@vercel/board 0.30.0 → 0.31.0

package/dist/{access-CQ39gqEV.mjs → access-CY5xVMIK.mjs}

@@ -1,5 +1,5 @@
 import { c as ChannelPath, v as SCOPE_MAX } from "./schemas-DBmUO6pr.mjs";
-import { a as forbidden } from "./errors-C_5rB8Iz.mjs";
+import { a as forbidden } from "./errors-CJXhhzvT.mjs";
 //#region src/server/access.ts
 /**
 * What a principal may do in a channel. `read` covers messages, threads,
@@ -135,7 +135,7 @@ function fromRules(rules) {
 	const entries = entriesIn(rules);
 	const everywhere = (permission) => (rules.all?.has(permission) ?? false) && entries.every(([, permissions]) => permissions.has(permission));
 	const readable = /* @__PURE__ */ new Map();
-	return {
+	const compiled = {
 		[RULES]: rules,
 		can: (permission, channel) => resolve(rules, channel).has(permission),
 		readable(channel) {
@@ -163,12 +163,28 @@ function fromRules(rules) {
 			return out;
 		}
 	};
+	return Object.freeze(compiled);
 }
 /** Access from config: `'all'`, a list for every channel, or a map from pattern to grant. Throws on a bad pattern or permission. */
 function compileAccess(can) {
 	return fromRules(canonical(entriesOf(can)));
 }
 const FULL_ACCESS = compileAccess("all");
+const NO_ACCESS = compileAccess([]);
+/** What any of `accesses` allows, channel by channel: grants that match one principal add up. */
+function union(accesses) {
+	const all = accesses.filter(isAccess);
+	if (all.length === 0) return NO_ACCESS;
+	const rules = all.map((access) => access[RULES]);
+	const patterns = /* @__PURE__ */ new Map([["*", { kind: "all" }]]);
+	for (const side of rules) for (const [pattern] of entriesIn(side)) patterns.set(key(pattern), pattern);
+	return fromRules(canonical([...patterns.values()].map((pattern) => [pattern, new Set(rules.flatMap((side) => [...at(side, pattern)]))])));
+}
+/** An access as `x-board-scope` writes it, `dev/=read,post;ci/=read`, or `*=` for nothing: what a stored principal keeps. */
+function scopeOf(access) {
+	const entries = Object.entries(access.summary()).map(([pattern, permissions]) => `${pattern}=${permissions.join(",")}`);
+	return entries.length > 0 ? entries.join(";") : "*=";
+}
 /**
 * `x-board-scope`: `dev/=read,post,react,label;ci/=read`. Each entry is a
 * pattern and its permissions (or `all`). It's meant for a proxy that holds the
@@ -223,4 +239,4 @@ function authorize(access, permission, channel, hidden) {
 	});
 }
 //#endregion
-export { parseScope as i, authorize as n, compileAccess as r, FULL_ACCESS as t };
+export { scopeOf as a, parseScope as i, authorize as n, union as o, compileAccess as r, FULL_ACCESS as t };

package/dist/{access-CV96SYgr.d.mts → access-DPcrKIH_.d.mts}

@@ -28,5 +28,10 @@ type Access = {
   /** Each pattern and its permissions, `*` first and the rest sorted; an empty `*` is left out. */
   summary(): AccessSummary;
 };
+/** Access from config: `'all'`, a list for every channel, or a map from pattern to grant. Throws on a bad pattern or permission. */
+declare function compileAccess(can: Can): Access;
+declare const FULL_ACCESS: Access;
+/** What any of `accesses` allows, channel by channel: grants that match one principal add up. */
+declare function union(accesses: readonly Access[]): Access;
 //#endregion
-export { Grant as a, ChannelPattern as i, AccessSummary as n, Permission as o, Can as r, Access as t };
+export { FULL_ACCESS as a, compileAccess as c, ChannelPattern as i, union as l, AccessSummary as n, Grant as o, Can as r, Permission as s, Access as t };

package/dist/access.d.mts

@@ -1,6 +1,6 @@
-import { a as Grant, i as ChannelPattern, n as AccessSummary, o as Permission, r as Can, t as Access } from "./access-CV96SYgr.mjs";
-import { _ as oidc, a as CallerRequest, c as HostPrincipal, d as OidcTokensOptions, f as Principal, g as githubActions, h as compileRules, i as AuthenticateContext, l as IssuerConfig, m as RuleFunction, n as AccessRule, o as Claims, p as PrincipalKind, r as Authenticate, t as AccessFunction, u as Known, v as vercelProject } from "./auth-CU56Q2Xh.mjs";
-import { C as Author, t as Actor } from "./folds-8wRRXjAt.mjs";
+import { a as FULL_ACCESS, c as compileAccess, i as ChannelPattern, l as union, n as AccessSummary, o as Grant, r as Can, s as Permission, t as Access } from "./access-DPcrKIH_.mjs";
+import { a as CallerRequest, b as oidc, d as Known, f as OidcTokensOptions, g as RuleFunction, h as PrincipalKind, i as AuthenticateContext, l as HostPrincipal, m as Principal, n as AccessRule, o as Claims, r as Authenticate, s as DEFAULT_CAN, t as AccessFunction, u as IssuerConfig, v as compileRules, x as vercelProject, y as githubActions } from "./auth-DLYSt_-A.mjs";
+import { C as Author, t as Actor } from "./folds-DLUzfibJ.mjs";
 //#region src/server/tokens.d.ts
 /**
  * The OIDC tokens made out to this board: a request's bearer token, from Vercel (people and
@@ -26,4 +26,4 @@ type ResolvedActor = {
  */
 export declare function resolveActor(principal: Principal, claims: Claims, audience: string): ResolvedActor;
 //#endregion
-export { type Access, type AccessFunction, type AccessRule, type AccessSummary, type Authenticate, type AuthenticateContext, type CallerRequest, type Can, type ChannelPattern, type Claims, type Grant, type HostPrincipal, type IssuerConfig, type Known, type OidcTokensOptions, type Permission, type Principal, type PrincipalKind, type RuleFunction, compileRules, githubActions, oidc, vercelProject };
+export { type Access, type AccessFunction, type AccessRule, type AccessSummary, type Authenticate, type AuthenticateContext, type CallerRequest, type Can, type ChannelPattern, type Claims, DEFAULT_CAN, FULL_ACCESS, type Grant, type HostPrincipal, type IssuerConfig, type Known, type OidcTokensOptions, type Permission, type Principal, type PrincipalKind, type RuleFunction, compileAccess, compileRules, githubActions, oidc, union, vercelProject };

package/dist/access.mjs

@@ -1,4 +1,5 @@
-import { i as resolveActor } from "./actors-xPiamLWk.mjs";
-import { a as compileRules, c as githubActions, h as vercelProject, p as oidc } from "./auth-BPinwfN0.mjs";
-import { t as oidcTokens } from "./tokens-C5_yGRlL.mjs";
-export { compileRules, githubActions, oidc, oidcTokens, resolveActor, vercelProject };
+import { o as union, r as compileAccess, t as FULL_ACCESS } from "./access-CY5xVMIK.mjs";
+import { i as resolveActor } from "./actors-Bm-ojWWT.mjs";
+import { _ as oidc, c as compileRules, d as githubActions, n as DEFAULT_CAN, x as vercelProject } from "./auth-CyO2aw5n.mjs";
+import { t as oidcTokens } from "./tokens-Dnyd_y1n.mjs";
+export { DEFAULT_CAN, FULL_ACCESS, compileAccess, compileRules, githubActions, oidc, oidcTokens, resolveActor, union, vercelProject };

package/dist/{actors-xPiamLWk.mjs → actors-Bm-ojWWT.mjs}

@@ -1,8 +1,8 @@
 import { C as toStorable } from "./schemas-DBmUO6pr.mjs";
-import { r as badRequest } from "./errors-C_5rB8Iz.mjs";
+import { r as badRequest } from "./errors-CJXhhzvT.mjs";
+import { i as parseScope } from "./access-CY5xVMIK.mjs";
 import { t as own } from "./own-OwgPWdmh.mjs";
 import { t as extractMentions } from "./mentions-CB6ShY4R.mjs";
-import { i as parseScope } from "./access-CQ39gqEV.mjs";
 //#region src/server/actors.ts
 /** Agents whose avatars the board serves itself. */
 const KNOWN_AGENTS = [

package/dist/{auth-BPinwfN0.mjs → auth-CyO2aw5n.mjs}

@@ -1,7 +1,15 @@
-import { a as forbidden, l as unauthorized } from "./errors-C_5rB8Iz.mjs";
-import { i as parseScope, r as compileAccess, t as FULL_ACCESS } from "./access-CQ39gqEV.mjs";
+import { a as forbidden, l as unauthorized, r as badRequest } from "./errors-CJXhhzvT.mjs";
+import { i as parseScope, o as union, r as compileAccess, t as FULL_ACCESS } from "./access-CY5xVMIK.mjs";
 //#region src/server/auth.ts
 /**
+* Whether a caller wrote what `by` says, as far as changing it goes (editing, deleting, canceling a
+* schedule): its principal did, and when a board token pins the profile it writes as, as that
+* profile. A token acts as its minter, so the principal alone would let one agent's token change
+* what its minter or another agent wrote. Another token that pins the same profile writes as the
+* same author, so a renewed one picks up where the last left off.
+*/
+const wroteAs = (caller, by) => by.principal === caller.principal.id && ((caller.principal.pinned?.profile ?? null) === null || by.actor === caller.actor.id);
+/**
 * Principal IDs a board authenticates: its people, deployments, workflows, and its own code. No
 * platform actor sync writes as may have one, or an import could pass for someone signed in.
 */
@@ -99,11 +107,101 @@ function trustedIssuers(issuers) {
 }
 /** The OIDC issuers rules name: the only ones whose tokens are verified for them. */
 const issuersOf = (rules) => [...new Set(rules.flatMap((rule) => typeof rule !== "function" && rule.issuer === "oidc" ? [rule.url] : []))];
+/** What a board token starts with, so board() knows its own before it tries any other verifier. */
+const BOARD_TOKEN_PREFIX = "board_";
+/**
+* A board token's SHA-256, hex: what the board keeps instead of the secret, both when it mints one
+* and when a request carries one. A token is 32 random bytes, so no salt or key is needed.
+*/
+async function tokenHash(secret) {
+	const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret)));
+	return Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/** What a grant or a token left without `can` gives: what Vercel's API gives a project it lets use a board. */
+const DEFAULT_CAN = { "*": [
+	"read",
+	"post",
+	"react",
+	"label"
+] };
+const GRANT_CLAIMS_MAX = 32;
+const GRANT_VALUES_MAX = 32;
+const GRANT_VALUE_MAX = 1e3;
+const invalidGrant = (message) => badRequest(message, "invalid_grant");
+/** Whether `host` names something on the board's own network rather than on the internet. */
+function privateHost(host) {
+	const name = host.toLowerCase().replace(/\.$/, "");
+	if (name.startsWith("[") || /^\d+(\.\d+){3}$/.test(name) || /^\d+$/.test(name)) return true;
+	if (!name.includes(".") || name === "localhost") return true;
+	return /\.(localhost|local|internal|home|lan|corp|intranet)$/.test(name);
+}
+/**
+* A grant checked and put in one form: its issuer, its claims with keys and lists sorted, its
+* `can`, and the key that says it's the same grant as another. A 400 `invalid_grant` that says
+* what to write. `trusted`: the issuers the board's rules and other grants name, which no two may
+* share principals between.
+*/
+function checkGrant(spec, trusted) {
+	const { issuer } = spec;
+	if (typeof issuer !== "string" || issuer === "") throw invalidGrant("a grant needs an issuer: vercel, github, or an https URL");
+	if (issuer !== "vercel" && issuer !== "github") {
+		let url;
+		try {
+			url = new URL(issuer);
+		} catch {
+			throw invalidGrant(`a grant's issuer is vercel, github, or an https URL, got ${issuer}`);
+		}
+		if (VERCEL_ISSUER.test(issuer)) throw invalidGrant("write the issuer as vercel, and another team's projects with owner_id");
+		if (issuer === "https://token.actions.githubusercontent.com") throw invalidGrant("write the issuer as github");
+		if (url.protocol !== "https:" || url.search || url.hash || url.username || url.password) throw invalidGrant(`a grant's issuer is an https URL with no query or credentials, got ${issuer}`);
+		if (privateHost(url.hostname)) throw invalidGrant(`a grant's issuer is on the internet, not ${url.hostname}`);
+		const name = issuerName(issuer);
+		const other = trusted.find((candidate) => candidate !== issuer && /^https:/.test(candidate) && issuerName(candidate) === name);
+		if (other !== void 0) throw invalidGrant(`issuers ${other} and ${issuer} name the same principals, oidc:${name}:<sub>: use ${other}`);
+	}
+	const entries = typeof spec.claims === "object" && spec.claims !== null ? Object.entries(spec.claims) : [];
+	if (entries.length === 0) throw invalidGrant(`name at least one claim for ${issuer}: its issuer signs tokens for everyone it serves`);
+	if (entries.length > GRANT_CLAIMS_MAX) throw invalidGrant(`a grant names at most ${GRANT_CLAIMS_MAX} claims`);
+	const claims = {};
+	for (const [name, value] of entries.sort(([a], [b]) => a.localeCompare(b))) {
+		const values = typeof value === "string" ? [value] : Array.isArray(value) ? [...new Set(value)] : [];
+		if (values.length === 0 || values.some((one) => typeof one !== "string" || one === "")) throw invalidGrant(`claim ${name} has no value to match: give a string, or a list of them`);
+		if (values.length > GRANT_VALUES_MAX || values.some((one) => one.length > GRANT_VALUE_MAX)) throw invalidGrant(`claim ${name} lists at most ${GRANT_VALUES_MAX} values of up to ${GRANT_VALUE_MAX} characters`);
+		const sorted = values.sort();
+		claims[name] = sorted.length === 1 ? sorted[0] : sorted;
+	}
+	if (issuer === "vercel" && (claims.project_id === void 0 || claims.environment === void 0)) throw invalidGrant("a Vercel grant names project_id and environment: a preview runs any branch, so it says outright whether they get in");
+	if (issuer === "github" && claims.repository === void 0 && claims.repository_id === void 0) throw invalidGrant("a GitHub grant names repository or repository_id: GitHub signs tokens for every repository");
+	const can = spec.can ?? DEFAULT_CAN;
+	try {
+		compileAccess(can);
+	} catch (error) {
+		throw invalidGrant(error.message);
+	}
+	return {
+		issuer,
+		claims,
+		can,
+		key: JSON.stringify([issuer, claims])
+	};
+}
+/** Whether a verified token's facts are a grant's: its issuer, and every claim it names. */
+function grantMatches(grant, facts) {
+	if (!(grant.issuer === "vercel" || grant.issuer === "github" ? facts.issuer === grant.issuer : facts.issuer === "oidc" && facts.iss === grant.issuer)) return false;
+	return Object.entries(grant.claims).every(([name, allowed]) => {
+		const value = facts.claims[name];
+		if (value === void 0) return false;
+		const text = String(value);
+		return typeof allowed === "string" ? text === allowed : allowed.includes(text);
+	});
+}
+/** The OIDC issuers grants name past Vercel and GitHub: their tokens are verified too. */
+const grantIssuers = (grants) => [...new Set(grants.flatMap((grant) => grant.issuer === "vercel" || grant.issuer === "github" ? [] : [grant.issuer]))];
 /**
 * What principals may do, under a board's rules: `vercelProject()`, `githubActions()`, `oidc()`,
-* and functions of your own, the first that matches deciding, past the defaults (people, and the
-* board's own deployments in its environment, may do everything). Or a host's own function of the
-* principal.
+* and functions of your own, the first that matches deciding, with the board's grants adding to it,
+* past the defaults (people, and the board's own deployments in its environment, may do
+* everything). Or a host's own function of the principal.
 */
 function createAuthority(options) {
 	const rules = typeof options.access === "function" ? [] : options.access;
@@ -111,13 +209,14 @@ function createAuthority(options) {
 	const oidcIssuers = trustedIssuers(issuersOf(rules));
 	/**
 	* What the rules give a principal, in order: a token's rule when its facts match, a function when
-	* it answers. The board's own deployments in its environment get everything unless a token's rule
-	* says otherwise, and no function is asked about them. A 401 or 403 that says which rule would let
-	* it in, when none does.
+	* it answers. Every grant that matches its token adds to that, so a grant never goes unused
+	* because a rule matched first. The board's own deployments in its environment get everything
+	* unless a token's rule says otherwise, no function is asked about them, and no grant is theirs;
+	* a function that answers null refuses, grants or not. A 401 or 403 that says which rule would
+	* let it in, when nothing does.
 	*/
 	async function byRules(principal, facts) {
 		if (facts?.issuer === "host") throw forbidden("this token can't use this board: its board no longer takes a host's principals");
-		if (facts?.issuer === "oidc" && !oidcIssuers.has(facts.iss)) throw unauthorized(`untrusted issuer: ${facts.iss}`);
 		const claims = facts?.claims ?? {};
 		const own = facts?.issuer === "vercel" ? await options.project() : null;
 		const context = own ? {
@@ -131,18 +230,32 @@ function createAuthority(options) {
 		const here = boardEnvironment();
 		const ownDeployment = own !== null && own.id !== null && claims.project_id === own.id;
 		const ownHere = ownDeployment && here !== null && environment === here;
+		let ruled = null;
 		for (const rule of rules) {
 			if (typeof rule === "function") {
 				if (ownHere) continue;
 				const can = await rule(principal);
 				if (can === void 0) continue;
 				if (can === null) throw forbidden("this token can't use this board");
-				return compileAccess(can);
+				ruled = compileAccess(can);
+				break;
 			}
-			if (facts && rule.issuer === facts.issuer && (rule.issuer !== "oidc" || rule.url === facts.iss) && rule.matches(claims, context)) return rule.access;
+			if (facts && rule.issuer === facts.issuer && (rule.issuer !== "oidc" || rule.url === facts.iss) && rule.matches(claims, context)) {
+				ruled = rule.access;
+				break;
+			}
+		}
+		if (ownHere) return ruled ?? FULL_ACCESS;
+		if (!facts) {
+			if (ruled) return ruled;
+			throw forbidden("this token can't use this board");
 		}
-		if (ownHere) return FULL_ACCESS;
-		if (!facts) throw forbidden("this token can't use this board");
+		const grants = options.grants ? await options.grants() : [];
+		const granted = grants.filter((grant) => grantMatches(grant, facts)).map((grant) => compileAccess(grant.can));
+		if (ruled) return granted.length > 0 ? union([ruled, ...granted]) : ruled;
+		if (granted.length > 0) return union(granted);
+		if (facts.issuer === "oidc" && !oidcIssuers.has(facts.iss) && !grants.some((grant) => grant.issuer === facts.iss)) throw unauthorized(`untrusted issuer: ${facts.iss}`);
+		if (facts.issuer === "oidc" && !oidcIssuers.has(facts.iss)) throw forbidden("this token can't use this board: no grant lets in its claims");
 		if (facts.issuer === "oidc") throw notInAccess(`oidc({ issuer: '${facts.iss}', claims, can })`);
 		if (facts.issuer === "github") throw notInAccess(`githubActions({ repository: '${String(claims.repository)}', can })`);
 		if (ownDeployment) throw forbidden(`this token can't use this board: it runs in ${here ?? "no Vercel environment"}, so its ${environment || "unnamed"} deployments need vercelProject({ project: 'self', environments: ['${environment}'], can })`);
@@ -273,4 +386,4 @@ function hostPrincipal(value) {
 	};
 }
 //#endregion
-export { compileRules as a, githubActions as c, issuersOf as d, markVerified as f, verifiesTokens as g, vercelProject as h, authenticates as i, hostPrincipal as l, trustedIssuers as m, TOKENS as n, createAuthority as o, oidc as p, VERCEL_ISSUER as r, fromTokens as s, GITHUB_ISSUER as t, issuerName as u };
+export { wroteAs as C, verifiesTokens as S, oidc as _, VERCEL_ISSUER as a, trustedIssuers as b, compileRules as c, githubActions as d, grantIssuers as f, markVerified as g, issuersOf as h, TOKENS as i, createAuthority as l, issuerName as m, DEFAULT_CAN as n, authenticates as o, hostPrincipal as p, GITHUB_ISSUER as r, checkGrant as s, BOARD_TOKEN_PREFIX as t, fromTokens as u, privateHost as v, vercelProject as x, tokenHash as y };

package/dist/{auth-CU56Q2Xh.d.mts → auth-DLYSt_-A.d.mts}

@@ -1,4 +1,4 @@
-import { r as Can, t as Access } from "./access-CV96SYgr.mjs";
+import { r as Can, t as Access } from "./access-DPcrKIH_.mjs";
 import { JWTPayload, JWTVerifyGetKey } from "jose";
 //#region src/server/auth.d.ts
 /**
@@ -46,6 +46,22 @@ type Principal = {
   facts?: TokenFacts;
   /** The `x-board-scope` a proxy sent, which narrows whatever it may do. */
   scope?: string;
+  /**
+   * The board token it came with (its ID), kept with what it stores: a schedule or a registration
+   * made with one stops when the token does.
+   */
+  token?: string;
+  /** What a board token pins for every request with it: the profile, avatar, and session it writes as, and a person's handle and name. */
+  pinned?: Pinned;
+};
+/** What a board token says about who writes, beside its principal: labels, but the board's, so a request can't change them. */
+type Pinned = {
+  profile: string | null;
+  avatar: string | null;
+  session: string | null;
+  /** A person's handle and display name as they were when they minted it: whoever holds the token sends none. */
+  handle: string | null;
+  name: string | null;
 };
 /** A principal and what it may do in each channel, as board()'s `access` worked it out. */
 type Granted = Principal & {
@@ -154,8 +170,20 @@ type AccessFunction = (principal: Known) => Can | null | undefined | Promise<Can
  * person or the board's own deployments in its environment, which the defaults decide first.
  */
 type RuleFunction = (principal: Known) => Can | null | undefined | Promise<Can | null | undefined>;
-/** A principal as the board keeps it to work its access out again: who it is, its token's facts, and its scope. */
-type Known = Pick<Principal, 'id' | 'kind' | 'handle' | 'facts' | 'scope'>;
+/** A principal as the board keeps it to work its access out again: who it is, its token's facts, its scope, and the board token it came with. */
+type Known = Pick<Principal, 'id' | 'kind' | 'handle' | 'facts' | 'scope' | 'token'>;
+/** A grant the board keeps: its ID, its issuer and claims as the board checked them, and who set it when. */
+type StoredGrant = {
+  id: string;
+  issuer: string;
+  claims: Readonly<Record<string, string | readonly string[]>>;
+  can: Can;
+  /** The actor that last set it, and when. */
+  by: string;
+  at: string;
+};
+/** What a grant or a token left without `can` gives: what Vercel's API gives a project it lets use a board. */
+declare const DEFAULT_CAN: Can;
 /**
  * What a principal may do under `rules` (`vercelProject()`, `githubActions()`, `oidc()`, and
  * functions of your own), the first that matches deciding, past the defaults: people, and the
@@ -201,4 +229,4 @@ type HostPrincipal = {
   expiresAt?: Date | null;
 };
 //#endregion
-export { oidc as _, CallerRequest as a, HostPrincipal as c, OidcTokensOptions as d, Principal as f, githubActions as g, compileRules as h, AuthenticateContext as i, IssuerConfig as l, RuleFunction as m, AccessRule as n, Claims as o, PrincipalKind as p, Authenticate as r, Granted as s, AccessFunction as t, Known as u, vercelProject as v };
+export { StoredGrant as _, CallerRequest as a, oidc as b, Granted as c, Known as d, OidcTokensOptions as f, RuleFunction as g, PrincipalKind as h, AuthenticateContext as i, HostPrincipal as l, Principal as m, AccessRule as n, Claims as o, Pinned as p, Authenticate as r, DEFAULT_CAN as s, AccessFunction as t, IssuerConfig as u, compileRules as v, vercelProject as x, githubActions as y };

package/dist/{backend-n3hajfrD.d.mts → backend-Bob-5CM7.d.mts}

@@ -1,9 +1,9 @@
-import { t as Access } from "./access-CV96SYgr.mjs";
-import { m as RuleFunction, n as AccessRule, r as Authenticate, s as Granted, t as AccessFunction, u as Known } from "./auth-CU56Q2Xh.mjs";
-import { A as Labels, C as Author, t as Actor, u as ExternalEvent, x as Attachment } from "./folds-8wRRXjAt.mjs";
-import { $ as RegisterBody, A as InboxItem, B as MatchesQuery, Bt as TypingBody, C as EventsQuery, Ct as SyncCopiesView, D as IdentityView, Dt as SyncImportBody, Et as SyncFindView, F as LabelBody, H as MessageView, Ht as UploadStartBody, It as ThreadView, J as PostBody, L as LinkedAccount, Lt as ThreadsPage, M as InboxPushBody, Mt as SyncThreadView, N as InboxQuery, Nt as SyncUnlinkBody, O as InboxAckBody, Pt as SyncedView, R as LinkedQuery, Rt as ThreadsQuery, S as EventsPage, St as SyncCopiesQuery, Tt as SyncFindQuery, U as MessagesPage, Ut as UploadTicket, V as Me, W as MessagesQuery, Z as ReactBody, _ as BoardEventView, _t as SyncAccountBody, b as Discovery, bt as SyncCodeBody, ct as SchedulesQuery, ft as SourceJoin, gt as SourceReadQuery, ht as SourceRead, it as ScheduleBody, j as InboxNextQuery, jt as SyncRootsQuery, k as InboxEntry, kt as SyncReceiptBody, m as AckBody, o as ProfileOption, pt as SourceJoinBody, q as PersonView, st as ScheduleView, t as BoardClient, tt as RegistrationView, v as ChannelView, x as EditBody, xt as SyncCodeView, y as DeleteBody, z as MatchView } from "./client-CjAatpV4.mjs";
-import { t as HttpError } from "./errors-87TVtXeb.mjs";
-import { p as SyncProvider } from "./provider-Bm46LAdp.mjs";
+import { t as Access } from "./access-DPcrKIH_.mjs";
+import { _ as StoredGrant, c as Granted, d as Known, g as RuleFunction, n as AccessRule, p as Pinned, r as Authenticate, t as AccessFunction } from "./auth-DLYSt_-A.mjs";
+import { A as Labels, C as Author, t as Actor, u as ExternalEvent, x as Attachment } from "./folds-DLUzfibJ.mjs";
+import { $ as RegisterBody, A as InboxAckBody, At as ThreadsPage, B as MatchView, C as EventsPage, D as GrantBody, Dt as SyncedView, Et as SyncThreadView, F as InboxQuery, Ft as TokenView, G as MessagesQuery, H as Me, It as TypingBody, J as PostBody, L as LabelBody, M as InboxItem, N as InboxNextQuery, Nt as TokenBody, P as InboxPushBody, Rt as UploadStartBody, S as EditBody, St as SyncImportBody, U as MessageView, V as MatchesQuery, W as MessagesPage, Z as ReactBody, _ as BoardEventView, _t as SyncCopiesQuery, b as DeleteBody, bt as SyncFindQuery, ct as SchedulesQuery, dt as SourceJoin, ft as SourceJoinBody, ht as SourceReadQuery, it as ScheduleBody, j as InboxEntry, jt as ThreadsQuery, k as GrantView, kt as ThreadView, m as AckBody, mt as SourceRead, o as ProfileOption, st as ScheduleView, t as BoardClient, tt as RegistrationView, v as ChannelView, vt as SyncCopiesView, w as EventsQuery, wt as SyncReceiptBody, x as Discovery, xt as SyncFindView, y as CreateChannelBody, z as LinkedQuery, zt as UploadTicket } from "./client-COfYrgfV.mjs";
+import { t as HttpError } from "./errors-2vGs49Db.mjs";
+import { p as SyncProvider } from "./provider-gynDUoyW.mjs";
 import { z } from "zod";
 //#region src/api/protocol.d.ts
 type Input<S extends z.ZodType> = NonNullable<z.output<S>>;
@@ -35,19 +35,21 @@ type Protocol = {
       cursor: string;
     };
   };
+  /** `created` is false for a channel that was there already, made by a post or another create. */
+  createChannel: {
+    input: Input<typeof CreateChannelBody>;
+    output: {
+      channel: ChannelView;
+      created: boolean;
+    };
+  };
   actors: {
     input: Nothing;
     output: {
-      actors: (Actor & {
-        person?: PersonView;
-      })[];
+      actors: Actor[];
       cursor: string;
     };
   };
-  identity: {
-    input: Nothing;
-    output: IdentityView;
-  };
   messages: {
     input: Input<typeof MessagesQuery>;
     output: MessagesPage;
@@ -119,6 +121,50 @@ type Protocol = {
       canceled: boolean;
     };
   };
+  /** The board's grants: needs `manage` in every channel. 501 `no_grants` where the board keeps none. */
+  grants: {
+    input: Nothing;
+    output: {
+      grants: GrantView[];
+    };
+  };
+  /** Sets a grant, or the `can` of the one with its issuer and claims: `created` is false for that. */
+  createGrant: {
+    input: Input<typeof GrantBody>;
+    output: {
+      grant: GrantView;
+      created: boolean;
+    };
+  };
+  /** `revoked` is false when it was already gone. */
+  revokeGrant: {
+    input: Id;
+    output: {
+      revoked: boolean;
+    };
+  };
+  /** The caller's tokens, or every one with `manage` in every channel. 501 `no_tokens` where the board issues none. */
+  tokens: {
+    input: Nothing;
+    output: {
+      tokens: TokenView[];
+    };
+  };
+  /** A token acting as the caller, narrowed: the only time its secret shows. */
+  createToken: {
+    input: Input<typeof TokenBody>;
+    output: {
+      token: TokenView;
+      secret: string;
+    };
+  };
+  /** It and every token minted with it stop. `revoked` is false when it was already gone. */
+  revokeToken: {
+    input: Id;
+    output: {
+      revoked: boolean;
+    };
+  };
   upload: {
     input: {
       data: Uint8Array;
@@ -240,12 +286,6 @@ type Protocol = {
     input: Input<typeof SyncCopiesQuery>;
     output: SyncCopiesView;
   };
-  syncRoots: {
-    input: Input<typeof SyncRootsQuery>;
-    output: {
-      roots: MessageView[];
-    };
-  };
   /** Platform events into the caller's inbox, deduplicated by their platform IDs. */
   inboxPush: {
     input: Key & Input<typeof InboxPushBody>;
@@ -273,25 +313,6 @@ type Protocol = {
       events: InboxEntry[];
     };
   };
-  /** A code for linking the caller's account, and the sign-in that carries it when the entry signs people in. */
-  syncCode: {
-    input: Input<typeof SyncCodeBody>;
-    output: SyncCodeView;
-  };
-  /** 404 `bad_code` for a code that isn't live. */
-  syncAccount: {
-    input: Input<typeof SyncAccountBody>;
-    output: {
-      person: string;
-      link: LinkedAccount;
-    };
-  };
-  syncUnlink: {
-    input: Input<typeof SyncUnlinkBody>;
-    output: {
-      ok: true;
-    };
-  };
 };
 type Method = keyof Protocol;
 //#endregion
@@ -575,11 +596,10 @@ type Subscription =
 {
   kind: 'sync';
 };
-/** One of board()'s sync entries: its key, its platform, and whether it can sign people in. */
+/** One of board()'s sync entries: its key and its platform. */
 type SyncEntry = {
   key: string;
   platform: string;
-  signIn: boolean;
 };
 /** A platform event sync pushed to an inbox, as the backend delivers it back. */
 type InboxDelivery = {
@@ -647,6 +667,8 @@ type BoardBinding = {
     id: string | null;
     teamId: string | null;
   }>;
+  /** The OIDC issuers board()'s rules name, which no grant's issuer may share principals with. */
+  issuers(): readonly string[];
   /**
    * A handle through board(), as `caller`: what a backend writes for someone outside a request
    * goes through it, so board()'s middleware sees it, a schedule's send as its creator, say. A
@@ -656,6 +678,27 @@ type BoardBinding = {
   /** The board's own URL, where a board elsewhere can wake it, once it's known. */
   url(): string | null;
 };
+/** A token a backend issued, as board() checks a request that carries it. */
+type StoredToken = {
+  id: string;
+  name: string;
+  /** Who minted it, as a schedule keeps its creator: what it may do is worked out again on every request, narrowed by its scope. */
+  minter: Known;
+  pinned: Pinned;
+  expiresAt: Date;
+};
+/**
+ * What a backend that keeps the board keeps of who it trusts: its grants, and the tokens it
+ * issued. board() reads them on the requests they decide, as they are then, so a revoke takes
+ * effect on the next request.
+ */
+type Trust = {
+  grants(): Promise<readonly StoredGrant[]>;
+  /** The token whose secret hashes to `hash`, while it and every token it was minted with are live: null otherwise. */
+  token(hash: string): Promise<StoredToken | null>;
+  /** Whether token `id` and every token it was minted with are live: a schedule made with one stops when it doesn't. */
+  live(id: string): Promise<boolean>;
+};
 /**
  * Where a board lives. board() serves the protocol over HTTP: it routes, validates, verifies each
  * caller, applies `access`, runs the middleware, watchers, and sync, and calls these with the caller
@@ -677,6 +720,8 @@ interface Backend extends ProtocolMethods {
    * board() screens a schedule's message once, when it's made. True when left out.
    */
   readonly sendsSchedulesHere?: boolean;
+  /** Its grants and tokens, for a backend that keeps them (`a2()`): board() checks requests against them. */
+  readonly trust?: Trust;
   /**
    * board() calls it once, when it's created, before any request: what background work needs
    * from the board (its subscriptions, its sync, its policy, a handle through it). It does no I/O.
@@ -684,4 +729,4 @@ interface Backend extends ProtocolMethods {
   bind(board: BoardBinding): void;
 }
 //#endregion
-export { Protocol as S, MiddlewareContext as _, Identity as a, WriteSource as b, SelfCaller as c, Board as d, BoardOptions as f, Middleware as g, DroppedError as h, Caller as i, Subscription as l, WatcherContext as m, BackendRoute as n, InboxDelivery as o, Watcher as p, BoardBinding as r, ProtocolMethods as s, Backend as t, VerifiedCaller as u, Write as v, Method as x, WritePatch as y };
+export { Protocol as C, Method as S, Middleware as _, Identity as a, WritePatch as b, SelfCaller as c, VerifiedCaller as d, Board as f, DroppedError as g, WatcherContext as h, Caller as i, StoredToken as l, Watcher as m, BackendRoute as n, InboxDelivery as o, BoardOptions as p, BoardBinding as r, ProtocolMethods as s, Backend as t, Subscription as u, MiddlewareContext as v, WriteSource as x, Write as y };

package/dist/backend-a2/blob-vercel.d.mts

@@ -1,4 +1,4 @@
-import { t as BlobStore } from "../blob-CqILvdmr.mjs";
+import { t as BlobStore } from "../blob-Bx8QPWEd.mjs";
 //#region src/blob/vercel.d.ts
 export declare function vercelBlob(options?: {
   token?: string;