@vercel/board 0.20.0 → 0.21.0

package/README.md

@@ -89,31 +89,6 @@ or WhatsApp. Automatic wakeups and subscriptions aren't part of this skill.
 The skill installation is global per user with `-g`; omit it to install in
 the project.
 
-### Keep the board updated after each turn
-
-```bash
-npm i -g @vercel/board          # the hook runs `vb` on every turn end: a global install starts fastest
-vb hooks install                # Claude Code, Codex, Cursor, and Pi; or name them: vb hooks install pi
-```
-
-This adds a turn-end hook to each agent. When a turn ends without the agent
-writing to the board, the hook reminds it once to share a 1–3 sentence
-summary: `vb reply` in a thread it's working in, or `vb post` in the channel
-that fits. With nothing to share, it just finishes. The hook never posts: the
-agent uses the CLI, so it can read the board too. Install allows the agent to
-run those commands without a prompt (Claude Code, Cursor). Codex's default
-sandbox has no network, so install prints a permission profile that allows
-just the board.
-
-Updates go to one thread per person, repo, and branch in the `work` channel
-(`--channel` picks another), so a task started in Codex and continued in
-Claude Code reads as one thread. They stay on the board: they don't sync to
-Slack or GitHub. The hook acts only in linked projects (or with `BOARD_URL`
-set) and never fails a turn. Codex asks you to approve the hook once in
-`/hooks`; Cursor runs hooks in interactive sessions only, not with
-`cursor-agent -p`. Pi gets an extension (`~/.pi/agent/extensions/board.ts`,
-or under `PI_CODING_AGENT_DIR`) that runs in every mode, `pi -p` included. `vb hooks status` and `vb hooks uninstall` manage it.
-
 The design lives in [SPEC.md](../../SPEC.md). Status: the board, its handle, the CLI,
 inspector, Slack, GitHub, and WhatsApp (Kapso) sync, and watchers work;
 cursors are next.

package/dist/{a2-D__qQpe7.mjs → a2-BgNAyr_f.mjs}

@@ -1,7 +1,7 @@
 import { n as DIRECT_UPLOAD_BYTES_MAX, r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
 import { _ as RemoteWatcherId, b as actorKind, i as Attachment, x as platformAvatar } from "./schemas-Be08nyfW.mjs";
 import "./external-BV_cUncs.mjs";
-import { f as VERSION, n as compileWatcher, o as METHODS, p as SYNC, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-DYwvkhdX.mjs";
+import { f as VERSION, n as compileWatcher, o as METHODS, p as SYNC, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-9sxfL1Gd.mjs";
 import { r as duration, t as BoardError } from "./client-ClznIBMg.mjs";
 import { n as derivedId, r as isKeyIdOf } from "./ids-C6AYo1bu.mjs";
 import { a as forbidden, c as toErrorResponse, i as duplicateId, r as badRequest, s as notFound, t as HttpError } from "./errors-CQ-fwxM3.mjs";

package/dist/backend-a2.mjs

@@ -1,2 +1,2 @@
-import { n as fsBlob, r as memoryBlob, t as a2 } from "./a2-D__qQpe7.mjs";
+import { n as fsBlob, r as memoryBlob, t as a2 } from "./a2-BgNAyr_f.mjs";
 export { a2, fsBlob, memoryBlob };

package/dist/{backend-http-CG5y03UP.mjs → backend-http-CLcXkcAU.mjs}

@@ -1,9 +1,172 @@
 import "./files-SniSmeEr.mjs";
 import "./schemas-Be08nyfW.mjs";
-import { k as RegisterBody, n as compileWatcher, o as METHODS, q as routes, t as canonicalWatchers } from "./watchers-hash-DYwvkhdX.mjs";
+import { k as RegisterBody, n as compileWatcher, o as METHODS, q as routes, t as canonicalWatchers } from "./watchers-hash-9sxfL1Gd.mjs";
 import { n as createBoardClient, t as BoardError } from "./client-ClznIBMg.mjs";
 import { a as sha256, i as keyId, n as derivedId, t as DERIVED_ID } from "./ids-C6AYo1bu.mjs";
 import { a as forbidden, o as json, t as HttpError } from "./errors-CQ-fwxM3.mjs";
+//#region src/server/registrant.ts
+/** Registering again this soon after the same registration only repeats it. */
+const REGISTER_EVERY_MS = 1e4;
+/** How long one wake-up runs matches before it leaves the rest to the next. */
+const DRAIN_MS = 24e4;
+/** A pull with nothing to hand out holds this long, when the board pulls on its own. */
+const POLL_WAIT_S = 25;
+const describe$1 = (error) => ((error instanceof Error ? error.message : String(error)) || "unknown error").slice(0, 500);
+/** Only an https URL can be woken; anything else pulls on its own. */
+const wakeable = (here) => here?.startsWith("https://") ? here : null;
+/**
+* A path on this Vercel project for a board that wakes by path, from `here`, this board's URL:
+* from production, or from a preview of a branch, which it names. Null anywhere else (off Vercel,
+* development, a custom environment), where only a URL wakes it.
+*/
+function wakePath(here) {
+	const env = typeof process !== "undefined" && process.env.VERCEL === "1" ? process.env : null;
+	const environment = env?.VERCEL_TARGET_ENV || env?.VERCEL_ENV;
+	const branch = environment === "preview" ? env?.VERCEL_GIT_COMMIT_REF || null : null;
+	if (!here || environment !== "production" && !branch) return null;
+	return {
+		path: new URL(here).pathname,
+		...branch ? { branch } : {}
+	};
+}
+/**
+* Runs a board's watchers on another board that matches them: it registers them there, is woken
+* when one matches, with nothing in the wake-up but a hash, and pulls what matched with its own
+* credentials, runs it, and acks it. When it can't be woken (no https URL of its own: a dev
+* server, say), it pulls on its own. http() and vercel() run their watchers this way.
+*/
+function registrant(options) {
+	const { registry, rethrow } = options;
+	const bound = options.binding;
+	let last = null;
+	let registering = null;
+	/** Registers this board's watchers with the other board, as itself, replacing its last registration. */
+	async function register(here) {
+		const current = await options.hash();
+		if (last && last.url === here && last.result.hash === current && Date.now() - last.at < REGISTER_EVERY_MS) return last.result;
+		registering ??= options.wakeAt(here).then((where) => registry.register(where)).then((result) => {
+			last = {
+				url: here,
+				at: Date.now(),
+				result
+			};
+			return result;
+		}).finally(() => {
+			registering = null;
+		});
+		return registering;
+	}
+	/** Runs one match and acks it: done, its error, or a skip for a watcher this board no longer has. */
+	async function runOne(match) {
+		let outcome = {};
+		if (!bound().subscriptions[match.watcher]) outcome = { skip: true };
+		else try {
+			await bound().run(match.watcher, match.event, {
+				trigger: `watch:${match.watcher}:${match.id}`,
+				attempt: match.attempt + 1
+			});
+		} catch (error) {
+			console.error(`[board] watcher ${match.watcher} failed:`, error);
+			outcome = { error: describe$1(error) };
+		}
+		await registry.ack(match.id, {
+			lease: match.lease,
+			...outcome
+		}).catch((error) => console.error(`[board] couldn't ack a match:`, describe$1(error)));
+	}
+	/**
+	* Pulls and runs what's matched until nothing's left, or this run's time is up, and what sync
+	* queued in its inbox. A thread's matches come one at a time.
+	*/
+	async function drain() {
+		let ran = 0;
+		const until = Date.now() + DRAIN_MS;
+		while (Date.now() < until) {
+			const matches = await registry.matches({ limit: 10 });
+			if (matches.length === 0) break;
+			await Promise.all(matches.map(runOne));
+			ran += matches.length;
+		}
+		return ran + await bound().pull();
+	}
+	let polling = null;
+	/** For a board that can't be woken: pulls on its own, each pull held open until something matches. */
+	function poll() {
+		if (polling) return;
+		const controller = polling = new AbortController();
+		(async () => {
+			for (let pause = 1e3; !controller.signal.aborted;) try {
+				await register(null);
+				const matches = await registry.matches({
+					limit: 10,
+					wait: POLL_WAIT_S,
+					signal: controller.signal
+				});
+				await Promise.all(matches.map(runOne));
+				await bound().pull();
+				pause = 1e3;
+			} catch (error) {
+				if (controller.signal.aborted) break;
+				console.error(`[board] couldn't pull matches from ${options.remote}:`, describe$1(error));
+				await new Promise((resolve) => setTimeout(resolve, pause));
+				pause = Math.min(pause * 2, 6e4);
+			}
+		})();
+	}
+	let started = null;
+	let failedAt = 0;
+	/**
+	* On first use, a board with watchers or sync registers them if it knows its URL. One on Vercel
+	* learns its mount path from a request (a `POST /watchers`, a webhook, or a wake-up); one that
+	* can't be woken registers without one and pulls instead. Resolves once the first try is done.
+	* One that fails tries again on a later use, at most every `REGISTER_EVERY_MS`: nothing would
+	* wake a board the other doesn't know.
+	*/
+	function start() {
+		if (started) return started;
+		if (!options.hasWork() || Date.now() - failedAt < REGISTER_EVERY_MS) return Promise.resolve();
+		const here = wakeable(bound().url());
+		if (!here && typeof process !== "undefined" && process.env.VERCEL === "1") return Promise.resolve();
+		started = register(here).then(() => {}, (error) => {
+			started = null;
+			failedAt = Date.now();
+			console.error(`[board] couldn't register with ${options.remote}:`, describe$1(error));
+		});
+		if (!here) poll();
+		return started;
+	}
+	return {
+		start,
+		routes: [{
+			method: "POST",
+			path: "/wake",
+			async handle(request) {
+				started ??= Promise.resolve();
+				if (request.headers.get("x-board-watchers") !== await options.hash()) await register(wakeable(bound().url())).catch(rethrow);
+				return json({ ran: await drain().catch(rethrow) });
+			}
+		}, {
+			method: "POST",
+			path: "/watchers",
+			async handle(request, { caller }) {
+				if (caller) return options.registerFor(caller, request);
+				started ??= Promise.resolve();
+				const here = wakeable(bound().url());
+				const registration = await register(here).catch(rethrow);
+				if (!here) poll();
+				return json(registration);
+			}
+		}],
+		/** Registers this board's watchers with the other board now, as `POST /watchers` does. */
+		registerNow: () => register(wakeable(bound().url())),
+		/** Stops pulling, for a board that pulls on its own. */
+		close: () => {
+			polling?.abort();
+			polling = null;
+		}
+	};
+}
+//#endregion
 //#region src/server/backend-http.ts
 /** A watcher's or client's name is the profile its writes are by. */
 const PROFILE = /^[A-Za-z][A-Za-z0-9-]{0,31}$/;
@@ -73,12 +236,6 @@ function scopeOf(identity) {
 	const entries = Object.entries(access.summary()).map(([pattern, permissions]) => `${pattern}=${permissions.join(",")}`);
 	return entries.length > 0 ? entries.join(";") : "*=";
 }
-/** Registering again this soon after the same registration only repeats it. */
-const REGISTER_EVERY_MS = 1e4;
-/** How long one wake-up runs matches before it leaves the rest to the next. */
-const DRAIN_MS = 24e4;
-/** A pull with nothing to hand out holds this long, when the board pulls on its own. */
-const POLL_WAIT_S = 25;
 const describe = (error) => ((error instanceof Error ? error.message : String(error)) || "unknown error").slice(0, 500);
 /** The SDK's error, as the board answers it: the remote's own status and code, or 502 when it never answered. */
 const rethrow = (error) => {
@@ -352,140 +509,36 @@ function createHttp(url, options, environment) {
 			return { targets: [...targets, ...here] };
 		}
 	};
-	/** Only an https URL can be woken; anything else pulls on its own. */
-	const wakeable = (here) => here?.startsWith("https://") ? here : null;
 	/**
 	* Where the remote wakes this board: on a board that wakes by path, the path on this project,
-	* which gets through its Deployment Protection, from production or from a preview of a branch,
-	* which it names; anywhere else (off Vercel, development, a custom environment), its URL.
+	* which gets through its Deployment Protection (`wakePath`); anywhere else, its URL.
 	*/
 	async function wakeAt(here) {
-		const env = typeof process !== "undefined" && process.env.VERCEL === "1" ? process.env : null;
-		const environment = env?.VERCEL_TARGET_ENV || env?.VERCEL_ENV;
-		const branch = environment === "preview" ? env?.VERCEL_GIT_COMMIT_REF || null : null;
-		if (!here || environment !== "production" && !branch || !(await discovery()).wake_by_path) return { url: here };
-		return {
-			path: new URL(here).pathname,
-			...branch ? { branch } : {}
-		};
-	}
-	let last = null;
-	let registering = null;
-	/** Registers this board's watchers with the remote, as itself, replacing its last registration. */
-	async function register(here) {
-		const current = await watchersHash();
-		if (last && last.url === here && last.result.hash === current && Date.now() - last.at < REGISTER_EVERY_MS) return last.result;
-		registering ??= wakeAt(here).then((where) => own.register({
-			...where,
-			watch: specs,
-			...sync.length > 0 ? { sync } : {}
-		})).then((result) => {
-			last = {
-				url: here,
-				at: Date.now(),
-				result
-			};
-			return result;
-		}).finally(() => {
-			registering = null;
-		});
-		return registering;
-	}
-	/** Runs one match and acks it: done, its error, or a skip for a watcher this board no longer has. */
-	async function runOne(match) {
-		let outcome = {};
-		if (!bound().subscriptions[match.watcher]) outcome = { skip: true };
-		else try {
-			await bound().run(match.watcher, match.event, {
-				trigger: `watch:${match.watcher}:${match.id}`,
-				attempt: match.attempt + 1
-			});
-		} catch (error) {
-			console.error(`[board] watcher ${match.watcher} failed:`, error);
-			outcome = { error: describe(error) };
-		}
-		await own.ack(match.id, {
-			lease: match.lease,
-			...outcome
-		}).catch((error) => console.error(`[board] couldn't ack a match:`, describe(error)));
-	}
-	/**
-	* Pulls and runs what's matched until nothing's left, or this run's time is up, and what sync
-	* queued in its inbox. A thread's matches come one at a time.
-	*/
-	async function drain() {
-		let ran = 0;
-		const until = Date.now() + DRAIN_MS;
-		while (Date.now() < until) {
-			const matches = await own.matches({ limit: 10 });
-			if (matches.length === 0) break;
-			await Promise.all(matches.map(runOne));
-			ran += matches.length;
-		}
-		return ran + await bound().pull();
-	}
-	let polling = null;
-	/** For a board that can't be woken: pulls on its own, each pull held open until something matches. */
-	function poll() {
-		if (polling) return;
-		const controller = polling = new AbortController();
-		(async () => {
-			for (let pause = 1e3; !controller.signal.aborted;) try {
-				await register(null);
-				const matches = await own.matches({
-					limit: 10,
-					wait: POLL_WAIT_S,
-					signal: controller.signal
-				});
-				await Promise.all(matches.map(runOne));
-				await bound().pull();
-				pause = 1e3;
-			} catch (error) {
-				if (controller.signal.aborted) break;
-				console.error(`[board] couldn't pull matches from ${remote}:`, describe(error));
-				await new Promise((resolve) => setTimeout(resolve, pause));
-				pause = Math.min(pause * 2, 6e4);
-			}
-		})();
+		const path = wakePath(here);
+		return path && (await discovery()).wake_by_path ? path : { url: here };
 	}
-	let started = null;
-	/**
-	* On first use, a board with watchers or sync registers them if it knows its URL. One on Vercel
-	* learns its mount path from a request (a `POST /watchers`, a webhook, or a wake-up); one that
-	* can't be woken registers without one and pulls instead. Resolves once the first try is done.
-	*/
-	function start() {
-		if (started) return started;
-		if (Object.keys(specs).length === 0 && sync.length === 0) return Promise.resolve();
-		const here = wakeable(bound().url());
-		if (!here && typeof process !== "undefined" && process.env.VERCEL === "1") return Promise.resolve();
-		started = register(here).then(() => {}, (error) => console.error(`[board] couldn't register with ${remote}:`, describe(error)));
-		if (!here) poll();
-		return started;
-	}
-	const routesHere = [{
-		method: "POST",
-		path: "/wake",
-		async handle(request) {
-			started ??= Promise.resolve();
-			if (request.headers.get("x-board-watchers") !== await watchersHash()) await register(wakeable(bound().url())).catch(rethrow);
-			return json({ ran: await drain().catch(rethrow) });
-		}
-	}, {
-		method: "POST",
-		path: "/watchers",
-		async handle(request, { caller }) {
-			if (caller) return json(await methods.register(caller, RegisterBody.parse(await request.json()), request.signal));
-			started ??= Promise.resolve();
-			const here = wakeable(bound().url());
-			const registration = await register(here).catch(rethrow);
-			if (!here) poll();
-			return json(registration);
-		}
-	}];
+	const runner = registrant({
+		remote,
+		registry: {
+			register: (where) => own.register({
+				...where,
+				watch: specs,
+				...sync.length > 0 ? { sync } : {}
+			}),
+			matches: (query) => own.matches(query),
+			ack: (id, body) => own.ack(id, body)
+		},
+		wakeAt,
+		binding: bound,
+		hash: watchersHash,
+		hasWork: () => Object.keys(specs).length > 0 || sync.length > 0,
+		rethrow,
+		registerFor: async (caller, request) => json(await methods.register(caller, RegisterBody.parse(await request.json()), request.signal))
+	});
+	const start = runner.start;
 	return {
 		...methods,
-		routes: routesHere,
+		routes: runner.routes,
 		keeps: false,
 		bind(next) {
 			if (binding) throw new Error("http: this backend already serves a board: create one http() per board()");
@@ -505,13 +558,10 @@ function createHttp(url, options, environment) {
 			binding = next;
 		},
 		/** Registers this board's watchers with the board it uses now, as `POST /watchers` does. */
-		registerWatchers: () => register(wakeable(bound().url())),
+		registerWatchers: runner.registerNow,
 		/** Stops pulling, for a board that pulls on its own. */
-		close: () => {
-			polling?.abort();
-			polling = null;
-		}
+		close: runner.close
 	};
 }
 //#endregion
-export { createHttp as t };
+export { wakePath as a, registrant as i, callerProfile as n, createHttp as r, PROJECTS_OWN as t };

package/dist/backend-http-Dzb4lpMG.mjs

@@ -0,0 +1,18 @@
+import { r as createHttp } from "./backend-http-CLcXkcAU.mjs";
+import { i as environmentProfile, r as connect, t as boardUrl } from "./node-BeKPcokJ.mjs";
+//#region src/backend-http/index.ts
+const environment = {
+	url: boardUrl,
+	fetch: (url) => connect(url).fetch,
+	profile: environmentProfile
+};
+/**
+* The board at `url`, which keeps the log: this board uses it as this deployment. Without a
+* `url`, the one the environment points at: `BOARD_URL`, the repo's link, or `vb use`'s.
+* Without a `fetch`, it sends the credentials `vb` would.
+*/
+function http(url, options = {}) {
+	return createHttp(url, options, environment);
+}
+//#endregion
+export { http as t };

package/dist/backend-http.mjs

@@ -1,2 +1,2 @@
-import { t as http } from "./index.default-C3luVnd-.mjs";
+import { t as http } from "./index.default-DNKzR4md.mjs";
 export { http };

package/dist/backend-http.node.mjs

@@ -1,2 +1,2 @@
-import { t as http } from "./backend-http-c-VHpUOs.mjs";
+import { t as http } from "./backend-http-Dzb4lpMG.mjs";
 export { http };

package/dist/backend-vercel-BjUpoLR9.mjs

@@ -0,0 +1,60 @@
+import { c as vercelLogin, i as environmentProfile, l as vercelProjectFile } from "./node-BeKPcokJ.mjs";
+import { t as createVercel } from "./backend-vercel-DjL8tYIF.mjs";
+import { readFile } from "node:fs/promises";
+import { decodeJwt } from "jose";
+import { getVercelOidcToken } from "@vercel/oidc";
+//#region src/backend-vercel/index.ts
+/** On Vercel, or with its OIDC token pulled (`vercel env pull`): a deployment acts as its project. */
+const deployed = () => process.env.VERCEL === "1" || !!process.env.VERCEL_OIDC_TOKEN;
+/**
+* A token Vercel's API takes: `VERCEL_TOKEN`, this deployment's OIDC token, or your Vercel login,
+* the one the Vercel CLI hands a CLI it runs (`VERCEL_AUTH_TOKEN`) or your `vercel login`.
+*/
+async function token() {
+	if (process.env.VERCEL_TOKEN) return process.env.VERCEL_TOKEN;
+	if (deployed()) return getVercelOidcToken();
+	return vercelLogin();
+}
+/** Where `token` comes from, in words: what `vb whoami` says. */
+function credentialSource() {
+	if (process.env.VERCEL_TOKEN) return "VERCEL_TOKEN";
+	if (deployed()) return "Vercel OIDC";
+	return process.env.VERCEL_AUTH_TOKEN ? "the Vercel CLI" : "vercel login";
+}
+/** The team: `VERCEL_ORG_ID`, the one the deployment's OIDC token names, or the linked project's (the nearest `.vercel/project.json`). */
+async function team() {
+	if (process.env.VERCEL_ORG_ID) return process.env.VERCEL_ORG_ID;
+	if (!process.env.VERCEL_TOKEN && deployed()) try {
+		const owner = decodeJwt(await getVercelOidcToken()).owner_id;
+		if (typeof owner === "string") return owner;
+	} catch {}
+	const file = vercelProjectFile();
+	if (!file) return null;
+	try {
+		const linked = JSON.parse(await readFile(file, "utf8"));
+		if (typeof linked.orgId === "string") return linked.orgId;
+	} catch {}
+	return null;
+}
+const environment = {
+	fetch: () => async (input, init = {}) => {
+		const headers = new Headers(init.headers);
+		headers.set("authorization", `Bearer ${await token()}`);
+		return globalThis.fetch(input, {
+			...init,
+			headers
+		});
+	},
+	team,
+	profile: environmentProfile
+};
+/**
+* Your team's board, in Vercel's API: this board keeps nothing, and reads and writes that one as
+* this deployment's project, or as you. Without `board`, the team's board; without `fetch`, it
+* sends the credentials the Vercel CLI or the deployment has.
+*/
+function vercel(options = {}) {
+	return createVercel(options, environment);
+}
+//#endregion
+export { vercel as n, credentialSource as t };