@vercel/board 0.29.0 → 0.31.0

package/dist/{main-CVBqe3VO.mjs → main-Dz-8komG.mjs}

@@ -1,14 +1,15 @@
 import { i as fileSize, n as DIRECT_UPLOAD_BYTES_MAX } from "./files-SniSmeEr.mjs";
 import { a as AttachmentId } from "./schemas-DBmUO6pr.mjs";
-import { d as VERSION, i as withMentions } from "./watchers-hash-BDhLVkV5.mjs";
+import { d as VERSION, i as withMentions } from "./watchers-hash-BjwlnGD9.mjs";
 import { n as displayEmoji, r as normalizeEmoji } from "./emoji-CTLpvH-A.mjs";
-import { t as BoardError } from "./client-D0Px7KzF.mjs";
-import { i as groups, n as filters$1, o as options, r as globalOptions, s as usage$1, t as commands } from "./commands-C3R1AWgm.mjs";
-import { a as handFetch, d as vercelProjectFile, n as boardUrl, o as handLogin, r as connect } from "./node-Zd_C-gxP.mjs";
-import { t as http } from "./backend-http-Bmp0IgD3.mjs";
-import { t as board } from "./server-BixV_byP.mjs";
-import { t as conformance } from "./conformance-DlnfuzEB.mjs";
-import { n as handTeam, r as vercel, t as credentialSource } from "./backend-vercel-DQc_TaHp.mjs";
+import { u as BoardError } from "./errors-CJXhhzvT.mjs";
+import { i as groups, n as filters$1, o as options, r as globalOptions, s as usage$1, t as commands } from "./commands-L1JSGz2Z.mjs";
+import { i as parseScope } from "./access-CY5xVMIK.mjs";
+import { a as handFetch, d as vercelProjectFile, n as boardUrl, o as handLogin, r as connect } from "./node-BgeGcwX0.mjs";
+import { t as http } from "./backend-http-D8mUzuKQ.mjs";
+import { t as board } from "./server-DG8D6VV0.mjs";
+import { t as conformance } from "./conformance-DK43HiHf.mjs";
+import { n as handTeam, r as vercel, t as credentialSource } from "./backend-vercel-Ba8JDtqW.mjs";
 import { t as displayText } from "./bots-CGkO76qH.mjs";
 import { spawn } from "node:child_process";
 import { readFile, stat, writeFile } from "node:fs/promises";
@@ -34,7 +35,6 @@ function authorName(message) {
 	if (!author) return message.by.actor;
 	const slash = author.handle.indexOf("/");
 	if (message.by.profile !== null && slash !== -1) return `${author.name} via ${author.handle.slice(0, slash)}`;
-	if (author.person && author.person.handle !== author.handle) return `${author.name} (${author.person.handle})`;
 	return author.name;
 }
 function ago(iso, now = Date.now()) {
@@ -83,7 +83,7 @@ function embed(link, pad) {
 /** One message as a block: header line, indented text, reactions. */
 function formatMessage(message, options = {}) {
 	const pad = options.reply ? "    " : "      ";
-	const head = `${options.reply ? "  ↳ " : ""}#${message.id}  ${authorName(message)} · ${ago(message.createdAt)}${message.editedAt ? " (edited)" : ""}${message.schedule ? ` · scheduled s${message.schedule.id}` : ""}${labels(message)}`;
+	const head = `${options.reply ? "  ↳ " : ""}#${message.id}  ${authorName(message)} · ${ago(message.createdAt)}${message.editedAt ? " (edited)" : ""}${message.schedule ? ` · scheduled ${message.schedule.id}` : ""}${labels(message)}`;
 	const body = message.deleted ? `${pad}(message removed)` : indent(displayText(message.text, message.by.actor), pad);
 	const files = (message.attachments ?? []).map((a) => `${pad}file ${a.name} · ${a.type} · ${fileSize(a.size)} · ${a.id}`);
 	const links = message.deleted ? [] : (message.links ?? []).flatMap((link) => embed(link, pad));
@@ -161,6 +161,36 @@ function formatAccess(access) {
 		return `${pattern.padEnd(width)}  ${permissions.includes("manage") ? "all" : permissions.length === 0 ? "nothing" : permissions.join(" ")}`;
 	});
 }
+/** What a grant or token may do, as `--can` takes it: `dev/=read,post;ci/=read`, or `all`. */
+function formatCan(can) {
+	const patterns = Object.keys(can);
+	if (patterns.length === 1 && patterns[0] === "*" && can["*"].includes("manage")) return "all";
+	if (patterns.length === 0) return "nothing";
+	return patterns.map((pattern) => `${pattern}=${can[pattern].includes("manage") ? "all" : can[pattern].join(",")}`).join(";");
+}
+/** Rows of cells, each column padded to its widest, two spaces apart. */
+const table = (rows) => {
+	const widths = rows[0].map((_, column) => Math.max(...rows.map((row) => row[column].length)));
+	return rows.map((row) => row.map((cell, column) => column === row.length - 1 ? cell : cell.padEnd(widths[column])).join("  ").trimEnd()).join("\n");
+};
+/** Each grant on a row: its ID, its issuer, the claims it matches, and what it lets do. */
+function formatGrants(grants) {
+	return table(grants.map((grant) => [
+		grant.id,
+		grant.issuer,
+		Object.entries(grant.claims).map(([name, value]) => `${name}=${typeof value === "string" ? value : value.join("|")}`).join(" "),
+		formatCan(grant.can)
+	]));
+}
+/** Each token on a row: its ID, its name, what it may do, and when it expires. */
+function formatTokens(tokens, now = Date.now()) {
+	return table(tokens.map((token) => [
+		token.id,
+		token.name,
+		formatCan(token.can),
+		`expires ${until(token.expiresAt, now)}${token.profile !== null ? ` · as ${token.profile}` : ""}${token.parent !== null ? ` · minted with ${token.parent}` : ""}`
+	]));
+}
 /** `90m` → `1h30m`, `1d`: milliseconds as a duration flag would say them. */
 function span(ms) {
 	const parts = [];
@@ -193,7 +223,7 @@ function formatSchedule(schedule, options = {}) {
 	const sent = schedule.sent > 0 ? ` · ${schedule.sent} sent` : "";
 	const files = schedule.attachments.length ? ` · ${schedule.attachments.length} ${schedule.attachments.length === 1 ? "file" : "files"}` : "";
 	const text = displayText(schedule.text, schedule.by.actor);
-	return [`${pad}s${schedule.id}  ${where} · ${repeat}${stop} · ${when}${sent}${files} · by ${authorName(schedule)}`, indent(text || "(no text)", `${pad}    `)].join("\n");
+	return [`${pad}${schedule.id}  ${where} · ${repeat}${stop} · ${when}${sent}${files} · by ${authorName(schedule)}`, indent(text || "(no text)", `${pad}    `)].join("\n");
 }
 /** One line per live event, for `tail` and `wait`. */
 function formatEvent(event) {
@@ -448,9 +478,9 @@ function rows(entries, pad = padOf(entries)) {
 /** An option as help writes it: `--limit <N>`, `-h, --help`, `--label <k[=v|w]>...`. */
 const flag = (option) => `${option.short ? `-${option.short}, ` : ""}--${option.name}${option.value ? option.optionalValue ? ` [${option.value}]` : ` <${option.value}>` : ""}${option.multiple ? "..." : ""}`;
 const shown = (list) => list.filter((option) => !option.hidden);
-/** A command's rows in the list: itself, when it runs alone, and each of its subcommands. */
+/** A command's rows in the list: itself, when it runs alone and no subcommand is what it runs, and each of its subcommands. */
 function listed(command) {
-	return [...!command.subcommands || command.runsWithoutSubcommand ? [[usage$1([command]), command.description]] : [], ...(command.subcommands ?? []).filter((sub) => !sub.hidden).map((sub) => [usage$1([command, sub]), sub.description])];
+	return [...!command.subcommands || command.runsWithoutSubcommand && !command.subcommands.some((sub) => sub.default) ? [[usage$1([command]), command.description]] : [], ...(command.subcommands ?? []).filter((sub) => !sub.hidden).map((sub) => [usage$1([command, sub]), sub.description])];
 }
 /** Every command, by group, then what the app adds (`serve`, `inspect`), and the options they share. */
 function rootHelp(app, version) {
@@ -497,7 +527,7 @@ function commandHelp(name, path) {
 	return lines.join("\n");
 }
 /**
-* The command `words` name, and its subcommand when they name one (`identity link`, `sources slack
+* The command `words` name, and its subcommand when they name one (`schedule cancel`, `sources slack
 * read`): what `--help` shows the page of. Null when the first word names no command.
 */
 function commandPath(words, all) {
@@ -735,7 +765,7 @@ let typed = [];
 let warnings = [];
 /** The board this run reached by its URL, for a failure to name. */
 let reached = null;
-/** The help `words` ask for: a command's page when they name one (`read`, `identity link`), or else every command. */
+/** The help `words` ask for: a command's page when they name one (`read`, `sources read`), or else every command. */
 function help(words = []) {
 	const own = Object.values(app.commands).map((command) => command.spec);
 	const path = commandPath(words, [...commands, ...own]);
@@ -840,7 +870,7 @@ const result = (value) => io.write(`${JSON.stringify(warnings.length ? {
 	...value,
 	warnings
 } : value, null, io.tty ? 2 : void 0)}\n`);
-/** One line of a JSON stream (`tail`, `identity link`): compact, wherever it goes. */
+/** One line of a JSON stream (`tail`): compact, wherever it goes. */
 const line = (value) => io.write(`${JSON.stringify(value)}\n`);
 /** A message's ID as you'd write it: `#812` or `812`. It's passed to the board as it is. */
 function messageId(value, what = "message ID") {
@@ -859,11 +889,18 @@ const tooLarge = (path) => new Failed({
 const isMessageRef = (value) => /^#[^\s/]+$/.test(value) || /^\d+$/.test(value);
 /** A message's ID as it's passed back: bare when it's a number, `#<id>` when it could be a channel's name. */
 const messageRef = (id) => /^\d+$/.test(id) ? id : `#${id}`;
-function labelPairs(values) {
+/** `--if-revision N`, as an edit or a delete takes it. */
+function ifRevision() {
+	const given = flags["if-revision"];
+	if (given === void 0) return {};
+	if (!/^[1-9]\d{0,15}$/.test(given)) throw usage(`--if-revision takes the message's revision, a number, and ${given} isn't one.`);
+	return { revision: Number(given) };
+}
+function labelPairs(values, wrong = "Labels look like key=value, and {value} isn't one.") {
 	const pairs = {};
 	for (const value of values ?? []) {
 		const at = value.indexOf("=");
-		if (at <= 0) throw usage(`Labels look like key=value, and ${value} isn't one.`);
+		if (at <= 0) throw usage(wrong.replace("{value}", value));
 		pairs[value.slice(0, at)] = value.slice(at + 1);
 	}
 	return pairs;
@@ -895,12 +932,36 @@ async function attachments(board) {
 	}));
 	return uploaded;
 }
-/** `s12` or `12`. */
+/** A schedule's ID as the board gave it: `s12`, or `sch_…` on Vercel's board. */
 function scheduleId(value) {
-	const id = value?.replace(/^s(?=\d)/i, "") ?? "";
 	if (value === void 0) throw usage("Missing the schedule ID, like s12.", { reason: "missing_arguments" });
-	if (!/^[^\s/]+$/.test(id)) throw usage(`${value} isn't a schedule ID like s12.`);
-	return id;
+	if (!/^[^\s/]+$/.test(value)) throw usage(`${value} isn't a schedule ID like s12.`);
+	return value;
+}
+/** A grant's or token's ID as the board gave it: `g3`, `t12`, or another board's own. */
+function trustId(what, value) {
+	const like = what === "grant" ? "g3" : "t12";
+	if (value === void 0) throw usage(`Missing the ${what} ID, like ${like}.`, { reason: "missing_arguments" });
+	if (!/^[^\s/]+$/.test(value)) throw usage(`${value} isn't a ${what} ID like ${like}.`);
+	return value;
+}
+/** `--can`, as `x-board-scope` writes it: `dev/=read,post;ci/=read`. */
+function canFlag(value) {
+	try {
+		return parseScope(value);
+	} catch (error) {
+		throw usage(`${error.message.replace(/x-board-scope/g, "--can")}.`);
+	}
+}
+/** `--claim k=v`, each again: the same name twice is any of its values. */
+function claimPairs(values) {
+	const claims = {};
+	for (const value of values ?? []) {
+		const at = value.indexOf("=");
+		if (at <= 0 || at === value.length - 1) throw usage(`Claims look like name=value, and ${value} isn't one.`);
+		(claims[value.slice(0, at)] ??= []).push(value.slice(at + 1));
+	}
+	return Object.fromEntries(Object.entries(claims).map(([name, list]) => [name, list.length === 1 ? list[0] : list]));
 }
 /** A time flag: anything `Date` reads, as ISO. */
 function instant(flag, value) {
@@ -970,11 +1031,12 @@ function doing() {
 		case "typing": return `show typing in ${ref(a)}`;
 		case "sync": return b === void 0 ? `list where ${ref(a)} is synced` : `sync ${ref(a)} with ${b}`;
 		case "schedule": return a === "cancel" ? `cancel schedule ${b}` : `schedule a message in ${message ? ref(a) : a ?? "a channel"}`;
+		case "channels": return a === "create" ? `create ${b ?? "the channel"}` : "list channels";
 		case "schedules":
-		case "channels":
 		case "actors": return `list ${command}`;
+		case "grants": return a === "create" ? `grant ${b ?? "an issuer"}` : a === "revoke" ? `revoke grant ${b}` : "list grants";
+		case "tokens": return a === "create" ? `mint token ${b ?? ""}`.trimEnd() : a === "revoke" ? `revoke token ${b}` : "list tokens";
 		case "sources": return b === void 0 ? "list sources" : `${b} ${c ?? "it"} on ${a}`;
-		case "identity": return a === "link" ? `link your account on ${b}` : a === "unlink" ? `unlink ${b}` : "list your linked accounts";
 		case "download": return `download ${a ?? "the attachment"}`;
 		case "inbox": return `read ${a}'s inbox`;
 		case "tail": return `follow ${a ?? "the board"}`;
@@ -1007,6 +1069,7 @@ function missing() {
 		"schedule"
 	].includes(command) && isMessageRef(a)) return `message ${ref(a)}`;
 	if (command === "schedule" && a === "cancel" && b !== void 0) return `schedule ${b}`;
+	if ((command === "grants" || command === "tokens") && a === "revoke" && b !== void 0) return `${command === "grants" ? "grant" : "token"} ${b}`;
 	if (command === "download") return `attachment ${a}`;
 }
 /**
@@ -1109,7 +1172,7 @@ function failureOf(error) {
 	});
 	const specific = (fallback) => /^[a-z]+(_[a-z]+)+$/.test(code) && code !== "invalid_request" && code !== "remote_error" ? code : fallback;
 	if (status === 400) return theirs("usage", specific("invalid_arguments"), `Can't ${doing()}.`);
-	if (status === 401) return theirs("auth", "login_required", "The board didn't accept your credentials.", [{
+	if (status === 401) return theirs("auth", "login_required", "The board didn't accept your credentials.", process.env.BOARD_TOKEN ? [{ instruction: "Pass a token it accepts in BOARD_TOKEN, or unset it" }] : [{
 		instruction: "Log in again",
 		argv: ["vercel", "login"]
 	}]);
@@ -1121,7 +1184,37 @@ function failureOf(error) {
 			details: []
 		} : theirs("not_found", specific("not_found"), `Can't ${doing()}.`);
 	}
-	if (status === 409) return theirs("conflict", specific("conflict"), `Can't ${doing()}.`);
+	if (status === 409) {
+		const { args } = current;
+		const newer = code === "newer_message" && flags.after !== void 0 && args[0] !== void 0;
+		const labeled = code === "label_conflict" && (flags.if !== void 0 || flags["if-unset"] !== void 0) && args[0] !== void 0;
+		const changed = code === "revision_conflict" && flags["if-revision"] !== void 0 && args[0] !== void 0;
+		return theirs("conflict", specific("conflict"), `Can't ${doing()}.`, newer ? [{
+			instruction: `Read what came after ${ref(flags.after)}`,
+			argv: [
+				...cli(),
+				"read",
+				args[0].replace(/^#/, ""),
+				"--after",
+				flags.after.replace(/^#/, "")
+			]
+		}] : labeled ? [{
+			instruction: "See its labels now",
+			argv: [
+				...cli(),
+				"read",
+				args[0].replace(/^#/, "")
+			]
+		}] : changed ? [{
+			instruction: "Read it as it is now",
+			argv: [
+				...cli(),
+				"read",
+				args[0].replace(/^#/, ""),
+				"--json"
+			]
+		}] : []);
+	}
 	if (status === 413) return theirs("limit", "payload_too_large", `Can't ${doing()}. It's too large for the board.`);
 	if (status === 429) return theirs("rate_limit", "rate_limited", "Too many requests to the board. Try again in a minute.");
 	if (status === 501) return theirs("platform", specific("not_supported"), `Can't ${doing()}. This board doesn't support it.`);
@@ -1174,7 +1267,10 @@ function connection(url = flags.url, options = {}) {
 	const team = flags.scope ?? flags.team;
 	const configured = url ?? (team === void 0 ? configuredUrl() : null);
 	if (configured === null) {
-		const board$1 = board({ backend: vercel(team !== void 0 ? { team } : {}) });
+		const board$1 = board({ backend: vercel({
+			...team !== void 0 ? { team } : {},
+			...sending(options.token)
+		}) });
 		return {
 			url: null,
 			transport: { source: credentialSource },
@@ -1185,7 +1281,10 @@ function connection(url = flags.url, options = {}) {
 	reached = at;
 	const onVercel = vercelBoard(at);
 	if (onVercel) {
-		const board$3 = board({ backend: vercel(onVercel) });
+		const board$3 = board({ backend: vercel({
+			...onVercel,
+			...sending(options.token)
+		}) });
 		return {
 			url: at,
 			transport: { source: credentialSource },
@@ -1204,6 +1303,15 @@ function connection(url = flags.url, options = {}) {
 		board: profile !== void 0 ? board$2.as(profile) : board$2
 	};
 }
+/** For Vercel's API, `token` in place of your own credentials: a board token's secret. */
+function sending(token) {
+	if (token === void 0) return {};
+	return { fetch: (input, init) => {
+		const request = new Request(input, init);
+		request.headers.set("authorization", `Bearer ${token}`);
+		return globalThis.fetch(request);
+	} };
+}
 /** A handle on the board this command talks to: `vb()`'s, as `--as` says, or the one `connection()` finds. */
 function client() {
 	if (!io.board) return connection().board;
@@ -1287,94 +1395,6 @@ function portFlag() {
 	if (port !== void 0 && !(Number.isInteger(port) && port >= 0 && port <= 65535)) throw usage(`${flags.port} isn't a port.`, { reason: "invalid_port" });
 	return port;
 }
-/** How long `identity link` waits for the sign-in or the code. */
-const LINK_WAIT_MS = 6e5;
-async function identity(args) {
-	const board = client();
-	const [sub, target] = args;
-	if (sub === void 0) {
-		const view = await board.identity();
-		if (flags.json) return result(view), 0;
-		if (view.links.length === 0) out("no linked accounts");
-		for (const link of view.links) out(`${link.handle ? `@${link.handle}  ` : ""}${link.actor}  by ${link.method === "code" ? "code" : "sign-in"} · ${link.at}`);
-		if (view.unlinked?.length) out(`not linked  ${view.unlinked.join(", ")}  (${named()} identity link <key>)`);
-		return 0;
-	}
-	if (sub === "unlink") {
-		if (!target) throw usage(`Missing the account to unlink: a handle or actor ID from \`${named()} identity\`.`, { reason: "missing_arguments" });
-		if (args.length !== 2) throw usage("identity unlink takes one account.");
-		const unlinked = await board.unlinkAccount(target);
-		if (flags.json) result({
-			...unlinked,
-			outcome: "unlinked"
-		});
-		else out(`unlinked ${unlinked.actor}`);
-		return 0;
-	}
-	if (sub !== "link") throw usage(`Unknown command ${sub} for ${named()} identity.`, { reason: "unknown_command" });
-	if (!target) throw usage("Missing the sync entry to link your account on, such as slack.", { reason: "missing_arguments" });
-	if (args.length !== 2) throw usage("identity link takes one sync entry.");
-	const before = new Set((await board.identity()).links.map((link) => `${link.actor}|${link.at}`));
-	const platform = (await board.discovery().catch(() => null))?.sync.find((entry) => entry.key === target)?.platform ?? target;
-	const { code, expiresAt, signIn } = await board.syncCode(target);
-	const consent = signIn !== void 0 && !flags.code;
-	if (consent && browsable(signIn) === null) throw new Failed({
-		class: "platform",
-		reason: "invalid_sign_in",
-		message: "The board's sign-in isn't an http or https URL.",
-		details: [JSON.stringify(signIn)],
-		data: { signIn }
-	});
-	if (flags.json) line({
-		type: "code",
-		sync: target,
-		platform,
-		code,
-		expiresAt,
-		...signIn !== void 0 ? { signIn } : {}
-	});
-	const until = Date.now() + LINK_WAIT_MS;
-	const sleep = () => new Promise((resolve) => setTimeout(resolve, 2e3));
-	/** An account linked on that platform since this run began: where the code or the sign-in landed. */
-	const linkedSince = async () => (await board.identity()).links.find((link) => link.actor.startsWith(`${platform}:user:`) && !before.has(`${link.actor}|${link.at}`));
-	if (consent) {
-		if (!flags.json) {
-			out(`Sign in to ${platform} as yourself to link it (and to post as you there):\n\n  ${signIn}\n`);
-			out(`Only open it yourself: whoever completes it links their account to you.`);
-		}
-		if (!flags["no-open"] && !flags.json) openBrowser(signIn);
-	} else if (!flags.json) {
-		const minutes = Math.round((Date.parse(expiresAt) - Date.now()) / 6e4);
-		out(`From your ${platform} account, post this as a message anywhere the board syncs, within ${minutes} minutes:\n\n  ${code}\n`);
-	}
-	if (flags["no-wait"]) return 0;
-	while (Date.now() < Math.min(until, consent ? Infinity : Date.parse(expiresAt))) {
-		await sleep();
-		const linked = await linkedSince();
-		if (linked) {
-			if (flags.json) line({
-				type: "linked",
-				account: linked
-			});
-			else out(`linked ${linked.handle ? `@${linked.handle} ` : ""}(${linked.actor})`);
-			return 0;
-		}
-	}
-	throw new Failed({
-		class: "timeout",
-		reason: "timeout",
-		message: consent ? "Nothing linked an account within 10 minutes." : "The code expired before a message carried it.",
-		next: [{
-			instruction: "Try again",
-			argv: [
-				...cli(),
-				"identity",
-				"link",
-				target
-			]
-		}]
-	});
-}
 async function run(command, args) {
 	switch (command) {
 		case void 0:
@@ -1410,12 +1430,31 @@ async function run(command, args) {
 		}
 		case "conformance": {
 			if (args.length > 0) throw usage("conformance takes no arguments: pass its channel with --channel.");
-			const report = await conformance(client(), flags.channel ? { channel: flags.channel } : {});
+			const withToken = io.board ? {} : { withToken: (secret) => connection(flags.url, { token: secret }).board };
+			const report = await conformance(client(), {
+				...flags.channel ? { channel: flags.channel } : {},
+				...withToken
+			});
 			if (flags.json) result(report);
 			else out(formatConformance(report));
 			return report.ok ? 0 : 1;
 		}
 		case "channels": {
+			const [sub, ...rest] = args;
+			if (sub === "create") {
+				const [path, extra] = rest;
+				if (!path) throw usage("Missing the channel to create, such as dev/alerts.", { reason: "missing_arguments" });
+				if (extra !== void 0) throw usage(`channels create takes one channel: ${extra} is one too many.`);
+				const { channel, created } = await client().createChannel(path);
+				if (flags.json) result({
+					channel,
+					outcome: created ? "created" : "unchanged"
+				});
+				else out(created ? `created ${channel.path}` : `${channel.path} already exists`);
+				return 0;
+			}
+			if (sub !== void 0 && sub !== "list") throw usage(`Unknown command ${sub} for ${named()} channels.`, { reason: "unknown_command" });
+			if (rest.length > 0) throw usage(`channels list takes no arguments: ${rest[0]} is one too many.`);
 			const channels = await client().channels();
 			if (flags.json) return result({ channels }), 0;
 			if (channels.length === 0) return out("no channels yet"), 0;
@@ -1427,17 +1466,18 @@ async function run(command, args) {
 					group = prefix;
 				}
 				const count = (n, one, many) => `${n} ${n === 1 ? one : many}`;
-				out(`${prefix ? "  " : ""}${channel.path}  ${count(channel.threads, "thread", "threads")} · ${count(channel.messages, "message", "messages")} · last #${channel.lastIndex}`);
+				const { threads, messages, lastIndex } = channel;
+				const counted = threads !== void 0 && messages !== void 0 ? `  ${count(threads, "thread", "threads")} · ${count(messages, "message", "messages")}${lastIndex ? ` · last #${lastIndex}` : ""}` : "";
+				out(`${prefix ? "  " : ""}${channel.path}${counted}`);
 			}
 			return 0;
 		}
 		case "actors": {
 			const actors = await client().actors();
 			if (flags.json) return result({ actors }), 0;
-			for (const actor of actors) out(`@${actor.handle}  ${actor.name}  ${actor.id}${actor.person ? `  → @${actor.person.handle}` : ""}`);
+			for (const actor of actors) out(`@${actor.handle}  ${actor.name}  ${actor.id}`);
 			return 0;
 		}
-		case "identity": return identity(args);
 		case "read": {
 			const target = args[0];
 			const board = client();
@@ -1506,6 +1546,7 @@ async function run(command, args) {
 				]
 			}] });
 			if (flags.sync?.length && flags["no-sync"]) throw usage("Can't use --sync with --no-sync.");
+			if (re === void 0 && flags.after !== void 0) throw usage("Can't use --after on a new thread. It's for replies: the thread's newest message.");
 			const board = client();
 			const content = body === void 0 && flags.attach?.length ? "" : await text(body);
 			const files = await attachments(board);
@@ -1519,7 +1560,10 @@ async function run(command, args) {
 			const message = re === void 0 ? await board.post(target, {
 				...options,
 				...flags.sync?.length ? { sync: flags.sync } : {}
-			}) : await board.reply(re, options);
+			}) : await board.reply(re, {
+				...options,
+				...flags.after !== void 0 ? { after: messageId(flags.after) } : {}
+			});
 			warnUnknownMentions(message.unknownMentions);
 			printMessage(message);
 			return 0;
@@ -1533,7 +1577,8 @@ async function run(command, args) {
 				text: content,
 				...files.length ? { attachments: files } : {},
 				...flags["idempotency-key"] ? { id: flags["idempotency-key"] } : {},
-				...flags["no-sync"] ? { noSync: true } : {}
+				...flags["no-sync"] ? { noSync: true } : {},
+				...flags.after !== void 0 ? { after: messageId(flags.after) } : {}
 			});
 			warnUnknownMentions(message.unknownMentions);
 			printMessage(message);
@@ -1546,7 +1591,7 @@ async function run(command, args) {
 					schedule,
 					outcome: canceled ? "canceled" : "unchanged"
 				});
-				else out(canceled ? `canceled s${schedule.id}` : `s${schedule.id} is already ${schedule.state}`);
+				else out(canceled ? `canceled ${schedule.id}` : `${schedule.id} is already ${schedule.state}`);
 				return 0;
 			}
 			const [target, body] = args;
@@ -1579,6 +1624,80 @@ async function run(command, args) {
 			else out(formatSchedule(schedule));
 			return 0;
 		}
+		case "grants": {
+			const [verb, ...rest] = args;
+			if (verb === void 0 || verb === "list") {
+				if (rest.length > 0) throw usage(`grants list takes no arguments: ${rest[0]} is one too many.`);
+				const list = await client().grants();
+				if (flags.json) return result({ grants: list }), 0;
+				out(list.length === 0 ? "no grants" : formatGrants(list));
+				return 0;
+			}
+			if (verb === "revoke") {
+				const id = trustId("grant", rest[0]);
+				const { revoked } = await client().revokeGrant(id);
+				if (flags.json) result({
+					grant: id,
+					outcome: revoked ? "revoked" : "unchanged"
+				});
+				else out(revoked ? `revoked ${id}` : `${id} is already gone`);
+				return 0;
+			}
+			if (verb !== "create") throw usage(`Unknown command ${verb} for ${named()} grants.`, { reason: "unknown_command" });
+			const [issuer, extra] = rest;
+			if (!issuer) throw usage("Missing the issuer to grant: vercel, github, or an https URL.", { reason: "missing_arguments" });
+			if (extra !== void 0) throw usage(`grants create takes one issuer, and its claims as --claim name=value: ${extra} is one too many.`);
+			const claims = claimPairs(flags.claim);
+			if (Object.keys(claims).length === 0) throw usage(`Missing the claims ${issuer}'s tokens must carry: pass --claim name=value.`, { reason: "missing_arguments" });
+			const { grant, created } = await client().createGrant({
+				issuer,
+				claims,
+				...flags.can !== void 0 ? { can: canFlag(flags.can) } : {}
+			});
+			if (flags.json) result({
+				grant,
+				outcome: created ? "granted" : "updated"
+			});
+			else out(`${created ? "granted" : "updated"} ${grant.id}`);
+			return 0;
+		}
+		case "tokens": {
+			const [verb, ...rest] = args;
+			if (verb === void 0 || verb === "list") {
+				if (rest.length > 0) throw usage(`tokens list takes no arguments: ${rest[0]} is one too many.`);
+				const list = await client().tokens();
+				if (flags.json) return result({ tokens: list }), 0;
+				out(list.length === 0 ? "no tokens" : formatTokens(list));
+				return 0;
+			}
+			if (verb === "revoke") {
+				const id = trustId("token", rest[0]);
+				const { revoked } = await client().revokeToken(id);
+				if (flags.json) result({
+					token: id,
+					outcome: revoked ? "revoked" : "unchanged"
+				});
+				else out(revoked ? `revoked ${id}` : `${id} isn't a live token of yours`);
+				return 0;
+			}
+			if (verb !== "create") throw usage(`Unknown command ${verb} for ${named()} tokens.`, { reason: "unknown_command" });
+			const [name, extra] = rest;
+			if (!name) throw usage("Missing a name for the token, like feedback-widget.", { reason: "missing_arguments" });
+			if (extra !== void 0) throw usage(`tokens create takes one name: ${extra} is one too many.`);
+			const { token, secret } = await client().createToken({
+				name,
+				...flags.can !== void 0 ? { can: canFlag(flags.can) } : {},
+				...flags.profile !== void 0 ? { profile: flags.profile } : {},
+				...flags.session !== void 0 ? { session: flags.session } : {},
+				...flags.expires !== void 0 ? { expires: flags.expires } : {}
+			});
+			if (flags.json) result({
+				token,
+				secret
+			});
+			else out(secret);
+			return 0;
+		}
 		case "schedules": {
 			const list = await client().schedules({
 				...args[0] ? { re: messageId(args[0]) } : {},
@@ -1630,14 +1749,14 @@ async function run(command, args) {
 		case "hook": return 0;
 		case "edit": {
 			const id = messageId(args[0]);
-			const { unknownMentions } = await client().edit(id, await text(args[1]));
+			const { unknownMentions } = await client().edit(id, await text(args[1]), ifRevision());
 			warnUnknownMentions(unknownMentions);
 			printDone(id, "edited");
 			return 0;
 		}
 		case "delete": {
 			const id = messageId(args[0]);
-			await client().delete(id);
+			await client().delete(id, ifRevision());
 			printDone(id, "deleted");
 			return 0;
 		}
@@ -1659,9 +1778,15 @@ async function run(command, args) {
 			const set = labelPairs(args.slice(1));
 			const unset = flags.unset ?? [];
 			if (Object.keys(set).length === 0 && unset.length === 0) throw usage("Missing the labels: k=v to set one, --unset k to remove one.", { reason: "missing_arguments" });
+			const expected = labelPairs(flags.if, "--if takes key=value, and {value} isn't one. For a label that mustn't be set, --if-unset key.");
+			for (const key of flags["if-unset"] ?? []) {
+				if (Object.hasOwn(expected, key)) throw usage(`Can't use --if ${key}=… with --if-unset ${key}.`);
+				expected[key] = null;
+			}
 			await client().label(id, {
 				set,
-				unset
+				unset,
+				...Object.keys(expected).length ? { if: expected } : {}
 			});
 			printDone(id, "labeled");
 			return 0;
@@ -1888,7 +2013,6 @@ async function runOnce(argv, options) {
 /** The commands about the machine the CLI runs on, not the board: none of them run in-process. */
 const MACHINE = /* @__PURE__ */ new Set([
 	"whoami",
-	"identity",
 	"hooks",
 	"hook",
 	"serve",

package/dist/{middleware-CXjEeef4.mjs → middleware-BavYSDUa.mjs}

@@ -1,5 +1,5 @@
 import { m as MESSAGE_TEXT_MAX, p as Labels } from "./schemas-DBmUO6pr.mjs";
-import { t as HttpError } from "./errors-CusN4x2l.mjs";
+import { t as HttpError } from "./errors-CJXhhzvT.mjs";
 import { z } from "zod";
 //#region src/server/middleware.ts
 /** A write the middleware didn't let through: the API answers 422 with what it responded. */

package/dist/{node-Zd_C-gxP.mjs → node-BgeGcwX0.mjs}

@@ -1,4 +1,4 @@
-import { t as BoardError } from "./client-D0Px7KzF.mjs";
+import { u as BoardError } from "./errors-CJXhhzvT.mjs";
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, readdir, stat, unlink, writeFile } from "node:fs/promises";
@@ -496,12 +496,16 @@ function guarded(url, doFetch, suppliedToken) {
 			envRejected = true;
 		}
 		if (process.env.VERCEL === "1") {
+			let edgeless = false;
 			if (!headers.has("x-vercel-trusted-oidc-idp-token")) {
 				const token = headers.get("authorization")?.match(/^Bearer (.+)$/i)?.[1] ?? (typeof suppliedToken === "function" ? await suppliedToken() : suppliedToken) ?? (process.env.BOARD_TOKEN || await hostedToken(url));
-				headers.set("x-vercel-trusted-oidc-idp-token", token);
+				const edge = token.startsWith("board_") ? await hostedToken(url).catch(() => null) : token;
+				if (edge === null) edgeless = true;
+				else headers.set("x-vercel-trusted-oidc-idp-token", edge);
 			}
 			return through(doFetch, input, init, null).catch((error) => {
-				throw error instanceof Wall ? new BoardError("protected", `${url} is behind Vercel Deployment Protection, and it rejected this deployment's Vercel OIDC token.`, error.status, { hint: "Add this project and environment to the board project's Deployment Protection Trusted Sources." }) : error;
+				if (!(error instanceof Wall)) throw error;
+				throw edgeless ? new BoardError("protected", `${url} is behind Vercel Deployment Protection, and this deployment has no Vercel OIDC token to get through it.`, error.status, { hint: "Enable OIDC on its project, and add it to the board project's Deployment Protection Trusted Sources." }) : new BoardError("protected", `${url} is behind Vercel Deployment Protection, and it rejected this deployment's Vercel OIDC token.`, error.status, { hint: "Add this project and environment to the board project's Deployment Protection Trusted Sources." });
 			});
 		}
 		const used = await (secret ??= readBypass(host));

package/dist/{platform-B4TnJtWu-CwcTyKg2.mjs → platform-B4TnJtWu-Do3agKr5.mjs}

@@ -1,4 +1,4 @@
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/platform-B4TnJtWu.js
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/platform-B4TnJtWu.js
 const SYMBOL_FOR_REQ_CONTEXT = Symbol.for("@vercel/request-context");
 function requestContext() {
 	try {

package/dist/{project-CBXlLftU.mjs → project-CQ4VUibA.mjs}

@@ -1,5 +1,5 @@
 import { n as setOwn, t as own } from "./own-OwgPWdmh.mjs";
-import { n as foldMessages, r as foldSync } from "./folds-BDMSxBUf.mjs";
+import { n as foldMessages, r as foldSync } from "./folds-Cu9Q9zyQ.mjs";
 //#region src/store/project.ts
 /** The message an event concerns, if any. */
 function concernedMessageId(event) {