@vercel/board 0.30.0 → 0.31.0

package/dist/{exports-CG0P8Qi4.mjs → exports-CWIdN0Ub.mjs}

@@ -1,11 +1,12 @@
 import { t as ATTACHMENT_BYTES_MAX } from "./files-SniSmeEr.mjs";
 import "./schemas-DBmUO6pr.mjs";
-import { A as ScheduleBody, B as SyncImportBody, C as LinkedQuery, D as ReactBody, E as PostBody, F as SyncAccountBody, G as TypingBody, H as SyncRootsQuery, I as SyncBody, K as UploadStartBody, L as SyncCodeBody, M as SignInQuery, N as SourceJoinBody, O as Ref, P as SourceReadQuery, R as SyncCopiesQuery, S as LabelBody, T as MessagesQuery, U as SyncUnlinkBody, V as SyncReceiptBody, W as ThreadsQuery, _ as IdentityUnlinkBody, a as METHODS, b as InboxPushBody, c as queryObject, d as VERSION, f as SYNC, g as EventsQuery, h as EditBody, j as SchedulesQuery, k as RegisterBody, l as readCapped, m as DeleteBody, o as createRouter, p as AckBody, s as openapi, u as readJson, v as InboxAckBody, w as MatchesQuery, x as InboxQuery, y as InboxNextQuery, z as SyncFindQuery } from "./watchers-hash-B_5b0-ZG.mjs";
-import { a as forbidden, c as toErrorResponse, d as createBoardClient, l as unauthorized, n as RejectedError, o as json, r as badRequest, s as notFound, t as HttpError, u as BoardError } from "./errors-C_5rB8Iz.mjs";
+import { A as RegisterBody, B as ThreadsQuery, C as LabelBody, D as PostBody, E as MessagesQuery, F as SyncBody, H as TypingBody, I as SyncCopiesQuery, L as SyncFindQuery, M as SchedulesQuery, N as SourceJoinBody, O as ReactBody, P as SourceReadQuery, R as SyncImportBody, S as InboxQuery, T as MatchesQuery, U as UploadStartBody, V as TokenBody, _ as EventsQuery, a as METHODS, b as InboxNextQuery, c as queryObject, d as VERSION, f as SYNC, g as EditBody, h as DeleteBody, j as ScheduleBody, k as Ref, l as readCapped, m as CreateChannelBody, o as createRouter, p as AckBody, s as openapi, u as readJson, v as GrantBody, w as LinkedQuery, x as InboxPushBody, y as InboxAckBody, z as SyncReceiptBody } from "./watchers-hash-BjwlnGD9.mjs";
+import { a as forbidden, c as toErrorResponse, d as createBoardClient, l as unauthorized, n as RejectedError, o as json, r as badRequest, s as notFound, t as HttpError, u as BoardError } from "./errors-CJXhhzvT.mjs";
 import { r as derivedId } from "./wait-until-Dw4XrIDQ.mjs";
-import { i as resolveActor, r as claimsOf, t as KNOWN_AGENTS } from "./actors-xPiamLWk.mjs";
-import { d as issuersOf, g as verifiesTokens, l as hostPrincipal, o as createAuthority, s as fromTokens } from "./auth-BPinwfN0.mjs";
-import { r as runMiddleware, t as DroppedError } from "./middleware-DlJQYiwV.mjs";
+import { a as scopeOf, i as parseScope, r as compileAccess } from "./access-CY5xVMIK.mjs";
+import { i as resolveActor, r as claimsOf, t as KNOWN_AGENTS } from "./actors-Bm-ojWWT.mjs";
+import { S as verifiesTokens, a as VERCEL_ISSUER, f as grantIssuers, h as issuersOf, l as createAuthority, p as hostPrincipal, u as fromTokens, y as tokenHash } from "./auth-CyO2aw5n.mjs";
+import { r as runMiddleware, t as DroppedError } from "./middleware-BavYSDUa.mjs";
 import { n as syncTarget, r as withEmailMentions, t as mentionsEmails } from "./targets-Cgjs29T0.mjs";
 //#region src/server/policy.ts
 /**
@@ -13,10 +14,11 @@ import { n as syncTarget, r as withEmailMentions, t as mentionsEmails } from "./
 * principals its backend stores. `keeps`: the backend keeps the board, so the defaults let its
 * people and own deployments in when `access` is left out.
 */
-function createPolicy(options, keeps, serving) {
+function createPolicy(options, keeps, serving, trust = null) {
 	/** Whether requests are served at all: a board on `http()` serves none without an `access` of its own. */
 	const open = keeps || options.access !== void 0;
 	const access = options.access ?? [];
+	const grants = trust && typeof access !== "function" ? () => trust.grants() : null;
 	/** The board's own Vercel project and team, from `project` or the environment, asked once. */
 	let own = null;
 	const project = () => (own ??= (async () => {
@@ -48,12 +50,39 @@ function createPolicy(options, keeps, serving) {
 	const authority = createAuthority({
 		access,
 		project,
-		hosts: options.authenticate !== void 0 && !verifiesTokens(options.authenticate)
+		hosts: options.authenticate !== void 0 && !verifiesTokens(options.authenticate),
+		grants
 	});
+	const ruleIssuers = typeof access === "function" ? [] : issuersOf(access);
+	/** One for every request, so a verifier keeps what it built: its issuers change only when grants name new ones. */
 	const context = {
 		project,
-		issuers: typeof access === "function" ? [] : issuersOf(access)
+		issuers: ruleIssuers
 	};
+	/**
+	* Trusts the issuers grants name, before a token from one is verified: only for a token from an
+	* issuer neither Vercel, GitHub, nor a rule is, so most requests read no grants for it.
+	*/
+	async function learnIssuers(credential) {
+		if (!grants) return;
+		const iss = issuerOf(credential);
+		if (iss === null || !iss.startsWith("https://") || iss === "https://token.actions.githubusercontent.com" || VERCEL_ISSUER.test(iss) || ruleIssuers.includes(iss)) return;
+		const named = grantIssuers(await grants());
+		const issuers = [...ruleIssuers, ...named.filter((issuer) => !ruleIssuers.includes(issuer))];
+		if (issuers.join("\n") !== context.issuers.join("\n")) context.issuers = issuers;
+	}
+	/** Who a board token is: the principal that minted it, narrowed, until it's revoked or expires. */
+	async function tokenPrincipal(secret) {
+		if (!trust) throw unauthorized("this board issues no tokens: send a board token to the board that minted it");
+		const found = await trust.token(await tokenHash(secret));
+		if (!found || found.expiresAt.getTime() <= Date.now()) throw unauthorized("invalid token: revoked, expired, or not this board's");
+		return {
+			...found.minter,
+			expiresAt: found.expiresAt,
+			token: found.id,
+			pinned: found.pinned
+		};
+	}
 	/** Verified principals by credential, until they expire, so a stream's polls don't verify from scratch. */
 	const verified = /* @__PURE__ */ new Map();
 	/** And by request, for one with no credential (a session cookie), for as long as it's served. */
@@ -79,7 +108,7 @@ function createPolicy(options, keeps, serving) {
 		const principal = verify(request);
 		perRequest.set(request, principal);
 		if (key !== null) principal.then((found) => {
-			if (found.facts?.issuer === "host" || found.expiresAt === null) return;
+			if (found.facts?.issuer === "host" || found.expiresAt === null || found.token !== void 0) return;
 			if (verified.size >= 1e3) verified.delete(verified.keys().next().value);
 			verified.set(key, {
 				principal,
@@ -89,6 +118,8 @@ function createPolicy(options, keeps, serving) {
 		return principal;
 	}
 	async function verify(request) {
+		if (request.credential?.startsWith("board_")) return tokenPrincipal(request.credential);
+		if (request.credential !== null) await learnIssuers(request.credential);
 		const authenticate = await verifier();
 		let result;
 		try {
@@ -107,6 +138,10 @@ function createPolicy(options, keeps, serving) {
 	return {
 		open,
 		project,
+		/** The OIDC issuers the rules name. */
+		issuers: ruleIssuers,
+		/** Whether grants decide anything here: not where `access` is one function, which decides alone. */
+		takesGrants: typeof access !== "function",
 		discoveryIdentity,
 		/**
 		* Who a request is, and what it may do now: verified, under the rules, with the profile it
@@ -115,11 +150,13 @@ function createPolicy(options, keeps, serving) {
 		*/
 		async identify(request) {
 			const found = await principalOf(request);
-			const principal = request.claims.scope === null ? found : {
+			const claims = found.pinned ? pinnedClaims(found.pinned, request.claims) : request.claims;
+			const scope = found.scope === void 0 ? claims.scope ?? void 0 : claims.scope === null ? found.scope : scopeOf(compileAccess(parseScope(found.scope)).narrow(parseScope(claims.scope)));
+			const principal = scope === void 0 ? found : {
 				...found,
-				scope: request.claims.scope
+				scope
 			};
-			const { author, actor } = resolveActor(principal, request.claims, request.audience);
+			const { author, actor } = resolveActor(principal, claims, request.audience);
 			return {
 				principal: {
 					...principal,
@@ -129,10 +166,38 @@ function createPolicy(options, keeps, serving) {
 				actor
 			};
 		},
-		/** What a stored principal (a schedule's creator, a watcher's registrant) may do now: null once nothing. */
-		accessNow: (principal) => authority.accessNow(principal)
+		/** What a stored principal (a schedule's creator, a watcher's registrant) may do now: null once nothing, its board token's revoking included. */
+		async accessNow(principal) {
+			if (principal.token !== void 0 && !await trust?.live(principal.token)) return null;
+			return authority.accessNow(principal);
+		}
 	};
 }
+/** A board token's pins, over what the request says: its profile and session win, and a person's name is the minter's. */
+function pinnedClaims(pinned, claims) {
+	return {
+		...claims,
+		...pinned.profile !== null ? {
+			profile: pinned.profile,
+			avatar: pinned.avatar
+		} : {},
+		...pinned.session !== null ? { session: pinned.session } : {},
+		handle: pinned.handle,
+		name: pinned.name
+	};
+}
+/** A JWT's `iss`, read but not verified: which issuer's keys would check it. Null for anything else. */
+function issuerOf(credential) {
+	const payload = credential.split(".")[1];
+	if (payload === void 0) return null;
+	try {
+		const json = atob(payload.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payload.length / 4) * 4, "="));
+		const { iss } = JSON.parse(json);
+		return typeof iss === "string" ? iss : null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/contract/logos.ts
 const LOGOS = {
@@ -182,6 +247,10 @@ const CREATED = /* @__PURE__ */ new Set([
 	"upload",
 	"uploadFinish"
 ]);
+/** An email, as `--mentions` names one: sync looks its platform user up. */
+const EMAIL = /^[^\s@]+@[^\s@]+$/;
+/** How long a filter's email lookup holds. */
+const EMAIL_TTL_MS = 3e5;
 /** Shown inline only when a browser can't run it: everything else downloads. */
 const INLINE = /^(image\/(png|jpeg|gif|webp|avif)|video\/(mp4|webm)|text\/plain)$/;
 /**
@@ -210,12 +279,15 @@ async function inputOf(name, request, url, params) {
 		case "me":
 		case "channels":
 		case "actors":
-		case "identity":
-		case "watchers": return {};
+		case "watchers":
+		case "grants":
+		case "tokens": return {};
 		case "message":
 		case "posted":
 		case "synced":
 		case "cancelSchedule":
+		case "revokeGrant":
+		case "revokeToken":
 		case "attachment":
 		case "uploadFinish": return { id };
 		case "messages": return MessagesQuery.parse(queryObject(url));
@@ -229,7 +301,10 @@ async function inputOf(name, request, url, params) {
 			return query;
 		}
 		case "post": return PostBody.parse(await body());
+		case "createChannel": return CreateChannelBody.parse(await body());
 		case "schedule": return ScheduleBody.parse(await body());
+		case "createGrant": return GrantBody.parse(await body());
+		case "createToken": return TokenBody.parse(await body());
 		case "register": return RegisterBody.parse(await body());
 		case "edit": return {
 			id,
@@ -271,7 +346,6 @@ async function inputOf(name, request, url, params) {
 		case "syncThread": return { thread: params.thread ?? "" };
 		case "syncFind": return SyncFindQuery.parse(queryObject(url));
 		case "syncCopies": return SyncCopiesQuery.parse(queryObject(url));
-		case "syncRoots": return SyncRootsQuery.parse(queryObject(url));
 		case "inboxPush": return {
 			key,
 			...InboxPushBody.parse(await body())
@@ -289,9 +363,6 @@ async function inputOf(name, request, url, params) {
 			key,
 			...InboxQuery.parse(queryObject(url))
 		};
-		case "syncCode": return SyncCodeBody.parse(await body());
-		case "syncAccount": return SyncAccountBody.parse(await body());
-		case "syncUnlink": return SyncUnlinkBody.parse(await body());
 		case "typing": return {
 			id,
 			...TypingBody.parse(await body()) ?? {}
@@ -371,17 +442,48 @@ async function createServe(context) {
 	* board learns who they are; the rest stay plain text.
 	*/
 	async function withEmails(text) {
-		return (await withEmailMentions(text, engine ? async (email) => {
-			const actor = await engine.findByEmail(email);
-			if (actor) await backend.syncImport(engine.caller, {
-				op: "seen",
-				author: {
-					...actor,
-					isBot: false
-				}
-			}, new AbortController().signal);
-			return actor;
-		} : void 0)).text;
+		return (await withEmailMentions(text, engine ? learnEmail : void 0)).text;
+	}
+	/**
+	* The synced platform's user with this email, whom the board learns: a post can mention only
+	* an actor it knows, and a platform mention of them resolves only once it does.
+	*/
+	async function learnEmail(email) {
+		const actor = await engine.findByEmail(email);
+		if (actor) await backend.syncImport(engine.caller, {
+			op: "seen",
+			author: {
+				...actor,
+				isBot: false
+			}
+		}, new AbortController().signal);
+		return actor;
+	}
+	/** Emails filters named, as sync found them, for a few minutes: `tail` and `wait` ask at every page. */
+	const mentioned = /* @__PURE__ */ new Map();
+	/**
+	* `--mentions ada@vercel.com`: the synced platform's user with that email, for a caller that may
+	* read somewhere. Anything else, and an email sync doesn't know, goes on as it came.
+	*/
+	async function withMentioned(caller, query) {
+		const email = query.mentions?.toLowerCase();
+		if (!engine || email === void 0 || !EMAIL.test(email)) return query;
+		const access = accessOf(caller);
+		if (access !== null && !access.anywhere("read")) return query;
+		let found = mentioned.get(email);
+		if (!found || Date.now() - found.at > EMAIL_TTL_MS) {
+			if (mentioned.size >= 1e3) mentioned.clear();
+			found = {
+				at: Date.now(),
+				actor: learnEmail(email).catch(() => null)
+			};
+			mentioned.set(email, found);
+		}
+		const actor = await found.actor;
+		return actor ? {
+			...query,
+			mentions: actor.id
+		} : query;
 	}
 	/**
 	* A sync target as the board that syncs it resolves it. One for an entry this board doesn't
@@ -819,8 +921,9 @@ async function createServe(context) {
 		}, signal);
 		return { message: await read(message) };
 	}
-	/** The protocol method `name`, as board() serves it: what it posts and edits with the emails they mention resolved. */
+	/** The protocol method `name`, as board() serves it: what it posts and edits, and the filters it reads by, with their emails resolved. */
 	async function invoke(name, caller, input, signal) {
+		if (name === "messages" || name === "threads" || name === "events") input = await withMentioned(caller, input);
 		switch (name) {
 			case "post": return post(caller, input, signal);
 			case "edit": {
@@ -833,6 +936,11 @@ async function createServe(context) {
 				});
 			}
 			case "syncImport": return syncImport(caller, input, signal);
+			case "grants":
+			case "createGrant":
+			case "revokeGrant":
+				if (backend.keeps && !policy.takesGrants) throw new HttpError(501, "no_grants", "this board's access is one function, which decides alone: it keeps no grants");
+				return backend[name].call(backend, caller, input, signal);
 			case "schedule": {
 				const body = input;
 				const schedule = (made) => backend.sendsSchedulesHere === false ? screenSchedule(caller, made, signal) : backend.schedule(caller, made, signal);
@@ -870,35 +978,6 @@ async function createServe(context) {
 			}
 		}
 	}
-	/**
-	* A sign-in that carries a code, where the entry's sync runs: a browser opens it with no token,
-	* so the code is all it has. `signIn` sends the person to the platform as whoever the code was
-	* issued to; `signedIn`, where the platform sends them back, links the account they approved.
-	*/
-	async function signingIn(name, url, signal) {
-		const { sync: key, code } = SignInQuery.parse(queryObject(url));
-		if (!engine || !entries[key]) throw notFound(`no sync entry named ${key}`);
-		const page = (status, text) => new Response(`${text}\n`, {
-			status,
-			headers: { "content-type": "text/plain; charset=utf-8" }
-		});
-		const { holder } = await backend.syncFind(engine.caller, { code }, signal);
-		if (holder === null) return page(404, "That link has expired or been used. Run `vb identity link` again for a new one.");
-		if (name === "signIn") {
-			const back = ownUrl();
-			const at = await engine.signIn(key, holder, back ? `${back}/identity/signed-in?${new URLSearchParams({
-				sync: key,
-				code
-			})}` : void 0);
-			return new Response(null, {
-				status: 302,
-				headers: { location: at }
-			});
-		}
-		const linked = await engine.redeemSignIn(key, holder, code);
-		if (!linked) return page(409, `${entries[key].platform} hasn't said you approved yet: finish signing in, then open this page again.`);
-		return page(200, `Linked ${linked.handle ? `@${linked.handle}` : linked.actor}. You can close this tab.`);
-	}
 	/** board()'s own routes for a caller: sync's, which run where board() does. */
 	async function serve(name, caller, request, url, params) {
 		const signal = request.signal;
@@ -925,19 +1004,6 @@ async function createServe(context) {
 					attached: attached ?? true
 				});
 			}
-			case "identityUnlink": {
-				const body = IdentityUnlinkBody.parse(await readJson(request));
-				const { links } = await backend.identity(caller, {}, signal);
-				const wanted = body.actor.replace(/^@/, "").toLowerCase();
-				const found = links.filter((link) => link.actor === body.actor || link.handle?.toLowerCase() === wanted).map((link) => link.actor);
-				if (found.length === 0) throw notFound(`${body.actor} isn't linked to you`, "not_linked");
-				if (found.length > 1) throw badRequest(`${body.actor} names several of your accounts: use ${found.join(" or ")}`, "ambiguous_actor");
-				await backend.syncUnlink(caller, { account: found[0] }, signal);
-				return json({
-					ok: true,
-					actor: found[0]
-				});
-			}
 			default: throw notFound(`no route: ${request.method} ${url.pathname}`);
 		}
 	}
@@ -1046,7 +1112,6 @@ async function createServe(context) {
 				if (!engine || !entries[match.params.key ?? ""]) throw notFound(`no sync entry named ${match.params.key}`);
 				return await engine.handleWebhook(match.params.key, request);
 			}
-			if (target.kind === "board" && (target.name === "signIn" || target.name === "signedIn")) return await signingIn(target.name, url, request.signal);
 			if (target.kind === "board" && target.name === "avatar") {
 				const name = match.param ?? "";
 				if (!KNOWN_AGENTS.includes(name)) throw notFound(`no avatar: ${name}`);
@@ -1068,10 +1133,11 @@ async function createServe(context) {
 			const caller = own ?? await callerOf(asked);
 			if (target.kind === "board") return await serve(target.name, caller, request, url, match.params);
 			const input = await inputOf(target.name, request, url, match.params);
-			if (target.name === "events" && (request.headers.get("accept") ?? "").includes("text/event-stream")) return await sse(caller, input, request, asked ? () => callerOf(asked) : null);
+			if (target.name === "events" && (request.headers.get("accept") ?? "").includes("text/event-stream")) return await sse(caller, await withMentioned(caller, input), request, asked ? () => callerOf(asked) : null);
 			const output = injected && "platform" in injected ? await asPlatform(target.name, injected, input, request.signal) : await invoke(target.name, caller, input, request.signal);
 			if (target.name === "attachment") return attachmentResponse(output);
-			return json(output, CREATED.has(target.name) ? 201 : 200);
+			const made = CREATED.has(target.name) || target.name === "createChannel" && output.created;
+			return json(output, made ? 201 : 200);
 		} catch (error) {
 			return toErrorResponse(error);
 		}
@@ -1136,7 +1202,7 @@ const EVENTS_WAIT_S = 25;
 */
 function createBoard(options, runtime) {
 	const backend = options.backend ?? runtime.http();
-	const policy = createPolicy(options, backend.keeps, runtime.serving);
+	const policy = createPolicy(options, backend.keeps, runtime.serving, backend.trust ?? null);
 	const watch = options.watch ?? {};
 	const entries = options.sync ?? {};
 	const state = { learned: null };
@@ -1244,8 +1310,7 @@ function createBoard(options, runtime) {
 	/** This board's sync entries, as its sync and discovery see them. */
 	const ownEntries = Object.entries(entries).map(([key, entry]) => ({
 		key,
-		platform: entry.platform,
-		signIn: entry.users !== null
+		platform: entry.platform
 	}));
 	const binding = {
 		subscriptions,
@@ -1278,6 +1343,7 @@ function createBoard(options, runtime) {
 		typing: async (messages, status) => (await server()).typing(messages, status),
 		accessNow: (principal) => policy.accessNow(principal),
 		project: () => policy.project(),
+		issuers: () => policy.issuers,
 		handle: (caller) => handleOf(caller, null),
 		url: ownUrl
 	};

package/dist/exports-FBOQWT7O.d.mts

@@ -0,0 +1,5 @@
+import "./auth-DLYSt_-A.mjs";
+import "./folds-DLUzfibJ.mjs";
+import "./client-COfYrgfV.mjs";
+import "./backend-Bob-5CM7.mjs";
+import "./errors-2vGs49Db.mjs";

package/dist/{folds-DGYkMW19.mjs → folds-Cu9Q9zyQ.mjs}

@@ -111,28 +111,8 @@ function foldMessage(state, event) {
 		default: return;
 	}
 }
-/** The principal an actor belongs to: its link, its own principal for a profile (`…+claude`), or itself. */
-function personOf(actors, actor) {
-	const linked = own(actors.links, actor)?.to;
-	if (linked) return linked;
-	const plus = actor.indexOf("+");
-	return plus === -1 ? actor : actor.slice(0, plus);
-}
-/** The platform actors linked to `principal`. */
-const linkedTo = (actors, principal) => Object.entries(actors.links).filter(([, link]) => link.to === principal).map(([actor]) => actor);
+/** Who's who: `actor.seen`. */
 function foldActors(state, event) {
-	if (event.type === "actor.linked") {
-		setOwn(state.links, event.payload.actor, {
-			to: event.payload.to,
-			method: event.payload.method,
-			at: iso(event.createdAt)
-		});
-		return state;
-	}
-	if (event.type === "actor.unlinked") {
-		delete state.links[event.payload.actor];
-		return state;
-	}
 	if (event.type !== "actor.seen") return state;
 	const { actor, kind, handle, name, avatar, host } = event.payload;
 	const previous = own(state.byId, actor);
@@ -224,4 +204,4 @@ function foldSync(state, event) {
 	}
 }
 //#endregion
-export { linkedTo as a, iso as i, foldMessages as n, personOf as o, foldSync as r, foldActors as t };
+export { iso as i, foldMessages as n, foldSync as r, foldActors as t };

package/dist/{folds-8wRRXjAt.d.mts → folds-DLUzfibJ.d.mts}

@@ -101,6 +101,19 @@ declare const boardEvents: {
     blind: z.ZodOptional<z.ZodLiteral<true>>;
     importedBy: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
+  /**
+   * A channel made before anything posted to it. A post makes one too, with no event of its own:
+   * this is only for one that's empty. It names no message, so it carries no `id`.
+   */
+  'channel.created': z.ZodObject<{
+    channel: z.ZodString;
+    by: z.ZodObject<{
+      actor: z.ZodString;
+      principal: z.ZodString;
+      profile: z.ZodNullable<z.ZodString>;
+      session: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+  }, z.core.$strip>;
   /** A message's links changed: an edit linked something new, or the platform sent what a link says. */
   'message.linked': z.ZodObject<{
     id: z.ZodNumber;
@@ -214,7 +227,6 @@ declare const boardEvents: {
     external: z.ZodObject<{
       thread: z.ZodString;
       message: z.ZodString;
-      asUser: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strip>;
     syncedBy: z.ZodOptional<z.ZodString>;
   }, z.core.$strip>;
@@ -251,35 +263,6 @@ declare const boardEvents: {
     avatar: z.ZodNullable<z.ZodString>;
     host: z.ZodOptional<z.ZodLiteral<true>>;
   }, z.core.$strip>;
-  /**
-   * A platform actor (`slack:user:U0456`) is the same person as a principal
-   * (`vercel:user:…`): for display, `--by`, and mentions, never for permissions.
-   * `method` says how it was proved: a one-time code posted from that account,
-   * or the account's own sign-in (`consent`).
-   */
-  'actor.linked': z.ZodObject<{
-    actor: z.ZodString;
-    to: z.ZodString;
-    method: z.ZodEnum<{
-      code: "code";
-      consent: "consent";
-    }>;
-    by: z.ZodObject<{
-      actor: z.ZodString;
-      principal: z.ZodString;
-      profile: z.ZodNullable<z.ZodString>;
-      session: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>;
-  }, z.core.$strip>;
-  'actor.unlinked': z.ZodObject<{
-    actor: z.ZodString;
-    by: z.ZodObject<{
-      actor: z.ZodString;
-      principal: z.ZodString;
-      profile: z.ZodNullable<z.ZodString>;
-      session: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>;
-  }, z.core.$strip>;
 };
 declare const BOARD_SESSION = "board";
 type BoardEvents = typeof boardEvents;
@@ -548,28 +531,18 @@ type Actor = {
   /** A host's principal, or one of its profiles: once it's seen as one, it stays one. Views leave it out. */
   host?: true;
 };
-/** A platform actor proved to be a principal (`actor.linked`). */
-type ActorLink = {
-  to: string;
-  method: 'code' | 'consent';
-  at: string;
-};
 type ActorsState = {
   byId: Record<string, Actor>;
   /** Lowercased handle → actor IDs. Handles aren't reserved, so several can share one. */
   byHandle: Record<string, string[]>;
-  /** Platform actor → the principal it's linked to. Display and filtering only, never permissions. */
-  links: Record<string, ActorLink>;
 };
 /** A copy of a board message on a platform. */
 /** `files`: the platform's IDs for the message's files, or null when it refused them; unset until they're sent. */
-/** `asUser`: posted with its author's own token, so editing or deleting it needs that token too. */
 /** `by`: the principal of the sync elsewhere that recorded it, whose copy it is to change; none for the board's own sync's. */
 type ExternalCopy = {
   thread: string;
   message: string;
   files?: string[] | null;
-  asUser?: true;
   by?: string;
 };
 type SyncedThread = {

package/dist/{index-BygAXP7t.d.mts → index-Ho-ayyQL.d.mts}

@@ -1,5 +1,5 @@
-import { d as Board, f as BoardOptions } from "./backend-n3hajfrD.mjs";
-import "./exports-CrGA5_yN.mjs";
+import { f as Board, p as BoardOptions } from "./backend-Bob-5CM7.mjs";
+import "./exports-FBOQWT7O.mjs";
 //#region src/server/index.d.ts
 /**
  * The handle on a board. With a `backend`, the board lives there: `a2()` keeps it in this

package/dist/index.d.mts

@@ -1,9 +1,9 @@
-import { a as CallerRequest, o as Claims } from "./auth-CU56Q2Xh.mjs";
-import { x as Attachment } from "./folds-8wRRXjAt.mjs";
-import { $ as RegisterBody, A as InboxItem, At as SyncReceiptInput, B as MatchesQuery, Bt as TypingBody, C as EventsQuery, Ct as SyncCopiesView, D as IdentityView, Dt as SyncImportBody, E as IdentityUnlinkBody, Et as SyncFindView, F as LabelBody, Ft as ThreadSummaryView, G as MessagesQueryInput, H as MessageView, Ht as UploadStartBody, I as LinkView, It as ThreadView, J as PostBody, K as ParsedFilters, L as LinkedAccount, Lt as ThreadsPage, M as InboxPushBody, Mt as SyncThreadView, N as InboxQuery, Nt as SyncUnlinkBody, O as InboxAckBody, Ot as SyncImportInput, P as LABEL_CONDITIONS_MAX, Pt as SyncedView, Q as Ref, R as LinkedQuery, Rt as ThreadsQuery, S as EventsPage, St as SyncCopiesQuery, T as FiltersInput, Tt as SyncFindQuery, U as MessagesPage, Ut as UploadTicket, V as Me, Vt as TypingResult, W as MessagesQuery, Wt as routes, X as REGISTERED_WATCHERS_MAX, Y as PostInput, Z as ReactBody, _ as BoardEventView, _t as SyncAccountBody, a as PostOptions, at as ScheduleBodyOutput, b as Discovery, bt as SyncCodeBody, c as ScheduleOptions, ct as SchedulesQuery, d as WaitOptions, dt as SignInQuery, et as RegisterInput, f as Written, ft as SourceJoin, g as ApiError, gt as SourceReadQuery, h as ActorView, ht as SourceRead, i as Filters, it as ScheduleBody, j as InboxNextQuery, jt as SyncRootsQuery, k as InboxEntry, kt as SyncReceiptBody, l as ScheduleTiming, lt as SchedulesQueryInput, m as AckBody, mt as SourceMessage, n as BoardError, nt as ResolvedSyncTarget, o as ProfileOption, ot as ScheduleInput, p as duration, pt as SourceJoinBody, q as PersonView, rt as RouteName, s as ReplyOptions, st as ScheduleView, tt as RegistrationView, u as UploadInput, ut as SchedulesQueryOutput, v as ChannelView, vt as SyncAccountInput, w as EventsQueryInput, wt as SyncFindInput, x as EditBody, xt as SyncCodeView, y as DeleteBody, yt as SyncBody, z as MatchView, zt as ThreadsQueryInput } from "./client-CjAatpV4.mjs";
-import { S as Protocol, _ as MiddlewareContext, a as Identity, b as WriteSource, c as SelfCaller, d as Board, f as BoardOptions, g as Middleware, h as DroppedError, i as Caller, l as Subscription, m as WatcherContext, n as BackendRoute, o as InboxDelivery, p as Watcher, r as BoardBinding, s as ProtocolMethods, t as Backend, u as VerifiedCaller, v as Write, x as Method, y as WritePatch } from "./backend-n3hajfrD.mjs";
-import { t as HttpError } from "./errors-87TVtXeb.mjs";
-import "./exports-CrGA5_yN.mjs";
+import { a as CallerRequest, o as Claims } from "./auth-DLYSt_-A.mjs";
+import { x as Attachment } from "./folds-DLUzfibJ.mjs";
+import { $ as RegisterBody, A as InboxAckBody, At as ThreadsPage, B as MatchView, Bt as routes, C as EventsPage, Ct as SyncImportInput, D as GrantBody, Dt as SyncedView, E as FiltersInput, Et as SyncThreadView, F as InboxQuery, Ft as TokenView, G as MessagesQuery, H as Me, I as LABEL_CONDITIONS_MAX, It as TypingBody, J as PostBody, K as MessagesQueryInput, L as LabelBody, Lt as TypingResult, M as InboxItem, Mt as ThreadsQueryInput, N as InboxNextQuery, Nt as TokenBody, O as GrantInput, Ot as ThreadSummaryView, P as InboxPushBody, Pt as TokenInput, Q as Ref, R as LinkView, Rt as UploadStartBody, S as EditBody, St as SyncImportBody, T as EventsQueryInput, Tt as SyncReceiptInput, U as MessageView, V as MatchesQuery, W as MessagesPage, X as REGISTERED_WATCHERS_MAX, Y as PostInput, Z as ReactBody, _ as BoardEventView, _t as SyncCopiesQuery, a as PostOptions, at as ScheduleBodyOutput, b as DeleteBody, bt as SyncFindQuery, c as ScheduleOptions, ct as SchedulesQuery, d as WaitOptions, dt as SourceJoin, et as RegisterInput, f as Written, ft as SourceJoinBody, g as ApiError, gt as SyncBody, h as ActorView, ht as SourceReadQuery, i as Filters, it as ScheduleBody, j as InboxEntry, jt as ThreadsQuery, k as GrantView, kt as ThreadView, l as ScheduleTiming, lt as SchedulesQueryInput, m as AckBody, mt as SourceRead, n as BoardError, nt as ResolvedSyncTarget, o as ProfileOption, ot as ScheduleInput, p as duration, pt as SourceMessage, q as ParsedFilters, rt as RouteName, s as ReplyOptions, st as ScheduleView, tt as RegistrationView, u as UploadInput, ut as SchedulesQueryOutput, v as ChannelView, vt as SyncCopiesView, w as EventsQuery, wt as SyncReceiptBody, x as Discovery, xt as SyncFindView, y as CreateChannelBody, yt as SyncFindInput, z as LinkedQuery, zt as UploadTicket } from "./client-COfYrgfV.mjs";
+import { C as Protocol, S as Method, _ as Middleware, a as Identity, b as WritePatch, c as SelfCaller, d as VerifiedCaller, f as Board, g as DroppedError, h as WatcherContext, i as Caller, m as Watcher, n as BackendRoute, o as InboxDelivery, p as BoardOptions, r as BoardBinding, s as ProtocolMethods, t as Backend, u as Subscription, v as MiddlewareContext, x as WriteSource, y as Write } from "./backend-Bob-5CM7.mjs";
+import { t as HttpError } from "./errors-2vGs49Db.mjs";
+import "./exports-FBOQWT7O.mjs";
 //#region src/server/index.default.d.ts
 /**
  * The handle on a board. Outside Node there's no environment to find one in, so pass its
@@ -11,4 +11,4 @@ import "./exports-CrGA5_yN.mjs";
  */
 export declare function board(options?: BoardOptions): Board;
 //#endregion
-export { type AckBody, type ActorView, type ApiError, type Attachment, type Backend, type BackendRoute, type Board, type BoardBinding, BoardError, type BoardEventView, type BoardOptions, type Caller, type CallerRequest, type ChannelView, type Claims, type DeleteBody, type Discovery, DroppedError, type EditBody, type EventsPage, type EventsQuery, type EventsQueryInput, type Filters, type FiltersInput, HttpError, type Identity, type IdentityUnlinkBody, type IdentityView, type InboxAckBody, type InboxDelivery, type InboxEntry, type InboxItem, type InboxNextQuery, type InboxPushBody, type InboxQuery, type LABEL_CONDITIONS_MAX, type LabelBody, type LinkView, type LinkedAccount, type LinkedQuery, type MatchView, type MatchesQuery, type Me, type MessageView, type MessagesPage, type MessagesQuery, type MessagesQueryInput, type Method, type Middleware, type MiddlewareContext, type ParsedFilters, type PersonView, type PostBody, type PostInput, type PostOptions, type ProfileOption, type Protocol, type ProtocolMethods, type REGISTERED_WATCHERS_MAX, type ReactBody, type Ref, type RegisterBody, type RegisterInput, type RegistrationView, type ReplyOptions, type ResolvedSyncTarget, type RouteName, type ScheduleBody, type ScheduleBodyOutput, type ScheduleInput, type ScheduleOptions, type ScheduleTiming, type ScheduleView, type SchedulesQuery, type SchedulesQueryInput, type SchedulesQueryOutput, type SelfCaller, type SignInQuery, type SourceJoin, type SourceJoinBody, type SourceMessage, type SourceRead, type SourceReadQuery, type Subscription, type SyncAccountBody, type SyncAccountInput, type SyncBody, type SyncCodeBody, type SyncCodeView, type SyncCopiesQuery, type SyncCopiesView, type SyncFindInput, type SyncFindQuery, type SyncFindView, type SyncImportBody, type SyncImportInput, type SyncReceiptBody, type SyncReceiptInput, type SyncRootsQuery, type SyncThreadView, type SyncUnlinkBody, type SyncedView, type ThreadSummaryView, type ThreadView, type ThreadsPage, type ThreadsQuery, type ThreadsQueryInput, type TypingBody, type TypingResult, type UploadInput, type UploadStartBody, type UploadTicket, type VerifiedCaller, type WaitOptions, type Watcher, type WatcherContext, type Write, type WritePatch, type WriteSource, type Written, duration, type routes };
+export { type AckBody, type ActorView, type ApiError, type Attachment, type Backend, type BackendRoute, type Board, type BoardBinding, BoardError, type BoardEventView, type BoardOptions, type Caller, type CallerRequest, type ChannelView, type Claims, type CreateChannelBody, type DeleteBody, type Discovery, DroppedError, type EditBody, type EventsPage, type EventsQuery, type EventsQueryInput, type Filters, type FiltersInput, type GrantBody, type GrantInput, type GrantView, HttpError, type Identity, type InboxAckBody, type InboxDelivery, type InboxEntry, type InboxItem, type InboxNextQuery, type InboxPushBody, type InboxQuery, type LABEL_CONDITIONS_MAX, type LabelBody, type LinkView, type LinkedQuery, type MatchView, type MatchesQuery, type Me, type MessageView, type MessagesPage, type MessagesQuery, type MessagesQueryInput, type Method, type Middleware, type MiddlewareContext, type ParsedFilters, type PostBody, type PostInput, type PostOptions, type ProfileOption, type Protocol, type ProtocolMethods, type REGISTERED_WATCHERS_MAX, type ReactBody, type Ref, type RegisterBody, type RegisterInput, type RegistrationView, type ReplyOptions, type ResolvedSyncTarget, type RouteName, type ScheduleBody, type ScheduleBodyOutput, type ScheduleInput, type ScheduleOptions, type ScheduleTiming, type ScheduleView, type SchedulesQuery, type SchedulesQueryInput, type SchedulesQueryOutput, type SelfCaller, type SourceJoin, type SourceJoinBody, type SourceMessage, type SourceRead, type SourceReadQuery, type Subscription, type SyncBody, type SyncCopiesQuery, type SyncCopiesView, type SyncFindInput, type SyncFindQuery, type SyncFindView, type SyncImportBody, type SyncImportInput, type SyncReceiptBody, type SyncReceiptInput, type SyncThreadView, type SyncedView, type ThreadSummaryView, type ThreadView, type ThreadsPage, type ThreadsQuery, type ThreadsQueryInput, type TokenBody, type TokenInput, type TokenView, type TypingBody, type TypingResult, type UploadInput, type UploadStartBody, type UploadTicket, type VerifiedCaller, type WaitOptions, type Watcher, type WatcherContext, type Write, type WritePatch, type WriteSource, type Written, duration, type routes };

package/dist/{index.default-DhkgpfR2.mjs → index.default-BUcwDaAe.mjs}

@@ -1,4 +1,4 @@
-import { r as createHttp } from "./backend-http-BPaNYLWj.mjs";
+import { r as createHttp } from "./backend-http-CvUKOn-m.mjs";
 //#region src/backend-http/index.default.ts
 /**
 * The board at `url`, which keeps the log. Outside Node there's no environment to find it or a

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { f as duration, t as HttpError, u as BoardError } from "./errors-C_5rB8Iz.mjs";
-import { t as http } from "./index.default-DhkgpfR2.mjs";
-import { t as createBoard } from "./exports-CG0P8Qi4.mjs";
-import { t as DroppedError } from "./middleware-DlJQYiwV.mjs";
+import { f as duration, t as HttpError, u as BoardError } from "./errors-CJXhhzvT.mjs";
+import { t as http } from "./index.default-BUcwDaAe.mjs";
+import { t as createBoard } from "./exports-CWIdN0Ub.mjs";
+import { t as DroppedError } from "./middleware-BavYSDUa.mjs";
 //#region src/server/index.default.ts
 /**
 * The handle on a board. Outside Node there's no environment to find one in, so pass its
@@ -10,7 +10,7 @@ import { t as DroppedError } from "./middleware-DlJQYiwV.mjs";
 function board(options = {}) {
 	return createBoard(options, {
 		http: () => http(),
-		sync: () => import("./engine-DkdkXQEy.mjs"),
+		sync: () => import("./engine-DurYIRt8.mjs"),
 		serving: null
 	});
 }