@ref0/cli 0.10.0 → 0.11.0

package/dist/main.mjs

@@ -5486,12 +5486,15 @@ const name$1 = ownerNamePattern.source.replace(/^\^|\$$/g, "");
 const projectPattern = new RegExp(`^(${name$1})/(${name$1})$`);
 const threadPattern = new RegExp(`^(${name$1})(?:/(${name$1}))?#([1-9][0-9]*)$`);
 const repoPattern = new RegExp(`^(${name$1})/(${repoNamePattern.source.replace(/^\^|\$$/g, "")})$`);
+const pullRequestPattern = new RegExp(`${repoPattern.source.replace(/\$$/, "")}#[1-9][0-9]*$`);
 /** A project, `owner/project`. */
 const WrittenProject = Schema.String.check(Schema.isPattern(projectPattern)).pipe(Schema.brand("WrittenProject"));
 /** A thread, `owner/project#number`, or an org thread, `owner#number`. */
 const WrittenThread = Schema.String.check(Schema.isPattern(threadPattern)).pipe(Schema.brand("WrittenThread"));
 /** A repo, `owner/repo`. */
 const WrittenRepo = Schema.String.check(Schema.isPattern(repoPattern)).pipe(Schema.brand("WrittenRepo"));
+/** A pull request, `owner/repo#number`. */
+const WrittenPullRequest = Schema.String.check(Schema.isPattern(pullRequestPattern)).pipe(Schema.brand("WrittenPullRequest"));
 /** A written repo's parts: its owner, as an endpoint's path takes it, and its name. */
 const repoParts = (written) => {
 	const [, owner = "", repo = ""] = repoPattern.exec(written) ?? [];
@@ -6767,589 +6770,227 @@ Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
 	attachGrant: Schema.optionalKey(EventId)
 })]);
 //#endregion
-//#region ../contracts/src/approvals.ts
+//#region ../contracts/src/plan-events.ts
 /**
-* Approvals, as their commands travel: what a terminal, a page or an agent asks its person to
-* say yes to. A command is one endpoint, by its name in the surface table, and its request, as
-* that endpoint encodes it. ref0 decodes each part by the endpoint's own `Schema` before it
-* keeps or shows anything, so a command is exactly what the endpoint would take.
+* A plan's events, in its thread's project's log, written by the Project DO. A version's
+* state is folded from these and its thread's, never recorded on its own.
 */
 /**
-* An endpoint by its name in the surface table, `group.endpoint`. Checked against the table
-* where the command is made canonical, since the table is typed from the API this is part of.
+* A new version, as a draft. Its content never changes after this. Its reason, when given, says
+* why it was written; it's beside the plan, never in it, so it's no part of the content hash.
 */
-const CommandEndpoint = Schema.String.check(Schema.isPattern(/^[a-zA-Z]+\.[a-zA-Z]+$/));
-/** One command, as asked: its endpoint, and its request's path, query and payload, encoded. */
-const ApprovalCommand = Schema.Struct({
-	endpoint: CommandEndpoint,
-	params: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
-	query: Schema.optionalKey(Schema.JsonObject),
-	payload: Schema.optionalKey(Schema.Json)
-});
-/** A command ref0 won't ask anyone about: not an endpoint's request, or not one an approval runs. */
-var CommandRefused = class extends Schema.TaggedError()("CommandRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
-/** A terminal asking: its command, and the hash of the secret it collects the result with. */
-const StartApproval = Schema.Struct({
-	command: ApprovalCommand,
-	secretHash: SecretHash
-});
-/** A terminal's approval, started: what to show its person, and until when. */
-const ApprovalStarted = Schema.Struct({
-	approval: ApprovalId,
-	code: ApprovalCode,
-	expiresAt: Timestamp
-});
+const PlanWritten = eventKind("plan.written", Schema.Struct({
+	thread: ThreadId,
+	version: PlanVersion,
+	plan: PlanRecord,
+	contentHash: PlanContentHash,
+	reason: Schema.optionalKey(TextId)
+}));
 /**
-* An answer that waits for the person: the call only the person may make, or that agents ask
-* for, became an approval, which the person answers on their own page. A `202`, never a failure
-* of the call: whoever asked collects the result with `GET /v1/approvals/{approval}`.
+* The version is put to approval: each repo it names is asked to answer for it, and ref0 says yes
+* once they have or their time runs out. Any earlier draft or proposed version is
+* superseded.
 */
-var ApprovalNeeded = class extends Schema.TaggedError()("ApprovalNeeded", {
-	approval: ApprovalId,
-	says: Schema.String,
-	expiresAt: Timestamp
-}, { httpApiStatus: 202 }) {};
-const terminalAsker = Schema.Struct({ kind: Schema.Literal("terminal") });
-const pageAsker = Schema.Struct({ kind: Schema.Literal("page") });
-const agentAsker = Schema.Struct({
-	kind: Schema.Literal("agent"),
-	agent: AgentId,
-	handle: AgentHandle,
-	session: SessionId,
-	/** The attachment its credential was made under, for a person's agent in an organization. */
-	attachment: Schema.optionalKey(CredentialRef)
+const PlanProposed = eventKind("plan.proposed", Schema.Struct({
+	thread: ThreadId,
+	version: PlanVersion
+}));
+/** Who said yes: ref0's plans part, once every repo answered or its time ran out. */
+const PlanAcceptedBy = Schema.Struct({
+	kind: Schema.Literal("answered"),
+	part: Ref0Part
 });
-/**
-* Who asked, as a receipt keeps it: a terminal, one of ref0's pages, an agent, or a machine
-* asking to connect, by its ID and its own word for itself, and from where.
-*/
-const ApprovalAsker = Schema.Union([
-	terminalAsker,
-	pageAsker,
-	Schema.Struct({
-		kind: Schema.Literal("machine"),
-		machine: MachineId,
-		machineName: MachineName,
-		askedFrom: Schema.optionalKey(Schema.String)
-	}),
-	agentAsker
-]);
-/**
-* Who asked, as the person reads a request before they answer: a terminal, a page or an agent.
-* A machine's request is read as an `AttachmentRequestView`, never as a command.
-*/
-const ApprovalViewAsker = Schema.Union([
-	terminalAsker,
-	pageAsker,
-	agentAsker
-]);
-/** A request, as the person reads it before they answer. */
-const ApprovalView = Schema.Struct({
-	approval: ApprovalId,
-	/** The command as its CLI line. */
-	says: Schema.String,
-	/** Everything the command carries, each named, in order: nothing it would run is left out. */
-	fields: Schema.Array(Schema.Struct({
-		name: Schema.String,
-		value: Schema.String,
-		part: Schema.Literals([
-			"path",
-			"query",
-			"payload"
-		])
-	})),
-	command: ApprovalCommand,
-	asker: ApprovalViewAsker,
-	askedFrom: Schema.optionalKey(Schema.String),
-	askedAt: Timestamp,
-	expiresAt: Timestamp,
-	/**
-	* An agent's ask: the kind of action its answer may set agents' permission for, and whether a
-	* yes may let agents take it without asking. A no with the passkey may always stop them asking.
-	*/
-	agentPermission: Schema.optionalKey(Schema.Struct({
-		action: ScopeAction,
-		mayAllow: Schema.Boolean
-	})),
-	/**
-	* What the command acts on, drawn as ref0 resolves it for the person reading, where its
-	* endpoint names a preview. Without one the page can draw, it offers only no.
-	*/
-	preview: Schema.optionalKey(ApprovalPreview)
+/** A child thread, by the plan entry that made it. */
+const PlanChildThread = Schema.Struct({
+	entry: PlanEntryKey,
+	thread: ThreadId
 });
-/** A statement's hash: the SHA-256 of its words and quoted values as JSON, as lowercase hex. */
-const StatementHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+const ChildThreads = Schema.Array(PlanChildThread).check(Schema.isMaxLength(50));
 /**
-* Who asks for a yes to a statement: a workflow's run, `passkey.run`'s, by the workflow and the
-* run; or a gate's check, `passkey.check`'s, by the check, the pull request's version it gates and
-* the check run its statement is over.
+* The version is accepted, and the one accepted before it superseded. Each child is named only
+* once its owner has registered it.
 */
-const StatementAsker = Schema.Union([Schema.Struct({
-	kind: Schema.Literal("workflow"),
-	workflow: WorkflowName,
-	run: WorkflowRunId
-}), Schema.Struct({
-	kind: Schema.Literal("gate"),
-	check: CheckKey,
-	pullRequest: PullRequestNumber,
-	version: VersionNumber,
-	run: CheckRunId
-})]);
+const PlanAccepted = eventKind("plan.accepted", Schema.Struct({
+	thread: ThreadId,
+	version: PlanVersion,
+	by: PlanAcceptedBy,
+	/** The version accepted before this one. */
+	supersedes: Schema.optionalKey(PlanVersion),
+	/** Children made now, each starting in planning. */
+	started: ChildThreads,
+	/** Entries an earlier version dropped and this one adds back: the same child, reopened if it was closed. */
+	rejoined: ChildThreads,
+	/** Children no longer part of the plan, so it stops waiting on them. Closing one is its own event. */
+	dropped: ChildThreads
+}));
+//#endregion
+//#region ../contracts/src/plan-calls.ts
 /**
-* A passkey request, as the person reads it before they answer: the statement, its words as its
-* asker wrote them and each value it quotes, and its hash; who asks; where, a workflow's
-* `owner/repo` or a thread's `owner/project#number`, or a gate's pull request, `owner/repo#number`;
-* whom it asks, the run's accountable person, or for a gate the person behind its run, a person by
-* name, or a permission's holders; and until when.
+* Plans and decisions: what the Worker asks a thread's Project DO, once `Authorize` has said
+* who's acting. A plan is written with its words; the Project DO stores each as a text and
+* records the version with their IDs.
 */
-const StatementView = Schema.Struct({
-	approval: ApprovalId,
-	statement: WorkflowText,
-	hash: StatementHash,
-	asker: StatementAsker,
-	home: Schema.String,
-	from: Schema.Union([Schema.Literals(["accountable", "person"]), Schema.Struct({ permission: RepoPermissionName })]),
-	askedAt: Timestamp,
-	expiresAt: Timestamp
-});
+/** A plan's free text: one of its outcomes, or an answer's reason. */
+const PlanText = Schema.String.check(Schema.isBetweenLength(1, 2048));
 /**
-* The person's own requests, waiting for them; the passkey requests workflows' runs and gates asked
-* them; and each machine's request this browser session is the answerer of, so a reload finds it
-* again without its code.
+* How a plan does its work, in system terms, for people: about a page. A revision replaces it,
+* with a reason; no one appends to it.
 */
-const ApprovalsWaiting = Schema.Struct({
-	approvals: Schema.Array(ApprovalView),
-	statements: Schema.Array(StatementView),
-	requests: Schema.Array(AttachmentRequestView)
-});
-/** Finding a terminal's request by the code it showed. */
-const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), Schema.Struct({ link: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)) })]);
+const Approach = Schema.String.check(Schema.isBetweenLength(1, 6e3));
 /**
-* Asking for the passkey's options to answer a request: a terminal's request needs its code
-* again, so its ID alone, which travels where its code doesn't, never answers it. A machine's
-* request needs its answerer, and the agent it chooses to connect, before a yes has options.
+* A child as written. On a top-level org thread's plan, `project` names one of its owner's
+* projects to start it in, as that project's thread; left out, it's in its parent's scope.
 */
-const ApprovalOptionsRequest = Schema.Struct({
-	code: Schema.optionalKey(TypedApprovalCode),
-	folders: Schema.optionalKey(ConnectFolderChoices)
+const PlanChildInput = Schema.Struct({
+	entry: PlanEntryKey,
+	title: Title,
+	outcome: Outcome,
+	stackedOn: Schema.optionalKey(PlanEntryKey),
+	required: Schema.Boolean,
+	project: Schema.optionalKey(ProjectName)
 });
 /**
-* An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
-* permission its own way, so a pairing that can't happen can't be sent: yes, and let agents do
-* it without asking; no, and stop agents asking, with the passkey too.
+* A plan as written: `PlanRecord`'s shape, with its words in place of text IDs. Its repos are up
+* to 20 of the project's, by name; a parent whose work is all in its children names none.
 */
-const AnswerApproval = Schema.Union([
-	Schema.Struct({
-		answer: Schema.Literal("yes"),
-		permission: Schema.optionalKey(Schema.Literal("allow")),
-		assertion: PasskeyAsserted,
-		code: Schema.optionalKey(TypedApprovalCode),
-		/** The preview the page drew, where the command's endpoint names one. */
-		preview: Schema.optionalKey(PreviewEcho),
-		/** The statement the page showed, by its hash, for a workflow run's or a gate's passkey request. */
-		statement: Schema.optionalKey(Schema.Struct({ hash: StatementHash }))
-	}),
-	Schema.Struct({
-		answer: Schema.Literal("no"),
-		permission: Schema.Literal("deny"),
-		assertion: PasskeyAsserted,
-		code: Schema.optionalKey(TypedApprovalCode)
-	}),
-	Schema.Struct({
-		answer: Schema.Literal("no"),
-		code: Schema.optionalKey(TypedApprovalCode)
-	})
-]);
+const PlanInput = Schema.Struct({
+	approach: Schema.optionalKey(Approach),
+	repos: Schema.Array(RepoName).check(Schema.isMaxLength(20)),
+	outcomes: Schema.Array(PlanText).check(Schema.isBetweenLength(1, 50)),
+	children: Schema.Array(PlanChildInput).check(Schema.isMaxLength(50))
+}).check(Schema.makeFilter((plan) => planProblem(plan) ?? true));
 /**
-* What running an approved command came to: its status, and its endpoint's answer or refusal,
-* as JSON. ref0 reads it by the command's endpoint before anyone sees it, and whoever asked reads
-* it the same way, with `ranOf`: this schema is part of the API the endpoints' types come from,
-* so it can't be typed by them itself.
+* A project a plan's child names, as the Worker found it in the plan's owner before it asked the
+* scope: its ID, and whether the writer can see it; or, with no `project`, that the owner has
+* none by that name. The Worker refuses nothing for it, since only the scope knows which entries
+* a version keeps.
 */
-const Ran = Schema.Struct({
-	status: Schema.Int,
-	result: Schema.Json
+const NamedProject = Schema.Struct({
+	name: ProjectName,
+	project: Schema.optionalKey(ProjectId),
+	seen: Schema.Boolean
 });
-/**
-* A ran command whose answer its endpoint's schemas no longer read, such as one kept from
-* before they changed: it ran, and what it came to can't be said.
-*/
-var ResultUnreadable = class extends Schema.TaggedError()("ResultUnreadable", { nextStep: Schema.String }, { httpApiStatus: 500 }) {};
-/**
-* Where a request stands, for whoever asked: still waiting; approved, and running as soon as
-* ref0 can; refused; expired; or what it ran to, with the endpoint it ran, whose schemas read it.
-*/
-const ApprovalState = Schema.Union([
-	Schema.Struct({
-		state: Schema.Literal("waiting"),
-		expiresAt: Timestamp
-	}),
-	Schema.Struct({
-		state: Schema.Literal("approved"),
-		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
-		collected: Schema.optionalKey(Schema.Literal(true))
-	}),
-	Schema.Struct({ state: Schema.Literal("refused") }),
-	Schema.Struct({ state: Schema.Literal("expired") }),
-	Schema.Struct({
-		state: Schema.Literal("ran"),
-		endpoint: CommandEndpoint,
-		...Ran.fields
-	})
-]);
-/** Only the answering browser receives a machine's answer code; state reads never carry it. */
-const ApprovalAnswer = Schema.Union([
-	Schema.Struct({
-		...ApprovalState.members[1].fields,
-		answerCode: ApprovalCode
-	}),
-	Schema.Struct({
-		...ApprovalState.members[4].fields,
-		answerCode: ApprovalCode
-	}),
-	ApprovalState
-]);
-/** A request that isn't there, or isn't the caller's to see, answers the same. */
-var ApprovalNotFound = class extends Schema.TaggedError()("ApprovalNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
-/** Too many asked, or too many codes typed, from here in the last hour. */
-var SlowDown = class extends Schema.TaggedError()("SlowDown", { nextStep: Schema.String }, { httpApiStatus: 429 }) {};
-/** A command's hash: the SHA-256 of its canonical JSON, as lowercase hex. */
-const CommandHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
 Schema.Struct({
-	approval: ApprovalId,
-	endpoint: CommandEndpoint,
-	/** The command's canonical JSON. */
-	command: Schema.String,
-	commandHash: CommandHash,
-	asker: ApprovalAsker,
-	/** The browser session the person answered in, for their log. */
-	credential: CredentialRef,
-	generation: Generation,
-	/** When the request expires, in epoch milliseconds. */
-	deadline: Schema.Int,
-	challenge: Schema.String,
-	/** A machine answer retries only from its answering session, with this key. */
-	answerKey: Schema.optionalKey(RequestId),
-	/** An agent's ask: the credential it asked with, checked again before the answer counts. */
-	asking: Schema.optionalKey(TokenId),
-	/** The kind of action the person, answering, let agents take without asking from now on. */
-	allow: Schema.optionalKey(ScopeAction)
+	...commandFields,
+	project: ProjectId,
+	ownerName: OwnerName,
+	number: ThreadNumber,
+	plan: PlanInput,
+	projects: Schema.Array(NamedProject).check(Schema.isMaxLength(50)),
+	reason: Schema.optionalKey(Reason),
+	propose: Schema.Boolean
 });
 Schema.Struct({
-	approval: ApprovalId,
-	action: ScopeAction,
-	credential: CredentialRef,
-	generation: Generation
+	...commandFields,
+	ownerName: OwnerName,
+	project: ProjectId,
+	number: ThreadNumber,
+	version: PlanVersion
+});
+/** A decision as it stands: what it asks, who decides, the answers so far, and how it closed. */
+const DecisionView = Schema.Struct({
+	decision: DecisionId,
+	kind: DecisionKind,
+	subject: DecisionSubject,
+	question: Schema.optionalKey(TextId),
+	options: Schema.Array(AnswerOption),
+	lean: Schema.optionalKey(AnswerKey),
+	deciders: Schema.Array(Decider),
+	deadline: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
+	state: Schema.Literals(["open", "closed"]),
+	answers: Schema.Array(Schema.Struct({
+		decider: DeciderRef,
+		answer: AnswerKey,
+		reason: Schema.optionalKey(TextId),
+		at: Schema.DateTimeUtcFromMillis
+	})),
+	result: Schema.optionalKey(AnswerKey),
+	closedWhy: Schema.optionalKey(DecisionClosedWhy)
 });
-Schema.Union([Schema.Struct({ denied: Schema.Literal(true) }), Schema.Struct({
-	denied: Schema.Literal(false),
-	reason: Schema.Literals(["generation moved", "not set up"])
-})]);
-Schema.Union([Schema.Struct({
-	admitted: Schema.Literal(true),
-	admittedAt: Schema.Int,
-	answerCode: Schema.optionalKey(ApprovalCode)
-}), Schema.Struct({
-	admitted: Schema.Literal(false),
-	reason: Schema.Literals([
-		"expired",
-		"generation moved",
-		"challenge used",
-		"not set up",
-		"asker gone"
-	])
-})]);
-Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
-	found: Schema.Literal(true),
-	endpoint: CommandEndpoint,
-	command: Schema.String,
-	commandHash: CommandHash,
-	generation: Generation,
-	generationNow: Generation,
-	/** The `approval.answered` its admission recorded in the person's log. */
-	answeredEvent: EventId,
-	/** Who asked, as that `approval.answered` says. */
-	asker: ApprovalAsker,
-	/** What running it came to, once it ran, as `KeptRan` keeps it. */
-	result: Schema.optionalKey(Schema.String)
-})]);
 /**
-* A `Ran` as it's kept, on its receipt and on its approval: its JSON, as text. The Owner DO
-* keeps it as it comes and runs no endpoint's schemas, so it's read only by its endpoint, with
-* `keptRan`, which refuses one they don't take.
+* Where a decision is, as people write it: its thread, `pip/default#3`, or an org thread's,
+* `acme#7`; and a gate's pull request, `pip/notes#1`. Its Project DO writes them as it answers,
+* from its own threads and repos and the owner's name the Worker gives it, so each reads as it's
+* called now.
 */
-const KeptRan = Schema.fromJsonString(Ran);
-Schema.Struct({
-	approval: ApprovalId,
-	result: Schema.String
+const DecisionNames = Schema.Struct({
+	thread: WrittenThread,
+	pullRequest: Schema.optionalKey(WrittenPullRequest)
 });
-Schema.Struct({ result: Schema.String });
-Schema.Struct({ approval: ApprovalId });
-Schema.Struct({ approval: ApprovalId });
-Schema.Union([Schema.Struct({ expired: Schema.Literal(true) }), Schema.Struct({ expired: Schema.Literal(false) })]);
-Schema.Struct({
-	person: PersonId,
-	approval: ApprovalId
+/** A decision as `/v1` answers it: as it stands, and where it is, in words. */
+const NamedDecision = Schema.Struct({
+	...DecisionView.fields,
+	names: DecisionNames
 });
-//#endregion
-//#region ../contracts/src/browser-sessions.ts
 /**
-* A browser session's cookie: Better Auth's, named for ref0, `Secure` and host-only on the
-* app's one origin. It holds the session's token, signed; the directory and the person's Owner DO hold
-* only the token's SHA-256.
+* A version as it stands: its content, its state, and, once proposed, where its approval is: its
+* repos still being checked, or who accepted it.
 */
-const browserSessionCookie = "__Secure-ref0.session_token";
-Schema.Struct({
-	token: TokenId,
-	secretHash: SecretHash,
-	expiresAt: Schema.DateTimeUtcFromMillis
+const PlanVersionView = Schema.Struct({
+	thread: ThreadId,
+	number: ThreadNumber,
+	version: PlanVersion,
+	state: PlanState,
+	contentHash: PlanContentHash,
+	plan: PlanView,
+	/** Why it was written, when its writer said: never part of its content. */
+	reason: Schema.optionalKey(TextId),
+	writtenBy: ActorRef,
+	writtenAt: Schema.DateTimeUtcFromMillis,
+	/** Proposed, and its repos haven't all answered yet: it isn't accepted yet. */
+	checking: Schema.Boolean,
+	/**
+	* What its check found when it ended, every repo answered or their time run out: the repos
+	* that never answered. None for a draft, while it's being checked, or when a newer version or
+	* the thread closing ended the check first.
+	*/
+	check: Schema.optionalKey(PlanCheck),
+	/**
+	* Accepted, and waiting to be recorded: on its new `children` registering, or on a merge under
+	* the thread's current revision `publishing`.
+	*/
+	accepting: Schema.optionalKey(Schema.Literals(["children", "publishing"])),
+	acceptedBy: Schema.optionalKey(PlanAcceptedBy)
 });
-Schema.Struct({ registered: Schema.Boolean });
-/**
-* Where a signed-in person stands: naming, when the name their GitHub login gave was taken or
-* kept back, with that login as a suggestion; setting up, once their owner is made and before
-* it's ready with this session registered, which naming again finishes; or ready.
-*/
-const Welcome = Schema.Union([Schema.Struct({
-	state: Schema.Literals(["ready", "setting up"]),
-	person: PersonId,
-	owner: OwnerId,
-	name: OwnerName
-}), Schema.Struct({
-	state: Schema.Literal("naming"),
-	person: PersonId,
-	suggestion: Schema.optionalKey(Schema.String)
-})]);
+/** A plan's free text refused before anything was stored, saying which. */
+var PlanTextRefused = class extends Schema.TaggedError()("PlanTextRefused", {
+	/** Where it is in the plan, such as `outcomes[3]`. */
+	where: Schema.String,
+	problem: Schema.Literals([
+		"empty",
+		"too long",
+		"looks like a secret"
+	]),
+	nextStep: Schema.String
+}, { httpApiStatus: 422 }) {};
+/** A plan names a repo this project doesn't hold. */
+var PlanRepoNotFound = class extends Schema.TaggedError()("PlanRepoNotFound", {
+	repo: RepoName,
+	nextStep: Schema.String
+}, { httpApiStatus: 422 }) {};
 /**
-* A browser session renewed: its expiry, in its person's Owner DO and in the directory, and on its cookie.
-* Renewed at most once a day, so one asked sooner answers its expiry unchanged.
+* A plan names its scope's own repo, made just now, before the scope holds it. Nothing was kept
+* under the request's delivery ID, so the same request is written once it does.
 */
-const SessionRenewed = Schema.Struct({ expiresAt: Schema.DateTimeUtcFromMillis });
+var OwnRepoNotReady = class extends Schema.TaggedError()("OwnRepoNotReady", {
+	repo: RepoName,
+	nextStep: Schema.String
+}, { httpApiStatus: 503 }) {};
 /**
-* What starting a GitHub sign-in at `POST /auth/sign-in/social` answers: GitHub's address to go
-* to, with the sign-in's state in a cookie set alongside. Better Auth's answer, which ref0 serves.
+* A child entry this plan can't have: a project named on a project thread's plan or a nested org
+* thread's, a project that isn't there or the writer can't see, one where its proposer may not
+* start threads, an entry moved to another project, or a stack across scopes. A project that
+* isn't there and one the writer can't see are refused alike, as `ProjectNotFound` is.
 */
-const NavigationUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/[^\s/]+(?:\/[^\s]*)?$/), Schema.makeFilter((url) => URL.canParse(url) || "an HTTP(S) URL the platform can parse")).pipe(Schema.brand("NavigationUrl"));
-Schema.Struct({ url: NavigationUrl });
+var PlanChildRefused = class extends Schema.TaggedError()("PlanChildRefused", { nextStep: Schema.String }, { httpApiStatus: 422 }) {};
+var PlanVersionNotFound = class extends Schema.TaggedError()("PlanVersionNotFound", {
+	number: ThreadNumber,
+	version: PlanVersion,
+	nextStep: Schema.String
+}, { httpApiStatus: 404 }) {};
 /**
-* Where signing in sends the browser back to, as `POST /auth/sign-in/social` takes it: a path on
-* ref0's own origin, such as `/welcome`, or a whole URL. Never a socket's.
-*/
-const SignInDestination = Schema.String.pipe(Schema.brand("SignInDestination"));
-Schema.Struct({
-	provider: Schema.Literal("github"),
-	callbackURL: SignInDestination,
-	errorCallbackURL: SignInDestination
-});
-/** The name a naming person chose for their owner. */
-const NameOwner = Schema.Struct({ name: OwnerName });
-//#endregion
-//#region ../contracts/src/plan-events.ts
-/**
-* A plan's events, in its thread's project's log, written by the Project DO. A version's
-* state is folded from these and its thread's, never recorded on its own.
-*/
-/**
-* A new version, as a draft. Its content never changes after this. Its reason, when given, says
-* why it was written; it's beside the plan, never in it, so it's no part of the content hash.
-*/
-const PlanWritten = eventKind("plan.written", Schema.Struct({
-	thread: ThreadId,
-	version: PlanVersion,
-	plan: PlanRecord,
-	contentHash: PlanContentHash,
-	reason: Schema.optionalKey(TextId)
-}));
-/**
-* The version is put to approval: each repo it names is asked to answer for it, and ref0 says yes
-* once they have or their time runs out. Any earlier draft or proposed version is
-* superseded.
-*/
-const PlanProposed = eventKind("plan.proposed", Schema.Struct({
-	thread: ThreadId,
-	version: PlanVersion
-}));
-/** Who said yes: ref0's plans part, once every repo answered or its time ran out. */
-const PlanAcceptedBy = Schema.Struct({
-	kind: Schema.Literal("answered"),
-	part: Ref0Part
-});
-/** A child thread, by the plan entry that made it. */
-const PlanChildThread = Schema.Struct({
-	entry: PlanEntryKey,
-	thread: ThreadId
-});
-const ChildThreads = Schema.Array(PlanChildThread).check(Schema.isMaxLength(50));
-/**
-* The version is accepted, and the one accepted before it superseded. Each child is named only
-* once its owner has registered it.
-*/
-const PlanAccepted = eventKind("plan.accepted", Schema.Struct({
-	thread: ThreadId,
-	version: PlanVersion,
-	by: PlanAcceptedBy,
-	/** The version accepted before this one. */
-	supersedes: Schema.optionalKey(PlanVersion),
-	/** Children made now, each starting in planning. */
-	started: ChildThreads,
-	/** Entries an earlier version dropped and this one adds back: the same child, reopened if it was closed. */
-	rejoined: ChildThreads,
-	/** Children no longer part of the plan, so it stops waiting on them. Closing one is its own event. */
-	dropped: ChildThreads
-}));
-//#endregion
-//#region ../contracts/src/plan-calls.ts
-/**
-* Plans and decisions: what the Worker asks a thread's Project DO, once `Authorize` has said
-* who's acting. A plan is written with its words; the Project DO stores each as a text and
-* records the version with their IDs.
-*/
-/** A plan's free text: one of its outcomes, or an answer's reason. */
-const PlanText = Schema.String.check(Schema.isBetweenLength(1, 2048));
-/**
-* How a plan does its work, in system terms, for people: about a page. A revision replaces it,
-* with a reason; no one appends to it.
-*/
-const Approach = Schema.String.check(Schema.isBetweenLength(1, 6e3));
-/**
-* A child as written. On a top-level org thread's plan, `project` names one of its owner's
-* projects to start it in, as that project's thread; left out, it's in its parent's scope.
-*/
-const PlanChildInput = Schema.Struct({
-	entry: PlanEntryKey,
-	title: Title,
-	outcome: Outcome,
-	stackedOn: Schema.optionalKey(PlanEntryKey),
-	required: Schema.Boolean,
-	project: Schema.optionalKey(ProjectName)
-});
-/**
-* A plan as written: `PlanRecord`'s shape, with its words in place of text IDs. Its repos are up
-* to 20 of the project's, by name; a parent whose work is all in its children names none.
-*/
-const PlanInput = Schema.Struct({
-	approach: Schema.optionalKey(Approach),
-	repos: Schema.Array(RepoName).check(Schema.isMaxLength(20)),
-	outcomes: Schema.Array(PlanText).check(Schema.isBetweenLength(1, 50)),
-	children: Schema.Array(PlanChildInput).check(Schema.isMaxLength(50))
-}).check(Schema.makeFilter((plan) => planProblem(plan) ?? true));
-/**
-* A project a plan's child names, as the Worker found it in the plan's owner before it asked the
-* scope: its ID, and whether the writer can see it; or, with no `project`, that the owner has
-* none by that name. The Worker refuses nothing for it, since only the scope knows which entries
-* a version keeps.
-*/
-const NamedProject = Schema.Struct({
-	name: ProjectName,
-	project: Schema.optionalKey(ProjectId),
-	seen: Schema.Boolean
-});
-Schema.Struct({
-	...commandFields,
-	project: ProjectId,
-	ownerName: OwnerName,
-	number: ThreadNumber,
-	plan: PlanInput,
-	projects: Schema.Array(NamedProject).check(Schema.isMaxLength(50)),
-	reason: Schema.optionalKey(Reason),
-	propose: Schema.Boolean
-});
-Schema.Struct({
-	...commandFields,
-	ownerName: OwnerName,
-	project: ProjectId,
-	number: ThreadNumber,
-	version: PlanVersion
-});
-/** A decision as it stands: what it asks, who decides, the answers so far, and how it closed. */
-const DecisionView = Schema.Struct({
-	decision: DecisionId,
-	kind: DecisionKind,
-	subject: DecisionSubject,
-	question: Schema.optionalKey(TextId),
-	options: Schema.Array(AnswerOption),
-	lean: Schema.optionalKey(AnswerKey),
-	deciders: Schema.Array(Decider),
-	deadline: Schema.optionalKey(Schema.DateTimeUtcFromMillis),
-	state: Schema.Literals(["open", "closed"]),
-	answers: Schema.Array(Schema.Struct({
-		decider: DeciderRef,
-		answer: AnswerKey,
-		reason: Schema.optionalKey(TextId),
-		at: Schema.DateTimeUtcFromMillis
-	})),
-	result: Schema.optionalKey(AnswerKey),
-	closedWhy: Schema.optionalKey(DecisionClosedWhy)
-});
-/**
-* A version as it stands: its content, its state, and, once proposed, where its approval is: its
-* repos still being checked, or who accepted it.
-*/
-const PlanVersionView = Schema.Struct({
-	thread: ThreadId,
-	number: ThreadNumber,
-	version: PlanVersion,
-	state: PlanState,
-	contentHash: PlanContentHash,
-	plan: PlanView,
-	/** Why it was written, when its writer said: never part of its content. */
-	reason: Schema.optionalKey(TextId),
-	writtenBy: ActorRef,
-	writtenAt: Schema.DateTimeUtcFromMillis,
-	/** Proposed, and its repos haven't all answered yet: it isn't accepted yet. */
-	checking: Schema.Boolean,
-	/**
-	* What its check found when it ended, every repo answered or their time run out: the repos
-	* that never answered. None for a draft, while it's being checked, or when a newer version or
-	* the thread closing ended the check first.
-	*/
-	check: Schema.optionalKey(PlanCheck),
-	/**
-	* Accepted, and waiting to be recorded: on its new `children` registering, or on a merge under
-	* the thread's current revision `publishing`.
-	*/
-	accepting: Schema.optionalKey(Schema.Literals(["children", "publishing"])),
-	acceptedBy: Schema.optionalKey(PlanAcceptedBy)
-});
-/** A plan's free text refused before anything was stored, saying which. */
-var PlanTextRefused = class extends Schema.TaggedError()("PlanTextRefused", {
-	/** Where it is in the plan, such as `outcomes[3]`. */
-	where: Schema.String,
-	problem: Schema.Literals([
-		"empty",
-		"too long",
-		"looks like a secret"
-	]),
-	nextStep: Schema.String
-}, { httpApiStatus: 422 }) {};
-/** A plan names a repo this project doesn't hold. */
-var PlanRepoNotFound = class extends Schema.TaggedError()("PlanRepoNotFound", {
-	repo: RepoName,
-	nextStep: Schema.String
-}, { httpApiStatus: 422 }) {};
-/**
-* A plan names its scope's own repo, made just now, before the scope holds it. Nothing was kept
-* under the request's delivery ID, so the same request is written once it does.
-*/
-var OwnRepoNotReady = class extends Schema.TaggedError()("OwnRepoNotReady", {
-	repo: RepoName,
-	nextStep: Schema.String
-}, { httpApiStatus: 503 }) {};
-/**
-* A child entry this plan can't have: a project named on a project thread's plan or a nested org
-* thread's, a project that isn't there or the writer can't see, one where its proposer may not
-* start threads, an entry moved to another project, or a stack across scopes. A project that
-* isn't there and one the writer can't see are refused alike, as `ProjectNotFound` is.
-*/
-var PlanChildRefused = class extends Schema.TaggedError()("PlanChildRefused", { nextStep: Schema.String }, { httpApiStatus: 422 }) {};
-var PlanVersionNotFound = class extends Schema.TaggedError()("PlanVersionNotFound", {
-	number: ThreadNumber,
-	version: PlanVersion,
-	nextStep: Schema.String
-}, { httpApiStatus: 404 }) {};
-/**
-* Only a thread's newest version is proposed, and never one already declined, nor one whose
-* required or stacked children would close a cycle of threads waiting on each other.
+* Only a thread's newest version is proposed, and never one already declined, nor one whose
+* required or stacked children would close a cycle of threads waiting on each other.
 */
 var PlanNotProposable = class extends Schema.TaggedError()("PlanNotProposable", {
 	version: PlanVersion,
@@ -7435,7 +7076,7 @@ const GateAnswerRoute = Schema.TaggedStruct("GateAnswerRoute", {
 	reason: Schema.optionalKey(TextId)
 });
 Schema.Union([
-	DecisionView,
+	NamedDecision,
 	GateAnswerRoute,
 	DecisionNotFound,
 	AnswerRefused,
@@ -7467,79 +7108,473 @@ Schema.Union([
 	]) }),
 	DeliveryOutsideWindow
 ]);
+/** Someone decisions wait on: a person, or an agent, and the roles the Worker found they hold. */
+const Waiter = Schema.Struct({
+	decider: DeciderRef,
+	roles: Schema.Array(Schema.Struct({
+		role: Schema.Literal("admin"),
+		owner: OwnerId
+	}))
+});
+Schema.Struct({
+	ownerName: OwnerName,
+	you: Waiter,
+	person: Schema.optionalKey(Waiter),
+	decisions: Schema.optionalKey(Schema.Array(DecisionId).check(Schema.isMaxLength(100)))
+});
+/**
+* An open decision that waits on the caller: on them, or, for an agent, on its person, who
+* answers it. A gate never takes an agent's answer, so an agent's gate always waits on its person.
+*/
+const WaitingDecision = Schema.Struct({
+	...NamedDecision.fields,
+	waitsOn: Schema.Literals(["you", "your person"])
+});
+const WaitingPage = Schema.Struct({ decisions: Schema.Array(WaitingDecision) });
+Schema.Struct({
+	ownerName: OwnerName,
+	number: ThreadNumber
+});
+const PlanVersionPage = Schema.Struct({ versions: Schema.Array(PlanVersionView) });
+Schema.Union([PlanVersionPage, ThreadNotFound]);
+/** One decision of the project's, by its ID. */
+/** At most how long a read of a decision waits for it to close, in seconds. */
+const DecisionWait = Schema.Int.check(Schema.isBetween({
+	minimum: 1,
+	maximum: 60
+}));
+Schema.Struct({
+	ownerName: OwnerName,
+	decision: DecisionId,
+	wait: Schema.optionalKey(DecisionWait)
+});
+Schema.Union([NamedDecision, DecisionNotFound]);
+/**
+* `POST …/plans`: a version, as a draft unless it's proposed at once, and why it was written.
+* A first version needs no reason, and a later one may leave it out.
+*/
+const WritePlanRequest = Schema.Struct({
+	plan: PlanInput,
+	reason: Schema.optionalKey(Reason),
+	propose: Schema.optionalKey(Schema.Boolean)
+});
+/** `POST …/decisions/{decision}/answers`: one of its answers, and why, in words. */
+const AnswerRequest = Schema.Struct({
+	answer: AnswerKey,
+	reason: Schema.optionalKey(PlanText)
+});
+Schema.Struct({
+	thread: ThreadId,
+	owner: OwnerId,
+	parent: ThreadId,
+	parentScope: ProjectId,
+	parentNumber: ThreadNumber,
+	fromPlan: Schema.Struct({
+		version: PlanVersion,
+		entry: PlanEntryKey
+	}),
+	title: Title,
+	outcome: Outcome,
+	required: Schema.Boolean,
+	actor: ActorRef,
+	cause: EventRef
+});
+/** The child as it stands, whether this call started it or an earlier one did. */
+const RemoteChildStarted = Schema.Struct({
+	number: ThreadNumber,
+	stage: ThreadStage,
+	stageRevision: StageRevision
+});
+Schema.Union([RemoteChildStarted, ProjectNotReady]);
+Schema.Struct({
+	thread: ThreadId,
+	number: ThreadNumber
+});
+/** A child's stage and its revision, as one read found them. */
+const ChildStageView = Schema.Struct({
+	stage: ThreadStage,
+	stageRevision: StageRevision
+});
+Schema.Union([ChildStageView, ThreadNotFound]);
+//#endregion
+//#region ../contracts/src/approvals.ts
+/**
+* Approvals, as their commands travel: what a terminal, a page or an agent asks its person to
+* say yes to. A command is one endpoint, by its name in the surface table, and its request, as
+* that endpoint encodes it. ref0 decodes each part by the endpoint's own `Schema` before it
+* keeps or shows anything, so a command is exactly what the endpoint would take.
+*/
+/**
+* An endpoint by its name in the surface table, `group.endpoint`. Checked against the table
+* where the command is made canonical, since the table is typed from the API this is part of.
+*/
+const CommandEndpoint = Schema.String.check(Schema.isPattern(/^[a-zA-Z]+\.[a-zA-Z]+$/));
+/** One command, as asked: its endpoint, and its request's path, query and payload, encoded. */
+const ApprovalCommand = Schema.Struct({
+	endpoint: CommandEndpoint,
+	params: Schema.optionalKey(Schema.Record(Schema.String, Schema.String)),
+	query: Schema.optionalKey(Schema.JsonObject),
+	payload: Schema.optionalKey(Schema.Json)
+});
+/** A command ref0 won't ask anyone about: not an endpoint's request, or not one an approval runs. */
+var CommandRefused = class extends Schema.TaggedError()("CommandRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/** A terminal asking: its command, and the hash of the secret it collects the result with. */
+const StartApproval = Schema.Struct({
+	command: ApprovalCommand,
+	secretHash: SecretHash
+});
+/** A terminal's approval, started: what to show its person, and until when. */
+const ApprovalStarted = Schema.Struct({
+	approval: ApprovalId,
+	code: ApprovalCode,
+	expiresAt: Timestamp
+});
+/**
+* An answer that waits for the person: the call only the person may make, or that agents ask
+* for, became an approval, which the person answers on their own page. A `202`, never a failure
+* of the call: whoever asked collects the result with `GET /v1/approvals/{approval}`.
+*/
+var ApprovalNeeded = class extends Schema.TaggedError()("ApprovalNeeded", {
+	approval: ApprovalId,
+	says: Schema.String,
+	expiresAt: Timestamp
+}, { httpApiStatus: 202 }) {};
+const terminalAsker = Schema.Struct({ kind: Schema.Literal("terminal") });
+const pageAsker = Schema.Struct({ kind: Schema.Literal("page") });
+const agentAsker = Schema.Struct({
+	kind: Schema.Literal("agent"),
+	agent: AgentId,
+	handle: AgentHandle,
+	session: SessionId,
+	/** The attachment its credential was made under, for a person's agent in an organization. */
+	attachment: Schema.optionalKey(CredentialRef)
+});
+/**
+* Who asked, as a receipt keeps it: a terminal, one of ref0's pages, an agent, or a machine
+* asking to connect, by its ID and its own word for itself, and from where.
+*/
+const ApprovalAsker = Schema.Union([
+	terminalAsker,
+	pageAsker,
+	Schema.Struct({
+		kind: Schema.Literal("machine"),
+		machine: MachineId,
+		machineName: MachineName,
+		askedFrom: Schema.optionalKey(Schema.String)
+	}),
+	agentAsker
+]);
+/**
+* Who asked, as the person reads a request before they answer: a terminal, a page or an agent.
+* A machine's request is read as an `AttachmentRequestView`, never as a command.
+*/
+const ApprovalViewAsker = Schema.Union([
+	terminalAsker,
+	pageAsker,
+	agentAsker
+]);
+/** A request, as the person reads it before they answer. */
+const ApprovalView = Schema.Struct({
+	approval: ApprovalId,
+	/** The command as its CLI line. */
+	says: Schema.String,
+	/** Everything the command carries, each named, in order: nothing it would run is left out. */
+	fields: Schema.Array(Schema.Struct({
+		name: Schema.String,
+		value: Schema.String,
+		part: Schema.Literals([
+			"path",
+			"query",
+			"payload"
+		])
+	})),
+	command: ApprovalCommand,
+	asker: ApprovalViewAsker,
+	askedFrom: Schema.optionalKey(Schema.String),
+	askedAt: Timestamp,
+	expiresAt: Timestamp,
+	/**
+	* An agent's ask: the kind of action its answer may set agents' permission for, and whether a
+	* yes may let agents take it without asking. A no with the passkey may always stop them asking.
+	*/
+	agentPermission: Schema.optionalKey(Schema.Struct({
+		action: ScopeAction,
+		mayAllow: Schema.Boolean
+	})),
+	/**
+	* What the command acts on, drawn as ref0 resolves it for the person reading, where its
+	* endpoint names a preview. Without one the page can draw, it offers only no.
+	*/
+	preview: Schema.optionalKey(ApprovalPreview)
+});
+/** A statement's hash: the SHA-256 of its words and quoted values as JSON, as lowercase hex. */
+const StatementHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+/**
+* Who asks for a yes to a statement: a workflow's run, `passkey.run`'s, by the workflow and the
+* run; or a gate's check, `passkey.check`'s, by the check, the pull request's version it gates and
+* the check run its statement is over.
+*/
+const StatementAsker = Schema.Union([Schema.Struct({
+	kind: Schema.Literal("workflow"),
+	workflow: WorkflowName,
+	run: WorkflowRunId
+}), Schema.Struct({
+	kind: Schema.Literal("gate"),
+	check: CheckKey,
+	pullRequest: PullRequestNumber,
+	version: VersionNumber,
+	run: CheckRunId
+})]);
+/**
+* A passkey request, as the person reads it before they answer: the statement, its words as its
+* asker wrote them and each value it quotes, and its hash; who asks; where, a workflow's
+* `owner/repo` or a thread's `owner/project#number`, or a gate's pull request, `owner/repo#number`;
+* whom it asks, the run's accountable person, or for a gate the person behind its run, a person by
+* name, or a permission's holders; and until when.
+*/
+const StatementView = Schema.Struct({
+	approval: ApprovalId,
+	statement: WorkflowText,
+	hash: StatementHash,
+	asker: StatementAsker,
+	home: Schema.String,
+	from: Schema.Union([Schema.Literals(["accountable", "person"]), Schema.Struct({ permission: RepoPermissionName })]),
+	askedAt: Timestamp,
+	expiresAt: Timestamp
+});
+/**
+* The person's own requests, waiting for them; the passkey requests workflows' runs and gates asked
+* them; each machine's request this browser session is the answerer of, so a reload finds it
+* again without its code; and the gates' decisions that wait on their yes or no, in every project
+* they see, oldest first.
+*/
+const ApprovalsWaiting = Schema.Struct({
+	approvals: Schema.Array(ApprovalView),
+	statements: Schema.Array(StatementView),
+	requests: Schema.Array(AttachmentRequestView),
+	decisions: Schema.Array(NamedDecision)
+});
+/** Finding a terminal's request by the code it showed. */
+const FindApproval = Schema.Union([Schema.Struct({ code: TypedApprovalCode }), Schema.Struct({ link: Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{22}$/)) })]);
+/**
+* Asking for the passkey's options to answer a request: a terminal's request needs its code
+* again, so its ID alone, which travels where its code doesn't, never answers it. A machine's
+* request needs its answerer, and the agent it chooses to connect, before a yes has options.
+*/
+const ApprovalOptionsRequest = Schema.Struct({
+	code: Schema.optionalKey(TypedApprovalCode),
+	folders: Schema.optionalKey(ConnectFolderChoices)
+});
+/**
+* An answer: yes, with the passkey, or no. For an agent's ask, each answer can set the owner's
+* permission its own way, so a pairing that can't happen can't be sent: yes, and let agents do
+* it without asking; no, and stop agents asking, with the passkey too.
+*/
+const AnswerApproval = Schema.Union([
+	Schema.Struct({
+		answer: Schema.Literal("yes"),
+		permission: Schema.optionalKey(Schema.Literal("allow")),
+		assertion: PasskeyAsserted,
+		code: Schema.optionalKey(TypedApprovalCode),
+		/** The preview the page drew, where the command's endpoint names one. */
+		preview: Schema.optionalKey(PreviewEcho),
+		/** The statement the page showed, by its hash, for a workflow run's or a gate's passkey request. */
+		statement: Schema.optionalKey(Schema.Struct({ hash: StatementHash }))
+	}),
+	Schema.Struct({
+		answer: Schema.Literal("no"),
+		permission: Schema.Literal("deny"),
+		assertion: PasskeyAsserted,
+		code: Schema.optionalKey(TypedApprovalCode)
+	}),
+	Schema.Struct({
+		answer: Schema.Literal("no"),
+		code: Schema.optionalKey(TypedApprovalCode)
+	})
+]);
+/**
+* What running an approved command came to: its status, and its endpoint's answer or refusal,
+* as JSON. ref0 reads it by the command's endpoint before anyone sees it, and whoever asked reads
+* it the same way, with `ranOf`: this schema is part of the API the endpoints' types come from,
+* so it can't be typed by them itself.
+*/
+const Ran = Schema.Struct({
+	status: Schema.Int,
+	result: Schema.Json
+});
+/**
+* A ran command whose answer its endpoint's schemas no longer read, such as one kept from
+* before they changed: it ran, and what it came to can't be said.
+*/
+var ResultUnreadable = class extends Schema.TaggedError()("ResultUnreadable", { nextStep: Schema.String }, { httpApiStatus: 500 }) {};
+/**
+* Where a request stands, for whoever asked: still waiting; approved, and running as soon as
+* ref0 can; refused; expired; or what it ran to, with the endpoint it ran, whose schemas read it.
+*/
+const ApprovalState = Schema.Union([
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		expiresAt: Timestamp
+	}),
+	Schema.Struct({
+		state: Schema.Literal("approved"),
+		/** A machine's answering browser may forget its saved answer once the terminal kept it. */
+		collected: Schema.optionalKey(Schema.Literal(true))
+	}),
+	Schema.Struct({ state: Schema.Literal("refused") }),
+	Schema.Struct({ state: Schema.Literal("expired") }),
+	Schema.Struct({
+		state: Schema.Literal("ran"),
+		endpoint: CommandEndpoint,
+		...Ran.fields
+	})
+]);
+/** Only the answering browser receives a machine's answer code; state reads never carry it. */
+const ApprovalAnswer = Schema.Union([
+	Schema.Struct({
+		...ApprovalState.members[1].fields,
+		answerCode: ApprovalCode
+	}),
+	Schema.Struct({
+		...ApprovalState.members[4].fields,
+		answerCode: ApprovalCode
+	}),
+	ApprovalState
+]);
+/** A request that isn't there, or isn't the caller's to see, answers the same. */
+var ApprovalNotFound = class extends Schema.TaggedError()("ApprovalNotFound", { nextStep: Schema.String }, { httpApiStatus: 404 }) {};
+/** Too many asked, or too many codes typed, from here in the last hour. */
+var SlowDown = class extends Schema.TaggedError()("SlowDown", { nextStep: Schema.String }, { httpApiStatus: 429 }) {};
+/** A command's hash: the SHA-256 of its canonical JSON, as lowercase hex. */
+const CommandHash = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/));
+Schema.Struct({
+	approval: ApprovalId,
+	endpoint: CommandEndpoint,
+	/** The command's canonical JSON. */
+	command: Schema.String,
+	commandHash: CommandHash,
+	asker: ApprovalAsker,
+	/** The browser session the person answered in, for their log. */
+	credential: CredentialRef,
+	generation: Generation,
+	/** When the request expires, in epoch milliseconds. */
+	deadline: Schema.Int,
+	challenge: Schema.String,
+	/** A machine answer retries only from its answering session, with this key. */
+	answerKey: Schema.optionalKey(RequestId),
+	/** An agent's ask: the credential it asked with, checked again before the answer counts. */
+	asking: Schema.optionalKey(TokenId),
+	/** The kind of action the person, answering, let agents take without asking from now on. */
+	allow: Schema.optionalKey(ScopeAction)
+});
+Schema.Struct({
+	approval: ApprovalId,
+	action: ScopeAction,
+	credential: CredentialRef,
+	generation: Generation
+});
+Schema.Union([Schema.Struct({ denied: Schema.Literal(true) }), Schema.Struct({
+	denied: Schema.Literal(false),
+	reason: Schema.Literals(["generation moved", "not set up"])
+})]);
+Schema.Union([Schema.Struct({
+	admitted: Schema.Literal(true),
+	admittedAt: Schema.Int,
+	answerCode: Schema.optionalKey(ApprovalCode)
+}), Schema.Struct({
+	admitted: Schema.Literal(false),
+	reason: Schema.Literals([
+		"expired",
+		"generation moved",
+		"challenge used",
+		"not set up",
+		"asker gone"
+	])
+})]);
+Schema.Union([Schema.Struct({ found: Schema.Literal(false) }), Schema.Struct({
+	found: Schema.Literal(true),
+	endpoint: CommandEndpoint,
+	command: Schema.String,
+	commandHash: CommandHash,
+	generation: Generation,
+	generationNow: Generation,
+	/** The `approval.answered` its admission recorded in the person's log. */
+	answeredEvent: EventId,
+	/** Who asked, as that `approval.answered` says. */
+	asker: ApprovalAsker,
+	/** What running it came to, once it ran, as `KeptRan` keeps it. */
+	result: Schema.optionalKey(Schema.String)
+})]);
+/**
+* A `Ran` as it's kept, on its receipt and on its approval: its JSON, as text. The Owner DO
+* keeps it as it comes and runs no endpoint's schemas, so it's read only by its endpoint, with
+* `keptRan`, which refuses one they don't take.
+*/
+const KeptRan = Schema.fromJsonString(Ran);
 Schema.Struct({
-	decider: DeciderRef,
-	roles: Schema.optionalKey(Schema.Array(Schema.Struct({
-		role: Schema.Literal("admin"),
-		owner: OwnerId
-	})))
+	approval: ApprovalId,
+	result: Schema.String
 });
-const WaitingPage = Schema.Struct({ decisions: Schema.Array(DecisionView) });
+Schema.Struct({ result: Schema.String });
+Schema.Struct({ approval: ApprovalId });
+Schema.Struct({ approval: ApprovalId });
+Schema.Union([Schema.Struct({ expired: Schema.Literal(true) }), Schema.Struct({ expired: Schema.Literal(false) })]);
 Schema.Struct({
-	ownerName: OwnerName,
-	number: ThreadNumber
+	person: PersonId,
+	approval: ApprovalId
 });
-const PlanVersionPage = Schema.Struct({ versions: Schema.Array(PlanVersionView) });
-Schema.Union([PlanVersionPage, ThreadNotFound]);
-/** One decision of the project's, by its ID. */
-/** At most how long a read of a decision waits for it to close, in seconds. */
-const DecisionWait = Schema.Int.check(Schema.isBetween({
-	minimum: 1,
-	maximum: 60
-}));
+//#endregion
+//#region ../contracts/src/browser-sessions.ts
+/**
+* A browser session's cookie: Better Auth's, named for ref0, `Secure` and host-only on the
+* app's one origin. It holds the session's token, signed; the directory and the person's Owner DO hold
+* only the token's SHA-256.
+*/
+const browserSessionCookie = "__Secure-ref0.session_token";
 Schema.Struct({
-	ownerName: OwnerName,
-	decision: DecisionId,
-	wait: Schema.optionalKey(DecisionWait)
+	token: TokenId,
+	secretHash: SecretHash,
+	expiresAt: Schema.DateTimeUtcFromMillis
 });
-Schema.Union([DecisionView, DecisionNotFound]);
+Schema.Struct({ registered: Schema.Boolean });
 /**
-* `POST …/plans`: a version, as a draft unless it's proposed at once, and why it was written.
-* A first version needs no reason, and a later one may leave it out.
+* Where a signed-in person stands: naming, when the name their GitHub login gave was taken or
+* kept back, with that login as a suggestion; setting up, once their owner is made and before
+* it's ready with this session registered, which naming again finishes; or ready.
 */
-const WritePlanRequest = Schema.Struct({
-	plan: PlanInput,
-	reason: Schema.optionalKey(Reason),
-	propose: Schema.optionalKey(Schema.Boolean)
-});
-/** `POST …/decisions/{decision}/answers`: one of its answers, and why, in words. */
-const AnswerRequest = Schema.Struct({
-	answer: AnswerKey,
-	reason: Schema.optionalKey(PlanText)
-});
-Schema.Struct({
-	thread: ThreadId,
+const Welcome = Schema.Union([Schema.Struct({
+	state: Schema.Literals(["ready", "setting up"]),
+	person: PersonId,
 	owner: OwnerId,
-	parent: ThreadId,
-	parentScope: ProjectId,
-	parentNumber: ThreadNumber,
-	fromPlan: Schema.Struct({
-		version: PlanVersion,
-		entry: PlanEntryKey
-	}),
-	title: Title,
-	outcome: Outcome,
-	required: Schema.Boolean,
-	actor: ActorRef,
-	cause: EventRef
-});
-/** The child as it stands, whether this call started it or an earlier one did. */
-const RemoteChildStarted = Schema.Struct({
-	number: ThreadNumber,
-	stage: ThreadStage,
-	stageRevision: StageRevision
-});
-Schema.Union([RemoteChildStarted, ProjectNotReady]);
+	name: OwnerName
+}), Schema.Struct({
+	state: Schema.Literal("naming"),
+	person: PersonId,
+	suggestion: Schema.optionalKey(Schema.String)
+})]);
+/**
+* A browser session renewed: its expiry, in its person's Owner DO and in the directory, and on its cookie.
+* Renewed at most once a day, so one asked sooner answers its expiry unchanged.
+*/
+const SessionRenewed = Schema.Struct({ expiresAt: Schema.DateTimeUtcFromMillis });
+/**
+* What starting a GitHub sign-in at `POST /auth/sign-in/social` answers: GitHub's address to go
+* to, with the sign-in's state in a cookie set alongside. Better Auth's answer, which ref0 serves.
+*/
+const NavigationUrl = Schema.String.check(Schema.isPattern(/^https?:\/\/[^\s/]+(?:\/[^\s]*)?$/), Schema.makeFilter((url) => URL.canParse(url) || "an HTTP(S) URL the platform can parse")).pipe(Schema.brand("NavigationUrl"));
+Schema.Struct({ url: NavigationUrl });
+/**
+* Where signing in sends the browser back to, as `POST /auth/sign-in/social` takes it: a path on
+* ref0's own origin, such as `/welcome`, or a whole URL. Never a socket's.
+*/
+const SignInDestination = Schema.String.pipe(Schema.brand("SignInDestination"));
 Schema.Struct({
-	thread: ThreadId,
-	number: ThreadNumber
-});
-/** A child's stage and its revision, as one read found them. */
-const ChildStageView = Schema.Struct({
-	stage: ThreadStage,
-	stageRevision: StageRevision
+	provider: Schema.Literal("github"),
+	callbackURL: SignInDestination,
+	errorCallbackURL: SignInDestination
 });
-Schema.Union([ChildStageView, ThreadNotFound]);
+/** The name a naming person chose for their owner. */
+const NameOwner = Schema.Struct({ name: OwnerName });
 //#endregion
 //#region ../contracts/src/ask-calls.ts
 /**
@@ -11659,6 +11694,151 @@ Schema.Struct({
 		name: RepoName
 	}))
 });
+/** Where an agent's session asks for an identity token. */
+const identityTokenPath = "/v1/me/identity-token";
+/** One DNS label, or one part of an IPv4 address: letters, digits and inner hyphens. */
+const label = "[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?";
+/** `https://`, a host name, then maybe `:` and a port with no leading zero. */
+const audiencePattern = new RegExp(`^https://(${label}(?:\\.${label})*)(?::([1-9][0-9]{0,4}))?$`);
+/**
+* Whether the platform's URL parser reads the audience as written: an `https` URL whose host is
+* the audience's own, lowercased, and whose port is its own, or none for 443. That refuses a host
+* the parser rewrites, such as `https://1.2.3` read as `1.2.0.3`, and a port past 65535.
+*/
+const parsesAsWritten = (audience) => {
+	const parts = audiencePattern.exec(audience);
+	if (parts === null || !URL.canParse(audience)) return false;
+	const url = new URL(audience);
+	const port = parts[2] ?? "";
+	return url.protocol === "https:" && url.hostname === (parts[1] ?? "").toLowerCase() && url.port === (port === "443" ? "" : port);
+};
+/**
+* Who an identity token is for: an outside service's HTTPS origin, in ASCII, at most 255 bytes,
+* with no credentials, path, query, fragment, wildcard or space. It's kept exactly as asked, its
+* case and any port too, so `https://verifier.example:443` is another audience than
+* `https://verifier.example`. ref0 never fetches or resolves it.
+*/
+const IdentityAudience = Schema.String.check(Schema.isMaxLength(255), Schema.isPattern(audiencePattern), Schema.makeFilter((audience) => parsesAsWritten(audience) || "an origin the platform reads as written")).pipe(Schema.brand("IdentityAudience"));
+/** `POST /v1/me/identity-token`'s body: the one audience, and nothing else. */
+const IdentityTokenRequest = Schema.Struct({ audience: IdentityAudience });
+/** A compact JWT: its header, payload and signature, each in base64url, at most 4 KiB. */
+const IdentityToken = Schema.String.check(Schema.isMaxLength(4096), Schema.isPattern(/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/)).pipe(Schema.brand("IdentityToken"));
+/** What asking for an identity token answers: the token, and when it expires, its `exp`. */
+const IssuedIdentityToken = Schema.Struct({
+	token: IdentityToken,
+	expiresAt: Schema.DateTimeUtcFromMillis
+});
+/**
+* An identity token's `jti`: a fresh UUIDv4 from the platform's cryptographic source for each
+* token, naming its issuance in ref0's log without naming any row or secret.
+*/
+const IdentityTokenId = Schema.String.check(Schema.isPattern(/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)).pipe(Schema.brand("IdentityTokenId"));
+/**
+* A person, as one audience knows them: `pperson_`, then the first 128 bits of an HMAC of the
+* person's ref0 ID for the token's issuer and audience, as a TypeID suffix. Stable at one
+* audience, different at every other, and carrying no time.
+*/
+const PairwisePersonId = TypeId("pperson").pipe(Schema.brand("PairwisePersonId"));
+/** A session, as one audience knows it, made as a person's is. */
+const PairwiseSessionId = TypeId("psession").pipe(Schema.brand("PairwiseSessionId"));
+/** The accountable person, last in a token's chain: only their pairwise ID. */
+const PersonActor = Schema.Struct({ sub: PairwisePersonId });
+/** A session in a token's chain, then whoever it acts for: its parent session, or the person. */
+const sessionActing = (act) => Schema.Struct({
+	sub: PairwiseSessionId,
+	act
+});
+const oneSession = sessionActing(PersonActor);
+const twoSessions = sessionActing(oneSession);
+const threeSessions = sessionActing(twoSessions);
+/**
+* A token's `act`, as RFC 8693 nests it: the current session, then up to three parent sessions,
+* then the accountable person, each by its pairwise ID. It's history, not authority: a verifier
+* allows the agent in `sub`, never an actor.
+*/
+const IdentityActor = Schema.Union([
+	oneSession,
+	twoSessions,
+	threeSessions,
+	sessionActing(threeSessions)
+]);
+/** A time in a token, in whole UTC epoch seconds. */
+const EpochSeconds = Schema.Int.check(Schema.isGreaterThan(0));
+Schema.Struct({
+	iss: ApiOrigin,
+	sub: AgentId,
+	aud: IdentityAudience,
+	iat: EpochSeconds,
+	exp: EpochSeconds,
+	jti: IdentityTokenId,
+	act: IdentityActor
+}).check(Schema.makeFilter(({ iat, exp }) => exp > iat && exp - iat <= 600 || `an expiry after its issue, at most 600 seconds later`));
+/**
+* A signing key's ID, its `kid`: the key's RFC 7638 thumbprint, SHA-256 in base64url, so one ID
+* never names two keys.
+*/
+const SigningKeyId = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{43}$/)).pipe(Schema.brand("SigningKeyId"));
+Schema.Struct({
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId,
+	typ: Schema.Literal("JWT")
+});
+/** A P-256 coordinate: 32 bytes in base64url, unpadded, in its one canonical spelling. */
+const Coordinate = Schema.String.check(Schema.isPattern(/^[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$/));
+/** One public key in the JWKS: exactly these fields, and never a private one. */
+const PublicSigningKey = Schema.Struct({
+	kty: Schema.Literal("EC"),
+	crv: Schema.Literal("P-256"),
+	x: Coordinate,
+	y: Coordinate,
+	use: Schema.Literal("sig"),
+	alg: Schema.Literal("ES256"),
+	kid: SigningKeyId
+});
+Schema.Struct({ keys: Schema.Array(PublicSigningKey).check(Schema.isMaxLength(3)) });
+Schema.Struct({
+	issuer: ApiOrigin,
+	jwks_uri: Schema.String,
+	subject_types_supported: Schema.Tuple([Schema.Literal("public")]),
+	id_token_signing_alg_values_supported: Schema.Tuple([Schema.Literal("ES256")]),
+	claims_supported: Schema.Tuple([
+		Schema.Literal("iss"),
+		Schema.Literal("sub"),
+		Schema.Literal("aud"),
+		Schema.Literal("exp"),
+		Schema.Literal("iat"),
+		Schema.Literal("jti"),
+		Schema.Literal("act")
+	])
+});
+/**
+* The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
+* `IdentityAudience` says. The refused text is never echoed.
+*/
+var IdentityAudienceRefused = class extends Schema.TaggedError()("IdentityAudienceRefused", { nextStep: Schema.String }, { httpApiStatus: 400 }) {};
+/**
+* Less than a whole second is left before the session, a parent or the credential expires, or
+* the token would expire before it's recorded: the next prompt renews or replaces the session.
+*/
+var IdentityTokenNotReady = class extends Schema.TaggedError()("IdentityTokenNotReady", { nextStep: Schema.String }, { httpApiStatus: 409 }) {};
+/**
+* ref0 signed an identity token for one of a project's sessions: in that project's log, on the
+* session's thread, with ref0's own IDs for the session, its agent and its accountable person,
+* and the token's `jti`, never the token. It proves ref0 made the token, not that any service
+* received or used it. A failed append discards the token, so every token has its event.
+*/
+const IdentityTokenIssued = eventKind("identity_token.issued", Schema.Struct({
+	session: SessionId,
+	agent: AgentRef,
+	/** The person whose attachment authorized the session's chain, last in the token's `act`. */
+	accountable: PersonId,
+	jti: IdentityTokenId,
+	audience: IdentityAudience,
+	issuer: ApiOrigin,
+	keyId: SigningKeyId,
+	issuedAt: Schema.DateTimeUtcFromMillis,
+	expiresAt: Schema.DateTimeUtcFromMillis
+}));
 Schema.Literals([
 	"info/refs",
 	"git-upload-pack",
@@ -11911,6 +12091,71 @@ const GateAddition = Schema.Struct({
 	from: NeedFrom
 });
 /**
+* A yes that met a need: its decider's, given by the person `by` when one gave it, such as an
+* admin answering as the owner's admins; or, `overridden`, a check ref0 said no to, met by the
+* yes of each of its overrides.
+*/
+const NeedYes = Schema.Struct({
+	decider: DeciderRef,
+	by: Schema.optionalKey(PersonId),
+	overridden: Schema.optionalKey(Schema.Literal(true))
+});
+/**
+* An override left of a check ref0 said no to: of a part's failed run, or of the check not running,
+* and who answers it.
+*/
+const OverrideLeft = Schema.Struct({
+	of: Schema.Literals(["failed run", "not run"]),
+	by: OverrideAnswerer
+});
+/**
+* A decider a need waits on. For a check ref0 said no to, `overrides` lists each of its overrides
+* left, every one of whose yeses meets it in a pass's place, none when it has none: one yes to a
+* gate answers every decider its person may answer as, each override among them.
+*/
+const NeedWait = Schema.Struct({
+	decider: DeciderRef,
+	overrides: Schema.optionalKey(Schema.Array(OverrideLeft).check(Schema.isMaxLength(maxGateDeciders)))
+});
+/**
+* How one of a version's needs stands under its gate's answers now, as the gate is decided from
+* them: `met` by each yes in `by`; `met` with nothing to wait for, `as` `no checks`, for `checks`
+* when none of the repo's checks runs on the change, or `on the tip`, for a check only the merge
+* queue's tip runs, which judges it before `main` moves; `waiting` on each decider in `on`, when
+* `all`, or else on a yes from any one of them; `waiting` for ref0 to read which of `main`'s
+* checks run on the change; or `refused` by a person's no to one of its deciders, or to an
+* override of one, which decides the whole gate no.
+*/
+const NeedStanding = Schema.Union([
+	Schema.Struct({
+		state: Schema.Literal("met"),
+		by: Schema.Array(NeedYes).check(Schema.isMaxLength(maxGateDeciders))
+	}),
+	Schema.Struct({
+		state: Schema.Literal("met"),
+		as: Schema.Literals(["no checks", "on the tip"])
+	}),
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		on: Schema.Array(NeedWait).check(Schema.isMaxLength(maxGateDeciders)),
+		all: Schema.Boolean
+	}),
+	Schema.Struct({
+		state: Schema.Literal("waiting"),
+		for: Schema.Literal("checks read")
+	}),
+	Schema.Struct({
+		state: Schema.Literal("refused"),
+		decider: DeciderRef,
+		by: PersonId
+	})
+]);
+/** A version's need, with every place it came from, and how it stands once its gate is open. */
+const GateNeedView = Schema.Struct({
+	...GateNeed.fields,
+	standing: Schema.optionalKey(NeedStanding)
+});
+/**
 * The version's gate decided again in place under `main`'s `.ref0/` now (Q7c): on which `main`
 * and under its tree, `pending` until `main`'s gate answers, then `held` or `grew`; the needs
 * it answered, joined to ref0's floor, absent while pending; what `main`'s gate read of the
@@ -12012,8 +12257,21 @@ const GateView = Schema.Struct({
 	state: GateState,
 	/** Why the gate failed; null otherwise. */
 	why: Schema.NullOr(Schema.String),
-	/** None while pending; once answered, the floor's too, sorted as they're spelled. */
-	needs: Schema.Array(GateNeed),
+	/**
+	* None while pending; once answered, the floor's too, sorted as they're spelled, each with how
+	* it stands once the version's gate is open.
+	*/
+	needs: Schema.Array(GateNeedView),
+	/** The repo's owner, whose admins answer its admins' needs: at home, its person alone. */
+	owner: OwnerId,
+	/**
+	* The names of the owner and of the people its needs' standings name, where the directory has
+	* them.
+	*/
+	names: Schema.optionalKey(Schema.Array(Schema.Struct({
+		owner: OwnerId,
+		name: OwnerName
+	})).check(Schema.isMaxLength(maxGateDeciders + 1))),
 	/** What the gate read of the change's trees, each read once, in order; none while pending. */
 	reads: GateReads,
 	/** The project gate revision the version was decided under; none for 0. */
@@ -14133,6 +14391,7 @@ const KnownEvent = Schema.Union([
 	ThreadListingChanged,
 	SessionStarted,
 	SessionEnded,
+	IdentityTokenIssued,
 	MemberRoleChanged,
 	MemberRemoved,
 	InvitationSent,
@@ -14994,6 +15253,11 @@ var ApprovalSecret = class extends HttpApiMiddleware.Service()("ref0/contracts/A
 * what to change. Any other part that fails its contract is answered with Effect's empty 400.
 */
 var MachineNameRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/MachineNameRefusal", { error: CommandRefused }) {};
+/**
+* An identity token's request whose audience its contract refuses, missing or not an HTTPS
+* origin, answered as `IdentityAudienceRefused`, which never echoes what was sent.
+*/
+var IdentityAudienceRefusal = class extends HttpApiMiddleware.Service()("ref0/contracts/IdentityAudienceRefusal", { error: IdentityAudienceRefused }) {};
 const idempotency = { "idempotency-key": RequestId };
 const inProject$1 = {
 	owner: OwnerRef,
@@ -15216,7 +15480,18 @@ var MeGroup = class extends HttpApiGroup.make("me").add(HttpApiEndpoint.get("get
 		UsageRangeRefused,
 		AuthorityUnavailable
 	]
-})).middleware(Authorization) {};
+}), HttpApiEndpoint.post("identityToken", identityTokenPath, {
+	payload: IdentityTokenRequest,
+	success: IssuedIdentityToken,
+	error: [
+		IdentityAudienceRefused,
+		IdentityTokenNotReady,
+		NotPermitted,
+		SessionHasEnded,
+		SlowDown,
+		AuthorityUnavailable
+	]
+}).middleware(IdentityAudienceRefusal)).middleware(Authorization) {};
 /**
 * A thread's endpoints, as one of a project's threads and an org thread take them alike, by
 * where they are: `at` is a project's path parameters, or the owner's alone for its own scope.
@@ -16152,15 +16427,18 @@ const decisionEndpoints = (at) => {
 		HttpApiEndpoint.get("get", "/:decision", {
 			params: onDecision,
 			query: { wait: Schema.optionalKey(DecisionWait) },
-			success: DecisionView,
+			success: NamedDecision,
 			error: [...projectErrors, DecisionNotFound]
 		}),
 		HttpApiEndpoint.post("answer", "/:decision/answers", {
 			params: onDecision,
 			headers: idempotency,
 			payload: AnswerRequest,
-			success: DecisionView,
+			success: NamedDecision,
 			error: [
+				ApprovalNeeded,
+				CommandRefused,
+				SlowDown,
 				...projectErrors,
 				DecisionNotFound,
 				AnswerRefused,
@@ -17007,6 +17285,15 @@ const ownSurfaces = {
 		cli: "meters",
 		mcp: null
 	},
+	"me.identityToken": {
+		action: "session:change",
+		actors: "agent",
+		target: "session",
+		stepUp: "never",
+		asks: "never",
+		cli: "identity-token",
+		mcp: null
+	},
 	"threads.list": {
 		action: "project:read",
 		actors: "both",
@@ -20180,10 +20467,10 @@ const blockerLines = (list, address) => {
 	].join("\n");
 };
 /** How many blockers stand on the thread now, in words. */
-const standingWords = (changed) => changed.standing === 0 ? "None stands now, so ref0 merges it once it’s ready." : `${changed.standing} ${changed.standing === 1 ? "stands" : "stand"}, so ref0 won’t merge it yet.`;
+const standingWords$1 = (changed) => changed.standing === 0 ? "None stands now, so ref0 merges it once it’s ready." : `${changed.standing} ${changed.standing === 1 ? "stands" : "stand"}, so ref0 won’t merge it yet.`;
 /** A blocker added, in words: which, its ask, how many stand, and a publish it didn't stop. */
 const addedWords = (changed, address) => [
-	`Blocked ${address} by ${changed.blocker}. ${standingWords(changed)}`,
+	`Blocked ${address} by ${changed.blocker}. ${standingWords$1(changed)}`,
 	...changed.decision === void 0 ? [] : [`It waits on a person’s answer to the ask ${changed.decision}.`],
 	...changed.admitted === void 0 ? [] : [`A merge carrying it was already under way in ${changed.admitted.join(", ")}; the blocker doesn’t stop that one.`]
 ].join("\n");
@@ -20330,7 +20617,7 @@ const clearing = (name, description) => Command.make(name, {
 		payload
 	}));
 	const done = name === "remove" ? "Removed" : "Marked met";
-	yield* printAnswer(answer.json, asJson, `${done} ${answer.value.blocker} on ${address}. ${standingWords(answer.value)}`);
+	yield* printAnswer(answer.json, asJson, `${done} ${answer.value.blocker} on ${address}. ${standingWords$1(answer.value)}`);
 }).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription(description));
 /** `ref0 blocked` and its subcommands. */
 const blockedCommands = [Command.make("blocked").pipe(Command.withDescription("What a thread is blocked by, which stops ref0 merging it: list, add, hold, remove, and mark met"), Command.withShortDescription("List and manage a thread’s blockers"), Command.withSubcommands([
@@ -21030,7 +21317,7 @@ const grantForAgent = Effect.fnUntraced(function* (owner, agent) {
 * an update installs anew. Node, run from source, loads JSON only with the `type` attribute,
 * and only as a default export.
 */
-const cliVersion = "0.10.0";
+const cliVersion = "0.11.0";
 //#endregion
 //#region src/harness/hook-protocol.ts
 /**
@@ -21408,9 +21695,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		"Approve it only if you ran this ref0 connect yourself, just now: a yes gives this machine a lasting credential for each agent it connects.",
 		"Waiting for the answer. Ctrl-C stops it."
 	]]);
-	let typed = "";
-	const show = (text) => Effect.ignore(terminal.display(text));
-	const endWait = yield* Effect.cached(Effect.suspend(() => typed === "" ? Effect.void : show("\n")).pipe(Effect.andThen(Console.error(""))));
+	const endWait = yield* Effect.cached(Console.error(""));
 	const saidAfterWait = (refusal) => Effect.andThen(endWait, said(refusal));
 	if (opener !== void 0) yield* openBrowser(opener, `${config.api}/connect#${link.secret}`);
 	const withSecret = HttpApiMiddleware.layerClient(ApprovalSecret, ({ request, next }) => next(HttpClientRequest.bearerToken(request, collecting.secret)));
@@ -21569,25 +21854,21 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 	});
 	const typedCode = Effect.gen(function* () {
 		const keys = yield* terminal.readInput;
+		let typed = "";
 		while (true) {
 			const pressed = yield* Effect.option(Queue.take(keys));
 			if (Option.isNone(pressed) || quits(pressed.value.key)) return yield* Effect.interrupt;
 			const { input, key } = pressed.value;
 			if (key.name === "backspace") {
-				if (typed === "") continue;
 				typed = takeBack(typed);
-				yield* show("\b \b");
 				continue;
 			}
 			if (key.name !== "return" && key.name !== "enter") {
 				const text = Option.getOrElse(input, () => "");
-				if (!typesText(text)) continue;
-				typed += text;
-				yield* show(text);
+				if (typesText(text)) typed += text;
 				continue;
 			}
 			const line = typed.trim();
-			if (typed !== "") yield* show("\n");
 			typed = "";
 			if (line === "") continue;
 			if (isAnswerCode(line)) return line;
@@ -21595,7 +21876,7 @@ const requestAttachment = Effect.fnUntraced(function* (asked) {
 		}
 	}).pipe(Effect.scoped);
 	const readAnswer = Effect.gen(function* () {
-		yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
+		if (listener === void 0) yield* printBlocks([[`Paste the code from your own page on ${config.api}.`]]);
 		const code = yield* typedCode;
 		yield* Ref.update(pasted, (first) => first ?? code);
 		if (listener !== void 0) yield* listener.stop;
@@ -24062,8 +24343,16 @@ const mostFolders = 8;
 const isConfigFolderPath = Schema.is(ConfigFolderPath);
 /** The line that asks again. */
 const again = "ref0 connect";
-/** Every folder found, each ticked but one ref0 can't be shown; Enter keeps the ticked ones. */
+/** The widest a line of ref0's own words runs, as its help does, in a terminal at least as wide. */
+const mostColumns = 100;
+/**
+* Every folder found, each ticked but one ref0 can't be shown; Enter keeps the ticked ones. The
+* question is said first, wrapped between words to the terminal, and the chooser shows only the
+* folders: once Enter chooses, it leaves the ticked ones on one line after any question it was
+* given, which the terminal would break mid-word.
+*/
 const choose = Effect.fnUntraced(function* (found, home) {
+	const columns = yield* (yield* Terminal.Terminal).columns;
 	const choices = found.map((folder) => {
 		const shown = shownConfigFolder(home, folder.configFolder);
 		const sendable = isConfigFolderPath(shown);
@@ -24079,8 +24368,9 @@ const choose = Effect.fnUntraced(function* (found, home) {
 		};
 	});
 	const ticked = choices.filter((choice) => choice.selected).length;
+	const keys = "Space ticks or unticks one; Enter connects those ticked.";
+	yield* printBlocks([[{ label: "Connect which config folders?" }, ...wrapWords(ticked > mostFolders ? `One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. ${keys}` : keys, columns > 0 ? Math.min(columns, mostColumns) : mostColumns)]]);
 	return yield* Prompt.run(Prompt.MultiSelect({
-		message: ticked > mostFolders ? `Connect which config folders? One request connects at most ${mostFolders}, so untick ${ticked - mostFolders} or more. Space ticks or unticks one; Enter connects those ticked.` : "Connect which config folders? Space ticks or unticks one; Enter connects those ticked.",
 		choices,
 		max: mostFolders
 	}));
@@ -24197,6 +24487,7 @@ const connectCommands = [Command.make("connect", { json }, ({ json: asJson }) =>
 	if (found.length === 0) return yield* sayFailed(`ref0 found no Claude Code or Codex config folder in your home. Start Claude Code or Codex once, then run ${again} again.`);
 	const chosen = yield* choose(found, home).pipe(Effect.catchTag("QuitError", () => sayFailed("Stopped, and nothing was asked.")));
 	if (chosen.length === 0) return yield* sayFailed(`No config folder was ticked, so nothing was asked. To connect one, run ${again} again.`);
+	yield* Console.error("");
 	const connected = yield* requestAttachment(chosen);
 	const installed = yield* installInto(connected.kept, { asJson });
 	const others = yield* otherOwners(connected);
@@ -24582,7 +24873,7 @@ const paramValues = (params) => {
 * its params, and when it ends; under it, each workflow's run, by its title and its file, and
 * how it stands; and under each, its newest asks and passkeys.
 */
-const waitingLines = (wait, now) => [`${wait.check}${paramValues(wait.params)} · waiting, until ${minute(wait.endsAt)} · ${wait.start}`, ...wait.runs.flatMap((run, index) => {
+const waitingLines$1 = (wait, now) => [`${wait.check}${paramValues(wait.params)} · waiting, until ${minute(wait.endsAt)} · ${wait.start}`, ...wait.runs.flatMap((run, index) => {
 	const last = index === wait.runs.length - 1;
 	const under = last ? "   " : "│  ";
 	return [`${last ? "└─" : "├─"} ${run.title ?? run.workflow} · ${waitedText[run.state]} · ${run.workflow}.ts`, ...run.leaves.map((leaf, at) => `${under}${at === run.leaves.length - 1 ? "└─" : "├─"} ${leafText(leaf, now)}`)];
@@ -25492,7 +25783,7 @@ const nextStepsFor = (place, wait) => `Wait on it with ref0 runs waiting ${wait.
 /** Says a waiting start's tree on stderr, as it stands now. */
 const sayTree = Effect.fnUntraced(function* (wait) {
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* Console.error(printable(waitingLines(wait, now)));
+	yield* Console.error(printable(waitingLines$1(wait, now)));
 });
 /**
 * Waits on a start that waits until it goes on or ends, or 9 minutes pass: what it got, printed
@@ -25639,7 +25930,7 @@ const run = Command.make("run", {
 		value
 	}, asJson, rerunCommand);
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* printAnswer(answer.json, asJson, `${waitingLines(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
+	yield* printAnswer(answer.json, asJson, `${waitingLines$1(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
 }).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("Run a check on main, or on a thread’s head: a run it ran already is answered, not run again, unless the check says reuse: false. A start its check’s start rule makes wait shows what it waits on, and waits up to 9 minutes for it, unless --no-wait. With --local, run a check of the thread’s open version on this machine, and report it"), Command.withShortDescription("Run a check on main or a thread’s head"));
 const trace = Command.make("trace", {
 	run: Argument.String("run").pipe(Argument.withDescription("The run, as checkrun_… or workflowrun_…")),
@@ -25717,7 +26008,7 @@ const waiting$1 = Command.make("waiting", {
 		value
 	}, asJson, rerunCommand);
 	const now = DateTime.makeUnsafe(yield* Clock.currentTimeMillis);
-	yield* printAnswer(answer.json, asJson, `${waitingLines(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
+	yield* printAnswer(answer.json, asJson, `${waitingLines$1(value.waiting, now)}\n${nextStepsFor(place, value.waiting)}`);
 }).pipe(Effect.catchTag("CallFailed", failedWith$13))).pipe(Command.withDescription("A start of yours its check’s start rule made wait: what it waits on, as a tree, waiting up to 9 minutes for it to go on or end, unless --no-wait"), Command.withShortDescription("Show what a waiting start waits on"));
 /** What a cancel did, in words. */
 const cancelledText = {
@@ -25836,19 +26127,21 @@ const checksCommands = [Command.make("checks").pipe(Command.withDescription("A r
 //#endregion
 //#region src/gate-lines.ts
 /**
-* A pull request's gate as `ref0 gate` says it: its current version, whether its needs are
-* answered, the project gate's revision and whether it failed, and each need on its own line
-* with where it came from, ref0's floor or the line of `.ref0/gate.ts`, or of the project gate's,
-* that returned it, with that line's code. A need for one of the project's checks says the
-* project gate revision whose checks run for it, the version's own. Then what each gate read of
-* the change, each read's tree, path and the object it found, short. Then its gate decided again
-* in place under `main`'s `.ref0/`, with `main`'s commit: the needs it held, or those that grew,
-* and why. Then the additions standing on the pull request now, each with the ID `ref0 pr needs
-* remove` takes: the version's own say who added its needs when it was made, and one may have gone
-* since. Then the local runs of its parts' identities, each with its signer; each part that takes
-* local or needs a yes, with its wrappers, the run and the yeses that meet it or what it waits for;
-* and last, each signer revoked from answering one of their checks, an attachment or a person by
-* name, with how an admin restores them.
+* A pull request's gate as `ref0 gate` says it: its current version, whether its gate returned its
+* needs, and once it's open, how many still wait and whose one yes would meet them all; the project
+* gate's revision and whether it failed; and each need on its own line with where it came from,
+* ref0's floor or the line of `.ref0/gate.ts`, or of the project gate's, that returned it, with
+* that line's code, and under it whether it's met, by whose yes, or on whom or what it waits; in an
+* organization, what one yes gives its giver. A need for one of the project's checks says the
+* project gate revision whose checks run for it, the version's own. Then what each gate read of the
+* change, each read's tree, path and the object it found, short. Then its gate decided again in
+* place under `main`'s `.ref0/`, with `main`'s commit: the needs it held, or those that grew, and
+* why. Then the additions standing on the pull request now, each with the ID `ref0 pr needs remove`
+* takes: the version's own say who added its needs when it was made, and one may have gone since.
+* Then the local runs of its parts' identities, each with its signer; each part that takes local or
+* needs a yes, with its wrappers, the run and the yeses that meet it or what it waits for; and
+* last, each signer revoked from answering one of their checks, an attachment or a person by name,
+* with how an admin restores them.
 */
 const fromWords = (from) => {
 	switch (from.kind) {
@@ -25879,11 +26172,116 @@ const columns = (lines) => {
 * version was decided under, whose checks run for it, never `main`'s.
 */
 const noteOf = (need, view) => need.kind === "check" && need.source === "project" && view.projectRevision !== void 0 ? `  at gate revision ${view.projectRevision}` : "";
-const stateWords = (view) => {
+const isPerson = Schema.is(PersonId);
+/** An owner or a person, by name where it's known. */
+const nameOf = (id, named) => named.names.get(id) ?? id;
+/** The admins of an owner, in words: at home, its person alone, by name. */
+const adminsOf = (owner, named) => isPerson(owner) ? nameOf(owner, named) : `an admin of ${nameOf(owner, named)}`;
+/** Who answers as a decider, in words: a person by their name, a check by its key. */
+const whoWords = (decider, named) => {
+	switch (decider.kind) {
+		case "person": return nameOf(decider.id, named);
+		case "role": return adminsOf(decider.owner, named);
+		case "permission": return adminsOf(named.owner, named);
+		case "check": return checkKey(decider);
+		case "agent": return decider.id;
+		case "override": return whoWords(decider.by, named);
+	}
+};
+/** Alternatives in words, each once: `pip or an admin of acme`. */
+const anyOf = (deciders, named) => [...new Set(deciders.map((each) => whoWords(each, named)))].join(" or ");
+/** A yes that met a need, in words: whose, or the check that passed or was overridden. */
+const needYesWords = (yes, named) => {
+	if (yes.decider.kind === "check") return `${checkKey(yes.decider)} ${yes.overridden === true ? "overridden" : "passed"}`;
+	if (yes.by === void 0) return `${whoWords(yes.decider, named)}’s yes`;
+	const by = nameOf(yes.by, named);
+	return yes.decider.kind === "person" ? `${by}’s yes` : `${by}’s yes, as an admin`;
+};
+/** An override left of a check, in words: whose yes overrides which of its noes. */
+const overrideWords = (check, left, named) => `a yes from ${whoWords(left.by, named)} to override ${left.of === "failed run" ? `${check}’s failed run` : `${check} not running`}`;
+/**
+* One decider a need waits on, in words: a check to pass, or its parts when the need wraps it,
+* or, once ref0 said no to it, every override left.
+*/
+const waitWords = (wait, need, named) => {
+	if (wait.decider.kind !== "check") return whoWords(wait.decider, named);
+	const check = checkKey(wait.decider);
+	if (wait.overrides === void 0) return need.kind === "check" && (need.local === true || need.passkey !== void 0) ? `${check}’s parts, as below` : `${check} to pass`;
+	if (wait.overrides.length === 0) return `${check}, which ref0 said no to`;
+	return [...new Set(wait.overrides.map((left) => overrideWords(check, left, named)))].join(", and ");
+};
+/** The decider keys whose answers meet a need, for telling two needs met by the same yes. */
+const yesKey = (standing) => {
+	if (standing.state === "met" && "by" in standing && standing.by.every(({ decider }) => decider.kind !== "check")) return standing.by.map(({ decider }) => deciderKey(decider)).join(" ");
+	if (standing.state === "waiting" && "on" in standing && !standing.all) return standing.on.map(({ decider }) => deciderKey(decider)).join(" ");
+};
+/** How a need stands, in words. */
+const standingWords = (standing, need, named) => {
+	switch (standing.state) {
+		case "refused": return `refused: ${nameOf(standing.by, named)} said no, which decides the gate no`;
+		case "met": {
+			if ("as" in standing) return standing.as === "no checks" ? "met: no check runs on this change" : "met: the merge queue’s tip runs it, and main moves only once it passes there";
+			const people = /* @__PURE__ */ new Map();
+			for (const yes of standing.by) {
+				const who = yes.by ?? deciderKey(yes.decider);
+				if (!people.has(who)) people.set(who, yes);
+			}
+			const yeses = [...new Set([...people.values()].map((yes) => needYesWords(yes, named)))];
+			return standing.by.some(({ decider }) => decider.kind === "check") ? `met: ${yeses.join(", ")}` : `met by ${yeses.join(" and ")}`;
+		}
+		case "waiting": {
+			if ("for" in standing) return "waiting for ref0 to read which of main’s checks run on this change";
+			if (standing.all) return `waiting for ${standing.on.map((wait) => waitWords(wait, need, named)).join(", and ")}`;
+			const asked = `a yes from ${anyOf(standing.on.map(({ decider }) => decider), named)}`;
+			return need.kind === "check" || need.kind === "checks" ? `waiting on ${asked}: no run can meet it before main moves` : `waiting on ${asked}`;
+		}
+	}
+};
+/**
+* Who one yes would meet a waiting need with, in words, each alone: anyone it asks a yes of, or
+* the one answerer of every override it waits on; none for a check to pass.
+*/
+const meetersOf = (standing, named) => {
+	if (standing.state !== "waiting" || !("on" in standing)) return [];
+	if (!standing.all) return standing.on.map(({ decider }) => whoWords(decider, named));
+	const answerers = new Set(standing.on.flatMap(({ overrides }) => overrides === void 0 || overrides.length === 0 ? [""] : overrides.map((left) => whoWords(left.by, named))));
+	return answerers.size === 1 && !answerers.has("") ? [...answerers] : [];
+};
+/** An open gate's standings, or none until every need has one. */
+const standingsOf = (needs) => {
+	const standings = needs.flatMap(({ standing }) => standing === void 0 ? [] : [standing]);
+	return standings.length === 0 || standings.length < needs.length ? void 0 : standings;
+};
+/**
+* Where an open gate's needs stand, after its state: each met; refused, by whom; or how many
+* still wait, and whose one yes would meet them all, since one yes answers every decider its
+* person may answer as.
+*/
+const standsWords = (needs, named) => {
+	const standings = standingsOf(needs);
+	if (standings === void 0) return "";
+	const refused = standings.find((each) => each.state === "refused");
+	if (refused !== void 0 && refused.state === "refused") return `; ${nameOf(refused.by, named)} said no, which decides it no`;
+	const waiting = standings.filter((each) => each.state === "waiting");
+	if (waiting.length === 0) return "; each need is met";
+	const [first, ...rest] = waiting.map((each) => meetersOf(each, named));
+	const common = (first ?? []).filter((who) => rest.every((each) => each.includes(who)));
+	const still = waiting.length === 1 ? "1 still waits" : `${waiting.length} still wait`;
+	if (common.length === 0) return `; ${still}`;
+	return `; ${still}, and one yes from ${[...new Set(common)].join(" or ")} meets ${waiting.length === 1 ? "it" : "them all"}`;
+};
+/**
+* In an organization, what one yes gives, under the needs, while one waits on a yes: every
+* approval and override its giver may give, so an admin's meets every need an admin may meet.
+*/
+const oneYesLines = (view, named) => {
+	return (standingsOf(view.needs) ?? []).some((each) => each.state === "waiting" && "on" in each && each.on.some(({ decider, overrides }) => decider.kind !== "check" || overrides !== void 0)) && !isPerson(view.owner) ? [`  one yes to this gate gives every approval and override above its giver may give, as themselves and as ${adminsOf(view.owner, named)}`] : [];
+};
+const stateWords = (view, named) => {
 	switch (view.state) {
-		case "pending": return "its gate hasn’t answered yet";
-		case "answered": return "answered";
-		case "failed": return `its gate failed: ${view.why ?? "ref0 couldn’t run it"}`;
+		case "pending": return "its gate hasn’t returned its needs yet";
+		case "answered": return `its gate returned its needs${standsWords(view.needs, named)}`;
+		case "failed": return `its gate failed: ${view.why ?? "ref0 couldn’t run it"}${standsWords(view.needs, named)}`;
 	}
 };
 /** The project gate's line, under the head: its revision, and why it failed. */
@@ -25891,7 +26289,7 @@ const projectWords$1 = (view) => {
 	const project = view.projectGate;
 	if (project === void 0) return [];
 	const at = `  project gate, revision ${project.revision}`;
-	return [project.state === "failed" ? `${at}: failed: ${project.why ?? "ref0 couldn’t run it"}, so an admin answers it` : `${at}: ${project.state}`];
+	return [project.state === "failed" ? `${at}: failed: ${project.why ?? "ref0 couldn’t run it"}, so an admin answers it` : `${at}: ${project.state === "pending" ? "hasn’t returned its needs yet" : "returned its needs"}`];
 };
 /**
 * What a gate read of the change, under `head`: each read's tree, its path and the object it
@@ -25906,6 +26304,23 @@ const needLines = (needs, view) => columns(needs.map(({ need, from }) => ({
 	need: spellNeed(need),
 	from: `${from.map(fromWords).join("; ")}${noteOf(need, view)}`
 })));
+/**
+* The version's needs, each with how it stands on the line under it, once its gate is open: a
+* need met by, or waiting on, the same yes as one above says so.
+*/
+const standingLines = (view, named) => {
+	const lines = needLines(view.needs, view);
+	const seen = /* @__PURE__ */ new Map();
+	return view.needs.flatMap(({ need, standing }, i) => {
+		const line = lines[i] ?? "";
+		if (standing === void 0) return [line];
+		const key = yesKey(standing);
+		const same = key === void 0 ? void 0 : seen.get(key);
+		if (key !== void 0 && same === void 0) seen.set(key, need);
+		const also = same === void 0 ? "" : `, the same yes as ${spellNeed(same)}`;
+		return [line, `    ${standingWords(standing, need, named)}${also}`];
+	});
+};
 const grewWords = (grew) => {
 	const why = grew.why ?? "ref0 couldn’t say why";
 	switch (grew.kind) {
@@ -25917,7 +26332,7 @@ const grewWords = (grew) => {
 };
 const inPlaceLines = (inPlace, view) => {
 	const head = `under main’s .ref0/, at ${inPlace.main.slice(0, 7)}:`;
-	if (inPlace.state === "pending") return [`${head} its gate there hasn’t answered yet`];
+	if (inPlace.state === "pending") return [`${head} its gate there hasn’t returned its needs yet`];
 	const reads = readLines("its gate there read:", inPlace.reads ?? []);
 	if (inPlace.state === "held" || inPlace.grew === void 0) return [
 		`${head} ${inPlace.state}`,
@@ -25991,7 +26406,11 @@ const wrappedPartLines = (parts) => parts.length === 0 ? [] : ["parts that take
 const revokedSignerLines = (one) => one.kind === "attachment" ? [`  ${one.check}  attachment ${one.attachment.id} of ${one.attachment.person}, since ${DateTime.formatIso(one.at)}: ref0 failed local run ${one.signed}'s identity twice, the second in run ${one.failed}`, `    an admin restores it: ref0 checks signers restore ${one.check} --attachment ${one.attachment.id}`] : [`  ${one.check}  ${one.person}, since ${DateTime.formatIso(one.at)}: ref0 failed the identity of run ${one.signed}, which they said yes over, twice, the second in run ${one.failed}`, `    an admin restores them: ref0 checks signers restore ${one.check} --person ${one.person}`];
 const revokedLines = (revoked) => revoked.length === 0 ? [] : ["signers revoked:", ...revoked.flatMap(revokedSignerLines)];
 const gateLines = (view, repo) => {
-	const head = `${repo}#${view.pullRequest}, version ${view.version}: ${stateWords(view)}`;
+	const named = {
+		names: new Map((view.names ?? []).map(({ owner, name }) => [owner, name])),
+		owner: view.owner
+	};
+	const head = `${repo}#${view.pullRequest}, version ${view.version}: ${stateWords(view, named)}`;
 	const inPlace = view.inPlace === void 0 ? [] : inPlaceLines(view.inPlace, view);
 	const added = view.added.map(({ need, from }) => ({
 		need: spellNeed(need),
@@ -26003,7 +26422,8 @@ const gateLines = (view, repo) => {
 	return [
 		head,
 		...projectWords$1(view),
-		...needLines(view.needs, view),
+		...standingLines(view, named),
+		...oneYesLines(view, named),
 		...readLines("its gate read:", view.reads),
 		...readLines("its project gate read:", view.projectGate?.reads ?? []),
 		...inPlace,
@@ -26058,7 +26478,7 @@ const gateCommands = [Command.make("gate", {
 		}
 	});
 	yield* printAnswer(answer.json, asJson, gateLines(answer.value, repo));
-}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("A pull request’s needs, each with where it came from: ref0’s floor, or a line of .ref0/gate.ts; with --project, the project gate"), Command.withShortDescription("Show a pull request’s or project’s gate"))];
+}).pipe(Effect.catchTag("CallFailed", failedWith$11))).pipe(Command.withDescription("A pull request’s needs, each with where it came from, ref0’s floor or a line of .ref0/gate.ts, and whether it’s met or on whom it waits; with --project, the project gate"), Command.withShortDescription("Show a pull request’s or project’s gate"))];
 //#endregion
 //#region src/clone.ts
 /** The remote a clone pushes to: its thread's fork path, named as the thread is. */
@@ -27508,18 +27928,28 @@ const repoCommands = [Command.make("repos", {
 //#endregion
 //#region src/decision-lines.ts
 /** A decision in words, as `ref0 waiting`, `ref0 decision` and `ref0 answer` print it. */
-/** What a decision is about, in words. */
-const subjectWords = (subject) => {
-	switch (subject.kind) {
-		case "thread": return subject.thread;
-		case "version": return `version ${subject.version} of pull request ${subject.pullRequest} in ${subject.repo}, from ${subject.thread}`;
-	}
-};
+/** What a decision is about, in words: its thread, and a gate's version of its pull request. */
+const subjectWords = ({ subject, names }) => subject.kind === "version" && names.pullRequest !== void 0 ? `version ${subject.version} of ${names.pullRequest}, from ${names.thread}` : names.thread;
 /** A decision in a line. */
-const decisionLines = (view) => {
-	const on = subjectWords(view.subject);
-	const answers = view.options.map((option) => option.key).join(" or ");
-	return view.state === "open" ? `${view.decision}  on ${on}: ${answers}` : `${view.decision}  on ${on}: ${view.result ?? "no answer"}, ${view.closedWhy ?? "closed"}`;
+const decisionLines = (decision) => {
+	const on = subjectWords(decision);
+	const answers = decision.options.map((option) => option.key).join(" or ");
+	return decision.state === "open" ? `${decision.decision}  on ${on}: ${answers}` : `${decision.decision}  on ${on}: ${decision.result ?? "no answer"}, ${decision.closedWhy ?? "closed"}`;
+};
+const nothing = "Nothing waits on you here.";
+/**
+* What waits, as `ref0 waiting` prints it: what waits on the caller, then, for an agent, what
+* waits on its person, which they answer on their own page.
+*/
+const waitingLines = (decisions) => {
+	const yours = decisions.flatMap((decision) => decision.waitsOn === "you" ? [decisionLines(decision)] : []);
+	const theirs = decisions.flatMap((decision) => decision.waitsOn === "your person" ? [`  ${decisionLines(decision)}`] : []);
+	if (theirs.length === 0) return yours.length === 0 ? nothing : yours.join("\n");
+	return [
+		...yours,
+		"Waits on your person, under Waiting on you on their page:",
+		...theirs
+	].join("\n");
 };
 //#endregion
 //#region src/commands/plans.ts
@@ -27713,9 +28143,7 @@ const planCommands = [
 			endpoint: "decisions.waiting",
 			params: scopeParams(address)
 		}));
-		const { decisions } = answer.value;
-		const words = decisions.length === 0 ? "Nothing waits on you here." : decisions.map((each) => decisionLines(each)).join("\n");
-		yield* printAnswer(answer.json, asJson, words);
+		yield* printAnswer(answer.json, asJson, waitingLines(answer.value.decisions));
 	}).pipe(Effect.catchTag("CallFailed", (failed) => sayFailed(failed.nextStep)))).pipe(Command.withDescription("What in a project, or in an organization’s org threads, waits on you"), Command.withShortDescription("Show what waits on you")),
 	Command.make("decision", {
 		project: project$2,
@@ -34168,6 +34596,7 @@ const startServer = Effect.fnUntraced(function* (harness, configFolder, plugin,
 		CLAUDE_CONFIG_DIR: configFolder,
 		...checked
 	};
+	const withheld = Object.keys(yield* fromHere(keychainVariables)).some((variable) => env[variable] === void 0);
 	return yield* Effect.scoped(Effect.gen(function* () {
 		const handle = yield* spawner.spawn(ChildProcess.make(server.value.command, server.value.args, {
 			cwd: yield* emptyFolder(fs),
@@ -34182,6 +34611,7 @@ const startServer = Effect.fnUntraced(function* (harness, configFolder, plugin,
 		const said = yield* handle.stderr.pipe(Stream.decodeText(), Stream.mkString, Effect.forkScoped);
 		const lines = yield* handle.stdout.pipe(Stream.decodeText(), Stream.splitLines, Stream.takeUntil((line) => Option.isSome(decodeAnswer(line))), Stream.runCollect);
 		if (lines.some((line) => Option.isSome(decodeAnswer(line)))) return { kind: "answered" };
+		if (withheld) return { kind: "withoutKeychain" };
 		return {
 			kind: "stopped",
 			said: firstLine(yield* Fiber.join(said)) || firstLine(lines.join("\n"))
@@ -34252,6 +34682,7 @@ const serverCheckOf = (started, configFolder) => {
 	switch (started.kind) {
 		case "answered": return checkOf("server", "yes", "starts");
 		case "stopped": return checkOf("server", "no", started.said === "" ? "can’t start, and said nothing" : `can’t start: ${started.said}`, installLine(configFolder));
+		case "withoutKeychain": return checkOf("server", "no", "can’t reach the keychain, since an older ref0 installed it", installLine(configFolder));
 		case "unnamed": return checkOf("server", "no", "the plugin names no ref0 server", installLine(configFolder));
 		case "unanswered": return checkOf("server", "unknown", `didn’t answer in ${Duration.toSeconds(serverLimit)} s`, "ref0 status");
 	}