@vercel/board 0.25.0 → 0.25.1

package/dist/{main-BNkywL2P.mjs → main-DOhNCWMd.mjs}

@@ -1,14 +1,14 @@
 import { i as fileSize, n as DIRECT_UPLOAD_BYTES_MAX } from "./files-SniSmeEr.mjs";
 import { a as AttachmentId } from "./schemas-Be08nyfW.mjs";
-import { d as VERSION, i as withMentions } from "./watchers-hash-C4CJg7K1.mjs";
+import { d as VERSION, i as withMentions } from "./watchers-hash-BHNXy_N7.mjs";
 import { n as displayEmoji, r as normalizeEmoji } from "./emoji-CTLpvH-A.mjs";
-import { t as BoardError } from "./client-BY-BCggB.mjs";
+import { t as BoardError } from "./client-D0Px7KzF.mjs";
 import { i as groups, n as filters$1, o as options, r as globalOptions, s as usage$1, t as commands } from "./commands-BtL4jFq8.mjs";
-import { n as connect, s as vercelProjectFile, t as boardUrl } from "./node-C51_xzCb.mjs";
-import { t as http } from "./backend-http-Cs-UKpYp.mjs";
-import { t as board } from "./server-BgK1sgj7.mjs";
-import { t as conformance } from "./conformance-BZ53bxrG.mjs";
-import { n as vercel, t as credentialSource } from "./backend-vercel-B0Q0K0O5.mjs";
+import { n as connect, s as vercelProjectFile, t as boardUrl } from "./node-Bkd1x0QI.mjs";
+import { t as http } from "./backend-http-CJd4Fu0U.mjs";
+import { t as board } from "./server-BF4WJ7qi.mjs";
+import { t as conformance } from "./conformance-DlnfuzEB.mjs";
+import { n as vercel, t as credentialSource } from "./backend-vercel-Bqg2QfTd.mjs";
 import { t as displayText } from "./bots-CGkO76qH.mjs";
 import { spawn } from "node:child_process";
 import { readFile, stat, writeFile } from "node:fs/promises";
@@ -1011,14 +1011,15 @@ function missing() {
 	if (command === "download") return `attachment ${a}`;
 }
 /**
-* What `error` means for this run, in the Vercel CLI's terms. The handle's own errors (`vercel
-* login` missing, Deployment Protection) say what and why themselves; the board's are said by what
-* this run was doing, with the board's own words under it.
+* What `error` means for this run, in the Vercel CLI's terms. What the handle raised itself says
+* what and why, and its hint what fixes it. What a board answered is said by what this run was
+* doing, with the board's words under it and in `data`, never in what to run: a board can answer
+* with any code, the handle's own included.
 */
 function failureOf(error) {
 	if (error instanceof Failed) return error.failure;
 	const message = error instanceof Error ? error.message : String(error);
-	const { code, status, hint } = error;
+	const { code, status, hint, origin } = error;
 	if (typeof code !== "string" || typeof status !== "number") return {
 		class: "unknown",
 		reason: "unexpected_error",
@@ -1028,61 +1029,65 @@ function failureOf(error) {
 	const said = { error: {
 		code,
 		message,
-		status
+		status,
+		...typeof hint === "string" ? { hint } : {}
 	} };
-	const fix = typeof hint === "string" ? [{ instruction: hint }] : [];
-	const own = (kind, reason, next = fix) => ({
-		class: kind,
-		reason,
-		message,
-		...next.length ? { next } : {},
-		data: said
-	});
-	switch (code) {
-		case "not_logged_in": return {
-			class: "auth",
-			reason: "login_required",
-			message: "You're not logged in to Vercel.",
-			next: [{
-				instruction: "Log in",
-				argv: ["vercel", "login"]
-			}],
+	if (origin === "handle") {
+		const fix = typeof hint === "string" ? [{ instruction: hint }] : [];
+		const own = (kind, reason, next = fix) => ({
+			class: kind,
+			reason,
+			message,
+			...next.length ? { next } : {},
 			data: said
-		};
-		case "no_access": return own("permission", "permission_denied");
-		case "wrong_project": return own("permission", "wrong_project");
-		case "protected": return own("permission", "deployment_protected");
-		case "no_project": return own("platform", "no_project");
-		case "no_token": return own("auth", "token_unavailable");
-		case "no_board": return own("not_found", "board_not_found");
-		case "too_many_redirects": return own("network", "network_error");
-		case "invalid_duration": return own("usage", "invalid_arguments", [helpRecovery()]);
-		case "wrong_audience": return own("usage", "wrong_url");
-		case "ambiguous_agent": return own("usage", "ambiguous_agent", [{
-			instruction: "Write as one of them",
-			argv: rerun("--as", "<PROFILE>")
-		}, {
-			instruction: "Or as yourself",
-			argv: rerun("--human")
-		}]);
-		case "too_large": return {
-			...own("limit", "payload_too_large"),
-			message: `Can't ${doing()}. ${sentence(message)}`
-		};
-		case "upload_failed": return {
-			...own("platform", "upload_failed"),
-			message: `Failed to ${doing()}.`,
-			details: [message]
-		};
-		case "port_taken": return own("conflict", "port_taken", [{
-			instruction: "Pick another port",
-			argv: [
-				...cli(),
-				current.command ?? "serve",
-				"--port",
-				"<PORT>"
-			]
-		}]);
+		});
+		switch (code) {
+			case "not_logged_in": return {
+				class: "auth",
+				reason: "login_required",
+				message: "You're not logged in to Vercel.",
+				next: [{
+					instruction: "Log in",
+					argv: ["vercel", "login"]
+				}],
+				data: said
+			};
+			case "no_access": return own("permission", "permission_denied");
+			case "wrong_project": return own("permission", "wrong_project");
+			case "protected": return own("permission", "deployment_protected");
+			case "no_project": return own("platform", "no_project");
+			case "no_token": return own("auth", "token_unavailable");
+			case "no_board": return own("not_found", "board_not_found");
+			case "too_many_redirects": return own("network", "network_error");
+			case "invalid_duration": return own("usage", "invalid_arguments", [helpRecovery()]);
+			case "wrong_audience":
+			case "redirected": return own("usage", "wrong_url");
+			case "ambiguous_agent": return own("usage", "ambiguous_agent", [{
+				instruction: "Write as one of them",
+				argv: rerun("--as", "<PROFILE>")
+			}, {
+				instruction: "Or as yourself",
+				argv: rerun("--human")
+			}]);
+			case "too_large": return {
+				...own("limit", "payload_too_large"),
+				message: `Can't ${doing()}. ${sentence(message)}`
+			};
+			case "upload_failed": return {
+				...own("platform", "upload_failed"),
+				message: `Failed to ${doing()}.`,
+				details: [message]
+			};
+			case "port_taken": return own("conflict", "port_taken", [{
+				instruction: "Pick another port",
+				argv: [
+					...cli(),
+					current.command ?? "serve",
+					"--port",
+					"<PORT>"
+				]
+			}]);
+		}
 	}
 	const theirs = (kind, reason, headline, next = []) => ({
 		class: kind,
@@ -1459,7 +1464,7 @@ async function run(command, args) {
 			};
 			const old = outdated("This board can't list threads.");
 			const page = await board.threads(query).catch((error) => {
-				throw error instanceof BoardError && error.status === 404 ? old : error;
+				throw error instanceof BoardError && error.status === 404 && /^no route: /.test(error.message) ? old : error;
 			});
 			if (!Array.isArray(page.threads)) throw old;
 			if (!page.threads.length && target) {

package/dist/{middleware-B0J7QBq7.mjs → middleware-ChKM1zuu.mjs}

@@ -1,5 +1,5 @@
 import { m as MESSAGE_TEXT_MAX, p as Labels } from "./schemas-Be08nyfW.mjs";
-import { t as HttpError } from "./errors-Bven0k29.mjs";
+import { t as HttpError } from "./errors-CusN4x2l.mjs";
 import { z } from "zod";
 //#region src/server/middleware.ts
 /** A write the middleware didn't let through: the API answers 422 with what it responded. */

package/dist/{node-C51_xzCb.mjs → node-Bkd1x0QI.mjs}

@@ -1,4 +1,4 @@
-import { t as BoardError } from "./client-BY-BCggB.mjs";
+import { t as BoardError } from "./client-D0Px7KzF.mjs";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -52,6 +52,13 @@ const LOOPBACK = /* @__PURE__ */ new Set([
 	"localhost",
 	"[::1]"
 ]);
+const PROJECT_ID = /^prj_[A-Za-z0-9]{1,64}$/;
+const URL_SHAPE = /^https?:\/\/[A-Za-z0-9.-]{1,253}(:\d{1,5})?(\/[A-Za-z0-9._~%/-]{0,2000})?$/;
+/**
+* A value a board said, as a message can show it: only when it's what it should be (a project
+* ID, a URL), since the handle's messages are trusted where a board's words aren't.
+*/
+const shown = (value, shape) => typeof value === "string" && shape.test(value) ? value : void 0;
 /** Where `vb serve` leaves the token for the board it runs at `url`: only this user can read it. */
 function localTokenFile(url) {
 	const normalized = url.replace(/\/+$/, "");
@@ -157,7 +164,7 @@ async function personToken(audience, discovery) {
 		return filled;
 	}
 	if (cached) return cached;
-	if (!discovery.project_id) throw new BoardError("no_project", `The board at ${discovery.url} doesn't know its Vercel project, so there's no Vercel login token to mint for it.`, 0, { hint: "Pass a token it accepts in BOARD_TOKEN." });
+	if (!discovery.project_id) throw new BoardError("no_project", `The board at ${audience} doesn't know its Vercel project, so there's no Vercel login token to mint for it.`, 0, { hint: "Pass a token it accepts in BOARD_TOKEN." });
 	const authToken = await vercelLogin().catch(() => null);
 	const project = await boardProject(audience, discovery, authToken);
 	let development;
@@ -211,7 +218,7 @@ async function boardProject(url, discovery, authToken) {
 		return response.ok ? await response.json() : null;
 	} : vercelCliApi, host);
 	if (!found) throw new BoardError("no_access", `Your Vercel login can't see the project ${host} belongs to.`, 0, { hint: "Log in as someone on the project's team (vercel login), or ask for access to it." });
-	if (found.projectId !== discovery.project_id) throw new BoardError("wrong_project", `The board at ${url} says its project is ${discovery.project_id}, but it's a deployment of ${found.projectId}, so no token is minted for it.`, 0);
+	if (found.projectId !== discovery.project_id) throw new BoardError("wrong_project", `The board at ${url} says its project is ${shown(discovery.project_id, PROJECT_ID) ?? "another one"}, but it's a deployment of ${found.projectId}, so no token is minted for it.`, 0);
 	return {
 		id: found.projectId,
 		team: found.ownerId.startsWith("team_") ? found.ownerId : null
@@ -274,7 +281,7 @@ function connect(url, options = {}) {
 	const discover = () => discovery ??= doFetch(url).then(async (response) => {
 		if (!response.ok) throw new BoardError("no_board", `There's no board at ${url}: it answered ${response.status}.`, response.status);
 		const found = await response.json();
-		if (found.audience !== url) throw new BoardError("wrong_audience", `The board at ${url} says its URL is ${found.audience}.`, 0, { hint: `Use ${found.audience}.` });
+		if (found.audience !== url) throw new BoardError("wrong_audience", `The board at ${url} says its URL is ${shown(found.audience, URL_SHAPE) ?? "another one"}.`, 0, { hint: shown(found.audience, URL_SHAPE) ? `Use ${found.audience}.` : "Use the URL its discovery names." });
 		return found;
 	});
 	let cached = null;
@@ -381,6 +388,19 @@ var Wall = class extends Error {
 	}
 };
 /**
+* A wall reached after a redirect to another origin, which none of a request's credentials follow,
+* by design: no bypass or token gets through it from here, so none is looked for.
+*/
+var Moved = class extends Error {
+	origin;
+	status;
+	constructor(origin, status) {
+		super("moved");
+		this.origin = origin;
+		this.status = status;
+	}
+};
+/**
 * This deployment's Vercel OIDC token, with `url` as its audience: what a hosted client sends a
 * board, for Deployment Protection's Trusted Sources. Its `cause` says why it couldn't.
 */
@@ -403,7 +423,12 @@ function guarded(url, doFetch, suppliedToken) {
 	let secret;
 	let looked;
 	let envRejected = false;
-	return async (input, init = {}) => {
+	return (input, init) => attempt(input, init).catch((error) => {
+		if (!(error instanceof Moved)) throw error;
+		const there = shown(`${error.origin}${new URL(url).pathname}`, URL_SHAPE);
+		throw new BoardError("redirected", `${url} redirects to ${there ? new URL(there).origin : "another origin"}, and its credentials don't follow it there, so Deployment Protection turns it away.`, error.status, { hint: there ? `Use ${there}.` : "Use the URL it redirects to." });
+	});
+	async function attempt(input, init = {}) {
 		const headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0));
 		init = {
 			...init,
@@ -447,7 +472,7 @@ function guarded(url, doFetch, suppliedToken) {
 		} catch (error) {
 			throw error instanceof Wall ? new BoardError("protected", `${url} is behind Vercel Deployment Protection, and its project's automation bypass didn't get through.`, error.status, { hint: `Set VERCEL_AUTOMATION_BYPASS_SECRET (${WHERE}).` }) : error;
 		}
-	};
+	}
 }
 /**
 * One request that recognizes the wall: a redirect to `/sso-api`, an HTML
@@ -464,6 +489,8 @@ async function through(doFetch, input, init, bypass) {
 	const method = (init.method ?? (input instanceof Request ? input.method : "GET")).toUpperCase();
 	let headers = new Headers(init.headers ?? (input instanceof Request ? input.headers : void 0));
 	if (bypass) headers.set("x-vercel-protection-bypass", bypass);
+	let moved = null;
+	const wall = (status) => moved ? new Moved(moved, status) : new Wall(status);
 	for (let hops = 0;; hops++) {
 		const response = await doFetch(hops === 0 ? input : target, {
 			...init,
@@ -473,10 +500,11 @@ async function through(doFetch, input, init, bypass) {
 		const location = response.status >= 300 && response.status < 400 ? response.headers.get("location") : null;
 		if (location) {
 			const next = new URL(location, target);
-			if (next.pathname.startsWith("/sso-api")) throw new Wall(response.status);
+			if (next.pathname.startsWith("/sso-api")) throw wall(response.status);
 			if (method === "GET" || method === "HEAD") {
 				if (hops >= 20) throw new BoardError("too_many_redirects", `${target} redirected more than 20 times.`, response.status);
 				if (next.origin !== new URL(target).origin) {
+					moved = next.origin;
 					headers = new Headers(headers);
 					headers.delete("authorization");
 					headers.delete("x-vercel-trusted-oidc-idp-token");
@@ -487,8 +515,8 @@ async function through(doFetch, input, init, bypass) {
 			}
 		}
 		const { status } = response;
-		if (/^text\/html\b/i.test(response.headers.get("content-type") ?? "") && !response.headers.has("content-disposition") && (status >= 200 && status < 300 || status === 401 || status === 403)) throw new Wall(status);
-		if (status === 401 && response.headers.has("x-vercel-error")) throw new Wall(status);
+		if (/^text\/html\b/i.test(response.headers.get("content-type") ?? "") && !response.headers.has("content-disposition") && (status >= 200 && status < 300 || status === 401 || status === 403)) throw wall(status);
+		if (status === 401 && response.headers.has("x-vercel-error")) throw wall(status);
 		return response;
 	}
 }