@vercel/board 0.29.0 → 0.31.0

package/dist/{a2-HUbQJ0RD.mjs → a2-DngWY2Eb.mjs}

@@ -1,31 +1,31 @@
 import { r as IMPORT_BYTES_MAX, t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
-import { _ as RemoteWatcherId, b as actorKind, x as platformAvatar } from "./schemas-DBmUO6pr.mjs";
+import { _ as RemoteWatcherId, b as actorKind, v as SCOPE_MAX, x as platformAvatar } from "./schemas-DBmUO6pr.mjs";
 import "./external-D3p5T57R.mjs";
-import { a as METHODS, d as VERSION, f as SYNC, n as compileWatcher, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-BDhLVkV5.mjs";
-import { r as duration, t as BoardError } from "./client-D0Px7KzF.mjs";
+import { a as METHODS, d as VERSION, f as SYNC, n as compileWatcher, r as hasCriteria, t as canonicalWatchers } from "./watchers-hash-BjwlnGD9.mjs";
+import { a as forbidden, c as toErrorResponse, f as duration, i as duplicateId, l as unauthorized, r as badRequest, s as notFound, t as HttpError, u as BoardError } from "./errors-CJXhhzvT.mjs";
 import { i as isKeyIdOf, r as derivedId, t as waitUntil } from "./wait-until-Dw4XrIDQ.mjs";
-import { a as forbidden, c as toErrorResponse, i as duplicateId, r as badRequest, s as notFound, t as HttpError } from "./errors-CusN4x2l.mjs";
+import { a as scopeOf, i as parseScope, n as authorize, r as compileAccess, t as FULL_ACCESS } from "./access-CY5xVMIK.mjs";
 import { t as own } from "./own-OwgPWdmh.mjs";
 import { n as replaceMentions } from "./mentions-CB6ShY4R.mjs";
-import { _ as FULL_ACCESS, i as authenticates, v as authorize } from "./auth-JO22iIwr.mjs";
-import { a as resolveMentions, n as actorSeen } from "./actors-DcJhFbwJ.mjs";
-import { n as MIDDLEWARE_ACTOR, t as DroppedError } from "./middleware-CXjEeef4.mjs";
+import { a as resolveMentions, n as actorSeen } from "./actors-Bm-ojWWT.mjs";
+import { C as wroteAs, f as grantIssuers, n as DEFAULT_CAN, o as authenticates, s as checkGrant, t as BOARD_TOKEN_PREFIX, y as tokenHash } from "./auth-CyO2aw5n.mjs";
+import { n as MIDDLEWARE_ACTOR, t as DroppedError } from "./middleware-BavYSDUa.mjs";
 import { n as syncTarget, r as withEmailMentions } from "./targets-Cgjs29T0.mjs";
-import { t as A2Error } from "./session-clear-wHd5GCpZ-BnKSxReK.mjs";
-import { a as reducer } from "./reducer-CjmvZSAb-D_OSISmj.mjs";
-import { _ as BOARD_SESSION, a as IDENTITY_SESSION, c as SCHEDULES_SESSION, d as inboxContract, f as inboxSession, g as watchSession, h as watchContract, l as boardContract, m as schedulesContract, n as channelsReducer, o as INBOXES_SESSION, p as registryContract, r as identityCodesReducer, s as REGISTRY_SESSION, t as actorsReducer, u as identityContract } from "./reducers-DJzVpXwM.mjs";
-import { n as createServer, t as consumer } from "./server-DtFrWxi3-Boa6gdWO.mjs";
-import { a as linkedTo, i as iso, n as foldMessages, o as personOf, t as foldActors } from "./folds-BDMSxBUf.mjs";
-import { c as readUpload, i as finishUpload, l as startUpload, n as attachmentNotFound, t as attachmentBody, u as writeUpload } from "./blob-DdbpJqN1.mjs";
-import { t as concernedMessageId } from "./project-CBXlLftU.mjs";
-import { t as TABLES_CONSUMER } from "./sql-D4Z_efJX.mjs";
+import { t as A2Error } from "./session-clear-XJYpmUpg-2q8l_FJR.mjs";
+import { a as reducer } from "./reducer-Bswr11ar-P324o9vn.mjs";
+import { a as INBOXES_SESSION, c as accessContract, d as inboxSession, f as registryContract, g as BOARD_SESSION, h as watchSession, i as ACCESS_SESSION, l as boardContract, m as watchContract, n as channelsReducer, o as REGISTRY_SESSION, p as schedulesContract, s as SCHEDULES_SESSION, t as actorsReducer, u as inboxContract } from "./reducers-DcENwtwZ.mjs";
+import { n as createServer, t as consumer } from "./server-DX7mM6nm-D7N_7bug.mjs";
+import { i as iso, n as foldMessages, t as foldActors } from "./folds-Cu9Q9zyQ.mjs";
+import { c as ownUpload, d as writeUpload, i as finishUpload, l as readUpload, n as attachmentNotFound, t as attachmentBody, u as startUpload } from "./blob-WbB2DJKn.mjs";
+import { t as concernedMessageId } from "./project-CQ4VUibA.mjs";
+import { t as TABLES_CONSUMER } from "./sql-CT5xVuGr.mjs";
 import { t as afterRetry } from "./attempts-HXcskN1w.mjs";
 import { createHash, randomBytes } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { lookup } from "node:dns";
 import { request } from "node:https";
 import { BlockList, isIP } from "node:net";
-//#region ../../node_modules/.pnpm/experimental-a2@0.22.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__52060f00b21aecfab049c27fa3abd2f9/node_modules/experimental-a2/dist/idempotent-id-BRJVeylj.js
+//#region ../../node_modules/.pnpm/experimental-a2@0.24.0_@upstash+qstash@2.12.0_@vercel+queue@0.7.0_ai@7.0.130_zod@4.6.5__b1e2c243a963f2620a5d202817417c26/node_modules/experimental-a2/dist/idempotent-id-BRJVeylj.js
 async function idempotentId(...parts) {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(parts)));
 	const bytes = new Uint8Array(digest).slice(0, 16);
@@ -35,6 +35,350 @@ async function idempotentId(...parts) {
 	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
 }
 //#endregion
+//#region src/server/trust.ts
+/** How long a token lives when its minter doesn't say, and at most: npm caps its write tokens at 90 days. */
+const TOKEN_DEFAULT_MS = 2592e6;
+/** How deep tokens minted with tokens go: each request walks the chain to its root. */
+const TOKEN_DEPTH_MAX = 8;
+const DAY_MS = 864e5;
+/** What makes two grants one: the issuer, and the claims with their names sorted. */
+const grantKey = (issuer, claims) => JSON.stringify([issuer, Object.keys(claims).sort().map((name) => [name, claims[name]])]);
+function dropToken(state, id) {
+	const row = state.tokens[id];
+	if (!row) return;
+	delete state.hashes[row.hash];
+	delete state.tokens[id];
+}
+/** Whether token `id` is token `ancestor`, or was minted with it at any depth. */
+function mintedWith(state, id, ancestor) {
+	let at = id;
+	for (let depth = 0; at !== null && depth <= TOKEN_DEPTH_MAX; depth++) {
+		if (at === ancestor) return true;
+		at = state.tokens[at]?.parent ?? null;
+	}
+	return false;
+}
+/**
+* Whether `identity` may see and revoke token `row`: anyone's with `manage` in every channel. A
+* token acts as its minter, so its principal alone would hand it every token its minter has: with
+* a token, it's that token and those minted with it; without one, those its principal minted.
+*/
+function manages(state, { principal }, row) {
+	if (principal.access.everywhere("manage")) return true;
+	if (row.minter.id !== principal.id) return false;
+	if (principal.token === void 0) return true;
+	const held = indexOf$1(principal.token, "t");
+	return held !== null && mintedWith(state, row.id, held);
+}
+/**
+* The access session's fold. It prunes by the events' own times, so every instance folds the same
+* state, and each event costs a day's expired tokens at most. A child whose parent is gone counts
+* as dead (`liveIn`), and lives no longer than its parent, so pruning never brings one back.
+*/
+function foldAccess(state, event) {
+	const at = new Date(event.createdAt).getTime();
+	const day = Math.floor(at / DAY_MS);
+	if (state.pruned === null) state.pruned = day;
+	for (; state.pruned < day; state.pruned++) {
+		for (const id of state.expiring[state.pruned] ?? []) dropToken(state, id);
+		delete state.expiring[state.pruned];
+	}
+	switch (event.type) {
+		case "grant.set": {
+			const { issuer, claims, can, by } = event.payload;
+			const key = grantKey(issuer, claims);
+			const existing = state.grants[key];
+			if (existing) Object.assign(existing, {
+				can,
+				by,
+				at
+			});
+			else {
+				state.grants[key] = {
+					id: event.index,
+					issuer,
+					claims,
+					can,
+					by,
+					at
+				};
+				state.grantKeys[event.index] = key;
+			}
+			break;
+		}
+		case "grant.revoked": {
+			const key = state.grantKeys[event.payload.id];
+			if (key !== void 0) {
+				delete state.grants[key];
+				delete state.grantKeys[event.payload.id];
+			}
+			break;
+		}
+		case "token.minted": {
+			const { payload } = event;
+			if (state.hashes[payload.hash] !== void 0) break;
+			state.tokens[event.index] = {
+				id: event.index,
+				...payload,
+				minter: payload.minter,
+				at
+			};
+			state.hashes[payload.hash] = event.index;
+			(state.expiring[Math.floor(payload.expiresAt / DAY_MS)] ??= []).push(event.index);
+			break;
+		}
+		case "token.revoked": dropToken(state, event.payload.id);
+	}
+	return state;
+}
+const accessReducer = reducer({
+	contract: accessContract,
+	name: "board.access.v1",
+	initialState: {
+		grants: {},
+		grantKeys: {},
+		tokens: {},
+		hashes: {},
+		expiring: {},
+		pruned: null
+	}
+}).fold(foldAccess);
+const grantId = (id) => `g${id}`;
+const tokenId = (id) => `t${id}`;
+/** The index an ID names: `g12` or `t12` for 12. Null for one that names none. */
+function indexOf$1(id, prefix) {
+	const found = new RegExp(`^${prefix}([1-9]\\d{0,15})$`).exec(id);
+	return found ? Number(found[1]) : null;
+}
+const grantView = (row) => ({
+	id: grantId(row.id),
+	issuer: row.issuer,
+	claims: row.claims,
+	can: compileAccess(row.can).summary(),
+	by: row.by,
+	at: new Date(row.at).toISOString()
+});
+/** A token as the protocol shows it, with `can` what it may do now (`accessNow`'s, for its minter). */
+const tokenView = (row, can) => ({
+	id: tokenId(row.id),
+	name: row.name,
+	can: can === null ? {} : can.summary(),
+	profile: row.profile,
+	session: row.session,
+	by: row.by,
+	at: new Date(row.at).toISOString(),
+	expiresAt: new Date(row.expiresAt).toISOString(),
+	parent: row.parent === null ? null : tokenId(row.parent)
+});
+/** A new token's secret: the prefix and 32 random bytes, base64url. */
+function newSecret() {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32));
+	return `${BOARD_TOKEN_PREFIX}${btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")}`;
+}
+const needsManage = (identity, what) => {
+	if (!identity.principal.access.everywhere("manage")) throw forbidden(`this token can't ${what}: it needs manage in every channel`);
+};
+/**
+* The board's grants and tokens, in session `access` of its log: what `a2()` answers for them, and
+* what board() checks requests against. `issuers`: the OIDC issuers the board's rules name, which no
+* grant's may share principals with. `accessNow`: what a principal may do now, under board()'s
+* rules and grants, which a token's listing shows.
+*/
+function createTrust(options) {
+	const session = createServer({
+		contract: accessContract,
+		store: options.store
+	}).session(ACCESS_SESSION);
+	const read = async () => (await session.state(accessReducer)).state;
+	/**
+	* What each of `rows` may do now: its minter's access, narrowed by its scope. A minter's is worked
+	* out once, however many tokens it has.
+	*/
+	async function viewsOf(rows) {
+		const minters = /* @__PURE__ */ new Map();
+		return Promise.all(rows.map(async (row) => {
+			const { scope, ...minter } = row.minter;
+			const key = JSON.stringify(minter);
+			let access = minters.get(key);
+			if (!access) minters.set(key, access = options.accessNow(minter));
+			const now = await access;
+			return tokenView(row, now === null || scope === void 0 ? now : now.narrow(parseScope(scope)));
+		}));
+	}
+	/** Whether token `id` and every token it was minted with are live now. */
+	function liveIn(state, id) {
+		let at = id;
+		for (let depth = 0; at !== null; depth++) {
+			const row = state.tokens[at];
+			if (!row || row.expiresAt <= Date.now() || depth > TOKEN_DEPTH_MAX) return false;
+			at = row.parent;
+		}
+		return true;
+	}
+	return {
+		trust: {
+			async grants() {
+				return Object.values((await read()).grants).map((row) => ({
+					...grantView(row),
+					can: row.can
+				}));
+			},
+			async token(hash) {
+				const state = await read();
+				const id = state.hashes[hash];
+				if (id === void 0 || !liveIn(state, id)) return null;
+				const row = state.tokens[id];
+				return {
+					id: tokenId(row.id),
+					name: row.name,
+					minter: row.minter,
+					pinned: {
+						profile: row.profile,
+						avatar: row.avatar,
+						session: row.session,
+						handle: row.handle,
+						name: row.personName
+					},
+					expiresAt: new Date(row.expiresAt)
+				};
+			},
+			async live(id) {
+				const index = indexOf$1(id, "t");
+				return index !== null && liveIn(await read(), index);
+			}
+		},
+		async grants(identity) {
+			needsManage(identity, "list grants");
+			return { grants: Object.values((await read()).grants).sort((a, b) => a.id - b.id).map(grantView) };
+		},
+		async createGrant(identity, body) {
+			needsManage(identity, "set grants");
+			const before = await read();
+			const checked = checkGrant(body, [...options.issuers(), ...grantIssuers(Object.values(before.grants))]);
+			const key = grantKey(checked.issuer, checked.claims);
+			const created = before.grants[key] === void 0;
+			await session.append({
+				type: "grant.set",
+				payload: {
+					issuer: checked.issuer,
+					claims: checked.claims,
+					can: checked.can,
+					by: identity.actor.id
+				}
+			});
+			const row = (await read()).grants[key];
+			return {
+				grant: grantView(row),
+				created
+			};
+		},
+		async revokeGrant(identity, { id }) {
+			needsManage(identity, "revoke grants");
+			const index = indexOf$1(id, "g");
+			if (index === null || (await read()).grantKeys[index] === void 0) return { revoked: false };
+			await session.append({
+				type: "grant.revoked",
+				payload: {
+					id: index,
+					by: identity.actor.id
+				}
+			});
+			return { revoked: true };
+		},
+		async tokens(identity) {
+			const state = await read();
+			return { tokens: await viewsOf(Object.values(state.tokens).filter((row) => liveIn(state, row.id) && manages(state, identity, row)).sort((a, b) => a.id - b.id)) };
+		},
+		/** The board tokens `principal` came with: its own, then each it was minted with. Undefined with none. */
+		async chain(principal) {
+			if (principal.token === void 0) return void 0;
+			const state = await read();
+			const chain = [];
+			for (let at = indexOf$1(principal.token, "t"); at !== null && chain.length <= TOKEN_DEPTH_MAX; at = state.tokens[at]?.parent ?? null) chain.push(tokenId(at));
+			return chain;
+		},
+		async createToken(identity, body) {
+			const { principal, author, actor } = identity;
+			const state = await read();
+			const now = Date.now();
+			const asked = body.expires === void 0 ? TOKEN_DEFAULT_MS : duration(body.expires);
+			if (asked <= 0 || asked > 7776e6) throw badRequest("a token lives up to 90 days: pass expires as 90d or less", "invalid_expires");
+			let expiresAt = now + asked;
+			let parent = null;
+			if (principal.token !== void 0) {
+				const index = indexOf$1(principal.token, "t");
+				parent = index === null ? null : state.tokens[index] ?? null;
+				if (!parent || !liveIn(state, parent.id)) throw unauthorized("invalid token: revoked, expired, or not this board's");
+				let depth = 0;
+				for (let at = parent; at; at = at.parent === null ? void 0 : state.tokens[at.parent]) depth++;
+				if (depth >= TOKEN_DEPTH_MAX) throw badRequest(`tokens minted with tokens go ${TOKEN_DEPTH_MAX} deep at most`, "invalid_token");
+				expiresAt = Math.min(expiresAt, parent.expiresAt);
+			}
+			let can;
+			try {
+				can = compileAccess(body.can ?? DEFAULT_CAN);
+			} catch (error) {
+				throw badRequest(error.message, "invalid_scope");
+			}
+			const scope = scopeOf((principal.scope === void 0 ? FULL_ACCESS : compileAccess(parseScope(principal.scope))).narrow(can));
+			if (scope.length > 4e3) throw badRequest(`a token's can is ${SCOPE_MAX} characters at most as a scope: name fewer channels`, "invalid_scope");
+			const minter = {
+				id: principal.id,
+				kind: principal.kind,
+				handle: principal.handle,
+				...principal.facts ? { facts: principal.facts } : {},
+				scope
+			};
+			const pinned = principal.pinned;
+			const profile = pinned?.profile ?? body.profile ?? null;
+			const avatar = pinned?.profile ? pinned.avatar : profile !== null ? body.avatar ?? null : null;
+			const pinnedSession = pinned?.session ?? body.session ?? null;
+			const person = principal.kind === "person";
+			const base = author.profile === null ? actor.handle : actor.handle.slice(0, Math.max(0, actor.handle.length - author.profile.length - 1)) || principal.handle;
+			const handle = pinned?.handle ?? (person ? base : null);
+			const personName = pinned?.name ?? (person && author.profile === null ? actor.name : null);
+			const secret = newSecret();
+			const [row] = await session.append({
+				type: "token.minted",
+				payload: {
+					hash: await tokenHash(secret),
+					name: body.name,
+					minter,
+					profile,
+					avatar,
+					session: pinnedSession,
+					handle,
+					personName,
+					expiresAt,
+					parent: parent?.id ?? null,
+					by: actor.id
+				}
+			});
+			const minted = row && (await read()).tokens[row.index];
+			if (!minted) throw new Error("a token was minted but its log has no record of it");
+			const [view] = await viewsOf([minted]);
+			return {
+				token: view,
+				secret
+			};
+		},
+		async revokeToken(identity, { id }) {
+			const state = await read();
+			const index = indexOf$1(id, "t");
+			const row = index === null ? void 0 : state.tokens[index];
+			if (!row || !liveIn(state, row.id) || !manages(state, identity, row)) return { revoked: false };
+			await session.append({
+				type: "token.revoked",
+				payload: {
+					id: row.id,
+					by: identity.actor.id
+				}
+			});
+			return { revoked: true };
+		}
+	};
+}
+//#endregion
 //#region src/server/feed.ts
 /** Bookkeeping events, shown only with `all`: who's who, and delivery receipts. */
 const HIDDEN = /* @__PURE__ */ new Set([
@@ -42,27 +386,14 @@ const HIDDEN = /* @__PURE__ */ new Set([
 	"message.synced",
 	"message.files_synced"
 ]);
-/** The person a linked platform actor is, as views show it. */
-function personView(actors, actor) {
-	const link = own(actors.links, actor);
-	const person = link ? own(actors.byId, link.to) : void 0;
-	return link ? {
-		id: link.to,
-		handle: person?.handle ?? link.to,
-		name: person?.name ?? link.to,
-		avatar: person?.avatar ?? null
-	} : void 0;
-}
 function actorView(actors, id) {
 	const author = own(actors.byId, id);
 	if (!author) return null;
-	const person = personView(actors, id);
 	return {
 		kind: author.kind,
 		handle: author.handle,
 		name: author.name,
-		avatar: author.avatar,
-		...person ? { person } : {}
+		avatar: author.avatar
 	};
 }
 /** The board's own code, which reads every channel: it needs no messages to say so. */
@@ -125,11 +456,13 @@ function viewedBy(view, reader) {
 }
 /** A message's or a cursor's ID as clients see it. On this board it's the log index, in decimal. */
 const ref = (index) => String(index);
+/** A schedule's ID as clients see it: its index in session `schedules`, as `s12`, so it reads apart from message `12`. */
+const scheduleRef = (index) => `s${index}`;
 /** The log index a ref names on this board, or null for a string that names nothing here. */
 const indexOf = (value) => /^(0|[1-9]\d{0,15})$/.test(value) ? Number(value) : null;
 /** A message as `reader` sees it. Every view names its reader, so none shows a link's snapshot by default. */
 function view(message, actors, reader) {
-	const { blind, version, schedule, ...shown } = message;
+	const { blind, version, revision, schedule, ...shown } = message;
 	return {
 		...shown,
 		...blind ? { blind } : {},
@@ -137,8 +470,9 @@ function view(message, actors, reader) {
 		re: message.re === null ? null : ref(message.re),
 		replyTo: message.replyTo === null ? null : ref(message.replyTo),
 		version: version ?? message.id,
+		revision: revision ?? message.id,
 		...schedule ? { schedule: {
-			id: ref(schedule.id),
+			id: scheduleRef(schedule.id),
 			n: schedule.n
 		} } : {},
 		links: readableLinks(message.links, reader),
@@ -147,30 +481,17 @@ function view(message, actors, reader) {
 		author: actorView(actors, message.by.actor)
 	};
 }
-/** Whether accounts are linked to `id`: then it's a person, even one who never wrote on the board. */
-const hasLinks = (actors, id) => Object.values(actors.links).some((link) => link.to === id);
-const actorSet = (value, actors) => own(actors.byId, value) || own(actors.links, value) || hasLinks(actors, value) ? /* @__PURE__ */ new Set([value]) : new Set(own(actors.byHandle, value.toLowerCase()) ?? []);
+const actorSet = (value, actors) => own(actors.byId, value) ? /* @__PURE__ */ new Set([value]) : new Set(own(actors.byHandle, value.toLowerCase()) ?? []);
 /**
-* Who a `--by` or `--mentions` value covers. A person (`julian`, or one of their
-* linked accounts, `@julian` on Slack) is everyone they are: their own actor,
-* their agents (`julian/claude`), and every account linked to them. An agent
-* or an unlinked platform actor is just itself.
+* Who a `--by` or `--mentions` value covers. A person (`julian`) is everyone they
+* are: their own actor, and their agents (`julian/claude`). An agent or a platform
+* actor is just itself.
 */
 function whoIs(value, actors) {
 	const ids = actorSet(value, actors);
-	const out = new Set(ids);
-	const principals = /* @__PURE__ */ new Set();
-	for (const id of ids) {
-		const kind = own(actors.byId, id)?.kind;
-		const person = own(actors.links, id) ? personOf(actors, id) : kind === "person" || hasLinks(actors, id) ? id : null;
-		if (person === null) continue;
-		principals.add(person);
-		out.add(person);
-		for (const linked of linkedTo(actors, person)) out.add(linked);
-	}
 	return {
-		actors: out,
-		principals
+		actors: ids,
+		principals: new Set([...ids].filter((id) => own(actors.byId, id)?.kind === "person"))
 	};
 }
 /** Whether `author` is one of `who`: its actor, or an agent of one of its people. */
@@ -191,7 +512,7 @@ function compileFilter(filters, context) {
 	const subtree = channel?.endsWith("/") ? channel.slice(0, -1) : null;
 	const by = filters.by === void 0 ? null : whoIs(filters.by, context.actors);
 	const re = filters.re === void 0 ? void 0 : indexOf(filters.re) ?? -1;
-	const mentions = filters.mentions === void 0 ? null : filters.mentions === "me" ? new Set(context.me === null ? [] : [context.me, ...linkedTo(context.actors, context.me)]) : whoIs(filters.mentions, context.actors).actors;
+	const mentions = filters.mentions === void 0 ? null : filters.mentions === "me" ? new Set(context.me === null ? [] : [context.me]) : whoIs(filters.mentions, context.actors).actors;
 	return (message) => {
 		if (!message || !access.readable(message.channel)) return false;
 		if (channel !== void 0) {
@@ -244,7 +565,7 @@ function toMessageFilter(filters, context) {
 			principals: [...who.principals]
 		};
 	}
-	if (filters.mentions !== void 0) out.mentions = filters.mentions === "me" ? context.me === null ? [] : [context.me, ...linkedTo(context.actors, context.me)] : [...whoIs(filters.mentions, context.actors).actors];
+	if (filters.mentions !== void 0) out.mentions = filters.mentions === "me" ? context.me === null ? [] : [context.me] : [...whoIs(filters.mentions, context.actors).actors];
 	if (filters.from !== void 0) out.from = filters.from;
 	if (filters.text !== void 0) out.text = filters.text.toLowerCase();
 	if (filters.label?.length) out.labels = filters.label.map(([key, values]) => ({
@@ -325,7 +646,7 @@ function payloadView(payload, links) {
 	]) if (typeof shown[key] === "number") shown[key] = ref(shown[key]);
 	const schedule = shown.schedule;
 	if (schedule) shown.schedule = {
-		id: ref(schedule.id),
+		id: scheduleRef(schedule.id),
 		n: schedule.n
 	};
 	if (links) shown.links = links;
@@ -681,13 +1002,15 @@ async function authorizeMessage(ctx, access, permission, id) {
 * read, it's yours only if it was posted without reading too: a write-only
 * source fixes what it wrote, but a principal ID it shares with a caller that
 * reads (a repo's workflows share one) doesn't reach that caller's messages.
+* A board token that pins a profile owns only what was written as it (`wroteAs`).
 * Someone else's answers 404 where you can't read it, and 403 where you can.
 */
-async function authorizeOwn(ctx, principal, id, verb) {
+async function authorizeOwn(ctx, identity, id, verb) {
+	const { principal } = identity;
 	const message = await ctx.reads.message(id);
 	if (!message) throw messageNotFound(id)();
 	const readable = principal.access.readable(message.channel);
-	if (message.by.principal !== principal.id || !readable && !message.blind) {
+	if (!wroteAs(identity, message.by) || !readable && !message.blind) {
 		if (!readable) throw messageNotFound(id)();
 		throw forbidden(`only the author can ${verb} a message`);
 	}
@@ -750,19 +1073,20 @@ async function writePost(ctx, input) {
 		if (input.sync?.length) throw badRequest("sync attaches whole threads: use `board sync <id> <target>`");
 	} else {
 		if (!channel) throw badRequest("a post needs a channel");
+		if (input.after !== void 0) throw badRequest("`after` is for replies", "invalid_after");
 		thread = id;
 	}
 	spend(input.proofs.post, "post", { channel });
 	if (hasLabels(input.labels)) spend(input.proofs.label, "label", { channel });
 	if (input.sync?.length) spend(input.proofs.sync, "sync", { channel });
-	if (input.id !== void 0) {
-		const landed = await ctx.reads.byEventId(input.id);
-		if (landed) {
-			if (landed.channel !== channel || landed.re !== re || landed.replyTo !== replyTo) throw duplicateId();
-			const shown = await landedFor(ctx, identity, landed);
-			if (!shown) throw duplicateId();
-			return shownTo(shown, identity.principal.access, sent);
-		}
+	const replayed = await replayOf(ctx, input, {
+		channel,
+		re,
+		replyTo
+	}, sent);
+	if (replayed) return replayed;
+	if (input.after !== void 0) {
+		if ((await ctx.reads.message(input.after))?.thread !== thread) throw badRequest(`after names no message in #${re}'s thread`, "invalid_after");
 	}
 	return commitPost(ctx, input, {
 		channel,
@@ -773,6 +1097,16 @@ async function writePost(ctx, input) {
 		sent
 	});
 }
+/** The post a caller's own ID already landed, as its retry gets it back: null when there's none. */
+async function replayOf(ctx, input, place, sent) {
+	if (input.id === void 0) return null;
+	const landed = await ctx.reads.byEventId(input.id);
+	if (!landed) return null;
+	if (landed.channel !== place.channel || landed.re !== place.re || landed.replyTo !== place.replyTo) throw duplicateId();
+	const shown = await landedFor(ctx, input.identity, landed);
+	if (!shown) throw duplicateId();
+	return shownTo(shown, input.identity.principal.access, sent);
+}
 /**
 * A post that landed, as its author may have it back: only the same author's, and one in a
 * channel it can't read only if it posted without reading too. A caller that can't read gets back
@@ -833,28 +1167,45 @@ async function commitPost(ctx, input, placed) {
 			by: identity.author
 		}
 	})));
-	const rows = await ctx.session.append(...seen ? [seen] : [], ...named, {
-		type: "message.posted",
-		...id ? { id } : {},
-		payload: {
+	const events = [
+		...seen ? [seen] : [],
+		...named,
+		{
+			type: "message.posted",
+			...id ? { id } : {},
+			payload: {
+				channel,
+				text,
+				re,
+				replyTo,
+				thread,
+				labels: input.labels ?? {},
+				noSync: input.noSync ?? false,
+				mentions,
+				by: identity.author,
+				origin: input.origin ?? null,
+				from: input.from ?? null,
+				...input.attachments?.length ? { attachments: input.attachments } : {},
+				...input.links?.length ? { links: input.links } : {},
+				...input.schedule ? { schedule: input.schedule } : {},
+				...identity.principal.access.readable(channel) ? {} : { blind: true },
+				...input.importedBy !== void 0 ? { importedBy: input.importedBy } : {}
+			}
+		},
+		...synced
+	];
+	let rows;
+	try {
+		rows = input.after === void 0 || re === null ? await ctx.session.append(...events) : await appendWhile(ctx, nothingAfter(ctx, re, input.after), events);
+	} catch (error) {
+		const replayed = error instanceof HttpError && error.code === "newer_message" ? await replayOf(ctx, input, {
 			channel,
-			text,
 			re,
-			replyTo,
-			thread,
-			labels: input.labels ?? {},
-			noSync: input.noSync ?? false,
-			mentions,
-			by: identity.author,
-			origin: input.origin ?? null,
-			from: input.from ?? null,
-			...input.attachments?.length ? { attachments: input.attachments } : {},
-			...input.links?.length ? { links: input.links } : {},
-			...input.schedule ? { schedule: input.schedule } : {},
-			...identity.principal.access.readable(channel) ? {} : { blind: true },
-			...input.importedBy !== void 0 ? { importedBy: input.importedBy } : {}
-		}
-	}, ...synced);
+			replyTo
+		}, sent) : null;
+		if (replayed) return replayed;
+		throw error;
+	}
 	const posted = rows.find((row) => row.type === "message.posted");
 	await untilApplied(ctx, rows);
 	const message = foldMessages({
@@ -923,6 +1274,42 @@ async function untilApplied(ctx, rows) {
 }
 /** How long a write waits for the tables before it answers anyway. */
 const LANDED_WAIT_MS = 1e4;
+/**
+* Appends `events` only while the board, as `holds` reads it, still allows them: `holds` checks
+* the tables, throws what refuses the write, and returns the index its reads reflect. The append
+* holds only while that index is still the log's last, so anything that lands in between,
+* anywhere on the board, moves it, and it looks again from there.
+*/
+async function appendWhile(ctx, holds, events) {
+	return whileHeadMoves(async () => {
+		await ctx.reads.ensure();
+		return appendIfLast(ctx.session, await holds(), events);
+	});
+}
+/**
+* Runs `attempt`, a look and a conditional append, again each time the board moves on in
+* between, up to `CONDITIONAL_TRIES` times: how every conditional write here looks again.
+*/
+async function whileHeadMoves(attempt) {
+	for (let tries = 1;; tries++) try {
+		return await attempt();
+	} catch (error) {
+		if (!headMoved(error)) throw error;
+		if (tries === CONDITIONAL_TRIES) throw new HttpError(503, "unavailable", "the board kept changing while it checked: try again");
+		await new Promise((resolve) => setTimeout(resolve, Math.random() * 5 * tries));
+	}
+}
+/** How many times a conditional write looks again, as the board moves on, before it gives up. */
+const CONDITIONAL_TRIES = 10;
+/** A reply's `after`: nothing came after it in the thread, as of the index the read reflects. */
+const nothingAfter = (ctx, root, after) => async () => {
+	const { messages: [newer], position } = await ctx.reads.tables.messages({ re: root }, {
+		after,
+		limit: 1
+	});
+	if (newer) throw new HttpError(409, "newer_message", `#${newer.id} came after #${after}`);
+	return position;
+};
 /** The message a by-ID write targets, as the board looked it up, once its proof is spent on the message's channel. */
 function spent(authorized, permission) {
 	spend(authorized.proof, permission, authorized.message);
@@ -931,7 +1318,10 @@ function spent(authorized, permission) {
 async function writeEdit(ctx, input) {
 	const message = spent(input.authorized, "post");
 	if (input.asAuthor !== false && message.by.principal !== input.identity.principal.id) throw forbidden("only the author can edit a message");
-	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
+	if (message.deleted) {
+		if (input.revision !== void 0 && input.revision !== (message.revision ?? message.id)) throw new HttpError(409, "revision_conflict", `#${message.id} was deleted since revision ${input.revision}`);
+		throw badRequest("message was deleted", "message_deleted");
+	}
 	return commitEdit(ctx, input, message);
 }
 async function commitEdit(ctx, input, message) {
@@ -940,17 +1330,22 @@ async function commitEdit(ctx, input, message) {
 	const { text, found } = await withEmailMentions(input.text);
 	const named = found.map((actor) => actorSeen(actor, actors)).filter((event) => event !== null);
 	const { mentions, unknown } = resolveMentions(text, knownWith(actors, found), seen ? input.identity.actor : void 0, input.from != null, input.identity.principal.access.readsAll);
-	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], ...named, {
-		type: "message.edited",
-		payload: {
-			id: message.id,
-			thread: message.thread,
-			text,
-			mentions,
-			by: input.identity.author,
-			from: input.from ?? null
+	const events = [
+		...seen ? [seen] : [],
+		...named,
+		{
+			type: "message.edited",
+			payload: {
+				id: message.id,
+				thread: message.thread,
+				text,
+				mentions,
+				by: input.identity.author,
+				from: input.from ?? null
+			}
 		}
-	}));
+	];
+	await untilApplied(ctx, input.revision === void 0 ? await ctx.session.append(...events) : await appendWhile(ctx, revisionIs(ctx, message.id, input.revision), events));
 	return unknown.length && input.identity.principal.access.readable(message.channel) ? { unknownMentions: unknown } : {};
 }
 /** A message's links, replaced: a platform edit or unfurl changed what it links to. */
@@ -971,8 +1366,11 @@ async function writeLinks(ctx, input) {
 async function writeDelete(ctx, input) {
 	const message = spent(input.authorized, "post");
 	if (input.asAuthor !== false && message.by.principal !== input.identity.principal.id) throw forbidden("only the author can delete a message");
-	if (message.deleted) return;
-	await untilApplied(ctx, await ctx.session.append({
+	if (message.deleted) {
+		if (input.revision !== void 0 && input.revision !== (message.revision ?? message.id)) throw new HttpError(409, "revision_conflict", `#${message.id} was deleted since revision ${input.revision}`);
+		return;
+	}
+	const deleted = [{
 		type: "message.deleted",
 		payload: {
 			id: message.id,
@@ -980,8 +1378,17 @@ async function writeDelete(ctx, input) {
 			by: input.identity.author,
 			from: input.from ?? null
 		}
-	}));
+	}];
+	await untilApplied(ctx, input.revision === void 0 ? await ctx.session.append(...deleted) : await appendWhile(ctx, revisionIs(ctx, message.id, input.revision), deleted));
 }
+/** An edit's or a delete's `revision`: no edit or delete since, as of the index the read reflects. */
+const revisionIs = (ctx, id, revision) => async () => {
+	const position = await ctx.reads.tables.position();
+	const message = (await ctx.reads.tables.messagesAt([id], position)).get(id);
+	const now = message ? message.revision ?? message.id : null;
+	if (now !== revision) throw new HttpError(409, "revision_conflict", message?.deleted ? `#${id} was deleted since revision ${revision}` : `#${id} was edited since revision ${revision}: it's at ${now}`);
+	return position;
+};
 async function writeReaction(ctx, input) {
 	const message = spent(input.authorized, "react");
 	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
@@ -1003,7 +1410,7 @@ async function writeLabels(ctx, input) {
 	if (message.deleted) throw badRequest("message was deleted", "message_deleted");
 	const { state: actors } = await ctx.session.state(actorsReducer);
 	const seen = seenFor(input.identity, actors);
-	await untilApplied(ctx, await ctx.session.append(...seen ? [seen] : [], {
+	const events = [...seen ? [seen] : [], {
 		type: "labels.changed",
 		payload: {
 			id: message.id,
@@ -1012,8 +1419,21 @@ async function writeLabels(ctx, input) {
 			unset: input.unset ?? [],
 			by: input.identity.author
 		}
-	}));
+	}];
+	await untilApplied(ctx, input.if !== void 0 && Object.keys(input.if).length > 0 ? await appendWhile(ctx, labelsAre(ctx, message.id, input.if), events) : await ctx.session.append(...events));
 }
+/** A label write's `if`: each label is as it says, as of the index the read reflects. */
+const labelsAre = (ctx, id, expected) => async () => {
+	const position = await ctx.reads.tables.position();
+	const labels = (await ctx.reads.tables.messagesAt([id], position)).get(id)?.labels ?? {};
+	for (const key of Object.keys(expected).sort()) {
+		const now = own(labels, key);
+		if (now === expected[key] || now === void 0 && expected[key] === null) continue;
+		const wanted = expected[key];
+		throw new HttpError(409, "label_conflict", wanted === null ? `${key} is set` : now === void 0 ? `${key} isn't set` : `${key} isn't ${wanted}`);
+	}
+	return position;
+};
 /**
 * Syncs a message's thread with a target, resolved by the sync that delivers it. Attaching twice
 * is a no-op; a platform thread another board thread is synced with is a 409.
@@ -1037,6 +1457,135 @@ async function writeAttach(ctx, input) {
 	}));
 	return { attached: true };
 }
+/**
+* A channel made before anything posts to it, or the one that's there, made by a post or another
+* create, which `created: false` says. It needs `read` and `post` there, refused alike whether it's
+* there or not: the answer says whether it was, and shows what it holds.
+*/
+async function writeChannel(ctx, input) {
+	const { access } = input.identity.principal;
+	authorize(access, "read", input.path);
+	authorize(access, "post", input.path);
+	const seen = seenFor(input.identity, (await ctx.session.state(actorsReducer)).state);
+	const events = [...seen ? [seen] : [], {
+		type: "channel.created",
+		payload: {
+			channel: input.path,
+			by: input.identity.author
+		}
+	}];
+	const made = await whileHeadMoves(async () => {
+		const { state, index } = await ctx.session.state(channelsReducer, { through: "latest" });
+		const found = own(state, input.path);
+		return found ? { found } : { rows: await appendIfLast(ctx.session, index, events) };
+	});
+	if ("found" in made) return {
+		channel: made.found,
+		created: false
+	};
+	await untilApplied(ctx, made.rows);
+	return {
+		channel: {
+			path: input.path,
+			lastIndex: 0,
+			messages: 0,
+			threads: 0
+		},
+		created: true
+	};
+}
+/** The batch, only while `index` is still the session's last: A2's conditional append. */
+const appendIfLast = (session, index, events) => session.append.ifLastIndex(index, ...events);
+/** What A2 throws when the session's last index isn't the one a conditional append named. */
+const headMoved = (error) => error?.code === "LAST_INDEX_MISMATCH";
+//#endregion
+//#region src/server/registry.ts
+/** A principal as a registration keeps it: enough to work out its access again at each match. */
+const storedPrincipal = (principal) => ({
+	id: principal.id,
+	kind: principal.kind,
+	handle: principal.handle,
+	...principal.facts ? { facts: principal.facts } : {},
+	...principal.scope !== void 0 ? { scope: principal.scope } : {},
+	...principal.token !== void 0 ? { token: principal.token } : {}
+});
+/** What a registration shows: the principal's token facts stay on the board. */
+const viewOf = ({ principal: _principal, ...view }) => view;
+/**
+* The same on both ends: a board on `http()` hashes its watchers, and whether its sync subscribes,
+* and the board it uses hashes what it holds.
+*/
+function watchersHash(watch, sync = []) {
+	return createHash("sha256").update(canonicalWatchers(watch, sync)).digest("hex").slice(0, 32);
+}
+function foldRegistry(state, event) {
+	if (event.type === "watchers.registered") {
+		const { owner, principal, url, watch, sync, hash } = event.payload;
+		const copied = Object.fromEntries(Object.entries(watch).map(([id, spec]) => [id, {
+			tail: spec.tail,
+			when: spec.when
+		}]));
+		state.byOwner[owner] = {
+			owner,
+			principal: structuredClone(principal),
+			url,
+			watch: copied,
+			sync: (sync ?? []).map((entry) => ({ ...entry })),
+			hash
+		};
+	}
+	return state;
+}
+const registryReducer = reducer({
+	contract: registryContract,
+	name: "board.registry.v1",
+	initialState: { byOwner: {} }
+}).fold(foldRegistry);
+/** Watchers registered with this board by boards on `http()`. */
+function createRegistry(options) {
+	const server = createServer({
+		contract: registryContract,
+		...options.store ? { store: options.store } : {},
+		...options.scheduler ? { scheduler: options.scheduler } : {}
+	});
+	const session = server.session(REGISTRY_SESSION);
+	const state = async () => (await session.state(registryReducer)).state;
+	return {
+		server,
+		state,
+		/**
+		* Replaces `principal`'s registration. One that changes nothing writes nothing, so asking
+		* again is free, unless the principal's token facts changed: those decide what it may read.
+		*/
+		async register(principal, input) {
+			const owner = principal.id;
+			const hash = watchersHash(input.watch, input.sync);
+			const current = (await state()).byOwner[owner];
+			if (current && current.url === input.url && current.hash === hash && JSON.stringify(current.principal) === JSON.stringify(principal)) return viewOf(current);
+			await session.append({
+				type: "watchers.registered",
+				payload: {
+					owner,
+					principal,
+					url: input.url,
+					watch: input.watch,
+					...input.sync.length > 0 ? { sync: input.sync } : {},
+					hash
+				}
+			});
+			return {
+				owner,
+				url: input.url,
+				watch: input.watch,
+				sync: input.sync,
+				hash
+			};
+		},
+		async list() {
+			return Object.values((await state()).byOwner).sort((a, b) => a.owner.localeCompare(b.owner)).map(viewOf);
+		}
+	};
+}
 //#endregion
 //#region src/server/schedules.ts
 /** Vercel Queues delays at most 6 days: a send further out than this goes in hops. */
@@ -1132,12 +1681,16 @@ function nextSend(schedule, n, at, now) {
 * needs `post` there now, as it would to create it. Where it can't read, the
 * schedule is its own only if it was created without reading too, so a
 * principal ID shared with a caller that reads doesn't reach that caller's.
+* A board token that pins a profile owns only what was scheduled as it (`wroteAs`).
 */
-const createdBy = (schedule, principal) => schedule.as.principal.id === principal.id && principal.access.can("post", schedule.channel) && (schedule.blind || principal.access.readable(schedule.channel));
+const createdBy = (schedule, identity) => wroteAs(identity, {
+	principal: schedule.as.principal.id,
+	actor: schedule.as.actor.id
+}) && identity.principal.access.can("post", schedule.channel) && (schedule.blind || identity.principal.access.readable(schedule.channel));
 const scheduleView = (schedule, actors) => {
 	const author = actors.byId[schedule.as.actor.id] ?? schedule.as.actor;
 	return {
-		id: ref(schedule.id),
+		id: scheduleRef(schedule.id),
 		channel: schedule.channel,
 		re: schedule.re === null ? null : ref(schedule.re),
 		text: schedule.text,
@@ -1408,7 +1961,10 @@ function createSchedules(options) {
 			if (every !== null && every > 316224e5) throw badRequest("`every` is at most a year");
 			const first = body.at !== void 0 ? Date.parse(body.at) : now + duration(body.in ?? body.every);
 			if (first < now - 6e4) throw badRequest("`at` is in the past");
-			const until = body.until !== void 0 ? Date.parse(body.until) : body.for !== void 0 ? first + duration(body.for) : null;
+			const asked = body.until !== void 0 ? Date.parse(body.until) : body.for !== void 0 ? first + duration(body.for) : null;
+			const expires = identity.principal.token !== void 0 ? identity.principal.expiresAt?.getTime() ?? null : null;
+			if (expires !== null && first > expires) throw badRequest(`this token expires ${new Date(expires).toISOString()}, before the schedule's first send: schedule it with a credential that lasts`, "token_expires_first");
+			const until = expires !== null && (asked === null || asked > expires) ? expires : asked;
 			if (until !== null && until < first) throw badRequest("the schedule stops before its first send");
 			if (first > now + 316224e5 || until !== null && until > now + 316224e5) throw badRequest("a schedule reaches at most a year out: its first send and its stop");
 			const { state: known } = await writes.session.state(actorsReducer);
@@ -1437,13 +1993,7 @@ function createSchedules(options) {
 					times: body.times ?? null,
 					as: {
 						author: identity.author,
-						principal: {
-							id: identity.principal.id,
-							kind: identity.principal.kind,
-							handle: identity.principal.handle,
-							...identity.principal.facts ? { facts: identity.principal.facts } : {},
-							...identity.principal.scope !== void 0 ? { scope: identity.principal.scope } : {}
-						},
+						principal: storedPrincipal(identity.principal),
 						actor: identity.actor
 					},
 					...identity.principal.access.readable(channel) ? {} : { blind: true }
@@ -1470,7 +2020,7 @@ function createSchedules(options) {
 			const schedule = state.byId[id];
 			const missing = () => notFound(`schedule not found: s${id}`, "schedule_not_found");
 			if (!schedule) throw missing();
-			if (!createdBy(schedule, identity.principal)) authorize(identity.principal.access, "manage", schedule.channel, missing);
+			if (!createdBy(schedule, identity)) authorize(identity.principal.access, "manage", schedule.channel, missing);
 			const canceled = schedule.next !== null;
 			if (canceled) await session.append({
 				type: "schedule.canceled",
@@ -2146,93 +2696,6 @@ function createWatchers(options) {
 	};
 }
 //#endregion
-//#region src/server/registry.ts
-/** A principal as a registration keeps it: enough to work out its access again at each match. */
-const storedPrincipal = (principal) => ({
-	id: principal.id,
-	kind: principal.kind,
-	handle: principal.handle,
-	...principal.facts ? { facts: principal.facts } : {},
-	...principal.scope !== void 0 ? { scope: principal.scope } : {}
-});
-/** What a registration shows: the principal's token facts stay on the board. */
-const viewOf = ({ principal: _principal, ...view }) => view;
-/**
-* The same on both ends: a board on `http()` hashes its watchers, and whether its sync subscribes,
-* and the board it uses hashes what it holds.
-*/
-function watchersHash(watch, sync = []) {
-	return createHash("sha256").update(canonicalWatchers(watch, sync)).digest("hex").slice(0, 32);
-}
-function foldRegistry(state, event) {
-	if (event.type === "watchers.registered") {
-		const { owner, principal, url, watch, sync, hash } = event.payload;
-		const copied = Object.fromEntries(Object.entries(watch).map(([id, spec]) => [id, {
-			tail: spec.tail,
-			when: spec.when
-		}]));
-		state.byOwner[owner] = {
-			owner,
-			principal: structuredClone(principal),
-			url,
-			watch: copied,
-			sync: (sync ?? []).map((entry) => ({ ...entry })),
-			hash
-		};
-	}
-	return state;
-}
-const registryReducer = reducer({
-	contract: registryContract,
-	name: "board.registry.v1",
-	initialState: { byOwner: {} }
-}).fold(foldRegistry);
-/** Watchers registered with this board by boards on `http()`. */
-function createRegistry(options) {
-	const server = createServer({
-		contract: registryContract,
-		...options.store ? { store: options.store } : {},
-		...options.scheduler ? { scheduler: options.scheduler } : {}
-	});
-	const session = server.session(REGISTRY_SESSION);
-	const state = async () => (await session.state(registryReducer)).state;
-	return {
-		server,
-		state,
-		/**
-		* Replaces `principal`'s registration. One that changes nothing writes nothing, so asking
-		* again is free, unless the principal's token facts changed: those decide what it may read.
-		*/
-		async register(principal, input) {
-			const owner = principal.id;
-			const hash = watchersHash(input.watch, input.sync);
-			const current = (await state()).byOwner[owner];
-			if (current && current.url === input.url && current.hash === hash && JSON.stringify(current.principal) === JSON.stringify(principal)) return viewOf(current);
-			await session.append({
-				type: "watchers.registered",
-				payload: {
-					owner,
-					principal,
-					url: input.url,
-					watch: input.watch,
-					...input.sync.length > 0 ? { sync: input.sync } : {},
-					hash
-				}
-			});
-			return {
-				owner,
-				url: input.url,
-				watch: input.watch,
-				sync: input.sync,
-				hash
-			};
-		},
-		async list() {
-			return Object.values((await state()).byOwner).sort((a, b) => a.owner.localeCompare(b.owner)).map(viewOf);
-		}
-	};
-}
-//#endregion
 //#region src/server/transport.ts
 /** Addresses a wake-up never reaches: this machine, private networks, link-local, and the rest that aren't the internet. */
 const NOT_PUBLIC = new BlockList();
@@ -2349,9 +2812,17 @@ function messageAt(value) {
 	if (index === null || index === 0) throw notFound(`message not found: #${value}`, "message_not_found");
 	return index;
 }
-/** A schedule's ID, `12` or as the CLI shows it, `s12`, as its index in session `schedules`. */
+/**
+* A reply's `after`, as the index of a message. One that isn't one is 0, which names no message:
+* the post refuses it, after a retry that landed gets its reply back.
+*/
+const afterAt = (value) => value === void 0 ? void 0 : indexOf(value) ?? 0;
+/**
+* A schedule's ID, `s12`, as its index in session `schedules`. `12` from a client that strips the
+* `s`, and `ss12` from an older CLI that adds one to what this board hands out, name it too.
+*/
 function scheduleAt(value) {
-	const bare = value.replace(/^s/, "");
+	const bare = value.replace(/^s{1,2}/, "");
 	const index = indexOf(bare);
 	if (index === null || index === 0) throw notFound(`schedule not found: s${bare}`, "schedule_not_found");
 	return index;
@@ -2426,17 +2897,6 @@ function externalIdentity(author, records) {
 		...records ? {} : { records: false }
 	};
 }
-/**
-* A one-time code for linking an account: `vb-` and eight letters and digits that
-* can't be misread. Only its hash is kept.
-*/
-const CODE_LETTERS = "ABCDEFGHJKMNPQRSTUVWXYZ23456789";
-const CODE_TTL_MS = 6e5;
-const newCode = () => {
-	const letters = [...randomBytes(8)].map((byte) => CODE_LETTERS[byte % 31]).join("");
-	return `vb-${letters.slice(0, 4)}-${letters.slice(4)}`;
-};
-const hashCode = (code) => createHash("sha256").update(code.toUpperCase()).digest("base64url");
 /** The board events sync delivers: what a platform shows, and a thread's new targets. */
 const DELIVERED = [
 	"thread.synced",
@@ -2589,10 +3049,11 @@ function build(options, binding) {
 		...options.scheduler ? { scheduler: options.scheduler } : {},
 		consumers: [inbound]
 	});
-	const codes = createServer({
-		contract: identityContract,
-		store: log
-	}).session(IDENTITY_SESSION);
+	const access = createTrust({
+		store: log,
+		issuers: () => binding.issuers(),
+		accessNow: (principal) => binding.accessNow(principal)
+	});
 	const inboxes = inboxServer.session(INBOXES_SESSION);
 	/** The inboxes this instance knows have an `inbox.opened`, so most pushes write nothing more. */
 	const opened = /* @__PURE__ */ new Set();
@@ -2606,8 +3067,8 @@ function build(options, binding) {
 	* Whether `principal` may have a file: one it uploaded, or one a message it
 	* can read carries. A deleted message drops its files, so it no longer counts.
 	*/
-	async function attachmentReadable(principal, id, uploadedBy) {
-		if (principal.access.readsAll || uploadedBy === principal.id) return true;
+	async function attachmentReadable(principal, id, uploader) {
+		if (principal.access.readsAll || ownUpload(uploader, principal)) return true;
 		await reads.ensure();
 		return (await reads.tables.withAttachment(id)).some((message) => principal.access.readable(message.channel));
 	}
@@ -2648,8 +3109,8 @@ function build(options, binding) {
 	}
 	/** Files a write carries, as the board stored them: each one the caller may have, or 404 as if it didn't exist. */
 	const attachmentsFor = (principal, ids) => Promise.all([...new Set(ids ?? [])].map(async (id) => {
-		const { attachment, uploadedBy } = await readUpload(blob, id);
-		if (!await attachmentReadable(principal, id, uploadedBy)) throw attachmentNotFound(id);
+		const { attachment, ...uploader } = await readUpload(blob, id);
+		if (!await attachmentReadable(principal, id, uploader)) throw attachmentNotFound(id);
 		return attachment;
 	}));
 	/**
@@ -2722,6 +3183,7 @@ function build(options, binding) {
 			noSync: body.noSync,
 			id: body.id,
 			sync: body.sync,
+			after: afterAt(body.after),
 			...schedule && !fromRequest(caller) ? {
 				schedule,
 				lenientMentions: true
@@ -2749,10 +3211,7 @@ function build(options, binding) {
 				audience: url,
 				team_id: teamId,
 				project_id: id,
-				sync: (await linkable()).map(({ key, platform }) => ({
-					key,
-					platform
-				}))
+				sync: await syncEntries()
 			};
 		},
 		async me(caller) {
@@ -2778,6 +3237,12 @@ function build(options, binding) {
 				cursor: ref(index)
 			};
 		},
+		async createChannel(caller, { path }) {
+			return writeChannel(writes, {
+				identity: await identityOf(caller),
+				path
+			});
+		},
 		async actors(caller) {
 			const { principal, actor } = await identityOf(caller);
 			const { state, index } = await session.state(actorsReducer);
@@ -2788,31 +3253,7 @@ function build(options, binding) {
 				seen = (id) => ids.has(id);
 			}
 			return {
-				actors: Object.values(state.byId).filter((a) => seen === null || seen(a.id)).sort((a, b) => a.handle.localeCompare(b.handle)).map(({ host: _host, ...a }) => {
-					const person = personView(state, a.id);
-					return person ? {
-						...a,
-						person
-					} : a;
-				}),
-				cursor: ref(index)
-			};
-		},
-		async identity(caller) {
-			const { principal } = await identityOf(caller);
-			const { state, index } = await session.state(actorsReducer);
-			const links = linkedTo(state, principal.id).map((id) => ({
-				actor: id,
-				handle: state.byId[id]?.handle ?? null,
-				name: state.byId[id]?.name ?? null,
-				method: state.links[id].method,
-				at: state.links[id].at
-			}));
-			const unlinked = (await linkable()).filter((entry) => !links.some((link) => link.actor.startsWith(`${entry.platform}:user:`))).map((entry) => entry.key);
-			return {
-				principal: principal.id,
-				links,
-				unlinked,
+				actors: Object.values(state.byId).filter((a) => seen === null || seen(a.id)).sort((a, b) => a.handle.localeCompare(b.handle)).map(({ host: _host, ...a }) => a),
 				cursor: ref(index)
 			};
 		},
@@ -2880,25 +3321,27 @@ function build(options, binding) {
 		async post(caller, parsed) {
 			return postNow(caller, await identityOf(caller), parsed);
 		},
-		async edit(caller, { id, text }) {
+		async edit(caller, { id, text, revision }) {
 			const identity = await identityOf(caller);
-			const authorized = await authorizeOwn(writes, identity.principal, messageAt(id), "edit");
+			const authorized = await authorizeOwn(writes, identity, messageAt(id), "edit");
 			const { unknownMentions } = await writeEdit(writes, {
 				identity,
 				authorized,
-				text
+				text,
+				revision
 			});
 			return {
 				ok: true,
 				...unknownMentions ? { unknownMentions } : {}
 			};
 		},
-		async delete(caller, { id }) {
+		async delete(caller, { id, revision }) {
 			const identity = await identityOf(caller);
-			const authorized = await authorizeOwn(writes, identity.principal, messageAt(id), "delete");
+			const authorized = await authorizeOwn(writes, identity, messageAt(id), "delete");
 			await writeDelete(writes, {
 				identity,
-				authorized
+				authorized,
+				revision
 			});
 			return { ok: true };
 		},
@@ -2913,14 +3356,15 @@ function build(options, binding) {
 			});
 			return { ok: true };
 		},
-		async label(caller, { id, set, unset }) {
+		async label(caller, { id, set, unset, if: expected }) {
 			const identity = await identityOf(caller);
 			const authorized = await authorizeMessage(writes, identity.principal.access, "label", messageAt(id));
 			await writeLabels(writes, {
 				identity,
 				authorized,
 				set,
-				unset
+				unset,
+				if: expected
 			});
 			return { ok: true };
 		},
@@ -2941,7 +3385,10 @@ function build(options, binding) {
 				const at = messageAt(query.re);
 				root = (await authorizeMessage(writes, principal.access, "read", at)).message.re ?? at;
 			}
-			const visible = (schedule) => principal.access.readable(schedule.channel) || createdBy(schedule, principal);
+			const visible = (schedule) => principal.access.readable(schedule.channel) || createdBy(schedule, {
+				principal,
+				actor
+			});
 			return { schedules: (await schedules.list({
 				...query,
 				...root !== void 0 ? { root } : {}
@@ -2955,6 +3402,12 @@ function build(options, binding) {
 				schedule: blindSchedule(answer.schedule, identity.principal.access, identity.actor.id)
 			};
 		},
+		grants: async (caller) => access.grants(await identityOf(caller)),
+		createGrant: async (caller, body) => access.createGrant(await identityOf(caller), body),
+		revokeGrant: async (caller, input) => access.revokeGrant(await identityOf(caller), input),
+		tokens: async (caller) => access.tokens(await identityOf(caller)),
+		createToken: async (caller, body) => access.createToken(await identityOf(caller), body),
+		revokeToken: async (caller, input) => access.revokeToken(await identityOf(caller), input),
 		async upload(caller, { data, name, type }) {
 			const { principal } = await identityOf(caller);
 			if (!principal.access.anywhere("post") && !principal.access.anywhere("sync")) throw forbidden("this token can't post anywhere, so it can't upload");
@@ -2963,7 +3416,8 @@ function build(options, binding) {
 				data,
 				name,
 				type,
-				uploadedBy: principal.id
+				uploadedBy: principal.id,
+				uploadedWith: await access.chain(principal)
 			}, max) };
 		},
 		async uploadStart(caller, { name, type, size }) {
@@ -2973,17 +3427,18 @@ function build(options, binding) {
 				name: name ?? null,
 				type: type ?? null,
 				size,
-				uploadedBy: principal.id
+				uploadedBy: principal.id,
+				uploadedWith: await access.chain(principal)
 			});
 		},
 		async uploadFinish(caller, { id }) {
 			const { principal } = await identityOf(caller);
-			return { attachment: await finishUpload(blob, id, principal.id) };
+			return { attachment: await finishUpload(blob, id, principal) };
 		},
 		async attachment(caller, { id }) {
 			const { principal } = await identityOf(caller);
-			const { attachment, uploadedBy } = await readUpload(blob, id);
-			if (!await attachmentReadable(principal, attachment.id, uploadedBy)) throw attachmentNotFound(attachment.id);
+			const { attachment, ...uploader } = await readUpload(blob, id);
+			if (!await attachmentReadable(principal, attachment.id, uploader)) throw attachmentNotFound(attachment.id);
 			return {
 				attachment,
 				data: await attachmentBody(blob, attachment.id)
@@ -3194,6 +3649,7 @@ function build(options, binding) {
 						origin: body.origin,
 						from: body.from,
 						...body.origin && !ownSync(caller) ? { importedBy: principal.id } : {},
+						after: afterAt(body.after),
 						lenientMentions: true,
 						attachments,
 						links: await linksOf(principal, body.links)
@@ -3222,7 +3678,8 @@ function build(options, binding) {
 						authorized: proof,
 						text,
 						from: body.from,
-						asAuthor
+						asAuthor,
+						revision: body.revision
 					});
 					return ref(found.id);
 				};
@@ -3240,7 +3697,8 @@ function build(options, binding) {
 				identity: author,
 				authorized: await authorized("post"),
 				from: body.from,
-				asAuthor
+				asAuthor,
+				revision: body.revision
 			});
 			else if (body.op === "react") await writeReaction(writes, {
 				identity: author,
@@ -3253,7 +3711,8 @@ function build(options, binding) {
 				identity: author,
 				authorized: await authorized("label"),
 				set: body.set,
-				unset: body.unset
+				unset: body.unset,
+				if: body.if
 			});
 			else await writeLinks(writes, {
 				identity: author,
@@ -3337,12 +3796,6 @@ function build(options, binding) {
 			const { tables } = store;
 			let thread = null;
 			let message = null;
-			let holder = null;
-			if (query.code !== void 0) {
-				const issued = (await codes.state(identityCodesReducer)).state[hashCode(query.code)];
-				const keys = new Set((await entriesOf(caller, principal.id)).map((entry) => entry.key));
-				if (issued && issued.usedBy === null && Date.parse(issued.expiresAt) >= Date.now() && keys.has(issued.sync)) holder = issued.principal;
-			}
 			if (query.post !== void 0) {
 				const landed = await reads.byEventId(importId(caller, principal.id, query.post), signal);
 				if (landed && principal.access.can("sync", landed.channel)) message = ref(landed.id);
@@ -3361,22 +3814,9 @@ function build(options, binding) {
 					if (found && principal.access.can("sync", found.channel)) message = ref(found.id);
 				}
 			}
-			const { state: actors } = query.account !== void 0 || query.person !== void 0 ? await session.state(actorsReducer) : { state: null };
-			const platforms = actors ? (await entriesOf(caller, principal.id)).map((entry) => `${entry.platform}:`) : [];
-			const ours = (account) => platforms.some((platform) => account.startsWith(platform));
-			const link = query.account !== void 0 && ours(query.account) ? actors?.links[query.account] : void 0;
 			return {
 				thread,
-				message,
-				person: link ? {
-					id: link.to,
-					method: link.method
-				} : null,
-				accounts: query.person === void 0 || !actors ? [] : linkedTo(actors, query.person).filter(ours).map((id) => ({
-					id,
-					method: actors.links[id].method
-				})),
-				holder
+				message
 			};
 		},
 		async syncCopies(caller, query) {
@@ -3394,14 +3834,6 @@ function build(options, binding) {
 			}
 			return { copies: out };
 		},
-		async syncRoots(caller, { by, since }) {
-			const { principal } = await needSync(caller, "look up a sync");
-			await reads.ensure();
-			const roots = (await store.tables.recentRoots(by, since)).filter((root) => principal.access.can("sync", root.channel));
-			const { state: actors } = await session.state(actorsReducer);
-			const reader = await reads.reader(principal.access, roots);
-			return { roots: roots.map((root) => view(root, actors, reader)) };
-		},
 		async inboxPush(caller, { key, events }) {
 			const { principal } = await needSync(caller, "push to an inbox", true);
 			for (const { event } of events) for (const location of [
@@ -3504,73 +3936,6 @@ function build(options, binding) {
 				});
 			}
 			return { events: entries.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)).slice(0, limit ?? 50) };
-		},
-		async syncCode(caller, { sync }) {
-			const identity = await identityOf(caller);
-			if (identity.principal.kind !== "person") throw forbidden("only people link platform accounts");
-			const entry = (await linkable()).find((candidate) => candidate.key === sync);
-			if (!entry) throw notFound(`no sync entry named ${sync}`);
-			const principal = identity.principal.id;
-			const code = newCode();
-			const expiresAt = new Date(Date.now() + CODE_TTL_MS).toISOString();
-			await codes.append({
-				type: "identity.code_issued",
-				payload: {
-					hash: hashCode(code),
-					principal,
-					sync,
-					expiresAt
-				}
-			});
-			const signIn = entry.signIn && entry.url !== null ? `${entry.url}/identity/sign-in?${new URLSearchParams({
-				sync,
-				code
-			})}` : null;
-			return {
-				code,
-				expiresAt,
-				...signIn ? { signIn } : {}
-			};
-		},
-		async syncAccount(caller, body) {
-			const { principal } = await needSync(caller, "link accounts", true);
-			const { account } = body;
-			await speaksFor(caller, principal.id, account, body.sync);
-			const hash = hashCode(body.code);
-			const issued = (await codes.state(identityCodesReducer)).state[hash];
-			const bad = () => notFound("that code isn't live: it expired, was used, or was issued for another sync entry", "bad_code");
-			if (!issued || issued.sync !== body.sync) throw bad();
-			const usedHere = (used) => used?.usedBy === account.id && used.usedIn === (body.message ?? null);
-			if (issued.usedBy === null ? Date.parse(issued.expiresAt) < Date.now() : !usedHere(issued)) throw bad();
-			await codes.append({
-				type: "identity.code_used",
-				id: `used:${hash}`,
-				payload: {
-					hash,
-					actor: account.id,
-					...body.message !== void 0 ? { message: body.message } : {}
-				}
-			});
-			if (!usedHere((await codes.state(identityCodesReducer)).state[hash])) throw bad();
-			const linked = externalIdentity(account, recordsActors(caller, principal));
-			return {
-				person: issued.principal,
-				link: await link(linked, issued.principal, body.method ?? "code", `link:${hash}`)
-			};
-		},
-		async syncUnlink(caller, { account }) {
-			const { principal, author } = await identityOf(caller);
-			const { state } = await session.state(actorsReducer);
-			const found = state.links[account];
-			if (!found || found.to !== principal.id && !principal.access.everywhere("sync")) throw notFound(`${account} isn't linked`, "not_linked");
-			await session.append({
-				type: "actor.unlinked",
-				payload: {
-					actor: account,
-					by: author
-				}
-			});
-			return { ok: true };
 		}
 	};
 	/**
@@ -3590,35 +3955,27 @@ function build(options, binding) {
 		return ((await registry.state()).byOwner[principal]?.sync ?? []).filter((entry) => !binding.sync.some((own) => own.key === entry.key));
 	}
 	/**
-	* The sync entries this board links accounts on, by key, each with the URL where its sync runs,
-	* once that's known: its own sync's, then those of the syncs registered here that may still sync.
-	* A key its own sync has is its own. A key two registered syncs claim is neither's to sign people
-	* in for: a person links it by posting the code where either syncs.
+	* The sync entries this board lists in its discovery: its own sync's, then those of the syncs
+	* registered here that may still sync. A key its own sync has is its own.
 	*/
-	async function linkable() {
+	async function syncEntries() {
 		const found = /* @__PURE__ */ new Map();
-		for (const entry of binding.sync) found.set(entry.key, {
-			...entry,
-			url: binding.url()
+		for (const { key, platform } of binding.sync) found.set(key, {
+			key,
+			platform
 		});
-		const claimed = /* @__PURE__ */ new Map();
 		for (const registration of Object.values((await registry.state()).byOwner)) {
 			if (registration.sync.length === 0) continue;
 			if (!(await binding.accessNow(registration.principal))?.anywhere("sync")) continue;
-			for (const entry of registration.sync) if (!found.has(entry.key)) (claimed.get(entry.key) ?? claimed.set(entry.key, []).get(entry.key)).push({
-				...entry,
-				url: registration.url
+			for (const { key, platform } of registration.sync) if (!found.has(key)) found.set(key, {
+				key,
+				platform
 			});
 		}
-		for (const [key, claims] of claimed) found.set(key, claims.length === 1 ? claims[0] : {
-			...claims[0],
-			signIn: false,
-			url: null
-		});
 		return [...found.values()];
 	}
 	/**
-	* Whether a caller may write as, or link, `author`: a platform user, never anyone this board
+	* Whether a caller may write as `author`: a platform user, never anyone this board
 	* signs in, on a platform it syncs: the one of entry `from`, when it names one.
 	*/
 	async function speaksFor(caller, principal, author, from) {
@@ -3787,43 +4144,6 @@ function build(options, binding) {
 		});
 		opened.add(channel);
 	}
-	/** Records that platform user `identity` is `to`, unless it already is. `id` makes a retry a no-op. */
-	async function link(identity, to, method, id) {
-		const { actor: account, author: by } = identity;
-		const { state: actors } = await session.state(actorsReducer);
-		const seen = identity.records === false ? null : actorSeen(account, actors);
-		const existing = actors.links[account.id];
-		if (existing?.to === to && !id) {
-			if (seen) await session.append(seen);
-			return {
-				actor: account.id,
-				handle: account.handle,
-				name: account.name,
-				method: existing.method,
-				at: existing.at
-			};
-		}
-		await session.append(...seen ? [{
-			...seen,
-			...id ? { id: `${id}:seen` } : {}
-		}] : [], {
-			type: "actor.linked",
-			...id ? { id } : {},
-			payload: {
-				actor: account.id,
-				to,
-				method,
-				by
-			}
-		});
-		return {
-			actor: account.id,
-			handle: account.handle,
-			name: account.name,
-			method,
-			at: (/* @__PURE__ */ new Date()).toISOString()
-		};
-	}
 	const servers = [
 		server,
 		inboxServer,
@@ -3834,6 +4154,7 @@ function build(options, binding) {
 	return {
 		methods,
 		schedules,
+		trust: access.trust,
 		/** The scheduler's callback, for every A2 server behind the board. */
 		scheduler: options.scheduler ? options.scheduler.handler(...servers) : async (_request) => toErrorResponse(notFound("this board has no scheduler")),
 		servers,
@@ -3879,6 +4200,11 @@ function a2(options = {}) {
 		...Object.fromEntries(METHODS.map((name) => [name, async (caller, input, signal) => (await ready()).methods[name](caller, input, signal)])),
 		routes: [],
 		keeps: true,
+		trust: {
+			grants: async () => (await ready()).trust.grants(),
+			token: async (hash) => (await ready()).trust.token(hash),
+			live: async (id) => (await ready()).trust.live(id)
+		},
 		bind(given) {
 			if (binding) throw new Error("a2: this backend already serves a board: create one a2() per board()");
 			binding = given;