@vercel/board 0.28.0 → 0.30.0

package/dist/{a2-B0_VlbtC.mjs → a2-D_28Pdip.mjs}

@@ -1,32 +1,31 @@
-import { n as DIRECT_UPLOAD_BYTES_MAX, r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
-import { _ as RemoteWatcherId, b as actorKind, i as Attachment, x as platformAvatar } from "./schemas-Be08nyfW.mjs";
-import "./external-BV_cUncs.mjs";
-import { a as METHODS, d as VERSION, f as SYNC, n as compileWatcher, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-7DJU9b-n.mjs";
-import { r as duration, t as BoardError } from "./client-D0Px7KzF.mjs";
+import { r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
+import { _ as RemoteWatcherId, b as actorKind, x as platformAvatar } from "./schemas-DBmUO6pr.mjs";
+import "./external-D3p5T57R.mjs";
+import { a as METHODS, d as VERSION, f as SYNC, n as compileWatcher, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-B_5b0-ZG.mjs";
+import { a as forbidden, c as toErrorResponse, f as duration, i as duplicateId, r as badRequest, s as notFound, t as HttpError, u as BoardError } from "./errors-C_5rB8Iz.mjs";
 import { i as isKeyIdOf, r as derivedId, t as waitUntil } from "./wait-until-Dw4XrIDQ.mjs";
-import { a as forbidden, c as toErrorResponse, i as duplicateId, r as badRequest, s as notFound, t as HttpError } from "./errors-CusN4x2l.mjs";
 import { t as own } from "./own-OwgPWdmh.mjs";
 import { n as replaceMentions } from "./mentions-CB6ShY4R.mjs";
-import { _ as FULL_ACCESS, i as authenticates, v as authorize } from "./auth-lTkOgvcE.mjs";
-import { a as resolveMentions, n as actorSeen } from "./actors-BLXVp4oZ.mjs";
-import { n as MIDDLEWARE_ACTOR, t as DroppedError } from "./middleware-ChKM1zuu.mjs";
-import { n as syncTarget, r as withEmailMentions } from "./targets-C-wdR5wP.mjs";
-import { t as A2Error } from "./session-clear-wHd5GCpZ-BnKSxReK.mjs";
-import { a as reducer } from "./reducer-CjmvZSAb-D_OSISmj.mjs";
-import { _ as BOARD_SESSION, a as IDENTITY_SESSION, c as SCHEDULES_SESSION, d as inboxContract, f as inboxSession, g as watchSession, h as watchContract, l as boardContract, m as schedulesContract, n as channelsReducer, o as INBOXES_SESSION, p as registryContract, r as identityCodesReducer, s as REGISTRY_SESSION, t as actorsReducer, u as identityContract } from "./reducers-BcmSs4qf.mjs";
-import { n as createServer, t as consumer } from "./server-DtFrWxi3-Boa6gdWO.mjs";
-import { a as linkedTo, i as iso, n as foldMessages, o as personOf, t as foldActors } from "./folds-Dyjput8M.mjs";
-import { t as concernedMessageId } from "./project-DMDST9kl.mjs";
-import { t as TABLES_CONSUMER } from "./sql-U9WTxrwJ.mjs";
+import { n as authorize, t as FULL_ACCESS } from "./access-CQ39gqEV.mjs";
+import { a as resolveMentions, n as actorSeen } from "./actors-xPiamLWk.mjs";
+import { i as authenticates } from "./auth-BPinwfN0.mjs";
+import { n as MIDDLEWARE_ACTOR, t as DroppedError } from "./middleware-DlJQYiwV.mjs";
+import { n as syncTarget, r as withEmailMentions } from "./targets-Cgjs29T0.mjs";
+import { t as A2Error } from "./session-clear-XJYpmUpg-2q8l_FJR.mjs";
+import { a as reducer } from "./reducer-Bswr11ar-P324o9vn.mjs";
+import { _ as BOARD_SESSION, a as IDENTITY_SESSION, c as SCHEDULES_SESSION, d as inboxContract, f as inboxSession, g as watchSession, h as watchContract, l as boardContract, m as schedulesContract, n as channelsReducer, o as INBOXES_SESSION, p as registryContract, r as identityCodesReducer, s as REGISTRY_SESSION, t as actorsReducer, u as identityContract } from "./reducers-8jqLewgw.mjs";
+import { n as createServer, t as consumer } from "./server-DX7mM6nm-D7N_7bug.mjs";
+import { a as linkedTo, i as iso, n as foldMessages, o as personOf, t as foldActors } from "./folds-DGYkMW19.mjs";
+import { c as readUpload, i as finishUpload, l as startUpload, n as attachmentNotFound, t as attachmentBody, u as writeUpload } from "./blob-DQK5prXT.mjs";
+import { t as concernedMessageId } from "./project-C_2xs57L.mjs";
+import { t as TABLES_CONSUMER } from "./sql-Bj0fk6dn.mjs";
 import { t as afterRetry } from "./attempts-HXcskN1w.mjs";
 import { createHash, randomBytes } from "node:crypto";
-import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, join } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { lookup } from "node:dns";
 import { request } from "node:https";
 import { BlockList, isIP } from "node:net";
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/idempotent-id-BRJVeylj.js
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/idempotent-id-BRJVeylj.js
 async function idempotentId(...parts) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(parts)));
 	const bytes = new Uint8Array(digest).slice(0, 16);
@@ -36,181 +35,6 @@ async function idempotentId(...parts) {
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 //#endregion
-//#region src/server/blob.ts
-/** Files in memory, for tests: forgets everything when the process ends. */
-function memoryBlob() {
-	const files = /* @__PURE__ */ new Map();
-	return {
-		put: async (key, data, contentType) => void files.set(key, {
-			data: data.slice(),
-			contentType
-		}),
-		get: async (key) => files.get(key) ?? null
-	};
-}
-/** Files on disk, for development and `vb serve`: under `dir`, `.a2/attachments` by default. */
-function fsBlob(dir = ".a2/attachments") {
-	const path = (key) => join(dir, ...key.split("/"));
-	return {
-		async put(key, data, contentType) {
-			await mkdir(dirname(path(key)), { recursive: true });
-			await writeFile(path(key), data);
-			await writeFile(`${path(key)}.type`, contentType);
-		},
-		async get(key) {
-			try {
-				const [data, contentType] = await Promise.all([readFile(path(key)), readFile(`${path(key)}.type`, "utf8")]);
-				return {
-					data: new Uint8Array(data),
-					contentType
-				};
-			} catch {
-				return null;
-			}
-		}
-	};
-}
-const dataKey = (id) => `board/attachments/${id}`;
-/** A direct upload the board signed, until it's finished: what it's called, and who may finish it. */
-const ticketKey = (id) => `board/uploads/${id}.json`;
-const metaKey = (id) => `board/attachments/${id}.json`;
-/** `shot.png`, as the board stores a name: no paths, no control characters. */
-function fileName(name) {
-	return (name ?? "").split(/[\\/]/).pop().replace(/[\u0000-\u001f\u007f]/g, "").trim().slice(0, 255) || "file";
-}
-/** `image/png`, or `application/octet-stream` when the type isn't one. */
-function mediaType(type) {
-	const value = (type ?? "").split(";")[0].trim().toLowerCase();
-	return /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/.test(value) && value.length <= 255 ? value : "application/octet-stream";
-}
-/** A board without a blob store keeps no files: every file route says so. */
-const noBlob = () => new HttpError(501, "no_files", "this board keeps no files: pass `blob` to `a2()`");
-/** 128 random bits, base64url, drawn again when they'd start with `-`, which a command line reads as a flag. */
-function attachmentId() {
-	for (;;) {
-		const id = randomBytes(16).toString("base64url");
-		if (!id.startsWith("-")) return id;
-	}
-}
-/**
-* Stores an upload under a fresh ID, with its metadata beside it. `uploadedBy`
-* is the principal that sent it, who can read it before any message carries it.
-* `max` is the most it can be: `ATTACHMENT_BYTES_MAX` unless the board's own sync imports it.
-*/
-async function writeUpload(blob, input, max = ATTACHMENT_BYTES_MAX) {
-	if (!blob) throw noBlob();
-	if (input.data.byteLength === 0) throw badRequest("the file is empty");
-	if (input.data.byteLength > max) throw new HttpError(413, "too_large", `attachments are at most ${max / 1024 / 1024} MB`);
-	const attachment = {
-		id: attachmentId(),
-		name: fileName(input.name),
-		type: mediaType(input.type),
-		size: input.data.byteLength
-	};
-	await blob.put(dataKey(attachment.id), input.data, attachment.type);
-	const meta = input.uploadedBy === void 0 ? attachment : {
-		...attachment,
-		uploadedBy: input.uploadedBy
-	};
-	await blob.put(metaKey(attachment.id), new TextEncoder().encode(JSON.stringify(meta)), "application/json");
-	return attachment;
-}
-async function bytes(data) {
-	return data instanceof Uint8Array ? data : new Uint8Array(await new Response(data).arrayBuffer());
-}
-const attachmentNotFound = (id) => notFound(`no attachment: ${id}`, "attachment_not_found");
-/**
-* An upload's metadata, as the board recorded it, never what a request says,
-* and who uploaded it: null for files the board imported itself, or stored
-* before it recorded that.
-*/
-async function readUpload(blob, id) {
-	if (!blob) throw noBlob();
-	const found = Attachment.shape.id.safeParse(id).success ? await blob.get(metaKey(id)) : null;
-	if (!found) throw attachmentNotFound(id);
-	const meta = JSON.parse(new TextDecoder().decode(await bytes(found.data)));
-	return {
-		attachment: Attachment.parse(meta),
-		uploadedBy: typeof meta.uploadedBy === "string" ? meta.uploadedBy : null
-	};
-}
-/** An attachment's bytes as the store keeps them, a stream or the bytes, for board() to serve. */
-async function attachmentBody(blob, id) {
-	if (!blob) throw noBlob();
-	const found = await blob.get(dataKey(id));
-	if (!found) throw attachmentNotFound(id);
-	return found.data;
-}
-/** How long a direct upload's URL takes bytes: long enough for 100 MB on a slow link. */
-const DIRECT_UPLOAD_TTL_MS = 18e5;
-const noDirectUploads = () => new HttpError(501, "no_direct_uploads", `this board's blob store can't take direct uploads, so files are at most ${ATTACHMENT_BYTES_MAX / 1024 / 1024} MB`);
-/**
-* Starts a direct upload: a fresh ID, and a URL in the store to `PUT` its bytes to. The board
-* keeps what the request said the file is until `finishUpload` checks the store has it.
-*/
-async function startUpload(blob, input) {
-	if (!blob) throw noBlob();
-	if (!blob.uploadUrl || !blob.head) throw noDirectUploads();
-	if (input.size > 104857600) throw new HttpError(413, "too_large", `direct uploads are at most ${DIRECT_UPLOAD_BYTES_MAX / 1024 / 1024} MB`);
-	const expires = new Date(Date.now() + DIRECT_UPLOAD_TTL_MS);
-	const ticket = {
-		id: attachmentId(),
-		name: fileName(input.name),
-		type: mediaType(input.type),
-		size: input.size,
-		uploadedBy: input.uploadedBy,
-		expiresAt: expires.toISOString()
-	};
-	await blob.put(ticketKey(ticket.id), new TextEncoder().encode(JSON.stringify(ticket)), "application/json");
-	const { url, headers } = await blob.uploadUrl(dataKey(ticket.id), {
-		contentType: ticket.type,
-		maxBytes: ticket.size,
-		expiresAt: expires
-	});
-	return {
-		id: ticket.id,
-		url,
-		headers: {
-			...headers,
-			"content-type": ticket.type
-		},
-		expiresAt: ticket.expiresAt
-	};
-}
-/**
-* Finishes a direct upload: once the store has exactly the bytes its start said, the board records
-* the attachment, as `writeUpload` does. Only its uploader may finish it; a second finish answers
-* the same attachment. It never reads the record before writing it: a store with a cache (Vercel
-* Blob's CDN) would keep that miss, and the post that names the file would find nothing.
-*/
-async function finishUpload(blob, id, principal) {
-	if (!blob) throw noBlob();
-	const found = Attachment.shape.id.safeParse(id).success ? await blob.get(ticketKey(id)) : null;
-	const ticket = found ? JSON.parse(new TextDecoder().decode(await bytes(found.data))) : null;
-	if (!ticket || ticket.uploadedBy !== principal) throw notFound(`no upload: ${id}`, "upload_not_found");
-	if (!blob.head) throw noDirectUploads();
-	const stored = await blob.head(dataKey(id));
-	if (!stored) throw new HttpError(409, "not_uploaded", `nothing's been uploaded for ${id} yet: PUT the file to its URL first`);
-	if (stored.size !== ticket.size) throw badRequest(`the store has ${stored.size} bytes for ${id}, but its upload said ${ticket.size}`, "size_mismatch");
-	const attachment = {
-		id,
-		name: ticket.name,
-		type: ticket.type,
-		size: stored.size
-	};
-	try {
-		await blob.put(metaKey(id), new TextEncoder().encode(JSON.stringify({
-			...attachment,
-			uploadedBy: principal
-		})), "application/json");
-	} catch (error) {
-		const done = await blob.get(metaKey(id)).catch(() => null);
-		if (!done) throw error;
-		return Attachment.parse(JSON.parse(new TextDecoder().decode(await bytes(done.data))));
-	}
-	return attachment;
-}
-//#endregion
 //#region src/server/feed.ts
 /** Bookkeeping events, shown only with `all`: who's who, and delivery receipts. */
 const HIDDEN = /* @__PURE__ */ new Set([
@@ -301,11 +125,13 @@ function viewedBy(view, reader) {
 }
 /** A message's or a cursor's ID as clients see it. On this board it's the log index, in decimal. */
 const ref = (index) => String(index);
+/** A schedule's ID as clients see it: its index in session `schedules`, as `s12`, so it reads apart from message `12`. */
+const scheduleRef = (index) => `s${index}`;
 /** The log index a ref names on this board, or null for a string that names nothing here. */
 const indexOf = (value) => /^(0|[1-9]\d{0,15})$/.test(value) ? Number(value) : null;
 /** A message as `reader` sees it. Every view names its reader, so none shows a link's snapshot by default. */
 function view(message, actors, reader) {
-	const { blind, version, schedule, ...shown } = message;
+	const { blind, version, revision, schedule, ...shown } = message;
 	return {
 		...shown,
 		...blind ? { blind } : {},
@@ -313,8 +139,9 @@ function view(message, actors, reader) {
 		re: message.re === null ? null : ref(message.re),
 		replyTo: message.replyTo === null ? null : ref(message.replyTo),
 		version: version ?? message.id,
+		revision: revision ?? message.id,
 		...schedule ? { schedule: {
-			id: ref(schedule.id),
+			id: scheduleRef(schedule.id),
 			n: schedule.n
 		} } : {},
 		links: readableLinks(message.links, reader),
@@ -501,7 +328,7 @@ function payloadView(payload, links) {
 	]) if (typeof shown[key] === "number") shown[key] = ref(shown[key]);
 	const schedule = shown.schedule;
 	if (schedule) shown.schedule = {
-		id: ref(schedule.id),
+		id: scheduleRef(schedule.id),
 		n: schedule.n
 	};
 	if (links) shown.links = links;
@@ -926,19 +753,20 @@ async function writePost(ctx, input) {
 		if (input.sync?.length) throw badRequest("sync attaches whole threads: use `board sync <id> <target>`");
 	} else {
 		if (!channel) throw badRequest("a post needs a channel");
+		if (input.after !== void 0) throw badRequest("`after` is for replies", "invalid_after");
 		thread = id;
 	}
 	spend(input.proofs.post, "post", { channel });
 	if (hasLabels(input.labels)) spend(input.proofs.label, "label", { channel });
 	if (input.sync?.length) spend(input.proofs.sync, "sync", { channel });
-	if (input.id !== void 0) {
-		const landed = await ctx.reads.byEventId(input.id);
-		if (landed) {
-			if (landed.channel !== channel || landed.re !== re || landed.replyTo !== replyTo) throw duplicateId();
-			const shown = await landedFor(ctx, identity, landed);
-			if (!shown) throw duplicateId();
-			return shownTo(shown, identity.principal.access, sent);
-		}
+	const replayed = await replayOf(ctx, input, {
+		channel,
+		re,
+		replyTo
+	}, sent);
+	if (replayed) return replayed;
+	if (input.after !== void 0) {
+		if ((await ctx.reads.message(input.after))?.thread !== thread) throw badRequest(`after names no message in #${re}'s thread`, "invalid_after");
 	}
 	return commitPost(ctx, input, {
 		channel,
@@ -949,6 +777,16 @@ async function writePost(ctx, input) {
 		sent
 	});
 }
+/** The post a caller's own ID already landed, as its retry gets it back: null when there's none. */
+async function replayOf(ctx, input, place, sent) {
+	if (input.id === void 0) return null;
+	const landed = await ctx.reads.byEventId(input.id);
+	if (!landed) return null;
+	if (landed.channel !== place.channel || landed.re !== place.re || landed.replyTo !== place.replyTo) throw duplicateId();
+	const shown = await landedFor(ctx, input.identity, landed);
+	if (!shown) throw duplicateId();
+	return shownTo(shown, input.identity.principal.access, sent);
+}
 /**
 * A post that landed, as its author may have it back: only the same author's, and one in a
 * channel it can't read only if it posted without reading too. A caller that can't read gets back
@@ -1009,28 +847,45 @@ async function commitPost(ctx, input, placed) {
 			by: identity.author
 		}
 	})));
-	const rows = await ctx.session.append(...seen ? [seen] : [], ...named, {
-		type: "message.posted",
-		...id ? { id } : {},
-		payload: {
+	const events = [
+		...seen ? [seen] : [],
+		...named,
+		{
+			type: "message.posted",
+			...id ? { id } : {},
+			payload: {
+				channel,
+				text,
+				re,
+				replyTo,
+				thread,
+				labels: input.labels ?? {},
+				noSync: input.noSync ?? false,
+				mentions,
+				by: identity.author,
+				origin: input.origin ?? null,
+				from: input.from ?? null,
+				...input.attachments?.length ? { attachments: input.attachments } : {},
+				...input.links?.length ? { links: input.links } : {},
+				...input.schedule ? { schedule: input.schedule } : {},
+				...identity.principal.access.readable(channel) ? {} : { blind: true },
+				...input.importedBy !== void 0 ? { importedBy: input.importedBy } : {}
+			}
+		},
+		...synced
+	];
+	let rows;
+	try {
+		rows = input.after === void 0 || re === null ? await ctx.session.append(...events) : await appendWhile(ctx, nothingAfter(ctx, re, input.after), events);
+	} catch (error) {
+		const replayed = error instanceof HttpError && error.code === "newer_message" ? await replayOf(ctx, input, {
 			channel,
-			text,
 			re,
-			replyTo,
-			thread,
-			labels: input.labels ?? {},
-			noSync: input.noSync ?? false,
-			mentions,
-			by: identity.author,
-			origin: input.origin ?? null,
-			from: input.from ?? null,
-			...input.attachments?.length ? { attachments: input.attachments } : {},
-			...input.links?.length ? { links: input.links } : {},
-			...input.schedule ? { schedule: input.schedule } : {},
-			...identity.principal.access.readable(channel) ? {} : { blind: true },
-			...input.importedBy !== void 0 ? { importedBy: input.importedBy } : {}
-		}
-	}, ...synced);
+			replyTo
+		}, sent) : null;
+		if (replayed) return replayed;
+		throw error;
+	}
 	const posted = rows.find((row) => row.type === "message.posted");
 	await untilApplied(ctx, rows);
 	const message = foldMessages({
@@ -1099,6 +954,36 @@ async function untilApplied(ctx, rows) {
 }
 /** How long a write waits for the tables before it answers anyway. */
 const LANDED_WAIT_MS = 1e4;
+/**
+* Appends `events` only while the board, as `holds` reads it, still allows them: `holds` checks
+* the tables, throws what refuses the write, and returns the index its reads reflect. The append
+* holds only while that index is still the log's last, so anything that lands in between,
+* anywhere on the board, moves it, and it looks again from there.
+*/
+async function appendWhile(ctx, holds, events) {
+	for (let attempt = 1;; attempt++) {
+		await ctx.reads.ensure();
+		const position = await holds();
+		try {
+			return await appendIfLast(ctx.session, position, events);
+		} catch (error) {
+			if (!headMoved(error)) throw error;
+			if (attempt === CONDITIONAL_TRIES) throw new HttpError(503, "unavailable", "the board kept changing while it checked: try again");
+			await new Promise((resolve) => setTimeout(resolve, Math.random() * 5 * attempt));
+		}
+	}
+}
+/** How many times a conditional write looks again, as the board moves on, before it gives up. */
+const CONDITIONAL_TRIES = 10;
+/** A reply's `after`: nothing came after it in the thread, as of the index the read reflects. */
+const nothingAfter = (ctx, root, after) => async () => {
+	const { messages: [newer], position } = await ctx.reads.tables.messages({ re: root }, {
+		after,
+		limit: 1
+	});
+	if (newer) throw new HttpError(409, "newer_message", `#${newer.id} came after #${after}`);
+	return position;
+};
 /** The message a by-ID write targets, as the board looked it up, once its proof is spent on the message's channel. */
 function spent(authorized, permission) {
 	spend(authorized.proof, permission, authorized.message);
@@ -1107,7 +992,10 @@ function spent(authorized, permission) {
 async function writeEdit(ctx, input) {
 	const message = spent(input.authorized, "post");
 	if (input.asAuthor !== false && message.by.principal !== input.identity.principal.id) throw forbidden("only the author can edit a message");
-	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
+	if (message.deleted) {
+		if (input.revision !== void 0 && input.revision !== (message.revision ?? message.id)) throw new HttpError(409, "revision_conflict", `#${message.id} was deleted since revision ${input.revision}`);
+		throw badRequest("message was deleted", "message_deleted");
+	}
 	return commitEdit(ctx, input, message);
 }
 async function commitEdit(ctx, input, message) {
@@ -1116,17 +1004,22 @@ async function commitEdit(ctx, input, message) {
 	const { text, found } = await withEmailMentions(input.text);
 	const named = found.map((actor) => actorSeen(actor, actors)).filter((event) => event !== null);
 	const { mentions, unknown } = resolveMentions(text, knownWith(actors, found), seen ? input.identity.actor : void 0, input.from != null, input.identity.principal.access.readsAll);
-	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], ...named, {
-		type: "message.edited",
-		payload: {
-			id: message.id,
-			thread: message.thread,
-			text,
-			mentions,
-			by: input.identity.author,
-			from: input.from ?? null
+	const events = [
+		...seen ? [seen] : [],
+		...named,
+		{
+			type: "message.edited",
+			payload: {
+				id: message.id,
+				thread: message.thread,
+				text,
+				mentions,
+				by: input.identity.author,
+				from: input.from ?? null
+			}
 		}
-	}));
+	];
+	await untilApplied(ctx, input.revision === void 0 ? await ctx.session.append(...events) : await appendWhile(ctx, revisionIs(ctx, message.id, input.revision), events));
 	return unknown.length && input.identity.principal.access.readable(message.channel) ? { unknownMentions: unknown } : {};
 }
 /** A message's links, replaced: a platform edit or unfurl changed what it links to. */
@@ -1147,8 +1040,11 @@ async function writeLinks(ctx, input) {
 async function writeDelete(ctx, input) {
 	const message = spent(input.authorized, "post");
 	if (input.asAuthor !== false && message.by.principal !== input.identity.principal.id) throw forbidden("only the author can delete a message");
-	if (message.deleted) return;
-	await untilApplied(ctx, await ctx.session.append({
+	if (message.deleted) {
+		if (input.revision !== void 0 && input.revision !== (message.revision ?? message.id)) throw new HttpError(409, "revision_conflict", `#${message.id} was deleted since revision ${input.revision}`);
+		return;
+	}
+	const deleted = [{
 		type: "message.deleted",
 		payload: {
 			id: message.id,
@@ -1156,8 +1052,17 @@ async function writeDelete(ctx, input) {
 			by: input.identity.author,
 			from: input.from ?? null
 		}
-	}));
-}
+	}];
+	await untilApplied(ctx, input.revision === void 0 ? await ctx.session.append(...deleted) : await appendWhile(ctx, revisionIs(ctx, message.id, input.revision), deleted));
+}
+/** An edit's or a delete's `revision`: no edit or delete since, as of the index the read reflects. */
+const revisionIs = (ctx, id, revision) => async () => {
+	const position = await ctx.reads.tables.position();
+	const message = (await ctx.reads.tables.messagesAt([id], position)).get(id);
+	const now = message ? message.revision ?? message.id : null;
+	if (now !== revision) throw new HttpError(409, "revision_conflict", message?.deleted ? `#${id} was deleted since revision ${revision}` : `#${id} was edited since revision ${revision}: it's at ${now}`);
+	return position;
+};
 async function writeReaction(ctx, input) {
 	const message = spent(input.authorized, "react");
 	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
@@ -1179,7 +1084,7 @@ async function writeLabels(ctx, input) {
 	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
 	const { state: actors } = await ctx.session.state(actorsReducer);
 	const seen = seenFor(input.identity, actors);
-	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], {
+	const events = [...seen ? [seen] : [], {
 		type: "labels.changed",
 		payload: {
 			id: message.id,
@@ -1188,8 +1093,21 @@ async function writeLabels(ctx, input) {
 			unset: input.unset ?? [],
 			by: input.identity.author
 		}
-	}));
-}
+	}];
+	await untilApplied(ctx, input.if !== void 0 && Object.keys(input.if).length > 0 ? await appendWhile(ctx, labelsAre(ctx, message.id, input.if), events) : await ctx.session.append(...events));
+}
+/** A label write's `if`: each label is as it says, as of the index the read reflects. */
+const labelsAre = (ctx, id, expected) => async () => {
+	const position = await ctx.reads.tables.position();
+	const labels = (await ctx.reads.tables.messagesAt([id], position)).get(id)?.labels ?? {};
+	for (const key of Object.keys(expected).sort()) {
+		const now = own(labels, key);
+		if (now === expected[key] || now === void 0 && expected[key] === null) continue;
+		const wanted = expected[key];
+		throw new HttpError(409, "label_conflict", wanted === null ? `${key} is set` : now === void 0 ? `${key} isn't set` : `${key} isn't ${wanted}`);
+	}
+	return position;
+};
 /**
 * Syncs a message's thread with a target, resolved by the sync that delivers it. Attaching twice
 * is a no-op; a platform thread another board thread is synced with is a 409.
@@ -1213,6 +1131,10 @@ async function writeAttach(ctx, input) {
 	}));
 	return { attached: true };
 }
+/** The batch, only while `index` is still the session's last: A2's conditional append. */
+const appendIfLast = (session, index, events) => session.append.ifLastIndex(index, ...events);
+/** What A2 throws when the session's last index isn't the one a conditional append named. */
+const headMoved = (error) => error?.code === "LAST_INDEX_MISMATCH";
 //#endregion
 //#region src/server/schedules.ts
 /** Vercel Queues delays at most 6 days: a send further out than this goes in hops. */
@@ -1313,7 +1235,7 @@ const createdBy = (schedule, principal) => schedule.as.principal.id === principa
 const scheduleView = (schedule, actors) => {
 	const author = actors.byId[schedule.as.actor.id] ?? schedule.as.actor;
 	return {
-		id: ref(schedule.id),
+		id: scheduleRef(schedule.id),
 		channel: schedule.channel,
 		re: schedule.re === null ? null : ref(schedule.re),
 		text: schedule.text,
@@ -2525,9 +2447,17 @@ function messageAt(value) {
 	if (index === null || index === 0) throw notFound(`message not found: #${value}`, "message_not_found");
 	return index;
 }
-/** A schedule's ID, `12` or as the CLI shows it, `s12`, as its index in session `schedules`. */
+/**
+* A reply's `after`, as the index of a message. One that isn't one is 0, which names no message:
+* the post refuses it, after a retry that landed gets its reply back.
+*/
+const afterAt = (value) => value === void 0 ? void 0 : indexOf(value) ?? 0;
+/**
+* A schedule's ID, `s12`, as its index in session `schedules`. `12` from a client that strips the
+* `s`, and `ss12` from an older CLI that adds one to what this board hands out, name it too.
+*/
 function scheduleAt(value) {
-	const bare = value.replace(/^s/, "");
+	const bare = value.replace(/^s{1,2}/, "");
 	const index = indexOf(bare);
 	if (index === null || index === 0) throw notFound(`schedule not found: s${bare}`, "schedule_not_found");
 	return index;
@@ -2898,6 +2828,7 @@ function build(options, binding) {
 			noSync: body.noSync,
 			id: body.id,
 			sync: body.sync,
+			after: afterAt(body.after),
 			...schedule && !fromRequest(caller) ? {
 				schedule,
 				lenientMentions: true
@@ -3056,25 +2987,27 @@ function build(options, binding) {
 		async post(caller, parsed) {
 			return postNow(caller, await identityOf(caller), parsed);
 		},
-		async edit(caller, { id, text }) {
+		async edit(caller, { id, text, revision }) {
 			const identity = await identityOf(caller);
 			const authorized = await authorizeOwn(writes, identity.principal, messageAt(id), "edit");
 			const { unknownMentions } = await writeEdit(writes, {
 				identity,
 				authorized,
-				text
+				text,
+				revision
 			});
 			return {
 				ok: true,
 				...unknownMentions ? { unknownMentions } : {}
 			};
 		},
-		async delete(caller, { id }) {
+		async delete(caller, { id, revision }) {
 			const identity = await identityOf(caller);
 			const authorized = await authorizeOwn(writes, identity.principal, messageAt(id), "delete");
 			await writeDelete(writes, {
 				identity,
-				authorized
+				authorized,
+				revision
 			});
 			return { ok: true };
 		},
@@ -3089,14 +3022,15 @@ function build(options, binding) {
 			});
 			return { ok: true };
 		},
-		async label(caller, { id, set, unset }) {
+		async label(caller, { id, set, unset, if: expected }) {
 			const identity = await identityOf(caller);
 			const authorized = await authorizeMessage(writes, identity.principal.access, "label", messageAt(id));
 			await writeLabels(writes, {
 				identity,
 				authorized,
 				set,
-				unset
+				unset,
+				if: expected
 			});
 			return { ok: true };
 		},
@@ -3264,11 +3198,11 @@ function build(options, binding) {
 			const { message, replies } = await methods.message(caller, { id }, signal);
 			return { targets: await binding.typing([message, ...replies], status) };
 		},
-		async readSource(caller, { key, target, limit }) {
+		async readSource(caller, { key, target, limit, after }) {
 			if (!binding.sync.some((entry) => entry.key === key)) throw notFound(`this board doesn't run sync entry ${key}: read it where its sync runs`, "not_synced_here");
 			const { principal } = await identityOf(caller);
 			if (!principal.access.everywhere("manage")) throw forbidden("this token can't read a source: it needs manage in every channel");
-			return binding.readSource(key, target, limit ?? 50);
+			return binding.readSource(key, target, limit ?? 50, after ?? null);
 		},
 		async joinSource(caller, { key, target }) {
 			if (!binding.sync.some((entry) => entry.key === key)) throw notFound(`this board doesn't run sync entry ${key}: join it where its sync runs`, "not_synced_here");
@@ -3370,6 +3304,7 @@ function build(options, binding) {
 						origin: body.origin,
 						from: body.from,
 						...body.origin && !ownSync(caller) ? { importedBy: principal.id } : {},
+						after: afterAt(body.after),
 						lenientMentions: true,
 						attachments,
 						links: await linksOf(principal, body.links)
@@ -3398,7 +3333,8 @@ function build(options, binding) {
 						authorized: proof,
 						text,
 						from: body.from,
-						asAuthor
+						asAuthor,
+						revision: body.revision
 					});
 					return ref(found.id);
 				};
@@ -3416,7 +3352,8 @@ function build(options, binding) {
 				identity: author,
 				authorized: await authorized("post"),
 				from: body.from,
-				asAuthor
+				asAuthor,
+				revision: body.revision
 			});
 			else if (body.op === "react") await writeReaction(writes, {
 				identity: author,
@@ -3429,7 +3366,8 @@ function build(options, binding) {
 				identity: author,
 				authorized: await authorized("label"),
 				set: body.set,
-				unset: body.unset
+				unset: body.unset,
+				if: body.if
 			});
 			else await writeLinks(writes, {
 				identity: author,
@@ -4085,4 +4023,4 @@ function a2(options = {}) {
 	return backend;
 }
 //#endregion
-export { fsBlob as n, memoryBlob as r, a2 as t };
+export { a2 as t };