spur-board 0.7.1 → 0.8.2

package/dist/cli.mjs

@@ -1,6 +1,6 @@
-import { B as SLACK_BOT_SCOPES, R as configSchema, s as OPERATIONS, z as requiredSecretKeys } from "./src-BFgTh55w.mjs";
-import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-Ln76BdDz.mjs";
-import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-B_6fA4Au.mjs";
+import { B as requiredSecretKeys, V as SLACK_BOT_SCOPES, j as ERRORS, s as OPERATIONS, z as configSchema } from "./src-g7u1onIP.mjs";
+import { a as errorExitCode, i as CliError, n as requestOperation, o as renderCliError, r as requestTokenEnrollment, s as escapeTerminalControls } from "./client-D4cveOHQ.mjs";
+import { a as memoryVerdictCache, c as loadEnrollmentConfig, i as fileVerdictCache, l as resolveDaemonAddress, n as cliPackageVersion, o as configFile, s as loadClientConfig, t as checkCatalog } from "./config-B1fVOLzp.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
@@ -1082,8 +1082,25 @@ function createProgram(options = {}) {
 			const config = options.clientConfig ?? loadClientConfig(env);
 			const key = op.kind === "mutation" ? keyOption || randomUUID() : void 0;
 			if (key) io.stderr(`key: ${escapeTerminalControls(key)}\n`);
+			let instance;
+			let outcome;
 			try {
-				const result = await (options.sendOperation ?? requestOperation)(op, input, key, config);
+				outcome = { value: await (options.sendOperation ?? requestOperation)(op, input, key, config, (seen) => {
+					instance = seen;
+				}) };
+			} catch (error) {
+				outcome = { error };
+			}
+			const reportedMismatch = "error" in outcome && outcome.error instanceof CliError && outcome.error.code === "version_mismatch";
+			if (instance !== void 0 && !reportedMismatch) {
+				const cliVersion = cliPackageVersion();
+				const cache = cliVersion === void 0 ? memoryVerdictCache() : fileVerdictCache(join(dirname(configFile(env, options.home ?? homedir())), "version-check.json"), cliVersion);
+				const verdict = await checkCatalog(config, instance, cache);
+				if (verdict !== void 0 && !verdict.matches) io.stderr(`warning: the daemon catalog ${verdict.serverVersion.slice(0, 12)} differs from this CLI's ${verdict.clientVersion.slice(0, 12)}. ${ERRORS.version_mismatch.hint}\n`);
+			}
+			try {
+				if ("error" in outcome) throw outcome.error;
+				const result = outcome.value;
 				io.stdout(`${json || !io.isTTY ? JSON.stringify(result) : formatHuman(result)}\n`);
 			} catch (error) {
 				if (error instanceof CliError) {

package/dist/{client-Ln76BdDz.mjs → client-D4cveOHQ.mjs}

@@ -1,4 +1,4 @@
-import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-BFgTh55w.mjs";
+import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-g7u1onIP.mjs";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { request } from "node:http";
@@ -84,9 +84,15 @@ function decodeResponse(output, response, raw) {
 	}
 	throw problemError(response.statusCode ?? 0, response.headers["content-type"], body);
 }
-async function post(path, body, config, output, anonymous) {
+const instanceHeader = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** The daemon instance a response came from, when it sends a well-formed one. */
+function responseInstance(response) {
+	const value = response.headers["x-board-instance"];
+	return typeof value === "string" && instanceHeader.test(value) ? value : void 0;
+}
+function send({ method, path, body, config, anonymous, decode, observe }) {
 	const target = new URL(path, config.address);
-	const payload = JSON.stringify(body);
+	const payload = method === "POST" ? JSON.stringify(body) : void 0;
 	const transport = target.protocol === "https:" ? request$1 : request;
 	return new Promise((resolve, reject) => {
 		let connected = false;
@@ -100,15 +106,19 @@ async function post(path, body, config, output, anonymous) {
 			else resolve(result.value);
 		};
 		const req = transport(target, {
-			method: "POST",
+			method,
 			agent: false,
 			headers: {
-				"content-type": "application/json",
 				accept: "application/json, application/problem+json",
-				"content-length": Buffer.byteLength(payload),
+				...payload === void 0 ? {} : {
+					"content-type": "application/json",
+					"content-length": Buffer.byteLength(payload)
+				},
 				...anonymous ? {} : config.session ? { "x-board-session": config.session } : { authorization: `Bearer ${config.token ?? ""}` }
 			}
 		}, (response) => {
+			const instance = responseInstance(response);
+			if (instance !== void 0) observe?.(instance);
 			const chunks = [];
 			response.on("data", (chunk) => {
 				chunks.push(chunk);
@@ -118,7 +128,7 @@ async function post(path, body, config, output, anonymous) {
 			});
 			response.once("end", () => {
 				try {
-					settle({ value: decodeResponse(output, response, Buffer.concat(chunks).toString()) });
+					settle({ value: decode(response, Buffer.concat(chunks).toString()) });
 				} catch (error) {
 					settle({ error: error instanceof CliError ? error : new CliError("outcome_unknown") });
 				}
@@ -142,12 +152,48 @@ async function post(path, body, config, output, anonymous) {
 	});
 }
 /** Shared daemon HTTP client. The CLI owns output; this module owns transport and wire parsing. */
-async function requestOperation(op, input, key, config) {
+async function requestOperation(op, input, key, config, observe) {
 	if (!config.session && !config.token) throw new CliError("config");
-	return post(`/v1/ops/${encodeURIComponent(op.id)}`, {
-		input,
-		...key ? { key } : {}
-	}, config, op.output, false);
+	return send({
+		method: "POST",
+		path: `/v1/ops/${encodeURIComponent(op.id)}`,
+		body: {
+			input,
+			...key ? { key } : {}
+		},
+		config,
+		anonymous: false,
+		decode: (response, raw) => decodeResponse(op.output, response, raw),
+		observe
+	});
+}
+const schemaVersion = z.looseObject({ version: z.string().regex(/^[0-9a-f]{64}$/) });
+/**
+* The daemon's catalog version and instance. `/v1/schema` answers with the bare snapshot, not a
+* success envelope.
+*/
+function fetchCatalogVersion(config) {
+	return send({
+		method: "GET",
+		path: "/v1/schema",
+		config,
+		anonymous: true,
+		decode: (response, raw) => {
+			let body;
+			try {
+				body = JSON.parse(raw);
+			} catch {
+				throw new CliError("outcome_unknown");
+			}
+			if (response.statusCode !== 200) throw problemError(response.statusCode ?? 0, response.headers["content-type"], body);
+			const parsed = schemaVersion.safeParse(body);
+			if (!parsed.success) throw new CliError("outcome_unknown");
+			return {
+				version: parsed.data.version,
+				instance: responseInstance(response)
+			};
+		}
+	});
 }
 const enrollmentOutput = z.strictObject({
 	name: z.string(),
@@ -156,7 +202,14 @@ const enrollmentOutput = z.strictObject({
 });
 /** Bootstrap sends a hash and no authorization header. */
 function requestTokenEnrollment(input, config) {
-	return post("/v1/tokens/requests", input, config, enrollmentOutput, true);
+	return send({
+		method: "POST",
+		path: "/v1/tokens/requests",
+		body: input,
+		config,
+		anonymous: true,
+		decode: (response, raw) => decodeResponse(enrollmentOutput, response, raw)
+	});
 }
 //#endregion
-export { renderCliError as a, errorExitCode as i, requestTokenEnrollment as n, escapeTerminalControls as o, CliError as r, requestOperation as t };
+export { errorExitCode as a, CliError as i, requestOperation as n, renderCliError as o, requestTokenEnrollment as r, escapeTerminalControls as s, fetchCatalogVersion as t };

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { n as requestTokenEnrollment, t as requestOperation } from "./client-Ln76BdDz.mjs";
-export { requestOperation, requestTokenEnrollment };
+import { n as requestOperation, r as requestTokenEnrollment, t as fetchCatalogVersion } from "./client-D4cveOHQ.mjs";
+export { fetchCatalogVersion, requestOperation, requestTokenEnrollment };

package/dist/config-B1fVOLzp.mjs

@@ -0,0 +1,229 @@
+import { a as buildCatalogSnapshot, s as OPERATIONS, z as configSchema } from "./src-g7u1onIP.mjs";
+import { i as CliError, t as fetchCatalogVersion } from "./client-D4cveOHQ.mjs";
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { z } from "zod";
+import YAML from "yaml";
+//#region src/config.ts
+const CONNECT_TIMEOUT_MS = 2e3;
+const RESPONSE_TIMEOUT_MS = 3e4;
+function configFile(env, home) {
+	const boardHome = env["BOARD_HOME"];
+	if (boardHome) return join(resolve(boardHome), "config.yaml");
+	const xdg = env["XDG_CONFIG_HOME"];
+	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "spur-board", "config.yaml");
+}
+function resolveDaemonAddress(env = process.env, home = homedir(), configuredPort) {
+	const rawAddress = env["BOARD_DAEMON_URL"];
+	if (rawAddress === void 0) {
+		let port = configuredPort ?? 4311;
+		if (configuredPort === void 0) try {
+			const parsed = YAML.parseDocument(readFileSync(configFile(env, home), "utf8"));
+			if (parsed.errors.length === 0) {
+				const config = configSchema.safeParse(parsed.toJS());
+				if (config.success) port = config.data.http.port;
+			}
+		} catch {}
+		if (port === 0) throw new CliError("config", void 0, void 0, "http.port: 0 assigns a runtime port that clients cannot discover. Set BOARD_DAEMON_URL to the daemon listening address.");
+		return new URL(`http://127.0.0.1:${String(port)}`);
+	}
+	let address;
+	try {
+		address = new URL(rawAddress);
+	} catch {
+		throw new CliError("config", { environmentVariable: "BOARD_DAEMON_URL" });
+	}
+	if (!["http:", "https:"].includes(address.protocol) || address.username || address.password) throw new CliError("config", { environmentVariable: "BOARD_DAEMON_URL" });
+	return address;
+}
+function tokenInFolder(folder, warn) {
+	const directory = join(folder, ".spur-board");
+	const file = join(directory, "token");
+	try {
+		const owner = process.getuid?.();
+		const directoryInfo = lstatSync(directory);
+		if (!directoryInfo.isDirectory() || directoryInfo.uid !== owner || (directoryInfo.mode & 63) !== 0) throw new Error("unsafe token directory");
+		const descriptor = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+		let value;
+		try {
+			const fileInfo = fstatSync(descriptor);
+			if (!fileInfo.isFile() || fileInfo.uid !== owner || (fileInfo.mode & 63) !== 0) throw new Error("unsafe token file");
+			value = readFileSync(descriptor, "utf8").trimEnd();
+		} finally {
+			closeSync(descriptor);
+		}
+		if (value === "") throw new Error("empty token file");
+		return value;
+	} catch (error) {
+		if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") return;
+		warn("Ignoring an unsafe .spur-board/token candidate.\n");
+		return;
+	}
+}
+function findTokenFile(cwd, home, warn = (message) => {
+	process.stderr.write(message);
+}) {
+	const current = realpathSync(cwd);
+	const boundary = realpathSync(home);
+	if (current === boundary) return void 0;
+	const toCurrent = relative(boundary, current);
+	const outsideHome = toCurrent === ".." || toCurrent.startsWith(`..${sep}`) || isAbsolute(toCurrent);
+	let folder = current;
+	while (folder !== boundary) {
+		if (outsideHome) {
+			const info = statSync(folder);
+			if (info.uid !== process.getuid?.() || (info.mode & 2) !== 0) break;
+		}
+		const token = tokenInFolder(folder, warn);
+		if (token !== void 0) return token;
+		const parent = dirname(folder);
+		if (parent === folder) break;
+		folder = parent;
+	}
+}
+function loadClientConfig(env = process.env, paths = {
+	cwd: process.cwd(),
+	home: homedir()
+}) {
+	const address = resolveDaemonAddress(env, paths.home);
+	const session = env["SPUR_SESSION"] || void 0;
+	const token = session ? void 0 : env["BOARD_TOKEN"] === void 0 ? findTokenFile(paths.cwd, paths.home) : env["BOARD_TOKEN"];
+	if (!session && !token) throw new CliError("config", { environmentVariable: "BOARD_TOKEN" });
+	return {
+		address,
+		session,
+		token,
+		connectTimeoutMs: CONNECT_TIMEOUT_MS,
+		responseTimeoutMs: RESPONSE_TIMEOUT_MS
+	};
+}
+/** Enrollment sends only a hash and works before any operator credential exists. */
+function loadEnrollmentConfig(env = process.env) {
+	return {
+		address: resolveDaemonAddress(env),
+		session: void 0,
+		token: void 0,
+		connectTimeoutMs: CONNECT_TIMEOUT_MS,
+		responseTimeoutMs: RESPONSE_TIMEOUT_MS
+	};
+}
+//#endregion
+//#region src/version.ts
+let clientVersion;
+/** The catalog version this client was built with; the snapshot is built once per process. */
+function clientCatalogVersion() {
+	if (clientVersion === void 0) {
+		const pending = buildCatalogSnapshot(OPERATIONS).then((snapshot) => snapshot.version);
+		clientVersion = pending;
+		pending.catch(() => {
+			if (clientVersion === pending) clientVersion = void 0;
+		});
+	}
+	return clientVersion;
+}
+/** The CLI package version, or `undefined` when its manifest cannot be read. */
+function cliPackageVersion() {
+	try {
+		const version = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"))?.version;
+		return typeof version === "string" && version ? version : void 0;
+	} catch {
+		return;
+	}
+}
+/** Compares the client catalog with the daemon's; rejects when the daemon cannot answer. */
+async function compareCatalogs(config) {
+	const [clientVersion, served] = await Promise.all([clientCatalogVersion(), fetchCatalogVersion(config)]);
+	return {
+		clientVersion,
+		serverVersion: served.version,
+		matches: clientVersion === served.version,
+		instance: served.instance
+	};
+}
+/**
+* Compares the client catalog with the daemon instance's catalog once per cache entry. Any
+* failure returns `undefined`, so the caller carries on unchanged.
+*/
+function checkCatalog(config, instance, cache) {
+	return cache.check(config.address, instance, () => compareCatalogs(config).catch(() => void 0));
+}
+/** In-process cache that shares an in-flight check between overlapping callers. */
+function memoryVerdictCache() {
+	const entries = /* @__PURE__ */ new Map();
+	const keyOf = (address, instance) => `${address.href} ${instance}`;
+	return {
+		check(address, instance, run) {
+			const key = keyOf(address, instance);
+			const held = entries.get(key);
+			if (held !== void 0) return held;
+			const pending = run();
+			entries.set(key, pending);
+			pending.then((verdict) => {
+				if (verdict === void 0 && entries.get(key) === pending) entries.delete(key);
+			});
+			return pending;
+		},
+		remember(address, instance, verdict) {
+			entries.set(keyOf(address, instance), Promise.resolve(verdict));
+		}
+	};
+}
+const fileEntrySchema = z.object({
+	cliPackageVersion: z.string(),
+	address: z.string(),
+	instance: z.string(),
+	clientVersion: z.string(),
+	serverVersion: z.string()
+});
+const fileSchema = z.object({ entries: z.array(fileEntrySchema) });
+function readEntries(path) {
+	try {
+		const parsed = fileSchema.safeParse(JSON.parse(readFileSync(path, "utf8")));
+		return parsed.success ? parsed.data.entries : [];
+	} catch {
+		return [];
+	}
+}
+function writeEntries(path, entries) {
+	const temporary = `${path}.${randomUUID()}.tmp`;
+	try {
+		mkdirSync(dirname(path), {
+			recursive: true,
+			mode: 448
+		});
+		writeFileSync(temporary, `${JSON.stringify({ entries })}\n`, { mode: 384 });
+		renameSync(temporary, path);
+	} catch {
+		try {
+			unlinkSync(temporary);
+		} catch {}
+	}
+}
+/** Verdicts kept across CLI invocations, keyed by CLI package version, address and instance. */
+function fileVerdictCache(path, cliVersion) {
+	return { async check(address, instance, run) {
+		const matchesKey = (entry) => entry.cliPackageVersion === cliVersion && entry.address === address.href && entry.instance === instance;
+		const held = readEntries(path).find(matchesKey);
+		if (held !== void 0) return {
+			clientVersion: held.clientVersion,
+			serverVersion: held.serverVersion,
+			matches: held.clientVersion === held.serverVersion
+		};
+		const verdict = await run();
+		if (verdict !== void 0) {
+			const entry = {
+				cliPackageVersion: cliVersion,
+				address: address.href,
+				instance,
+				clientVersion: verdict.clientVersion,
+				serverVersion: verdict.serverVersion
+			};
+			writeEntries(path, [...readEntries(path).filter((item) => !matchesKey(item)), entry].slice(-16));
+		}
+		return verdict;
+	} };
+}
+//#endregion
+export { memoryVerdictCache as a, loadEnrollmentConfig as c, fileVerdictCache as i, resolveDaemonAddress as l, cliPackageVersion as n, configFile as o, compareCatalogs as r, loadClientConfig as s, checkCatalog as t };

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, B as SLACK_BOT_SCOPES, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as requiredSecretKeys } from "./src-BFgTh55w.mjs";
+import { A as taskKeySchema, B as requiredSecretKeys, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as RESERVED_PROJECT, S as prRefSchema, T as actorIdSchema, V as SLACK_BOT_SCOPES, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as configSchema } from "./src-g7u1onIP.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -7661,18 +7661,92 @@ async function scanTransaction(store, fn) {
 	throw new Error("Gateway secret scan replay limit exceeded");
 }
 //#endregion
+//#region ../core/src/app/board-utils.ts
+function trackerSource(project) {
+	return project.tracker.type === "jira" ? `jira:${project.id}` : `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
+}
+function projectForKey(config, key) {
+	const lowerKey = key.toLowerCase();
+	const matched = config.projects.filter((project) => {
+		const tracker = project.tracker;
+		if (tracker.type === "github-issues") {
+			const prefix = `${tracker.repo.toLowerCase()}#`;
+			const short = tracker.repo.split("/")[1];
+			return lowerKey.startsWith(prefix) || short !== void 0 && lowerKey.startsWith(`${short.toLowerCase()}#`);
+		}
+		const prefix = /^([A-Za-z][A-Za-z0-9_]*)-/.exec(key)?.[1]?.toUpperCase();
+		return prefix !== void 0 && (tracker.projectKeys.length === 0 || tracker.projectKeys.includes(prefix));
+	});
+	return matched.length === 1 ? matched[0] ?? null : null;
+}
+async function emit(trx, kind, project, taskId, at, payload, actor = "system") {
+	const parsed = parseActorId(actor);
+	if (parsed === null) throw new Error("Invalid journal actor");
+	await trx.insertInto("event").values({
+		at,
+		project,
+		task_id: taskId,
+		kind,
+		actor: parsed.actor,
+		actor_ref: parsed.actor === "agent" ? JSON.stringify(parsed.actorRef) : null,
+		payload: toJson(eventPayloadSchemas[kind], payload),
+		v: 1,
+		request_id: null
+	}).execute();
+}
+function taskView(task) {
+	return {
+		key: task.key,
+		project: task.project,
+		column: task.column,
+		membership: task.membership
+	};
+}
+function linkView(link) {
+	return {
+		kind: link.entity,
+		ref: link.entity === "pr" ? `${link.repo ?? ""}#${String(link.number ?? "")}` : link.entity === "session" ? link.session_id ?? "" : link.ticket_key ?? "",
+		role: link.role
+	};
+}
+//#endregion
 //#region ../core/src/app/denied-event.ts
 const actorRefSchema$2 = z.strictObject({
 	project: z.string().min(1),
 	session: z.string().min(1)
 });
+/**
+* The journal project of a denial with no resolved target, in order: the configured project
+* the input's `task` key or `project` names; else the only configured project listing the agent
+* actor's Spur project; else `RESERVED_PROJECT`. Never throws.
+*/
+function deniedProject(config, actor, input) {
+	if (typeof input === "object" && input !== null) {
+		const hints = input;
+		if (typeof hints.task === "string") {
+			const project = projectForKey(config, hints.task);
+			if (project !== null) return project.id;
+		}
+		if (typeof hints.project === "string") {
+			const named = hints.project;
+			if (config.projects.some((project) => project.id === named)) return named;
+		}
+	}
+	const parsed = parseActorId(actor);
+	if (parsed?.actor === "agent") {
+		const owners = config.projects.filter((project) => project.spurProjects.some((spur) => spur.name === parsed.actorRef.project));
+		if (owners.length === 1 && owners[0] !== void 0) return owners[0].id;
+	}
+	return RESERVED_PROJECT;
+}
 /** Persist an authorization refusal through the caller's transaction. */
-async function writeDeniedEvent(trx, actor, operation, target, at) {
+async function writeDeniedEvent(trx, denial) {
+	const { config, actor, operation, input, target, at } = denial;
 	const parsed = parseActorId(actor);
 	if (parsed === null) throw new Error("Invalid actor");
 	await trx.insertInto("event").values({
 		at,
-		project: target.kind === "found" ? target.value.project : "board",
+		project: target.kind === "found" ? target.value.project : deniedProject(config, actor, input),
 		task_id: target.kind === "found" ? target.value.task?.id ?? null : null,
 		kind: "operation_denied",
 		actor: parsed.actor,
@@ -7787,7 +7861,14 @@ function createApply(deps) {
 						...mode === void 0 ? {} : { mode }
 					});
 					if (decision.status === "denied") {
-						await writeDeniedEvent(trx, actor, entry.id, target, at);
+						await writeDeniedEvent(trx, {
+							config,
+							actor,
+							operation: entry.id,
+							input: parsedInput,
+							target,
+							at
+						});
 						deniedHint = decision.hint;
 						return;
 					}
@@ -7849,7 +7930,14 @@ function createQuery(deps) {
 					target
 				});
 				if (decision.status === "denied") {
-					await writeDeniedEvent(trx, actor, entry.id, target, new Date(clock.now()).toISOString());
+					await writeDeniedEvent(trx, {
+						config,
+						actor,
+						operation: entry.id,
+						input: parsedInput,
+						target,
+						at: new Date(clock.now()).toISOString()
+					});
 					return {
 						status: "denied",
 						hint: decision.hint
@@ -8490,11 +8578,13 @@ const NO_FEED = /* @__PURE__ */ new Set([
 	"answer_undelivered",
 	"transport_health"
 ]);
+/** Display label of a feed line with no task; not part of the line's identity. */
+const TASKLESS_FEED_KEY = "spur-board";
 async function journal$2(trx, item, kind, at, rule) {
 	const task = item.task_id === null ? void 0 : await trx.selectFrom("task").select(["project"]).where("id", "=", item.task_id).executeTakeFirstOrThrow();
 	await trx.insertInto("event").values({
 		at: at.toISOString(),
-		project: task?.project ?? "board",
+		project: task?.project ?? "_board",
 		task_id: item.task_id,
 		kind,
 		actor: "system",
@@ -8531,7 +8621,7 @@ async function raiseItem(trx, input) {
 	}).returningAll().executeTakeFirstOrThrow();
 	await journal$2(trx, item, "from_you_raised", input.at, input.rule);
 	if (!NO_FEED.has(item.kind) && !input.suppressFeed) {
-		const key = (item.task_id === null ? null : await trx.selectFrom("task").select("key").where("id", "=", item.task_id).executeTakeFirstOrThrow())?.key ?? "board";
+		const key = (item.task_id === null ? null : await trx.selectFrom("task").select("key").where("id", "=", item.task_id).executeTakeFirstOrThrow())?.key ?? TASKLESS_FEED_KEY;
 		const line = await enqueueFeedLine(trx, {
 			itemId: item.id,
 			itemKey: item.item_key,
@@ -8580,7 +8670,7 @@ async function clearItem(trx, itemId, at) {
 		itemKey: item.item_key,
 		raise: item.raise_no,
 		lineId: item.line_outbox_id,
-		key: task?.key ?? "board",
+		key: task?.key ?? TASKLESS_FEED_KEY,
 		taskId: item.task_id,
 		at
 	});
@@ -8595,7 +8685,7 @@ function effectiveStatus(row, at) {
 async function journalToken(trx, kind, name, at) {
 	await trx.insertInto("event").values({
 		at: at.toISOString(),
-		project: "board",
+		project: RESERVED_PROJECT,
 		task_id: null,
 		kind,
 		actor: kind === "token_approved" || kind === "token_denied" || kind === "token_revoked" ? "operator" : "system",
@@ -8821,12 +8911,15 @@ async function createApiServer(options) {
 		trustProxy: false
 	});
 	const snapshot = await buildCatalogSnapshot(OPERATIONS);
+	/** Lets clients notice a daemon restart and check its catalog again. */
+	const instance = randomUUID();
 	const callers = /* @__PURE__ */ new WeakMap();
 	let doctorInFlight = null;
 	let doctorCached = null;
 	let doctorNextProbeAt = 0;
 	app.addHook("onRequest", async (request, reply) => {
 		reply.header("x-request-id", request.id);
+		reply.header("x-board-instance", instance);
 		if (request.headers.origin !== void 0) throw new CommandError("forbidden", "Browser origins are not accepted.");
 		const address = app.server.address();
 		const port = address !== null && typeof address === "object" ? address.port : options.port;
@@ -8912,7 +9005,7 @@ async function createApiServer(options) {
 		const caller = callers.get(request);
 		if (caller === void 0) throw new Error("Operation identity was not resolved.");
 		const operation = OPERATIONS.find((entry) => entry.id === request.params.id);
-		if (operation === void 0) throw new CommandError("usage", "Unknown catalog operation.");
+		if (operation === void 0) throw new CommandError("version_mismatch", "This daemon does not know the operation. Run `board service restart` to update the daemon, then retry.");
 		const body = inputBody(request.body);
 		const parsed = operation.input.safeParse(body.input);
 		if (!parsed.success) throw new CommandError(errorCodeOf(parsed.error), "Fix the operation input.");
@@ -9530,55 +9623,6 @@ function createBlockMutations(config) {
 	};
 }
 //#endregion
-//#region ../core/src/app/board-utils.ts
-function trackerSource(project) {
-	return project.tracker.type === "jira" ? `jira:${project.id}` : `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
-}
-function projectForKey(config, key) {
-	const lowerKey = key.toLowerCase();
-	const matched = config.projects.filter((project) => {
-		const tracker = project.tracker;
-		if (tracker.type === "github-issues") {
-			const prefix = `${tracker.repo.toLowerCase()}#`;
-			const short = tracker.repo.split("/")[1];
-			return lowerKey.startsWith(prefix) || short !== void 0 && lowerKey.startsWith(`${short.toLowerCase()}#`);
-		}
-		const prefix = /^([A-Za-z][A-Za-z0-9_]*)-/.exec(key)?.[1]?.toUpperCase();
-		return prefix !== void 0 && (tracker.projectKeys.length === 0 || tracker.projectKeys.includes(prefix));
-	});
-	return matched.length === 1 ? matched[0] ?? null : null;
-}
-async function emit(trx, kind, project, taskId, at, payload, actor = "system") {
-	const parsed = parseActorId(actor);
-	if (parsed === null) throw new Error("Invalid journal actor");
-	await trx.insertInto("event").values({
-		at,
-		project,
-		task_id: taskId,
-		kind,
-		actor: parsed.actor,
-		actor_ref: parsed.actor === "agent" ? JSON.stringify(parsed.actorRef) : null,
-		payload: toJson(eventPayloadSchemas[kind], payload),
-		v: 1,
-		request_id: null
-	}).execute();
-}
-function taskView(task) {
-	return {
-		key: task.key,
-		project: task.project,
-		column: task.column,
-		membership: task.membership
-	};
-}
-function linkView(link) {
-	return {
-		kind: link.entity,
-		ref: link.entity === "pr" ? `${link.repo ?? ""}#${String(link.number ?? "")}` : link.entity === "session" ? link.session_id ?? "" : link.ticket_key ?? "",
-		role: link.role
-	};
-}
-//#endregion
 //#region ../core/src/app/membership.ts
 function canonicalKey(config, key) {
 	const parsed = parseRef$1(key, "task");
@@ -9988,6 +10032,7 @@ const EVENT_SUMMARIES = {
 	doorbell_read: "Doorbell read",
 	doorbell_undelivered: "Doorbell delivery exhausted",
 	inbound_failed: "Inbound message failed",
+	inbound_skipped: "Inbound message skipped",
 	from_you_raised: "Operator item raised",
 	from_you_cleared: "Operator item cleared",
 	flag_raised: "Flag raised",
@@ -11100,7 +11145,7 @@ function createObservationCore(deps) {
 					key,
 					value: "true"
 				}).execute();
-				await emit(trx, "spur_unknown_state", "board", null, new Date(clock.now()).toISOString(), {
+				await emit(trx, "spur_unknown_state", RESERVED_PROJECT, null, new Date(clock.now()).toISOString(), {
 					kind,
 					value
 				});
@@ -11343,18 +11388,12 @@ async function journal(trx, input) {
 async function taskContext(trx, event, gateway) {
 	if (!("conversation" in event) || event.conversation === void 0) return {
 		taskId: null,
-		project: "board",
-		taskKey: null
+		project: null
 	};
-	const row = await trx.selectFrom("conversation").leftJoin("task", "task.id", "conversation.task_id").select([
-		"conversation.task_id as taskId",
-		"task.project",
-		"task.key"
-	]).where("conversation.gateway", "=", gateway).where("conversation.ref", "=", event.conversation).executeTakeFirst();
+	const row = await trx.selectFrom("conversation").leftJoin("task", "task.id", "conversation.task_id").select(["conversation.task_id as taskId", "task.project"]).where("conversation.gateway", "=", gateway).where("conversation.ref", "=", event.conversation).executeTakeFirst();
 	return {
 		taskId: row?.taskId ?? null,
-		project: row?.project ?? "board",
-		taskKey: row?.key ?? null
+		project: row?.project ?? null
 	};
 }
 async function raiseInboundItem(trx, input) {
@@ -11370,6 +11409,10 @@ async function raiseInboundItem(trx, input) {
 	if (input.retry && item.inbound_event_json === null) await trx.updateTable("operator_item").set({ inbound_event_json: toJson(inboundEventSchema, input.event) }).where("id", "=", item.id).execute();
 	return item;
 }
+/** The operation input a parsed query command carries; legacy stored commands carry none. */
+function commandInput(event) {
+	return event.kind === "command" && event.command?.kind === "query" ? event.command.input : void 0;
+}
 async function deny(trx, input) {
 	const context = await taskContext(trx, input.event, input.gateway);
 	await journal(trx, {
@@ -11382,7 +11425,7 @@ async function deny(trx, input) {
 		},
 		actor: input.actor,
 		taskId: context.taskId,
-		project: context.project,
+		project: context.project ?? deniedProject(input.config, input.actor, commandInput(input.event)),
 		at: input.at
 	});
 	return input.privateResponse ? {
@@ -11390,6 +11433,24 @@ async function deny(trx, input) {
 		response: "not allowed"
 	} : { status: "ignored" };
 }
+/** Journal an inbound message the board does not act on; no gateway response. */
+async function skip(trx, input) {
+	const context = await taskContext(trx, input.event, input.gateway);
+	await journal(trx, {
+		kind: "inbound_skipped",
+		payload: {
+			gateway: input.gateway,
+			reason: input.reason,
+			normalizedEvent: input.event,
+			..."author" in input.event ? { platformUser: input.event.author } : {}
+		},
+		actor: input.actor,
+		taskId: context.taskId,
+		project: context.project ?? "_board",
+		at: input.at
+	});
+	return { status: "ignored" };
+}
 async function linkedComment(trx, event) {
 	return trx.selectFrom("comment").selectAll().where("conversation_ref", "=", event.conversation).where("message_ref", "=", event.message).executeTakeFirst();
 }
@@ -11470,7 +11531,7 @@ function createInbound(input) {
 	}
 	async function processMessage(trx, event, at) {
 		const conversation = await sourceContext(trx, event, at);
-		if (conversation?.block_id === null || conversation === void 0) return deny(trx, {
+		if (conversation?.block_id === null || conversation === void 0) return skip(trx, {
 			event,
 			reason: "Unknown board conversation.",
 			actor: "operator",
@@ -11498,7 +11559,7 @@ function createInbound(input) {
 			return { status: "applied" };
 		}
 		const comment = await linkedComment(trx, event);
-		if (comment === void 0 || comment.author !== "operator") return deny(trx, {
+		if (comment === void 0 || comment.author !== "operator") return skip(trx, {
 			event,
 			reason: "Original operator comment not found.",
 			actor: "system",
@@ -11547,6 +11608,7 @@ function createInbound(input) {
 	}
 	async function runUser(trx, event, at) {
 		if (event.kind === "command" && event.name !== void 0 && event.name !== config.slack.command) return deny(trx, {
+			config,
 			event,
 			reason: "Command name does not match the configured command.",
 			actor: "system",
@@ -11554,6 +11616,7 @@ function createInbound(input) {
 			at
 		});
 		if (event.kind !== "message_deleted" && event.author !== config.operator.slack) return deny(trx, {
+			config,
 			event,
 			reason: "Only the configured operator may act.",
 			actor: "system",
@@ -11563,6 +11626,7 @@ function createInbound(input) {
 		});
 		if (event.kind === "action" || event.kind === "command") {
 			if (!(event.kind === "action" ? event.sourceSpace !== null : true)) return deny(trx, {
+				config,
 				event,
 				reason: "Interaction came from outside a board space.",
 				actor: "operator",
@@ -11663,7 +11727,7 @@ function createInbound(input) {
 				},
 				actor: "system",
 				taskId: context.taskId,
-				project: context.project,
+				project: context.project ?? "_board",
 				at
 			});
 			await raiseInboundItem(trx, {

package/dist/mcp.mjs

@@ -1,6 +1,6 @@
-import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-BFgTh55w.mjs";
-import { r as CliError, t as requestOperation } from "./client-Ln76BdDz.mjs";
-import { n as loadClientConfig } from "./config-B_6fA4Au.mjs";
+import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-g7u1onIP.mjs";
+import { i as CliError, n as requestOperation } from "./client-D4cveOHQ.mjs";
+import { a as memoryVerdictCache, r as compareCatalogs, s as loadClientConfig, t as checkCatalog } from "./config-B1fVOLzp.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { z } from "zod";
@@ -79,6 +79,32 @@ function createMcpServer(env = process.env, loadConfig = loadClientConfig) {
 		version
 	});
 	const agent = Boolean(env["SPUR_SESSION"]);
+	const verdicts = memoryVerdictCache();
+	/** Addresses whose daemon served a different catalog; each call probes before sending. */
+	const mismatched = /* @__PURE__ */ new Map();
+	/** Refuses the call unless the daemon at a marked address now serves the client's catalog. */
+	const probe = async (config) => {
+		if (mismatched.get(config.address.href) === void 0) return;
+		const { clientVersion, serverVersion, matches, instance } = await compareCatalogs(config).catch((cause) => {
+			throw cause instanceof CliError && ERRORS[cause.code].recovery.sideEffects === "none" ? cause : new CliError("daemon_unavailable");
+		});
+		if (!matches) {
+			mismatched.set(config.address.href, {
+				clientVersion,
+				serverVersion
+			});
+			throw new CliError("version_mismatch", {
+				clientVersion,
+				serverVersion
+			});
+		}
+		mismatched.delete(config.address.href);
+		if (instance !== void 0) verdicts.remember(config.address, instance, {
+			clientVersion,
+			serverVersion,
+			matches: true
+		});
+	};
 	for (const op of OPERATIONS) server.registerTool(op.mcp.name, {
 		description: toolDescription(op),
 		inputSchema: fromJsonSchema(toolInputSchema(op, agent), handlerValidator),
@@ -93,7 +119,29 @@ function createMcpServer(env = process.env, loadConfig = loadClientConfig) {
 			const parsed = parseArguments(op, argumentsValue, agent);
 			key = parsed.key;
 			const config = loadConfig(env);
-			const value = await requestOperation(op, parsed.input, key, config);
+			await probe(config);
+			let instance;
+			let outcome;
+			try {
+				outcome = { value: await requestOperation(op, parsed.input, key, config, (seen) => {
+					instance = seen;
+				}) };
+			} catch (error) {
+				outcome = { error };
+			}
+			if (instance !== void 0) {
+				const verdict = await checkCatalog(config, instance, verdicts);
+				if (verdict !== void 0 && !verdict.matches) {
+					const context = {
+						clientVersion: verdict.clientVersion,
+						serverVersion: verdict.serverVersion
+					};
+					mismatched.set(config.address.href, context);
+					if (op.kind === "query") throw new CliError("version_mismatch", context);
+				}
+			}
+			if ("error" in outcome) throw outcome.error;
+			const value = outcome.value;
 			return {
 				content: [{
 					type: "text",

package/dist/{src-BFgTh55w.mjs → src-g7u1onIP.mjs}

@@ -113,6 +113,12 @@ const SLACK_BOT_SCOPES = [
 const DEFAULT_HTTP_PORT = 4311;
 const DEFAULT_SLACK_APP_NAME = "spur-board";
 const DEFAULT_SLACK_COMMAND = "/board";
+/**
+* The journal project of board-wide events that belong to no configured project: token
+* lifecycle, unknown Spur states and denials with no resolvable project. It sits outside the
+* project id pattern, so no configured project can take it.
+*/
+const RESERVED_PROJECT = "_board";
 const WEEKDAYS = [
 	"monday",
 	"tuesday",
@@ -195,7 +201,10 @@ function checkBoard(items, ctx) {
 	});
 }
 const projectSchema = z.strictObject({
-	id: z.string().regex(/^[a-z][a-z0-9-]*$/, "Expected lowercase letters, digits and dashes"),
+	id: z.string().refine((id) => id !== RESERVED_PROJECT, {
+		message: `"${RESERVED_PROJECT}" is reserved for board-wide journal events; choose another project id`,
+		abort: true
+	}).regex(/^[a-z][a-z0-9-]*$/, "Expected lowercase letters, digits and dashes"),
 	tracker: z.discriminatedUnion("type", [jiraTracker, githubIssuesTracker]),
 	repos: z.array(repoSlugSchema).min(1),
 	operatorGithubLogin: z.string().regex(/^[A-Za-z0-9-]{1,39}$/, "Expected a GitHub login"),
@@ -522,7 +531,11 @@ const ERRORS = {
 		exit: EXIT_CODES.notApplied,
 		message: "The client and daemon catalog versions do not match; nothing was applied.",
 		hint: "Run `board service restart` to update the daemon, then retry.",
-		recovery: noRetry("Run `board service restart`, then retry the command.")
+		recovery: noRetry("Run `board service restart`, then retry the command."),
+		mcp: {
+			hint: "Restart your agent session so `board mcp` loads the daemon's catalog; if the mismatch remains, run `board service restart`.",
+			recovery: noRetry("Restart your agent session; if the mismatch remains, run `board service restart`. Then retry the tool call.")
+		}
 	}),
 	daemon_unavailable: spec("daemon_unavailable", {
 		status: null,
@@ -894,6 +907,7 @@ const EVENT_KINDS = [
 	"doorbell_read",
 	"doorbell_undelivered",
 	"inbound_failed",
+	"inbound_skipped",
 	"from_you_raised",
 	"from_you_cleared",
 	"flag_raised",
@@ -1034,6 +1048,10 @@ const eventPayloadSchemas = {
 		gateway: S,
 		reason: S
 	}),
+	inbound_skipped: z.looseObject({
+		gateway: S,
+		reason: S
+	}),
 	from_you_raised: z.looseObject({
 		item: S,
 		rule: S.optional()
@@ -1242,9 +1260,10 @@ const errorInputSchema = z.strictObject({
 	requestId: z.string().min(1),
 	context: errorContextSchema.optional()
 });
-function fields(input) {
+function fields(input, transport = "default") {
 	const { code, requestId, context } = errorInputSchema.parse(input);
 	const spec = ERRORS[code];
+	const guidance = (transport === "mcp" ? spec.mcp : void 0) ?? spec;
 	const trace = code === "unexpected" ? {
 		requestId,
 		logLocation: "daemon log"
@@ -1253,9 +1272,9 @@ function fields(input) {
 		code,
 		requestId,
 		message: spec.message,
-		hint: spec.hint,
+		hint: guidance.hint,
 		docs: spec.docs,
-		recovery: spec.recovery,
+		recovery: guidance.recovery,
 		context: context ?? {},
 		...trace ? { trace } : {}
 	};
@@ -1275,12 +1294,12 @@ function renderHttpProblem(input) {
 	};
 }
 function renderMcpError(input) {
-	const content = fields(input);
+	const content = fields(input, "mcp");
 	return {
 		isError: true,
 		content: [{
 			type: "text",
-			text: renderStderrError(input)
+			text: renderLines(content)
 		}],
 		structuredContent: content
 	};
@@ -1292,8 +1311,7 @@ function renderJsonError(input) {
 		error: fields(input)
 	};
 }
-function renderStderrError(input) {
-	const value = fields(input);
+function renderLines(value) {
 	const context = Object.entries(value.context);
 	return [
 		`error: ${value.code}: ${value.message}`,
@@ -2678,4 +2696,4 @@ var AdapterError = class extends Error {
 	}
 };
 //#endregion
-export { taskKeySchema as A, SLACK_BOT_SCOPES as B, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, requiredSecretKeys as z };
+export { taskKeySchema as A, requiredSecretKeys as B, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, RESERVED_PROJECT as R, prRefSchema as S, actorIdSchema as T, SLACK_BOT_SCOPES as V, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, configSchema as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spur-board",
-  "version": "0.7.1",
+  "version": "0.8.2",
   "license": "MIT",
   "engines": {
     "node": "^24.12.0 || ^26.0.0"

package/dist/config-B_6fA4Au.mjs

@@ -1,111 +0,0 @@
-import { R as configSchema } from "./src-BFgTh55w.mjs";
-import { r as CliError } from "./client-Ln76BdDz.mjs";
-import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import YAML from "yaml";
-//#region src/config.ts
-const CONNECT_TIMEOUT_MS = 2e3;
-const RESPONSE_TIMEOUT_MS = 3e4;
-function configFile(env, home) {
-	const boardHome = env["BOARD_HOME"];
-	if (boardHome) return join(resolve(boardHome), "config.yaml");
-	const xdg = env["XDG_CONFIG_HOME"];
-	return join(xdg && isAbsolute(xdg) ? xdg : join(home, ".config"), "spur-board", "config.yaml");
-}
-function resolveDaemonAddress(env = process.env, home = homedir(), configuredPort) {
-	const rawAddress = env["BOARD_DAEMON_URL"];
-	if (rawAddress === void 0) {
-		let port = configuredPort ?? 4311;
-		if (configuredPort === void 0) try {
-			const parsed = YAML.parseDocument(readFileSync(configFile(env, home), "utf8"));
-			if (parsed.errors.length === 0) {
-				const config = configSchema.safeParse(parsed.toJS());
-				if (config.success) port = config.data.http.port;
-			}
-		} catch {}
-		if (port === 0) throw new CliError("config", void 0, void 0, "http.port: 0 assigns a runtime port that clients cannot discover. Set BOARD_DAEMON_URL to the daemon listening address.");
-		return new URL(`http://127.0.0.1:${String(port)}`);
-	}
-	let address;
-	try {
-		address = new URL(rawAddress);
-	} catch {
-		throw new CliError("config", { environmentVariable: "BOARD_DAEMON_URL" });
-	}
-	if (!["http:", "https:"].includes(address.protocol) || address.username || address.password) throw new CliError("config", { environmentVariable: "BOARD_DAEMON_URL" });
-	return address;
-}
-function tokenInFolder(folder, warn) {
-	const directory = join(folder, ".spur-board");
-	const file = join(directory, "token");
-	try {
-		const owner = process.getuid?.();
-		const directoryInfo = lstatSync(directory);
-		if (!directoryInfo.isDirectory() || directoryInfo.uid !== owner || (directoryInfo.mode & 63) !== 0) throw new Error("unsafe token directory");
-		const descriptor = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW);
-		let value;
-		try {
-			const fileInfo = fstatSync(descriptor);
-			if (!fileInfo.isFile() || fileInfo.uid !== owner || (fileInfo.mode & 63) !== 0) throw new Error("unsafe token file");
-			value = readFileSync(descriptor, "utf8").trimEnd();
-		} finally {
-			closeSync(descriptor);
-		}
-		if (value === "") throw new Error("empty token file");
-		return value;
-	} catch (error) {
-		if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") return;
-		warn("Ignoring an unsafe .spur-board/token candidate.\n");
-		return;
-	}
-}
-function findTokenFile(cwd, home, warn = (message) => {
-	process.stderr.write(message);
-}) {
-	const current = realpathSync(cwd);
-	const boundary = realpathSync(home);
-	if (current === boundary) return void 0;
-	const toCurrent = relative(boundary, current);
-	const outsideHome = toCurrent === ".." || toCurrent.startsWith(`..${sep}`) || isAbsolute(toCurrent);
-	let folder = current;
-	while (folder !== boundary) {
-		if (outsideHome) {
-			const info = statSync(folder);
-			if (info.uid !== process.getuid?.() || (info.mode & 2) !== 0) break;
-		}
-		const token = tokenInFolder(folder, warn);
-		if (token !== void 0) return token;
-		const parent = dirname(folder);
-		if (parent === folder) break;
-		folder = parent;
-	}
-}
-function loadClientConfig(env = process.env, paths = {
-	cwd: process.cwd(),
-	home: homedir()
-}) {
-	const address = resolveDaemonAddress(env, paths.home);
-	const session = env["SPUR_SESSION"] || void 0;
-	const token = session ? void 0 : env["BOARD_TOKEN"] === void 0 ? findTokenFile(paths.cwd, paths.home) : env["BOARD_TOKEN"];
-	if (!session && !token) throw new CliError("config", { environmentVariable: "BOARD_TOKEN" });
-	return {
-		address,
-		session,
-		token,
-		connectTimeoutMs: CONNECT_TIMEOUT_MS,
-		responseTimeoutMs: RESPONSE_TIMEOUT_MS
-	};
-}
-/** Enrollment sends only a hash and works before any operator credential exists. */
-function loadEnrollmentConfig(env = process.env) {
-	return {
-		address: resolveDaemonAddress(env),
-		session: void 0,
-		token: void 0,
-		connectTimeoutMs: CONNECT_TIMEOUT_MS,
-		responseTimeoutMs: RESPONSE_TIMEOUT_MS
-	};
-}
-//#endregion
-export { resolveDaemonAddress as i, loadClientConfig as n, loadEnrollmentConfig as r, configFile as t };