readerFor(ctx, identity.principal.access, message)), identity.principal.access, sent, unknown);
+}
+/**
+* A post's view for its writer. One that can't read the channel gets back the
+* text it sent, no mentions, and no `unknownMentions`: the board resolved its
+* handles and emails to actor IDs, which `/actors` doesn't show it, and which
+* handles matched no one would say which ones exist. The board keeps the
+* mentions, so they still notify.
+*/
+const shownTo = (shown, access, sent, unknown = []) => !access.readable(shown.channel) ? {
+	...shown,
+	text: sent,
+	mentions: []
+} : unknown.length ? {
+	...shown,
+	unknownMentions: unknown
+} : shown;
+/** The writer, as the reader of the view its write returns. Only a link to a board message needs a lookup. */
+const readerFor = (ctx, access, message) => ctx.reads.reader(access, [message]);
+/**
+* Refuses an external thread another board thread is synced with: taking it
+* over would send its replies away from that thread, to a caller who may not
+* read it. A reader of that thread's channel learns which thread it is. It
+* reads the tables once they've applied the whole log, so a sync just made
+* counts.
+*/
+async function unclaimed(ctx, target, thread, access) {
+	if (target.kind !== "thread") return;
+	await ctx.reads.ensure();
+	const owner = await ctx.reads.tables.threadOf(target.target);
+	if (owner === null || owner === thread) return;
+	const synced = await ctx.reads.tables.syncOf(owner);
+	const which = synced && access.readable(synced.channel) ? `#${synced.root}` : "another thread";
+	throw new HttpError(409, "already_synced", `${target.target} is already synced with ${which}`);
+}
+/**
+* Waits until the tables hold a write, so any read after it includes it. Most often
+* nothing was written in between, and the writer applies its own events itself; else
+* it waits for the tables' consumer. The write landed either way: if the tables are
+* slow or stuck, it still succeeds.
+*/
+async function untilApplied(ctx, rows) {
+	const events = [...rows].sort((a, b) => a.index - b.index);
+	const last = events.at(-1).index;
+	try {
+		let caughtUp = true;
+		for (const event of events) if (!(caughtUp = await ctx.reads.tables.applyNext(event))) break;
+		if (caughtUp) return;
+	} catch {}
+	await ctx.reads.ensure(last, AbortSignal.timeout(LANDED_WAIT_MS)).catch((error) => {
+		console.warn(`[board] the tables haven't applied #${last} yet:`, error.message);
+	});
+}
+/** How long a write waits for the tables before it answers anyway. */
+const LANDED_WAIT_MS = 1e4;
+/** The message a by-ID write targets, as the board looked it up, once its proof is spent on the message's channel. */
+function spent(authorized, permission) {
+	spend(authorized.proof, permission, authorized.message);
+	return authorized.message;
+}
+async function writeEdit(ctx, input) {
+	const message = spent(input.authorized, "post");
+	if (input.asAuthor !== false && message.by.principal !== input.identity.principal.id) throw forbidden("only the author can edit a message");
+	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
+	return commitEdit(ctx, input, message);
+}
+async function commitEdit(ctx, input, message) {
+	const { state: actors } = await ctx.session.state(actorsReducer);
+	const seen = seenFor(input.identity, actors);
+	const { text, found } = await withEmailMentions(input.text);
+	const named = found.map((actor) => actorSeen(actor, actors)).filter((event) => event !== null);
+	const { mentions, unknown } = resolveMentions(text, knownWith(actors, found), seen ? input.identity.actor : void 0, input.from != null, input.identity.principal.access.readsAll);
+	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], ...named, {
+		type: "message.edited",
+		payload: {
+			id: message.id,
+			thread: message.thread,
+			text,
+			mentions,
+			by: input.identity.author,
+			from: input.from ?? null
+		}
+	}));
+	return unknown.length && input.identity.principal.access.readable(message.channel) ? { unknownMentions: unknown } : {};
+}
+/** A message's links, replaced: a platform edit or unfurl changed what it links to. */
+async function writeLinks(ctx, input) {
+	const message = spent(input.authorized, "post");
+	if (message.deleted) return;
+	await untilApplied(ctx, await ctx.session.append({
+		type: "message.linked",
+		payload: {
+			id: message.id,
+			thread: message.thread,
+			links: input.links,
+			by: input.identity.author,
+			from: input.from
+		}
+	}));
+}
+async function writeDelete(ctx, input) {
+	const message = spent(input.authorized, "post");
+	if (input.asAuthor !== false && message.by.principal !== input.identity.principal.id) throw forbidden("only the author can delete a message");
+	if (message.deleted) return;
+	await untilApplied(ctx, await ctx.session.append({
+		type: "message.deleted",
+		payload: {
+			id: message.id,
+			thread: message.thread,
+			by: input.identity.author,
+			from: input.from ?? null
+		}
+	}));
+}
+async function writeReaction(ctx, input) {
+	const message = spent(input.authorized, "react");
+	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
+	const { state: actors } = await ctx.session.state(actorsReducer);
+	const seen = seenFor(input.identity, actors);
+	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], {
+		type: input.remove ? "reaction.removed" : "reaction.added",
+		payload: {
+			id: message.id,
+			thread: message.thread,
+			emoji: input.emoji,
+			by: input.identity.author,
+			from: input.from ?? null
+		}
+	}));
+}
+async function writeLabels(ctx, input) {
+	const message = spent(input.authorized, "label");
+	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
+	const { state: actors } = await ctx.session.state(actorsReducer);
+	const seen = seenFor(input.identity, actors);
+	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], {
+		type: "labels.changed",
+		payload: {
+			id: message.id,
+			thread: message.thread,
+			set: input.set ?? {},
+			unset: input.unset ?? [],
+			by: input.identity.author
+		}
+	}));
+}
+/**
+* Syncs a message's thread with a target, resolved by the sync that delivers it. Attaching twice
+* is a no-op; a platform thread another board thread is synced with is a 409.
+*/
+async function writeAttach(ctx, input) {
+	const message = spent(input.authorized, "sync");
+	const { target, kind } = input.target;
+	await ctx.reads.ensure();
+	if ((await ctx.reads.tables.syncOf(message.thread))?.targets.includes(target)) return { attached: false };
+	await unclaimed(ctx, input.target, message.thread, input.identity.principal.access);
+	await untilApplied(ctx, await ctx.session.append({
+		type: "thread.synced",
+		id: await derivedId("board", message.thread, "sync", target),
+		payload: {
+			thread: message.thread,
+			target,
+			kind,
+			cause: input.cause,
+			by: input.identity.author
+		}
+	}));
+	return { attached: true };
+}
+//#endregion
 //#region src/server/schedules.ts
 /** Vercel Queues delays at most 6 days: a send further out than this goes in hops. */
 const MAX_HOP_MS = 432e6;
@@ -1654,6 +2544,13 @@ const inboxesReducer = reducer({
 });
 /** An append that holds an event ID already in the log. */
 const duplicate = (error) => error instanceof A2Error && error.code === "PARTIAL_DUPLICATE_BATCH";
+/**
+* A platform event whose ID is already in an inbox: the platform's retry, which can read differently
+* (another instance, a name changed since), so the copy already there stands.
+*/
+const alreadyReceived = (error) => {
+	if (!duplicate(error)) throw error;
+};
 /** Where a board given no store keeps it, in the working directory, in every environment. */
 const DEFAULT_STORE_PATH = ".a2/dev.db";
 /** Why a file couldn't be opened, in a few words: a read-only filesystem, a serverless function's say. */
@@ -1729,9 +2626,8 @@ function build(options, binding) {
 		const event = ctx.event;
 		const [messages, { state: actors }] = await Promise.all([loadBefore(reads, event, ctx.signal), ctx.session.state(actorsReducer, { through: event.index - 1 })]);
 		const { before, after } = foldEvent(messages, actors, event);
-		const about = event.type === "thread.synced" ? (await reads.ensure(event.index - 1, ctx.signal), await store.tables.byEventId(event.payload.thread)) ?? void 0 : after;
 		const shown = {
-			...eventView(event, about, actors, OWN_CODE),
+			...eventView(event, event.type === "thread.synced" ? (await reads.ensure(event.index - 1, ctx.signal), await store.tables.byEventId(event.payload.thread)) ?? void 0 : after, actors, OWN_CODE),
 			...event.type === "labels.changed" && before ? { before: view(before, actors, OWN_CODE) } : {}
 		};
 		await delivering.run(ctx, () => binding.run(SYNC, shown, {
@@ -1900,7 +2796,7 @@ function build(options, binding) {
 		if (fromRequest(caller) && body.id?.startsWith("key:") && !isKeyIdOf(body.id, principal.id)) throw badRequest(`id: key:… IDs derive from a client's key, and this token's are key:${principal.id}:…`);
 		if (fromRequest(caller) && body.id?.startsWith("sync:")) throw badRequest("id: sync:… IDs are what sync imports, under the principal that imports them");
 		const attachments = await attachmentsFor(principal, body.attachments);
-		const { schedule, config } = caller.origin;
+		const { schedule } = caller.origin;
 		const { unknownMentions, ...message } = await writePost(writes, {
 			attachments,
 			identity,
@@ -1912,7 +2808,6 @@ function build(options, binding) {
 			noSync: body.noSync,
 			id: body.id,
 			sync: body.sync,
-			config,
 			...schedule && !fromRequest(caller) ? {
 				schedule,
 				lenientMentions: true
@@ -2255,7 +3150,7 @@ function build(options, binding) {
 			const { principal, actor } = await identityOf(caller);
 			const after = query.after !== void 0 ? cursorAt(query.after) : void 0;
 			const { state: actors } = await session.state(actorsReducer);
-			const feed = {
+			const { events, cursor } = await pollFeed({
 				session,
 				reads,
 				after,
@@ -2264,8 +3159,7 @@ function build(options, binding) {
 				me: actor.id,
 				actors,
 				access: principal.access
-			};
-			const { events, cursor } = await pollFeed(feed, (query.wait ?? 0) * 1e3, signal);
+			}, (query.wait ?? 0) * 1e3, signal);
 			return {
 				events,
 				cursor: ref(cursor)
@@ -2285,6 +3179,57 @@ function build(options, binding) {
 			if (!principal.access.everywhere("manage")) throw forbidden("this token can't read a source: it needs manage in every channel");
 			return binding.readSource(key, target, limit ?? 50);
 		},
+		async synced(caller, { id }, signal) {
+			const { principal } = await identityOf(caller);
+			const message = await reads.message(messageAt(id), signal);
+			if (!message || !principal.access.readable(message.channel)) throw notFound(`message not found: #${id}`, "message_not_found");
+			await reads.ensure(void 0, signal);
+			const { tables } = store;
+			const [thread, copies] = await Promise.all([tables.syncOf(message.thread), tables.copiesOf([message.id])]);
+			const mine = copies.get(message.id) ?? {};
+			return { targets: await Promise.all((thread?.targets ?? []).map(async (target) => {
+				const key = target.slice(0, target.indexOf(":"));
+				const external = (thread && Object.hasOwn(thread.external, target) ? thread.external[target] : void 0) ?? null;
+				const copy = (Object.hasOwn(mine, target) ? mine[target] : external !== null && Object.hasOwn(mine, external) ? mine[external] : void 0) ?? null;
+				return {
+					target,
+					key,
+					thread: copy?.thread ?? external,
+					message: copy?.message ?? null,
+					url: copy ? await binding.linkOf(key, copy.thread, copy.message) : null,
+					undelivered: Object.hasOwn(message.undelivered, target) ? message.undelivered[target] : null
+				};
+			})) };
+		},
+		async linked(caller, { url }, signal) {
+			const missing = () => notFound("no message on this board for that link", "message_not_found");
+			const read = binding.locate(url);
+			if (read.length === 0) throw missing();
+			await reads.ensure(void 0, signal);
+			const { tables } = store;
+			const registered = Object.values((await registry.state()).byOwner).flatMap((registration) => registration.sync);
+			const keysOf = (platform) => new Set([...binding.sync, ...registered].filter((entry) => entry.platform === platform).map((entry) => entry.key));
+			const first = async () => {
+				for (const { platform, thread, message } of read) for (const key of keysOf(platform)) {
+					let found;
+					if (message !== null) found = await tables.messageOf(`${key}:${thread}`, message);
+					else {
+						const at = await tables.threadOf(`${key}:${thread}`);
+						found = at === null ? null : (await tables.syncOf(at))?.root ?? null;
+					}
+					if (found) return found;
+				}
+				return null;
+			};
+			const id = await first();
+			if (id === null) throw missing();
+			try {
+				return await methods.message(caller, { id: ref(id) }, signal);
+			} catch (error) {
+				if (error instanceof HttpError && error.status === 404) throw missing();
+				throw error;
+			}
+		},
 		async syncImport(caller, body, signal) {
 			const { principal } = await needSync(caller, "import", true);
 			await speaksFor(caller, principal.id, body.author, body.op === "seen" ? null : body.from);
@@ -2330,8 +3275,7 @@ function build(options, binding) {
 						...body.origin && !ownSync(caller) ? { importedBy: principal.id } : {},
 						lenientMentions: true,
 						attachments,
-						links: await linksOf(principal, body.links),
-						config: caller.origin.config
+						links: await linksOf(principal, body.links)
 					})).id;
 				};
 				const write = {
@@ -2555,7 +3499,7 @@ function build(options, binding) {
 							event,
 							raw
 						}
-					});
+					}).catch(alreadyReceived);
 				}
 				return { ok: true };
 			}
@@ -2575,7 +3519,7 @@ function build(options, binding) {
 			})));
 			await queue.append(...matched).catch(async (error) => {
 				if (!duplicate(error)) throw error;
-				for (const one of matched) await queue.append(one);
+				for (const one of matched) await queue.append(one).catch(alreadyReceived);
 			});
 			return { ok: true };
 		},