@vercel/board 0.29.0 → 0.31.0

package/dist/sync-github.d.mts

@@ -1,5 +1,5 @@
-import { S as SyncUnit, _ as withUserTokens, d as ResolvedTarget, f as SyncContext, h as UserTokens, o as ProviderPost, r as ProviderDelivery, y as SyncFn } from "./provider-DmSTp9lI.mjs";
-import { n as ChatSyncProvider } from "./chat-provider-BWHbChcQ.mjs";
+import { f as SyncContext, g as SyncFn, y as SyncUnit } from "./provider-gynDUoyW.mjs";
+import { n as ChatSyncProvider } from "./chat-provider-BChYrrA7.mjs";
 import { z } from "zod";
 import { Adapter } from "chat";
 //#region src/sync/github.d.ts
@@ -432,9 +432,8 @@ export type GitHubRepo = SyncUnit<GitHubEvent> | {
 };
 export type GitHubOptions = {
   /**
-   * A Vercel Connect connector (`'github/acme'`): board builds the GitHub adapter
-   * and people's sign-in, so comments they write on the board post as them.
-   * Or your own Chat SDK adapter, wrapped in `withUserTokens` to post as people.
+   * A Vercel Connect connector (`'github/acme'`): board builds the GitHub adapter.
+   * Or your own Chat SDK adapter.
    */
   adapter: Adapter | string;
   /**
@@ -459,18 +458,7 @@ export declare function github(app: string | GitHubOptions, sync: SyncFn<GitHubE
  */
 export declare function repos(map: Record<string, GitHubRepo>): SyncFn<GitHubEvent>;
 export declare class GitHubProvider extends ChatSyncProvider<GitHubEvent> {
-  private readonly body;
   constructor(given: GitHubOptions, sync: SyncFn<GitHubEvent>);
-  whoAmI(token: string): Promise<{
-    id: string;
-    handle: string;
-    name: string;
-    avatar: string | null;
-    isBot: boolean;
-  }>;
-  postAs(token: string, target: string, kind: ResolvedTarget['kind'], post: ProviderPost): Promise<ProviderDelivery>;
-  editAs(token: string, thread: string, message: string, post: ProviderPost): Promise<void>;
-  deleteAs(token: string, thread: string, message: string): Promise<void>;
   /**
    * A thread's root is the PR or issue itself, not a comment: its copy has no comment ID
    * (`root:<event>` or `lifecycle:<event>`), so its reactions go on the PR or issue.
@@ -478,5 +466,4 @@ export declare class GitHubProvider extends ChatSyncProvider<GitHubEvent> {
   react(thread: string, message: string, emoji: string, added: boolean): Promise<void>;
   event(context: SyncContext): GitHubEvent;
 }
-//#endregion
-export { type UserTokens, withUserTokens };
+//#endregion

package/dist/sync-github.mjs

@@ -1,7 +1,5 @@
-import { c as into, d as withRoutes } from "./provider-BaVmi4Hi.mjs";
-import { i as eventSchema, r as envelope } from "./events-qf5XG5VQ.mjs";
-import { r as withUserTokens, t as connectUserTokens } from "./users-yryHKFMo.mjs";
-import { r as markdownOf, t as ChatSyncProvider } from "./chat-provider-COtsU5jB.mjs";
+import { g as withRoutes, i as eventSchema, p as into, r as envelope } from "./events-lujPA3gQ.mjs";
+import { n as markdownOf, t as ChatSyncProvider } from "./chat-provider-DkFp2hrh.mjs";
 import { n as tagOf } from "./tags-BpFo6q0_.mjs";
 import { z } from "zod";
 import { connectGitHubAdapter } from "@vercel/connect/chat";
@@ -338,35 +336,6 @@ const GitHubEvent = z.discriminatedUnion("type", [
 	...prTypes.map(prLifecycle),
 	...issueTypes.map(issueLifecycle)
 ]);
-/** `owner/repo:12`, `owner/repo:issue:3`, or `owner/repo:12:rc:345` (a review comment thread). */
-function parseThread(thread) {
-	const match = /^([^/]+)\/([^:]+):(?:issue:)?(\d+)(?::rc:(\d+))?$/.exec(thread);
-	if (!match) throw new Error(`invalid GitHub thread: ${thread}`);
-	return {
-		owner: match[1],
-		repo: match[2],
-		number: Number(match[3]),
-		review: match[4] ? Number(match[4]) : null
-	};
-}
-/** GitHub's REST API with a person's own token: Chat SDK's adapter only holds the app's. */
-async function asPerson(token, method, path, body) {
-	const response = await fetch(`https://api.github.com${path}`, {
-		method,
-		headers: {
-			authorization: `Bearer ${token}`,
-			accept: "application/vnd.github+json",
-			"x-github-api-version": "2022-11-28",
-			...body === void 0 ? {} : { "content-type": "application/json" }
-		},
-		...body === void 0 ? {} : { body: JSON.stringify(body) }
-	});
-	if (!response.ok) {
-		const detail = await response.text().catch(() => "");
-		throw Object.assign(/* @__PURE__ */ new Error(`GitHub ${method} ${path}: ${response.status} ${detail.slice(0, 200)}`), { data: { error: `github_${response.status}` } });
-	}
-	return response.status === 204 ? null : response.json();
-}
 /**
 * Syncs GitHub with the board: `app` is a Vercel Connect connector
 * (`'github/acme'`) or the options, and `sync` is what each event does, both
@@ -428,10 +397,9 @@ function fromConnector(connector, botUserId) {
 			detecting.logger?.warn("Could not detect the GitHub bot user ID", { error });
 		}
 	};
-	return withUserTokens(adapter, connectUserTokens(connector));
+	return adapter;
 }
 var GitHubProvider = class extends ChatSyncProvider {
-	body;
 	constructor(given, sync) {
 		const options = {
 			...given,
@@ -590,40 +558,6 @@ var GitHubProvider = class extends ChatSyncProvider {
 				};
 			}
 		}, sync);
-		const converter = options.adapter.formatConverter;
-		this.body = (post) => {
-			try {
-				return converter ? converter.renderPostable({ markdown: post.markdown }) : post.markdown;
-			} catch {
-				return post.markdown;
-			}
-		};
-	}
-	async whoAmI(token) {
-		const user = await asPerson(token, "GET", "/user");
-		if (!user.id) throw new Error("GitHub didn't say whose token this is");
-		return {
-			...author(user),
-			isBot: false
-		};
-	}
-	async postAs(token, target, kind, post) {
-		if (kind === "channel") throw new Error("github cannot start threads");
-		const { owner, repo, number, review } = parseThread(target);
-		const body = this.body(post);
-		const comment = await (review !== null ? asPerson(token, "POST", `/repos/${owner}/${repo}/pulls/${number}/comments/${review}/replies`, { body }) : asPerson(token, "POST", `/repos/${owner}/${repo}/issues/${number}/comments`, { body }));
-		return {
-			thread: target,
-			message: String(comment.id)
-		};
-	}
-	async editAs(token, thread, message, post) {
-		const { owner, repo, review } = parseThread(thread);
-		await asPerson(token, "PATCH", `/repos/${owner}/${repo}/${review !== null ? "pulls" : "issues"}/comments/${message}`, { body: this.body(post) });
-	}
-	async deleteAs(token, thread, message) {
-		const { owner, repo, review } = parseThread(thread);
-		await asPerson(token, "DELETE", `/repos/${owner}/${repo}/${review !== null ? "pulls" : "issues"}/comments/${message}`);
 	}
 	/**
 	* A thread's root is the PR or issue itself, not a comment: its copy has no comment ID
@@ -676,4 +610,4 @@ var GitHubProvider = class extends ChatSyncProvider {
 	}
 };
 //#endregion
-export { GitHubEvent, GitHubPayload, GitHubProvider, github, repos, withUserTokens };
+export { GitHubEvent, GitHubPayload, GitHubProvider, github, repos };

package/dist/sync-linear.d.mts

@@ -1,6 +1,6 @@
-import { mt as SourceRead } from "./client-BqAjk0Q4.mjs";
-import { S as SyncUnit, c as ReceivedEvent, d as ResolvedTarget, f as SyncContext, o as ProviderPost, r as ProviderDelivery, y as SyncFn } from "./provider-DmSTp9lI.mjs";
-import { n as ChatSyncProvider, t as ChatInput } from "./chat-provider-BWHbChcQ.mjs";
+import { mt as SourceRead } from "./client-COfYrgfV.mjs";
+import { c as ReceivedEvent, d as ResolvedTarget, f as SyncContext, g as SyncFn, o as ProviderPost, r as ProviderDelivery, y as SyncUnit } from "./provider-gynDUoyW.mjs";
+import { n as ChatSyncProvider, t as ChatInput } from "./chat-provider-BChYrrA7.mjs";
 import { z } from "zod";
 import { Adapter } from "chat";
 //#region src/sync/linear.d.ts

package/dist/sync-linear.mjs

@@ -1,6 +1,5 @@
-import { i as UnreadableError, s as channels } from "./provider-BaVmi4Hi.mjs";
-import { i as eventSchema, r as envelope } from "./events-qf5XG5VQ.mjs";
-import { r as markdownOf, t as ChatSyncProvider } from "./chat-provider-COtsU5jB.mjs";
+import { f as channels, i as eventSchema, l as UnreadableError, r as envelope } from "./events-lujPA3gQ.mjs";
+import { n as markdownOf, t as ChatSyncProvider } from "./chat-provider-DkFp2hrh.mjs";
 import { n as tagOf, t as slug } from "./tags-BpFo6q0_.mjs";
 import "zod";
 import { connectLinearAdapter } from "@vercel/connect/chat";
@@ -37,6 +36,8 @@ const bodyOf = (description) => description?.trim() || null;
 * An issue's properties as board labels: `priority=high`, `project=v0-accessibility`, a label per
 * Linear label (`tag.bug`), and its assignee (`assignee.ada`). Only what the payload says: a
 * property it carries empty is unset, and one it names without its details is left as it was.
+* Linear leaves an empty assignee or project out of the payload rather than sending `null`, so
+* either one missing, with no ID either, is empty.
 * `priority` and `project` are single keys, so they're unset by name; `tag.` and `assignee.` are
 * prefixes the mirror owns, so a key under them that Linear doesn't have goes.
 */
@@ -47,7 +48,7 @@ function propertiesOf(data) {
 	if (data.priority === 0 || data.priorityLabel === "No priority") unset.push("priority");
 	else if (data.priorityLabel && slug(data.priorityLabel)) labels.priority = slug(data.priorityLabel).slice(0, 256);
 	if (data.project?.name && slug(data.project.name)) labels.project = slug(data.project.name).slice(0, 256);
-	else if (data.project === null || data.projectId === null) unset.push("project");
+	else if (!data.project && !data.projectId) unset.push("project");
 	if (Array.isArray(data.labels)) {
 		owns.push("tag.");
 		for (const label of data.labels) {
@@ -59,7 +60,7 @@ function propertiesOf(data) {
 		owns.push("assignee.");
 		const tag = tagOf("assignee", handleOf(data.assignee));
 		if (tag) labels[tag[0]] = tag[1];
-	} else if (data.assignee === null || data.assigneeId === null) owns.push("assignee.");
+	} else if (!data.assigneeId) owns.push("assignee.");
 	return {
 		labels,
 		unset,

package/dist/sync-slack.d.mts

@@ -1,6 +1,6 @@
-import { f as ExternalLink } from "./folds-ZkHM4M-v.mjs";
-import { C as channels, _ as withUserTokens, d as ResolvedTarget, f as SyncContext, h as UserTokens, o as ProviderPost, r as ProviderDelivery, y as SyncFn } from "./provider-DmSTp9lI.mjs";
-import { n as ChatSyncProvider, t as ChatInput } from "./chat-provider-BWHbChcQ.mjs";
+import { f as ExternalLink } from "./folds-DLUzfibJ.mjs";
+import { b as channels, d as ResolvedTarget, f as SyncContext, g as SyncFn, o as ProviderPost, r as ProviderDelivery } from "./provider-gynDUoyW.mjs";
+import { n as ChatSyncProvider, t as ChatInput } from "./chat-provider-BChYrrA7.mjs";
 import { z } from "zod";
 import { Adapter } from "chat";
 //#region src/sync/slack.d.ts
@@ -165,6 +165,7 @@ type SlackMessage = {
   files?: SlackFile[];
   thread_ts?: string;
   reply_count?: number;
+  attachments?: SlackAttachment[];
 };
 /** What Slack attaches to a message that links another: `is_msg_unfurl` marks a message link's. */
 type SlackAttachment = {
@@ -343,9 +344,8 @@ export declare const SlackEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
 export type SlackEvent = z.infer<typeof SlackEvent>;
 export type SlackOptions = {
   /**
-   * A Vercel Connect connector (`'slack/acme'`): board builds the Slack adapter,
-   * its Web API client, and people's sign-in, so messages they write post as them.
-   * Or your own Chat SDK adapter, wrapped in `withUserTokens` to post as people.
+   * A Vercel Connect connector (`'slack/acme'`): board builds the Slack adapter
+   * and its Web API client. Or your own Chat SDK adapter.
    */
   adapter: Adapter | string;
   /** Not needed with a connector. */
@@ -401,4 +401,4 @@ export declare class SlackProvider extends ChatSyncProvider<SlackEvent> {
   event(context: SyncContext): SlackEvent;
 }
 //#endregion
-export { type UserTokens, channels, withUserTokens };
+export { channels };

package/dist/sync-slack.mjs

@@ -1,9 +1,7 @@
 import { m as MESSAGE_TEXT_MAX } from "./schemas-DBmUO6pr.mjs";
 import "./external-D3p5T57R.mjs";
-import { i as UnreadableError, s as channels } from "./provider-BaVmi4Hi.mjs";
-import { i as eventSchema, r as envelope } from "./events-qf5XG5VQ.mjs";
-import { r as withUserTokens, t as connectUserTokens } from "./users-yryHKFMo.mjs";
-import { r as markdownOf, t as ChatSyncProvider } from "./chat-provider-COtsU5jB.mjs";
+import { f as channels, i as eventSchema, l as UnreadableError, r as envelope } from "./events-lujPA3gQ.mjs";
+import { n as markdownOf, t as ChatSyncProvider } from "./chat-provider-DkFp2hrh.mjs";
 import { z } from "zod";
 import { stringifyMarkdown } from "chat";
 import { createSlackAdapter } from "@chat-adapter/slack";
@@ -236,13 +234,13 @@ const SLACK_CLIENT = {
 	},
 	timeout: 3e4
 };
-/** A Slack adapter, client, and people's tokens, all from one Vercel Connect connector. */
+/** A Slack adapter and its client, from one Vercel Connect connector. */
 function fromConnector(connector) {
 	const credentials = connectSlackAdapter(connector);
-	const adapter = withUserTokens(createSlackAdapter({
+	const adapter = createSlackAdapter({
 		...credentials,
 		webClientOptions: SLACK_CLIENT
-	}), connectUserTokens(connector));
+	});
 	const botToken = credentials.botToken;
 	const client = async () => adapter.withBotToken(typeof botToken === "function" ? await botToken() : botToken, () => adapter.webClient);
 	return {
@@ -263,7 +261,6 @@ var SlackProvider = class extends ChatSyncProvider {
 			...given,
 			adapter: given.adapter
 		};
-		const tokens = options.adapter;
 		let directClient;
 		if (!options.client) try {
 			directClient = options.adapter.webClient;
@@ -457,47 +454,45 @@ var SlackProvider = class extends ChatSyncProvider {
 					return null;
 				}
 			},
-			async fetchLink(link) {
+			async fetchLink(link, linker) {
 				const [, channel, thread] = link.thread.split(":");
 				const web = await client();
-				if (!web?.conversations.replies || !channel || !thread) return {
+				const replies = web?.conversations.replies;
+				if (!web || !replies || !channel || !thread) return {
 					snapshot: null,
 					unavailable: "no Slack client to read it with"
 				};
+				const one = async (channel, thread, ts) => (await replies({
+					channel,
+					ts: thread,
+					oldest: ts,
+					latest: ts,
+					inclusive: true,
+					limit: 1
+				})).messages?.find((m) => m.ts === ts);
 				let found;
+				let unavailable = "message_not_found";
 				try {
 					const info = (await web.conversations.info({ channel })).channel;
-					if (!info) return {
-						snapshot: null,
-						unavailable: "channel_not_found"
-					};
-					if (info.is_private || info.is_im || info.is_mpim) return {
-						snapshot: null,
-						unavailable: "private_channel"
-					};
-					if (!info.is_member) return {
-						snapshot: null,
-						unavailable: "not_in_channel"
-					};
-					const { messages } = await web.conversations.replies({
-						channel,
-						ts: thread,
-						oldest: link.message,
-						latest: link.message,
-						inclusive: true,
-						limit: 1
-					});
-					found = messages?.find((m) => m.ts === link.message);
+					if (!info) unavailable = "channel_not_found";
+					else if (info.is_private || info.is_im || info.is_mpim) unavailable = "private_channel";
+					else if (!info.is_member) unavailable = "not_in_channel";
+					else found = await one(channel, thread, link.message);
 				} catch (error) {
-					return {
+					unavailable = slackError(error);
+				}
+				if (!found) {
+					const [, at, root] = linker.thread.split(":");
+					const linking = at && root ? await one(at, root, linker.message).catch(() => void 0) : void 0;
+					const unfurled = linking ? slackLinks("", linking.text ?? "", linking.attachments, mrkdwn).find((known) => known.url === link.url)?.snapshot : null;
+					return unfurled ? {
+						snapshot: unfurled,
+						unavailable: null
+					} : {
 						snapshot: null,
-						unavailable: slackError(error)
+						unavailable
 					};
 				}
-				if (!found) return {
-					snapshot: null,
-					unavailable: "message_not_found"
-				};
 				return {
 					unavailable: null,
 					snapshot: {
@@ -645,22 +640,6 @@ var SlackProvider = class extends ChatSyncProvider {
 			groupThread: (thread) => thread,
 			isRoot: (thread, messageId) => thread.slice(thread.lastIndexOf(":") + 1) === messageId,
 			context: () => null,
-			...typeof tokens.withBotToken === "function" ? {
-				runAs: (token, fn) => tokens.withBotToken(token, fn),
-				async whoAmI(token) {
-					const me = await tokens.withBotToken(token, () => tokens.webClient.auth.test());
-					if (!me.user_id) throw new Error("Slack didn't say whose token this is");
-					const user = (await (await client().catch(() => void 0))?.users?.info({ user: me.user_id }).catch(() => void 0))?.user;
-					const handle = user?.profile?.display_name || user?.name || me.user || me.user_id;
-					return {
-						id: `slack:user:${me.user_id}`,
-						handle,
-						name: user?.profile?.real_name || user?.real_name || handle,
-						avatar: user?.profile?.image_72 ?? user?.profile?.image_48 ?? null,
-						isBot: false
-					};
-				}
-			} : {},
 			async resolveTarget(target) {
 				const at = target.indexOf(":");
 				const channel = await this.resolveChannel(at === -1 ? target : target.slice(0, at));
@@ -836,4 +815,4 @@ var SlackProvider = class extends ChatSyncProvider {
 	}
 };
 //#endregion
-export { SlackEvent, SlackProvider, channels, forwardText, slack, slackFileName, slackIcon, slackLinks, withUserTokens, withoutHtml, withoutLabel };
+export { SlackEvent, SlackProvider, channels, forwardText, slack, slackFileName, slackIcon, slackLinks, withoutHtml, withoutLabel };

package/dist/sync.d.mts

@@ -1,3 +1,3 @@
-import { d as ExternalFile, l as ExternalAuthor, u as ExternalEvent } from "./folds-ZkHM4M-v.mjs";
-import { A as SyncOverrides, C as channels, D as EventBase, E as render, M as SyncRoot, N as envelope, O as ProviderEvent, P as eventSchema, S as SyncUnit, T as mirror, _ as withUserTokens, a as ProviderOptions, b as SyncIn, c as ReceivedEvent, d as ResolvedTarget, f as SyncContext, g as connectUserTokens, h as UserTokens, i as ProviderFile, j as SyncResult, k as RootOverride, l as RenderInput, m as UnreadableError, n as FileDelivery, o as ProviderPost, p as SyncProvider, r as ProviderDelivery, s as Receive, u as Renderer, v as Sync, w as into, x as SyncOut, y as SyncFn } from "./provider-DmSTp9lI.mjs";
-export { EventBase, type ExternalAuthor, ExternalEvent, type ExternalFile, type FileDelivery, type ProviderDelivery, type ProviderEvent, type ProviderFile, type ProviderOptions, type ProviderPost, type Receive, ReceivedEvent, type RenderInput, type Renderer, ResolvedTarget, type RootOverride, type Sync, type SyncContext, type SyncFn, type SyncIn, type SyncOut, SyncOverrides, SyncProvider, type SyncResult, type SyncRoot, type SyncUnit, UnreadableError, type UserTokens, channels, connectUserTokens, envelope, eventSchema, into, mirror, render, withUserTokens };
+import { d as ExternalFile, l as ExternalAuthor, u as ExternalEvent } from "./folds-DLUzfibJ.mjs";
+import { A as envelope, C as render, D as SyncOverrides, E as RootOverride, O as SyncResult, S as mirror, T as ProviderEvent, _ as SyncIn, a as ProviderOptions, b as channels, c as ReceivedEvent, d as ResolvedTarget, f as SyncContext, g as SyncFn, h as Sync, i as ProviderFile, j as eventSchema, k as SyncRoot, l as RenderInput, m as UnreadableError, n as FileDelivery, o as ProviderPost, p as SyncProvider, r as ProviderDelivery, s as Receive, u as Renderer, v as SyncOut, w as EventBase, x as into, y as SyncUnit } from "./provider-gynDUoyW.mjs";
+export { EventBase, type ExternalAuthor, ExternalEvent, type ExternalFile, type FileDelivery, type ProviderDelivery, type ProviderEvent, type ProviderFile, type ProviderOptions, type ProviderPost, type Receive, ReceivedEvent, type RenderInput, type Renderer, ResolvedTarget, type RootOverride, type Sync, type SyncContext, type SyncFn, type SyncIn, type SyncOut, SyncOverrides, SyncProvider, type SyncResult, type SyncRoot, type SyncUnit, UnreadableError, channels, envelope, eventSchema, into, mirror, render };

package/dist/sync.mjs

@@ -1,5 +1,3 @@
 import { n as ExternalEvent } from "./external-D3p5T57R.mjs";
-import { c as into, i as UnreadableError, l as mirror, n as ResolvedTarget, r as SyncProvider, s as channels, t as ReceivedEvent, u as render } from "./provider-BaVmi4Hi.mjs";
-import { i as eventSchema, n as SyncOverrides, r as envelope, t as EventBase } from "./events-qf5XG5VQ.mjs";
-import { r as withUserTokens, t as connectUserTokens } from "./users-yryHKFMo.mjs";
-export { EventBase, ExternalEvent, ReceivedEvent, ResolvedTarget, SyncOverrides, SyncProvider, UnreadableError, channels, connectUserTokens, envelope, eventSchema, into, mirror, render, withUserTokens };
+import { c as SyncProvider, f as channels, h as render, i as eventSchema, l as UnreadableError, m as mirror, n as SyncOverrides, o as ReceivedEvent, p as into, r as envelope, s as ResolvedTarget, t as EventBase } from "./events-lujPA3gQ.mjs";
+export { EventBase, ExternalEvent, ReceivedEvent, ResolvedTarget, SyncOverrides, SyncProvider, UnreadableError, channels, envelope, eventSchema, into, mirror, render };

package/dist/{tokens-CC3izSNr.mjs → tokens-Dnyd_y1n.mjs}

@@ -1,5 +1,5 @@
-import { l as unauthorized } from "./errors-CusN4x2l.mjs";
-import { f as markVerified, m as trustedIssuers, n as TOKENS, r as VERCEL_ISSUER, u as issuerName } from "./auth-JO22iIwr.mjs";
+import { l as unauthorized } from "./errors-CJXhhzvT.mjs";
+import { a as VERCEL_ISSUER, b as trustedIssuers, g as markVerified, i as TOKENS, m as issuerName, v as privateHost } from "./auth-CyO2aw5n.mjs";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 //#region src/server/identity.ts
 let fromDisk;
@@ -95,13 +95,22 @@ function factsOf(issuer, iss, claims) {
 }
 const issuerMatches = (iss, accepted) => typeof accepted === "string" ? iss === accepted : accepted.test(iss);
 const remoteKeys = /* @__PURE__ */ new Map();
+/**
+* An issuer's keys, by OIDC Discovery 1.0: its document under the issuer, naming that issuer
+* (§4.3), and its keys at an https `jwks_uri` (§3), which must be on the internet, as a grant's
+* issuer must. Like jose's own fetch of the keys, it follows no redirect.
+*/
 async function keysFor(iss) {
 	const cached = remoteKeys.get(iss);
 	if (cached) return cached;
-	const response = await fetch(`${iss.replace(/\/+$/, "")}/.well-known/openid-configuration`);
-	if (!response.ok) throw unauthorized(`cannot load keys for issuer ${iss}`);
-	const { jwks_uri } = await response.json();
-	const keys = createRemoteJWKSet(new URL(jwks_uri));
+	const unknown = (why) => unauthorized(`cannot load keys for issuer ${iss}: ${why}`);
+	const response = await fetch(`${iss.replace(/\/+$/, "")}/.well-known/openid-configuration`, { redirect: "manual" });
+	if (response.status !== 200) throw unknown(`its discovery answered ${response.status}`);
+	const config = await response.json().catch(() => null);
+	if (config?.issuer !== iss) throw unknown("its discovery names another issuer");
+	const jwks = typeof config.jwks_uri === "string" ? URL.parse(config.jwks_uri) : null;
+	if (jwks?.protocol !== "https:" || privateHost(jwks.hostname)) throw unknown("its jwks_uri isn't an https URL on the internet");
+	const keys = createRemoteJWKSet(jwks);
 	remoteKeys.set(iss, keys);
 	return keys;
 }

package/dist/{types-No0WdhE5.d.mts → types-CmrFjpml.d.mts}

@@ -1,5 +1,5 @@
-import { a as ExternalCopy, c as SyncedThread, g as BoardEvent, o as Message } from "./folds-ZkHM4M-v.mjs";
-import { t as A2Store } from "./store-D0MhBvg6-4Z2L0Kqd.mjs";
+import { a as ExternalCopy, c as SyncedThread, g as BoardEvent, o as Message } from "./folds-DLUzfibJ.mjs";
+import { t as A2Store } from "./store-DEzcHZOA-B-5vhxef.mjs";
 //#region src/store/types.d.ts
 /**
  * What a query matches, resolved by the board: handles are already actor and
@@ -84,8 +84,6 @@ interface MessageTables {
   messageOf(externalThread: string, platformMessage: string): Promise<number | null>;
   /** Every platform thread a board thread lives in. */
   externalThreads(): Promise<string[]>;
-  /** A person's own roots posted at or after `since` (epoch ms). */
-  recentRoots(principal: string, since: number): Promise<Message[]>;
   /** The messages that carry an attachment, by ID. A deleted message carries none. */
   withAttachment(attachment: string): Promise<Message[]>;
   close(): Promise<void>;