@vercel/board 0.28.0 → 0.30.0

package/dist/access-CQ39gqEV.mjs

@@ -0,0 +1,226 @@
+import { c as ChannelPath, v as SCOPE_MAX } from "./schemas-DBmUO6pr.mjs";
+import { a as forbidden } from "./errors-C_5rB8Iz.mjs";
+//#region src/server/access.ts
+/**
+* What a principal may do in a channel. `read` covers messages, threads,
+* `/events`, and schedules; `post` starts threads and edits your own messages;
+* `manage` is the board's own bookkeeping (inbox, sources).
+*/
+const PERMISSIONS = [
+	"read",
+	"post",
+	"react",
+	"label",
+	"sync",
+	"manage"
+];
+/**
+* One hop of implication, kept as data like Vercel's git broker
+* (`ACTION_IMPLICATIONS`). Each verb that addresses a message by ID implies
+* `read`, so none of them is a blind existence oracle. `post` implies nothing:
+* write-only is `['post']`.
+*/
+const IMPLIES = {
+	read: [],
+	post: [],
+	react: ["read"],
+	label: ["read"],
+	sync: ["read"],
+	manage: [
+		"read",
+		"post",
+		"react",
+		"label",
+		"sync"
+	]
+};
+const ORDER = new Map(PERMISSIONS.map((permission, index) => [permission, index]));
+const SHAPE = "write *, a channel, or a channel and its subtree (feedback/)";
+/** A pattern's parts; any other `*` throws, and says what to type instead. */
+function parsePattern(pattern) {
+	if (pattern === "*") return { kind: "all" };
+	if (pattern.includes("*")) {
+		const before = pattern.slice(0, pattern.indexOf("*")).replace(/\/+$/, "");
+		const hint = before === "" ? "write * for every channel" : ChannelPath.safeParse(before).success ? `write ${before}/ for ${before} and its subtree` : SHAPE;
+		throw new Error(`invalid channel pattern ${pattern}: ${hint}`);
+	}
+	const subtree = pattern.endsWith("/");
+	const path = subtree ? pattern.slice(0, -1) : pattern;
+	if (!ChannelPath.safeParse(path).success) throw new Error(`invalid channel pattern ${pattern || "(empty)"}: ${SHAPE}`);
+	return subtree ? {
+		kind: "subtree",
+		path
+	} : {
+		kind: "exact",
+		path
+	};
+}
+const key = (pattern) => pattern.kind === "all" ? "*" : pattern.kind === "subtree" ? `${pattern.path}/` : pattern.path;
+/** A grant with its implications, closed: `['label']` is `read` and `label`. */
+function expand(grant) {
+	const out = /* @__PURE__ */ new Set();
+	const add = (permission) => {
+		if (!ORDER.has(permission)) throw new Error(`unknown permission ${String(permission)}: use ${PERMISSIONS.join(", ")}`);
+		if (out.has(permission)) return;
+		out.add(permission);
+		for (const implied of IMPLIES[permission]) add(implied);
+	};
+	for (const permission of grant === "all" ? PERMISSIONS : grant) add(permission);
+	return out;
+}
+const NOTHING = /* @__PURE__ */ new Set();
+function compile(entries) {
+	let all = null;
+	const exact = /* @__PURE__ */ new Map();
+	const subtrees = [];
+	for (const [pattern, permissions] of entries) if (pattern.kind === "all") all = permissions;
+	else if (pattern.kind === "exact") exact.set(pattern.path, permissions);
+	else subtrees.push([pattern.path, permissions]);
+	subtrees.sort((a, b) => b[0].length - a[0].length);
+	return {
+		all,
+		exact,
+		subtrees
+	};
+}
+const under = (channel, path) => channel === path || channel.startsWith(`${path}/`);
+/** What the most specific pattern covering `channel` gives; with `subtreeOnly`, ignoring an exact rule for it. */
+function resolve(rules, channel, subtreeOnly = false) {
+	if (!subtreeOnly) {
+		const exact = rules.exact.get(channel);
+		if (exact) return exact;
+	}
+	for (const [path, permissions] of rules.subtrees) if (under(channel, path)) return permissions;
+	return rules.all ?? NOTHING;
+}
+/**
+* What `rules` gives every channel `pattern` governs where nothing more
+* specific does. The patterns matching one channel form a chain, so that's one
+* answer: an exact channel resolves as itself, a subtree as whatever covers the
+* subtree's root, ignoring an exact rule for the root.
+*/
+const at = (rules, pattern) => pattern.kind === "all" ? rules.all ?? NOTHING : resolve(rules, pattern.path, pattern.kind === "subtree");
+const equal = (a, b) => a.size === b.size && [...a].every((permission) => b.has(permission));
+/** The answer of the pattern next less specific than `pattern` in `rules`. */
+function parent(rules, pattern) {
+	if (pattern.kind === "exact") return resolve(rules, pattern.path, true);
+	if (pattern.kind === "subtree") {
+		for (const [path, permissions] of rules.subtrees) if (path !== pattern.path && under(pattern.path, path)) return permissions;
+	}
+	return rules.all ?? NOTHING;
+}
+/** Drops rules that say what their parent says, and an empty `*`, so equal access has one summary. */
+function canonical(entries) {
+	const rules = compile(entries);
+	return compile(entries.filter(([pattern, permissions]) => pattern.kind === "all" ? permissions.size > 0 : !equal(permissions, parent(rules, pattern))));
+}
+function entriesOf(can) {
+	if (can === "all" || Array.isArray(can)) return [[{ kind: "all" }, expand(can)]];
+	return Object.entries(can).map(([pattern, grant]) => [parsePattern(pattern), expand(grant)]);
+}
+const entriesIn = (rules) => [
+	...rules.all ? [[{ kind: "all" }, rules.all]] : [],
+	...rules.subtrees.map(([path, permissions]) => [{
+		kind: "subtree",
+		path
+	}, permissions]),
+	...[...rules.exact].map(([path, permissions]) => [{
+		kind: "exact",
+		path
+	}, permissions])
+];
+const RULES = Symbol("board.access");
+const isAccess = (value) => typeof value === "object" && RULES in value;
+function fromRules(rules) {
+	const entries = entriesIn(rules);
+	const everywhere = (permission) => (rules.all?.has(permission) ?? false) && entries.every(([, permissions]) => permissions.has(permission));
+	const readable = /* @__PURE__ */ new Map();
+	return {
+		[RULES]: rules,
+		can: (permission, channel) => resolve(rules, channel).has(permission),
+		readable(channel) {
+			let found = readable.get(channel);
+			if (found === void 0) readable.set(channel, found = resolve(rules, channel).has("read"));
+			return found;
+		},
+		readsAll: everywhere("read"),
+		everywhere,
+		anywhere: (permission) => entries.some(([, permissions]) => permissions.has(permission)),
+		narrow(scope) {
+			const other = isAccess(scope) ? scope[RULES] : canonical(entriesOf(scope));
+			const patterns = /* @__PURE__ */ new Map([["*", { kind: "all" }]]);
+			for (const [pattern] of [...entries, ...entriesIn(other)]) patterns.set(key(pattern), pattern);
+			return fromRules(canonical([...patterns.values()].map((pattern) => {
+				const theirs = at(other, pattern);
+				return [pattern, new Set([...at(rules, pattern)].filter((permission) => theirs.has(permission)))];
+			})));
+		},
+		summary() {
+			const named = entries.map(([pattern, permissions]) => [key(pattern), permissions]);
+			named.sort(([a], [b]) => a === "*" ? -1 : b === "*" ? 1 : a.localeCompare(b));
+			const out = {};
+			for (const [name, permissions] of named) out[name] = [...permissions].sort((a, b) => ORDER.get(a) - ORDER.get(b));
+			return out;
+		}
+	};
+}
+/** Access from config: `'all'`, a list for every channel, or a map from pattern to grant. Throws on a bad pattern or permission. */
+function compileAccess(can) {
+	return fromRules(canonical(entriesOf(can)));
+}
+const FULL_ACCESS = compileAccess("all");
+/**
+* `x-board-scope`: `dev/=read,post,react,label;ci/=read`. Each entry is a
+* pattern and its permissions (or `all`). It's meant for a proxy that holds the
+* credential, like Pi's sandbox: the board intersects it with the principal's
+* access, so it can only narrow, and a caller holding its own token gains
+* nothing by sending it.
+*/
+function parseScope(header) {
+	if (header.length > 4e3) throw new Error(`x-board-scope is longer than ${SCOPE_MAX} characters`);
+	const out = {};
+	const entries = header.split(";").map((entry) => entry.trim());
+	if (entries.every((entry) => entry === "")) throw new Error("x-board-scope is empty: write pattern=permissions, like dev/=read,post");
+	for (const entry of entries) {
+		if (entry === "") continue;
+		const split = entry.indexOf("=");
+		if (split < 0) throw new Error(`x-board-scope entry ${entry} needs =: write pattern=permissions, like dev/=read,post`);
+		const pattern = entry.slice(0, split).trim();
+		const list = entry.slice(split + 1).trim();
+		if (Object.hasOwn(out, pattern)) throw new Error(`x-board-scope lists ${pattern} twice`);
+		parsePattern(pattern);
+		const permissions = list === "" ? [] : list.split(",").map((permission) => permission.trim());
+		if (permissions.length === 1 && permissions[0] === "all") {
+			out[pattern] = "all";
+			continue;
+		}
+		for (const permission of permissions) if (!ORDER.has(permission)) throw new Error(`x-board-scope: unknown permission ${permission || "(empty)"}: use ${PERMISSIONS.join(", ")}, or all`);
+		out[pattern] = permissions;
+	}
+	return out;
+}
+const PHRASE = {
+	read: (channel) => `read ${channel}`,
+	post: (channel) => `post in ${channel}`,
+	react: (channel) => `react in ${channel}`,
+	label: (channel) => `label in ${channel}`,
+	sync: (channel) => `sync in ${channel}`,
+	manage: (channel) => `manage ${channel}`
+};
+/**
+* A proof that `access` allows `permission` in `channel`, or a 403 naming what's
+* missing: `this token can't label in dev`. Pass the channel the board looked
+* up, never one the request named. What the caller can't read should answer as
+* if it didn't exist: pass that error as `hidden`, and it's thrown instead
+* whenever `channel` isn't readable.
+*/
+function authorize(access, permission, channel, hidden) {
+	if (hidden && !access.readable(channel)) throw hidden();
+	if (!access.can(permission, channel)) throw forbidden(`this token can't ${PHRASE[permission](channel)}`);
+	return Object.freeze({
+		permission,
+		channel
+	});
+}
+//#endregion
+export { parseScope as i, authorize as n, compileAccess as r, FULL_ACCESS as t };

package/dist/access.d.mts

@@ -1,6 +1,6 @@
 import { a as Grant, i as ChannelPattern, n as AccessSummary, o as Permission, r as Can, t as Access } from "./access-CV96SYgr.mjs";
 import { _ as oidc, a as CallerRequest, c as HostPrincipal, d as OidcTokensOptions, f as Principal, g as githubActions, h as compileRules, i as AuthenticateContext, l as IssuerConfig, m as RuleFunction, n as AccessRule, o as Claims, p as PrincipalKind, r as Authenticate, t as AccessFunction, u as Known, v as vercelProject } from "./auth-CU56Q2Xh.mjs";
-import { C as Author, t as Actor } from "./folds-jS9wlh9_.mjs";
+import { C as Author, t as Actor } from "./folds-8wRRXjAt.mjs";
 //#region src/server/tokens.d.ts
 /**
  * The OIDC tokens made out to this board: a request's bearer token, from Vercel (people and

package/dist/access.mjs

@@ -1,4 +1,4 @@
-import { a as compileRules, c as githubActions, h as vercelProject, p as oidc } from "./auth-lTkOgvcE.mjs";
-import { i as resolveActor } from "./actors-BLXVp4oZ.mjs";
-import { t as oidcTokens } from "./tokens-BuCU-61R.mjs";
+import { i as resolveActor } from "./actors-xPiamLWk.mjs";
+import { a as compileRules, c as githubActions, h as vercelProject, p as oidc } from "./auth-BPinwfN0.mjs";
+import { t as oidcTokens } from "./tokens-C5_yGRlL.mjs";
 export { compileRules, githubActions, oidc, oidcTokens, resolveActor, vercelProject };

package/dist/{actors-BLXVp4oZ.mjs → actors-xPiamLWk.mjs}

@@ -1,8 +1,8 @@
-import { C as toStorable } from "./schemas-Be08nyfW.mjs";
-import { r as badRequest } from "./errors-CusN4x2l.mjs";
+import { C as toStorable } from "./schemas-DBmUO6pr.mjs";
+import { r as badRequest } from "./errors-C_5rB8Iz.mjs";
 import { t as own } from "./own-OwgPWdmh.mjs";
 import { t as extractMentions } from "./mentions-CB6ShY4R.mjs";
-import { y as parseScope } from "./auth-lTkOgvcE.mjs";
+import { i as parseScope } from "./access-CQ39gqEV.mjs";
 //#region src/server/actors.ts
 /** Agents whose avatars the board serves itself. */
 const KNOWN_AGENTS = [

package/dist/{auth-lTkOgvcE.mjs → auth-BPinwfN0.mjs}

@@ -1,228 +1,5 @@
-import { c as ChannelPath, v as SCOPE_MAX } from "./schemas-Be08nyfW.mjs";
-import { a as forbidden, l as unauthorized } from "./errors-CusN4x2l.mjs";
-//#region src/server/access.ts
-/**
-* What a principal may do in a channel. `read` covers messages, threads,
-* `/events`, and schedules; `post` starts threads and edits your own messages;
-* `manage` is the board's own bookkeeping (inbox, sources).
-*/
-const PERMISSIONS = [
-	"read",
-	"post",
-	"react",
-	"label",
-	"sync",
-	"manage"
-];
-/**
-* One hop of implication, kept as data like Vercel's git broker
-* (`ACTION_IMPLICATIONS`). Each verb that addresses a message by ID implies
-* `read`, so none of them is a blind existence oracle. `post` implies nothing:
-* write-only is `['post']`.
-*/
-const IMPLIES = {
-	read: [],
-	post: [],
-	react: ["read"],
-	label: ["read"],
-	sync: ["read"],
-	manage: [
-		"read",
-		"post",
-		"react",
-		"label",
-		"sync"
-	]
-};
-const ORDER = new Map(PERMISSIONS.map((permission, index) => [permission, index]));
-const SHAPE = "write *, a channel, or a channel and its subtree (feedback/)";
-/** A pattern's parts; any other `*` throws, and says what to type instead. */
-function parsePattern(pattern) {
-	if (pattern === "*") return { kind: "all" };
-	if (pattern.includes("*")) {
-		const before = pattern.slice(0, pattern.indexOf("*")).replace(/\/+$/, "");
-		const hint = before === "" ? "write * for every channel" : ChannelPath.safeParse(before).success ? `write ${before}/ for ${before} and its subtree` : SHAPE;
-		throw new Error(`invalid channel pattern ${pattern}: ${hint}`);
-	}
-	const subtree = pattern.endsWith("/");
-	const path = subtree ? pattern.slice(0, -1) : pattern;
-	if (!ChannelPath.safeParse(path).success) throw new Error(`invalid channel pattern ${pattern || "(empty)"}: ${SHAPE}`);
-	return subtree ? {
-		kind: "subtree",
-		path
-	} : {
-		kind: "exact",
-		path
-	};
-}
-const key = (pattern) => pattern.kind === "all" ? "*" : pattern.kind === "subtree" ? `${pattern.path}/` : pattern.path;
-/** A grant with its implications, closed: `['label']` is `read` and `label`. */
-function expand(grant) {
-	const out = /* @__PURE__ */ new Set();
-	const add = (permission) => {
-		if (!ORDER.has(permission)) throw new Error(`unknown permission ${String(permission)}: use ${PERMISSIONS.join(", ")}`);
-		if (out.has(permission)) return;
-		out.add(permission);
-		for (const implied of IMPLIES[permission]) add(implied);
-	};
-	for (const permission of grant === "all" ? PERMISSIONS : grant) add(permission);
-	return out;
-}
-const NOTHING = /* @__PURE__ */ new Set();
-function compile(entries) {
-	let all = null;
-	const exact = /* @__PURE__ */ new Map();
-	const subtrees = [];
-	for (const [pattern, permissions] of entries) if (pattern.kind === "all") all = permissions;
-	else if (pattern.kind === "exact") exact.set(pattern.path, permissions);
-	else subtrees.push([pattern.path, permissions]);
-	subtrees.sort((a, b) => b[0].length - a[0].length);
-	return {
-		all,
-		exact,
-		subtrees
-	};
-}
-const under = (channel, path) => channel === path || channel.startsWith(`${path}/`);
-/** What the most specific pattern covering `channel` gives; with `subtreeOnly`, ignoring an exact rule for it. */
-function resolve(rules, channel, subtreeOnly = false) {
-	if (!subtreeOnly) {
-		const exact = rules.exact.get(channel);
-		if (exact) return exact;
-	}
-	for (const [path, permissions] of rules.subtrees) if (under(channel, path)) return permissions;
-	return rules.all ?? NOTHING;
-}
-/**
-* What `rules` gives every channel `pattern` governs where nothing more
-* specific does. The patterns matching one channel form a chain, so that's one
-* answer: an exact channel resolves as itself, a subtree as whatever covers the
-* subtree's root, ignoring an exact rule for the root.
-*/
-const at = (rules, pattern) => pattern.kind === "all" ? rules.all ?? NOTHING : resolve(rules, pattern.path, pattern.kind === "subtree");
-const equal = (a, b) => a.size === b.size && [...a].every((permission) => b.has(permission));
-/** The answer of the pattern next less specific than `pattern` in `rules`. */
-function parent(rules, pattern) {
-	if (pattern.kind === "exact") return resolve(rules, pattern.path, true);
-	if (pattern.kind === "subtree") {
-		for (const [path, permissions] of rules.subtrees) if (path !== pattern.path && under(pattern.path, path)) return permissions;
-	}
-	return rules.all ?? NOTHING;
-}
-/** Drops rules that say what their parent says, and an empty `*`, so equal access has one summary. */
-function canonical(entries) {
-	const rules = compile(entries);
-	return compile(entries.filter(([pattern, permissions]) => pattern.kind === "all" ? permissions.size > 0 : !equal(permissions, parent(rules, pattern))));
-}
-function entriesOf(can) {
-	if (can === "all" || Array.isArray(can)) return [[{ kind: "all" }, expand(can)]];
-	return Object.entries(can).map(([pattern, grant]) => [parsePattern(pattern), expand(grant)]);
-}
-const entriesIn = (rules) => [
-	...rules.all ? [[{ kind: "all" }, rules.all]] : [],
-	...rules.subtrees.map(([path, permissions]) => [{
-		kind: "subtree",
-		path
-	}, permissions]),
-	...[...rules.exact].map(([path, permissions]) => [{
-		kind: "exact",
-		path
-	}, permissions])
-];
-const RULES = Symbol("board.access");
-const isAccess = (value) => typeof value === "object" && RULES in value;
-function fromRules(rules) {
-	const entries = entriesIn(rules);
-	const everywhere = (permission) => (rules.all?.has(permission) ?? false) && entries.every(([, permissions]) => permissions.has(permission));
-	const readable = /* @__PURE__ */ new Map();
-	return {
-		[RULES]: rules,
-		can: (permission, channel) => resolve(rules, channel).has(permission),
-		readable(channel) {
-			let found = readable.get(channel);
-			if (found === void 0) readable.set(channel, found = resolve(rules, channel).has("read"));
-			return found;
-		},
-		readsAll: everywhere("read"),
-		everywhere,
-		anywhere: (permission) => entries.some(([, permissions]) => permissions.has(permission)),
-		narrow(scope) {
-			const other = isAccess(scope) ? scope[RULES] : canonical(entriesOf(scope));
-			const patterns = /* @__PURE__ */ new Map([["*", { kind: "all" }]]);
-			for (const [pattern] of [...entries, ...entriesIn(other)]) patterns.set(key(pattern), pattern);
-			return fromRules(canonical([...patterns.values()].map((pattern) => {
-				const theirs = at(other, pattern);
-				return [pattern, new Set([...at(rules, pattern)].filter((permission) => theirs.has(permission)))];
-			})));
-		},
-		summary() {
-			const named = entries.map(([pattern, permissions]) => [key(pattern), permissions]);
-			named.sort(([a], [b]) => a === "*" ? -1 : b === "*" ? 1 : a.localeCompare(b));
-			const out = {};
-			for (const [name, permissions] of named) out[name] = [...permissions].sort((a, b) => ORDER.get(a) - ORDER.get(b));
-			return out;
-		}
-	};
-}
-/** Access from config: `'all'`, a list for every channel, or a map from pattern to grant. Throws on a bad pattern or permission. */
-function compileAccess(can) {
-	return fromRules(canonical(entriesOf(can)));
-}
-const FULL_ACCESS = compileAccess("all");
-/**
-* `x-board-scope`: `dev/=read,post,react,label;ci/=read`. Each entry is a
-* pattern and its permissions (or `all`). It's meant for a proxy that holds the
-* credential, like Pi's sandbox: the board intersects it with the principal's
-* access, so it can only narrow, and a caller holding its own token gains
-* nothing by sending it.
-*/
-function parseScope(header) {
-	if (header.length > 4e3) throw new Error(`x-board-scope is longer than ${SCOPE_MAX} characters`);
-	const out = {};
-	const entries = header.split(";").map((entry) => entry.trim());
-	if (entries.every((entry) => entry === "")) throw new Error("x-board-scope is empty: write pattern=permissions, like dev/=read,post");
-	for (const entry of entries) {
-		if (entry === "") continue;
-		const split = entry.indexOf("=");
-		if (split < 0) throw new Error(`x-board-scope entry ${entry} needs =: write pattern=permissions, like dev/=read,post`);
-		const pattern = entry.slice(0, split).trim();
-		const list = entry.slice(split + 1).trim();
-		if (Object.hasOwn(out, pattern)) throw new Error(`x-board-scope lists ${pattern} twice`);
-		parsePattern(pattern);
-		const permissions = list === "" ? [] : list.split(",").map((permission) => permission.trim());
-		if (permissions.length === 1 && permissions[0] === "all") {
-			out[pattern] = "all";
-			continue;
-		}
-		for (const permission of permissions) if (!ORDER.has(permission)) throw new Error(`x-board-scope: unknown permission ${permission || "(empty)"}: use ${PERMISSIONS.join(", ")}, or all`);
-		out[pattern] = permissions;
-	}
-	return out;
-}
-const PHRASE = {
-	read: (channel) => `read ${channel}`,
-	post: (channel) => `post in ${channel}`,
-	react: (channel) => `react in ${channel}`,
-	label: (channel) => `label in ${channel}`,
-	sync: (channel) => `sync in ${channel}`,
-	manage: (channel) => `manage ${channel}`
-};
-/**
-* A proof that `access` allows `permission` in `channel`, or a 403 naming what's
-* missing: `this token can't label in dev`. Pass the channel the board looked
-* up, never one the request named. What the caller can't read should answer as
-* if it didn't exist: pass that error as `hidden`, and it's thrown instead
-* whenever `channel` isn't readable.
-*/
-function authorize(access, permission, channel, hidden) {
-	if (hidden && !access.readable(channel)) throw hidden();
-	if (!access.can(permission, channel)) throw forbidden(`this token can't ${PHRASE[permission](channel)}`);
-	return Object.freeze({
-		permission,
-		channel
-	});
-}
-//#endregion
+import { a as forbidden, l as unauthorized } from "./errors-C_5rB8Iz.mjs";
+import { i as parseScope, r as compileAccess, t as FULL_ACCESS } from "./access-CQ39gqEV.mjs";
 //#region src/server/auth.ts
 /**
 * Principal IDs a board authenticates: its people, deployments, workflows, and its own code. No
@@ -496,4 +273,4 @@ function hostPrincipal(value) {
 	};
 }
 //#endregion
-export { FULL_ACCESS as _, compileRules as a, githubActions as c, issuersOf as d, markVerified as f, verifiesTokens as g, vercelProject as h, authenticates as i, hostPrincipal as l, trustedIssuers as m, TOKENS as n, createAuthority as o, oidc as p, VERCEL_ISSUER as r, fromTokens as s, GITHUB_ISSUER as t, issuerName as u, authorize as v, parseScope as y };
+export { compileRules as a, githubActions as c, issuersOf as d, markVerified as f, verifiesTokens as g, vercelProject as h, authenticates as i, hostPrincipal as l, trustedIssuers as m, TOKENS as n, createAuthority as o, oidc as p, VERCEL_ISSUER as r, fromTokens as s, GITHUB_ISSUER as t, issuerName as u };

package/dist/backend-a2/blob-vercel.d.mts

@@ -1,4 +1,4 @@
-import { t as BlobStore } from "../blob-B-9AvYis.mjs";
+import { t as BlobStore } from "../blob-CqILvdmr.mjs";
 //#region src/blob/vercel.d.ts
 export declare function vercelBlob(options?: {
   token?: string;

package/dist/backend-a2/contract.d.mts

@@ -1,5 +1,5 @@
-import { A as Labels, C as Author, D as Handle, E as Emoji, M as MessageId, N as MessageText, O as LabelKey, S as AttachmentId, T as ChannelPath, _ as BoardEvents, b as ActorKind, g as BoardEvent, h as BOARD_SESSION, i as ChannelsState, j as MESSAGE_TEXT_MAX, k as LabelValue, l as ExternalAuthor, m as Origin, n as ActorsState, o as Message, r as Channel, s as MessagesState, t as Actor, v as ATTACHMENTS_PER_MESSAGE_MAX, w as CHANNEL_PATH_MAX, x as Attachment, y as ActorId } from "../folds-jS9wlh9_.mjs";
-import { l as Reducer, n as Contract } from "../reducer-CYPHsSmd-BQIfozGi.mjs";
+import { A as Labels, C as Author, D as Handle, E as Emoji, M as MessageId, N as MessageText, O as LabelKey, S as AttachmentId, T as ChannelPath, _ as BoardEvents, b as ActorKind, g as BoardEvent, h as BOARD_SESSION, i as ChannelsState, j as MESSAGE_TEXT_MAX, k as LabelValue, l as ExternalAuthor, m as Origin, n as ActorsState, o as Message, r as Channel, s as MessagesState, t as Actor, v as ATTACHMENTS_PER_MESSAGE_MAX, w as CHANNEL_PATH_MAX, x as Attachment, y as ActorId } from "../folds-8wRRXjAt.mjs";
+import { l as Reducer, n as Contract } from "../reducer-CYPHsSmd-BXjGiptm.mjs";
 import { z } from "zod";
 //#region src/contract/files.d.ts
 /** Under Vercel Functions' 4.5 MB request body limit, so an upload fits in one request. */

package/dist/backend-a2/contract.mjs

@@ -1,5 +1,5 @@
 import { n as DIRECT_UPLOAD_BYTES_MAX, r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "../files-SniSmeEr.mjs";
-import { a as AttachmentId, c as ChannelPath, d as LabelKey, f as LabelValue, g as MessageText, h as MessageId, i as Attachment, l as Emoji, m as MESSAGE_TEXT_MAX, n as ActorId, o as Author, p as Labels, r as ActorKind, s as CHANNEL_PATH_MAX, t as ATTACHMENTS_PER_MESSAGE_MAX, u as Handle } from "../schemas-Be08nyfW.mjs";
-import { o as Origin } from "../external-BV_cUncs.mjs";
-import { _ as BOARD_SESSION, i as messagesReducer, l as boardContract, n as channelsReducer, t as actorsReducer } from "../reducers-BcmSs4qf.mjs";
+import { a as AttachmentId, c as ChannelPath, d as LabelKey, f as LabelValue, g as MessageText, h as MessageId, i as Attachment, l as Emoji, m as MESSAGE_TEXT_MAX, n as ActorId, o as Author, p as Labels, r as ActorKind, s as CHANNEL_PATH_MAX, t as ATTACHMENTS_PER_MESSAGE_MAX, u as Handle } from "../schemas-DBmUO6pr.mjs";
+import { o as Origin } from "../external-D3p5T57R.mjs";
+import { _ as BOARD_SESSION, i as messagesReducer, l as boardContract, n as channelsReducer, t as actorsReducer } from "../reducers-8jqLewgw.mjs";
 export { ATTACHMENTS_PER_MESSAGE_MAX, ATTACHMENT_BYTES_MAX, ActorId, ActorKind, Attachment, AttachmentId, Author, BOARD_SESSION, CHANNEL_PATH_MAX, ChannelPath, DIRECT_UPLOAD_BYTES_MAX, Emoji, Handle, IMPORT_BYTES_MAX, LabelKey, LabelValue, Labels, MESSAGE_TEXT_MAX, MessageId, MessageText, Origin, actorsReducer, boardContract, channelsReducer, messagesReducer };

package/dist/backend-a2/scheduler-local.d.mts

@@ -1,4 +1,4 @@
-import { t as A2Scheduler } from "../server-qgez0Xny-D5mLfqFQ.mjs";
+import { t as A2Scheduler } from "../server-B9gu0qi1-DI1WvcVK.mjs";
 //#region src/scheduler/local.d.ts
 /**
  * A scheduler in this process (`@vercel/board/backend-a2/scheduler-local`): each task runs at its time on

package/dist/backend-a2/scheduler-local.mjs

@@ -1,2 +1,2 @@
-import { t as localScheduler } from "../local-DhkrAqPP.mjs";
+import { t as localScheduler } from "../local-C76Fy5ad.mjs";
 export { localScheduler };

package/dist/backend-a2/scheduler-qstash.d.mts

@@ -1,6 +1,6 @@
-import { n as Clock } from "../store-D0MhBvg6-4Z2L0Kqd.mjs";
-import { i as SchedulerTask, t as A2Scheduler } from "../server-qgez0Xny-D5mLfqFQ.mjs";
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/scheduler-qstash.d.ts
+import { n as Clock } from "../store-DEzcHZOA-B-5vhxef.mjs";
+import { i as SchedulerTask, t as A2Scheduler } from "../server-B9gu0qi1-DI1WvcVK.mjs";
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/scheduler-qstash.d.ts
 //#region src/scheduler-qstash.d.ts
 type QStashStoreOutage = {
   version: 1;

package/dist/backend-a2/scheduler-qstash.mjs

@@ -1,11 +1,11 @@
-import { t as A2Error } from "../session-clear-wHd5GCpZ-BnKSxReK.mjs";
-import { i as deliverSchedulerClear, r as deliverSchedulerAppend } from "../server-DtFrWxi3-Boa6gdWO.mjs";
-import { _ as serverInternals, l as assertSchedulerTargets, t as DRAIN_TIMINGS, u as classifySchedulerSendFailure } from "../internal-CvsrprnU-CRY89I-b.mjs";
-import { n as platformVercelOidcToken } from "../platform-B4TnJtWu-CwcTyKg2.mjs";
-import { t as retryableLazy } from "../retryable-lazy-DZWmHpii-Bye-W8q7.mjs";
-import { n as SYSTEM_CLOCK } from "../store-N8PXxDAS-BWBgzBHp.mjs";
-import { t as normalizeSchedulerTask } from "../scheduler-task-X1SToDjP-BVoWuInI.mjs";
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/scheduler-qstash.js
+import { t as A2Error } from "../session-clear-XJYpmUpg-2q8l_FJR.mjs";
+import { i as deliverSchedulerClear, r as deliverSchedulerAppend } from "../server-DX7mM6nm-D7N_7bug.mjs";
+import { _ as serverInternals, l as assertSchedulerTargets, t as DRAIN_TIMINGS, u as classifySchedulerSendFailure } from "../internal-CvsrprnU-zZMpDiRY.mjs";
+import { n as platformVercelOidcToken } from "../platform-B4TnJtWu-Do3agKr5.mjs";
+import { t as retryableLazy } from "../retryable-lazy-DZWmHpii-DpTc5PIP.mjs";
+import { n as SYSTEM_CLOCK } from "../store-N8PXxDAS-DWWgv-Vz.mjs";
+import { t as normalizeSchedulerTask } from "../scheduler-task-X1SToDjP-D2Il2rln.mjs";
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/scheduler-qstash.js
 /**
 * experimental-a2/scheduler-qstash — HTTP scheduler over Upstash QStash.
 *

package/dist/backend-a2/scheduler-vercel.d.mts

@@ -1,6 +1,6 @@
-import { n as Clock } from "../store-D0MhBvg6-4Z2L0Kqd.mjs";
-import { i as SchedulerTask, t as A2Scheduler } from "../server-qgez0Xny-D5mLfqFQ.mjs";
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/scheduler-vercel.d.ts
+import { n as Clock } from "../store-DEzcHZOA-B-5vhxef.mjs";
+import { i as SchedulerTask, t as A2Scheduler } from "../server-B9gu0qi1-DI1WvcVK.mjs";
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/scheduler-vercel.d.ts
 type QueueDeliveryMetadata = {
   messageId: string;
   deliveryCount: number;

package/dist/backend-a2/scheduler-vercel.mjs

@@ -1,10 +1,10 @@
-import { i as deliverSchedulerClear, r as deliverSchedulerAppend } from "../server-DtFrWxi3-Boa6gdWO.mjs";
-import { _ as serverInternals, l as assertSchedulerTargets, t as DRAIN_TIMINGS, u as classifySchedulerSendFailure } from "../internal-CvsrprnU-CRY89I-b.mjs";
-import { t as retryableLazy } from "../retryable-lazy-DZWmHpii-Bye-W8q7.mjs";
-import { n as SYSTEM_CLOCK } from "../store-N8PXxDAS-BWBgzBHp.mjs";
-import { t as normalizeSchedulerTask } from "../scheduler-task-X1SToDjP-BVoWuInI.mjs";
+import { i as deliverSchedulerClear, r as deliverSchedulerAppend } from "../server-DX7mM6nm-D7N_7bug.mjs";
+import { _ as serverInternals, l as assertSchedulerTargets, t as DRAIN_TIMINGS, u as classifySchedulerSendFailure } from "../internal-CvsrprnU-zZMpDiRY.mjs";
+import { t as retryableLazy } from "../retryable-lazy-DZWmHpii-DpTc5PIP.mjs";
+import { n as SYSTEM_CLOCK } from "../store-N8PXxDAS-DWWgv-Vz.mjs";
+import { t as normalizeSchedulerTask } from "../scheduler-task-X1SToDjP-D2Il2rln.mjs";
 import { createHash } from "node:crypto";
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/scheduler-vercel.js
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/scheduler-vercel.js
 /**
 * experimental-a2/scheduler-vercel — queue-backed scheduler over Vercel Queues.
 *

package/dist/backend-a2/store-memory.d.mts

@@ -1,5 +1,5 @@
-import { n as Clock } from "../store-D0MhBvg6-4Z2L0Kqd.mjs";
-import { t as BoardStore } from "../types-aCAf6lGU.mjs";
+import { n as Clock } from "../store-DEzcHZOA-B-5vhxef.mjs";
+import { t as BoardStore } from "../types-shZmGZ-q.mjs";
 //#region src/store/memory.d.ts
 /**
  * A board that lives in memory, for tests: its log in A2's memory store, its

package/dist/backend-a2/store-memory.mjs

@@ -1,6 +1,6 @@
-import { r as sqlTables } from "../sql-U9WTxrwJ.mjs";
-import { t as sqliteDb } from "../sqlite-db-Ds4majtT.mjs";
-import { t as memory$1 } from "../store-memory-Bas9Uq5C.mjs";
+import { r as sqlTables } from "../sql-Bj0fk6dn.mjs";
+import { t as sqliteDb } from "../sqlite-db-Dc8G78XV.mjs";
+import { t as memory$1 } from "../store-memory-B0PkVSuQ.mjs";
 //#region src/store/memory.ts
 /**
 * A board that lives in memory, for tests: its log in A2's memory store, its

package/dist/backend-a2/store-postgres.d.mts

@@ -1,4 +1,4 @@
-import { t as BoardStore } from "../types-aCAf6lGU.mjs";
+import { t as BoardStore } from "../types-shZmGZ-q.mjs";
 //#region src/store/postgres-db.d.ts
 /** What the tables need of a `pg` Pool, or of anything shaped like one. */
 type PgQueryable = {