@vercel/board 0.29.0 → 0.31.0

package/dist/{provider-BaVmi4Hi.mjs → events-lujPA3gQ.mjs}

@@ -1,4 +1,5 @@
-import { n as ExternalEvent } from "./external-D3p5T57R.mjs";
+import { d as LabelKey, p as Labels } from "./schemas-DBmUO6pr.mjs";
+import { n as ExternalEvent, r as ExternalLocation } from "./external-D3p5T57R.mjs";
 import { z } from "zod";
 //#region src/sync/fn.ts
 const ROUTES = Symbol.for("board.syncRoutes");
@@ -122,8 +123,6 @@ var SyncProvider = class {
 	uploadsFiles;
 	startsThreadsWithFiles;
 	fn;
-	/** People's tokens, when the adapter has them: messages they write post as them. */
-	users;
 	options;
 	constructor(options, sync) {
 		if (typeof sync !== "function") throw new Error(`${options.platform} needs a sync function: what each event does, like channels({ '#dev': 'dev' })`);
@@ -131,23 +130,12 @@ var SyncProvider = class {
 		const routes = routesOf(sync);
 		if (routes) routed.set(this, routes);
 		this.options = options;
-		this.users = options.users ?? null;
 		this.platform = options.platform;
 		this.canStartThreads = options.canStartThreads ?? false;
 		this.singleReaction = options.singleReaction ?? false;
 		this.uploadsFiles = options.uploadsFiles ?? false;
 		this.startsThreadsWithFiles = this.uploadsFiles && (options.startsThreadsWithFiles ?? false);
 	}
-	/** The platform account a person's token belongs to. */
-	async whoAmI(_token) {
-		throw new Error(`${this.platform} can't post as a person`);
-	}
-	/** `post`, as the person whose token this is. */
-	async postAs(_token, _target, _kind, _body) {
-		throw new Error(`${this.platform} can't post as a person`);
-	}
-	async editAs(_token, _thread, _message, _body) {}
-	async deleteAs(_token, _thread, _message) {}
 	async findByEmail(_email) {
 		return null;
 	}
@@ -164,8 +152,12 @@ var SyncProvider = class {
 	async permalink(_event) {
 		return null;
 	}
-	/** A linked message the platform didn't describe, read from the platform. */
-	async fetchLink(_link) {
+	/**
+	* A linked message the platform didn't describe, read from the platform. `linker` is the
+	* platform message that links it, by its own IDs: what the platform says about the link may be
+	* there by now.
+	*/
+	async fetchLink(_link, _linker) {
 		return {
 			snapshot: null,
 			unavailable: `${this.platform} can't read it`
@@ -223,4 +215,75 @@ var SyncProvider = class {
 	}
 };
 //#endregion
-export { channelMissing as a, into as c, withRoutes as d, UnreadableError as i, mirror as l, ResolvedTarget as n, routesFor as o, SyncProvider as r, channels as s, ReceivedEvent as t, render as u };
+//#region src/sync/events.ts
+const EventBase = z.object({
+	id: z.string().min(1),
+	platform: z.string().min(1),
+	key: z.string().min(1),
+	...ExternalLocation.shape,
+	raw: z.unknown()
+});
+const eventTypes = {
+	message: "message",
+	edited: "message.edited",
+	deleted: "message.deleted",
+	reaction: "reaction.added",
+	lifecycle: "lifecycle"
+};
+function envelope(platform, key, event, raw, id) {
+	return {
+		...event,
+		...EventBase.parse({
+			id,
+			platform,
+			key,
+			channel: event.channel,
+			thread: event.thread,
+			subthread: "subthread" in event ? event.subthread : null,
+			raw
+		}),
+		type: event.kind === "lifecycle" ? event.type : event.kind === "reaction" && !event.added ? "reaction.removed" : eventTypes[event.kind]
+	};
+}
+function eventSchema(platform, messageType) {
+	const [message, edited, deleted, reaction, lifecycle] = ExternalEvent.options;
+	const common = {
+		...EventBase.shape,
+		platform: z.literal(platform)
+	};
+	return z.discriminatedUnion("kind", [
+		message.extend({
+			...common,
+			type: z.literal(messageType)
+		}),
+		edited.extend({
+			...common,
+			type: z.literal("message.edited")
+		}),
+		deleted.extend({
+			...common,
+			type: z.literal("message.deleted")
+		}),
+		reaction.extend({
+			...common,
+			type: z.enum(["reaction.added", "reaction.removed"])
+		}),
+		lifecycle.extend(common)
+	]);
+}
+const SyncOverrides = z.object({
+	root: z.custom((value) => typeof value === "function").optional(),
+	text: z.string().optional(),
+	labels: Labels.optional(),
+	unset: z.array(LabelKey).optional(),
+	noSync: z.boolean().optional()
+}).strict();
+function immutable(value) {
+	if (value && typeof value === "object") {
+		for (const item of Object.values(value)) immutable(item);
+		Object.freeze(value);
+	}
+	return value;
+}
+//#endregion
+export { immutable as a, SyncProvider as c, routesFor as d, channels as f, withRoutes as g, render as h, eventSchema as i, UnreadableError as l, mirror as m, SyncOverrides as n, ReceivedEvent as o, into as p, envelope as r, ResolvedTarget as s, EventBase as t, channelMissing as u };

package/dist/{exports-BG-0Wyn-.mjs → exports-CWIdN0Ub.mjs}

@@ -1,12 +1,12 @@
 import { t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
 import "./schemas-DBmUO6pr.mjs";
-import { A as SchedulesQuery, B as SyncReceiptBody, C as MatchesQuery, D as Ref, E as ReactBody, F as SyncBody, G as UploadStartBody, H as SyncUnlinkBody, I as SyncCodeBody, L as SyncCopiesQuery, M as SourceJoinBody, N as SourceReadQuery, O as RegisterBody, P as SyncAccountBody, R as SyncFindQuery, S as LinkedQuery, T as PostBody, U as ThreadsQuery, V as SyncRootsQuery, W as TypingBody, _ as InboxAckBody, a as METHODS, b as InboxQuery, c as queryObject, d as VERSION, f as SYNC, g as IdentityUnlinkBody, h as EventsQuery, j as SignInQuery, k as ScheduleBody, l as readCapped, m as EditBody, o as createRouter, p as AckBody, s as openapi, u as readJson, v as InboxNextQuery, w as MessagesQuery, x as LabelBody, y as InboxPushBody, z as SyncImportBody } from "./watchers-hash-BDhLVkV5.mjs";
-import { n as createBoardClient, t as BoardError } from "./client-D0Px7KzF.mjs";
+import { A as RegisterBody, B as ThreadsQuery, C as LabelBody, D as PostBody, E as MessagesQuery, F as SyncBody, H as TypingBody, I as SyncCopiesQuery, L as SyncFindQuery, M as SchedulesQuery, N as SourceJoinBody, O as ReactBody, P as SourceReadQuery, R as SyncImportBody, S as InboxQuery, T as MatchesQuery, U as UploadStartBody, V as TokenBody, _ as EventsQuery, a as METHODS, b as InboxNextQuery, c as queryObject, d as VERSION, f as SYNC, g as EditBody, h as DeleteBody, j as ScheduleBody, k as Ref, l as readCapped, m as CreateChannelBody, o as createRouter, p as AckBody, s as openapi, u as readJson, v as GrantBody, w as LinkedQuery, x as InboxPushBody, y as InboxAckBody, z as SyncReceiptBody } from "./watchers-hash-BjwlnGD9.mjs";
+import { a as forbidden, c as toErrorResponse, d as createBoardClient, l as unauthorized, n as RejectedError, o as json, r as badRequest, s as notFound, t as HttpError, u as BoardError } from "./errors-CJXhhzvT.mjs";
 import { r as derivedId } from "./wait-until-Dw4XrIDQ.mjs";
-import { a as forbidden, c as toErrorResponse, l as unauthorized, n as RejectedError, o as json, r as badRequest, s as notFound, t as HttpError } from "./errors-CusN4x2l.mjs";
-import { d as issuersOf, g as verifiesTokens, l as hostPrincipal, o as createAuthority, s as fromTokens } from "./auth-JO22iIwr.mjs";
-import { i as resolveActor, r as claimsOf, t as KNOWN_AGENTS } from "./actors-DcJhFbwJ.mjs";
-import { r as runMiddleware, t as DroppedError } from "./middleware-CXjEeef4.mjs";
+import { a as scopeOf, i as parseScope, r as compileAccess } from "./access-CY5xVMIK.mjs";
+import { i as resolveActor, r as claimsOf, t as KNOWN_AGENTS } from "./actors-Bm-ojWWT.mjs";
+import { S as verifiesTokens, a as VERCEL_ISSUER, f as grantIssuers, h as issuersOf, l as createAuthority, p as hostPrincipal, u as fromTokens, y as tokenHash } from "./auth-CyO2aw5n.mjs";
+import { r as runMiddleware, t as DroppedError } from "./middleware-BavYSDUa.mjs";
 import { n as syncTarget, r as withEmailMentions, t as mentionsEmails } from "./targets-Cgjs29T0.mjs";
 //#region src/server/policy.ts
 /**
@@ -14,10 +14,11 @@ import { n as syncTarget, r as withEmailMentions, t as mentionsEmails } from "./
 * principals its backend stores. `keeps`: the backend keeps the board, so the defaults let its
 * people and own deployments in when `access` is left out.
 */
-function createPolicy(options, keeps, serving) {
+function createPolicy(options, keeps, serving, trust = null) {
 	/** Whether requests are served at all: a board on `http()` serves none without an `access` of its own. */
 	const open = keeps || options.access !== void 0;
 	const access = options.access ?? [];
+	const grants = trust && typeof access !== "function" ? () => trust.grants() : null;
 	/** The board's own Vercel project and team, from `project` or the environment, asked once. */
 	let own = null;
 	const project = () => (own ??= (async () => {
@@ -49,12 +50,39 @@ function createPolicy(options, keeps, serving) {
 	const authority = createAuthority({
 		access,
 		project,
-		hosts: options.authenticate !== void 0 && !verifiesTokens(options.authenticate)
+		hosts: options.authenticate !== void 0 && !verifiesTokens(options.authenticate),
+		grants
 	});
+	const ruleIssuers = typeof access === "function" ? [] : issuersOf(access);
+	/** One for every request, so a verifier keeps what it built: its issuers change only when grants name new ones. */
 	const context = {
 		project,
-		issuers: typeof access === "function" ? [] : issuersOf(access)
+		issuers: ruleIssuers
 	};
+	/**
+	* Trusts the issuers grants name, before a token from one is verified: only for a token from an
+	* issuer neither Vercel, GitHub, nor a rule is, so most requests read no grants for it.
+	*/
+	async function learnIssuers(credential) {
+		if (!grants) return;
+		const iss = issuerOf(credential);
+		if (iss === null || !iss.startsWith("https://") || iss === "https://token.actions.githubusercontent.com" || VERCEL_ISSUER.test(iss) || ruleIssuers.includes(iss)) return;
+		const named = grantIssuers(await grants());
+		const issuers = [...ruleIssuers, ...named.filter((issuer) => !ruleIssuers.includes(issuer))];
+		if (issuers.join("\n") !== context.issuers.join("\n")) context.issuers = issuers;
+	}
+	/** Who a board token is: the principal that minted it, narrowed, until it's revoked or expires. */
+	async function tokenPrincipal(secret) {
+		if (!trust) throw unauthorized("this board issues no tokens: send a board token to the board that minted it");
+		const found = await trust.token(await tokenHash(secret));
+		if (!found || found.expiresAt.getTime() <= Date.now()) throw unauthorized("invalid token: revoked, expired, or not this board's");
+		return {
+			...found.minter,
+			expiresAt: found.expiresAt,
+			token: found.id,
+			pinned: found.pinned
+		};
+	}
 	/** Verified principals by credential, until they expire, so a stream's polls don't verify from scratch. */
 	const verified = /* @__PURE__ */ new Map();
 	/** And by request, for one with no credential (a session cookie), for as long as it's served. */
@@ -80,7 +108,7 @@ function createPolicy(options, keeps, serving) {
 		const principal = verify(request);
 		perRequest.set(request, principal);
 		if (key !== null) principal.then((found) => {
-			if (found.facts?.issuer === "host" || found.expiresAt === null) return;
+			if (found.facts?.issuer === "host" || found.expiresAt === null || found.token !== void 0) return;
 			if (verified.size >= 1e3) verified.delete(verified.keys().next().value);
 			verified.set(key, {
 				principal,
@@ -90,6 +118,8 @@ function createPolicy(options, keeps, serving) {
 		return principal;
 	}
 	async function verify(request) {
+		if (request.credential?.startsWith("board_")) return tokenPrincipal(request.credential);
+		if (request.credential !== null) await learnIssuers(request.credential);
 		const authenticate = await verifier();
 		let result;
 		try {
@@ -108,6 +138,10 @@ function createPolicy(options, keeps, serving) {
 	return {
 		open,
 		project,
+		/** The OIDC issuers the rules name. */
+		issuers: ruleIssuers,
+		/** Whether grants decide anything here: not where `access` is one function, which decides alone. */
+		takesGrants: typeof access !== "function",
 		discoveryIdentity,
 		/**
 		* Who a request is, and what it may do now: verified, under the rules, with the profile it
@@ -116,11 +150,13 @@ function createPolicy(options, keeps, serving) {
 		*/
 		async identify(request) {
 			const found = await principalOf(request);
-			const principal = request.claims.scope === null ? found : {
+			const claims = found.pinned ? pinnedClaims(found.pinned, request.claims) : request.claims;
+			const scope = found.scope === void 0 ? claims.scope ?? void 0 : claims.scope === null ? found.scope : scopeOf(compileAccess(parseScope(found.scope)).narrow(parseScope(claims.scope)));
+			const principal = scope === void 0 ? found : {
 				...found,
-				scope: request.claims.scope
+				scope
 			};
-			const { author, actor } = resolveActor(principal, request.claims, request.audience);
+			const { author, actor } = resolveActor(principal, claims, request.audience);
 			return {
 				principal: {
 					...principal,
@@ -130,10 +166,38 @@ function createPolicy(options, keeps, serving) {
 				actor
 			};
 		},
-		/** What a stored principal (a schedule's creator, a watcher's registrant) may do now: null once nothing. */
-		accessNow: (principal) => authority.accessNow(principal)
+		/** What a stored principal (a schedule's creator, a watcher's registrant) may do now: null once nothing, its board token's revoking included. */
+		async accessNow(principal) {
+			if (principal.token !== void 0 && !await trust?.live(principal.token)) return null;
+			return authority.accessNow(principal);
+		}
 	};
 }
+/** A board token's pins, over what the request says: its profile and session win, and a person's name is the minter's. */
+function pinnedClaims(pinned, claims) {
+	return {
+		...claims,
+		...pinned.profile !== null ? {
+			profile: pinned.profile,
+			avatar: pinned.avatar
+		} : {},
+		...pinned.session !== null ? { session: pinned.session } : {},
+		handle: pinned.handle,
+		name: pinned.name
+	};
+}
+/** A JWT's `iss`, read but not verified: which issuer's keys would check it. Null for anything else. */
+function issuerOf(credential) {
+	const payload = credential.split(".")[1];
+	if (payload === void 0) return null;
+	try {
+		const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payload.length / 4) * 4, "="));
+		const { iss } = JSON.parse(json);
+		return typeof iss === "string" ? iss : null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/contract/logos.ts
 const LOGOS = {
@@ -183,6 +247,10 @@ const CREATED = /* @__PURE__ */ new Set([
 	"upload",
 	"uploadFinish"
 ]);
+/** An email, as `--mentions` names one: sync looks its platform user up. */
+const EMAIL = /^[^\s@]+@[^\s@]+$/;
+/** How long a filter's email lookup holds. */
+const EMAIL_TTL_MS = 3e5;
 /** Shown inline only when a browser can't run it: everything else downloads. */
 const INLINE = /^(image\/(png|jpeg|gif|webp|avif)|video\/(mp4|webm)|text\/plain)$/;
 /**
@@ -211,13 +279,15 @@ async function inputOf(name, request, url, params) {
 		case "me":
 		case "channels":
 		case "actors":
-		case "identity":
-		case "watchers": return {};
+		case "watchers":
+		case "grants":
+		case "tokens": return {};
 		case "message":
 		case "posted":
 		case "synced":
-		case "delete":
 		case "cancelSchedule":
+		case "revokeGrant":
+		case "revokeToken":
 		case "attachment":
 		case "uploadFinish": return { id };
 		case "messages": return MessagesQuery.parse(queryObject(url));
@@ -231,12 +301,19 @@ async function inputOf(name, request, url, params) {
 			return query;
 		}
 		case "post": return PostBody.parse(await body());
+		case "createChannel": return CreateChannelBody.parse(await body());
 		case "schedule": return ScheduleBody.parse(await body());
+		case "createGrant": return GrantBody.parse(await body());
+		case "createToken": return TokenBody.parse(await body());
 		case "register": return RegisterBody.parse(await body());
 		case "edit": return {
 			id,
 			...EditBody.parse(await body())
 		};
+		case "delete": return {
+			id,
+			...DeleteBody.parse(await body())
+		};
 		case "react": return {
 			id,
 			...ReactBody.parse(await body())
@@ -269,7 +346,6 @@ async function inputOf(name, request, url, params) {
 		case "syncThread": return { thread: params.thread ?? "" };
 		case "syncFind": return SyncFindQuery.parse(queryObject(url));
 		case "syncCopies": return SyncCopiesQuery.parse(queryObject(url));
-		case "syncRoots": return SyncRootsQuery.parse(queryObject(url));
 		case "inboxPush": return {
 			key,
 			...InboxPushBody.parse(await body())
@@ -287,9 +363,6 @@ async function inputOf(name, request, url, params) {
 			key,
 			...InboxQuery.parse(queryObject(url))
 		};
-		case "syncCode": return SyncCodeBody.parse(await body());
-		case "syncAccount": return SyncAccountBody.parse(await body());
-		case "syncUnlink": return SyncUnlinkBody.parse(await body());
 		case "typing": return {
 			id,
 			...TypingBody.parse(await body()) ?? {}
@@ -369,17 +442,48 @@ async function createServe(context) {
 	* board learns who they are; the rest stay plain text.
 	*/
 	async function withEmails(text) {
-		return (await withEmailMentions(text, engine ? async (email) => {
-			const actor = await engine.findByEmail(email);
-			if (actor) await backend.syncImport(engine.caller, {
-				op: "seen",
-				author: {
-					...actor,
-					isBot: false
-				}
-			}, new AbortController().signal);
-			return actor;
-		} : void 0)).text;
+		return (await withEmailMentions(text, engine ? learnEmail : void 0)).text;
+	}
+	/**
+	* The synced platform's user with this email, whom the board learns: a post can mention only
+	* an actor it knows, and a platform mention of them resolves only once it does.
+	*/
+	async function learnEmail(email) {
+		const actor = await engine.findByEmail(email);
+		if (actor) await backend.syncImport(engine.caller, {
+			op: "seen",
+			author: {
+				...actor,
+				isBot: false
+			}
+		}, new AbortController().signal);
+		return actor;
+	}
+	/** Emails filters named, as sync found them, for a few minutes: `tail` and `wait` ask at every page. */
+	const mentioned = /* @__PURE__ */ new Map();
+	/**
+	* `--mentions ada@vercel.com`: the synced platform's user with that email, for a caller that may
+	* read somewhere. Anything else, and an email sync doesn't know, goes on as it came.
+	*/
+	async function withMentioned(caller, query) {
+		const email = query.mentions?.toLowerCase();
+		if (!engine || email === void 0 || !EMAIL.test(email)) return query;
+		const access = accessOf(caller);
+		if (access !== null && !access.anywhere("read")) return query;
+		let found = mentioned.get(email);
+		if (!found || Date.now() - found.at > EMAIL_TTL_MS) {
+			if (mentioned.size >= 1e3) mentioned.clear();
+			found = {
+				at: Date.now(),
+				actor: learnEmail(email).catch(() => null)
+			};
+			mentioned.set(email, found);
+		}
+		const actor = await found.actor;
+		return actor ? {
+			...query,
+			mentions: actor.id
+		} : query;
 	}
 	/**
 	* A sync target as the board that syncs it resolves it. One for an entry this board doesn't
@@ -513,6 +617,25 @@ async function createServe(context) {
 		}));
 	}
 	/**
+	* A schedule, on a backend whose sends post elsewhere: its message through the middleware once,
+	* as the caller's post of it, since its text and labels never change and no send comes back here.
+	*/
+	function screenSchedule(caller, input, signal) {
+		const { channel, re, text, labels, noSync, attachments } = input;
+		return screenPost(caller, {
+			...channel !== void 0 ? { channel } : {},
+			...re !== void 0 ? { re } : {},
+			text,
+			...labels ? { labels } : {},
+			...noSync !== void 0 ? { noSync } : {},
+			...attachments ? { attachments } : {}
+		}, signal, (screened) => backend.schedule(caller, {
+			...input,
+			text: screened.text,
+			...screened.labels ? { labels: screened.labels } : {}
+		}, signal));
+	}
+	/**
 	* The caller's own message, still there, where it may post: what an edit of it changes. One it
 	* can't read may still be its own, as board()'s own code finds it, only if it was written there
 	* without reading too: one its principal wrote where it reads (a repo's workflows share one) is
@@ -709,22 +832,27 @@ async function createServe(context) {
 		switch (name) {
 			case "post": return importPost(caller, input, signal);
 			case "edit": {
-				const { id, text } = input;
+				const { id, text, revision } = input;
 				return change({
 					op: "edit",
 					author,
 					from: null,
 					message: id,
 					text: await withEmails(text),
-					source
+					source,
+					...revision !== void 0 ? { revision } : {}
+				});
+			}
+			case "delete": {
+				const { id, revision } = input;
+				return change({
+					op: "delete",
+					author,
+					from: null,
+					message: id,
+					...revision !== void 0 ? { revision } : {}
 				});
 			}
-			case "delete": return change({
-				op: "delete",
-				author,
-				from: null,
-				message: input.id
-			});
 			case "react": {
 				const { id, emoji, remove } = input;
 				return change({
@@ -737,14 +865,15 @@ async function createServe(context) {
 				});
 			}
 			case "label": {
-				const { id, set, unset } = input;
+				const { id, set, unset, if: expected } = input;
 				return change({
 					op: "labels",
 					author,
 					from: null,
 					message: id,
 					...set ? { set } : {},
-					...unset ? { unset } : {}
+					...unset ? { unset } : {},
+					...expected ? { if: expected } : {}
 				});
 			}
 			default: return invoke(name, me, input, signal);
@@ -780,7 +909,8 @@ async function createServe(context) {
 			...input.labels ? { labels: input.labels } : {},
 			...input.noSync ? { noSync: true } : {},
 			...input.attachments?.length ? { attachments: input.attachments } : {},
-			...input.id !== void 0 ? { id: input.id } : {}
+			...input.id !== void 0 ? { id: input.id } : {},
+			...input.after !== void 0 ? { after: input.after } : {}
 		}, signal));
 		for (const target of targets) await backend.syncReceipt(me, {
 			kind: "thread",
@@ -791,32 +921,36 @@ async function createServe(context) {
 		}, signal);
 		return { message: await read(message) };
 	}
-	/** The protocol method `name`, as board() serves it: what it posts and edits with the emails they mention resolved. */
+	/** The protocol method `name`, as board() serves it: what it posts and edits, and the filters it reads by, with their emails resolved. */
 	async function invoke(name, caller, input, signal) {
+		if (name === "messages" || name === "threads" || name === "events") input = await withMentioned(caller, input);
 		switch (name) {
 			case "post": return post(caller, input, signal);
 			case "edit": {
-				const { id, text } = input;
+				const edit = input;
 				const send = (body) => screenEdit(caller, body, signal, (patched) => backend.edit(caller, patched, signal));
-				if (!engine || !mentionsEmails(text) || !await mayPost(caller, { re: id }, signal)) return send({
-					id,
-					text
-				});
+				if (!engine || !mentionsEmails(edit.text) || !await mayPost(caller, { re: edit.id }, signal)) return send(edit);
 				return send({
-					id,
-					text: await withEmails(text)
+					...edit,
+					text: await withEmails(edit.text)
 				});
 			}
 			case "syncImport": return syncImport(caller, input, signal);
+			case "grants":
+			case "createGrant":
+			case "revokeGrant":
+				if (backend.keeps && !policy.takesGrants) throw new HttpError(501, "no_grants", "this board's access is one function, which decides alone: it keeps no grants");
+				return backend[name].call(backend, caller, input, signal);
 			case "schedule": {
 				const body = input;
+				const schedule = (made) => backend.sendsSchedulesHere === false ? screenSchedule(caller, made, signal) : backend.schedule(caller, made, signal);
 				const allowed = engine && mentionsEmails(body.text) ? await mayPost(caller, body, signal) : null;
-				if (!allowed) return backend.schedule(caller, body, signal);
+				if (!allowed) return schedule(body);
 				const text = await withEmails(body.text);
-				const answer = await backend.schedule(caller, {
+				const answer = await schedule({
 					...body,
 					text
-				}, signal);
+				});
 				const { access } = allowed;
 				return text !== body.text && access !== null && !access.readable(answer.schedule.channel) ? {
 					...answer,
@@ -844,35 +978,6 @@ async function createServe(context) {
 			}
 		}
 	}
-	/**
-	* A sign-in that carries a code, where the entry's sync runs: a browser opens it with no token,
-	* so the code is all it has. `signIn` sends the person to the platform as whoever the code was
-	* issued to; `signedIn`, where the platform sends them back, links the account they approved.
-	*/
-	async function signingIn(name, url, signal) {
-		const { sync: key, code } = SignInQuery.parse(queryObject(url));
-		if (!engine || !entries[key]) throw notFound(`no sync entry named ${key}`);
-		const page = (status, text) => new Response(`${text}\n`, {
-			status,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		});
-		const { holder } = await backend.syncFind(engine.caller, { code }, signal);
-		if (holder === null) return page(404, "That link has expired or been used. Run `vb identity link` again for a new one.");
-		if (name === "signIn") {
-			const back = ownUrl();
-			const at = await engine.signIn(key, holder, back ? `${back}/identity/signed-in?${new URLSearchParams({
-				sync: key,
-				code
-			})}` : void 0);
-			return new Response(null, {
-				status: 302,
-				headers: { location: at }
-			});
-		}
-		const linked = await engine.redeemSignIn(key, holder, code);
-		if (!linked) return page(409, `${entries[key].platform} hasn't said you approved yet: finish signing in, then open this page again.`);
-		return page(200, `Linked ${linked.handle ? `@${linked.handle}` : linked.actor}. You can close this tab.`);
-	}
 	/** board()'s own routes for a caller: sync's, which run where board() does. */
 	async function serve(name, caller, request, url, params) {
 		const signal = request.signal;
@@ -899,19 +1004,6 @@ async function createServe(context) {
 					attached: attached ?? true
 				});
 			}
-			case "identityUnlink": {
-				const body = IdentityUnlinkBody.parse(await readJson(request));
-				const { links } = await backend.identity(caller, {}, signal);
-				const wanted = body.actor.replace(/^@/, "").toLowerCase();
-				const found = links.filter((link) => link.actor === body.actor || link.handle?.toLowerCase() === wanted).map((link) => link.actor);
-				if (found.length === 0) throw notFound(`${body.actor} isn't linked to you`, "not_linked");
-				if (found.length > 1) throw badRequest(`${body.actor} names several of your accounts: use ${found.join(" or ")}`, "ambiguous_actor");
-				await backend.syncUnlink(caller, { account: found[0] }, signal);
-				return json({
-					ok: true,
-					actor: found[0]
-				});
-			}
 			default: throw notFound(`no route: ${request.method} ${url.pathname}`);
 		}
 	}
@@ -1020,7 +1112,6 @@ async function createServe(context) {
 				if (!engine || !entries[match.params.key ?? ""]) throw notFound(`no sync entry named ${match.params.key}`);
 				return await engine.handleWebhook(match.params.key, request);
 			}
-			if (target.kind === "board" && (target.name === "signIn" || target.name === "signedIn")) return await signingIn(target.name, url, request.signal);
 			if (target.kind === "board" && target.name === "avatar") {
 				const name = match.param ?? "";
 				if (!KNOWN_AGENTS.includes(name)) throw notFound(`no avatar: ${name}`);
@@ -1042,10 +1133,11 @@ async function createServe(context) {
 			const caller = own ?? await callerOf(asked);
 			if (target.kind === "board") return await serve(target.name, caller, request, url, match.params);
 			const input = await inputOf(target.name, request, url, match.params);
-			if (target.name === "events" && (request.headers.get("accept") ?? "").includes("text/event-stream")) return await sse(caller, input, request, asked ? () => callerOf(asked) : null);
+			if (target.name === "events" && (request.headers.get("accept") ?? "").includes("text/event-stream")) return await sse(caller, await withMentioned(caller, input), request, asked ? () => callerOf(asked) : null);
 			const output = injected && "platform" in injected ? await asPlatform(target.name, injected, input, request.signal) : await invoke(target.name, caller, input, request.signal);
 			if (target.name === "attachment") return attachmentResponse(output);
-			return json(output, CREATED.has(target.name) ? 201 : 200);
+			const made = CREATED.has(target.name) || target.name === "createChannel" && output.created;
+			return json(output, made ? 201 : 200);
 		} catch (error) {
 			return toErrorResponse(error);
 		}
@@ -1110,7 +1202,7 @@ const EVENTS_WAIT_S = 25;
 */
 function createBoard(options, runtime) {
 	const backend = options.backend ?? runtime.http();
-	const policy = createPolicy(options, backend.keeps, runtime.serving);
+	const policy = createPolicy(options, backend.keeps, runtime.serving, backend.trust ?? null);
 	const watch = options.watch ?? {};
 	const entries = options.sync ?? {};
 	const state = { learned: null };
@@ -1218,8 +1310,7 @@ function createBoard(options, runtime) {
 	/** This board's sync entries, as its sync and discovery see them. */
 	const ownEntries = Object.entries(entries).map(([key, entry]) => ({
 		key,
-		platform: entry.platform,
-		signIn: entry.users !== null
+		platform: entry.platform
 	}));
 	const binding = {
 		subscriptions,
@@ -1252,6 +1343,7 @@ function createBoard(options, runtime) {
 		typing: async (messages, status) => (await server()).typing(messages, status),
 		accessNow: (principal) => policy.accessNow(principal),
 		project: () => policy.project(),
+		issuers: () => policy.issuers,
 		handle: (caller) => handleOf(caller, null),
 		url: ownUrl
 	};

package/dist/exports-FBOQWT7O.d.mts

@@ -0,0 +1,5 @@
+import "./auth-DLYSt_-A.mjs";
+import "./folds-DLUzfibJ.mjs";
+import "./client-COfYrgfV.mjs";
+import "./backend-Bob-5CM7.mjs";
+import "./errors-2vGs49Db.mjs";