@vercel/board 0.28.0 → 0.29.0

package/dist/{backend-vercel-D87pIp2k.mjs → backend-vercel-BNauAs7w.mjs}

@@ -1,8 +1,10 @@
-import { _ as RemoteWatcherId } from "./schemas-Be08nyfW.mjs";
-import { O as RegisterBody, a as METHODS, d as VERSION, n as compileWatcher, t as canonicalWatchers } from "./watchers-hash-7DJU9b-n.mjs";
+import { r as IMPORT_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import { _ as RemoteWatcherId } from "./schemas-DBmUO6pr.mjs";
+import { O as RegisterBody, a as METHODS, d as VERSION, n as compileWatcher, t as canonicalWatchers } from "./watchers-hash-BDhLVkV5.mjs";
 import { o as sha256, r as derivedId } from "./wait-until-Dw4XrIDQ.mjs";
 import { a as forbidden, o as json, s as notFound, t as HttpError } from "./errors-CusN4x2l.mjs";
-import { a as wakePath, i as registrant, n as callerProfile, t as PROJECTS_OWN } from "./backend-http-CfLVYqmj.mjs";
+import { a as wakePath, i as registrant, n as callerProfile, t as PROJECTS_OWN } from "./backend-http-CzIJMm58.mjs";
+import { o as mediaType, r as fileName } from "./blob-DdbpJqN1.mjs";
 //#region src/server/backend-vercel.ts
 const PROFILE = /^[A-Za-z][A-Za-z0-9-]{0,31}$/;
 const SESSION = /^[A-Za-z0-9_.:-]{1,128}$/;
@@ -22,9 +24,16 @@ const UNKEPT = {
 	schedule: ["no_scheduler", "Vercel's boards don't schedule messages yet"],
 	schedules: ["no_scheduler", "Vercel's boards don't schedule messages yet"],
 	cancelSchedule: ["no_scheduler", "Vercel's boards don't schedule messages yet"],
-	upload: ["no_files", "Vercel's boards keep no files yet"],
-	attachment: ["no_files", "Vercel's boards keep no files yet"]
+	uploadStart: ["no_direct_uploads", "Vercel's boards take files up to 4 MB in one upload for now"],
+	uploadFinish: ["no_direct_uploads", "Vercel's boards take files up to 4 MB in one upload for now"]
 };
+/** A file as the board names it. */
+const fileOf = ({ id, name, type, size }) => ({
+	id,
+	name,
+	type,
+	size
+});
 const notSupported = (what) => new HttpError(501, "not_supported", `Vercel's boards don't support ${what} yet`);
 /** What a caller board() verified may do. Null for this deployment's own code, which may do what its credentials may. */
 const accessOf = (caller) => "identity" in caller ? caller.identity.principal.access : null;
@@ -89,6 +98,7 @@ function createVercel(options, environment) {
 	if (!/^https:\/\/[^/]+$|^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(origin)) throw new Error(`vercel: ${origin} isn't Vercel's API: pass an https origin`);
 	if (!options.fetch && !environment) throw new Error("vercel: pass a fetch that sends credentials: outside Node there's no environment to find them in");
 	const doFetch = options.fetch ?? environment.fetch();
+	const filesFetch = options.files ?? fetch;
 	let binding = null;
 	/** This board's own code's names, which a caller here never takes as its profile. */
 	const own = /* @__PURE__ */ new Set();
@@ -318,7 +328,7 @@ function createVercel(options, environment) {
 			editedAt: message.editedAt === void 0 ? null : iso(message.editedAt),
 			deleted: message.deletedAt !== void 0,
 			undelivered: {},
-			attachments: [],
+			attachments: message.attachments ?? [],
 			links: [],
 			version: message.version,
 			author: await nameOf(who, message.createdBy)
@@ -560,7 +570,7 @@ function createVercel(options, environment) {
 					by,
 					origin: null,
 					from: null,
-					attachments: [],
+					attachments: message.attachments,
 					links: []
 				};
 				break;
@@ -1144,12 +1154,58 @@ function createVercel(options, environment) {
 				})
 			};
 		},
+		async upload(caller, { data, name, type }) {
+			checkCaller("upload", caller);
+			if (data.byteLength === 0) throw new HttpError(400, "bad_request", "the file is empty");
+			if (data.byteLength > 26214400) throw new HttpError(413, "too_large", `attachments are at most ${IMPORT_BYTES_MAX / 1024 / 1024} MB`);
+			const who = whoOf(caller);
+			const bytes = new Uint8Array(data);
+			const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes));
+			const started = await api(who, "POST", await onBoard(who, "/attachments"), { body: {
+				operationId: operationId(),
+				name: fileName(name),
+				type: mediaType(type),
+				size: data.byteLength,
+				sha256: btoa(String.fromCharCode(...digest))
+			} });
+			const put = await filesFetch(started.upload.url, {
+				method: started.upload.method,
+				headers: started.upload.headers,
+				body: bytes,
+				redirect: "error"
+			});
+			if (!put.ok) throw new HttpError(502, "upload_failed", `the upload to Vercel's storage answered ${put.status}`);
+			const { attachment } = await api(who, "POST", await onBoard(who, `/attachments/${encodeURIComponent(started.attachment.id)}/complete`));
+			return { attachment: fileOf(attachment) };
+		},
+		async attachment(caller, { id }, signal) {
+			const who = whoOf(caller);
+			const access = accessOf(caller);
+			const found = await api(who, "GET", await onBoard(who, `/attachments/${encodeURIComponent(id)}`), signal ? { signal } : {});
+			if (access) {
+				if (!found.attachment.messageId) throw notFound(`no attachment: ${id}`, "attachment_not_found");
+				const { message } = await readableMessage(who, access, found.attachment.messageId, signal).catch((error) => {
+					if (error instanceof HttpError && error.status === 404) throw notFound(`no attachment: ${id}`, "attachment_not_found");
+					throw error;
+				});
+				if (message.deletedAt !== void 0) throw notFound(`no attachment: ${id}`, "attachment_not_found");
+			}
+			const response = await filesFetch(found.url, {
+				redirect: "error",
+				...signal ? { signal } : {}
+			});
+			if (!response.ok || !response.body) throw new HttpError(502, "download_failed", `Vercel's storage answered ${response.status}`);
+			return {
+				attachment: fileOf(found.attachment),
+				data: response.body
+			};
+		},
 		async post(caller, input, signal) {
 			checkCaller("post", caller);
-			if (input.attachments?.length) throw new HttpError(501, "no_files", "Vercel's boards keep no files yet");
 			if (input.sync?.length) throw notSupported("sync");
 			const who = whoOf(caller);
 			const access = accessOf(caller);
+			if (access && input.attachments?.length) throw forbidden("this board's callers act as its project on Vercel's board, which can't tell them apart: only the project's own code posts files there");
 			const labeled = Object.keys(input.labels ?? {}).length > 0;
 			const clientId = input.id !== void 0 ? await postId(caller, input.id) : void 0;
 			let made;
@@ -1163,7 +1219,8 @@ function createVercel(options, environment) {
 						channelId: channel.id,
 						text: input.text,
 						...input.labels && Object.keys(input.labels).length ? { labels: input.labels } : {},
-						...clientId ? { clientId } : {}
+						...clientId ? { clientId } : {},
+						...input.attachments?.length ? { attachments: input.attachments } : {}
 					},
 					signal
 				});
@@ -1176,7 +1233,8 @@ function createVercel(options, environment) {
 						operationId: operationId(),
 						text: input.text,
 						...to.sequence > 1 ? { replyTo: to.sequence } : {},
-						...clientId ? { clientId } : {}
+						...clientId ? { clientId } : {},
+						...input.attachments?.length ? { attachments: input.attachments } : {}
 					},
 					signal
 				});

package/dist/{backend-vercel-DTrDiSk5.mjs → backend-vercel-DQc_TaHp.mjs}

@@ -1,6 +1,6 @@
 import { t as HttpError } from "./errors-CusN4x2l.mjs";
 import { c as loginHanded, d as vercelProjectFile, i as environmentProfile, t as asYou, u as vercelLogin } from "./node-Zd_C-gxP.mjs";
-import { t as createVercel } from "./backend-vercel-D87pIp2k.mjs";
+import { t as createVercel } from "./backend-vercel-BNauAs7w.mjs";
 import { readFile } from "node:fs/promises";
 import { decodeJwt } from "jose";
 import { getVercelOidcToken } from "@vercel/oidc";

package/dist/backend-vercel.d.mts

@@ -1,4 +1,4 @@
-import { n as VercelOptions, t as VercelBackend } from "./backend-vercel-CIRObA0t.mjs";
+import { n as VercelOptions, t as VercelBackend } from "./backend-vercel-4tvcPKqX.mjs";
 //#region src/backend-vercel/index.default.d.ts
 /**
  * Your team's board, in Vercel's API. Outside Node there's no environment to find credentials or

package/dist/backend-vercel.mjs

@@ -1,4 +1,4 @@
-import { t as createVercel } from "./backend-vercel-D87pIp2k.mjs";
+import { t as createVercel } from "./backend-vercel-BNauAs7w.mjs";
 //#region src/backend-vercel/index.default.ts
 /**
 * Your team's board, in Vercel's API. Outside Node there's no environment to find credentials or

package/dist/backend-vercel.node.d.mts

@@ -1,4 +1,4 @@
-import { n as VercelOptions, t as VercelBackend } from "./backend-vercel-CIRObA0t.mjs";
+import { n as VercelOptions, t as VercelBackend } from "./backend-vercel-4tvcPKqX.mjs";
 //#region src/backend-vercel/index.d.ts
 /** Where `token` comes from, in words: what `vb whoami` says. */
 export declare function credentialSource(): string;

package/dist/backend-vercel.node.mjs

@@ -1,2 +1,2 @@
-import { n as handTeam, r as vercel, t as credentialSource } from "./backend-vercel-DTrDiSk5.mjs";
+import { n as handTeam, r as vercel, t as credentialSource } from "./backend-vercel-DQc_TaHp.mjs";
 export { credentialSource, handTeam, vercel };

package/dist/blob-DdbpJqN1.mjs

@@ -0,0 +1,182 @@
+import { n as DIRECT_UPLOAD_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import { i as Attachment } from "./schemas-DBmUO6pr.mjs";
+import { r as badRequest, s as notFound, t as HttpError } from "./errors-CusN4x2l.mjs";
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+//#region src/server/blob.ts
+/** Files in memory, for tests: forgets everything when the process ends. */
+function memoryBlob() {
+	const files = /* @__PURE__ */ new Map();
+	return {
+		put: async (key, data, contentType) => void files.set(key, {
+			data: data.slice(),
+			contentType
+		}),
+		get: async (key) => files.get(key) ?? null
+	};
+}
+/** Files on disk, for development and `vb serve`: under `dir`, `.a2/attachments` by default. */
+function fsBlob(dir = ".a2/attachments") {
+	const path = (key) => join(dir, ...key.split("/"));
+	return {
+		async put(key, data, contentType) {
+			await mkdir(dirname(path(key)), { recursive: true });
+			await writeFile(path(key), data);
+			await writeFile(`${path(key)}.type`, contentType);
+		},
+		async get(key) {
+			try {
+				const [data, contentType] = await Promise.all([readFile(path(key)), readFile(`${path(key)}.type`, "utf8")]);
+				return {
+					data: new Uint8Array(data),
+					contentType
+				};
+			} catch {
+				return null;
+			}
+		}
+	};
+}
+const dataKey = (id) => `board/attachments/${id}`;
+/** A direct upload the board signed, until it's finished: what it's called, and who may finish it. */
+const ticketKey = (id) => `board/uploads/${id}.json`;
+const metaKey = (id) => `board/attachments/${id}.json`;
+/** `shot.png`, as the board stores a name: no paths, no control characters. */
+function fileName(name) {
+	return (name ?? "").split(/[\\/]/).pop().replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, 255) || "file";
+}
+/** `image/png`, or `application/octet-stream` when the type isn't one. */
+function mediaType(type) {
+	const value = (type ?? "").split(";")[0].trim().toLowerCase();
+	return /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/.test(value) && value.length <= 255 ? value : "application/octet-stream";
+}
+/** A board without a blob store keeps no files: every file route says so. */
+const noBlob = () => new HttpError(501, "no_files", "this board keeps no files: pass `blob` to `a2()`");
+/** 128 random bits, base64url, drawn again when they'd start with `-`, which a command line reads as a flag. */
+function attachmentId() {
+	for (;;) {
+		const id = randomBytes(16).toString("base64url");
+		if (!id.startsWith("-")) return id;
+	}
+}
+/**
+* Stores an upload under a fresh ID, with its metadata beside it. `uploadedBy`
+* is the principal that sent it, who can read it before any message carries it.
+* `max` is the most it can be: `ATTACHMENT_BYTES_MAX` unless the board's own sync imports it.
+*/
+async function writeUpload(blob, input, max = ATTACHMENT_BYTES_MAX) {
+	if (!blob) throw noBlob();
+	if (input.data.byteLength === 0) throw badRequest("the file is empty");
+	if (input.data.byteLength > max) throw new HttpError(413, "too_large", `attachments are at most ${max / 1024 / 1024} MB`);
+	const attachment = {
+		id: attachmentId(),
+		name: fileName(input.name),
+		type: mediaType(input.type),
+		size: input.data.byteLength
+	};
+	await blob.put(dataKey(attachment.id), input.data, attachment.type);
+	const meta = input.uploadedBy === void 0 ? attachment : {
+		...attachment,
+		uploadedBy: input.uploadedBy
+	};
+	await blob.put(metaKey(attachment.id), new TextEncoder().encode(JSON.stringify(meta)), "application/json");
+	return attachment;
+}
+async function bytes(data) {
+	return data instanceof Uint8Array ? data : new Uint8Array(await new Response(data).arrayBuffer());
+}
+const attachmentNotFound = (id) => notFound(`no attachment: ${id}`, "attachment_not_found");
+/**
+* An upload's metadata, as the board recorded it, never what a request says,
+* and who uploaded it: null for files the board imported itself, or stored
+* before it recorded that.
+*/
+async function readUpload(blob, id) {
+	if (!blob) throw noBlob();
+	const found = Attachment.shape.id.safeParse(id).success ? await blob.get(metaKey(id)) : null;
+	if (!found) throw attachmentNotFound(id);
+	const meta = JSON.parse(new TextDecoder().decode(await bytes(found.data)));
+	return {
+		attachment: Attachment.parse(meta),
+		uploadedBy: typeof meta.uploadedBy === "string" ? meta.uploadedBy : null
+	};
+}
+/** An attachment's bytes as the store keeps them, a stream or the bytes, for board() to serve. */
+async function attachmentBody(blob, id) {
+	if (!blob) throw noBlob();
+	const found = await blob.get(dataKey(id));
+	if (!found) throw attachmentNotFound(id);
+	return found.data;
+}
+/** How long a direct upload's URL takes bytes: long enough for 100 MB on a slow link. */
+const DIRECT_UPLOAD_TTL_MS = 18e5;
+const noDirectUploads = () => new HttpError(501, "no_direct_uploads", `this board's blob store can't take direct uploads, so files are at most ${ATTACHMENT_BYTES_MAX / 1024 / 1024} MB`);
+/**
+* Starts a direct upload: a fresh ID, and a URL in the store to `PUT` its bytes to. The board
+* keeps what the request said the file is until `finishUpload` checks the store has it.
+*/
+async function startUpload(blob, input) {
+	if (!blob) throw noBlob();
+	if (!blob.uploadUrl || !blob.head) throw noDirectUploads();
+	if (input.size > 104857600) throw new HttpError(413, "too_large", `direct uploads are at most ${DIRECT_UPLOAD_BYTES_MAX / 1024 / 1024} MB`);
+	const expires = new Date(Date.now() + DIRECT_UPLOAD_TTL_MS);
+	const ticket = {
+		id: attachmentId(),
+		name: fileName(input.name),
+		type: mediaType(input.type),
+		size: input.size,
+		uploadedBy: input.uploadedBy,
+		expiresAt: expires.toISOString()
+	};
+	await blob.put(ticketKey(ticket.id), new TextEncoder().encode(JSON.stringify(ticket)), "application/json");
+	const { url, headers } = await blob.uploadUrl(dataKey(ticket.id), {
+		contentType: ticket.type,
+		maxBytes: ticket.size,
+		expiresAt: expires
+	});
+	return {
+		id: ticket.id,
+		url,
+		headers: {
+			...headers,
+			"content-type": ticket.type
+		},
+		expiresAt: ticket.expiresAt
+	};
+}
+/**
+* Finishes a direct upload: once the store has exactly the bytes its start said, the board records
+* the attachment, as `writeUpload` does. Only its uploader may finish it; a second finish answers
+* the same attachment. It never reads the record before writing it: a store with a cache (Vercel
+* Blob's CDN) would keep that miss, and the post that names the file would find nothing.
+*/
+async function finishUpload(blob, id, principal) {
+	if (!blob) throw noBlob();
+	const found = Attachment.shape.id.safeParse(id).success ? await blob.get(ticketKey(id)) : null;
+	const ticket = found ? JSON.parse(new TextDecoder().decode(await bytes(found.data))) : null;
+	if (!ticket || ticket.uploadedBy !== principal) throw notFound(`no upload: ${id}`, "upload_not_found");
+	if (!blob.head) throw noDirectUploads();
+	const stored = await blob.head(dataKey(id));
+	if (!stored) throw new HttpError(409, "not_uploaded", `nothing's been uploaded for ${id} yet: PUT the file to its URL first`);
+	if (stored.size !== ticket.size) throw badRequest(`the store has ${stored.size} bytes for ${id}, but its upload said ${ticket.size}`, "size_mismatch");
+	const attachment = {
+		id,
+		name: ticket.name,
+		type: ticket.type,
+		size: stored.size
+	};
+	try {
+		await blob.put(metaKey(id), new TextEncoder().encode(JSON.stringify({
+			...attachment,
+			uploadedBy: principal
+		})), "application/json");
+	} catch (error) {
+		const done = await blob.get(metaKey(id)).catch(() => null);
+		if (!done) throw error;
+		return Attachment.parse(JSON.parse(new TextDecoder().decode(await bytes(done.data))));
+	}
+	return attachment;
+}
+//#endregion
+export { fsBlob as a, readUpload as c, finishUpload as i, startUpload as l, attachmentNotFound as n, mediaType as o, fileName as r, memoryBlob as s, attachmentBody as t, writeUpload as u };

package/dist/{blob-B-9AvYis.d.mts → blob-DmiQjrYy.d.mts}

@@ -1,5 +1,5 @@
-import "./folds-jS9wlh9_.mjs";
-import "./errors-CB4tnZGz.mjs";
+import "./folds-ZkHM4M-v.mjs";
+import "./errors-DDktVeUa.mjs";
 //#region src/server/blob.d.ts
 /**
  * Where attachments' bytes live. The board writes each file once, under a key

package/dist/{chat-provider-DsNEBQiA.d.mts → chat-provider-BWHbChcQ.d.mts}

@@ -1,6 +1,6 @@
-import { d as ExternalFile, f as ExternalLink, l as ExternalAuthor, t as Actor } from "./folds-jS9wlh9_.mjs";
-import { dt as SourceJoin, mt as SourceRead } from "./client-xLxeDz0f.mjs";
-import { M as SyncRoot, O as ProviderEvent, a as ProviderOptions, c as ReceivedEvent, d as ResolvedTarget, i as ProviderFile, n as FileDelivery, o as ProviderPost, p as SyncProvider, r as ProviderDelivery, s as Receive, t as FetchedLink, y as SyncFn } from "./provider-Cdg1qadh.mjs";
+import { d as ExternalFile, f as ExternalLink, l as ExternalAuthor, t as Actor } from "./folds-ZkHM4M-v.mjs";
+import { dt as SourceJoin, mt as SourceRead } from "./client-BqAjk0Q4.mjs";
+import { M as SyncRoot, O as ProviderEvent, a as ProviderOptions, c as ReceivedEvent, d as ResolvedTarget, i as ProviderFile, n as FileDelivery, o as ProviderPost, p as SyncProvider, r as ProviderDelivery, s as Receive, t as FetchedLink, y as SyncFn } from "./provider-DmSTp9lI.mjs";
 import { Adapter, Author, FileUpload, Message, ReactionEvent } from "chat";
 //#region src/sync/types.d.ts
 declare function externalAuthor(platform: string, author: Author): ExternalAuthor;
@@ -45,6 +45,7 @@ type ChatTransport = Omit<ProviderOptions, 'uploadsFiles'> & {
   /** A channel or thread, read on demand without syncing it. */
   read?(target: string, options: {
     limit: number;
+    after: string | null;
   }): Promise<SourceRead>;
   /** Adds the app to a channel so `read` can read it. */
   join?(target: string): Promise<SourceJoin>;
@@ -126,6 +127,7 @@ declare abstract class ChatSyncProvider<E extends ProviderEvent = ProviderEvent>
   url(thread: string, message: string): Promise<string | null>;
   read(target: string, options: {
     limit: number;
+    after: string | null;
   }): Promise<SourceRead>;
   join(target: string): Promise<SourceJoin>;
   fetchFile(file: ExternalFile): Promise<Uint8Array | null>;

package/dist/{chat-provider-DnHibqnM.mjs → chat-provider-COtsU5jB.mjs}

@@ -1,5 +1,5 @@
-import "./external-BV_cUncs.mjs";
-import { n as ResolvedTarget, r as SyncProvider } from "./provider-poIkXapd.mjs";
+import "./external-D3p5T57R.mjs";
+import { n as ResolvedTarget, r as SyncProvider } from "./provider-BaVmi4Hi.mjs";
 import { n as userTokensOf } from "./users-yryHKFMo.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { Chat, stringifyMarkdown } from "chat";

package/dist/cli-commands.mjs

@@ -1,2 +1,2 @@
-import { a as option, i as groups, n as filters, o as options, r as globalOptions, s as usage, t as commands } from "./commands-BFookFtn.mjs";
+import { a as option, i as groups, n as filters, o as options, r as globalOptions, s as usage, t as commands } from "./commands-C3R1AWgm.mjs";
 export { commands, filters, globalOptions, groups, option, options, usage };

package/dist/cli-embedded.d.mts

@@ -1,5 +1,5 @@
-import { d as Board } from "./backend-ZKYTe3xa.mjs";
-import "./index-C05it0mC.mjs";
+import { d as Board } from "./backend-CPC_vyOo.mjs";
+import "./index-D3VvNfh_.mjs";
 //#region src/cli/failure.d.ts
 /**
  * What kind of failure it is, which fixes the exit code: 2 for `usage` and `missing_input`, 130

package/dist/cli-embedded.mjs

@@ -1,4 +1,4 @@
-import { a as commandLine, c as failureLines, i as mainWith, l as formatFailure, n as commandWord, o as exitCode, r as main, s as failureDocument, t as Failed } from "./main-eci7w-aP.mjs";
+import { a as commandLine, c as failureLines, i as mainWith, l as formatFailure, n as commandWord, o as exitCode, r as main, s as failureDocument, t as Failed } from "./main-CVBqe3VO.mjs";
 //#region src/cli/embedded.ts
 /**
 * Board's CLI as `appName` names it in help, usage, and errors (`vercel board`). With no board

package/dist/cli.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import { t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
-import "./schemas-Be08nyfW.mjs";
-import { a as option } from "./commands-BFookFtn.mjs";
+import "./schemas-DBmUO6pr.mjs";
+import { a as option } from "./commands-C3R1AWgm.mjs";
 import { l as projectDir } from "./node-Zd_C-gxP.mjs";
-import { r as main, u as who } from "./main-eci7w-aP.mjs";
+import { r as main, u as who } from "./main-CVBqe3VO.mjs";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { appendFile, readFile } from "node:fs/promises";
 import { join } from "node:path";
@@ -661,7 +661,7 @@ const local = {
 			if (args.length > 0) throw usage("serve takes no arguments: pass its port with --port, and its directory with --dir.");
 			const port = portFlag();
 			const root = projectDir();
-			const { localHandle, serveLocal } = await import("./serve-B09an9DQ.mjs");
+			const { localHandle, serveLocal } = await import("./serve-G9RuaDSr.mjs");
 			const handle = flags.handle ?? process.env.BOARD_HANDLE;
 			const local = await serveLocal({
 				dir: flags.dir ?? join(root, ".board"),

package/dist/{client-xLxeDz0f.d.mts → client-BqAjk0Q4.d.mts}

@@ -1,5 +1,5 @@
 import { n as AccessSummary } from "./access-CV96SYgr.mjs";
-import { a as ExternalCopy, g as BoardEvent, o as Message, p as Link, r as Channel, t as Actor, u as ExternalEvent, x as Attachment } from "./folds-jS9wlh9_.mjs";
+import { a as ExternalCopy, g as BoardEvent, o as Message, p as Link, r as Channel, t as Actor, u as ExternalEvent, x as Attachment } from "./folds-ZkHM4M-v.mjs";
 import { z } from "zod";
 //#region src/api/routes.d.ts
 /**
@@ -171,6 +171,7 @@ declare const AckBody: z.ZodObject<{
 declare const SourceReadQuery: z.ZodObject<{
   target: z.ZodString;
   limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+  after: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 /** A channel to add the board's app to, so it can be read on demand: `#name`, an ID, or a link into it. */
 declare const SourceJoinBody: z.ZodObject<{
@@ -495,6 +496,7 @@ declare const InboxPushBody: z.ZodObject<{
       type: z.ZodString;
       title: z.ZodString;
       url: z.ZodNullable<z.ZodString>;
+      body: z.ZodOptional<z.ZodNullable<z.ZodString>>;
       labels: z.ZodRecord<z.ZodString, z.ZodString>;
       unset: z.ZodArray<z.ZodString>;
       owns: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -911,6 +913,8 @@ type SourceRead = {
   messages: SourceMessage[];
   /** The platform has more than `limit`: older messages in a channel, later replies in a thread. */
   more: boolean;
+  /** Where to pick up, as `after`, when the platform can page past `limit`. */
+  next?: string | null;
 };
 /** A channel the board's app joined, or was already in (`joined: false`). */
 type SourceJoin = {
@@ -1226,6 +1230,7 @@ declare const routes: {
           type: z.ZodString;
           title: z.ZodString;
           url: z.ZodNullable<z.ZodString>;
+          body: z.ZodOptional<z.ZodNullable<z.ZodString>>;
           labels: z.ZodRecord<z.ZodString, z.ZodString>;
           unset: z.ZodArray<z.ZodString>;
           owns: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1535,6 +1540,7 @@ declare const routes: {
     readonly query: z.ZodObject<{
       target: z.ZodString;
       limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+      after: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
   };
   /** Adds the app to a public channel so it can be read, where that sync runs and opted in with `join`. Full access only. */
@@ -1930,6 +1936,7 @@ declare function createBoardClient(options: ClientOptions): {
    */
   readSource: (key: string, target: string, opts?: {
     limit?: number;
+    after?: string;
   }) => Promise<SourceRead>;
   /** Adds the app to a public channel so `readSource` can read it, where the sync opted in with `join`. Full access only. */
   joinSource: (key: string, target: string) => Promise<SourceJoin>;

package/dist/{commands-BFookFtn.mjs → commands-C3R1AWgm.mjs}

@@ -590,10 +590,13 @@ const commands = [
 				required: true,
 				description: "a channel ('#general'), a thread, or a message link"
 			}],
-			options: [option("limit", "messages to read")],
+			options: [option("limit", "messages to read"), option("after", "where the last read left off: the cursor it printed")],
 			examples: [{
 				name: "read a Slack channel",
 				value: "sources slack read '#general'"
+			}, {
+				name: "read a Linear project's issues",
+				value: "sources linear read https://linear.app/acme/project/checkout-a1b2c3"
 			}]
 		}, {
 			name: "join",

package/dist/conformance.d.mts

@@ -1,4 +1,4 @@
-import { d as Board } from "./backend-ZKYTe3xa.mjs";
+import { d as Board } from "./backend-CPC_vyOo.mjs";
 //#region src/conformance/index.d.ts
 /**
  * Checks that a board speaks the protocol, through a handle on it (`conformance(board())`), as

package/dist/{engine-Bfe6pcXb.mjs → engine-DQxXk7dX.mjs}

@@ -1,14 +1,14 @@
 import { a as typeOf, i as fileSize, r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
-import { C as toStorable, c as ChannelPath, m as MESSAGE_TEXT_MAX } from "./schemas-Be08nyfW.mjs";
-import { c as externalMessageKey, l as isThreadTarget, s as channelOf } from "./external-BV_cUncs.mjs";
+import { C as toStorable, c as ChannelPath, m as MESSAGE_TEXT_MAX } from "./schemas-DBmUO6pr.mjs";
+import { c as externalMessageKey, l as isThreadTarget, s as channelOf } from "./external-D3p5T57R.mjs";
 import { t as canonicalEmoji } from "./emoji-CTLpvH-A.mjs";
 import { r as derivedId, t as waitUntil } from "./wait-until-Dw4XrIDQ.mjs";
 import { r as badRequest, s as notFound, t as HttpError } from "./errors-CusN4x2l.mjs";
 import { n as replaceMentions } from "./mentions-CB6ShY4R.mjs";
-import { t as DroppedError } from "./middleware-ChKM1zuu.mjs";
+import { t as DroppedError } from "./middleware-CXjEeef4.mjs";
 import { t as afterRetry } from "./attempts-HXcskN1w.mjs";
-import { a as channelMissing, i as UnreadableError, n as ResolvedTarget, o as routesFor, t as ReceivedEvent } from "./provider-poIkXapd.mjs";
-import { a as immutable, n as SyncOverrides } from "./events-CewD4kw7.mjs";
+import { a as channelMissing, i as UnreadableError, n as ResolvedTarget, o as routesFor, t as ReceivedEvent } from "./provider-BaVmi4Hi.mjs";
+import { a as immutable, n as SyncOverrides } from "./events-qf5XG5VQ.mjs";
 import { t as displayText } from "./bots-CGkO76qH.mjs";
 //#region src/sync/engine.ts
 /** `files`: a message with files may have no text. */
@@ -872,7 +872,7 @@ function createSyncEngine(entries) {
 					const root = await messageOf(rootId);
 					const createdHere = root?.origin?.message === `lifecycle:${meta.id}`;
 					const desired = labels((createdHere ? rootDraft({
-						text: event.url ? `${event.title}\n${event.url}` : event.title,
+						text: lifecycleText(event),
 						labels: event.labels,
 						author: event.author,
 						raw
@@ -883,7 +883,7 @@ function createSyncEngine(entries) {
 					if (root && !root.deleted && (Object.keys(set).length || unset.length)) await setLabels(event.author, set, unset);
 					if (event.retitled && root && !root.deleted && root.from === key && root.origin?.thread === event.thread) {
 						const text = clampText(overrides.text ?? rootDraft({
-							text: event.url ? `${event.title}\n${event.url}` : event.title,
+							text: lifecycleText(event),
 							labels: root.labels,
 							author: event.author,
 							raw
@@ -916,7 +916,7 @@ function createSyncEngine(entries) {
 					message: null
 				};
 				const draft = rootDraft({
-					text: event.url ? `${event.title}\n${event.url}` : event.title,
+					text: lifecycleText(event),
 					labels: event.labels,
 					author: event.author,
 					raw
@@ -1289,14 +1289,14 @@ function createSyncEngine(entries) {
 						postedAsPerson = true;
 						return asPerson;
 					}
-					return platform.post(native(target), "channel", body);
+					if (root.attachments.length === 0 || !platform.startsThreadsWithFiles) return platform.post(native(target), "channel", body);
 				}
 				try {
 					const sent = await platform.post(native(target), "channel", {
 						...body,
 						files: await messageFiles(root)
 					});
-					uploaded = sent.files ?? [];
+					uploaded = mediaOnly ? sent.files ?? [] : sent.files;
 					return sent;
 				} catch (error) {
 					if (!platform.refusesFiles(error) && !keepsNoFiles(error)) throw error;
@@ -1500,10 +1500,13 @@ function createSyncEngine(entries) {
 		return 403;
 	};
 	/** A platform channel or thread, read for the caller: nothing is synced, stored, or joined. */
-	async function readSource(key, target, limit) {
+	async function readSource(key, target, limit, after) {
 		const platform = platformOf(key);
 		try {
-			return await platform.read(target, { limit });
+			return await platform.read(target, {
+				limit,
+				after
+			});
 		} catch (error) {
 			if (error instanceof UnreadableError) throw new HttpError(unreadableStatus(error.code), error.code, error.message);
 			throw badRequest(`can't read ${target} from ${key}: ${describe(error)}`, "platform_error");
@@ -1542,5 +1545,10 @@ function createSyncEngine(entries) {
 		joinSource
 	};
 }
+/** A lifecycle root's text: the title, its link, and what the PR or issue says. */
+function lifecycleText(event) {
+	const head = event.url ? `${event.title}\n${event.url}` : event.title;
+	return event.body ? `${head}\n\n${event.body}` : head;
+}
 //#endregion
 export { createSyncEngine };

package/dist/{errors-CB4tnZGz.d.mts → errors-DDktVeUa.d.mts}

@@ -1,4 +1,4 @@
-import { r as ErrorOrigin } from "./client-xLxeDz0f.mjs";
+import { r as ErrorOrigin } from "./client-BqAjk0Q4.mjs";
 //#region src/server/errors.d.ts
 declare class HttpError extends Error {
   readonly status: number;

package/dist/{events-CewD4kw7.mjs → events-qf5XG5VQ.mjs}

@@ -1,5 +1,5 @@
-import { d as LabelKey, p as Labels } from "./schemas-Be08nyfW.mjs";
-import { n as ExternalEvent, r as ExternalLocation } from "./external-BV_cUncs.mjs";
+import { d as LabelKey, p as Labels } from "./schemas-DBmUO6pr.mjs";
+import { n as ExternalEvent, r as ExternalLocation } from "./external-D3p5T57R.mjs";
 import { z } from "zod";
 //#region src/sync/events.ts
 const EventBase = z.object({