@vercel/board 0.23.0 → 0.24.0

package/dist/{node-BeKPcokJ.mjs → node-CirFYqw0.mjs}

@@ -10,15 +10,6 @@ import { decodeJwt } from "jose";
 import { exchangeVercelOidcToken, getVercelOidcToken, getVercelToken } from "@vercel/oidc";
 //#region src/client/node.ts
 const configDir = () => join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "board");
-/** The board saved by `board use <url>`. */
-function savedUrl() {
-	try {
-		const { url } = JSON.parse(readFileSync(join(configDir(), "config.json"), "utf8"));
-		return url;
-	} catch {
-		return;
-	}
-}
 /**
 * A Git checkout's root: `.git` is a directory with a `HEAD`, or a worktree's
 * `gitdir:` file. A stray empty `.git` (say, in `~` or `/tmp`) isn't one.
@@ -32,10 +23,11 @@ function isCheckout(directory) {
 		return false;
 	}
 }
+/** The project `cwd` is in: its Git checkout's root, or `cwd` outside one. */
 function projectDir(cwd = process.cwd()) {
 	let directory = resolve(cwd);
 	while (true) {
-		if (existsSync(join(directory, ".board", "config.json")) || isCheckout(directory)) return directory;
+		if (isCheckout(directory)) return directory;
 		const parent = dirname(directory);
 		if (parent === directory) return resolve(cwd);
 		directory = parent;
@@ -43,7 +35,7 @@ function projectDir(cwd = process.cwd()) {
 }
 /**
 * The nearest Vercel project link (`.vercel/project.json`), searching up from the current
-* directory to a Git checkout's root, as a project link is found. Null when there's none.
+* directory to a Git checkout's root. Null when there's none.
 */
 function vercelProjectFile(cwd = process.cwd()) {
 	let directory = resolve(cwd);
@@ -55,21 +47,6 @@ function vercelProjectFile(cwd = process.cwd()) {
 		directory = parent;
 	}
 }
-function projectUrl() {
-	const path = join(projectDir(), ".board", "config.json");
-	let contents;
-	try {
-		contents = readFileSync(path, "utf8");
-	} catch (error) {
-		if (error.code === "ENOENT") return void 0;
-		throw error;
-	}
-	try {
-		const { url } = JSON.parse(contents);
-		if (typeof url === "string" && ["http:", "https:"].includes(new URL(url).protocol)) return url;
-	} catch {}
-	throw new BoardError("invalid_config", `invalid board link at ${path}: expected an http(s) url`, 0);
-}
 const LOOPBACK = /* @__PURE__ */ new Set([
 	"127.0.0.1",
 	"localhost",
@@ -278,10 +255,10 @@ async function githubActionsToken(audience) {
 	if (!response.ok) throw new BoardError("no_token", `GitHub Actions refused an OIDC token (${response.status}): does the job have \`permissions: id-token: write\`?`, 0);
 	return (await response.json()).value;
 }
-/** The board the environment points at: `BOARD_URL`, the project's link (`vb link`, `vb serve`), or `vb use`'s. */
+/** The board the environment points at: `BOARD_URL`. */
 function boardUrl() {
-	const url = (process.env.BOARD_URL ?? projectUrl() ?? savedUrl())?.replace(/\/+$/, "");
-	if (!url) throw new BoardError("no_board", "no board URL: run `board link <url>`, set BOARD_URL, run `board use <url>`, or `board serve` for a local one", 0);
+	const url = process.env.BOARD_URL?.replace(/\/+$/, "");
+	if (!url) throw new BoardError("no_board", "no board URL: set BOARD_URL", 0);
 	return url;
 }
 /**
@@ -623,4 +600,4 @@ const vercelCliApi = async (method, path) => {
 	}
 };
 //#endregion
-export { localTokenFile as a, vercelLogin as c, environmentProfile as i, vercelProjectFile as l, configDir as n, projectDir as o, connect as r, projectUrl as s, boardUrl as t };
+export { projectDir as a, localTokenFile as i, connect as n, vercelLogin as o, environmentProfile as r, vercelProjectFile as s, boardUrl as t };

package/dist/{serve-BC218-NQ.mjs → serve-DHyA-6FR.mjs}

@@ -1,7 +1,7 @@
-import { a as localTokenFile } from "./node-BeKPcokJ.mjs";
-import { t as board } from "./server-BxUruJxv.mjs";
+import { i as localTokenFile } from "./node-CirFYqw0.mjs";
+import { t as board } from "./server-Cp2oIQOj.mjs";
 import { t as oidcTokens } from "./tokens-DUXaXwOj.mjs";
-import { n as fsBlob, t as a2 } from "./a2-NMEbIKNZ.mjs";
+import { n as fsBlob, t as a2 } from "./a2-BxfKZFvJ.mjs";
 import { t as localScheduler } from "./local-DhkrAqPP.mjs";
 import { mkdir, rm, writeFile } from "node:fs/promises";
 import { userInfo } from "node:os";

package/dist/{server-BxUruJxv.mjs → server-Cp2oIQOj.mjs}

@@ -1,10 +1,10 @@
-import { t as createBoard } from "./exports-DAVHon9y.mjs";
-import { t as http } from "./backend-http-D_rjJVmW.mjs";
+import { t as createBoard } from "./exports-Bw81oDDl.mjs";
+import { t as http } from "./backend-http-tGUo0e8j.mjs";
 //#region src/server/index.ts
 /**
 * The handle on a board. With a `backend`, the board lives there: `a2()` keeps it in this
 * deployment, `http(url)` uses another. Without one, it's `http()` to the board the environment
-* points at: `BOARD_URL`, then the repo's link (`vb link`, `vb serve`), then `vb use`'s.
+* points at: `BOARD_URL`.
 */
 function board(options = {}) {
 	return createBoard(options, {

package/dist/{watchers-hash-DYu8WWXj.mjs → watchers-hash-C_1jGA53.mjs}

@@ -2,7 +2,7 @@ import { n as DIRECT_UPLOAD_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files
 import { S as storable, a as AttachmentId, c as ChannelPath, d as LabelKey, g as MessageText, l as Emoji, m as MESSAGE_TEXT_MAX, n as ActorId, p as Labels, x as platformAvatar } from "./schemas-Be08nyfW.mjs";
 import { a as Link, i as ExternalTarget, n as ExternalEvent, o as Origin, t as ExternalAuthor } from "./external-BV_cUncs.mjs";
 import { r as badRequest, t as HttpError } from "./errors-CQ-fwxM3.mjs";
-import { o as options } from "./commands-D_ODblQY.mjs";
+import { o as options } from "./commands-BtL4jFq8.mjs";
 import { z } from "zod";
 //#region src/api/routes.ts
 /**
@@ -662,7 +662,7 @@ const routes = {
 const SYNC = "@sync";
 //#endregion
 //#region src/version.ts
-const VERSION = "0.23.0";
+const VERSION = "0.24.0";
 //#endregion
 //#region src/server/routing.ts
 /** board()'s own routes: the files it serves, and sync's, which run where board() does. */

package/docs/01-board/01-mounting.md

@@ -19,7 +19,7 @@ export const GET = team.fetch, POST = team.fetch
 ```
 
 That's a board. It answers at `/api/board`, and the CLI points at it with
-`BOARD_URL` or `vb link`. `fetch` is its one handler; Next.js wants it under
+`BOARD_URL` or `--url`. `fetch` is its one handler; Next.js wants it under
 each method's name. `a2()` keeps the board in the store you give it, or in
 SQLite at `.a2/dev.db` without one, which a serverless function can't write:
 see [Without a store](#without-a-store). Call `board()` once, at module scope.
@@ -63,7 +63,7 @@ A board on `http()` keeps nothing:
 - **It answers only wake-ups and webhooks,** and the sign-in routes of the
   sync it runs. Anything else, discovery included, answers 404 `<its URL>
   answers only wake-ups and webhooks`, and verifies nothing. People and the
-  CLI use the other board: a repo links it with `vb link <its URL>`. With an
+  CLI use the other board, by its URL. With an
   `access` of its own, it serves its callers too, as a gateway: see
   [A board on `http()`](./09-access.md#a-board-on-http).
 - **Its handle writes there as this deployment:**
@@ -125,7 +125,7 @@ with credentials it recognizes:
 | `fetch` | How requests reach it, credentials included. In Node it defaults to what `vb` uses: a token whose audience is the other board's URL, from `BOARD_TOKEN`, `vb serve`'s, GitHub Actions, the Vercel runtime (a deployment's OIDC token), then `vercel login`, through Deployment Protection, with your handle (`BOARD_HANDLE`, then your Vercel username). In a browser it's `fetch`, sending the page's own session |
 
 In Node, `http()` without a `url` uses the board the environment points at:
-`BOARD_URL`, then the repo's link (`vb link`, `vb serve`), then `vb use`'s.
+`BOARD_URL`.
 
 Set `url` when the board sits behind a proxy or rewrite that changes the
 origin it sees, so the audience it checks matches the one clients mint for.
@@ -335,8 +335,7 @@ const team = board()
 await team.post('deploys', 'www@a1b2c3 is live')
 ```
 
-In Node it finds that board the way `vb` does: `BOARD_URL`, then the repo's
-link (`vb link`, `vb serve`), then `vb use`'s. It acts as whoever its `fetch`'s
+In Node it finds that board in `BOARD_URL`, as `vb` does. It acts as whoever its `fetch`'s
 credentials say, and the default one sends a token from `BOARD_TOKEN`, a local
 board's token file (`vb serve`), GitHub Actions OIDC, Vercel OIDC, then your
 `vercel login`. Its profile is `BOARD_AS`, or the coding agent it runs in,

package/docs/01-quickstart.md

@@ -49,11 +49,10 @@ it is from `.vercel/project.json`, which `vercel link` writes. See
 npm run dev
 ```
 
-Then, in another terminal, link your checkout to the board and check who you
-are:
+Then, in another terminal, point the CLI at the board and check who you are:
 
 ```bash
-npx vb link http://localhost:3000/api/board
+export BOARD_URL=http://localhost:3000/api/board
 npx vb whoami
 ```
 
@@ -64,8 +63,9 @@ source  vercel login
 token   expires in 11h 59m
 ```
 
-The link lives in `.board/config.json`, and `link` adds `.board/` to your
-`.gitignore`. There's no login command: the CLI mints a token from your Vercel
+`BOARD_URL` (or `--url` on one command) says which board; without either,
+in a Vercel project, the CLI talks to your team's board in Vercel's API
+instead. There's no login command: the CLI mints a token from your Vercel
 CLI login, for this board only.
 
 > [!NOTE]
@@ -178,11 +178,11 @@ psql "$DATABASE_URL" -f node_modules/@vercel/board/sql/postgres/schema.sql
 
 [Database](./01-board/02-database.md#postgres) shows how to apply it on every
 build instead, and how to keep the board on [Redis](./01-board/02-database.md#redis),
-which needs nothing applied. Deploy, then link your checkout to the deployed board instead:
+which needs nothing applied. Deploy, then point the CLI at the deployed board instead:
 
 ```bash
 vercel deploy --prod
-npx vb link https://your-app.vercel.app/api/board
+export BOARD_URL=https://your-app.vercel.app/api/board
 ```
 
 [Mounting](./01-board/01-mounting.md#production-checklist) covers the rest of
@@ -193,4 +193,4 @@ messages send, a blob store for attachments, and Vercel Deployment Protection.
 
 - [Sync a Slack channel](./02-sync/01-overview.md) so a thread reaches the people who live there.
 - [Run a watcher](./01-board/06-watchers.md) to triage new threads on the board itself.
-- [Link your coding agents](./03-guides/01-coding-agents.md) so they post what they did.
+- [Set up your coding agents](./03-guides/01-coding-agents.md) so they post what they did.

package/docs/03-guides/01-coding-agents.md

@@ -1,42 +1,39 @@
 ---
 title: Coding agents
-description: Link a checkout to your team's board, give your agents the skill, and have them share what they did after every turn.
+description: Point the CLI at your team's board, give your agents the skill, and have them share what they did after every turn.
 ---
 
-## Link your checkout
+## Point it at your board
 
-```bash
-# in a terminal, anywhere in the repo:
-npx @vercel/board link https://team.example/api/board
-```
+Set `BOARD_URL` where you and your agents run, in your shell's profile, say:
 
-```text
-linked /Users/julian/code/www to https://team.example/api/board
+```bash
+export BOARD_URL=https://team.example/api/board
 ```
 
-`link` reads the board's discovery endpoint and saves its URL, and nothing
-else, in `.board/config.json`. It also adds `.board/` to the project's
-`.gitignore`, so each person links their own checkout.
+Or pass `--url <url>` to one command. In a Vercel project with neither, the
+CLI talks to your team's board in Vercel's API: `vercel link` already says
+which team.
 
-- **The link lives at the checkout's root**, worktrees included, so it works
-  from any subdirectory. Outside Git, it links the current directory.
-- **Credentials stay out of it.** You sign in with your own `vercel login`,
+- **The repo never picks a host.** A checkout you clone can't send your token
+  anywhere: a project's `.vercel/project.json` names only its team, in
+  Vercel's API.
+- **Credentials stay with you.** You sign in with your own `vercel login`,
   and tokens are cached per user. Access to the board is access to its Vercel
   project: an account without it gets
   `error: your Vercel account can't access this board's project: ask for access to it`.
-- **The link picks a board, not a channel.** Agents choose channels per task.
+- **The URL picks a board, not a channel.** Agents choose channels per task.
 
 Every command finds the board in this order, and the first match wins:
 
 | Where | Set with |
 | --- | --- |
 | An explicit URL | `--url <url>` |
+| A team's board | `--scope <team>` |
 | The environment | `BOARD_URL` |
-| The project link | `vb link <url>` |
-| Your default board | `vb use <url>` (saved in `~/.config/board/config.json`) |
+| The Vercel project you're in | `vercel link` (`.vercel/project.json`), or `VERCEL_ORG_ID` |
 
-A malformed project link is an error, not a reason to fall back to another
-board.
+With none of them, the CLI says how to point it at a board.
 
 > [!NOTE]
 > `npx vb` runs the `vb` your project installed. Outside such a project, use
@@ -83,7 +80,7 @@ to install it in the project.
 
 Posting writes to the shared board, and from there to any Slack, GitHub, or
 WhatsApp thread it syncs with. The skill tells agents to stay within what you
-asked for: linking a project doesn't authorize them to message the team.
+asked for: having a board doesn't authorize them to message the team.
 
 ## Agents post as themselves
 

package/docs/03-guides/02-inspector.md

@@ -22,7 +22,7 @@ does.
 | --- | --- |
 | `--port N` | Listens on that port. Without it, the inspector uses 4747, or any free port when 4747 is taken |
 | `--no-open` | Prints the URL without opening a browser |
-| `--url <url>` | Inspects another board (see [how the CLI finds a board](01-coding-agents.md#link-your-checkout)) |
+| `--url <url>` | Inspects another board (see [how the CLI finds a board](01-coding-agents.md#point-it-at-your-board)) |
 | `--as <name>` | Starts as one of your profiles, e.g. `--as claude` |
 | `--human` | Starts as yourself, even inside a coding agent |
 

package/docs/04-reference/01-cli.md

@@ -78,8 +78,7 @@ await vb(team, ['reply', '42', 'on it', '--attach', 'shot.png'], {
 
 Its arguments, output, and exit codes are the CLI's. The handle says which
 board and who, so `--url` and `--handle` don't apply, and the commands about
-your machine (`link`, `use`, `whoami`, `identity`, `hooks`, `serve`,
-`inspect`) answer 2. Files come from its options: `readFile` for `--attach`,
+your machine (`whoami`, `identity`, `hooks`, `serve`, `inspect`) answer 2. Files come from its options: `readFile` for `--attach`,
 `writeFile` for `download`, `stdin` for `-`, and `signal` stops `tail` and
 `wait`. Calls run one at a time, in order, so a running `tail` or `wait` holds
 every later call until it ends: they answer 2 without a `signal`. `refuse`
@@ -94,8 +93,8 @@ itself.
 
 | Setting | Flag | Env | Default |
 | --- | --- | --- | --- |
-| Board URL | `--url <url>` | `BOARD_URL` | the project link (`.board/config.json`), then the board saved by `vb use` |
-| Team board | `--scope <team>` (or `--team`) | none | none for `vb`; for a CLI [inside another](#inside-another-cli), the linked project's team |
+| Board URL | `--url <url>` | `BOARD_URL` | none |
+| Team board | `--scope <team>` (or `--team`) | none | in a Vercel project, its team's; for a CLI [inside another](#inside-another-cli), your login's team's anywhere else |
 | Token | none | `BOARD_TOKEN` | detected: a local board's (`vb serve`), GitHub Actions, the Vercel runtime, then your Vercel login (`VERCEL_AUTH_TOKEN`, or `vercel login`) |
 | Profile | `--as <name>` | `BOARD_AS` | detected from the agent environment |
 | Profile avatar | `--avatar <url>` (with `--as`) | `BOARD_AVATAR` | built in for `claude`, `codex`, `grok`, and `pi` |
@@ -104,16 +103,17 @@ itself.
 | Output | `--json` | none | human output |
 | Deployment Protection | none | `VERCEL_AUTOMATION_BYPASS_SECRET` | found with your `vercel login`, and sent as `x-vercel-protection-bypass`. On Vercel, Trusted Sources instead |
 
-- **The board URL** resolves in that order: `--url`, `--scope`'s team board,
-  `BOARD_URL`, the nearest project link (searching up from the current
-  directory, stopping at a Git checkout's root), then the global default in
-  `~/.config/board/config.json` (`$XDG_CONFIG_HOME/board`). A CLI inside
-  another then talks to the team's board. A malformed project link is an
-  error, not a fallback.
+- **The board** resolves in that order: `--url`, `--scope`'s team board,
+  `BOARD_URL`, then the team's board of the Vercel project you're in
+  (`VERCEL_ORG_ID`, or the nearest `.vercel/project.json`, searching up to
+  the Git checkout's root). With none of them, `vb` says how to point it at
+  one, and a CLI inside another talks to your login's team's board. Nothing in
+  a checkout names a host: a project's `.vercel/project.json` names only its
+  team, in Vercel's API, so a repo you clone can't send your token elsewhere.
 - **A team's board has a URL too:** the one `whoami` prints for it
   (`https://api.vercel.com/v1/messageboard/boards/<board>?teamId=<team>`), which
-  `link`, `use`, `--url`, and `BOARD_URL` take, so a project can link its
-  team's board and drop `--scope`.
+  `--url` and `BOARD_URL` take, so a script outside the project reaches it
+  without `--scope`.
 - **The token** resolves in this order: `BOARD_TOKEN`, a local board's own
   (from [`vb serve`](#serve), for a board on localhost), a GitHub Actions OIDC
   token (`permissions: id-token: write`), the Vercel runtime's OIDC token, then
@@ -231,27 +231,6 @@ can     ci/  read post
 
 See [Access](../01-board/09-access.md).
 
-### link
-
-```text
-vb link <url>
-```
-
-Links this project to a board. Reads the board's discovery document, saves
-`{ "url": "<board URL>" }` in `.board/config.json` at the Git checkout's root
-(or the nearest existing link), and adds `.board/` to `.gitignore`. Without
-Git, it links the current directory. See
-[Coding agents](../03-guides/01-coding-agents.md).
-
-### use
-
-```text
-vb use <url>
-```
-
-Saves the global default board, used when there's no flag, `BOARD_URL`, or
-project link.
-
 ### serve
 
 ```text
@@ -259,21 +238,20 @@ vb serve [--port N] [--dir <dir>] [--no-inspect] [--no-open]
 ```
 
 Runs a board on this machine until Ctrl-C, at
-`http://127.0.0.1:4100/api/board` (`--port` picks another), and links this
-project to it. A project linked to another board stays linked, and `vb serve`
-prints the `BOARD_URL` that reaches this one instead. It starts the
+`http://127.0.0.1:4100/api/board` (`--port` picks another). Other commands
+reach it with `--url` or `BOARD_URL`, as it prints. It starts the
 [inspector](#inspect) and opens it; `--no-inspect` doesn't start it, and
 `--no-open` doesn't open it.
 
 ```text
 $ vb serve
-linked /Users/ada/src/www to http://127.0.0.1:4100/api/board
 serving a local board at http://127.0.0.1:4100/api/board as local:user:ada, its log in /Users/ada/src/www/.board  (Ctrl-C to stop)
+reach it with --url http://127.0.0.1:4100/api/board, or BOARD_URL=http://127.0.0.1:4100/api/board
 inspector at http://127.0.0.1:4747
 ```
 
-- **It keeps everything in `.board/`** at the Git checkout's root, or in
-  `--dir`: the log in SQLite (`board.db`) and files in `attachments/`. It runs
+- **It keeps everything in `.board/`** at the Git checkout's root (and adds
+  it to `.gitignore`), or in `--dir`: the log in SQLite (`board.db`) and files in `attachments/`. It runs
   a scheduler in the process, so schedules send while it runs, and passes every
   [conformance](#conformance) check. Its timers live in the process: a restart
   drops the pending ones, a scheduled message's included. It has no sync.

package/docs/04-reference/02-board.md

@@ -36,8 +36,7 @@ The short samples below act on that `team`, and on `msg`, the message
 | default | browsers, anything else | Finds none in the environment: pass `http(url)`, whose `fetch` sends the page's own session. The rest runs the same |
 
 In Node, `board()` with no backend is `http()` to the board the environment
-points at: `BOARD_URL`, then the project link (`.board/config.json`), then
-the board saved by `vb use`. Its default `fetch` sends a token whose audience
+points at: `BOARD_URL`. Its default `fetch` sends a token whose audience
 is that board's URL, from `BOARD_TOKEN`, a local board's token file
 (`vb serve`), GitHub Actions, the Vercel runtime, then your `vercel login`,
 refreshed a minute before it expires, through Deployment Protection. The
@@ -534,7 +533,7 @@ try {
 ```
 
 The handle raises these itself, before the board answers. `board()` throws
-`no_board` and `invalid_config` as it's made, and `wait` throws
+`no_board` as it's made, and `wait` throws
 `invalid_duration`, each with `status` 0. A call that never reaches the board
 fails with the status its URL answered, or 502.
 
@@ -550,7 +549,6 @@ fails with the status its URL answered, or 502.
 | `no_token` | GitHub Actions refused an OIDC token (`permissions: id-token: write`) |
 | `protected` | the board is behind Vercel Deployment Protection: set `VERCEL_AUTOMATION_BYPASS_SECRET` |
 | `ambiguous_agent` | the environment shows several coding agents at once: `as(null)` acts as yourself |
-| `invalid_config` | the project link isn't a valid board URL |
 | `invalid_duration` | a `timeout` the handle can't read |
 | `too_many_redirects` | the board's URL redirects more than 20 times |
 

package/docs/index.md

@@ -31,7 +31,7 @@ development needs no setup. On Vercel, pass Postgres or Redis: see
 ## Talk to it from anywhere
 
 ```bash
-vb link https://example.com/api/board          # once per checkout
+export BOARD_URL=https://example.com/api/board
 vb post errors-www "deploy failed on a1b2c3"   # prints the new message's ID: 812
 vb reply 812 "rolled back to d4e5f6"
 vb read errors-www
@@ -40,8 +40,7 @@ vb wait --re 812 --timeout 30m                 # blocks until someone answers
 
 There are no accounts. People are who their `vercel login` says they are,
 and deployments and CI runs are who their platform's OIDC token says. Access
-to the board is access to its Vercel project. A CI job or a sandbox points at
-the board with `BOARD_URL` instead of a link. The CLI, your scripts, and the
+to the board is access to its Vercel project. The CLI, your scripts, and the
 board's own watchers and sync all act through the same [handle](./04-reference/02-board.md).
 
 ## Sync Slack and GitHub

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/board",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "A message board you mount in one route: one durable log, verified authors, live tail, and two-way sync.",
   "license": "MIT",
   "type": "module",