@vercel/board 0.18.0 → 0.19.0

package/dist/sync-slack.d.mts

@@ -1,6 +1,6 @@
 import { f as ExternalLink } from "./folds-CRYY14kc.mjs";
-import { C as channels, _ as withUserTokens, d as ResolvedTarget, f as SyncContext, h as UserTokens, o as ProviderPost, r as ProviderDelivery, y as SyncFn } from "./provider-B0b9Qxw4.mjs";
-import { n as ChatSyncProvider, t as ChatInput } from "./chat-provider-DNJQyajS.mjs";
+import { C as channels, _ as withUserTokens, d as ResolvedTarget, f as SyncContext, h as UserTokens, o as ProviderPost, r as ProviderDelivery, y as SyncFn } from "./provider-B1Z3Ok86.mjs";
+import { n as ChatSyncProvider, t as ChatInput } from "./chat-provider-B5uCc0an.mjs";
 import { z } from "zod";
 import { Adapter } from "chat";
 //#region src/sync/slack.d.ts

package/dist/sync.chat.d.mts

@@ -1,2 +1,2 @@
-import { i as externalAuthor, n as ChatSyncProvider, r as ChatTransport, t as ChatInput } from "./chat-provider-DNJQyajS.mjs";
+import { i as externalAuthor, n as ChatSyncProvider, r as ChatTransport, t as ChatInput } from "./chat-provider-B5uCc0an.mjs";
 export { ChatInput, ChatSyncProvider, ChatTransport, externalAuthor };

package/dist/sync.d.mts

@@ -1,3 +1,3 @@
 import { d as ExternalFile, l as ExternalAuthor, u as ExternalEvent } from "./folds-CRYY14kc.mjs";
-import { A as SyncOverrides, C as channels, D as EventBase, E as render, M as SyncRoot, N as envelope, O as ProviderEvent, P as eventSchema, S as SyncUnit, T as mirror, _ as withUserTokens, a as ProviderOptions, b as SyncIn, c as ReceivedEvent, d as ResolvedTarget, f as SyncContext, g as connectUserTokens, h as UserTokens, i as ProviderFile, j as SyncResult, k as RootOverride, l as RenderInput, m as UnreadableError, n as FileDelivery, o as ProviderPost, p as SyncProvider, r as ProviderDelivery, s as Receive, u as Renderer, v as Sync, w as into, x as SyncOut, y as SyncFn } from "./provider-B0b9Qxw4.mjs";
+import { A as SyncOverrides, C as channels, D as EventBase, E as render, M as SyncRoot, N as envelope, O as ProviderEvent, P as eventSchema, S as SyncUnit, T as mirror, _ as withUserTokens, a as ProviderOptions, b as SyncIn, c as ReceivedEvent, d as ResolvedTarget, f as SyncContext, g as connectUserTokens, h as UserTokens, i as ProviderFile, j as SyncResult, k as RootOverride, l as RenderInput, m as UnreadableError, n as FileDelivery, o as ProviderPost, p as SyncProvider, r as ProviderDelivery, s as Receive, u as Renderer, v as Sync, w as into, x as SyncOut, y as SyncFn } from "./provider-B1Z3Ok86.mjs";
 export { EventBase, type ExternalAuthor, ExternalEvent, type ExternalFile, type FileDelivery, type ProviderDelivery, type ProviderEvent, type ProviderFile, type ProviderOptions, type ProviderPost, type Receive, ReceivedEvent, type RenderInput, type Renderer, ResolvedTarget, type RootOverride, type Sync, type SyncContext, type SyncFn, type SyncIn, type SyncOut, SyncOverrides, SyncProvider, type SyncResult, type SyncRoot, type SyncUnit, UnreadableError, type UserTokens, channels, connectUserTokens, envelope, eventSchema, into, mirror, render, withUserTokens };

package/dist/{watchers-hash-RLtnSF-t.mjs → watchers-hash-B2TevhFZ.mjs}

@@ -116,8 +116,20 @@ const InboxQuery = z.object({
 });
 /** What a board on `http()` registers with the board it uses: its watchers' tails, and where to wake it. */
 const RegisterBody = z.object({
-	/** Without one, the board pulls on its own instead of being woken. */
+	/** Without one, or a `path`, the board pulls on its own instead of being woken. */
 	url: z.string().url().max(500).refine((url) => /^https:\/\//.test(url), "wake-ups go over https").transform((url) => url.replace(/\/+$/, "")).nullable().optional(),
+	/**
+	* Where to wake the caller on its own Vercel project, on a board whose discovery says
+	* `wake_by_path`. The board takes the project and environment from the caller's token and
+	* finds the deployment, so a project can only register itself, and anyone else gets 403
+	* `not_a_project`.
+	*/
+	path: z.string().max(300).regex(/^\/[^?#]*$/, "a path starts with / and has no query or fragment").transform((path) => path.replace(/(.)\/+$/, "$1")).nullable().optional(),
+	/**
+	* With a `path`, from a preview: the branch whose latest ready preview is woken, since a
+	* token says which project and environment called but not which deployment. Production names none.
+	*/
+	branch: z.string().min(1).max(255).nullable().optional(),
 	watch: z.record(z.string().max(100), z.object({
 		tail: z.string().max(1e3),
 		when: z.enum(["matches", "enters"]).default("matches")
@@ -131,6 +143,12 @@ const RegisterBody = z.object({
 		platform: z.string().min(1).max(64),
 		signIn: z.boolean().default(false)
 	})).max(32).optional()
+}).refine((body) => !(body.url && body.path), {
+	message: "register a url or a path, not both",
+	path: ["path"]
+}).refine((body) => !body.branch || body.path, {
+	message: "a branch goes with a path",
+	path: ["branch"]
 });
 /** A pull of the caller's matches: at most `limit`, waiting up to `wait` seconds for one. */
 const MatchesQuery = z.object({
@@ -631,7 +649,7 @@ const routes = {
 const SYNC = "@sync";
 //#endregion
 //#region src/version.ts
-const VERSION = "0.18.0";
+const VERSION = "0.19.0";
 //#endregion
 //#region src/server/routing.ts
 /** board()'s own routes: the files it serves, and sync's, which run where board() does. */

package/docs/01-board/06-watchers.md

@@ -236,6 +236,13 @@ export const GET = team.fetch, POST = team.fetch
   makes this board pull with its own credentials. One that Deployment
   Protection stops answers 401, and the other board tries less often until
   this board pulls or registers.
+- **On a board whose discovery says `wake_by_path`,** this board registers
+  its mount path on its own project instead of its URL, and its wake-ups get
+  through Deployment Protection with nothing to set up. Only on Vercel, from
+  production or a preview of a branch, which it names: the other board finds
+  the deployment from this project's token and that branch. Anywhere else
+  (development, a custom environment, a preview made with `vercel deploy`), it
+  registers its URL.
 - **Retries need the other board's scheduler,** as its own watchers do.
   Without one there, nothing waits on a clock: a retry, a lease that ran out,
   and a wake-up that didn't get there (once its back-off is over) each wait

package/docs/03-guides/01-coding-agents.md

@@ -54,7 +54,8 @@ token   expires in 11h 42m
 
 ### Boards behind Deployment Protection
 
-Many teams protect production with Vercel Authentication. The CLI and
+Many teams protect production with Vercel Authentication or Vercel Connect
+passport. The CLI and
 `board()` in Node get through the way `vercel curl` does: with your
 `vercel login`, they find the board's project from its host, read its
 Protection Bypass for Automation (creating one if the project has none, and

package/docs/04-reference/01-cli.md

@@ -533,11 +533,12 @@ core
 
 watchers
   passed   matches a registered tail, hands the match to a pull, and takes its ack
+  passed   wakes by path only where its discovery says so, and only a Vercel project
 
 sync
   passed   keeps sync's records: an import as a platform author, its lookups by platform ID, a receipt, and where it's synced
 
-18 passed
+19 passed
 ```
 
 A board that keeps no schedules or no files answers that check with a 501, and

package/docs/04-reference/03-http.md

@@ -94,7 +94,7 @@ a refused write it can read answers 403. `GET /me` returns the caller's
 
 | Method | Path | Purpose |
 | --- | --- | --- |
-| GET | `/` | Discovery (no token): `{ version, url, audience, team_id, project_id, sync }`, where `sync` lists each entry's `key` and `platform`. A board on `http()` with no `access` of its own has none: it answers only wake-ups, webhooks, and its sync's sign-ins |
+| GET | `/` | Discovery (no token): `{ version, url, audience, team_id, project_id, sync, wake_by_path? }`, where `sync` lists each entry's `key` and `platform`, and `wake_by_path` says `POST /watchers` takes a `path`. A board on `http()` with no `access` of its own has none: it answers only wake-ups, webhooks, and its sync's sign-ins |
 | GET | `/me` | Who this token and profile write as: `{ actor, principal, kind, handle, name, avatar, profile, session, expiresAt, can }`, where `can` maps each channel pattern to its permissions |
 | GET | `/channels` | `{ channels, cursor }`: each `{ path, lastIndex, messages, threads }`, sorted by path |
 | GET | `/actors` | `{ actors, cursor }`: each `{ id, kind, handle, name, avatar }`, sorted by handle |
@@ -118,7 +118,7 @@ a refused write it can read answers 403. `GET /me` returns the caller's
 | GET | `/schedules` | `{ schedules }`. Query: `re`, `channel`, `by`, `all` |
 | POST | `/schedules/:id/cancel` | Cancel one (`12` or `s12`). Its creator, or `manage` in its channel. Answers `{ schedule, canceled }` |
 | GET | `/events` | The event feed. See [Event feed](#event-feed) |
-| POST | `/watchers` | `{ url?, watch, sync? }`: registers the caller's watchers (at most 32, each `{ tail, when? }`), its sync entries, and where to wake it (`https` only), replacing its last registration. Needs `read` somewhere, and `sync` somewhere for sync entries. Answers the registration, `{ owner, url, watch, sync, hash }`. On a board on `http()`, it takes no token and registers that board's own |
+| POST | `/watchers` | `{ url?, path?, branch?, watch, sync? }`: registers the caller's watchers (at most 32, each `{ tail, when? }`), its sync entries, and where to wake it, replacing its last registration: a `url` (`https` only), or on a board whose discovery says `wake_by_path`, a `path` on the caller's own Vercel project, which the board finds from the caller's token and wakes through its Deployment Protection: production's best domain, or with `branch`, a preview's latest ready deployment of that branch (403 `not_a_project` for a caller that isn't a Vercel project, 501 `no_wake_by_path` on a board that can't). Needs `read` somewhere, and `sync` somewhere for sync entries. Answers the registration, `{ owner, url, path?, branch?, watch, sync, hash }`. On a board on `http()`, it takes no token and registers that board's own |
 | GET | `/watchers` | `{ watchers }`: the caller's registration, or every one for `manage` in every channel |
 | GET | `/watchers/matches` | `{ matches }`: the caller's matches it can run now, one thread at a time and in order, each `{ id, watcher, thread, lease, attempt, event }` and leased to it for 5 minutes. Query: `limit` (10 by default, at most 50), `wait` (seconds to hold for one, at most 25). 404 `no_registration` without a registration |
 | POST | `/watchers/matches/:id/ack` | `{ lease, error?, skip? }`: done, an error to try again after a wait (after 5 tries it's `watch.failed`), or `skip` to drop it. 404 `no_match`, 409 `stale_lease` for a lease that ran out |
@@ -451,6 +451,7 @@ Every failure is JSON with a matching status:
 | 401 | `unauthorized` | a missing, malformed, or expired token, an unknown issuer, or the wrong audience |
 | 403 | `forbidden` | a caller no rule in `access` matches, a write its access doesn't allow where it can read (the message names the permission and channel), an edit or delete by someone else, someone else's schedule without `manage`, or a source read without `manage` in every channel, or the inbox without `sync` in every channel, or a code for anyone but a person, or watchers or sync's records for a caller narrowed with `x-board-scope` |
 | 403 | `private_channel`, `shared_channel`, `not_in_channel` | a source read the board won't do |
+| 403 | `not_a_project` | a `path` in `POST /watchers` from a caller that isn't a Vercel project, on a board that wakes by path: a path is on the caller's own project |
 | 404 | `not_found` | no such route, a request a board on `http()` with no `access` doesn't serve, or a webhook, sign-in, or code for a sync entry the board doesn't have |
 | 404 | `message_not_found`, `schedule_not_found`, `attachment_not_found`, `post_not_found` | no such thing, or one the caller can't read |
 | 404 | `thread_not_found` | `GET /sync/threads/:thread` for a thread that isn't there, or that the caller can't sync |
@@ -473,6 +474,7 @@ Every failure is JSON with a matching status:
 | 501 | `no_files` | an upload, a download, or a write that carries files, on a board that keeps no files: `` this board keeps no files: pass `blob` to `a2()` `` |
 | 501 | `no_direct_uploads` | a direct upload on a board whose blob store can't sign upload URLs |
 | 501 | `no_verifier` | a request to a board on board's default build, outside Node, with no `authenticate` |
+| 501 | `no_wake_by_path` | a `path` in `POST /watchers` on a board that wakes only a `url`: `` this board wakes a url, not a path: register `url` instead `` |
 | 502 | `no_client`, `list_failed`, … | the platform failed a source read |
 | 502 | `unreachable`, `remote_error` | on a board on `http()`: the board it uses didn't answer, or answered with something that isn't its JSON error |
 | 503 | `unavailable` | the store is down, or isn't set up for this release: the message says what to apply, or, on Redis, to give the store a new `keyPrefix` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/board",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "A message board you mount in one route: one durable log, verified authors, live tail, and two-way sync.",
   "license": "MIT",
   "type": "module",

package/dist/exports-ZsgjzEnM.d.mts

@@ -1,4 +0,0 @@
-import "./auth-CU56Q2Xh.mjs";
-import "./schemas-CWxs3ECJ.mjs";
-import "./provider-B0b9Qxw4.mjs";
-import "./backend-B-SJ7p6p.mjs";